hop2 0.11.21 → 0.11.22

package/hay-web/index.html

@@ -6,7 +6,7 @@
     <!-- Terminal prompt chevron on a dark tile — reads "terminal app" at 16px. -->
     <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='7' fill='%2317181d'/%3E%3Cpath d='M11 9.5 L20.5 16 L11 22.5' fill='none' stroke='%23a78bfa' stroke-width='4' stroke-linecap='round' stroke-linejoin='round'/%3E%3C/svg%3E" />
     <title>Hay</title>
-    <script type="module" crossorigin src="/assets/index-DjSB7l7z.js"></script>
+    <script type="module" crossorigin src="/assets/index-COQpy7gK.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-B8TPcotl.css">
   </head>
   <body>

package/hop

@@ -539,6 +539,26 @@ function enforceViewBudget() {
     } catch (e) { /* a failed sweep never blocks a publish */ }
 }
 
+// Does the proxied session behind a Views server row still exist? Answered
+// from the ports ledger on disk (plus the in-memory store, when this is the
+// daemon), so the CLI and the daemon agree.
+function portSessionIsKnown(target) {
+    const seg = String(target || '').match(/^\/s\/([^/]+)/);
+    const nm = seg ? decodeURIComponent(seg[1]) : '';
+    if (!nm) return false;
+    const matches = (cfg, key) => cfg?.type === 'port' && (key === nm || cfg.displayName === nm);
+    for (const [key, cfg] of Object.entries(sessionStore?.sessions || {})) {
+        if (matches(cfg, key)) return true;
+    }
+    try {
+        const raw = JSON.parse(fs.readFileSync(PORTS_FILE, 'utf8'));
+        for (const [key, cfg] of Object.entries(raw.ports || {})) {
+            if (matches(cfg, key)) return true;
+        }
+    } catch (e) { /* no ledger yet */ }
+    return false;
+}
+
 // The virtual folder both `hop view` and `hop port --attached` publish into:
 // clients browse every view through one manifest, REBUILT from a disk scan
 // rather than read-modify-written, so two agents publishing at once cannot
@@ -578,6 +598,15 @@ function rebuildViewManifest() {
                     kind: m.kind === 'server' ? 'server' : 'file',
                     target: m.kind === 'server' ? (m.target || '') : undefined,
                     port: m.kind === 'server' ? m.port : undefined,
+                    // Whether the proxied session behind a server row still
+                    // EXISTS. A row whose session evaporated used to open the
+                    // hop wall (proxy miss → SPA fallback) with no hint why;
+                    // clients can now say "server gone" instead.
+                    // Read from the ports LEDGER, not sessionStore: the
+                    // manifest is rebuilt inside the `hop view` CLI process
+                    // as often as inside the daemon, and the CLI's store is
+                    // empty — every server row read dead from there.
+                    live: m.kind === 'server' ? portSessionIsKnown(m.target) : undefined,
                     // The extensionless serving path — see the /view route for
                     // why the extension must stay off the URL's end.
                     path: `/view/${encodeURIComponent(sess)}/${encodeURIComponent(f)}/inline`,
@@ -601,6 +630,13 @@ const SESSION_SECRET_FILE = path.join(HOME_DIR, '.session_secret');
 // evaporated on every daemon restart. Session MEMBERSHIP is persisted per
 // session in its durable meta, so a folder and its contents survive together.
 const FOLDERS_FILE = path.join(HOME_DIR, 'folders.json');
+// Port sessions (`hop port`, `hop session add --port`) outside a workspace.
+// The daemon boots with NO active workspace, so saveSessionStore() is a
+// no-op and every port definition lived in memory only — each restart
+// forgot them all while their backends kept running, and every Views row
+// pointing at one silently opened the hop wall instead (the proxy route no
+// longer matched, the SPA fallback answered). Same shape as folders.json.
+const PORTS_FILE = path.join(HOME_DIR, 'ports.json');
 const DEFAULT_SECRET_FILE = path.join(HOME_DIR, '.auth_secret');
 const DOMAIN_CONFIG_FILE = path.join(HOME_DIR, '.domain-config.json');
 const HOP_CONFIG_FILE = path.join(HOME_DIR, '.config.json');
@@ -833,6 +869,20 @@ function toInternalSessionName(displayName) {
     return displayName;
 }
 
