pendingyou 0.9.0 → 0.10.0

package/dist/claude.js

@@ -7,13 +7,20 @@
 // Since 0.7.0 the hooks run a private copy of this version with Node directly (install.ts), and init asks Claude Code
 // itself as little as it can: `claude mcp get` and `claude mcp add` each take up to a minute or more (Claude Code checks
 // its servers), so the MCP server is looked up in ~/.claude.json first (read only), and init says what it's waiting on.
+//
+// Since 0.10.0, on Claude Code 2.1.287 or later, settings' env.CLAUDE_CODE_PLUGIN_DIRS also loads the wake mod from
+// that private copy (mod.ts), so a session is woken when the person answers, with no hold running. And on a computer
+// with no browser (remote.ts) the MCP server is added with a headersHelper, `claude mcp add-json`, which signs Claude
+// Code in through this computer's own sign-in instead of OAuth.
 import { createHash } from 'node:crypto';
-import { rm, rmdir } from 'node:fs/promises';
+import { rm, rmdir, stat } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { DEFAULT_ORIGIN } from "./args.js";
 import { PlainError } from "./errors.js";
 import { claudeDir, configDir, readJson, readText, writeWhole } from "./files.js";
-import { hookForm, hookRuns, installCli, pruneCli, removeCli, shellQuote, } from "./install.js";
+import { cliPackage, hookForm, hookRuns, installCli, pruneCli, removeCli, shellQuote, } from "./install.js";
+import { claudeVersion, isOurModDir, loadsMods, modDir, PLUGIN_DIRS, pluginDirs, pluginEnabled, separatorFor, withModDir, } from "./mod.js";
+import { helperCommand, helperPath, isOurHelper, removeHelper, writeHelper } from "./remote.js";
 import { VERSION } from "./version.js";
 export const MCP_NAME = 'pendingyou';
 /** The hooks, by Claude Code event, and the command each runs. */
@@ -212,7 +219,12 @@ export async function mcpFromFile(io) {
     if (typeof server !== 'object' || server === null)
         return 'unknown';
     const url = server.url;
-    return { url: typeof url === 'string' ? url : null, scope: 'user' };
+    const helper = server.headersHelper;
+    return {
+        url: typeof url === 'string' ? url : null,
+        scope: 'user',
+        helper: typeof helper === 'string' ? helper : null,
+    };
 }
 /** `claude mcp get pendingyou`'s answer: the server, null when there isn't one, 'timeout' when it took too long. */
 async function mcpFromClaude(io) {
@@ -239,7 +251,10 @@ const removeCommand = (scope) => `claude mcp remove${scope ? ` --scope ${scope}`
 async function addMcp(io, origin, options, progress) {
     const url = `${origin}/mcp`;
     let existing = await mcpFromFile(io);
-    if (existing !== 'unknown' && existing?.url && sameUrl(existing.url, url))
+    if (existing !== 'unknown' &&
+        existing?.url &&
+        sameUrl(existing.url, url) &&
+        !isOurHelper(existing.helper))
         return {
             added: false,
             step: { ok: true, text: `The pendingyou MCP server (${url}) was already in Claude Code.` },
@@ -266,7 +281,9 @@ async function addMcp(io, origin, options, progress) {
             };
     }
     let replacing = null;
-    if (existing) {
+    // `init --browser` where Claude Code signed in through this computer's helper (remote.ts): back to its own sign-in.
