hop2 0.11.44 → 0.11.46

package/hay/apps/server/src/rooms.ts

@@ -73,6 +73,12 @@ export type ClientInfo = {
   // larger requests are a deliberate ask for scrollback DEPTH and keep the
   // raw-tail replay. Unset = raw tail at the room default (CLI reattach).
   replayBytes?: number;
+  // "attach" = the client claims the size AS it connects — the same
+  // election a resize message with claim:"attach" runs, but BEFORE the
+  // snapshot goes out, so the first frame the client renders is already
+  // its own size. A phone opening a session a desktop was driving used to
+  // paint the desktop's grid and reflow ~half a second later.
+  sizeClaim?: "attach";
   // False = skip the equal-size attach "wiggle" (the −1/+1 column repaint
   // nudge). Wall tiles decline it: they arrive already showing the current
   // grid (the daemon's headless screen, complete — not a raw byte tail), so
@@ -436,6 +442,13 @@ export class Room extends EventEmitter {
       } satisfies ServerMessage)
     );
 
+    // Connect-time size claim (see ClientInfo.sizeClaim): after hello, so
+    // the client can tell the resulting active_size is its own, and before
+    // the snapshot, so the replay is already at the claimed size.
+    if (info.sizeClaim === "attach") {
+      this.handleResize(client, info.cols, info.rows, "attach");
+    }
+
     socket.send(
       JSON.stringify({
         type: "active_size",
@@ -1317,17 +1330,26 @@ export class Room extends EventEmitter {
    * like the attach path so cursor/mouse state present identically too.
    */
   serializeScreen(
-    callback: (result: { data: string; cols: number; rows: number } | null) => void,
+    callback: (result: { data: string; cols: number; rows: number; offset: number } | null) => void,
     scrollback = 200
   ) {
     if (this.outputBytes === 0) { callback(null); return; }
     const grid = this.ensureGrid();
     if (!grid) { callback(null); return; }
+    // The output cursor this screen reflects: everything in the ring NOW is
+    // queued into the grid ahead of the serialize marker, everything that
+    // arrives later lands behind it. A consumer that keeps its own parser
+    // (the daemon's preview grids) continues from here with /output?since=
+    // and never misses or repeats a byte — which is what let it seed from a
+    // whole screen instead of a raw tail cut mid-frame (a differential TUI
+    // never re-sends the cells such a tail lost: Codex previews stayed
+    // partially wrong until the app repainted, 2026-09-09).
+    const offset = this.outputStart + this.outputBytes;
     grid.serialize((serialized) => {
       if (serialized === null) { callback(null); return; }
       const modeSeq = (this.mouseReporting ? "\x1b[?1002h" + (this.mouseSgr ? "\x1b[?1006h" : "") : "")
         + (this.cursorHidden ? "\x1b[?25l" : "");
-      callback({ data: "\x1bc" + serialized + modeSeq, cols: this.activeCols, rows: this.activeRows });
+      callback({ data: "\x1bc" + serialized + modeSeq, cols: this.activeCols, rows: this.activeRows, offset });
     }, scrollback);
   }
 
@@ -1471,7 +1493,7 @@ export class RoomManager {
 
   serializeRoomScreen(
     id: string,
-    callback: (result: { data: string; cols: number; rows: number } | null) => void,
+    callback: (result: { data: string; cols: number; rows: number; offset: number } | null) => void,
     scrollback?: number
   ) {
     const room = this.rooms.get(id);

package/hay/apps/server/test/rooms.test.ts

@@ -121,6 +121,31 @@ describe("Room", () => {
     expect(ptyInstance!.resizes.length).toBe(before);
   });
 
+  it("a connect-time size claim sizes the PTY before the snapshot goes out", () => {
+    let ptyInstance: FakePty | null = null;
+    const factory: PtyFactory = () => {
+      ptyInstance = new FakePty() as unknown as FakePty;
+      return ptyInstance as any;
+    };
+    const manager = new RoomManager(factory);
+    const room = manager.getRoom("claim", { cols: 120, rows: 40 }, "/tmp");
+    // A desktop is driving the size, and the session has painted something
+    // (a room with no output sends no snapshot at all).
+    room.attachClient({ id: "desk", name: "Desk", colorIndex: 0, cols: 120, rows: 40 }, new FakeSocket());
+    ptyInstance!.emit("$ ls\r\nREADME.md\r\n");
+    // ...and a phone opens the session, claiming its own size as it attaches.
+    const phone = new FakeSocket();
+    room.attachClient({ id: "phone", name: "iPhone", colorIndex: 1, cols: 60, rows: 30, sizeClaim: "attach" }, phone);
+    expect(ptyInstance!.resizes.some((r) => r.cols === 60 && r.rows === 30)).toBe(true);
+    const types = readMessages(phone).map((m) => m.type);
+    const sized = readMessages(phone).findIndex((m) => m.type === "active_size" && m.cols === 60 && m.rows === 30);
+    const snapshot = types.indexOf("snapshot");
+    expect(sized).toBeGreaterThanOrEqual(0);
+    expect(snapshot).toBeGreaterThan(sized);
+    // The phone owns the size: the active_size it receives names it.
+    expect(readMessages(phone).some((m) => m.type === "active_size" && m.clientId === "phone")).toBe(true);
+  });
+
   it("broadcasts pty output to all clients", () => {
     let ptyInstance: FakePty | null = null;
     const factory: PtyFactory = () => {
@@ -863,6 +888,19 @@ describe("Room", () => {
       expect(String(snapshot.data)).toContain("ROW-5");
     });
 
+    it("serializeScreen reports the output cursor the screen reflects, so a delta consumer can continue exactly", async () => {
+      const { room, pty } = await setup("offset");
+      pty().emit("hello\r\n");
+      const first = await new Promise<any>((r) => room.serializeScreen((x) => r(x)));
+      expect(first.offset).toBe(room.getOutputSince(undefined).offset);
+      pty().emit("more");
+      const second = await new Promise<any>((r) => room.serializeScreen((x) => r(x)));
+      expect(second.offset).toBe(first.offset + 4);
+      const delta = room.getOutputSince(first.offset);
+      expect(delta.reset).toBe(false);
+      expect(delta.data).toBe("more");
+    });
+
     it("flags a serialized snapshot as capped when deeper raw history exists", async () => {
       const { room, pty } = await setup("capped");
       const big = "\x1b[20;1H" + "y".repeat(4096);

