hop2 0.11.20 → 0.11.21

package/hay-web/index.html

@@ -6,7 +6,7 @@
     <!-- Terminal prompt chevron on a dark tile — reads "terminal app" at 16px. -->
     <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='7' fill='%2317181d'/%3E%3Cpath d='M11 9.5 L20.5 16 L11 22.5' fill='none' stroke='%23a78bfa' stroke-width='4' stroke-linecap='round' stroke-linejoin='round'/%3E%3C/svg%3E" />
     <title>Hay</title>
-    <script type="module" crossorigin src="/assets/index-BbSHpMlM.js"></script>
+    <script type="module" crossorigin src="/assets/index-DjSB7l7z.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-B8TPcotl.css">
   </head>
   <body>

package/hop

@@ -500,6 +500,45 @@ function viewSummaryBySession() {
     return viewSummaryCache.bySession;
 }
 
+// The log's budget. Jian's design: views are "a size-capped recent log" —
+// one kind of entry, one removal gesture, and the cap does the housekeeping
+// nobody wants to do by hand. Oldest FILE views evict first once the fleet's
+// published bytes exceed the budget; live-server rows weigh nothing and are
+// never evicted. Copies only, as always — sources are not hop's to touch.
+const VIEWS_BUDGET_BYTES = (Number(process.env.HOP_VIEWS_BUDGET_MB) > 0
+    ? Number(process.env.HOP_VIEWS_BUDGET_MB) : 2048) * 1024 * 1024;
+function enforceViewBudget() {
+    try {
+        const files = [];
+        for (const sess of fs.readdirSync(VIEWS_DIR)) {
+            const dir = path.join(VIEWS_DIR, sess);
+            if (sess === 'manifest.json' || sess.startsWith('.')
+                || !fs.statSync(dir).isDirectory()) continue;
+            const meta = readViewMeta(sess);
+            for (const f of fs.readdirSync(dir)) {
+                if (f.startsWith('.')) continue;
+                if (meta[f]?.kind === 'server') continue;
+                const st = fs.statSync(path.join(dir, f));
+                if (st.isFile()) files.push({ sess, f, bytes: st.size, mtime: st.mtimeMs });
+            }
+        }
+        let total = files.reduce((a, b) => a + b.bytes, 0);
+        if (total <= VIEWS_BUDGET_BYTES) return;
+        files.sort((a, b) => a.mtime - b.mtime);
+        for (const it of files) {
+            if (total <= VIEWS_BUDGET_BYTES) break;
+            try {
+                fs.rmSync(path.join(VIEWS_DIR, it.sess, it.f));
+                const meta = readViewMeta(it.sess);
+                delete meta[it.f];
+                writeViewMeta(it.sess, meta);
+                total -= it.bytes;
+                log(`[views] budget: evicted ${it.sess}/${it.f} (${Math.round(it.bytes / 1024)} KB, oldest first)`, DIM);
+            } catch (e) { /* the next candidate still evicts */ }
+        }
+    } catch (e) { /* a failed sweep never blocks a publish */ }
+}
+
 // The virtual folder both `hop view` and `hop port --attached` publish into:
 // clients browse every view through one manifest, REBUILT from a disk scan
 // rather than read-modify-written, so two agents publishing at once cannot
@@ -514,6 +553,7 @@ function viewSummaryBySession() {
 function rebuildViewManifest() {
     try {
         migrateLegacyViews();
+        enforceViewBudget();
         const entries = [];
         for (const sess of fs.readdirSync(VIEWS_DIR)) {
             const dir = path.join(VIEWS_DIR, sess);
@@ -4626,6 +4666,7 @@ async function attachExternalTerminalApiClient(sessionName, displayName, opts =
         startup: opts.startup,
         autoStart: opts.autoStart,
         createdBy: opts.createdBy,
+        createdVia: opts.createdVia,
         agentPermitted: opts.agentPermitted,
         workspaceName: opts.workspaceName,
         folderId: opts.folderId,
@@ -5749,6 +5790,53 @@ function pruneSessionAliasesForSession(internalName, displayName) {
     }
 }
 
