hop2 0.11.2 → 0.11.3

package/hay-web/index.html

@@ -6,8 +6,8 @@
     <!-- Terminal prompt chevron on a dark tile — reads "terminal app" at 16px. -->
     <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='7' fill='%2317181d'/%3E%3Cpath d='M11 9.5 L20.5 16 L11 22.5' fill='none' stroke='%23a78bfa' stroke-width='4' stroke-linecap='round' stroke-linejoin='round'/%3E%3C/svg%3E" />
     <title>Hay</title>
-    <script type="module" crossorigin src="/assets/index-DfGT3DuO.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-BohAWpcL.css">
+    <script type="module" crossorigin src="/assets/index-BrLbmVOB.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BRpBf8QE.css">
   </head>
   <body>
     <div id="root"></div>

package/hop

@@ -658,13 +658,60 @@ function getRuntimeSessionMetadata(name) {
     return runtimeSessionMetadata.get(name) || null;
 }
 
+// Durable meta is read on every effective-config lookup, so a tiny cache
+// keeps it off the hot path. Invalidated by mtime, so an external write
+// (the hook, another process) is picked up without a restart.
+const durableIdentityCache = new Map();
+function readDurableIdentity(name) {
+    if (!name || !SESSION_NAME_RE.test(name)) return null;
+    let mtimeMs = 0;
+    try {
+        mtimeMs = fs.statSync(path.join(CLAUDE_SESSIONS_DIR, `${name}.meta`)).mtimeMs;
+    } catch (e) {
+        durableIdentityCache.delete(name);
+        return null;
+    }
+    const hit = durableIdentityCache.get(name);
+    if (hit && hit.mtimeMs === mtimeMs) return hit.value;
+    const value = readClaudeSessionMeta(name);
+    durableIdentityCache.set(name, { mtimeMs, value });
+    return value;
+}
+
+// THE identity accessor. Everything that asks "what is this session called,
+// where is it filed, who made it" comes through here.
+//
+// The layers are not peers. saved/runtime configs are CACHES that any code
+// path may recreate with defaults — `hop restore` writes one per session
+// with the INTERNAL name — while durable meta is where a user's own answers
+// are recorded and the only layer that survives the daemon. Merging
+// saved-over-runtime and stopping there meant a crash + restore silently
+// reverted every rename and un-filed every folder, because restore's freshly
+// written cache outranked the file that knew better. Meta wins for the
+// user-authored fields; everything else keeps the old precedence.
 function getEffectiveSessionConfig(name) {
     const saved = getSessionConfig(name);
     const runtime = getRuntimeSessionMetadata(name);
-    if (saved && runtime) {
-        return { ...runtime, ...saved };
+    const base = saved && runtime ? { ...runtime, ...saved } : (saved || runtime || null);
+    const durable = readDurableIdentity(name);
+    if (!durable) return base;
+    if (!base) {
+        return {
+            type: 'terminal',
+            displayName: durable.displayName,
+            folderId: durable.folderId,
+            createdBy: durable.createdBy,
+            cwd: durable.cwd
+        };
     }
-    return saved || runtime || null;
+    const merged = { ...base };
+    if (durable.displayName) merged.displayName = durable.displayName;
+    if (durable.folderId !== undefined) merged.folderId = durable.folderId || null;
+    if (durable.createdBy) merged.createdBy = durable.createdBy;
+    if (durable.tagline) merged.tagline = durable.tagline;
+    if (durable.parked !== undefined) merged.parked = durable.parked;
+    if (durable.archived !== undefined) merged.archived = durable.archived;
+    return merged;
 }
 
 function hasSavedSessionConfig(name) {
@@ -1994,6 +2041,9 @@ function saveHopConfig(config) {
 // session should be the session you left, not a summary of it. Set
 // resume_mode to "summary" (cheaper) or "ask" (leave the prompt alone).
 const RESUME_PROMPT_RE = /Resuming the full session|Resume from summary|Resume full session as-is/i;
+// Claude Code's own chrome — proof the app is up even when the room reports
+// the wrapper shell as its foreground process (argv launch).
+const CLAUDE_UI_RE = /bypass permissions on|shift\+tab to cycle|Welcome back|esc to interrupt|\? for shortcuts/i;
 function getResumeMode() {
     const mode = String(getHopConfig().resume_mode || '').toLowerCase();
     return mode === 'summary' || mode === 'ask' ? mode : 'full';
@@ -3839,7 +3889,9 @@ function writeClaudeSessionRecord(internalName, rec) {
     if (!internalName || !SESSION_NAME_RE.test(internalName)) return;
     try { fs.mkdirSync(CLAUDE_SESSIONS_DIR, { recursive: true }); } catch (e) { /* best effort */ }
     try {
-        fs.writeFileSync(path.join(CLAUDE_SESSIONS_DIR, `${internalName}.json`), JSON.stringify(rec), { mode: 0o600 });
+        // Same crash-safety as the metas: records are what lets a claude
+        // conversation resume at all.
+        writePrivateFile(path.join(CLAUDE_SESSIONS_DIR, `${internalName}.json`), JSON.stringify(rec), 0o600);
     } catch (e) { /* best effort */ }
 }
 