package/hay/apps/web/src/App.tsx

@@ -15,6 +15,7 @@ import { attachScrollFlywheel } from "./utils/scrollFlywheel";
 import { collectTerminalMatches, selectTerminalMatch } from "./utils/terminalSearch";
 import { createVoiceHold, speechRecognitionCtor } from "./utils/voiceHold";
 import { tabTitle } from "./utils/tabTitle";
+import { remoteAppOwnsScreen } from "./utils/echoGuard";
 import { scanKeyboardProtocol } from "./utils/keyboardProtocol";
 import { originalPathHint, pasteableUploadPaths } from "./utils/fileDrop";
 import { MobileKeyboard } from "./components/MobileKeyboard";
@@ -639,6 +640,11 @@ const App = () => {
   // local viewport scroll is a no-op there — touch scrolling must instead send the
   // app its own scroll keys (PageUp/PageDown). See the mobile touch handler.
   const remoteAltScreenRef = useRef(false);
+  // The other ways an app announces it owns the screen (see utils/echoGuard):
+  // Codex draws in a DECSTBM scroll region on the normal screen inside DEC
+  // 2026 synchronized-output frames, never entering the alternate screen.
+  const remoteScrollRegionRef = useRef(false);
+  const remoteSyncOutputSeenAtRef = useRef(0);
   // Mouse tracking requested by the remote app (?1000/1002/1003) + SGR
   // encoding (?1006). When both are on, touch scrolling drives the app with
   // per-line SGR wheel events (smooth, momentum-capable) instead of Page keys.
@@ -1131,7 +1137,12 @@ const App = () => {
     // the SHELL, where the terminal echoes char-by-char with no redraw to
     // fight. (Reconcile's TUI guard still protects any in-flight echo when the
     // app flips to alt-screen mid-keystroke.)
-    && !remoteAltScreenRef.current
+    && !remoteAppOwnsScreen({
+      altScreen: remoteAltScreenRef.current,
+      mouseReporting: remoteMouseReportingRef.current,
+      scrollRegion: remoteScrollRegionRef.current,
+      syncOutputSeenAt: remoteSyncOutputSeenAtRef.current
+    }, Date.now())
     && !hasActiveOtherTypist(presenceRef.current, clientIdRef.current, typingLastSeenRef.current, Date.now())
     && (collabModeRef.current ? true : controllerIdRef.current === clientIdRef.current);
   const optimisticActive = echoEnabledNow();
@@ -2172,11 +2183,27 @@ const App = () => {
         if (ALT_SCREEN_PARAMS.has(n)) remoteAltScreenRef.current = enabled;
         if (MOUSE_TRACK_PARAMS.has(n)) remoteMouseReportingRef.current = enabled;
         if (n === 1006) remoteMouseSgrRef.current = enabled;
+        // DEC 2026: a synchronized-output frame — only TUIs draw this way.
+        if (n === 2026 && enabled) remoteSyncOutputSeenAtRef.current = Date.now();
       }
       return false; // let xterm's default handler apply the mode
     };
     terminal.parser.registerCsiHandler({ prefix: '?', final: 'h' }, (params) => trackAltScreen(params, true));
     terminal.parser.registerCsiHandler({ prefix: '?', final: 'l' }, (params) => trackAltScreen(params, false));
+    // DECSTBM (CSI t;b r): a scroll region narrower than the screen means an
+    // app is composing the screen itself. Bare CSI r (or RIS) clears it.
+    terminal.parser.registerCsiHandler({ final: 'r' }, (params) => {
+      const top = Number(Array.isArray(params[0]) ? params[0][0] : params[0]) || 1;
+      const bottomRaw = Array.isArray(params[1]) ? params[1][0] : params[1];
+      const bottom = Number(bottomRaw) || terminal.rows;
+      remoteScrollRegionRef.current = !(top <= 1 && bottom >= terminal.rows);
+      return false;
+    });
+    terminal.parser.registerEscHandler({ final: 'c' }, () => {
+      remoteScrollRegionRef.current = false;
+      remoteSyncOutputSeenAtRef.current = 0;
+      return false;
+    });
 
     setTerminalReady(true);
 
@@ -3129,6 +3156,8 @@ const App = () => {
           internalName: s.internalName || s.name,
           lastActivityAt: Number(s.lastActivityAt) || 0,
           bellSeq: Number(s.bellSeq) || 0,
+          attentionReason: typeof s.attentionReason === "string" ? s.attentionReason : "",
+          attentionNote: typeof s.attentionNote === "string" ? s.attentionNote : "",
           foregroundProcess: s.foregroundProcess,
           agentPermitted: s.agentPermitted === true,
           createdBy: s.createdBy === "agent" ? "agent" : "user",

package/hay/apps/web/src/utils/echoGuard.ts

@@ -0,0 +1,26 @@
+// Should optimistic local echo be suppressed because the remote app is a
+// full-screen TUI that repaints on every keystroke?
+//
+// The alternate screen was the only signal. Claude Code, vim and less use
+// it — Codex does not: its TUI draws with absolute cursor positioning in a
+// scroll region on the NORMAL screen, wrapped in DEC 2026 synchronized-output
+// brackets, and enables mouse reporting. Typing into it echoed a raw char
+// that the next frame overwrote — the same flicker the alt-screen guard
+// fixed for Claude, back for Codex. Any of these says "an app owns the
+// screen": no echo.
+export const SYNC_OUTPUT_FRESH_MS = 10_000;
+
+export type RemoteScreenSignals = {
+  altScreen: boolean;
+  mouseReporting: boolean;
+  /** A DECSTBM scroll region narrower than the full screen is in effect. */
+  scrollRegion: boolean;
+  /** Last time a DEC 2026 synchronized-output frame was seen (ms epoch), 0 = never. */
+  syncOutputSeenAt: number;
+};
+
+export const remoteAppOwnsScreen = (s: RemoteScreenSignals, now: number): boolean =>
+  s.altScreen
+  || s.mouseReporting
+  || s.scrollRegion
+  || (s.syncOutputSeenAt > 0 && now - s.syncOutputSeenAt < SYNC_OUTPUT_FRESH_MS);

package/hay/apps/web/test/echoGuard.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, it } from "vitest";
+import { remoteAppOwnsScreen, SYNC_OUTPUT_FRESH_MS } from "../src/utils/echoGuard";
+
+const shell = { altScreen: false, mouseReporting: false, scrollRegion: false, syncOutputSeenAt: 0 };
+
+describe("optimistic echo guard", () => {
+  it("a plain shell gets local echo", () => {
+    expect(remoteAppOwnsScreen(shell, 1_000_000)).toBe(false);
+  });
+  it("the alternate screen (Claude Code, vim) suppresses it", () => {
+    expect(remoteAppOwnsScreen({ ...shell, altScreen: true }, 1_000_000)).toBe(true);
+  });
+  it("Codex's normal-screen TUI suppresses it too: scroll region, sync frames, or mouse reporting", () => {
+    expect(remoteAppOwnsScreen({ ...shell, scrollRegion: true }, 1_000_000)).toBe(true);
+    expect(remoteAppOwnsScreen({ ...shell, mouseReporting: true }, 1_000_000)).toBe(true);
+    expect(remoteAppOwnsScreen({ ...shell, syncOutputSeenAt: 999_000 }, 1_000_000)).toBe(true);
+  });
+  it("a synchronized-output frame ages out once the app is gone", () => {
+    expect(remoteAppOwnsScreen({ ...shell, syncOutputSeenAt: 1_000_000 }, 1_000_000 + SYNC_OUTPUT_FRESH_MS + 1)).toBe(false);
+  });
+});

