hop2 0.11.36 → 0.11.38

package/hay/apps/server/src/rooms.ts

@@ -247,6 +247,8 @@ export class Room extends EventEmitter {
   private pty: IPty;
   private readonly initialCwd: string;
   private liveCwd: string;
+  /** The shell reports its own cwd, so the lsof fallback is unnecessary here. */
+  private osc7Seen = false;
   private foregroundProcess = "";
   private lastActivityAt = now(); // ms of the most recent PTY output
   // Terminal bells (BEL outside escape sequences) rung by the app — agents and
@@ -822,10 +824,11 @@ export class Room extends EventEmitter {
       }
 
       // The shell reports its own cwd, so the lsof fallback has nothing left to
-      // add for this room — retire its timer. Most rooms run a shell that emits
-      // OSC 7, so this is what keeps the global probe budget for the few that
-      // genuinely need it.
-      this.stopCwdPolling();
+      // add for this room. Retire the PROBE, not the timer: the same tick also
+      // samples the foreground process name, and stopping it outright froze
+      // that for every OSC 7 room — the session manager then showed whatever
+      // was running when the room started, forever.
+      this.osc7Seen = true;
 
       if (cwdPath && cwdPath !== this.liveCwd) {
         if (DEBUG_STATE) {
@@ -869,6 +872,7 @@ export class Room extends EventEmitter {
       if (typeof fg === "string" && fg) {
         this.foregroundProcess = fg.replace(/^-/, ""); // strip login-shell "-zsh" dash
       }
+      if (this.osc7Seen) return; // cwd comes from the shell itself
       if (process.platform === "darwin") {
         runGatedCwdProbe(pid, updateCwd);
       } else if (process.platform === "linux") {
@@ -1378,17 +1382,16 @@ export class Room extends EventEmitter {
 
   getSummary(): RoomSummary {
     const localCliCount = [...this.clients.values()].filter((client) => client.source === "local-cli").length;
-    // Read the foreground process name fresh (cheap getter) so the session
-    // manager reflects what's running now; fall back to the last polled sample.
-    let foregroundProcess = this.foregroundProcess;
-    try {
-      const live = (this.pty as unknown as { process?: string }).process;
-      if (typeof live === "string" && live) {
-        foregroundProcess = live.replace(/^-/, "");
-      }
-    } catch {
-      /* keep the polled fallback */
-    }
+    // The foreground process name comes from the poll tick, never from a live
+    // read here. node-pty's `.process` getter is a synchronous native call, and
+    // /rooms summarizes EVERY room in one request — 57 of them on this host —
+    // so the "cheap getter" it was billed as cost one blocking syscall per room
+    // per request, several times a minute. That is a request-path cost the
+    // terminal websockets share, and it tracked the host's multi-second
+    // event-loop stalls (2026-09-01: /rooms at 155-817ms with stalls to match,
+    // which is what made scrolling judder). The polled sample is the same
+    // getter read on a jittered timer, so nothing is lost but the stall.
+    const foregroundProcess = this.foregroundProcess;
     return {
       id: this.id,
       cwd: this.initialCwd,