+    const helped = existing && isOurHelper(existing.helper) && (!existing.url || sameUrl(existing.url, url));
+    if (existing && !helped) {
         if (!existing.url || sameUrl(existing.url, url))
             return {
                 added: false,
@@ -307,6 +324,19 @@ async function addMcp(io, origin, options, progress) {
             };
         replacing = existing;
     }
+    if (existing && helped) {
+        progress('Removing the pendingyou MCP server that signs in through this computer’s helper…\n');
+        const removed = await io.run('claude', ['mcp', 'remove', ...(existing.scope ? ['--scope', existing.scope] : []), MCP_NAME], MCP_TIMEOUT_MS);
+        if (removed.code !== 0)
+            return {
+                added: false,
+                step: {
+                    ok: false,
+                    text: `Claude Code didn’t remove the MCP server that signs in through this computer’s helper. Run:\n  ${removeCommand(existing.scope)}\n    ${addCommand(url)}`,
+                },
+            };
+        replacing = existing;
+    }
     progress('Adding the pendingyou MCP server to Claude Code (this can take a minute)…\n');
     const add = await io.run('claude', ['mcp', 'add', '--scope', 'user', '--transport', 'http', MCP_NAME, url], MCP_TIMEOUT_MS);
     if (add.code === 0)
@@ -314,9 +344,11 @@ async function addMcp(io, origin, options, progress) {
             added: true,
             step: {
                 ok: true,
-                text: replacing
-                    ? `Replaced the pendingyou MCP server (was ${replacing.url}) with ${url}. Restart Claude Code, then run /mcp, choose pendingyou and Authenticate.`
-                    : `Added the pendingyou MCP server (${url}) for every project.`,
+                text: !replacing
+                    ? `Added the pendingyou MCP server (${url}) for every project.`
+                    : isOurHelper(replacing.helper) && replacing.url && sameUrl(replacing.url, url)
+                        ? `Switched the pendingyou MCP server (${url}) from this computer’s sign-in to your browser’s. Restart Claude Code, then run /mcp, choose pendingyou and Authenticate.`
+                        : `Replaced the pendingyou MCP server (was ${replacing.url}) with ${url}. Restart Claude Code, then run /mcp, choose pendingyou and Authenticate.`,
             },
         };
     return {
@@ -329,6 +361,122 @@ async function addMcp(io, origin, options, progress) {
         },
     };
 }
+/** `claude mcp add-json`'s arguments for the server signed in through the helper, and the same as a command to type. */
+function helperServer(url, command) {
+    const json = JSON.stringify({ type: 'http', url, headersHelper: command });
+    return {
+        args: ['mcp', 'add-json', '--scope', 'user', MCP_NAME, json],
+        text: `claude mcp add-json --scope user ${MCP_NAME} ${quote(json)}`,
+    };
+}
+/**
+ * On a computer with no browser (remote.ts): the MCP server at user scope with the helper as its headersHelper, so
+ * Claude Code signs in through this computer's sign-in and never needs Authenticate. One already like that is kept. One
+ * at this origin that signs in through a browser (a plain `claude mcp add`, which can't finish here) is switched over
+ * without asking: it's the same Pending You. One with a headersHelper of someone else's is kept, with the commands to
+ * switch. One at another origin is replaced as addMcp replaces it: once the person agrees.
+ */
+async function addMcpWithHelper(io, origin, command, options, progress) {
+    const url = `${origin}/mcp`;
+    const add = helperServer(url, command);
+    let existing = await mcpFromFile(io);
+    if (existing !== 'unknown' &&
+        existing?.url &&
+        sameUrl(existing.url, url) &&
+        existing.helper === command)
+        return {
+            added: false,
+            step: {
+                ok: true,
+                text: `The pendingyou MCP server (${url}) already signs in through this computer’s sign-in.`,
+            },
+        };
+    const version = await io.run('claude', ['--version'], 20_000);
+    if (version.code === 127)
+        return {
+            added: false,
+            step: {
+                ok: false,
+                text: `Claude Code isn’t on this computer’s PATH. Install it, then run init again, or run: ${add.text}`,
+            },
+        };
+    if (existing === 'unknown') {
+        progress('Checking Claude Code’s MCP servers (this can take a minute)…\n');
+        existing = await mcpFromClaude(io);
+        if (existing === 'timeout')
+            return {
+                added: false,
+                step: {
+                    ok: false,