package/hop

@@ -2650,21 +2650,8 @@ const CLAUDE_UI_RE = /bypass permissions on|shift\+tab to cycle|Welcome back|esc
 // sat at the dialog for two weeks (lightscope, Neptune). Whitespace-
 // tolerant because the grid text can run words together across wraps.
 const TRUST_PROMPT_RE = /Quick\s*safety\s*check|Yes,?\s*I\s*trust\s*this\s*folder|Is\s*this\s*a\s*project\s*you\s*created\s*or\s*one\s*you\s*trust/i;
-// The directory the dialog is asking about, so an answer is only ever given
-// for the workspace the session was launched in - never for wherever a
-// shell happened to wander.
-function trustDialogWorkspace(screenText) {
-    const m = /Accessing\s*workspace:?\s*(\/[^\s\u2502\u2500]+)/i.exec(String(screenText || ''));
-    return m ? m[1].replace(/\/+$/, '') : null;
-}
-function samePath(a, b) {
-    const norm = (p) => {
-        let v = String(p || '').replace(/\/+$/, '');
-        try { v = fs.realpathSync(v); } catch (e) { /* keep as-is */ }
-        return v;
-    };
-    return !!a && !!b && norm(a) === norm(b);
-}
+// Trust-dialog reading lives in lib/trust-dialog.js so it can be unit-tested.
+const { trustDialogWorkspace, trustDialogAnswer, samePath } = require('./lib/trust-dialog.js');
 function getResumeMode() {
     const mode = String(getHopConfig().resume_mode || '').toLowerCase();
     return mode === 'summary' || mode === 'ask' ? mode : 'full';
@@ -5248,6 +5235,89 @@ function readTurnCount(internalName) {
 // surfaces (dedupe + seen-marks already handle "one finish, one alert").
 // Baselined at arm time (notifyBaseTurn) so arming a long-lived session does
 // not fire a single notification for its entire back history.
+// The ASK record the Claude hook writes when the agent stops to ask the human
+// something (permission, a question, a plan to approve): {count, at, type,
+// message}. Always on — unlike a finished turn, a question is worth a buzz by
+// definition — its count rides bellSeq like a bell, and the message travels
+// beside it so the phone can say what is being asked.
+function readAsk(internalName) {
+    try {
+        const a = JSON.parse(fs.readFileSync(
+            path.join(CLAUDE_SESSIONS_DIR, `${internalName}.ask`), 'utf8'));
+        if (!a || !Number.isInteger(a.count) || a.count < 0) return null;
+        const atMs = Date.parse(a.at);
+        return {
+            count: a.count,
+            at: Number.isFinite(atMs) ? atMs : null,
+            type: typeof a.type === 'string' ? a.type : '',
+            message: typeof a.message === 'string' ? a.message : ''
+        };
+    } catch (e) { return null; }
+}
+// One read per session per second at most: /api/sessions maps every field
+// through askOf() and the list is polled by every client.
+const askMemo = new Map();
+function askOf(internalName) {
+    const now = Date.now();
+    const hit = askMemo.get(internalName);
+    if (hit && now - hit.t < 1000) return hit.v;
+    const v = readAsk(internalName);
+    askMemo.set(internalName, { t: now, v });
+    return v;
+}
+// When the agent's last turn ended, from the same .turn record (Claude's
+// Stop hook, Codex's notify chain). Used to attribute a bell: Codex rings
+// the terminal bell at the end of EVERY turn, and a bell that lands within
+// seconds of the turn record is "finished", not "needs you".
+function readTurnAt(internalName) {
+    try {
+        const at = Date.parse(JSON.parse(fs.readFileSync(
+            path.join(CLAUDE_SESSIONS_DIR, `${internalName}.turn`), 'utf8')).at);
+        return Number.isFinite(at) ? at : 0;
+    } catch (e) { return 0; }
+}
+// The newest published view's time (ms) for a session, from the manifest
+// the views summary already reads. `hop view` rings one bell per publish.
+function latestViewAtMs(internalName) {
+    try {
+        const items = JSON.parse(fs.readFileSync(path.join(VIEWS_DIR, 'manifest.json'), 'utf8')).items || [];
+        let best = 0, title = '';
+        for (const it of items) {
+            if (it.session !== internalName) continue;
+            const ms = Number(it.mtime) < 1e11 ? Number(it.mtime) * 1000 : Number(it.mtime);
+            if (ms > best) { best = ms; title = it.title || it.name || ''; }
+        }
+        return { at: best, title };
+    } catch (e) { return { at: 0, title: '' }; }
+}
+// WHY a session wants attention — the thing Jian could not find when the UI
+// said a Codex session "needs your input" and the screen showed a finished
+// turn. Decided from timestamps hop already has, newest signal first:
+//   ask      the agent asked (hook record; also `hop notify`) — note = message
+//   finished the bell landed with the turn record (Codex rings at turn end)
+//   view     the bell landed with a `hop view` publish — note = the title
+//   bell     a bell nothing explains
+function attentionReason(internalName, lastBellAt, lastActivityAt) {
+    const ask = askOf(internalName);
+    const now = Date.now();
+    if (ask && ask.at && now - ask.at < 15 * 60 * 1000) {
+        return { reason: 'ask', note: ask.message || '', askType: ask.type || '' };
+    }
+    const bell = Number(lastBellAt) || 0;
+    if (bell > 0) {
+        const turnAt = readTurnAt(internalName);
+        if (turnAt && Math.abs(bell - turnAt) <= 4000) return { reason: 'finished', note: '' };
+        const view = latestViewAtMs(internalName);
+        if (view.at && Math.abs(bell - view.at) <= 4000) return { reason: 'view', note: view.title };
+        // Still producing output: an agent that needs you is QUIET. Codex
+        // rings mid-turn too (six bells in four minutes of "Working…" on
+        // angler-codex) — those are pings, not questions.
+        const active = Number(lastActivityAt) || 0;
+        if (active && now - active < 15000) return { reason: 'working', note: '' };
+        return { reason: 'bell', note: '' };
+    }
+    return { reason: '', note: '' };
+}
 function finishBump(internalName, config) {
     if (!config || config.notifyOnFinish !== true) return 0;
     const base = Number.isInteger(config.notifyBaseTurn) ? config.notifyBaseTurn : 0;
@@ -6026,7 +6096,34 @@ async function sweepRestoreReconcile() {
             // The screen and foreground name lie for argv-launched sessions.
             const procUp = claudeProcessRunning(exp.sessionId);
             const running = !isShellProcName(entry.foregroundProcess);
-            const claudeUp = procUp || running || CLAUDE_UI_RE.test(text);
+            const alive = procUp || running;
+            // A trust dialog is only a dialog while claude is up to show it.
+            // Checked BEFORE "converged": a live claude parked at the dialog
+            // used to be declared running and left there forever, while the
+            // dialog's text lingering on a dead session's screen — the
+            // process gone, a shell prompt under it — was "answered" every
+            // tick, typing digits into the shell (motif, 2026-09-10).
+            const settledMs = now - Math.max(exp.lastDriveAt || 0, exp.recordedAt || 0);