@@ -3881,7 +3933,14 @@ function writeClaudeSessionMeta(internalName, meta) {
     if (!internalName || !SESSION_NAME_RE.test(internalName)) return;
     try { fs.mkdirSync(CLAUDE_SESSIONS_DIR, { recursive: true }); } catch (e) { /* best effort */ }
     try {
-        fs.writeFileSync(path.join(CLAUDE_SESSIONS_DIR, `${internalName}.meta`), JSON.stringify(meta), { mode: 0o600 });
+        // ATOMIC + FSYNCED, not writeFileSync. The thermal-sleep crash proved
+        // the difference with a natural experiment: folders.json (written via
+        // writePrivateFile the same night) SURVIVED, while every meta
+        // rewritten in the prior three days — every rename, every folder
+        // filing — vanished with the un-fsynced page cache. These files are
+        // the restore inventory; they are exactly the data that must outlive
+        // a power cut.
+        writePrivateFile(path.join(CLAUDE_SESSIONS_DIR, `${internalName}.meta`), JSON.stringify(meta), 0o600);
     } catch (e) { /* best effort */ }
 }
 
@@ -4276,6 +4335,19 @@ async function restoreSavedSessionsUnlocked({ dryRun = false, includeAgents = fa
                 // a second copy on top of it (that is how command lines piled
                 // up in a shell that was busy booting).
                 if (running) { finish('already-running'); continue; }
+                // Same blindness applies before typing: a session whose
+                // command was launched as argv shows a shell here while
+                // claude runs beneath it. Typing again would land keystrokes
+                // in claude's own prompt.
+                try {
+                    const grid = await getRoomGridPreviewShared(job.plan.internalName);
+                    const text = String(grid?.text || '');
+                    if (RESUME_PROMPT_RE.test(text) || CLAUDE_UI_RE.test(text)) {
+                        job.state = 'verify';
+                        job.since = Date.now();
+                        continue;
+                    }
+                } catch (e) { /* fall through to typing */ }
                 // A fresh shell reports its own name once it has execed; that
                 // is our prompt-ready signal, and it beats guessing with a timer.
                 if (Date.now() - job.since < 400) continue;
@@ -4287,7 +4359,25 @@ async function restoreSavedSessionsUnlocked({ dryRun = false, includeAgents = fa
                 continue;
             }
             if (job.state === 'verify') {
-                if (running) {
+                // "Is it running?" cannot be answered by the foreground
+                // process alone. Argv launch runs `shell -lc "<cmd>; exec
+                // shell -l"`, so the foreground process is the WRAPPER SHELL
+                // for the whole life of the command — the very mechanism that
+                // replaced typing made the process check blind. After the
+                // crash restore, claude was sitting at its own resume prompt
+                // while this loop reported "never-started", retyped the
+                // command into that prompt, and gave up without answering it.
+                // The screen is the honest witness: a resume prompt, or
+                // claude's own chrome, means it is up.
+                let screenSaysRunning = false;
+                if (!running) {
+                    try {
+                        const grid = await getRoomGridPreviewShared(job.plan.internalName);
+                        const text = String(grid?.text || '');
+                        screenSaysRunning = RESUME_PROMPT_RE.test(text) || CLAUDE_UI_RE.test(text);
+                    } catch (e) { /* host busy — try again next tick */ }
+                }
+                if (running || screenSaysRunning) {
                     const key = resumeChoiceKey(getResumeMode());
                     if (!key) { finish('resumed'); continue; }
                     job.state = 'answer-prompt';
@@ -4990,6 +5080,14 @@ const resolveVia = (req) => {
 };
 
 function resolveActor(req) {
+    const declared = String(req?.headers?.[ACTOR_HEADER] || '').toLowerCase();
+    if (declared === 'agent' || declared === 'user') return declared;
+    // Undeclared: infer from the auth path. Cookie = a human in the web UI.
+    // Bearer token without the hop CLI's via stamp = automation.
+    if (req?.hopAuthVia === 'token') {
+        const via = String(req?.headers?.[VIA_HEADER] || '').toLowerCase();
+        if (via !== 'cli' && via !== 'web') return 'agent';
+    }
     return resolveActorFromHeaders(req?.headers || {}, ACTOR_HEADER);
 }
 