+// Invariant session id for NEW sessions: opaque, never derived from the
+// display name. Sessions created before this simply keep their original
+// name as their id (the state every rename already produced), so nothing
+// migrates. The id is machine-facing (HOP_SESSION, room keys, record
+// files) and must never be shown to the user; the display name is the
+// only name a human sees, and renaming touches only that.
+function mintSessionInternalName() {
+    let id;
+    do {
+        id = 's_' + crypto.randomBytes(5).toString('hex');
+    } while (hopSessionExists(id) || hasSavedSessionConfig(id));
+    return id;
+}
+
 function toDisplaySessionName(internalName) {
     if (!internalName || typeof internalName !== 'string') return '';
     return stripLegacySessionPrefix(internalName);
@@ -1023,6 +1073,7 @@ let sessionStore = initialWorkspaceState.store;
 const runtimeSessionMetadata = new Map();
 // Folders are organization the user authored; they must be there on boot.
 loadFolders();
+loadPorts();
 // internalName -> the display-name claim we last rejected for it, so the
 // collision guard reports each rejection once instead of every reconcile.
 const reportedNameCollisions = new Map();
@@ -1142,10 +1193,13 @@ function setSessionConfig(name, config) {
     const folderId = config?.folderId || null;
     ensureSessionOrder(name, folderId);
     saveSessionStore();
+    if (config?.type === 'port') savePorts();
 }
 
 function deleteSessionConfig(name) {
+    const wasPort = sessionStore.sessions[name]?.type === 'port';
     delete sessionStore.sessions[name];
+    if (wasPort) savePorts();
     removeSessionFromOrder(name);
     saveSessionStore();
     // A deleted session should not be resurrected by `hop restore`, so drop its
@@ -1430,6 +1484,29 @@ function saveFolders() {
     } catch (e) { /* best effort: folders are organization, not state */ }
 }
 