+            if (TRUST_PROMPT_RE.test(text) && alive && settledMs >= 6000) {
+                const trust = trustDialogAnswer(text, exp.cwd);
+                if (trust.ours) {
+                    if (!exp.trustAnsweredAt || now - exp.trustAnsweredAt > 20_000) {
+                        try {
+                            const e2 = await attachTerminalApiClient(name, exp.displayName, { actor: 'system', label: 'reconcile' });
+                            try { sendTerminalInput(e2, trust.input); } finally { try { closeTerminalApiEntry(e2.id); } catch (e) {} }
+                            exp.trustAnsweredAt = now;
+                            changed = true;
+                            log(`[reconcile] ${exp.displayName}: accepted ${trust.preapproval ? 'pre-approved permissions' : 'workspace trust'} (${trust.how})`, DIM);
+                        } catch (e) { /* try again next tick */ }
+                    }
+                    continue;
+                }
+                // Trust dialog for some OTHER directory — not ours to answer.
+                exp.status = 'needs-attention';
+                exp.reason = `claude is asking to trust ${trust.asked || 'a directory'}, not ${exp.cwd}`;
+                changed = true;
+                continue;
+            const claudeUp = alive || CLAUDE_UI_RE.test(text);
             if (claudeUp) {
                 exp.status = 'converged';
                 exp.convergedAt = now;
@@ -6034,23 +6131,6 @@ async function sweepRestoreReconcile() {
                 log(`[reconcile] ${exp.displayName}: verified running`, DIM);
                 continue;
             }
-            // A dialog: the resume sweep answers resume prompts already; the
-            // trust dialog we answer here (only for this session's own cwd).
-            if (TRUST_PROMPT_RE.test(text)) {
-                const asked = trustDialogWorkspace(text);
-                if (asked && samePath(asked, exp.cwd)) {
-                    try {
-                        const e2 = await attachTerminalApiClient(name, exp.displayName, { actor: 'system', label: 'reconcile' });
-                        try { sendTerminalInput(e2, '1\r'); } finally { try { closeTerminalApiEntry(e2.id); } catch (e) {} }
-                        log(`[reconcile] ${exp.displayName}: accepted workspace trust`, DIM);
-                    } catch (e) { /* try again next tick */ }
-                    continue;
-                }
-                // Trust dialog for some OTHER directory — not ours to answer.
-                exp.status = 'needs-attention';
-                exp.reason = `claude is asking to trust ${asked || 'a directory'}, not ${exp.cwd}`;
-                changed = true;
-                continue;
             }
             if (RESUME_PROMPT_RE.test(text)) continue; // resume sweep owns this
             // A busy non-shell foreground we did not recognise as claude: the
@@ -6477,18 +6557,32 @@ async function restoreSavedSessionsUnlocked({ dryRun = false, includeAgents = fa
                     const grid = await getRoomGridPreviewShared(job.plan.internalName);
                     screen = String(grid?.text || '');
                 } catch (e) { continue; }
-                if (TRUST_PROMPT_RE.test(screen) && !job.trustAnswered) {
+                // Only a LIVE dialog: the same text lingers on screen after
+                // claude has exited (or before the new one has drawn), and
+                // answering it then types into a shell or into a claude that
+                // has not asked yet.
+                // ...and only once the fresh claude has had time to DRAW it:
+                // the previous claude's dialog text is still on screen for the
+                // first seconds after launch, and an answer sent then reaches
+                // a claude that has not asked yet (the Enter lands on whatever
+                // it shows next — for this dialog, the default "No, exit").
+                const dialogLive = TRUST_PROMPT_RE.test(screen) && Date.now() - job.since >= 6000 && (() => {
+                    const recId = readClaudeSessionRecord(job.plan.internalName)?.sessionId;
+                    const fg = getRuntimeSessionMetadata(job.plan.internalName)?.foregroundProcess;
+                    return (!!recId && claudeProcessRunning(recId)) || (!!fg && !isShellProcName(fg));
+                })();
+                if (dialogLive && !job.trustAnswered) {
                     // Answer only for the workspace this session was launched
                     // in. A dialog naming any other directory is not ours to
                     // wave through - leave it on screen and say so.
-                    const asked = trustDialogWorkspace(screen);
-                    if (asked && samePath(asked, job.plan.cwd)) {
-                        try { sendTerminalInput(job.entry, '1\r'); } catch (e) { finish('write-failed'); continue; }
-                        log(`  ${getSessionDisplayName(job.plan.internalName) || job.plan.internalName}: accepted workspace trust for ${asked}`, DIM);
+                    const trust = trustDialogAnswer(screen, job.plan.cwd);
+                    if (trust.ours) {
+                        try { sendTerminalInput(job.entry, trust.input); } catch (e) { finish('write-failed'); continue; }
+                        log(`  ${getSessionDisplayName(job.plan.internalName) || job.plan.internalName}: accepted ${trust.preapproval ? 'pre-approved permissions' : `workspace trust for ${trust.asked}`} (${trust.how})`, DIM);
                         job.trustAnswered = true;
                         job.since = Date.now();
                     } else {
-                        log(`  ${getSessionDisplayName(job.plan.internalName) || job.plan.internalName}: claude is asking to trust ${asked || 'an unknown directory'}, not ${job.plan.cwd} — left for you to answer`, YELLOW);
+                        log(`  ${getSessionDisplayName(job.plan.internalName) || job.plan.internalName}: claude is asking to trust ${trust.asked || 'an unknown directory'}, not ${job.plan.cwd} — left for you to answer`, YELLOW);
                         finish('trust-prompt');
                     }
                     continue;
@@ -6529,7 +6623,12 @@ async function restoreSavedSessionsUnlocked({ dryRun = false, includeAgents = fa
 // The same script is registered for two events: SessionStart (records the
 // conversation id for `hop restore`) and Stop (bumps a per-turn counter a driver
 // can wait on). See scripts/claude-session-hook.js.
-const CLAUDE_HOOK_EVENTS = ['SessionStart', 'Stop'];
+const CLAUDE_HOOK_EVENTS = ['SessionStart', 'Stop', 'Notification', 'PreToolUse'];
+// Notification (permission prompts, elicitation) and PreToolUse (the two tools
+// that open a dialog and wait) bump the per-session ASK record — "whenever an
+// agent asks me a question, notify me" (Jian). PreToolUse gets a matcher, or
+// the script would run on every tool call for nothing.
+const CLAUDE_HOOK_MATCHERS = { PreToolUse: 'AskUserQuestion|ExitPlanMode' };
 
