pendingyou 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,112 @@
 # Changelog
 
+## 0.11.0
+
+- One step for the coding agents on a computer (Darin, 2026-10-04): `npx -y pendingyou@latest init` finds Claude Code
+  and Codex (`--app claude-code,codex` names some), says what it found and which it can't set up (an agent too old for
+  it is named, with the version it needs), and sets each up with one approval. Then: restart the agent, and its first
+  session finishes setting up by itself (whoami, report_setup, a test card). Asked for by name and not installed, or
+  nothing found at all: it says so and stops before anyone signs in.
+- One sign-in everywhere: each agent's MCP server signs in through this computer's own connection ("Claude Code on
+  Ann-MBP", "Codex on Ann-MBP"), through the headers helper, on every computer but Windows; 0.10.0 did that only over
+  SSH. The hooks use the same connection, so there's nothing to Authenticate and no second sign-in. Each agent gets a
+  sign-in and a client of its own (`credentials.json`: Claude Code's under the address as before, another agent's under
+  `<address>#<app>`, so a 0.10.0 process still running keeps it; a `.gitignore` of `*` in the folder).
+- Several agents, one approval: a device sign-in each, started together and shown as one link,
+  `/device?code=A&code=B`, which Pending You turns into one consent card naming each agent and the computer, with one
+  Allow (needs Pending You's Worker from this release). On a computer with a browser, the browser opens on it ("Your
+  browser is open on Pending You: press Allow once for Claude Code and Codex (codes …)"); over SSH, the link, a QR code
+  and each code. `--device` shows the codes anywhere, `--browser` opens the browser anyway, `--no-browser` only prints
+  the address. Cancel stops `init` before it changes anything. `login --app <app>` signs one agent in again, with its
+  own client, so it keeps its connection; `login --browser` no longer refuses a connection.
+- Codex CLI (0.152 or later, whose `http_headers_helper` can give Authorization): its `[mcp_servers.pendingyou]` table
+  in `~/.codex/config.toml`, edited in place with every other line as it was, signed in through the helper
+  (`--app codex`) with `default_tools_approval_mode = "approve"`; a stored OAuth sign-in, which would win over the
+  helper, is logged out first. Its skill in `~/.agents/skills/pendingyou/SKILL.md`, and four hooks in
+  `~/.codex/hooks.json`, added after the person's own: a session start (startup, resume, clear), each message, Pending
+  You's card tools, and the Stop check (pattern matching on Codex's final message, once a turn at most). Codex runs a
+  hook only once the person trusts it: `init` says to choose “Trust all and continue”, `status` says which are trusted
+  (from Codex's own hash of each), and `uninstall` keeps the trust of the person's own hooks that move up when ours go.
+  When a card a Codex thread posted is answered, a listener the hooks start for that thread runs `codex queue` in the
+  wake mod's words (never with the answer itself, which other programs could read in its arguments) (Codex 0.157 or later starts a turn on an idle thread; `init` says so on an older
+  one). A server and hooks Codex's `/import` copied from Claude Code are replaced. Not on Windows yet.
+- What happens to a `pendingyou` server that's there is decided before anyone signs in. At this Pending You, signing
+  in by itself (the agent's own OAuth, or the Pending You plugin with no server added by hand): moved to this
+  computer's sign-in without a word where there's no browser, on Yes (the default) at a terminal after saying what
+  that means, or with `--yes`; with nobody to ask, kept, with the command that switches it. Kept, the agent's hooks get
+  a sign-in that only hears, and a kept plugin carries the skill, so none is saved. At another Pending You: replaced
+  once the person says so (or `--yes`); kept, that agent is left as it is.
+- `--oauth`: every agent signs in to its MCP server by itself, as before 0.11.0 (Claude Code's `claude mcp add`; Codex's
+  table without the helper, then `codex mcp login pendingyou`).
+- Finishing setup by itself: a session start (new, resumed or cleared, never a compaction) adds one line while Pending
+  You says the agent's setup isn't finished (hear_answers' `for.setup`, on the request the hook makes anyway): what to
+  call, or that the test card's answer is waiting to be picked up; at most 3 times per `init`, none after 7 days, never
+  once it's verified. `init`'s copy of the wake mod starts that turn itself in Claude Code 2.1.287 or later. `init`
+  ends with the sentence to say when it doesn't, on its own line: “Finish setting up Pending You: it’s connected here
+  already.” (`FINISH_SAY`, the same as Pending You's pages).
+- The hooks run a script with a path that never changes, `~/.config/pendingyou/bin/pendingyou-hook <command> --app
+  <app>`, which runs this version's private copy: upgrading rewrites the script, never the hook lines. Every request a
+  hook or the listener makes names its app (`source`).
+- Node, without the shell's PATH (a Claude Code started from its desktop app or an IDE, Codex's stripped environment):
+  `init` records the Node it ran with by its stable path (`/opt/homebrew/bin/node`, not the Cellar folder an upgrade
+  removes), and the helper and the hooks' script also look in `/opt/homebrew/bin`, `/usr/local/bin` and `~/.volta/bin`.
+  A Mac is named by its own name (`scutil --get ComputerName`) unless `--name` says otherwise.