+function savePorts() {
+    try {
+        const ports = {};
+        for (const [name, cfg] of Object.entries(sessionStore.sessions)) {
+            if (cfg?.type === 'port') ports[name] = cfg;
+        }
+        writePrivateFile(PORTS_FILE, JSON.stringify({ ports }, null, 1));
+    } catch (e) { /* the in-memory definition still serves this run */ }
+}
+
+function loadPorts() {
+    try {
+        const raw = JSON.parse(fs.readFileSync(PORTS_FILE, 'utf8'));
+        for (const [name, cfg] of Object.entries(raw.ports || {})) {
+            if (!cfg || cfg.type !== 'port' || !Number.isInteger(cfg.port)) continue;
+            // A workspace-defined port outranks the ledger's copy.
+            if (sessionStore.sessions[name]) continue;
+            sessionStore.sessions[name] = cfg;
+            ensureSessionOrder(name, cfg.folderId || null);
+        }
+    } catch (e) { /* no ports yet */ }
+}
+
 function loadFolders() {
     try {
         const raw = JSON.parse(fs.readFileSync(FOLDERS_FILE, 'utf8'));
@@ -5020,21 +5097,40 @@ function claudeConfigRootsForRestore(recConfigDir) {
 // resume; the caller falls back to a plain shell with a visible warning.
 function resolveClaudeTranscriptPath(rec) {
     if (!rec || !rec.sessionId || !rec.cwd) return null;
+    const findIn = (base) => {
+        const file = path.join(base, `${rec.sessionId}.jsonl`);
+        try { fs.accessSync(file); return file; } catch (e) { /* next */ }
+        // Newer layout: a per-session DIRECTORY. Only counts when it holds a
+        // real transcript jsonl: a dir with only subagents/ metadata is a
+        // conversation that never persisted (resume would fail on it).
+        try {
+            const dir = path.join(base, rec.sessionId);
+            if (fs.statSync(dir).isDirectory()) {
+                const jsonl = fs.readdirSync(dir).find((f) => f.endsWith('.jsonl'));
+                if (jsonl) return path.join(dir, jsonl);
+            }
+        } catch (e) { /* next */ }
+        return null;
+    };
     for (const root of claudeConfigRootsForRestore(rec.configDir)) {
         for (const slug of claudeProjectDirCandidates(rec.cwd)) {
-            const base = path.join(root, 'projects', slug);
-            const file = path.join(base, `${rec.sessionId}.jsonl`);
-            try { fs.accessSync(file); return file; } catch (e) { /* next */ }
-            // Newer layout: a per-session DIRECTORY. Only counts when it holds a
-            // real transcript jsonl — a dir with only subagents/ metadata is a
-            // conversation that never persisted (resume would fail on it).
-            try {
-                const dir = path.join(base, rec.sessionId);
-                if (fs.statSync(dir).isDirectory()) {
-                    const jsonl = fs.readdirSync(dir).find((f) => f.endsWith('.jsonl'));
-                    if (jsonl) return path.join(dir, jsonl);
-                }
-            } catch (e) { /* next */ }
+            const hit = findIn(path.join(root, 'projects', slug));
+            if (hit) return hit;
+        }
+    }
+    // The cwd-derived slug is a HINT, not the identity: the session id is
+    // unique across the whole store, and claude itself resumes by id. A
+    // record whose cwd was healed (Accessibility-fork: conversation written
+    // from inside the transcript dir, so its file lives under a doubly-
+    // encoded slug) would otherwise read as "no transcript on this host"
+    // and restore to a bare shell, when the transcript is right there.
+    for (const root of claudeConfigRootsForRestore(rec.configDir)) {
+        const projects = path.join(root, 'projects');
+        let slugs = [];
+        try { slugs = fs.readdirSync(projects); } catch (e) { continue; }
+        for (const slug of slugs) {
+            const hit = findIn(path.join(projects, slug));
+            if (hit) return hit;
         }
     }
     return null;
@@ -5216,7 +5312,19 @@ function restorePlanForSession(entry) {
     // arbiter: when the record disagrees with it, the record is not this
     // room's primary conversation. Reopen a plain shell in the RIGHT place
     // rather than resume the wrong history.
-    const liveCwd = readClaudeSessionMeta(entry.internalName)?.cwd || entry.cwd;
+    // The transcript store is never a workspace (same rule as the hook and
+    // fork): a meta cwd inside ~/.claude*/projects/* means the room's shell
+    // was left standing in the transcript dir at some point (the
+    // Accessibility-fork incident): a poisoned arbiter. Trusting it made
+    // this guard fire against a CORRECT record and drop the room to a plain
+    // shell in the transcript dir, which is how the fork came back as 'zsh
+    // in ~/.claude/projects/-Users-jianzhou' with its conversation gone.
+    const storePath = (c) => /[\\/]\.claude[^\\/]*[\\/]projects([\\/]|$)/.test(String(c || ''));