 function getClaudeSettingsPath() {
     const dir = process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude');
@@ -6649,7 +6748,7 @@ function installClaudeHook() {
     for (const ev of CLAUDE_HOOK_EVENTS) {
         if (!Array.isArray(data.hooks[ev])) data.hooks[ev] = [];
         if (!hookGroupsHaveScript(data.hooks[ev])) {
-            data.hooks[ev].push({ matcher: '', hooks: [{ type: 'command', command }] });
+            data.hooks[ev].push({ matcher: CLAUDE_HOOK_MATCHERS[ev] || '', hooks: [{ type: 'command', command }] });
         }
     }
     try {
@@ -6693,6 +6792,65 @@ function removeClaudeHook() {
 // there (e.g. Codex Computer Use) via "--chain <orig...>". TOML is edited
 // line-by-line — `notify` is a top-level key, and we touch only that one line —
 // so the rest of the user's config is never reserialized (and mangled).
+// Codex hooks (Claude-compatible hooks.json at $CODEX_HOME/hooks.json): the
+// PermissionRequest event fires before Codex asks the human to approve a
+// command or network access — the same hop hook script records it as an ASK
+// so the phone buzzes with Codex's own one-line reason. Parity with Claude's
+// Notification/PreToolUse asks. Codex requires the user to TRUST a new hook
+// once, in its `/hooks` screen; until then it does not run.
+function getCodexHooksPath() {
+    return path.join(process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), 'hooks.json');
+}
+function codexHookGroupsHaveScript(groups) {
+    return Array.isArray(groups) && groups.some((g) => Array.isArray(g?.hooks) && g.hooks.some(
+        (h) => h && typeof h.command === 'string' && h.command.includes('claude-session-hook.js')
+    ));
+}
+function readCodexHooks() {
+    const p = getCodexHooksPath();
+    try { return { path: p, data: JSON.parse(fs.readFileSync(p, 'utf8')) }; }
+    catch (e) { return { path: p, data: { hooks: {} } }; }
+}
+function codexHookIsInstalled(data) {
+    return codexHookGroupsHaveScript(data?.hooks?.PermissionRequest);
+}
+function installCodexHook() {
+    const { path: p, data } = readCodexHooks();
+    if (codexHookIsInstalled(data)) return { ok: true, already: true, path: p };
+    if (!fs.existsSync(CLAUDE_HOOK_SCRIPT)) return { ok: false, error: `hook script missing: ${CLAUDE_HOOK_SCRIPT}` };
+    data.hooks = data.hooks && typeof data.hooks === 'object' ? data.hooks : {};
+    if (!Array.isArray(data.hooks.PermissionRequest)) data.hooks.PermissionRequest = [];
+    data.hooks.PermissionRequest.push({
+        matcher: '',
+        hooks: [{ type: 'command', command: `${process.execPath} ${CLAUDE_HOOK_SCRIPT}`, timeout: 5,
+                  statusMessage: 'hop: noting the question for your phone' }]
+    });
+    if (!data.description) data.description = 'hop: notify the phone when Codex stops to ask (PermissionRequest)';
+    try {
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        if (fs.existsSync(p)) fs.copyFileSync(p, `${p}.hop-backup`);
+        fs.writeFileSync(p, JSON.stringify(data, null, 2) + '\n');
+        return { ok: true, already: false, path: p };
+    } catch (e) { return { ok: false, error: e.message }; }
+}
+function removeCodexHook() {
+    const { path: p, data } = readCodexHooks();
+    if (!codexHookIsInstalled(data)) return { ok: true, already: true, path: p };
+    const groups = data.hooks.PermissionRequest;
+    for (const g of groups) {
+        if (Array.isArray(g.hooks)) {
+            g.hooks = g.hooks.filter((h) => !(h && typeof h.command === 'string' && h.command.includes('claude-session-hook.js')));
+        }
+    }
+    data.hooks.PermissionRequest = groups.filter((g) => Array.isArray(g.hooks) && g.hooks.length > 0);
+    if (data.hooks.PermissionRequest.length === 0) delete data.hooks.PermissionRequest;
+    try {
+        if (fs.existsSync(p)) fs.copyFileSync(p, `${p}.hop-backup`);
+        fs.writeFileSync(p, JSON.stringify(data, null, 2) + '\n');
+        return { ok: true, already: false, path: p };
+    } catch (e) { return { ok: false, error: e.message }; }
+}
+
 const CODEX_NOTIFY_SCRIPT = path.join(__dirname, 'scripts', 'codex-notify-hook.js');
 function getCodexConfigPath() {
     return path.join(process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), 'config.toml');
@@ -7836,6 +7994,38 @@ setInterval(() => {
     }
 }, 60_000).unref();
 
