hop2 0.11.2 → 0.11.4

package/hopa

@@ -286,7 +286,12 @@ async function resolveTerminalRef(server, ref) {
     const parsed = JSON.parse((listed.content || []).map((c) => c.text || '').join(''));
     terminals = Array.isArray(parsed.terminals) ? parsed.terminals : [];
   } catch { return ref; }
-  const matches = terminals.filter((t) => t && (t.sessionName === ref || t.displayName === ref || t.id === ref));
+  const exact = terminals.filter((t) => t && (t.sessionName === ref || t.displayName === ref || t.id === ref));
+  // Name refs fold case (unique match only) — same rule as the daemon's lookup.
+  const refLower = ref.toLowerCase();
+  const foldsTo = (v) => typeof v === 'string' && v.toLowerCase() === refLower;
+  const matches = exact.length ? exact
+    : terminals.filter((t) => t && (foldsTo(t.sessionName) || foldsTo(t.displayName) || foldsTo(t.id)));
   if (matches.length === 1) return matches[0].id;
   if (matches.length > 1) {
     fail(`"${ref}" matches ${matches.length} terminals: ${matches.map((t) => t.id).join(', ')}`, 2);

package/lib/hay-host-watchdog.js

@@ -0,0 +1,97 @@
+'use strict';
+
+function emptyFailureState() {
+  return { pid: 0, count: 0, firstAt: 0 };
+}
+
+function createFailureTracker({ requiredFailures, windowMs, now = Date.now }) {
+  if (!Number.isInteger(requiredFailures) || requiredFailures < 1) {
+    throw new TypeError('requiredFailures must be a positive integer');
+  }
+  if (!Number.isFinite(windowMs) || windowMs < 0) {
+    throw new TypeError('windowMs must be a non-negative number');
+  }
+  if (typeof now !== 'function') {
+    throw new TypeError('now must be a function');
+  }
+
+  let state = emptyFailureState();
+
+  return {
+    recordFailure(pid) {
+      if (!Number.isInteger(pid) || pid <= 0) {
+        throw new TypeError('pid must be a positive integer');
+      }
+      const at = now();
+      if (state.pid !== pid) {
+        state = { pid, count: 0, firstAt: at };
+      }
+      state.count += 1;
+      const failingForMs = Math.max(0, at - state.firstAt);
+      return {
+        ...state,
+        failingForMs,
+        shouldRestart: state.count >= requiredFailures && failingForMs >= windowMs
+      };
+    },
+
+    recordSuccess(pid) {
+      const recovered = state.pid === pid && state.count > 0
+        ? { ...state, failingForMs: Math.max(0, now() - state.firstAt) }
+        : null;
+      state = emptyFailureState();
+      return recovered;
+    },
+
+    reset() {
+      state = emptyFailureState();
+    },
+
+    snapshot() {
+      return { ...state };
+    }
+  };
+}
+
+function createSingleFlight() {
+  let pending = null;
+
+  return {
+    run(work) {
+      if (pending) return pending;
+      if (typeof work !== 'function') {
+        throw new TypeError('work must be a function');
+      }
+      const current = Promise.resolve().then(work);
+      pending = current;
+      const clear = () => {
+        if (pending === current) pending = null;
+      };
+      current.then(clear, clear);
+      return current;
+    },
+
+    isRunning() {
+      return pending !== null;
+    }
+  };
+}
+
+function sameHostIncarnation(a, b) {
+  if (!a || !b) return false;
+  if (Number(a.pid) !== Number(b.pid) || Number(a.port) !== Number(b.port)) {
+    return false;
+  }
+  const aStartedAt = Number(a.startedAt);
+  const bStartedAt = Number(b.startedAt);
+  if (aStartedAt > 0 && bStartedAt > 0) {
+    return aStartedAt === bStartedAt;
+  }
+  return true;
+}
+
+module.exports = {
+  createFailureTracker,
+  createSingleFlight,
+  sameHostIncarnation
+};