+                    text: `Claude Code took more than 3 minutes to list its MCP servers, so I left them alone. Check with: claude mcp get ${MCP_NAME}. If it isn’t there, run: ${add.text}`,
+                },
+            };
+    }
+    let replacing = null;
+    if (existing) {
+        const commands = `  ${removeCommand(existing.scope)}\n    ${add.text}`;
+        const here = !existing.url || sameUrl(existing.url, url);
+        if (here && existing.helper && !isOurHelper(existing.helper))
+            return {
+                added: false,
+                step: {
+                    ok: false,
+                    text: `Kept the pendingyou MCP server: it signs in through a headersHelper of its own (${existing.helper}). To use this computer’s sign-in instead, run:\n  ${commands}`,
+                },
+            };
+        if (!here) {
+            progress(`Claude Code’s pendingyou MCP server points at ${existing.url}, not ${url}.\n`);
+            let replace = options.yes;
+            if (!replace && io.interactive) {
+                const answer = await io.ask(`Replace it with ${url}? [y/N] `);
+                replace = /^\s*y(es)?\s*$/i.test(answer);
+            }
+            if (!replace)
+                return {
+                    added: false,
+                    step: {
+                        ok: false,
+                        text: `Kept the MCP server at ${existing.url}. To use ${url}, run init again with --yes, or run:\n  ${commands}`,
+                    },
+                };
+        }
+        progress('Removing the old pendingyou MCP server (this can take a minute)…\n');
+        const removed = await io.run('claude', ['mcp', 'remove', ...(existing.scope ? ['--scope', existing.scope] : []), MCP_NAME], MCP_TIMEOUT_MS);
+        if (removed.code !== 0)
+            return {
+                added: false,
+                step: {
+                    ok: false,
+                    text: `${removed.code === 124 ? 'Claude Code took more than 3 minutes to remove' : 'Claude Code didn’t remove'} the old MCP server. Run:\n  ${commands}`,
+                },
+            };
+        replacing = existing;
+    }
+    progress('Adding the pendingyou MCP server to Claude Code…\n');
+    const added = await io.run('claude', add.args, MCP_TIMEOUT_MS);
+    if (added.code !== 0)
+        return {
+            added: false,
+            step: {
+                ok: false,
+                text: added.code === 124
+                    ? `Claude Code took more than 3 minutes to add the MCP server. Check with: claude mcp get ${MCP_NAME}. If it isn’t there, run: ${add.text}`
+                    : `Claude Code didn’t add the MCP server. Run: ${add.text}`,
+            },
+        };
+    const how = `It signs in through this computer’s sign-in (${helperPath(io)}): no browser, nothing to Authenticate.`;
+    return {
+        added: true,
+        step: {
+            ok: true,
+            text: !replacing
+                ? `Added the pendingyou MCP server (${url}) for every project. ${how}`
+                : replacing.url && !sameUrl(replacing.url, url)
+                    ? `Replaced the pendingyou MCP server (was ${replacing.url}) with ${url}. ${how} Restart Claude Code.`
+                    : `Switched the pendingyou MCP server (${url}) from a browser sign-in, which can’t finish on this computer, to this computer’s own. ${how}`,
+        },
+    };
+}
 /** The stub skill: written when it isn't there, or refreshed while it's still the one init wrote. */
 async function saveSkill(io, origin, before) {
     const path = skillPath(io);
@@ -363,7 +511,11 @@ async function saveSkill(io, origin, before) {
         step: { ok: true, text: `Saved the skill to ${path}.` },
     };
 }
-/** Everything init does in Claude Code (not the sign-in). Idempotent. Each step is reported as it's done. */
+/**
+ * Everything init does in Claude Code (not the sign-in). Idempotent. Each step is reported as it's done. `remote`: a
+ * computer with no browser (remote.ts), where the MCP server signs in through the helper, which runs the hooks' copy,
+ * so that copy comes first.
+ */
 export async function installClaude(io, origin, options = {}) {
     const before = await readManifest(io);
     const steps = [];
@@ -372,13 +524,11 @@ export async function installClaude(io, origin, options = {}) {
         options.report?.(step);
     };
     const progress = (text) => io.out(text);
-    const mcp = await addMcp(io, origin, { yes: options.yes ?? false }, progress);
-    report(mcp.step);
-    const skill = await saveSkill(io, origin, before?.skill ?? null);
-    report(skill.step);
     // The hooks' own copy of this version, unless PENDINGYOU_SELF says what they run.