@@ -6077,9 +6175,25 @@ function syncSessionMetaFromRooms(rooms) {
     for (const room of rooms) {
         if (!room || typeof room.id !== 'string' || !SESSION_NAME_RE.test(room.id)) continue;
         const cwd = typeof room.cwd === 'string' ? room.cwd : '';
-        if (!cwd) continue;
         const existing = readClaudeSessionMeta(room.id);
-        if (existing && existing.cwd === cwd) continue;
+        // A room with no cwd used to be skipped entirely — so it never got a
+        // durable meta, and a session that only ever lived in the host's
+        // memory was UNRECOVERABLE the moment the host died: `hop restore`
+        // reads this directory, and a session absent from it cannot even be
+        // named, let alone relaunched. That is how a thermal-sleep crash took
+        // ten sessions with no trace. Every live room now leaves a record;
+        // cwd is filled in when it becomes known.
+        if (!existing) {
+            writeClaudeSessionMeta(room.id, {
+                internalName: room.id,
+                ...(cwd ? { cwd } : {}),
+                createdAt: new Date().toISOString(),
+                updatedAt: new Date().toISOString()
+            });
+            continue;
+        }
+        if (!cwd) continue;
+        if (existing.cwd === cwd) continue;
         // Carry an origin we already know; never invent one. This pass exists
         // to backfill cwd, and defaulting createdBy to 'user' here silently
         // stamped "human" onto every agent session whose origin lived only in
@@ -6299,6 +6413,28 @@ async function ensureExternalHayHostReady() {
     }
     try {
 
+    // Last look before spawning: an already-running, healthy host for THIS hop
+    // home means we must adopt it, not add a rival. Two hosts split the fleet —
+    // the daemon canonicalizes one, so every room on the loser goes invisible
+    // and dies unrecorded when it is reaped — and both thrash the same state
+    // files. The spawn lock above only serializes racing spawners; a host that
+    // survived a crash (or was started by hand) is outside its scope, which is
+    // how two hosts came to exist across the thermal-sleep crash.
+    try {
+        const survivors = (await inspectExternalHayHosts(true))
+            .filter((entry) => entry.healthy && hostBelongsToCurrentHome(entry, null));
+        const adoptable = survivors
+            .map((entry) => entry.host)
+            .filter((host) => host && Number.isInteger(host.pid) && isProcessAlive(host.pid))
+            .sort((a, b) => (b.startedAt || 0) - (a.startedAt || 0))[0];
+        if (adoptable) {
+            log(`[host] adopting the running host (pid ${adoptable.pid}, port ${adoptable.port}) instead of spawning a rival`, DIM);
+            writeHayHostStateFile(adoptable);
+            hayHostState = adoptable;
+            return adoptable;
+        }
+    } catch (e) { /* inspection failed — spawning is still the right move */ }
+
     const hostScript = path.join(__dirname, 'scripts', 'hay-host.js');
     if (!fs.existsSync(hostScript)) {
         throw new Error('Hay host script missing');
@@ -6940,6 +7076,14 @@ function startAuthProxy(authEmitter) {
             : null;
         const isAuthenticated = cookies[SESSION_COOKIE_NAME] === SESSION_SECRET
             || tokenFromHeader === SESSION_SECRET;
+        // How this request proved itself decides the DEFAULT actor. Humans
+        // reach the API through the web UI (cookie) or the hop CLI (which
+        // stamps x-hop-via); a raw Bearer-token call with neither is, in
+        // practice, always automation — an agent's script, a probe, a cron.
+        // Those callers rarely remember to declare x-hop-actor, and every
+        // one that forgot used to land its sessions in the USER tab
+        // (SelectProbe et al). Explicit headers still win outright.
+        req.hopAuthVia = cookies[SESSION_COOKIE_NAME] === SESSION_SECRET ? 'cookie' : 'token';
 