+// A dev server proxied under /s/<name>/ usually emits ROOT-ABSOLUTE URLs —
+// /@vite/client, /src/main.tsx, /api/... — which the browser resolves against
+// the tunnel origin, so they arrive with the /s/<name>/ prefix gone, fall
+// through to the hub shell (or the unknown-API 404), and the port page renders
+// blank. The Referer still names the session the page came from, so a request
+// that matched no hop route is sent back to the referring PORT session's
+// server. Top-level navigations are excluded — following a link out of a port
+// page must still land on hop, not be swallowed by the proxy. WebSocket
+// upgrades never carry a path-bearing Referer, so a dev server's HMR socket
+// stays unrescued: the page renders, and vite quietly retries its socket.
+function rescuePortReferral(req, res) {
+    const referer = req.headers.referer || req.headers.referrer || '';
+    const match = /\/s\/([^/?#]+)\//.exec(String(referer));
+    if (!match) return false;
+    let name;
+    try { name = decodeURIComponent(match[1]); } catch { return false; }
+    const config = getEffectiveSessionConfig(name);
+    if (!config || config.type !== 'port' || !config.port) return false;
+    const secFetchMode = String(req.headers['sec-fetch-mode'] || '');
+    const isNavigation = secFetchMode === 'navigate' ||
+        (!secFetchMode && String(req.headers.accept || '').includes('text/html'));
+    if (isNavigation) {
+        // A link INSIDE a proxied app is also root-absolute (/admin/growth),
+        // so following it would land on the hub shell. Rescue navigations too
+        // — but never off hop's own surfaces, so leaving a port page for the
+        // hub keeps working: the landing page and hop-owned prefixes stay
+        // hop's, everything else follows the referring app.
+        const p = url.parse(req.url).pathname || '/';
+        const hubOwned = p === '/' || p === '/sessions' ||
+            ['/assets/', '/view/', '/api/', '/s/', '/ws', '/health', '/oauth', '/media/'].some((prefix) => p.startsWith(prefix));
+        if (hubOwned) return false;
+    }
+    waitForPort(config.port).then((ready) => {
+        if (!ready) {
+            res.writeHead(502, { 'Content-Type': 'text/plain' });
+            res.end(`Port session "${name}" is not answering on 127.0.0.1:${config.port}.`);
+            return;
+        }
+        const proxy = httpProxy.createProxyServer({ target: `http://127.0.0.1:${config.port}`, ws: false });
+        proxy.web(req, res, {}, () => {
+            res.writeHead(502, { 'Content-Type': 'text/plain' });
+            res.end(`Port session "${name}" dropped the connection.`);
+        });
+    });
+    return true;
+}
+
 function getSessionSwitcherOverlay() {
     return `
 <style id="hop-session-switcher-style">
@@ -9324,7 +9412,7 @@ happens until someone clicks it.
         // off the end of the path; content-type still comes from the real
         // file name. The legacy /assets/view/<s>/<f> form redirects here, so
         // an edge-cached response is at worst a redirect, never the bytes.
-        const viewMatch = req.method === 'GET'
+        const viewMatch = (req.method === 'GET' || req.method === 'HEAD')
             && parsedUrl.pathname.match(/^\/view\/([^/]+)\/([^/]+?)(\/inline)?$/);
         if (viewMatch) {
             const viewRoot = path.resolve(VIEWS_DIR);
@@ -9364,10 +9452,48 @@ happens until someone clicks it.
                 res.end(html);
                 return;
             }
+            // Streamed, with Range support. iOS media playback (AVPlayer, and
+            // the player inside WKWebView) opens a video by asking for
+            // `Range: bytes=0-1` and refuses to play at all when the answer
+            // is a 200 with the whole body — which is exactly what
+            // readFileSync produced, and why published .mp4 views spun
+            // forever on the phone. Range also means a 30 MB video no longer
+            // has to fit in the daemon's heap per request.
+            const viewType = STATIC_CONTENT_TYPES[viewExt] || 'application/octet-stream';
+            const viewSize = fs.statSync(target).size;
+            const rangeHeader = String(req.headers.range || '');
+            const rangeMatch = /^bytes=(\d*)-(\d*)$/.exec(rangeHeader);
+            if (rangeMatch && (rangeMatch[1] || rangeMatch[2])) {
+                let start = rangeMatch[1] ? parseInt(rangeMatch[1], 10) : NaN;
+                let end = rangeMatch[2] ? parseInt(rangeMatch[2], 10) : NaN;
+                if (Number.isNaN(start)) {           // suffix form: bytes=-N
+                    start = Math.max(0, viewSize - end);
+                    end = viewSize - 1;
+                } else if (Number.isNaN(end) || end >= viewSize) {
+                    end = viewSize - 1;
+                }
+                if (start > end || start >= viewSize) {
+                    res.writeHead(416, { 'Content-Range': `bytes */${viewSize}` });
+                    res.end();
+                    return;
+                }
+                res.writeHead(206, {
+                    'Content-Type': viewType,
+                    'Content-Length': end - start + 1,
+                    'Content-Range': `bytes ${start}-${end}/${viewSize}`,
+                    'Accept-Ranges': 'bytes'
+                });
+                if (req.method === 'HEAD') { res.end(); return; }
+                fs.createReadStream(target, { start, end }).pipe(res);
+                return;
+            }
             res.writeHead(200, {
-                'Content-Type': STATIC_CONTENT_TYPES[viewExt] || 'application/octet-stream'
+                'Content-Type': viewType,
+                'Content-Length': viewSize,
+                'Accept-Ranges': 'bytes'
             });
-            res.end(fs.readFileSync(target));
+            if (req.method === 'HEAD') { res.end(); return; }
+            fs.createReadStream(target).pipe(res);
             return;
         }
         // The index. /assets/view/manifest.json is the URL every SHIPPED iOS
@@ -10915,6 +11041,10 @@ happens until someone clicks it.
                         startup,
                         autoStart,
                         createdBy: actor,
+                        // How it arrived (mcp/hopa): the mybot hunt dead-
+                        // ended at createdVia null because nothing here ever
+                        // recorded the channel.
+                        createdVia: resolveVia(req),
                         agentPermitted: actor === 'agent',
                         folderId,
                         workspaceName: targetWorkspaceName || null,
@@ -11326,6 +11456,11 @@ happens until someone clicks it.
         // returned 200 HTML, which callers (CLI, agents) misread as success
         // when talking to a daemon older than the endpoint they called.
         if (parsedUrl.pathname.startsWith('/api/')) {
+            // An /api/ path no hop handler claimed may belong to the app
+            // behind a PORT session — its page calls fetch('/api/...') with
+            // the session prefix gone. hop's own endpoints all matched above,
+            // so they keep priority over this rescue.
+            if (rescuePortReferral(req, res)) return;
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: `Unknown API endpoint: ${parsedUrl.pathname} (daemon may need a restart to pick up new endpoints)` }));
             return;
@@ -11339,6 +11474,11 @@ happens until someone clicks it.
             return;
         }
         if (!sessionName) {
+            // Before the hub shell answers: a subresource request referred by
+            // a /s/<name>/ PORT page belongs to that page's server, not to the
+            // hub — this is what keeps an absolute-path dev server (vite and
+            // friends) from rendering a blank page through the proxy.
+            if (rescuePortReferral(req, res)) return;
             // Landing (every device): the app shell in hub mode — the session
             // grid as the page, connected to NOTHING. Opening a session is the
             // user's click, not the server's guess.
@@ -13643,7 +13783,7 @@ async function attachToAllSessions(existingTunnel) {
 const KNOWN_COMMANDS = [
     'client', 'start', 'attach', 'local', 'stop', 'status', 'doctor', 'logs',
     'help', 'config', 'url', 'qr', 'health', 'domain', 'domain-clear',
-    'password', 'user', 'workspace', 'session', 'wipe', 'restore', 'update', 'resume-waiting', 'claude-hook', 'claude-skill', 'agent-skill', 'math', 'view', 'port', 'notify', 'new',
+    'password', 'user', 'workspace', 'session', 'wipe', 'restore', 'update', 'resume-waiting', 'claude-hook', 'claude-skill', 'agent-skill', 'math', 'view', 'port', 'notify', 'whoami', 'new',
     'mail', 'registration', 'canonical'
 ];
 