     let installed = null;
-    if (!io.env.PENDINGYOU_SELF) {
+    const installCopy = async () => {
+        if (io.env.PENDINGYOU_SELF)
+            return;
         const cli = await installCli(io, progress);
         installed = cli.installed;
         report(cli.installed
@@ -387,26 +537,66 @@ export async function installClaude(io, origin, options = {}) {
                 text: `${cli.installed.how === 'kept' ? `pendingyou ${VERSION} for the hooks was already in` : `Installed pendingyou ${VERSION} for the hooks in`} ${cli.installed.prefix} (they run it with ${cli.installed.node}, no npx).`,
             }
             : {
-                ok: true,
+                ok: !options.remote,
                 text: `Couldn’t install pendingyou for the hooks (${cli.error}), so they run it through npx, which is slower. Run init again to retry.`,
             });
+    };
+    let mcp;
+    let helper = null;
+    if (options.remote) {
+        await installCopy();
+        const copy = installed;
+        const written = copy ? await writeHelper(io, copy).catch(() => null) : null;
+        if (written) {
+            helper = { path: written.path, command: helperCommand(io, origin) };
+            report({
+                ok: true,
+                text: written.changed
+                    ? `Saved Claude Code’s sign-in helper for this computer: ${written.path}.`
+                    : 'Claude Code’s sign-in helper was already in place.',
+            });
+            mcp = await addMcpWithHelper(io, origin, helper.command, { yes: options.yes ?? false }, progress);
+        }
+        else
+            mcp = {
+                added: false,
+                step: {
+                    ok: false,
+                    text: copy
+                        ? `Couldn’t write Claude Code’s sign-in helper to ${helperPath(io)}. Run init again.`
+                        : 'Didn’t add the pendingyou MCP server: on this computer it signs in through pendingyou’s own copy, which isn’t installed. Run init again.',
+                },
+            };
+        report(mcp.step);
+    }
+    else {
+        mcp = await addMcp(io, origin, { yes: options.yes ?? false }, progress);
+        report(mcp.step);
     }
+    const skill = await saveSkill(io, origin, before?.skill ?? null);
+    report(skill.step);
+    if (!options.remote)
+        await installCopy();
+    const copy = installed;
     const commands = Object.fromEntries(Object.keys(HOOKS).map((event) => [
         event,
-        hookCommand(io, origin, HOOKS[event], installed),
+        hookCommand(io, origin, HOOKS[event], copy),
     ]));
     const merged = mergeSettings(await readSettings(io), commands);
-    if (merged.changed)
-        await writeSettings(io, merged.settings);
     report({
         ok: true,
         text: merged.changed
             ? `Installed or updated the session-start pickup, next-message hand-off and Stop check hooks in ${settingsPath(io)}.`
             : 'The hooks were already installed.',
     });
+    const mod = await addMod(io, merged.settings, copy);
+    if (mod.step)
+        report(mod.step);
+    if (merged.changed || mod.changed)
+        await writeSettings(io, mod.settings);
     // The hooks run this version now (or npx): the copies of other versions are no longer used.
     if (!io.env.PENDINGYOU_SELF)
-        await pruneCli(io, installed?.version ?? null);
+        await pruneCli(io, copy?.version ?? null);
     const manifest = {
         version: 1,
         origin,
@@ -415,25 +605,69 @@ export async function installClaude(io, origin, options = {}) {
         skill: skill.skill,
         hooks: commands,
         permissions: [...new Set([...(before?.permissions ?? []), ...merged.permissionsAdded])],
-        cli: installed ? { version: installed.version, prefix: installed.prefix } : null,
+        cli: copy ? { version: copy.version, prefix: copy.prefix } : null,
+        modDir: mod.dir,
+        // A remote setup's helper stays recorded when this run couldn't redo it, so uninstall still takes it out.
+        helper: helper ?? (options.remote ? (before?.helper ?? null) : null),
     };
     await writeWhole(manifestPath(io), `${JSON.stringify(manifest, null, 2)}\n`, { secret: true });
     return steps;
 }
+const exists = (path) => stat(path).then(() => true, () => false);
+/**
+ * The wake mod in Claude Code's settings (0.10.0): on Claude Code 2.1.287 or later, this version's copy in
+ * CLAUDE_CODE_PLUGIN_DIRS, every other entry kept and an older version's replaced. Nothing, and nothing said, for an
+ * older Claude Code or none. Without the hooks' private copy there's no folder to point at, so it says so.