package/hay/apps/web/src/components/SessionSwitcher.tsx

@@ -1471,6 +1471,24 @@ export const SessionSwitcher = ({
   // Maps to the create API's `startup` command.
   const [createType, setCreateType] = useState<"terminal" | "claude" | "codex">("terminal");
   const startupFor = (t: "terminal" | "claude" | "codex") => (t === "claude" ? "claude" : t === "codex" ? "codex" : "");
+  // Rendered by BOTH create forms. submitCreate has always sent createType, but
+  // only the top-bar form let you set it, so creating a session inside a folder
+  // silently produced whatever was last chosen — a plain terminal by default,
+  // with no way to ask for claude or codex from the ＋ on a folder.
+  const createTypePicker = () => (
+    <div className="switcher-create-type" role="radiogroup" aria-label="Session type">
+      {(["terminal", "claude", "codex"] as const).map((t) => (
+        <button
+          key={t}
+          type="button"
+          role="radio"
+          aria-checked={createType === t}
+          className={"create-type" + (createType === t ? " on" : "")}
+          onClick={() => setCreateType(t)}
+        >{t === "terminal" ? "Terminal" : t === "claude" ? "Claude" : "Codex"}</button>
+      ))}
+    </div>
+  );
   // When set, the next created session is filed here (the folder header's +).
   const [createInFolder, setCreateInFolder] = useState<SwitcherFolder | null>(null);
   const [, setTick] = useState(0);
@@ -1529,6 +1547,8 @@ export const SessionSwitcher = ({
   // than reshuffling the wall.
   const frozenOrderRef = useRef<{ mode: "tiers" | "project"; hero: string[]; groups: Array<{ label: string; rows: string[] }> } | null>(null);
   useEffect(() => { if (!open) frozenOrderRef.current = null; }, [open]);
+  // A non-empty query, whichever render branch the model picks for it.
+  const searching = filter.trim().length > 0;
   const model = useMemo(() => {
     // A filter query searches EVERYTHING (parked included); the browsing
     // wall shows only unparked sessions.
@@ -2925,18 +2945,7 @@ export const SessionSwitcher = ({
               autoFocus
               aria-label="New session name"
             />
-            <div className="switcher-create-type" role="radiogroup" aria-label="Session type">
-              {(["terminal", "claude", "codex"] as const).map((t) => (
-                <button
-                  key={t}
-                  type="button"
-                  role="radio"
-                  aria-checked={createType === t}
-                  className={"create-type" + (createType === t ? " on" : "")}
-                  onClick={() => setCreateType(t)}
-                >{t === "terminal" ? "Terminal" : t === "claude" ? "Claude" : "Codex"}</button>
-              ))}
-            </div>
+            {createTypePicker()}
             <button type="submit">Create</button>
             <button type="button" onClick={() => { setCreating(false); setCreateDraft(""); setCreateInFolder(null); }}>✕</button>
           </form>
@@ -2945,8 +2954,12 @@ export const SessionSwitcher = ({
       <div className="switcher-scroll" ref={scrollRef} onContextMenu={openWallMenu}>
         {/* The host agent's briefing — same digest.json the phone renders.
             Hidden while filtering: search is about one session, the briefing
-            is about the fleet. */}
-        {model.mode !== "filter" && (
+            is about the fleet. Keyed on the QUERY, not on model.mode: manual
+            mode answers a query with mode "manual" (narrow-in-place, so the
+            folders survive), never "filter", so a mode check left the
+            briefing sitting on top of every search result in the folder
+            layout. */}
+        {!searching && (
           <DigestCard sessions={sessions} onOpen={handleTap} />
         )}
         {model.mode === "filter" ? (
@@ -3034,6 +3047,7 @@ export const SessionSwitcher = ({
                           autoFocus
                           aria-label={"New session name in " + folder.name}
                         />
+                        {createTypePicker()}
                         <button type="submit">Create</button>
                         <button type="button" onClick={() => { setCreating(false); setCreateDraft(""); setCreateInFolder(null); }}>✕</button>
                       </form>
@@ -3088,7 +3102,7 @@ export const SessionSwitcher = ({
             ))}
           </>
         )}
-        {model.mode !== "filter" && parkedSessions.length > 0 && (
+        {!searching && parkedSessions.length > 0 && (
           <section className="switcher-group switcher-parked">
             <button
               type="button"

package/hay/apps/web/src/styles.css

@@ -3536,8 +3536,23 @@ button.primary {
   font-size: 11px; font-weight: 600; color: var(--ink-muted);
   padding: 4px 9px; border-radius: 6px; line-height: 1.3;
 }
-.create-type.on { background: var(--panel); color: var(--ink);
-  box-shadow: 0 1px 2px rgba(0,0,0,0.12); }
+.create-type:hover:not(.on) {
+  color: var(--ink);
+  background: color-mix(in srgb, var(--ink) 6%, transparent);
+}
+/* The selected mode decides what the new session RUNS, so it has to read at a
+   glance. The old treatment was a --panel pill with a black box-shadow: in
+   dark mode that is #1d1d21 on a faintly lightened track with an invisible
+   shadow, so "which one is on" came down to ink vs ink-muted text. Accent
+   fill, the same signal every other selected control in the app uses. */
+.create-type.on {
+  background: var(--accent);
+  color: var(--accent-fg);
+}
+.create-type:focus-visible {
+  outline: 2px solid var(--accent);
+  outline-offset: 1px;
+}
 .switcher-create-row input {
   flex: 1;
   min-width: 0;

package/hay/apps/web/test/SessionSwitcher.test.tsx

@@ -345,6 +345,32 @@ describe("manual folders in the wall", () => {
     expect(onClose).toHaveBeenCalled();
   });
 