package/mcp/hop-mcp.js

@@ -4901,7 +4901,12 @@ class HopMCPServer {
     try {
       const listed = await this.callApi('GET', '/api/sessions');
       if (listed && Array.isArray(listed.sessions)) {
-        const match = listed.sessions.find((s) => s && (s.name === name || s.displayName === name || s.internalName === name));
+        const nameLower = name.toLowerCase();
+        const foldsTo = (v) => typeof v === 'string' && v.toLowerCase() === nameLower;
+        const exact = listed.sessions.find((s) => s && (s.name === name || s.displayName === name || s.internalName === name));
+        // Case-insensitive fallback (unique match only) — same rule as the daemon.
+        const folded = exact ? [] : listed.sessions.filter((s) => s && (foldsTo(s.name) || foldsTo(s.displayName) || foldsTo(s.internalName)));
+        const match = exact || (folded.length === 1 ? folded[0] : null);
         if (match) {
           matched = true;
           internalName = match.internalName || match.name || name;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hop2",
-  "version": "0.11.2",
+  "version": "0.11.4",
   "description": "🐰 Hop into your terminal from anywhere. Secure remote shell access with 2FA via Cloudflare Tunnel. Next-gen rewrite with native terminal sharing.",
   "main": "hop",
   "bin": {

package/scripts/claude-session-hook.js

@@ -18,6 +18,27 @@
 
 const fs = require("node:fs");
 const os = require("node:os");
+
+// Crash-safe write: temp + fsync + atomic rename. Records are the restore
+// inventory — an un-fsynced page cache at power loss must not be able to
+// take a conversation's identity with it (the 07-29 thermal-sleep crash
+// erased three days of plainly-written files while fsynced ones survived).
+function writeDurable(file, data) {
+  try {
+    const tmp = `${file}.tmp-${process.pid}`;
+    const fd = fs.openSync(tmp, "w", 0o600);
+    try {
+      fs.writeSync(fd, data);
+      fs.fsyncSync(fd);
+    } finally {
+      fs.closeSync(fd);
+    }
+    fs.renameSync(tmp, file);
+  } catch {
+    try { fs.writeFileSync(file, data, { mode: 0o600 }); } catch { /* never disrupt claude */ }
+  }
+}
+
 const path = require("node:path");
 const { execFileSync } = require("node:child_process");
 
@@ -86,13 +107,13 @@ function recordSession(dir, hopSession, payload) {
     const prev = JSON.parse(prevRaw);
     if (prev && prev.sessionId && prev.sessionId !== sessionId && prev.cwd && prev.cwd !== cwd) {
       try {
-        fs.writeFileSync(path.join(dir, `${hopSession}.other.json`), record, { mode: 0o600 });
+        writeDurable(path.join(dir, `${hopSession}.other.json`), record);
       } catch { /* ignore */ }
       return;
     }
   } catch { /* no incumbent (or unreadable) — record normally */ }
   try {
-    fs.writeFileSync(file, record, { mode: 0o600 });
+    writeDurable(file, record);
   } catch { /* ignore */ }
 }
 
@@ -109,7 +130,7 @@ function bumpTurn(dir, hopSession, payload) {
     at: new Date().toISOString()
   });
   try {
-    fs.writeFileSync(file, record, { mode: 0o600 });
+    writeDurable(file, record);
   } catch { /* ignore */ }
 }
 

package/scripts/hay-host.js

@@ -370,7 +370,9 @@ async function main() {
                 cols,
                 rows,
                 // Per-connection snapshot cap (monitor tiles ask small).
-                replayBytes: Number.isFinite(replayRaw) && replayRaw > 0 ? replayRaw : undefined,
+                // 0 passes through as an explicit "no snapshot" — dropping it
+                // to undefined made claim sockets pull the full default tail.
+                replayBytes: Number.isFinite(replayRaw) && replayRaw >= 0 ? replayRaw : undefined,
                 // nudge=0: viewer already shows the current grid (wall tile)
                 nudge: wsUrl.searchParams.get('nudge') === '0' ? false : undefined
             },
@@ -378,6 +380,17 @@ async function main() {
         );
     });
 