+- `status` has a section for each agent `init` set up, a `Setup:` line (finished, waiting for the first session with
+  the sentence to say, the test card waiting on you, or answered and being picked up) that never changes Ready, and
+  "no browser here" in its header only when that's true. `uninstall` covers each agent, takes out the shared parts once
+  none is left, says which connections stay on your Assistants page, and ends with how to connect again.
+- `pendingyou mcp --app <app>` is reserved for a stdio MCP server for an agent that can't run a headers helper; it says
+  it isn't ready yet.
+
+## 0.10.0
+
+- The wake mod: Claude Code 2.1.287 or later is woken when you answer, with nothing waiting in the background. A
+  session heard your answer only while `npx pendingyou hold` ran, and a hold stops: after its own 4 hours, or sooner
+  when Claude Code stops a background command. Then it said "Don't start another hold now", and an answer that came
+  later waited until you next typed in that session; two sessions missed answers that way overnight (2026-10-04).
+  `init` now adds the Pending You plugin's mod, which this package carries in `mod/`, to `CLAUDE_CODE_PLUGIN_DIRS`
+  (`env` in `~/.claude/settings.json`), from the hooks' own copy in `~/.config/pendingyou/cli/0.10.0/`, keeping any
+  other folders there and replacing an older version's copy. Each session then learns the cards it posts, checks them
+  through its own Pending You connection (every 20 seconds while a card changed in the last half hour, then every
+  minute), and starts one turn when you answer, write back or a fallback comes due: “Pending You: your person
+  answered … Call get_request for it …, act on their words, then ack_answer.” Under the prompt it shows
+  `⚠ pendingyou-wake: 2 waiting on you`. It answers `npx pendingyou hold` itself, so an agent that still runs one waits on
+  nothing. With the Pending You plugin installed too (it carries the same mod, plugin 2.24), only one copy acts. On an
+  older Claude Code, or none, `init` skips it without a word. `uninstall` takes it out; `status` says whether it's
+  loaded, from where, and what to do when it isn't.
+- Without the mod, a hold that stops without an answer (its own `--timeout`, or Claude Code stopping it) says to start
+  it again in the background, with the exact command, `--origin` and `--timeout` included when they aren't the
+  defaults.
+- The next-message hook looks for this folder's answers with every message, not only while a hold had left an entry
+  behind: one request, as before, given up after 2 seconds, inside the hook's 3-second deadline. `state.json` no
+  longer keeps holds' waits.
+- A computer with no browser (a devbox or server you SSH into): one code approved on your phone sets Claude Code up.
+  `/mcp`'s Authenticate opened a browser on that machine, which nobody could reach, and `login --device` only signed
+  this command in. Now `init` there (an SSH session, or Linux with no display; `--device` forces it, `--browser` the
+  browser) signs the machine in by code as a Claude Code connection of its own ("Claude Code on devbox" on your
+  Assistants page, named by `--name`, else Tailscale's name for it, else its hostname; `login --name` with a new name
+  renames the connection with one more approval, which `login` suggests for a cloud's own name like `ip-10-42-1-252`;
+  QR code of the link at a terminal), then adds the MCP server with a `headersHelper` instead of OAuth
+  (`claude mcp add-json`), the wake mod in `env.CLAUDE_CODE_PLUGIN_DIRS` with `mcp__pendingyou` allowed, the skill and
+  the hooks. The helper, `~/.config/pendingyou/bin/pendingyou-mcp-headers`, is a small sh script Claude Code runs on
+  each connection: it finds Node on PATH, then nvm's default, then the Node `init` ran with, runs this version's own
+  copy (never npx) and prints only `{"Authorization":"Bearer …"}` (`pendingyou mcp-headers`), refreshing the sign-in in
+  the background when it's due. A browser sign-in at the same address (0.9.0's) is switched over; another's
+  `headersHelper` is kept. `login` there signs in that connection again, with the same client, so the machine keeps
+  one connection. `status` says what's set up and what's missing (it runs the helper as Claude Code would with a bare
+  PATH), each with the command that fixes it, `--origin` included off production. `uninstall` takes the helper out and
+  says the connection stays on your Assistants page. Needs Pending You's Worker from the same release.
+- `login` over SSH signs in by code without `--device`. A sign-in by code names the computer, and the phone asks "Let
+  devbox hear your answers for the assistants running on it?"; in the browser, "Let this computer hear…". Neither offers
+  a choice of assistant any more (Darin, 2026-10-04): a computer hears for the assistants running on it. A sign-in
+  pointed at one assistant before then keeps hearing it, so `watch` for a Muse or another app can't be set up anew.
+- Routing by sender: the hooks and `hold` ask Pending You for Claude Code's cards only (`source=claude-code`), so a card
+  Codex or another app posted from the same folder never reaches a Claude Code session, even with a sign-in pointed at
+  that app. `watch` names no app: it hands answers to a script, not a session. Pending You treats a folder's request
+  from an older version the same way.
+- Hooks still run 0.9.0 from `~/.config/pendingyou/cli/0.9.0/`: run `npx pendingyou@latest init` once to switch, and
+  to add the mod.
+
 ## 0.9.0
 