+    const metaCwd = readClaudeSessionMeta(entry.internalName)?.cwd;
+    const liveCwd = (metaCwd && !storePath(metaCwd) ? metaCwd : null)
+        || (entry.cwd && !storePath(entry.cwd) ? entry.cwd : null)
+        || (rec?.cwd && !storePath(rec.cwd) ? rec.cwd : null)
+        || metaCwd || entry.cwd;
     if (rec && rec.sessionId && liveCwd && rec.cwd && rec.cwd !== liveCwd) {
         // The incumbent record disagrees with the room's real directory. The
         // hook parks a rival record at <session>.other.json when it refuses
@@ -8145,7 +8253,11 @@ async function reconcileExternalRuntimeSessionsUncached() {
         // workspaces is a different tree entirely. That is how a session
         // working in ~/Code/nebula-slides came back in the slides tool's
         // agent-home workspace and read as "my session died".
-        if (room.cwd && typeof room.cwd === 'string' && durableMeta && durableMeta.cwd !== room.cwd) {
+        // ...but never persist a shell that wandered INTO the transcript
+        // store (~/.claude*/projects/*): that is not a workspace, and a meta
+        // holding it poisons restore's cwd arbiter (Accessibility-fork).
+        const roomInStore = /[\\/]\.claude[^\\/]*[\\/]projects([\\/]|$)/.test(String(room.cwd || ''));
+        if (room.cwd && typeof room.cwd === 'string' && durableMeta && durableMeta.cwd !== room.cwd && !roomInStore) {
             writeClaudeSessionMeta(room.id, { ...durableMeta, internalName: room.id, cwd: room.cwd });
         }
         rememberExternalRuntimeSession(room.id, room.hostPort);
@@ -9541,8 +9653,11 @@ happens until someone clicks it.
                 return;
             }
             const meta = readViewMeta(sess);
-            if (meta[name]?.kind === 'server') {
-                respond(400, { ok: false, error: 'A live server row disappears when the server stops — nothing to delete' });
+            // A LIVE server row is not a file to delete — it dies with its
+            // server. A DEAD one (session gone, backend forgotten) is exactly
+            // the stale entry a human wants to clear, so it goes.
+            if (meta[name]?.kind === 'server' && portSessionIsKnown(meta[name]?.target)) {
+                respond(400, { ok: false, error: 'This server is still running — its row disappears when it stops' });
                 return;
             }
             try {
@@ -10417,36 +10532,34 @@ happens until someone clicks it.
                     const actorCreatedBy = resolveActor(req) === 'agent' ? 'agent' : 'user';
                     const createdVia = resolveVia(req) || (actorCreatedBy === 'agent' ? 'agent-api' : 'web');
                     const displayName = name;
-                    const internalName = toInternalSessionName(displayName);
-                    if (!internalName || !displayName) {
+                    if (!displayName || !toInternalSessionName(displayName)) {
                         res.writeHead(400, { 'Content-Type': 'application/json' });
                         res.end(JSON.stringify({ error: 'Invalid session name' }));
                         return;
                     }
-                    // Durable origin marker, mirroring the terminal-API path:
-                    // runtime config dies with the daemon, so without this an
-                    // agent session reads as human after the next restart.
-                    if (actorCreatedBy === 'agent') {
-                        const durableOrigin = readClaudeSessionMeta(internalName) || {};
-                        writeClaudeSessionMeta(internalName, {
-                            ...durableOrigin,
-                            internalName,
-                            createdBy: 'agent',
-                            createdVia,
-                            createdAt: durableOrigin.createdAt || new Date().toISOString()
-                        });
-                    }
-
                     if (isDisplayNameInUse(displayName)) {
                         res.writeHead(409, { 'Content-Type': 'application/json' });
                         res.end(JSON.stringify({ error: 'Session name already in use' }));
                         return;
                     }
-                    if (hasSavedSessionConfig(internalName)) {
-                        res.writeHead(409, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ error: 'Session internal name already in use' }));
-                        return;
-                    }
+                    // Identity is MINTED, not derived: reusing a display name
+                    // that some renamed-away session was BORN with used to
+                    // collide with that session's internal id.
+                    const internalName = mintSessionInternalName();
+                    // Durable meta is the naming AUTHORITY (docs/