+ */
+async function addMod(io, settings, installed) {
+    const unchanged = { settings, changed: false, dir: null };
+    const result = await io.run('claude', ['--version'], 20_000);
+    const version = result.code === 0 ? claudeVersion(result.stdout) : null;
+    if (!version || !loadsMods(version))
+        return unchanged;
+    const dir = installed ? modDir(cliPackage(installed.prefix)) : null;
+    if (!dir || !(await exists(join(dir, 'hooks', 'hooks.json'))))
+        return {
+            ...unchanged,
+            step: {
+                ok: true,
+                text: 'Couldn’t add the wake mod without the hooks’ own copy of pendingyou, so Claude Code hears answers through hold for now. Run init again to retry.',
+            },
+        };
+    const added = withModDir(settings, dir, separatorFor(io.platform));
+    if ('invalid' in added)
+        return { ...unchanged, step: { ok: false, text: added.invalid } };
+    return {
+        settings: added.settings,
+        changed: added.changed,
+        dir,
+        step: {
+            ok: true,
+            text: added.changed
+                ? `Added the wake mod to ${PLUGIN_DIRS} in ${settingsPath(io)}: Claude Code ${version} wakes a session when you answer, with no hold running.`
+                : 'The wake mod was already in Claude Code’s settings.',
+        },
+    };
+}
 /** Removes what init added: the hooks, its permissions, its skill (if unchanged), its MCP server. */
 export async function uninstallClaude(io) {
     const manifest = await readManifest(io);
     const steps = [];
     const settings = await readSettings(io);
     const removed = unmergeSettings(settings, manifest?.permissions ?? []);
-    if (removed.changed)
-        await writeSettings(io, removed.settings);
+    // The wake mod lives in the private copy, which goes too: any copy of it in CLAUDE_CODE_PLUGIN_DIRS is ours.
+    const unmodded = withModDir(removed.settings, null, separatorFor(io.platform));
+    const modRemoved = !('invalid' in unmodded) && unmodded.changed;
+    if (removed.changed || modRemoved)
+        await writeSettings(io, 'invalid' in unmodded ? removed.settings : unmodded.settings);
     steps.push({
         ok: true,
         text: removed.changed
             ? 'Removed the Pending You hooks and permissions from Claude Code.'
             : 'No Pending You hooks were installed.',
     });
+    if (modRemoved)
+        steps.push({ ok: true, text: `Removed the wake mod from ${PLUGIN_DIRS}.` });
     if (manifest?.skill) {
         const text = await readText(manifest.skill.path);
         if (text !== null && sha256(text) === manifest.skill.sha256) {
@@ -446,6 +680,8 @@ export async function uninstallClaude(io) {
     }
     if (await removeCli(io))
         steps.push({ ok: true, text: 'Removed the hooks’ copy of pendingyou.' });
+    if (await removeHelper(io))
+        steps.push({ ok: true, text: 'Removed Claude Code’s sign-in helper for this computer.' });
     if (manifest?.mcpAdded) {
         io.out('Removing the pendingyou MCP server from Claude Code (this can take a minute)…\n');
         const result = await io.run('claude', ['mcp', 'remove', '--scope', 'user', MCP_NAME], MCP_TIMEOUT_MS);
@@ -473,8 +709,14 @@ export async function claudeState(io) {
     }
     const skill = (await readText(skillPath(io))) !== null;
     let ours = (_event) => undefined;
+    const mod = { loads: false, dirs: [], present: false, plugin: false };
+    const loads = claude ? claudeVersion(claude) : null;
+    mod.loads = loads !== null && loadsMods(loads);
     try {
-        const all = objectAt(await readSettings(io), 'hooks') ?? {};
+        const settings = await readSettings(io);
+        mod.dirs = (pluginDirs(settings, separatorFor(io.platform)) ?? []).filter(isOurModDir);
+        mod.plugin = pluginEnabled(settings);
+        const all = objectAt(settings, 'hooks') ?? {};
         ours = (event) => Array.isArray(all[event])
             ? all[event]
                 .flatMap((group) => group.hooks ?? [])
@@ -484,6 +726,8 @@ export async function claudeState(io) {
     catch { }
     const start = ours('SessionStart');
     const form = typeof start?.command === 'string' ? hookForm(start.command) : null;
+    const found = await Promise.all(mod.dirs.map((dir) => exists(join(dir, 'hooks', 'hooks.json'))));
+    mod.present = found.length > 0 && found.every(Boolean);
     return {
         claude,
         mcp,
@@ -491,5 +735,6 @@ export async function claudeState(io) {
         hooks: Boolean(start && ours('UserPromptSubmit')),
         stopcheck: Boolean(ours('Stop')),
         form: form ? { ...form, runs: await hookRuns(form) } : null,
+        mod,
     };
 }

package/dist/credentials.js

@@ -1,7 +1,7 @@
 // The command line's sign-in, one per Pending You address (production, staging, a local server), in
 // ~/.config/pendingyou/credentials.json: readable only by you (0600, in a 0700 folder), written whole, never printed
 // and never logged. A file someone loosened is tightened again on the next read.