@@ -13784,6 +13924,8 @@ const HELP_SECTIONS = [
         `hop view --list [--all]   What this session has published (--all: the whole fleet)`,
         `hop view --rm <name>      Unpublish one`,
         `hop view --clear [--all]  Clear published copies — frees hop's space, never touches source files`,
+        `                          Views auto-evict oldest past the budget (HOP_VIEWS_BUDGET_MB, default 2048)`,
+        `hop whoami [--json]      Which session this shell is inside — the name hop view targets`,
         `hop port <port> [name]    Expose a local web server (live proxy, WebSocket-safe); --standalone to detach`,
     ] },
     { title: 'Maintenance', lines: [
@@ -14790,6 +14932,38 @@ async function main() {
     // notification. For agents, via the hop-session skill: use it only when
     // blocked and waiting would waste the human's time (a decision, a dead
     // VPN, credentials) — never for routine completions.
+    // hop whoami — which session is this shell inside? The answer an agent
+    // needs before hop view can target anything: HOP_SESSION carries the
+    // INTERNAL name, invisible in any UI once the session is renamed, so
+    // this resolves the display name humans actually see. --json for agents.
+    if (process.argv[2] === 'whoami') {
+        const internal = process.env.HOP_SESSION || '';
+        const asJson = process.argv.includes('--json');
+        if (!internal) {
+            if (asJson) { console.log(JSON.stringify({ insideHopSession: false })); process.exit(1); }
+            log('Not inside a hop session (HOP_SESSION is unset).', YELLOW);
+            log(`Publishing from here needs an explicit target: ${CYAN}hop view --session <name> …${RESET}`, DIM);
+            process.exit(1);
+        }
+        let display = null;
+        const state = isServerRunning();
+        if (state) {
+            try {
+                const res = await fetchSessionList(state);
+                const hit = (res?.sessions || []).find((x) => (x.internalName || x.name) === internal);
+                if (hit) display = hit.displayName || hit.name || null;
+            } catch (e) { /* the env fact still stands */ }
+        }
+        if (asJson) {
+            console.log(JSON.stringify({ insideHopSession: true, internalName: internal, displayName: display }));
+            process.exit(0);
+        }
+        const renamed = display && display !== internal;
+        log(`${BOLD}${display || internal}${RESET}${renamed ? `  ${DIM}(internal: ${internal})${RESET}` : ''}`, GREEN);
+        log(`hop view targets this session automatically; from a scrubbed subprocess, pass ${CYAN}--session ${internal}${RESET}.`, DIM);
+        process.exit(0);
+    }
+
     if (process.argv[2] === 'notify') {
         const msg = process.argv.slice(3).join(' ').trim();
         if (!msg) {
@@ -14931,6 +15105,21 @@ async function main() {
             console.log(`View: ${state.url}/view/${encodeURIComponent(session)}/${encodeURIComponent(name)}/inline`);
         }
         if (published.length) writeViewMeta(session, meta);
+        if (published.length) {
+            // Always say WHICH session this acted on, and how that relates
+            // to the terminal it ran in. An agent carried a --session target
+            // three requests past its purpose because nothing in the output
+            // ever said "not the session you are in" — the human asked where
+            // their files were, and they were in the other room.
+            const here = process.env.HOP_SESSION || '';
+            if (here && here === session) {
+                log(`Session: ${session} (this terminal)`, DIM);
+            } else if (here) {
+                log(`Session: ${session} — NOT this terminal (you are in "${here}")`, YELLOW);
+            } else {
+                log(`Session: ${session} (targeted explicitly; not running inside a session)`, DIM);
+            }
+        }
         if (failed === 0 && files.length > 0) {
             // One bell: the view is usually the deliverable the human is
             // waiting on, and the link scrolls away if nothing pings them.