 - The Stop check catches a final message that asks you to type or reply something in Claude Code's own chat

package/README.md

@@ -1,46 +1,101 @@
 # pendingyou
 
-Pending You for Claude Code. Your assistants ask you in [Pending You](https://www.pendingyou.com) when you're away;
-this command lets Claude Code hear your answer the moment it's ready, even while it sits idle at the prompt.
+Pending You for your coding agents. Your agents ask you in [Pending You](https://www.pendingyou.com) when you're away;
+this command sets Claude Code and Codex up to ask there and to hear your answer the moment it's ready, even while they
+sit idle at the prompt.
 
 ```sh
-npx pendingyou init
+npx -y pendingyou@latest init
 ```
 
-Run it once on each computer. It:
+Run it once on each computer, in a terminal. It finds the agents on the computer (Claude Code, Codex; `--app` names
+some), says what it found, and for each one:
+
+- connects it to Pending You through **this computer's own sign-in**: its own connection ("Claude Code on Ann-MBP",
+  "Codex on Ann-MBP" on your Assistants page), which its MCP server and its hooks share, so there's nothing to
+  Authenticate in the agent and no second sign-in,
+- signs them all in with **one approval**: your browser opens on Pending You with one card naming each agent and this
+  computer, and you press Allow once (over SSH: a code and a QR code for your phone, [below](#a-computer-with-no-browser)),
+- adds the Pending You MCP server for every project, signed in through a small helper script, and lets the agent use
+  Pending You's tools without asking each time,
+- saves the Pending You skill (Claude Code: `~/.claude/skills/pendingyou/SKILL.md`; Codex:
+  `~/.agents/skills/pendingyou/SKILL.md`),
+- adds the hooks that hand it your answers: a new session picks up answers that arrived while nothing was running,
+  your next message brings a waiting answer with it, and a check when it finishes a turn catches what it left you only
+  in chat ([below](#nothing-left-only-in-chat)),
+- and wakes it when you answer: Claude Code 2.1.287 or later through the wake mod, Codex through `codex queue`.
+
+Then it says what to do next, and the one sentence to say if it's needed:
 
-- adds the Pending You MCP server to Claude Code for every project (unless it's already there),
-- saves the Pending You skill to `~/.claude/skills/pendingyou/SKILL.md`,
-- signs this computer in (your browser opens once; press Allow),
-- adds three hooks to `~/.claude/settings.json`: a new session picks up answers that arrived while nothing was
-  running, your next message brings a waiting answer with it, and a check when Claude Code finishes a turn (below),
-- lets Claude Code start `npx pendingyou hold` and use Pending You's tools without a permission prompt, so a question
-  it asks while you're away doesn't wait on one,
-- keeps a copy of this version for the hooks in `~/.config/pendingyou/cli/<version>/`, so they start in a few
-  hundredths of a second instead of waiting on npx (about half a second each).
+```
+Next: restart Claude Code here (/exit, then claude --continue), or start it in the folder you work in.
+It finishes setting up by itself and sends you a test card. If it doesn't, say this to it:
 
-Your other settings are kept as they are. `npx pendingyou uninstall` removes exactly what `init` added.
+Finish setting up Pending You: it’s connected here already.
+```
 
-Adding the MCP server can take Claude Code a minute or more (it checks its servers); `init` says when it's waiting on
-that. If Claude Code already has a `pendingyou` server pointing somewhere else (staging, say), `init` names both and
-asks before replacing it; `--yes` replaces it without asking, and with nobody to ask it prints the two commands to
-run. Afterwards restart Claude Code, run `/mcp`, choose pendingyou and Authenticate.
+The first session finishes setting up on its own: it checks in with Pending You, reports what's set up and sends you a
+test card. Claude Code 2.1.287 or later starts that turn by itself; otherwise (and in Codex, after you choose “Trust all
+and continue” for its hooks) the session start adds one line saying what's left, and you say the sentence.
+`npx pendingyou status` says what's set up for each agent, what's missing with the command that fixes it, and how setup
+stands. `npx pendingyou uninstall` removes exactly what `init` added.
 