+  it("hides the briefing while a query is typed in manual mode", async () => {
+    // The briefing was gated on model.mode !== "filter", but manual mode
+    // answers a query with mode "manual" (narrow-in-place), never "filter" —
+    // so in the folder layout the briefing stayed on top of every search.
+    const edition = { generated_at: "2026-09-01T00:00:00Z", summary: "fleet is fine", items: [] };
+    vi.stubGlobal("fetch", vi.fn(async (url: string) => ({
+      ok: true,
+      json: async () => (String(url).includes("digest-archive") ? { editions: [edition] } : edition)
+    })));
+    try {
+      render(<SessionSwitcher {...props} sessions={withFolder} folders={folders} open />);
+      fireEvent.click(screen.getByRole("button", { name: "Manual" }));
+      expect(await screen.findByText("fleet is fine")).toBeTruthy();
+      const input = document.querySelector(".switcher-top input") as HTMLInputElement
+        || document.querySelector("input") as HTMLInputElement;
+      fireEvent.change(input, { target: { value: "insid" } });
+      expect(screen.queryByText("fleet is fine")).toBeNull();
+      expect(screen.getByText("inside")).toBeTruthy();
+      // Clearing the query remounts the card, which refetches — hence async.
+      fireEvent.change(input, { target: { value: "" } });
+      expect(await screen.findByText("fleet is fine")).toBeTruthy();
+    } finally {
+      vi.unstubAllGlobals();
+    }
+  });
+
   it("a query in manual mode still offers the full-history search", () => {
     // Manual keeps its own render branch under a query (narrow-in-place), so
     // the search tail — content hits + the deep button — must ride along or