package/hopa

@@ -47,6 +47,7 @@ const VERBS = {
   'agents':          { tool: 'hopx_agents_overview', pos: [] },
   'sessions':        { tool: 'hop_list_sessions', pos: [] },
   'info':            { tool: 'hop_server_info', pos: [] },
+  'whoami':          { tool: 'hop_current_session', pos: [] },
   'connect':         { tool: 'connect_server', pos: ['base_url'] },
 
   'term ls':         { tool: 'hop_list_terminals', pos: [] },
@@ -86,6 +87,7 @@ const USAGE = `hopa — agent-facing hop CLI (terminal orchestration; no admin v
 
   hopa                                live overview of agent terminals (same as: hopa agents)
   hopa sessions | info | ledger       list sessions / server info / task ledger
+  hopa whoami                         which hop session this process runs inside (for hop view --session)
 
   hopa term ls                        list terminals
   hopa term new [name] [--cwd P]      create a terminal

package/mcp/hop-mcp.js

@@ -3148,6 +3148,11 @@ class HopMCPServer {
         description: 'Return hop-mcp runtime diagnostics (version, script path, read-mode capabilities).',
         inputSchema: { type: 'object', properties: {} }
       },
+      {
+        name: 'hop_current_session',
+        description: 'Which hop session THIS process runs inside — from the HOP_SESSION environment the terminal set, resolved to the display name humans see. This is the name to pass to hop view --session when publishing results, and the honest answer to "where am I?". Absent fields mean the process is not inside a hop terminal.',
+        inputSchema: { type: 'object', properties: {} }
+      },
       {
         name: 'hop_list_sessions',
         description: 'List Hop sessions and metadata.',
@@ -3683,6 +3688,32 @@ class HopMCPServer {
       return this.wrapJson(this.getServerInfoPayload());
     }
 