+    // Periodic notekeeping: the shutdown handler only runs on a GRACEFUL
+    // exit, so a crash (thermal sleep, power cut, SIGKILL) used to leave no
+    // buffers at all — `hop restore` had screens to replay only when the
+    // stop was polite. Flush the same bounded tails every few minutes; a
+    // crash now costs at most the last interval of scrollback.
+    const bufferFlushTimer = setInterval(() => {
+        if (shuttingDown) return;
+        try { persistRoomBuffers(rooms); } catch (e) { /* next tick */ }
+    }, 4 * 60 * 1000);
+    bufferFlushTimer.unref?.();
+
     const shutdown = () => {
         shuttingDown = true; // keep restore records for rooms killed by this shutdown
         // Persist tail buffers BEFORE closeAll() kills the PTYs, so a graceful

package/scripts/salvage-and-restart-host.js

@@ -68,6 +68,50 @@ const salvageRoom = (port, id) => new Promise((resolve) => {
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
+// Daemon API (Bearer-token) — used for the pre/post state census: room IDs
+// alone can't tell whether RENAMES and FOLDERS survived, and "restored" must
+// mean the user-visible state came back, not merely that a PTY exists.
+const daemonApi = (method, p, body) => new Promise((resolve) => {
+  const ds = daemonState();
+  const data = body ? JSON.stringify(body) : null;
+  const req = http.request({
+    host: '127.0.0.1', port: ds.port, path: p, method,
+    headers: { Authorization: 'Bearer ' + ds.sessionSecret, ...(data ? { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) } : {}) }
+  }, (res) => { let d = ''; res.on('data', (c) => d += c); res.on('end', () => resolve({ status: res.statusCode, data: d })); });
+  req.on('error', () => resolve({ status: 0, data: '' }));
+  // destroy() WITH an error: a bare destroy() emits no 'error' event, the
+  // promise never settles, and the whole run hangs silently on one slow
+  // request (exactly what stranded the first verified restart at RECONCILE).
+  req.setTimeout(20000, () => req.destroy(new Error('timeout')));
+  if (data) req.end(data); else req.end();
+});
+
+const sessionCensus = async () => {
+  const res = await daemonApi('GET', '/api/sessions');
+  try {
+    const sessions = JSON.parse(res.data).sessions || [];
+    const map = {};
+    for (const s of sessions) {
+      if (!s || s.type === 'port') continue;
+      map[s.internalName || s.name] = {
+        displayName: s.displayName || s.name,
+        folderId: s.folderId || null,
+        live: !!s.live
+      };
+    }
+    return map;
+  } catch (e) { return null; }
+};
+
+// Same screen-witness the restore machinery trusts: claude's own chrome.
+const CLAUDE_UI_RE = /bypass permissions on|shift\+tab to cycle|Welcome back|esc to interrupt|\? for shortcuts/i;
+const RESUME_PROMPT_RE = /Resuming the full session|Resume from summary|Resume full session as-is/i;
+
+const roomPreviewText = async (id) => {
+  const res = await daemonApi('GET', `/api/sessions/preview?name=${encodeURIComponent(id)}`);
+  try { return String(JSON.parse(res.data).text || ''); } catch (e) { return ''; }
+};
+
 // Same lifecycle lock the hop CLI takes (~/.hop2/.lifecycle.lock): this run
 // cycles the host, and a `hop stop`/`start`/`restore` landing in the middle
 // of it kills sessions mid-relaunch. Stale holders (dead pid, absurdly old)
@@ -128,6 +172,12 @@ const releaseLock = () => {
     const preRooms = (await hostGet('/rooms')).rooms;
     const rooms = preRooms.map((r) => r.id);
     fs.writeFileSync(path.join(OUT, 'pre-rooms.json'), JSON.stringify(preRooms, null, 1), { mode: 0o600 });
+    // Daemon-side census too: display names and folder membership are the
+    // state the user actually sees, and "back to the same state" is judged
+    // against THIS, not against bare room ids.
+    const preSessions = await sessionCensus();
+    if (preSessions) fs.writeFileSync(path.join(OUT, 'pre-sessions.json'), JSON.stringify(preSessions, null, 1), { mode: 0o600 });
+    else log('WARN: pre-restart daemon census unavailable — name/folder verification will be skipped');
     log(`salvaging ${rooms.length} rooms -> ${OUT}`);
     const salvageStats = {};
     for (const id of rooms) {
@@ -173,6 +223,72 @@ const releaseLock = () => {
       fs.writeFileSync(path.join(OUT, 'reconcile.json'),
         JSON.stringify({ preCount: rooms.length, restored, missing, extra, salvageMisses }, null, 1), { mode: 0o600 });