package/hop

@@ -891,6 +891,32 @@ function mintSessionInternalName() {
     return id;
 }
 
+/**
+ * The display name a session may actually show.
+ *
+ * A rename can leave a session claiming a name that ANOTHER session owns as
+ * its internal id — rename Altair to "Accessibility", then a real
+ * Accessibility room appears. Two sessions answering to one name are
+ * indistinguishable in the UI and ambiguous to address (a rename lands on
+ * whichever one the resolver reaches first), so the room that OWNS the name
+ * keeps it and the borrower falls back to its own.
+ *
+ * This must run wherever a display name is RESOLVED, not only where runtime
+ * metadata is refreshed: getEffectiveSessionConfig gives the durable meta the
+ * final word, so a guard applied during reconcile alone was overwritten on the
+ * very next read — six colliding pairs still rendered as duplicates in every
+ * client on 2026-09-01. Pass `liveIds` when the caller already has the room
+ * list; otherwise the live-room check is per name.
+ */
+function resolveDisplayNameClaim(internalName, claimed, liveIds = null) {
+    const own = toDisplaySessionName(internalName) || internalName;
+    if (!claimed) return own;
+    if (claimed === internalName) return claimed;
+    const owner = toInternalSessionName(claimed) || claimed;
+    const taken = liveIds ? liveIds.has(owner) : hopSessionExists(owner);
+    return taken ? own : claimed;
+}
+
 function toDisplaySessionName(internalName) {
     if (!internalName || typeof internalName !== 'string') return '';
     return stripLegacySessionPrefix(internalName);
@@ -1160,14 +1186,14 @@ function getEffectiveSessionConfig(name) {
     if (!base) {
         return {
             type: 'terminal',
-            displayName: durable.displayName,
+            displayName: resolveDisplayNameClaim(name, durable.displayName),
             folderId: durable.folderId,
             createdBy: durable.createdBy,
             cwd: durable.cwd
         };
     }
     const merged = { ...base };
-    if (durable.displayName) merged.displayName = durable.displayName;
+    if (durable.displayName) merged.displayName = resolveDisplayNameClaim(name, durable.displayName);
     if (durable.folderId !== undefined) merged.folderId = durable.folderId || null;
     if (durable.createdBy) merged.createdBy = durable.createdBy;
     if (durable.tagline) merged.tagline = durable.tagline;
@@ -5595,6 +5621,34 @@ const CLAUDE_VALUE_FLAGS = new Set([
     '--append-system-prompt', '--settings', '--mcp-config', '--agents',
     '--effort', '--betas', '--session-id'
 ]);
+// The conversation a `--fork-session` launch forked FROM.
+//
+// Only meaningful together with --fork-session: in a plain `--resume <id>` the
+// id names the conversation itself, which is not a parent to fall back to.
+function forkParentSessionId(launchCmd) {
+    const raw = typeof launchCmd === 'string' ? launchCmd : '';
+    if (!/(?:^|\s)--fork-session(?:\s|=|$)/.test(raw)) return null;
+    const m = raw.match(/(?:^|\s)(?:--resume(?:=|\s+)|-r\s+)([A-Za-z0-9-]{8,})/);
+    return m ? m[1] : null;
+}
+
+/**
+ * Drop `--fork-session` from a rebuilt launch command.
+ *
+ * Forking is a one-time act, not a standing property of the session: the
+ * recorded id IS the forked conversation. Resuming it with the flag still
+ * attached forks AGAIN and mints yet another id, so every restore orphans the
+ * previous fork and any fork killed before its first turn loses its whole tail
+ * (2026-09-01: Accessibility-fork's id churned on each restore, and a host
+ * restart left the newest id with no transcript at all).
+ */
+function stripForkSessionFlag(command) {
+    return String(command || '')
+        .replace(/(?:^|\s)--fork-session(?=\s|$)/g, ' ')
+        .replace(/\s{2,}/g, ' ')
+        .trim();
+}
+
 function rebuildClaudeLaunch(launchCmd) {
     const raw = typeof launchCmd === 'string' ? launchCmd.trim() : '';
     if (!raw) return null;
@@ -5709,12 +5763,33 @@ function restorePlanForSession(entry) {
             warning: `recorded conversation started in ${rec.cwd} but this session's last directory was ${liveCwd} — that record belongs to another claude; opening a plain shell here instead`
         };
     }
+    // Set only when the fork recovery below fires, so the rebuilt command keeps
+    // its --fork-session: we are resuming the PARENT and must not write into
+    // the parent's conversation.
+    let reforkFromParent = false;
     if (rec && rec.sessionId && !claudeTranscriptExists(rec)) {
-        return {
-            command: null,
-            cwd: rec.cwd || entry.cwd,
-            warning: `recorded claude conversation ${String(rec.sessionId).slice(0, 8)}… has no transcript on this host — opening a plain shell instead`
-        };
+        // A fork whose own transcript never landed is not a lost session.
+        // `--fork-session` mints a new conversation id at launch and claude
+        // only writes that transcript once a turn completes, so a fork killed
+        // before its first turn — a host restart, a crash — always leaves a
+        // recorded id with nothing behind it. The conversation it forked from
+        // is still on disk, and re-forking reproduces exactly what the
+        // recorded command produced the first time. Dropping to a plain shell
+        // here threw away the parent history too, which is the part that
+        // mattered (2026-09-01: Accessibility-fork came back as a bare shell,
+        // stranding a 2.3MB parent conversation).
+        const parentId = forkParentSessionId(rec.launchCmd);
+        if (parentId && parentId !== rec.sessionId
+            && claudeTranscriptExists({ ...rec, sessionId: parentId })) {
+            rec = { ...rec, sessionId: parentId, reforkedFrom: rec.sessionId };
+            reforkFromParent = true;
+        } else {
+            return {
+                command: null,
+                cwd: rec.cwd || entry.cwd,
+                warning: `recorded claude conversation ${String(rec.sessionId).slice(0, 8)}… has no transcript on this host — opening a plain shell instead`
+            };
+        }
     }
     if (rec && rec.sessionId) {
         // Preserve the original launch command's FLAGS (--dangerously-skip-
@@ -5741,6 +5816,9 @@ function restorePlanForSession(entry) {
             base = fromArgv;
             isClaudeLaunch = true;
         }
+        // The fork already happened; this id is its result. Only a deliberate
+        // re-fork of a parent (above) still needs the flag.
+        if (!reforkFromParent) base = stripForkSessionFlag(base);
         // Config-dir prefix: needed for a bare `claude` against a wrapper
         // config; a wrapper command (claude-fable) sets it itself. A null
         // configDir means the DEFAULT root — pin that explicitly too
@@ -8769,17 +8847,31 @@ async function ensureExternalHayHostReadyOnce() {
 