-If the `pendingyou` MCP server Claude Code uses in a session's folder is another Pending You than the hooks' (staging
-and production, say), both hooks add one line telling Claude Code so, and to ask you which one you use: its cards
-would otherwise go where you don't look. `npx pendingyou status` flags it too. Fix it with `npx pendingyou init
---origin <the one you use>`, then restart the session.
+Your other settings are kept as they are: `init` merges into Claude Code's `~/.claude/settings.json`, Codex's
+`~/.codex/config.toml` (its `[mcp_servers.pendingyou]` table and nothing else, every other line as it was) and
+`~/.codex/hooks.json`, and running it again changes nothing it doesn't need to.
+
+**A pendingyou server that's there already** is decided on before anyone signs in. One at another Pending You
+(staging, say) is named and replaced only once you say so (`--yes` replaces it without asking); keep it and that agent
+is left as it is. One at this Pending You that signs in by itself (Claude Code's `/mcp` → Authenticate, Codex's
+`codex mcp login`, or the Pending You plugin for Claude) is moved to this computer's sign-in: without asking where
+there's no browser (it can't finish there anyway), on Yes (the default) at a terminal, or with `--yes`; with nobody to
+ask it's kept, and `init` prints the command that switches it. The connection it had stays on your Assistants page for
+you to remove, and answers to the cards it asked through that one won't reach the agent by themselves. A kept plugin
+carries the skill, so none is saved. `--oauth` keeps every agent signing in by itself, as before 0.11.0.
+
+The hooks run a copy of this version kept in `~/.config/pendingyou/cli/<version>/`, through a small script with a path
+that never changes, `~/.config/pendingyou/bin/pendingyou-hook`:
+
+```
+"~/.config/pendingyou/bin/pendingyou-hook" pickup --app claude-code || true
+```
+
+(the path in full). Upgrading rewrites that script, never the hook lines, so Codex, which runs a hook only while you
+trust its exact definition, doesn't ask again. The script runs the copy with the Node `init` ran with, by its stable
+path (Homebrew's `/opt/homebrew/bin/node`, which outlives an upgrade), or the first Node it finds. If the copy can't be
+made (no npm, no network), the hooks run through `npx -y --prefer-offline pendingyou@<version>` instead.
 
 The hooks never get in your way: if anything goes wrong (no network, not signed in, a bad option), they print nothing
 and let your message through. Each one stops within 3 seconds whatever happens, with at most its one-line reminder, and
 never refreshes the sign-in itself: when that's due, it starts the refresh in the background, which finishes on its
-own. Running `init` again updates them in place, and adds any a newer version brings.
+own. Each hands an agent only its own app's cards from its folder, never one another agent posted there.
 
-The hooks run that copy with Node directly, like
-`"/opt/homebrew/bin/node" "~/.config/pendingyou/cli/0.9.0/node_modules/pendingyou/dist/cli.js" handoff || true` (the
-paths in full). If the copy can't be made (no npm, no network), they run through `npx -y --prefer-offline
-pendingyou@<version>` instead. `npx pendingyou status` says which. If you remove the Node they run with, run `init`
-again.
+If the `pendingyou` MCP server Claude Code uses in a session's folder is another Pending You than the hooks' (staging
+and production, say), both hooks add one line telling Claude Code so, and to ask you which one you use: its cards
+would otherwise go where you don't look. `npx pendingyou status` flags it too. Fix it with `npx pendingyou init
+--origin <the one you use>`, then restart the session. Codex's hooks do the same for Codex's server.
+
+## Codex
+
+Codex CLI 0.152 or later (its `http_headers_helper` gives the sign-in; 0.157 or later wakes an idle thread by itself).
+`init` writes, in `~/.codex/config.toml`:
+
+```toml
+[mcp_servers.pendingyou]
+url = "https://www.pendingyou.com/mcp"
+http_headers_helper = "/Users/ann/.config/pendingyou/bin/pendingyou-mcp-headers --app codex"
+default_tools_approval_mode = "approve"
+```
+
+and four hooks in `~/.codex/hooks.json`: a session start, each message, Pending You's card tools (so the Stop check
+knows a turn posted, and so the thread is woken), and the Stop check. **Codex runs a hook only once you trust it**: start
+`codex` and choose “Trust all and continue” (or trust them in `/hooks`). `status` says which are trusted. A
+`pendingyou` server or hooks Codex's `/import` copied from Claude Code (without its sign-in) are replaced.
+
+When you answer a card a Codex thread posted, a small listener `init`'s hooks start for that thread puts a message into
+it with `codex queue`: “Pending You: your person answered “…” (req_…). Call get_request …”, which reads your answer (the
+answer itself never goes in a command's arguments, where other programs could see it). Codex starts a turn at
+once when the thread is open and idle, after the current one when it's working, or when you next open it.
 