+// The host's whole current screen for a room (RIS + serialized grid + modes),
+// with the output cursor it reflects. Seeds a daemon preview grid without the
+// mid-frame holes a raw tail carries. null: host unreachable, room gone, or
+// an old host without the endpoint — callers fall back to the tail.
+function fetchHayRoomSerializedScreen(internalName) {
+    const host = hayHostState || readHayHostStateFile();
+    if (!host || !Number.isInteger(host.port) || host.port > 0 === false) return Promise.resolve(null);
+    return new Promise((resolve) => {
+        let settled = false;
+        const done = (v) => { if (!settled) { settled = true; resolve(v); } };
+        const req = http.request({
+            hostname: '127.0.0.1',
+            port: host.port,
+            path: `/rooms/${encodeURIComponent(internalName)}/serialized`,
+            method: 'GET'
+        }, (res) => {
+            let data = '';
+            res.on('data', (chunk) => { data += chunk; });
+            res.on('end', () => {
+                if ((res.statusCode || 0) !== 200) { done(null); return; }
+                try {
+                    const parsed = JSON.parse(data || 'null');
+                    done(parsed && typeof parsed.data === 'string' && parsed.data ? parsed : null);
+                } catch (e) { done(null); }
+            });
+        });
+        req.on('error', () => done(null));
+        req.setTimeout(6000, () => { req.destroy(); done(null); });
+        req.end();
+    });
+}
+
 function fetchHayRoomOutputSince(internalName, since) {
     const host = hayHostState || readHayHostStateFile();
     if (!host || !Number.isInteger(host.port) || host.port <= 0) return Promise.resolve(null);
@@ -7988,7 +8178,7 @@ async function getRoomGridPreview(internalName) {
     const Term = loadHeadlessTerminal();
     if (!Term) return null;
     let grid = roomGrids.get(internalName);
-    const res = await fetchHayRoomOutputSince(internalName, grid ? grid.offset : undefined);
+    let res = await fetchHayRoomOutputSince(internalName, grid ? grid.offset : undefined);
     if (!res) {
         // Host unreachable: an existing grid still holds the last true
         // screen — serve that rather than nothing.
@@ -8000,11 +8190,31 @@ async function getRoomGridPreview(internalName) {
         return null;
     }
     outputSinceProbe.supported = true;
+    // A grid that must (re)start seeds from the host's WHOLE screen, then
+    // continues with deltas from the cursor that screen reflects. Seeding
+    // from a bounded raw tail cut at an arbitrary byte left a differential
+    // TUI (Codex, Claude's inline UI) with holes it never re-sent: previews
+    // stayed partially wrong until the app repainted in full. An old host
+    // without an offset continues from the delta call's cursor instead —
+    // a few bytes may be skipped once, still far better than the tail.
+    const reseed = !grid || res.reset;
+    let seed = null;
+    if (reseed) {
+        const snap = await fetchHayRoomSerializedScreen(internalName);
+        if (snap) {
+            const from = Number.isFinite(Number(snap.offset)) ? Number(snap.offset) : res.offset;
+            const delta = await fetchHayRoomOutputSince(internalName, from);
+            if (delta && !delta.notFound && !delta.reset) {
+                seed = { data: snap.data, cols: Number(snap.cols) || res.cols, rows: Number(snap.rows) || res.rows };
+                res = delta;
+            }
+        }
+    }
     // Generous clamps: rendering NARROWER than the PTY re-wraps every long
     // line into garbage (the old 400 clamp mangled a real 476-col session).
-    const cols = Math.max(2, Math.min(1000, Math.floor(Number(res.cols) || 80)));
-    const rows = Math.max(2, Math.min(200, Math.floor(Number(res.rows) || 24)));
-    if (!grid || res.reset) {
+    const cols = Math.max(2, Math.min(1000, Math.floor(Number((seed || res).cols) || 80)));
+    const rows = Math.max(2, Math.min(200, Math.floor(Number((seed || res).rows) || 24)));
+    if (reseed) {
         disposeRoomGrid(internalName);
         let term;
         try {
@@ -8024,6 +8234,11 @@ async function getRoomGridPreview(internalName) {
         }
         grid = { term, serialize, offset: res.offset, cols, rows, lastUsedAt: Date.now() };
         roomGrids.set(internalName, grid);
+        if (seed) {
+            await new Promise((resolve) => {
+                try { term.write(seed.data, () => resolve()); } catch (e) { resolve(); }
+            });
+        }
         if (roomGrids.size > ROOM_GRID_MAX) {
             let oldestKey = null;
             let oldestAt = Infinity;
@@ -11067,8 +11282,18 @@ happens until someone clicks it.
                 // adds to bellSeq so the phone treats a finished response like a
                 // bell (dedupe/seen-marks make it one alert per finish). Plain
                 // sessions are unaffected — finishBump returns 0.
-                bellSeq: s.bellSeq + finishBump(s.internalName, getEffectiveSessionConfig(s.internalName)),
-                lastBellAt: s.lastBellAt,
+                bellSeq: s.bellSeq + finishBump(s.internalName, getEffectiveSessionConfig(s.internalName))
+                    + (askOf(s.internalName)?.count || 0),
+                // The bell's timestamp advances to the ask's, so clients that
+                // key seen-markers on time (the web) see a question as new.
+                lastBellAt: Math.max(Number(s.lastBellAt) || 0, askOf(s.internalName)?.at || 0) || s.lastBellAt,
+                // Why it wants you (see attentionReason): ask / finished / view / bell.
+                attentionReason: attentionReason(s.internalName, s.lastBellAt, s.lastActivityAt).reason,
+                attentionNote: attentionReason(s.internalName, s.lastBellAt, s.lastActivityAt).note,
+                askSeq: askOf(s.internalName)?.count || 0,
+                askAt: askOf(s.internalName)?.at || null,
+                askType: askOf(s.internalName)?.type || null,
+                askMessage: askOf(s.internalName)?.message || null,
                 shell: s.shell,
                 env: s.env,
                 cols: s.cols,
@@ -13225,6 +13450,9 @@ happens until someone clicks it.
             const rows = parseInt(wsUrl.searchParams.get('rows') || '24', 10);
             const source = wsUrl.searchParams.get('source') || '';
             const claimId = wsUrl.searchParams.get('claim') || null;
+            // Connect-time size claim (hay ClientInfo.sizeClaim): the phone's
+            // first frame at its own size, not a desktop peer's then a reflow.
+            const sizeClaim = wsUrl.searchParams.get('sizeClaim') === 'attach' ? 'attach' : undefined;
             // Client-supplied tab identity; the room evicts a same-key
             // predecessor on attach (reconnect replaces its own ghost).
             const deviceKeyRaw = wsUrl.searchParams.get('device') || '';
@@ -13266,7 +13494,7 @@ happens until someone clicks it.
 
             // Attach client to hay room
             session.room.attachClient(
-                { id: clientId, name: clientName, source, deviceKey, colorIndex, cols, rows },
+                { id: clientId, name: clientName, source, deviceKey, colorIndex, cols, rows, sizeClaim },
                 hay.createSocketAdapter(ws)
             );
         });
@@ -15145,7 +15373,7 @@ async function attachToAllSessions(existingTunnel) {
 const KNOWN_COMMANDS = [
     'client', 'start', 'attach', 'local', 'stop', 'status', 'doctor', 'logs',
     'help', 'config', 'url', 'qr', 'health', 'domain', 'domain-clear',
-    'password', 'user', 'workspace', 'session', 'wipe', 'restore', 'update', 'resume-waiting', 'claude-hook', 'codex-notify', 'claude-skill', 'agent-skill', 'math', 'view', 'port', 'notify', 'whoami', 'new',
+    'password', 'user', 'workspace', 'session', 'wipe', 'restore', 'recover', 'update', 'resume-waiting', 'claude-hook', 'codex-notify', 'codex-hook', 'claude-skill', 'agent-skill', 'math', 'view', 'port', 'notify', 'whoami', 'new',
     'mail', 'registration', 'canonical'
 ];
 