     } catch (e) { log('reconcile err: ' + e.message); }
+
+    // 4b. STATE verification: names, folders, and claude actually resumed.
+    // A room can exist while wearing the wrong name, sitting in no folder,
+    // or stuck at claude's resume question — each of those has happened, and
+    // each reads as "restore worked" to a bare room-id reconcile.
+    try {
+      const preSessions = JSON.parse(fs.readFileSync(path.join(OUT, 'pre-sessions.json'), 'utf8'));
+      const claudeRooms = rooms.filter((id) =>
+        fs.existsSync(path.join(HOME, 'claude-sessions', `${id}.json`)));
+      const problems = [];
+      const post = await sessionCensus() || {};
+      for (const [id, pre] of Object.entries(preSessions)) {
+        if (!pre.live) continue; // dead-at-shutdown sessions owe nothing
+        const cur = post[id];
+        if (!cur || !cur.live) { problems.push(`${id}: not live after restore`); continue; }
+        if (cur.displayName !== pre.displayName) problems.push(`${id}: name "${pre.displayName}" → "${cur.displayName}"`);
+        if ((cur.folderId || null) !== (pre.folderId || null)) problems.push(`${id}: folder ${pre.folderId || '(none)'} → ${cur.folderId || '(none)'}`);
+      }
+      // Claude resume witness: poll each claude room's screen for claude's
+      // own chrome; a lingering resume question gets answered by the same
+      // command a human would use, then re-checked.
+      let pendingClaude = new Set(claudeRooms);
+      let resumeNudged = false;
+      for (let i = 0; i < 18 && pendingClaude.size > 0; i++) {
+        for (const id of [...pendingClaude]) {
+          const text = await roomPreviewText(id);
+          if (CLAUDE_UI_RE.test(text) && !RESUME_PROMPT_RE.test(text)) { pendingClaude.delete(id); continue; }
+          if (RESUME_PROMPT_RE.test(text) && !resumeNudged) {
+            resumeNudged = true;
+            log('resume question on screen — running hop resume-waiting');
+            try { log(execSync('hop resume-waiting 2>&1 | tail -5', { encoding: 'utf8', timeout: 90000 })); } catch (e) { log('resume-waiting err: ' + e.message); }
+          }
+        }
+        if (pendingClaude.size > 0) await sleep(5000);
+      }
+      for (const id of pendingClaude) problems.push(`${id}: claude chrome never appeared (still starting, or resume failed)`);
+      log(`VERIFY: ${Object.keys(preSessions).filter((k) => preSessions[k].live).length} live sessions checked, ` +
+        `${claudeRooms.length} claude rooms witnessed, ${problems.length} problem(s)`);
+      for (const p of problems) log(`VERIFY FAIL: ${p}`);
+      if (problems.length === 0) log('VERIFY: state matches the pre-restart census — names, folders, claude all back ✓');
+      fs.writeFileSync(path.join(OUT, 'verification.json'), JSON.stringify({ problems, claudeRooms }, null, 1), { mode: 0o600 });
+    } catch (e) { log('verify err: ' + (e && e.stack || e)); }
+
+    // 4c. Serialized-attach probe: the whole point of this cycle is the new
+    // host code — witness a serialized snapshot (in-band RIS prefix) on a
+    // bounded-replay attach, exactly as a wall tile would connect.
+    try {
+      const probeRoom = rooms.find((id) => id !== 'Solstice') || rooms[0];
+      const nh = hostState();
+      const result = await new Promise((resolve) => {
+        const ws = new WebSocket(`ws://127.0.0.1:${nh.port}/ws?room=${encodeURIComponent(probeRoom)}&name=verify&cols=100&rows=30&replay=65536&nudge=0`);
+        const timer = setTimeout(() => { try { ws.close(); } catch (e) {} resolve('timeout'); }, 15000);
+        ws.on('message', (data) => {
+          try {
+            const msg = JSON.parse(String(data));
+            if (msg.type === 'snapshot') {
+              clearTimeout(timer);
+              try { ws.close(); } catch (e) {}
+              resolve(msg.data.startsWith('\x1bc') ? `serialized (${msg.data.length}B, capped=${msg.capped === true})` : `raw (${msg.data.length}B)`);
+            }
+          } catch (e) { /* keep waiting */ }
+        });
+        ws.on('error', () => { clearTimeout(timer); resolve('ws-error'); });
+      });
+      log(`serialized attach probe on ${probeRoom}: ${result}${String(result).startsWith('serialized') ? ' ✓ ACTIVE' : ' — NOT active'}`);
+    } catch (e) { log('serialized probe err: ' + e.message); }
     const ds = daemonState();
     const api = (method, p, body) => new Promise((resolve) => {
       const data = body ? JSON.stringify(body) : null;