 ## Nothing left only in chat
 
@@ -51,7 +106,7 @@ Deep into a long conversation, Claude Code tends to end a turn with a question f
   person also goes on a card.* While cards Claude Code posted from this folder are still waiting on you, the same line
   names them (at most 3, newest first, about 20 tokens each) and asks it to `cancel_request` one with `answeredHere`
   when your message answers it, so a question you answer in chat doesn't stay in your queue. That costs one small
-  request per message, given up after 1.5 seconds.
+  request per message, which brings any answer waiting for this folder too, given up after 2 seconds.
 - When Claude Code finishes a turn, `pendingyou stopcheck` looks at its last message. If it has something for you and
   nothing was posted, updated or replied to in Pending You that turn (and the message doesn't say it's on a card, or
   that one is coming),
@@ -73,34 +128,78 @@ card titled “Confirm in Claude Code on <computer>: <step>”, with the exact w
 session's link when Remote Control or Claude Code on the web gives one) and what it'll do then. Only such a message
 costs a request: this folder's open cards, given up after 1.5 seconds.
 
+Codex gets the same two (0.11.0). Its Stop check reads Codex's final message, and whether the turn posted, updated or
+replied on a card comes from Codex's own hook for Pending You's tools in that turn; it asks once a turn at most, for an
+action card titled “Confirm in Codex on <computer>: <step>” when it asked you to type something there.
+
 **On 0.2.0 with another origin?** Its hooks blocked every message (`There's no "--origin" command`). Run
 `npx pendingyou@latest init --origin <url>` again to repair them; see [CHANGELOG.md](CHANGELOG.md).
 
-## How Claude Code uses it
+## How Claude Code hears your answer
 
-After it posts a question to Pending You, Claude Code runs this in the background and keeps working:
+**Claude Code 2.1.287 or later: the wake mod.** There's nothing to run. In each session the mod learns the cards
+Claude Code posts, checks them through the session's own Pending You connection (every 20 seconds while a card changed
+in the last half hour, then every minute), and when you answer (after the 5-second window to undo), write back, or a
+fallback comes due, it starts a turn naming the card and what to do: read it with `get_request`, act, then
+`ack_answer`. That works while the session sits idle at the prompt, for as long as it's open, and across a restart
+with `claude --continue`. Under the prompt it shows `⚠ pendingyou-wake: 2 waiting on you`. If Claude Code still runs
+`npx pendingyou hold`, the mod answers it at once and nothing runs in the background. With the Pending You plugin
+installed as well, only one copy acts. `npx pendingyou status` says whether the mod is loaded.
+
+The mod's checks are Pending You tool calls like Claude Code's own, so they need Pending You's tools allowed, which
+`init` does (`mcp__pendingyou`). If they aren't, the line under the prompt says which rule to add in `/permissions`, and
+holds run as before.
+
+**Older Claude Code: a background hold.** After it posts a question to Pending You, Claude Code runs this in the
+background and keeps working:
 
 ```sh
 npx pendingyou hold req_0123456789abcdef0123
 ```
 
-When you answer (after the 5-second window to undo), write back, or the question's fallback comes due, it prints a few
-lines (the question, your answer, the next step) and exits. Claude Code wakes up with them. It stops on its own after
-4 hours (`--timeout`), telling Claude Code the hooks will bring the answer later.
+When you answer, write back, or the question's fallback comes due, it prints a few lines (the question, your answer,
+the next step) and exits. Claude Code wakes up with them. It stops on its own after 4 hours (`--timeout`), and Claude
+Code may stop a background command sooner; either way it then says to start it again, with the exact command. Your
+next message brings any answer with it too.
 
 When you're at the terminal, Claude Code asks you there and puts the same question in Pending You at once; the
 first answer wins. If you answer in the terminal, it withdraws the card and the hold ends by itself.
 
+**Finishing setup by itself (0.11.0).** In `init`'s copy of the mod, a few seconds after a session you're at opens
+(never `claude -p`), it asks Pending You whether Claude Code is set up here (`whoami`, once Pending You's tools are
+allowed and the server has connected). When it isn't, it starts one turn once the session is idle: “Finish setting up
+Pending You: it’s connected here already.” and exactly what to do. Once per session, in at most three sessions, never
+two within ten minutes, and never again once Pending You says it's set up.
+
 ## A computer with no browser
 
-On a server or over SSH, sign in with a code instead:
+On a devbox or server you reach over SSH, an agent's own sign-in opens a browser on that machine, which you can't
+reach. `init` signs in with a code there instead: SSH in, and at the prompt there run
 
 ```sh
-npx pendingyou login --device
+npx -y pendingyou@latest init
 ```
 