+    if (name === 'hop_current_session') {
+      // Answerable WITHOUT a daemon: the env fact stands on its own, and an
+      // agent asking "where am I" mid-outage still deserves the truth.
+      const internal = process.env.HOP_SESSION || null;
+      const payload = {
+        insideHopSession: !!internal,
+        internalName: internal,
+        displayName: null,
+        note: internal
+          ? 'Use these names for hop view --session and anywhere a session is addressed.'
+          : 'Not inside a hop terminal (HOP_SESSION unset). Publishing needs an explicit target: hop view --session <name>; hop_list_sessions names the candidates.'
+      };
+      if (internal) {
+        try {
+          this.refreshStateFileConnection();
+          this.ensureConnection();
+          const list = await this.callApi('GET', '/api/sessions');
+          const sessions = Array.isArray(list?.sessions) ? list.sessions : [];
+          const hit = sessions.find((x) => (x.internalName || x.name) === internal)
+            || sessions.find((x) => String(x.internalName || '').toLowerCase() === internal.toLowerCase());
+          if (hit) payload.displayName = hit.displayName || hit.name || null;
+        } catch (e) { /* the env facts still stand */ }
+      }
+      return this.wrapJson(payload);
+    }
+
     this.ensureConnection();
 
     switch (name) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hop2",
-  "version": "0.11.20",
+  "version": "0.11.21",
   "description": "🐰 Hop into your terminal from anywhere. Secure remote shell access with 2FA via Cloudflare Tunnel. Next-gen rewrite with native terminal sharing.",
   "main": "hop",
   "bin": {

package/skills/hop-session/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: hop-session
-description: Conventions for agents working inside a hop terminal session (the HOP_SESSION environment variable is set). Humans watch these terminals live, often from a phone. Covers rendering math with hop math, handing over results a terminal cannot render — plots, PDFs, images, rendered markdown write-ups — with hop view (always with --title), exposing a running local web server with hop port, ringing the bell for attention, and phone-friendly output.
+description: Conventions for agents working inside a hop terminal session (the HOP_SESSION environment variable is set). Humans watch these terminals live, often from a phone. Covers finding your session identity with hop whoami, rendering math with hop math, handing over results a terminal cannot render — plots, PDFs, images, rendered markdown write-ups — with hop view (always with --title), exposing a running local web server with hop port, ringing the bell for attention, and phone-friendly output.
 ---
 
 # Working in a hop terminal
@@ -24,6 +24,30 @@ formula in your response; do not repeat the raw LaTeX next to it. When you
 need the rendered text inside a file or message, capture it:
 `hop math '<latex>'` and copy the command's output verbatim.
 
+## Which session are you in?
+
+Everything below targets a SESSION, and yours is knowable, not guessable:
+
+```bash
+hop whoami            # display name + internal name of this terminal's session
+hop whoami --json     # {"insideHopSession":true,"internalName":"…","displayName":"…"}
+```
+
+Inside a hop terminal, `HOP_SESSION` holds the session's internal name and
+`hop view` targets it automatically. But subprocesses you spawn may have that
+variable deliberately scrubbed (session-identity hygiene), and a renamed
+session's internal name never matches what the human calls it — so when in
+doubt, ask `hop whoami` and pass the answer explicitly:
+
+```bash
+hop view --session "$(hop whoami --json | jq -r .internalName)" --title "…" out.pdf
+```
+
+Over MCP, the same answer is the `hop_current_session` tool; via the agent
+CLI it is `hopa whoami`. If `hop whoami` says you are NOT in a session,
+never guess a target — list candidates (`hop view --list --all`,
+`hop_list_sessions`) or ask.
+
 ## Showing results a terminal cannot render (plots, PDFs, write-ups)
 
 When the deliverable is a plot, a figure, a report, a PDF, an image, or a