     writeHayHostStateFile(started);
     child.unref();
-    if (watchdogKilledLiveHost) {
-        // The old host's PTYs — and every claude running inside them — died
-        // with it. Re-drive the fleet the way `hop restore` would instead of
-        // waiting for a human to notice dead shells (2026-08-31: a watchdog
-        // restart silently orphaned ~36 claude sessions). The delay lets the
-        // new host finish its own startup reconcile first; the restore
-        // reconciler then converges stragglers for 15 minutes.
-        log('[Hay] The watchdog killed a host with live sessions — auto-restoring saved sessions in 5s. Agent-created sessions are excluded; `hop restore --agents` brings those back.', YELLOW);
+    // This host REPLACES one: a record of the previous host was still on
+    // file when we got here. Its PTYs — and every claude running inside them
+    // — died with it, however it died. Re-drive the fleet the way `hop
+    // restore` would instead of waiting for a human to notice dead shells.
+    //
+    // Keyed on the prior record, not on who did the killing. The first
+    // version fired only after a WATCHDOG kill, which left every other death
+    // — a crash, an OOM, a reboot, a deliberate `kill` — to a human, and the
+    // one time it mattered (2026-09-01: host restarted by hand to deploy a
+    // fix) the restore that was supposed to follow never ran, because the
+    // shell it was queued in lived inside the host that had just died. The
+    // fleet sat empty until the user noticed. Deliberate teardown is still
+    // honored: `hop stop --all` clears the record, so there is nothing to
+    // replace and nothing is resurrected; the same goes for first boot.
+    //
+    // The delay lets the new host finish its own startup reconcile first;
+    // the restore reconciler then converges stragglers for 15 minutes.
+    if (existing) {
+        const why = watchdogKilledLiveHost
+            ? 'The watchdog killed a host with live sessions'
+            : `Host ${existing.pid} is gone (not stopped by hop) and has been replaced`;
+        log(`[Hay] ${why} — auto-restoring saved sessions in 5s. Agent-created sessions are excluded; \`hop restore --agents\` brings those back.`, YELLOW);
         setTimeout(() => {
             restoreSavedSessions({}).catch((e) => {
-                log(`[Hay] Auto-restore after the watchdog restart failed: ${e?.message || e}. Run \`hop restore\` by hand.`, RED);
+                log(`[Hay] Auto-restore after the host replacement failed: ${e?.message || e}. Run \`hop restore\` by hand.`, RED);
             });
         }, 5000).unref();
     }
@@ -8998,10 +9090,21 @@ async function reconcileExternalRuntimeSessionsUncached() {
         return { rooms: [], runtimeAvailable: false };
     }
 
+    // Every live room id, collected BEFORE the walk below. The display-name
+    // collision guard asks whether a claimed name is some OTHER room's id, and
+    // filling this set as we went made that answer depend on iteration order:
+    // a session whose claim collided with a room listed LATER kept the name,
+    // so two sessions answered to it. That is ambiguous to address, and a
+    // rename then landed on whichever one the resolver reached first
+    // (2026-09-01: room s_e15f120ce7 claimed "Solstice" from index 0 while the
+    // room actually NAMED Solstice sat at index 1, so renaming "Solstice" to
+    // "hop" retitled the wrong session and the card kept showing the old name).
     const runtimeIds = new Set();
+    for (const room of rooms) {
+        if (room && room.id) runtimeIds.add(room.id);
+    }
     for (const room of rooms) {
         if (!room || !room.id) continue;
-        runtimeIds.add(room.id);
         const savedConfig = getSessionConfig(room.id);
         const runtimeConfig = getRuntimeSessionMetadata(room.id);
         const durableMeta = readDurableIdentity(room.id); // mtime-cached — reconcile runs constantly
@@ -9033,7 +9136,7 @@ async function reconcileExternalRuntimeSessionsUncached() {
                 // store/runtime entry here let a stale in-memory name undo a
                 // rename on the very next tick.
                 const claimed = durableMeta?.displayName || savedConfig?.displayName || runtimeConfig?.displayName;
-                if (claimed && claimed !== room.id && runtimeIds.has(toInternalSessionName(claimed) || claimed)) {
+                if (claimed && resolveDisplayNameClaim(room.id, claimed, runtimeIds) !== claimed) {
                     // Log the rejection once per claim, not once per tick: an
                     // unresolvable claim (the user renamed to a name another
                     // live session owns) repeats forever otherwise, and 30+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hop2",
-  "version": "0.11.36",
+  "version": "0.11.38",
   "description": "🐰 Hop into your terminal from anywhere. Secure remote shell access with 2FA via Cloudflare Tunnel. Next-gen rewrite with native terminal sharing.",
   "main": "hop",
   "bin": {