-It shows a short code. Open pendingyou.com/device on your phone, sign in, enter the code and press Allow. Only enter a
-code your own computer is showing you.
+It sees it's an SSH session (or Linux with no display) and shows a link for your phone, a QR code of it, and each code,
+for every agent it found. Open it on your phone, sign in, check the codes match and press Allow once. Only allow codes
+your own computer is showing you. `--device` shows codes like this anywhere; `--browser` opens the browser anyway;
+`--no-browser` only prints the address.
+
+Run it at an interactive prompt after you SSH in, not as `ssh host npx pendingyou init`: on stock Ubuntu that one-line
+form doesn't read your shell's setup, so nvm's Node, `claude` and `codex` may not be on PATH. The helper script and the
+hooks find Node anyway when the agents run without your shell's PATH (a systemd service, a terminal multiplexer,
+Remote Control): on PATH, nvm's default, the one `init` ran with, or where Node usually is.
+
+The machine is called by its Tailscale name when Tailscale is installed and running (as `tailscale status` shows it),
+else by its hostname, or by `--name devbox` on `init` or `login`; a Mac by its own name (Sharing in System Settings). A
+cloud's own hostname (AWS's `ip-10-42-1-252`) is kept when there's nothing better, and `login` says how to change it:
+`npx pendingyou login --name <name>` asks for one more approval and renames the connection, which stays the same one.
+If an agent's sign-in ends (30 days, or you remove it on your Assistants page), `npx pendingyou login` (`--app codex`
+for Codex's) approves a new code and keeps the same connection.
+
+Only want this command's own sign-in (for `watch`, below)? `npx pendingyou login --device` signs it in with a code,
+hearing answers only, and adds no connection. Your phone asks "Let devbox hear your answers for the assistants running
+on it?", with no choice of assistant.
 