+                    // session-identity.md), and with minted ids it is the
+                    // only place the display name survives a daemon restart:
+                    // runtime config dies with the process, and the id can no
+                    // longer stand in for the name. Written for EVERY create,
+                    // after the refusals so a 409 writes nothing.
+                    writeClaudeSessionMeta(internalName, {
+                        internalName,
+                        displayName,
+                        createdBy: actorCreatedBy,
+                        createdVia,
+                        folderId: folderId || undefined,
+                        createdAt: new Date().toISOString()
+                    });
                     type = (type || 'terminal').toLowerCase();
                     if (type !== 'terminal' && type !== 'port') {
                         res.writeHead(400, { 'Content-Type': 'application/json' });
@@ -10477,7 +10590,15 @@ happens until someone clicks it.
                             res.end(JSON.stringify({ error: 'Terminal session already exists with this name' }));
                             return;
                         }
-                        const existingConfig = getEffectiveSessionConfig(internalName);
+                        // NOT getEffectiveSessionConfig: that synthesizes
+                        // type:'terminal' from durable meta when nothing else
+                        // exists — and this create already wrote its own meta
+                        // above, so a brand-new port session saw ITSELF and
+                        // refused with "Terminal session already exists".
+                        // Every `hop port` with a fresh name failed this way.
+                        // Only a saved or runtime TERMINAL config is a real
+                        // collision.
+                        const existingConfig = getSessionConfig(internalName) || getRuntimeSessionMetadata(internalName);
                         if (existingConfig && existingConfig.type === 'terminal') {
                             res.writeHead(409, { 'Content-Type': 'application/json' });
                             res.end(JSON.stringify({ error: 'Terminal session already exists with this name' }));
@@ -10548,7 +10669,7 @@ happens until someone clicks it.
                         }
                     }
                     res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ ok: true, name: displayName, type }));
+                    res.end(JSON.stringify({ ok: true, name: displayName, displayName, internalName, type }));
                 } catch (e) {
                     const status = Number.isInteger(e?.status) ? e.status : 500;
                     const message = e?.message || 'Failed to create session';
@@ -10972,7 +11093,9 @@ happens until someone clicks it.
                         res.end(JSON.stringify({ error: 'Session name already in use' }));
                         return;
                     }
-                    const internalName = toInternalSessionName(displayName);
+                    // Minted, not derived from the display name (see
+                    // mintSessionInternalName): renames stay label-only.
+                    const internalName = mintSessionInternalName();
                     if (!internalName) {
                         res.writeHead(400, { 'Content-Type': 'application/json' });
                         res.end(JSON.stringify({ error: 'Invalid session name' }));
@@ -11023,12 +11146,19 @@ happens until someone clicks it.
                         folderId,
                         workspaceName: targetWorkspaceName || null
                     });
-                    // Durable origin marker so `hop restore` (which may run after a
-                    // reboot, long after runtime metadata is gone) can keep
-                    // agent-created workers out of the default restore set.
-                    if (actor === 'agent') {
-                        writeClaudeSessionMeta(internalName, { createdBy: 'agent', createdAt: new Date().toISOString() });
-                    }
+                    // Durable meta for EVERY create (naming authority; see
+                    // docs/session-identity.md): with minted ids the display
+                    // name survives restarts nowhere else. createdBy rides
+                    // along so `hop restore` keeps agent workers out of the
+                    // default restore set, as before.
+                    writeClaudeSessionMeta(internalName, {
+                        internalName,
+                        displayName,
+                        createdBy: actor,
+                        createdVia: resolveVia(req),
+                        folderId: folderId || undefined,
+                        createdAt: new Date().toISOString()
+                    });
 