package/tests/hay-host-watchdog.unit.test.cjs

@@ -0,0 +1,109 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const {
+  createFailureTracker,
+  createSingleFlight,
+  sameHostIncarnation
+} = require('../lib/hay-host-watchdog');
+
+test('a successful probe resets the complete failure streak', () => {
+  let now = 0;
+  const tracker = createFailureTracker({
+    requiredFailures: 3,
+    windowMs: 60_000,
+    now: () => now
+  });
+
+  assert.equal(tracker.recordFailure(42).shouldRestart, false);
+  now = 17_000;
+  assert.equal(tracker.recordFailure(42).shouldRestart, false);
+
+  now = 53_000;
+  const recovered = tracker.recordSuccess(42);
+  assert.equal(recovered.count, 2);
+  assert.deepEqual(tracker.snapshot(), { pid: 0, count: 0, firstAt: 0 });
+
+  now = 62_000;
+  const nextFailure = tracker.recordFailure(42);
+  assert.equal(nextFailure.count, 1);
+  assert.equal(nextFailure.failingForMs, 0);
+  assert.equal(nextFailure.shouldRestart, false);
+});
+
+test('restart requires enough consecutive failures spanning the full window', () => {
+  let now = 0;
+  const tracker = createFailureTracker({
+    requiredFailures: 3,
+    windowMs: 60_000,
+    now: () => now
+  });
+
+  tracker.recordFailure(7);
+  now = 20_000;
+  tracker.recordFailure(7);
+  now = 59_999;
+  assert.equal(tracker.recordFailure(7).shouldRestart, false);
+  now = 60_000;
+  assert.equal(tracker.recordFailure(7).shouldRestart, true);
+});
+
+test('failure history never crosses host incarnations', () => {
+  let now = 0;
+  const tracker = createFailureTracker({
+    requiredFailures: 3,
+    windowMs: 60_000,
+    now: () => now
+  });
+
+  tracker.recordFailure(7);
+  now = 61_000;
+  const firstFailureForReplacement = tracker.recordFailure(8);
+  assert.equal(firstFailureForReplacement.count, 1);
+  assert.equal(firstFailureForReplacement.failingForMs, 0);
+  assert.equal(firstFailureForReplacement.shouldRestart, false);
+});
+
+test('single flight shares one operation across concurrent callers and clears afterward', async () => {
+  const flight = createSingleFlight();
+  let starts = 0;
+  let release;
+  const blocked = new Promise((resolve) => { release = resolve; });
+  const work = async () => {
+    starts += 1;
+    await blocked;
+    return 'ready';
+  };
+
+  const callers = Array.from({ length: 15 }, () => flight.run(work));
+  assert.equal(starts, 0, 'work starts on the next microtask');
+  await Promise.resolve();
+  assert.equal(starts, 1);
+  assert.equal(new Set(callers).size, 1, 'all callers receive the same promise');
+
+  release();
+  assert.deepEqual(await Promise.all(callers), Array(15).fill('ready'));
+  assert.equal(flight.isRunning(), false);
+
+  assert.equal(await flight.run(async () => {
+    starts += 1;
+    return 'again';
+  }), 'again');
+  assert.equal(starts, 2);
+});
+
+test('single flight clears after a rejected operation so recovery can retry', async () => {
+  const flight = createSingleFlight();
+  await assert.rejects(flight.run(async () => {
+    throw new Error('probe failed');
+  }), /probe failed/);
+  assert.equal(flight.isRunning(), false);
+  assert.equal(await flight.run(async () => 'recovered'), 'recovered');
+});
+
+test('host incarnation comparison includes pid, port, and start time', () => {
+  const host = { pid: 7, port: 5000, startedAt: 100 };
+  assert.equal(sameHostIncarnation(host, { ...host }), true);
+  assert.equal(sameHostIncarnation(host, { ...host, pid: 8 }), false);
+  assert.equal(sameHostIncarnation(host, { ...host, port: 5001 }), false);
+  assert.equal(sameHostIncarnation(host, { ...host, startedAt: 101 }), false);
+});