 ## Always-on scripts
 
@@ -110,8 +209,9 @@ code your own computer is showing you.
 npx pendingyou watch -- ./on-answer.sh
 ```
 
-When you sign in, pick which assistant it hears for ("Hear answers for: Only Muse"); by default it's your Claude Code
-assistants. The command runs without a shell, once per answer, message or fallback that comes due, oldest first. It
+It hears your Claude Code assistants' answers. Signing in asks no choice of assistant (since 2026-10-04: "Let pi hear
+your answers for the assistants running on it?"); a sign-in pointed at one assistant before then keeps hearing that
+one. The command runs without a shell, once per answer, message or fallback that comes due, oldest first. It
 gets the request as JSON on stdin, and `PENDINGYOU_REQUEST_ID`, `PENDINGYOU_EVENT` (`answer_ready`, `message_ready` or
 `fallback_due`), `PENDINGYOU_VERSION` and `PENDINGYOU_ORIGIN` in its environment. A failing command is tried twice
 more, then skipped. `--once` stops after the first.
@@ -120,27 +220,44 @@ more, then skipped. `--once` stops after the first.
 
 | Command | What it does |
 | --- | --- |
-| `init` | Set up Claude Code on this computer (`--no-login`, `--no-browser`, `--device`, `--yes`) |
-| `hold <requestId>` | Wait for the answer, print it, exit (`--timeout 4h`) |
-| `status` | What's set up; exits 0 when Claude Code hears answers right away |
-| `login` / `logout` | Sign this computer in or out (`--device`, `--force`, `--all`) |
+| `init` | Set up every agent on this computer (`--app`, `--oauth`, `--no-login`, `--no-browser`, `--device`, `--browser`, `--yes`, `--name`) |
+| `hold <requestId>` | Wait for the answer, print it, exit (`--timeout 4h`); the wake mod answers it itself |
+| `status` | What's set up for each agent; exits 0 when each hears answers right away (`--app`) |
+| `login` / `logout` | Sign an agent in again, or out (`--app`, `--device`, `--browser`, `--force`, `--name`, `--all`) |
 | `watch -- <command>` | Run a command each time an answer is ready (`--once`) |
-| `pickup` / `handoff` | The session-start and next-message hooks |
-| `stopcheck` | The Stop hook: items for you left only in chat |
-| `uninstall` | Remove what `init` added, and sign out |
+| `pickup` / `handoff` | The session-start and next-message hooks (`--app`) |
+| `stopcheck` | The Stop hook: items for you left only in chat (`--app`) |
+| `uninstall` | Remove what `init` added, and sign out (`--app`) |
+| `mcp --app <app>` | Not yet: a stdio MCP server for an agent that can't run a headers helper |
 
-Every command takes `--origin` (default `https://www.pendingyou.com`, or `$PENDINGYOU_ORIGIN`). Options can come
-before or after the command.
+Every command takes `--origin` (default `https://www.pendingyou.com`, or `$PENDINGYOU_ORIGIN`). `--app` takes
+`claude-code` or `codex` (several with commas where a command sets up or reports several); with none, a command that
+acts for one agent acts for Claude Code. Options can come before or after the command.
 
 ## What it can see, and where it keeps things
 
-The sign-in only hears answers to your own Claude Code assistants' questions, or to the one assistant you picked. It isn't an assistant: it can't ask,
-answer or change anything, and it doesn't show up as one. It's stored in `~/.config/pendingyou/credentials.json`
-(readable only by you), refreshes itself, and ends after 30 days or on `logout`. `state.json` beside it remembers
-which answers were already handed over (ids only), `claude-code.json` what `init` added, and `cli/` the hooks' copy
-of the command line. `init`, `status` and the hooks read `~/.claude.json` (and a folder's `.mcp.json`, and
-`~/.claude/settings.json`'s enabled plugins) only to see whether Claude Code has a `pendingyou` MCP server and where
-it points. Nothing is sent anywhere but Pending You.
+Each agent's sign-in is that agent's own connection on Pending You, signed in from this computer: it can post cards,
+change or cancel its own, read the answers to them and reply in their threads, and it can't answer anything for you.
+The hooks use the same sign-in, and hand a session only the cards its own app posted from its folder. An agent that
+signs in by itself (`--oauth`, or one you kept) gets a sign-in that only hears its answers instead: it can't ask,
+answer or change anything, and doesn't show up as an assistant. They're stored in `~/.config/pendingyou/credentials.json`
+(readable only by you, in a folder with a `.gitignore` of `*` so a dotfiles repository never takes it), refresh
+themselves, and end after 30 days or on `logout`. The headers helper hands an agent's token only to that agent's
+Pending You (Claude Code says which server it's for; Codex's is the one `init` wrote). `clients.json` remembers which
+sign-in each agent's connection used, so signing in again keeps it.
+
+`state.json` beside them remembers which answers were already handed over (ids only) and how many session starts
+reminded an unfinished setup; `claude-code.json` and `codex.json` what `init` added; `codex-threads.json` which cards
+each Codex thread waits on (ids, names and titles: never an answer); and `cli/` the hooks' copy of the command line.
+`init`, `status` and the hooks read `~/.claude.json` (and a folder's `.mcp.json`, and `~/.claude/settings.json`'s
+enabled plugins) and `~/.codex/config.toml` only to see whether the agent has a `pendingyou` MCP server and where it
+points. Nothing is sent anywhere but Pending You.
+
+The wake mod runs inside Claude Code and reaches Pending You only through the session's own connection, with
+`get_request` on the session's own cards (and, in `init`'s copy, `whoami` to see whether setup is finished). It keeps
+each session's cards (id, title, the agent's name, where each stands) in Claude Code's store for mods,
+`~/.claude/plugins/store/`, and forgets them once they close or after 7 days. It marks the copy acting for a session in
+that session's environment (`PENDINGYOU_WAKE_OWNER`).
 
 ## Development
 

package/dist/api.js

@@ -9,6 +9,12 @@
 // a hook that needs a new token starts `pendingyou refresh` detached (background), which runs to the end under the
 // lock whatever happens to the hook, and waits for it only briefly; until it lands the hook uses the token it has, or
 // gives up and prints its plain fallback.
+//
+// Since 0.11.0 each app has its own sign-in (credentials.ts), and every call names the app it's for: its sign-in is
+// the one used, and a session's request names it as `source` (routing by sender, 2026-10-04), so Pending You returns
+// only that app's cards, never one Codex posted from the same folder to a Claude Code session there. `watch` names no
+// app: it hands answers to a script, not a session, with Claude Code's sign-in as before.
+import { DEFAULT_APP } from "./apps/ids.js";
 import { credentialsPath, readCredential, updateCredential, } from "./credentials.js";
 import { isLocked } from "./files.js";
 import { OAuthError, refresh } from "./oauth.js";
@@ -43,7 +49,7 @@ export class Unavailable extends Error {