         // API: Auth status (used by local CLI to wait for remote login)
         if (parsedUrl.pathname === '/api/auth' && req.method === 'GET') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hop2",
-  "version": "0.11.2",
+  "version": "0.11.3",
   "description": "🐰 Hop into your terminal from anywhere. Secure remote shell access with 2FA via Cloudflare Tunnel. Next-gen rewrite with native terminal sharing.",
   "main": "hop",
   "bin": {

package/scripts/claude-session-hook.js

@@ -18,6 +18,27 @@
 
 const fs = require("node:fs");
 const os = require("node:os");
+
+// Crash-safe write: temp + fsync + atomic rename. Records are the restore
+// inventory — an un-fsynced page cache at power loss must not be able to
+// take a conversation's identity with it (the 07-29 thermal-sleep crash
+// erased three days of plainly-written files while fsynced ones survived).
+function writeDurable(file, data) {
+  try {
+    const tmp = `${file}.tmp-${process.pid}`;
+    const fd = fs.openSync(tmp, "w", 0o600);
+    try {
+      fs.writeSync(fd, data);
+      fs.fsyncSync(fd);
+    } finally {
+      fs.closeSync(fd);
+    }
+    fs.renameSync(tmp, file);
+  } catch {
+    try { fs.writeFileSync(file, data, { mode: 0o600 }); } catch { /* never disrupt claude */ }
+  }
+}
+
 const path = require("node:path");
 const { execFileSync } = require("node:child_process");
 
@@ -86,13 +107,13 @@ function recordSession(dir, hopSession, payload) {
     const prev = JSON.parse(prevRaw);
     if (prev && prev.sessionId && prev.sessionId !== sessionId && prev.cwd && prev.cwd !== cwd) {
       try {
-        fs.writeFileSync(path.join(dir, `${hopSession}.other.json`), record, { mode: 0o600 });
+        writeDurable(path.join(dir, `${hopSession}.other.json`), record);
       } catch { /* ignore */ }
       return;
     }
   } catch { /* no incumbent (or unreadable) — record normally */ }
   try {
-    fs.writeFileSync(file, record, { mode: 0o600 });
+    writeDurable(file, record);
   } catch { /* ignore */ }
 }
 
@@ -109,7 +130,7 @@ function bumpTurn(dir, hopSession, payload) {
     at: new Date().toISOString()
   });
   try {
-    fs.writeFileSync(file, record, { mode: 0o600 });
+    writeDurable(file, record);
   } catch { /* ignore */ }
 }
 

package/scripts/hay-host.js

@@ -378,6 +378,17 @@ async function main() {
         );
     });
 
+    // Periodic notekeeping: the shutdown handler only runs on a GRACEFUL
+    // exit, so a crash (thermal sleep, power cut, SIGKILL) used to leave no
+    // buffers at all — `hop restore` had screens to replay only when the
+    // stop was polite. Flush the same bounded tails every few minutes; a
+    // crash now costs at most the last interval of scrollback.
+    const bufferFlushTimer = setInterval(() => {
+        if (shuttingDown) return;
+        try { persistRoomBuffers(rooms); } catch (e) { /* next tick */ }
+    }, 4 * 60 * 1000);
+    bufferFlushTimer.unref?.();
+
     const shutdown = () => {
         shuttingDown = true; // keep restore records for rooms killed by this shutdown
         // Persist tail buffers BEFORE closeAll() kills the PTYs, so a graceful

package/tests/terminal-api.integration.test.cjs

@@ -584,3 +584,29 @@ test('a display name freed by a later rename can be reused', async () => {
   await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/delete', { name: 'Final', internalName: 'AliasOne' });
   await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/delete', { name: 'Freed', internalName: 'AliasTwo' });
 });
+
+// Regression: an undeclared Bearer-token creation is automation, not a human.
+// Agents' raw scripts rarely remember x-hop-actor, and every one that forgot
+// landed its sessions in the USER tab (SelectProbe). Cookie-auth (the web UI)
+// and the hop CLI's via stamp still default to user; explicit headers win.
+test('bare token API creations default to agent origin', async () => {
+  await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions',
+    { name: 'BareTokenProbe', type: 'terminal', cwd: tempDir, startRuntime: true });
+  await delay(400);
+  const list = await requestJson(state.port, state.sessionSecret, 'GET', '/api/sessions');
+  const s = list.data.sessions.find(x => x.internalName === 'BareTokenProbe');
+  assert.ok(s, 'session exists');
+  assert.equal(s.createdBy, 'agent', `undeclared token caller must be agent, got ${s.createdBy}`);
+
+  // The hop CLI's own via stamp keeps humans human.
+  await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions',
+    { name: 'CliUserProbe', type: 'terminal', cwd: tempDir, startRuntime: true },
+    { 'X-Hop-Via': 'cli' });
+  await delay(400);
+  const list2 = await requestJson(state.port, state.sessionSecret, 'GET', '/api/sessions');
+  const s2 = list2.data.sessions.find(x => x.internalName === 'CliUserProbe');
+  assert.equal(s2 && s2.createdBy, 'user', 'CLI-stamped caller stays user');
+
+  await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/delete', { name: 'BareTokenProbe', internalName: 'BareTokenProbe' });
+  await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/delete', { name: 'CliUserProbe', internalName: 'CliUserProbe' });
+});