-import { chmod, stat } from 'node:fs/promises';
+import { chmod, rm, stat } from 'node:fs/promises';
 import { join } from 'node:path';
 import { configDir, readJson, withLock, writeWhole } from "./files.js";
 export const credentialsPath = (io) => join(configDir(io), 'credentials.json');
@@ -57,3 +57,41 @@ export async function updateCredential(io, origin, change) {
         return next;
     });
 }
+export const clientsPath = (io) => join(configDir(io), 'clients.json');
+async function readClients(io) {
+    const file = await readJson(clientsPath(io)).catch(() => null);
+    return file && typeof file.origins === 'object' && file.origins !== null
+        ? file
+        : { version: 1, origins: {} };
+}
+/** The client this computer's connection for `origin` signed in with last, if any. */
+export async function connectionClient(io, origin) {
+    const entry = (await readClients(io)).origins[origin];
+    return typeof entry?.clientId === 'string' ? entry.clientId : null;
+}
+/** The name this computer's connection for `origin` signed in with ("devbox"), if it's known. */
+export async function connectionMachine(io, origin) {
+    const entry = (await readClients(io)).origins[origin];
+    return typeof entry?.machine === 'string' && entry.machine ? entry.machine : null;
+}
+/**
+ * Remembers the client this computer's connection for `origin` signed in with, or with null forgets it (uninstall),
+ * removing the file once it holds none.
+ */
+export async function saveConnectionClient(io, origin, clientId, machine) {
+    const path = clientsPath(io);
+    if (!clientId && !(await connectionClient(io, origin)))
+        return;
+    await withLock(path, io, async () => {
+        const file = await readClients(io);
+        if (clientId)
+            file.origins[origin] = { clientId, ...(machine ? { machine } : {}) };
+        else
+            delete file.origins[origin];
+        const text = `${JSON.stringify({ version: 1, origins: file.origins }, null, 2)}\n`;
+        if (Object.keys(file.origins).length === 0)
+            await rm(path, { force: true });
+        else
+            await writeWhole(path, text, { secret: true });
+    });
+}

package/dist/files.js

@@ -34,15 +34,15 @@ export async function readJson(path) {
 }
 /**
  * Writes a whole file at once. `secret` files and their folder are private to you (0600 and 0700), however they were
- * before; other files keep the mode they had.
+ * before; a `mode` given is the file's (a script's 0755); other files keep the mode they had.
  */
 export async function writeWhole(path, text, options = {}) {
     const folder = dirname(path);
     await mkdir(folder, { recursive: true, ...(options.secret ? { mode: 0o700 } : {}) });
     if (options.secret)
         await chmod(folder, 0o700);
-    let mode = options.secret ? 0o600 : 0o644;
-    if (!options.secret) {
+    let mode = options.mode ?? (options.secret ? 0o600 : 0o644);
+    if (!options.secret && options.mode === undefined) {
         try {
             mode = (await stat(path)).mode & 0o777;
         }

package/dist/hold.js

@@ -4,20 +4,41 @@
 // person; a fallback that ran; or it closed. Then it prints a few lines and exits, and Claude Code, which re-invokes
 // the model when a background command ends, wakes up with the answer, even if it was idle at the prompt.
 //
-// It lets go cleanly after --timeout (4 hours by default), on Ctrl-C or when Claude Code stops it, saying how the
-// answer will still arrive. Exit codes: 0 when it heard something or stopped cleanly; 1 when it can't wait at all
-// (not signed in, no such request, bad arguments).