  * Refreshes the sign-in under the lock unless it no longer needs it: a token with more than `earlyMs` left (or, when
  * `force`d after a 401, a refresh token another process already replaced) is used as it is.
  */
-async function refreshStored(io, origin, stored, options) {
+async function refreshStored(io, origin, stored, options, app) {
     let ended = false;
     const updated = await updateCredential(io, origin, async (current) => {
         if (!current)
@@ -65,35 +71,43 @@ async function refreshStored(io, origin, stored, options) {
             }
             throw error;
         }
-    });
+    }, app);
     if (!updated)
         throw new SignInNeeded(ended);
     return updated;
 }
-async function freshToken(io, origin, force) {
-    const stored = await readCredential(io, origin);
+async function freshToken(io, origin, force, app) {
+    const stored = await readCredential(io, origin, app);
     if (!stored)
         throw new SignInNeeded(false);
     if (!force && stored.expiresAt - EARLY_MS > io.now())
         return stored.accessToken;
-    return (await refreshStored(io, origin, stored, { force, earlyMs: EARLY_MS })).accessToken;
+    return (await refreshStored(io, origin, stored, { force, earlyMs: EARLY_MS }, app)).accessToken;
 }
+/** What a process starts to refresh an app's sign-in in the background: `--app` only for an app but Claude Code. */
+export const refreshArgs = (origin, app, force = false) => [
+    'refresh',
+    '--origin',
+    origin,
+    ...(app === DEFAULT_APP ? [] : ['--app', app]),
+    ...(force ? ['--force'] : []),
+];
 /**
  * `pendingyou refresh`, what a hook starts in the background: refreshes the sign-in when it runs out within SOON_MS
  * (or `force`, after a 401), under the lock, to the end. Quiet; true when there's a sign-in afterwards.
  */
-export async function refreshInBackground(io, origin, force) {
-    const stored = await readCredential(io, origin);
+export async function refreshInBackground(io, origin, force, app = DEFAULT_APP) {
+    const stored = await readCredential(io, origin, app);
     if (!stored)
         return false;
     if (!force && stored.expiresAt - SOON_MS > io.now())
         return true;
-    await refreshStored(io, origin, stored, { force, earlyMs: SOON_MS });
+    await refreshStored(io, origin, stored, { force, earlyMs: SOON_MS }, app);
     return true;
 }
 /** A hook's token: never refreshed here (see the top of this file). */
-async function hookToken(io, origin, force, signal) {
-    const stored = await readCredential(io, origin);
+async function hookToken(io, origin, force, signal, app) {
+    const stored = await readCredential(io, origin, app);
     if (!stored)
         throw new SignInNeeded(false);
     const left = stored.expiresAt - io.now();
@@ -101,14 +115,14 @@ async function hookToken(io, origin, force, signal) {
         return stored.accessToken;
     // One refresher at a time: a lock held now is a refresh (or a write) already under way.
     if (!(await isLocked(credentialsPath(io))))
-        io.background(['refresh', '--origin', origin, ...(force ? ['--force'] : [])]);
+        io.background(refreshArgs(origin, app, force));
     // Still good for a few seconds: this request goes with it, the next one with the new token.
     if (!force && left > USABLE_MS)
         return stored.accessToken;
     const until = io.now() + REFRESH_WAIT_MS;
     while (io.now() < until && !signal?.aborted) {
         await io.sleep(50, signal);
-        const current = await readCredential(io, origin);
+        const current = await readCredential(io, origin, app);
         if (!current)
             throw new SignInNeeded(true);
         if (current.refreshToken !== stored.refreshToken)
@@ -116,6 +130,33 @@ async function hookToken(io, origin, force, signal) {
     }
     throw new Unavailable('The sign-in is being refreshed in the background.');
 }
+/**
+ * The token `pendingyou mcp-headers` hands an app's MCP server (remote.ts). The app runs the helper each time it
+ * connects and gives it 10 seconds, so, as for a hook, a refresh is never made in this process: within 5 minutes of
+ * expiry it starts `pendingyou refresh` detached and waits for its token, up to `waitMs`, then uses the old one while it
+ * still works. A token handed over has at least 10 seconds left; the app runs the helper again on a 401.
+ */
+export async function helperToken(io, origin, waitMs, app = DEFAULT_APP) {
+    const stored = await readCredential(io, origin, app);
+    if (!stored)
+        throw new SignInNeeded(false);
+    if (stored.expiresAt - io.now() > SOON_MS)
+        return stored.accessToken;
+    if (!(await isLocked(credentialsPath(io))))
+        io.background(refreshArgs(origin, app));
+    const until = io.now() + waitMs;
+    while (io.now() < until) {
+        await io.sleep(100);
+        const current = await readCredential(io, origin, app);
+        if (!current)
+            throw new SignInNeeded(true);
+        if (current.refreshToken !== stored.refreshToken)
+            return current.accessToken;
+    }
+    if (stored.expiresAt - io.now() > USABLE_MS)
+        return stored.accessToken;
+    throw new Unavailable('Pending You couldn’t be reached to refresh the sign-in.');
+}
 /** Aborts on `signal` or after `ms`, whichever comes first (AbortSignal.any needs Node 20.3). */
 function either(signal, ms) {
     const timeout = AbortSignal.timeout(ms);
@@ -130,17 +171,19 @@ function either(signal, ms) {
     return controller.signal;
 }
 /**
- * GETs `path` on `origin` as the command line, and returns the JSON body with its status. 401 after a refresh means
- * the sign-in is over (revoked, or 30 days passed). Network failures and 5xx are `Unavailable`.
+ * GETs `path` on `origin` as the command line, with an app's sign-in (Claude Code's unless `app` says), and returns the
+ * JSON body with its status. 401 after a refresh means the sign-in is over (revoked, or 30 days passed). Network
+ * failures and 5xx are `Unavailable`.
  */
 export async function getJson(io, origin, path, timeoutMs, signal, options = {}) {
+    const app = options.app ?? DEFAULT_APP;
     for (let attempt = 0;; attempt++) {
         let token;
         try {
             token =
                 options.hook && io.background
-                    ? await hookToken(io, origin, attempt > 0, signal)
-                    : await freshToken(io, origin, attempt > 0);
+                    ? await hookToken(io, origin, attempt > 0, signal, app)
+                    : await freshToken(io, origin, attempt > 0, app);
         }
         catch (error) {
             if (error instanceof Unavailable)
@@ -165,7 +208,7 @@ export async function getJson(io, origin, path, timeoutMs, signal, options = {})
             await response.body?.cancel();
             if (attempt === 0)
                 continue;
-            await updateCredential(io, origin, () => null);
+            await updateCredential(io, origin, () => null, app);
             throw new SignInNeeded(true);
         }
         if (response.status >= 500 || response.status === 429) {