package/tests/terminal-api.integration.test.cjs

@@ -584,3 +584,103 @@ test('a display name freed by a later rename can be reused', async () => {
   await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/delete', { name: 'Final', internalName: 'AliasOne' });
   await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/delete', { name: 'Freed', internalName: 'AliasTwo' });
 });
+
+// Regression: folder membership must survive every cache rebuild. The store
+// entry is a CACHE any path may recreate without folderId (restore's fresh
+// session definitions did exactly that), and buildSessionEntries' store loop
+// read that raw cache — clobbering the correct value the durable meta (and
+// the live-rooms loop) already knew. Nine of eleven folder assignments
+// vanished from the UI after a host cycle while every meta on disk was right.
+test('folder membership survives restore re-registration and a daemon restart', async () => {
+  await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions',
+    { name: 'FolderKeeper', type: 'terminal', cwd: tempDir, startRuntime: true });
+  await delay(600);
+  const folder = await requestJson(state.port, state.sessionSecret, 'POST', '/api/folders', { name: 'KeeperShelf' });
+  assert.equal(folder.status, 200, `folder create failed: ${JSON.stringify(folder.data)}`);
+  const folderId = folder.data.folder.id;
+  const moved = await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/move',
+    { name: 'FolderKeeper', folderId });
+  assert.equal(moved.status, 200, `move failed: ${JSON.stringify(moved.data)}`);
+
+  const listedNow = await requestJson(state.port, state.sessionSecret, 'GET', '/api/sessions');
+  assert.equal(listedNow.data.sessions.find(s => s.internalName === 'FolderKeeper')?.folderId, folderId,
+    'freshly moved session must list its folder');
+
+  // Restore re-registration recreates cached session definitions — the write
+  // that used to outrank the durable meta in the listing.
+  await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/restore', {});
+  await delay(1200);
+  const afterRestore = await requestJson(state.port, state.sessionSecret, 'GET', '/api/sessions');
+  assert.equal(afterRestore.data.sessions.find(s => s.internalName === 'FolderKeeper')?.folderId, folderId,
+    'folder membership must survive restore re-registration');
+
+  const previousState = state;
+  await stopDaemon(true);
+  await launchDaemon(previousState);
+  const afterRestart = await requestJson(state.port, state.sessionSecret, 'GET', '/api/sessions');
+  assert.equal(afterRestart.data.sessions.find(s => s.internalName === 'FolderKeeper')?.folderId, folderId,
+    'folder membership must survive a daemon restart');
+
+  await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/delete', { name: 'FolderKeeper', internalName: 'FolderKeeper' });
+});
+
+// Session names resolve case-insensitively everywhere a name addresses a
+// session: exact-case wearers win, a UNIQUE folded match resolves, and two
+// sessions differing only by case stay exact-only rather than guessed at.
+test('session names resolve case-insensitively', async () => {
+  await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions',
+    { name: 'CaseFold', type: 'terminal', cwd: tempDir, startRuntime: true });
+  await delay(600);
+
+  // A by-name API call accepts any casing — no internalName hint given.