-import { getJson, SignInNeeded, Unavailable } from "./api.js";
+// It lets go cleanly after --timeout (4 hours by default), on Ctrl-C or when Claude Code stops it (a background
+// command's own time limit can stop it sooner). Since 0.10.0 it then says to start it again in the background, with the
+// exact command: a session without the wake mod (Claude Code before 2.1.287, or no plugin and no init) has nothing
+// else to wake it, and two sessions missed answers overnight when it said not to (2026-10-04). Exit codes: 0 when it
+// heard something or stopped cleanly; 1 when it can't wait at all (not signed in, no such request, bad arguments).
+import { getJson, SESSION_APP, SignInNeeded, Unavailable } from "./api.js";
+import { DEFAULT_ORIGIN, DEFAULT_TIMEOUT_MS } from "./args.js";
 import { readCredential } from "./credentials.js";
-import { describe, isClosed } from "./format.js";
-import { markHanded, momentOf, startWaiting, stopWaiting } from "./state.js";
+import { describe } from "./format.js";
+import { markHanded, momentOf } from "./state.js";
 /** The longest one long poll asks the server to wait. */
 export const LONG_POLL_SECONDS = 25;
 /** After this long, a pause between long polls: an answer hours later needn't arrive within seconds. */
 const PATIENT_AFTER_MS = 30 * 60 * 1000;
 const PATIENT_PAUSE_MS = 30_000;
 const BACKOFF_MS = [2000, 5000, 10_000, 20_000, 30_000, 60_000];
-const holdCommand = (requestId) => `npx pendingyou hold ${requestId}`;
+/** A duration as `--timeout` takes it: 4h, 90m or 45s. */
+export function durationText(ms) {
+    if (ms % 3_600_000 === 0)
+        return `${ms / 3_600_000}h`;
+    if (ms % 60_000 === 0)
+        return `${ms / 60_000}m`;
+    return `${Math.round(ms / 1000)}s`;
+}
+/**
+ * The command that holds for this request again, as it was started: its origin and timeout when they aren't the
+ * defaults (`--origin` rather than PENDINGYOU_ORIGIN=…, so init's `Bash(npx pendingyou hold:*)` still allows it).
+ */
+export function holdCommand(requestId, origin = DEFAULT_ORIGIN, timeoutMs = DEFAULT_TIMEOUT_MS) {
+    return [
+        `npx pendingyou hold ${requestId}`,
+        ...(origin === DEFAULT_ORIGIN ? [] : [`--origin ${origin}`]),
+        ...(timeoutMs === DEFAULT_TIMEOUT_MS ? [] : [`--timeout ${durationText(timeoutMs)}`]),
+    ].join(' ');
+}
 const minutes = (ms) => {
     if (ms < 60_000)
         return `${Math.round(ms / 1000)} seconds`;
@@ -29,6 +50,7 @@ const minutes = (ms) => {
 };
 export async function hold(io, options) {
     const { origin, requestId } = options;
+    const again = holdCommand(requestId, origin, options.timeoutMs);
     const started = io.now();
     const deadline = started + options.timeoutMs;
     const print = (lines) => io.out(`${lines.join('\n')}\n`);
@@ -43,28 +65,27 @@ export async function hold(io, options) {
     };
     if (!(await readCredential(io, origin)))
         return signInNeeded(false);
-    await startWaiting(io, origin, requestId, io.cwd).catch(() => { });
     let failures = 0;
     for (;;) {
         if (io.signal.aborted) {
             print([
                 `Pending You: stopped waiting on ${requestId}.`,
-                'Their answer still reaches you with your next message or session; or call get_request at a breakpoint.',
+                `If you’re still waiting on their answer, start it again as a background command: ${again}`,
             ]);
             return 0;
         }
         const left = deadline - io.now();
         if (left <= 0) {
             print([
-                `Pending You: no answer on ${requestId} after ${minutes(options.timeoutMs)}, so I stopped waiting.`,
-                'Don’t start another hold now. Their answer reaches you with your next message or session, or check list_pending at a breakpoint.',
+                `Pending You: no answer on ${requestId} after ${minutes(options.timeoutMs)}, so this hold stopped.`,
+                `Start it again now as a background command, so their answer still wakes you: ${again}`,
             ]);
             return 0;
         }
         const wait = Math.max(1, Math.min(LONG_POLL_SECONDS, Math.floor(left / 1000)));
         let result;