@@ -15268,6 +15496,7 @@ const HELP_SECTIONS = [
     ] },
     { title: 'Restore', lines: [
         `hop restore [--dry-run] [--agents]  Recreate your saved sessions, resuming claude conversations (--agents includes agent-created ones)`,
+        `hop recover [<session>]     Bring back the agent that last ran here: inside a session, relaunch its conversation in this terminal`,
         `hop restore <name>...     Redo just those sessions — even live ones, if they hold only an idle shell or a startup dialog`,
         `hop restore --health      Show sessions the reconciler could not bring back on its own, and why`,
         `hop update [--check|--no-host] Self-update from GitHub (daemon + host restart, host waits for the fleet to go idle; --no-host skips the host cycle)`,
@@ -15879,6 +16108,61 @@ async function main() {
     // Handle `hop resume-waiting` — answer claude's resume question for any
     // session currently parked on it (sessions restored before this existed,
     // or restored with resume_mode=ask and since reconsidered).
+    // hop recover [<session>] — bring back the agent that last ran in a
+    // session. Inside a session with no argument, it relaunches that
+    // session's own conversation IN THIS TERMINAL (the same flag-preserving
+    // command `hop restore` would use), so a claude that exited — crash,
+    // /exit, a wrong answer to a dialog — is one command away, and any
+    // dialog it shows is answered by the human sitting there. Named from
+    // anywhere, it is `hop restore <name>`.
+    if (process.argv[2] === 'recover') {
+        const args = process.argv.slice(3);
+        const dryRun = args.includes('--dry-run') || args.includes('-n');
+        const named = args.find((a) => !a.startsWith('-')) || null;
+        const here = process.env.HOP_SESSION || null;
+        if (!named && !here) {
+            log(`Run ${CYAN}hop recover${RESET} inside a hop session, or name one: ${CYAN}hop recover <session>${RESET}`, YELLOW);
+            process.exit(1);
+        }
+        const target = named ? (resolveSessionInternalName(named, named) || named) : here;
+        if (target !== here) {
+            // Not this terminal: the daemon relaunches it in its own room.
+            const child = spawn(process.execPath, [__filename, 'restore', ...(dryRun ? ['--dry-run'] : []), named], { stdio: 'inherit' });
+            child.on('exit', (code) => process.exit(code ?? 1));
+            return;
+        }
+        const display = getSessionDisplayName(target) || target;
+        const meta = readClaudeSessionMeta(target);
+        const cfg = getSessionConfig(target);
+        const cwd = meta?.cwd || cfg?.cwd || process.cwd();
+        const rec = readClaudeSessionRecord(target);
+        if (rec?.sessionId && claudeProcessRunning(rec.sessionId)) {
+            log(`${display}: its claude conversation ${String(rec.sessionId).slice(0, 8)}… is already running in this session.`, YELLOW);
+            process.exit(1);
+        }
+        const plan = restorePlanForSession({ internalName: target, cwd, startup: cfg?.startup, autoStart: cfg?.autoStart });
+        let command = plan?.command || null;
+        let kind = command ? 'claude' : null;
+        if (!command) {
+            // No claude record: a codex conversation is found by its rollout.
+            const rollout = resolveCodexTranscriptByCwd(cwd);
+            const rolloutId = rollout ? await trajectoryExtract.codexRolloutId(rollout) : null;
+            if (rolloutId) {
+                command = `codex resume '${rolloutId.replace(/'/g, `'\\''`)}'`;
+                kind = 'codex';
+            }
+        }
+        if (!command) {
+            log(`${display}: nothing to recover — no claude or codex conversation is recorded for this session${plan?.warning ? ` (${plan.warning})` : ''}.`, YELLOW);
+            process.exit(1);
+        }
+        log(`${dryRun ? 'Would recover' : 'Recovering'} ${BOLD}${display}${RESET} (${kind}) in this terminal:`, RESET);
+        log(`  ${DIM}${command}${RESET}`, RESET);
+        if (dryRun) process.exit(0);
+        const child = spawn('/bin/zsh', ['-lc', command], { stdio: 'inherit', cwd: plan?.cwd || cwd, env: process.env });
+        child.on('exit', (code, signal) => process.exit(signal ? 1 : (code ?? 0)));
+        return;
+    }
     if (process.argv[2] === 'resume-waiting') {
         const state = isServerRunning();
         if (!state) { printNotRunningError(); process.exit(1); }
@@ -16041,7 +16325,7 @@ async function main() {
             log(`${na.length} session(s) need your attention:`, YELLOW);
             for (const it of na) {
                 log(`  ${YELLOW}⚠${RESET} ${it.name}  ${DIM}${it.reason}${RESET}`, RESET);
-                log(`      ${DIM}redo: ${CYAN}hop restore ${it.name}${RESET}`, RESET);
+                log(`      ${DIM}redo: ${CYAN}hop restore ${it.name}${RESET}${DIM}, or inside it: ${CYAN}hop recover${RESET}`, RESET);
             }
             process.exit(0);
         }
@@ -16129,6 +16413,29 @@ async function main() {
     // Stop hook, so "notify me when it finishes" works for Codex sessions too.
     // Installs a WRAPPER into ~/.codex/config.toml that chains to any existing
     // notify (Computer Use), so nothing already there breaks.
+    if (process.argv[2] === 'codex-hook') {
+        const sub = process.argv[3] || 'status';
+        if (sub === 'install') {
+            const r = installCodexHook();
+            if (!r.ok) { log(`Failed to install Codex hook: ${r.error}`, RED); process.exit(1); }
+            log(r.already ? `Codex PermissionRequest hook already installed (${r.path}).`
+                          : `${GREEN}Installed${RESET} Codex PermissionRequest hook → ${r.path}`, RESET);
+            log(`Codex runs a new hook only after you trust it once: in Codex, type ${CYAN}/hooks${RESET} and choose Trust.`, DIM);
+            process.exit(0);
+        }
+        if (sub === 'remove') {
+            const r = removeCodexHook();
+            if (!r.ok) { log(`Failed to remove Codex hook: ${r.error}`, RED); process.exit(1); }
+            log(r.already ? `Codex PermissionRequest hook was not installed.` : `${GREEN}Removed${RESET} Codex PermissionRequest hook from ${r.path}`, RESET);
+            process.exit(0);
+        }
+        const { path: p, data } = readCodexHooks();
+        log(codexHookIsInstalled(data)
+            ? `${GREEN}✓${RESET} Codex PermissionRequest hook installed (${p}) — trusted in Codex's /hooks?`
+            : `${YELLOW}!${RESET} Codex PermissionRequest hook not installed. Run ${CYAN}hop codex-hook install${RESET} to get a phone notification when Codex asks.`, RESET);
+        process.exit(0);
+    }
+
     if (process.argv[2] === 'codex-notify') {
         const sub = process.argv[3] || 'status';
         if (sub === 'install') {
@@ -16406,6 +16713,19 @@ async function main() {
             log('Usage: hop notify <why you need the human>', YELLOW);
             process.exit(1);
         }
+        // The message rides the ASK record too, so the phone can say WHAT is
+        // needed instead of a bare "wants you" (see readAsk / attentionReason).
+        const hs = process.env.HOP_SESSION;
+        if (hs && /^[A-Za-z0-9_-]+$/.test(hs)) {
+            try {
+                const file = path.join(CLAUDE_SESSIONS_DIR, `${hs}.ask`);
+                let count = 0;
+                try { count = JSON.parse(fs.readFileSync(file, 'utf8')).count || 0; } catch (e) { /* first */ }
+                fs.mkdirSync(CLAUDE_SESSIONS_DIR, { recursive: true });
+                fs.writeFileSync(file, JSON.stringify({ sessionId: null, count: count + 1,
+                    at: new Date().toISOString(), type: 'notify', message: msg.slice(0, 300) }));
+            } catch (e) { /* the bell still rings */ }
+        }
         process.stdout.write(`\n\u2691 NEEDS YOU: ${msg}\n`);
         process.stdout.write('\x07');
         process.exit(0);