+  const renamed = await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/rename',
+    { oldName: 'casefold', newName: 'CaseKept' });
+  assert.equal(renamed.status, 200, `lowercase lookup must find CaseFold: ${JSON.stringify(renamed.data)}`);
+
+  // Changing ONLY the casing of your own name is not a collision.
+  const caseOnly = await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/rename',
+    { oldName: 'CaseKept', newName: 'casekept' });
+  assert.equal(caseOnly.status, 200, `case-only rename must be allowed: ${JSON.stringify(caseOnly.data)}`);
+
+  const list = await requestJson(state.port, state.sessionSecret, 'GET', '/api/sessions');
+  const worn = list.data.sessions.filter(s => s.internalName === 'CaseFold');
+  assert.equal(worn.length, 1, 'still exactly one session — folded lookups must never mint twins');
+  assert.equal(worn[0].displayName, 'casekept', 'the case-only rename is the worn spelling');
+
+  // A name another session wears — in ANY casing — is a collision.
+  await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions',
+    { name: 'CaseOther', type: 'terminal', cwd: tempDir, startRuntime: true });
+  await delay(400);
+  const collide = await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/rename',
+    { oldName: 'CaseOther', newName: 'CASEKEPT', internalName: 'CaseOther' });
+  assert.equal(collide.status, 409, 'a differently-cased spelling of a worn name must be refused');
+
+  await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/delete', { name: 'casekept', internalName: 'CaseFold' });
+  await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/delete', { name: 'CaseOther', internalName: 'CaseOther' });
+});
+
+// Regression: an undeclared Bearer-token creation is automation, not a human.
+// Agents' raw scripts rarely remember x-hop-actor, and every one that forgot
+// landed its sessions in the USER tab (SelectProbe). Cookie-auth (the web UI)
+// and the hop CLI's via stamp still default to user; explicit headers win.
+test('bare token API creations default to agent origin', async () => {
+  await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions',
+    { name: 'BareTokenProbe', type: 'terminal', cwd: tempDir, startRuntime: true });
+  await delay(400);
+  const list = await requestJson(state.port, state.sessionSecret, 'GET', '/api/sessions');
+  const s = list.data.sessions.find(x => x.internalName === 'BareTokenProbe');
+  assert.ok(s, 'session exists');
+  assert.equal(s.createdBy, 'agent', `undeclared token caller must be agent, got ${s.createdBy}`);
+
+  // The hop CLI's own via stamp keeps humans human.
+  await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions',
+    { name: 'CliUserProbe', type: 'terminal', cwd: tempDir, startRuntime: true },
+    { 'X-Hop-Via': 'cli' });
+  await delay(400);
+  const list2 = await requestJson(state.port, state.sessionSecret, 'GET', '/api/sessions');
+  const s2 = list2.data.sessions.find(x => x.internalName === 'CliUserProbe');
+  assert.equal(s2 && s2.createdBy, 'user', 'CLI-stamped caller stays user');
+
+  await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/delete', { name: 'BareTokenProbe', internalName: 'BareTokenProbe' });
+  await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/delete', { name: 'CliUserProbe', internalName: 'CliUserProbe' });
+});