         try {
-            result = await getJson(io, origin, `/mcp/cli/requests/${encodeURIComponent(requestId)}?wait=${wait}`, (wait + 20) * 1000, io.signal);
+            result = await getJson(io, origin, `/mcp/cli/requests/${encodeURIComponent(requestId)}?wait=${wait}&source=${SESSION_APP}`, (wait + 20) * 1000, io.signal);
         }
         catch (error) {
             if (io.signal.aborted)
@@ -80,7 +101,6 @@ export async function hold(io, options) {
         }
         failures = 0;
         if (result.status === 404) {
-            await stopWaiting(io, origin, [requestId]).catch(() => { });
             print([
                 `Pending You: can’t find ${requestId} among your person’s Claude Code questions on ${origin}.`,
                 'Check the id from post_request. If this Claude Code signed in to Pending You as someone else, use get_request instead.',
@@ -93,10 +113,8 @@ export async function hold(io, options) {
             continue;
         }
         if (heard.ready) {
-            print(describe(heard, `run \`${holdCommand(requestId)}\` in the background again`));
-            await markHanded(io, origin, [
-                { requestId, moment: momentOf(heard), closed: isClosed(heard) },
-            ]).catch(() => { });
+            print(describe(heard, `run \`${again}\` in the background again`));
+            await markHanded(io, origin, [{ requestId, moment: momentOf(heard) }]).catch(() => { });
             return 0;
         }
         if (io.now() - started > PATIENT_AFTER_MS)

package/dist/index.js

@@ -4,4 +4,5 @@ export { DEFAULT_ORIGIN, parseArgs } from "./args.js";
 export { readCredential, updateCredential } from "./credentials.js";
 export { main } from "./main.js";
 export { CLIENT_NAME, discover, register, revoke, SCOPE, signIn, signInWithDevice, } from "./oauth.js";
+export { qrCode, qrLines } from "./qr.js";
 export { VERSION } from "./version.js";

package/dist/install.js

@@ -21,6 +21,8 @@ export const cliRoot = (io) => join(configDir(io), 'cli');
 export const cliPrefix = (io, version = VERSION) => join(cliRoot(io), version);
 /** The command line inside a prefix. */
 export const cliScript = (prefix) => join(prefix, 'node_modules', 'pendingyou', 'dist', 'cli.js');
+/** The package inside a prefix, where its mod/ is (0.10.0). */
+export const cliPackage = (prefix) => join(prefix, 'node_modules', 'pendingyou');
 /** How long npm may take to install the package (it usually takes a few seconds). */
 const NPM_TIMEOUT_MS = 180_000;
 const exists = (path) => stat(path).then(() => true, () => false);
@@ -55,10 +57,10 @@ async function runningPackage(io) {
     const manifest = await readJson(join(root, 'package.json')).catch(() => null);
     return manifest?.name === 'pendingyou' && manifest.version === VERSION ? root : null;
 }
-/** Copies the package's published files (no dependencies to bring: it has none). */
+/** Copies the package's published files (no dependencies to bring: it has none), the wake mod included. */
 async function copyPackage(from, to) {
     await mkdir(to, { recursive: true });
-    for (const name of ['package.json', 'dist', 'README.md', 'CHANGELOG.md', 'LICENSE'])
+    for (const name of ['package.json', 'dist', 'mod', 'README.md', 'CHANGELOG.md', 'LICENSE'])
         if (await exists(join(from, name)))
             await cp(join(from, name), join(to, name), { recursive: true });
 }

package/dist/io.js

@@ -3,7 +3,7 @@
 import { spawn } from 'node:child_process';
 import { homedir, hostname } from 'node:os';
 import { createInterface } from 'node:readline';
-export function runProgram(command, args, timeoutMs = 60_000) {
+export function runProgram(command, args, timeoutMs = 60_000, options = {}) {
     return new Promise((resolve) => {
         let stdout = '';
         let stderr = '';
@@ -12,6 +12,8 @@ export function runProgram(command, args, timeoutMs = 60_000) {
             child = spawn(command, [...args], {
                 stdio: ['ignore', 'pipe', 'pipe'],
                 windowsHide: true,
+                // Exactly that environment, nothing of this process's.
+                ...(options.env ? { env: options.env } : {}),
             });
         }
         catch {