                     const entry = await attachTerminalApiClient(internalName, displayName, {
                         actor,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hop2",
-  "version": "0.11.21",
+  "version": "0.11.22",
   "description": "🐰 Hop into your terminal from anywhere. Secure remote shell access with 2FA via Cloudflare Tunnel. Next-gen rewrite with native terminal sharing.",
   "main": "hop",
   "bin": {

package/scripts/hay-host.js

@@ -54,6 +54,31 @@ const FALLBACK_CWD = process.env.HAY_HOST_CWD || process.cwd();
 // Where we stash each room's tail buffer on shutdown so `hop restore` can replay
 // a plain-shell session's last screen. Mirrors the daemon's HOP_HOME (~/.hop2).
 const HOP_HOME = process.env.HOP_HOME || path.join(os.homedir(), '.hop2');
+
+// EPHEMERAL homes die with their daemon. Integration tests spawn a daemon in
+// a mkdtemp HOP_HOME, which spawns this host — and a test run killed
+// mid-flight (a timeout, a crash) leaked the host forever: 18 of them were
+// found idling with 242MB after a week of test runs. A host under the OS
+// temp dir polls its daemon's pid from .tunnel-state and exits once it has
+// been gone for two checks. A REAL home never does this: the production
+// host deliberately outlives daemon restarts — that is what keeps sessions
+// alive through deploys.
+if (HOP_HOME.startsWith(os.tmpdir())) {
+  let daemonMissing = 0;
+  setInterval(() => {
+    let pid = null;
+    try { pid = Number(JSON.parse(fs.readFileSync(path.join(HOP_HOME, '.tunnel-state'), 'utf8')).pid); } catch (e) { /* not written yet */ }
+    let alive = false;
+    if (Number.isInteger(pid) && pid > 0) {
+      try { process.kill(pid, 0); alive = true; } catch (e) { /* dead */ }
+    }
+    daemonMissing = alive ? 0 : daemonMissing + 1;
+    if (daemonMissing >= 2) {
+      console.error('[hay-host] ephemeral home and the daemon is gone — exiting');
+      process.exit(0);
+    }
+  }, 30000).unref();
+}
 const BUFFER_DIR = path.join(HOP_HOME, 'session-buffers');
 const CLAUDE_SESSIONS_DIR = path.join(HOP_HOME, 'claude-sessions');
 
@@ -382,7 +407,13 @@ async function main() {
         const room = watchRoomEnd(rooms.getRoom(roomId, { cols, rows }, existingCwdOr(cwd, FALLBACK_CWD)));
         if (Date.now() - __t0 > 100) console.log(`[hay-host] slow room create (ws) room=${roomId} ${Date.now() - __t0}ms`);
 
-        const replayRaw = Number(wsUrl.searchParams.get('replay'));
+        // ABSENT is not ZERO: Number(null) === 0, and 0 is the explicit
+        // "no snapshot" contract for claim sockets — so every attach that
+        // simply omitted replay= (salvage, CLI reattach) silently got no
+        // screen: the 2026-08-17 host cycle salvaged 23 rooms and captured
+        // nothing, each waiting out a 20s timeout (the 8-minute freeze).
+        const replayParam = wsUrl.searchParams.get('replay');
+        const replayRaw = replayParam === null || replayParam === '' ? NaN : Number(replayParam);
         // The viewer's actual terminal colors (hex, no '#'). TUI apps pick a
         // light or dark theme from the background they're told — so a room
         // must report the background the USER is looking at, not a guess.

package/scripts/salvage-and-restart-host.js

@@ -50,7 +50,12 @@ const stripAnsi = (raw) => String(raw)
 
 // Capture one room's snapshot (the ~1.5MB replay tail) over WS.
 const salvageRoom = (port, id) => new Promise((resolve) => {
-  const ws = new WebSocket(`ws://127.0.0.1:${port}/ws?room=${encodeURIComponent(id)}&name=salvage&cols=200&rows=50`);
+  // Explicit replay: an ABSENT param read as 0 ("no snapshot") on the host
+  // (Number(null)===0), and every room timed out. source=monitor + nudge=0:
+  // salvage is a spectator — no equal-size wiggle SIGWINCHed into 23 running
+  // claudes, no presence stamp, no seen-witness. Raw tail (above the
+  // serialized ceiling) so the salvaged text is scrollback, not one screen.
+  const ws = new WebSocket(`ws://127.0.0.1:${port}/ws?room=${encodeURIComponent(id)}&name=salvage&source=monitor&replay=1572864&nudge=0&cols=200&rows=50`);
   const timer = setTimeout(() => { try { ws.close(); } catch (e) {} resolve('timeout'); }, 20000);
   ws.on('message', (data) => {
     try {