package/lib/trust-dialog.js

@@ -0,0 +1,65 @@
+'use strict';
+const fs = require('fs');
+
+// The directory the dialog is asking about, so an answer is only ever given
+// for the workspace the session was launched in - never for wherever a
+// shell happened to wander.
+function trustDialogWorkspace(screenText) {
+    const m = /Accessing\s*workspace:?\s*(\/[^\s\u2502\u2500]+)/i.exec(String(screenText || ''));
+    return m ? m[1].replace(/\/+$/, '') : null;
+}
+/**
+ * What a trust dialog on screen is asking, and the exact keys that say yes.
+ *
+ * Two variants exist. The classic one names the workspace ("Accessing
+ * workspace: /path") and numbers its options ("1. Yes, proceed / 2. No,
+ * exit"): typing the number answers it. The other appears when the folder's
+ * .claude/settings.json pre-approves tool permissions: it names no path (the
+ * folder IS the launch directory), lists "No, exit" FIRST, and is an ARROW
+ * SELECTOR — a ❯ marks the highlighted option and Enter confirms it. Typing
+ * a digit does nothing there, and the Enter that follows confirms the
+ * default: "No, exit". That is exactly how motif's restore was declined
+ * three times over — "1\r" on 2026-09-04, "2\r" on 2026-09-10 — and the
+ * session came back as a shell each time. So the answer is read off the
+ * screen: the number when the options are numbered, otherwise enough arrow
+ * presses to move the highlight onto the yes option, then Enter.
+ */
+function trustDialogAnswer(screenText, sessionCwd) {
+    const text = String(screenText || '');
+    const asked = trustDialogWorkspace(text);
+    const preapproval = /pre-?approves\s*\d+\s*tool\s*permissions|Only\s*proceed\s*if\s*you\s*trust\s*this\s*configuration/i.test(text);
+    const lines = text.split('\n');
+    const isYes = (l) => /Yes,?\s*(I\s*trust\s*this\s*folder|proceed)/i.test(l);
+    const isOption = (l) => isYes(l) || /No,?\s*exit/i.test(l);
+    const yesIdx = lines.findIndex(isYes);
+    let input = '1\r';
+    let how = 'option 1';
+    if (yesIdx >= 0) {
+        const numbered = /(?:^|\s)(\d+)\.\s*Yes/i.exec(lines[yesIdx]);
+        if (numbered) {
+            input = `${numbered[1]}\r`;
+            how = `option ${numbered[1]}`;
+        } else {
+            // Highlighted row → yes row, counting only option rows between.
+            const highlighted = lines.findIndex((l) => /[❯›>]\s*(Yes|No)/i.test(l));
+            const from = highlighted >= 0 ? highlighted : lines.findIndex(isOption);
+            const between = lines.slice(Math.min(from, yesIdx), Math.max(from, yesIdx)).filter(isOption).length;
+            const steps = from === yesIdx ? 0 : Math.max(0, between - (from < yesIdx ? 0 : 0));
+            const arrow = from < yesIdx ? '\x1b[B' : '\x1b[A';
+            input = arrow.repeat(from === yesIdx ? 0 : Math.max(1, steps)) + '\r';
+            how = from === yesIdx ? 'Enter on the highlighted yes' : `${from < yesIdx ? 'down' : 'up'} ×${Math.max(1, steps)} + Enter`;
+        }
+    }
+    const ours = asked ? samePath(asked, sessionCwd) : preapproval;
+    return { input, how, asked, preapproval, ours };
+}
+function samePath(a, b) {
+    const norm = (p) => {
+        let v = String(p || '').replace(/\/+$/, '');
+        try { v = fs.realpathSync(v); } catch (e) { /* keep as-is */ }
+        return v;
+    };
+    return !!a && !!b && norm(a) === norm(b);
+}
+
+module.exports = { trustDialogWorkspace, trustDialogAnswer, samePath };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hop2",
-  "version": "0.11.44",
+  "version": "0.11.46",
   "description": "🐰 Hop into your terminal from anywhere. Secure remote shell access with 2FA via Cloudflare Tunnel. Next-gen rewrite with native terminal sharing.",
   "main": "hop",
   "bin": {

package/tests/trust-dialog.unit.test.cjs

@@ -0,0 +1,45 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { trustDialogAnswer } = require('../lib/trust-dialog');
+
+const classic = `
+ Quick safety check
+ Accessing workspace: /Users/me/proj
+ Is this a project you created or one you trust?
+ ❯ 1. Yes, proceed
+   2. No, exit
+`;
+const preapproval = `
+ ⚠ This folder pre-approves 15 tool permissions in .claude/settings.json:
+ mcp__x__read, mcp__y__write, and 7 more
+ These will apply without asking. Only proceed if you trust this configuration.
+ ❯ No, exit
+   Yes, I trust this folder
+ Enter to confirm · Esc to cancel
+`;
+
+test('classic numbered dialog: type the number of the yes option, only for the session\'s own workspace', () => {
+    const ours = trustDialogAnswer(classic, '/Users/me/proj');
+    assert.equal(ours.input, '1\r');
+    assert.equal(ours.asked, '/Users/me/proj');
+    assert.equal(ours.ours, true);
+    assert.equal(trustDialogAnswer(classic, '/Users/me/elsewhere').ours, false);
+});
+
+test('pre-approval dialog is an arrow selector with "No, exit" highlighted: Down then Enter (the motif regression)', () => {
+    const a = trustDialogAnswer(preapproval, '/Users/me');
+    assert.equal(a.preapproval, true);
+    assert.equal(a.input, '\x1b[B\r');
+    assert.equal(a.asked, null);   // names no path: the folder is the launch directory
+    assert.equal(a.ours, true);
+});
+
+test('a selector already highlighting yes needs only Enter', () => {
+    const t = preapproval.replace('❯ No, exit', '  No, exit').replace('  Yes, I trust', '❯ Yes, I trust');
+    assert.equal(trustDialogAnswer(t, '/Users/me').input, '\r');
+});
+
+test('a numbered pre-approval layout takes its number', () => {
+    const t = preapproval.replace('❯ No, exit', '  1. No, exit').replace('  Yes, I trust', '❯ 2. Yes, I trust');
+    assert.equal(trustDialogAnswer(t, '/Users/me').input, '2\r');
+});