hop2 0.11.45 → 0.11.47

package/hay/apps/web/src/components/ViewsPanel.tsx

@@ -123,6 +123,27 @@ const formatBytes = (n?: number) => {
 const hrefFor = (item: ViewItem) =>
   item.kind === "server" && item.target ? item.target : item.path;
 
+// The stored file itself, as an attachment: the daemon's /download mode
+// serves the markdown an agent wrote rather than the page it renders into.
+// Only files — a server is live, there is nothing to save.
+const downloadHrefFor = (item: ViewItem) =>
+  item.kind === "server" ? null : item.path.replace(/\/inline$/, "") + "/download";
+
+// A hidden same-origin anchor with `download`: the row is already an <a>
+// (anchors cannot nest), and window.open would show the file, not save it.
+const triggerDownload = (item: ViewItem) => {
+  const href = downloadHrefFor(item);
+  if (!href) return;
+  const a = document.createElement("a");
+  a.href = href;
+  a.download = item.name;
+  a.rel = "noopener";
+  a.style.display = "none";
+  document.body.appendChild(a);
+  a.click();
+  a.remove();
+};
+
 const extOf = (name: string) => (name.split(".").pop() || "").toLowerCase();
 const isVideo = (name: string) => ["mp4", "mov", "webm", "m4v", "ogv"].includes(extOf(name));
 const isAudio = (name: string) => ["mp3", "m4a", "wav", "flac", "aac", "ogg", "oga", "opus"].includes(extOf(name));
@@ -427,10 +448,25 @@ export const ViewsPanel = ({ session, sessions = [], dock = false, onClose }: Pr
           <button type="button" className="views-act"
                   title="Open in a new tab" aria-label="Open in a new tab"
                   onClick={() => window.open(hrefFor(item), "_blank", "noopener")}>↗</button>
+          {!isServer && (
+            <button type="button" className="views-act"
+                    title="Download" aria-label={`Download ${item.name}`}
+                    onClick={() => triggerDownload(item)}>⤓</button>
+          )}
           <button type="button" className="views-act"
                   title={copied === item.path ? "Copied" : "Copy link"}
                   aria-label="Copy link"
                   onClick={() => copyLink(item)}>{copied === item.path ? "✓" : "⧉"}</button>
+          {!isServer && (
+            /* The FILE, not the page: ?download=1 serves the published bytes as
+               an attachment under their real name (md/csv/json raw, not the
+               rendered view). A window.open, not an anchor: anchors can't nest
+               in the row's own link, and the attachment header keeps the tab
+               from navigating. */
+            <button type="button" className="views-act"
+                    title="Download" aria-label="Download"
+                    onClick={() => window.open(item.path + "?download=1", "_blank", "noopener")}>⤓</button>
+          )}
           {!isServer && (
             <button type="button"
                     className={"views-act danger" + (armedDelete === item.path ? " armed" : "")}
@@ -484,6 +520,11 @@ export const ViewsPanel = ({ session, sessions = [], dock = false, onClose }: Pr
           {preview.title || preview.name}
         </span>
         <span className="views-head-spacer" />
+        {preview.kind !== "server" && (
+          <button type="button" className="views-act"
+                  title="Download" aria-label={`Download ${preview.name}`}
+                  onClick={() => triggerDownload(preview)}>⤓</button>
+        )}
         <button type="button" className="views-act"
                 title="Open in a new tab" aria-label="Open preview in a new tab"
                 onClick={() => window.open(hrefFor(preview), "_blank", "noopener")}>↗</button>

package/hay/apps/web/test/ViewsPanel.test.tsx

@@ -28,6 +28,31 @@ beforeEach(() => {
 afterEach(() => { cleanup(); vi.clearAllMocks(); vi.unstubAllGlobals(); });
 
 describe("ViewsPanel", () => {
+  it("Download saves the stored file itself through a same-origin anchor, in the list and in the preview", async () => {
+    // The row is an <a>, so the button clicks a hidden anchor of its own;
+    // capture what that anchor asked the browser to do.
+    const clicked: Array<{ href: string; download: string }> = [];
+    const origClick = HTMLAnchorElement.prototype.click;
+    HTMLAnchorElement.prototype.click = function (this: HTMLAnchorElement) {
+      clicked.push({ href: this.getAttribute("href") || "", download: this.download });
+    };
+    try {
+      render(<ViewsPanel onClose={() => {}} />);
+      await waitFor(() => expect(screen.getByText("Views end-to-end")).toBeTruthy());
+      fireEvent.click(screen.getByRole("button", { name: "Download agent-result.md" }));
+      expect(clicked).toEqual([{ href: "/view/Orion/agent-result.md/download", download: "agent-result.md" }]);
+      // Open the preview: its header offers the same download.
+      fireEvent.click(screen.getByText("Views end-to-end").closest("a") as HTMLAnchorElement);
+      const inPreview = screen.getAllByRole("button", { name: "Download agent-result.md" });
+      expect(inPreview.length).toBeGreaterThanOrEqual(2);
+      fireEvent.click(inPreview[inPreview.length - 1]);
+      expect(clicked.length).toBe(2);
+      expect(clicked[1].href).toBe("/view/Orion/agent-result.md/download");
+    } finally {
+      HTMLAnchorElement.prototype.click = origClick;
+    }
+  });
+
   it("a plain click previews IN PLACE; the row stays a real link for modified clicks", async () => {
     render(<ViewsPanel onClose={() => {}} />);
     await waitFor(() => expect(screen.getByText("Views end-to-end")).toBeTruthy());

package/hop

@@ -2650,21 +2650,8 @@ const CLAUDE_UI_RE = /bypass permissions on|shift\+tab to cycle|Welcome back|esc
 // sat at the dialog for two weeks (lightscope, Neptune). Whitespace-
 // tolerant because the grid text can run words together across wraps.
 const TRUST_PROMPT_RE = /Quick\s*safety\s*check|Yes,?\s*I\s*trust\s*this\s*folder|Is\s*this\s*a\s*project\s*you\s*created\s*or\s*one\s*you\s*trust/i;
-// The directory the dialog is asking about, so an answer is only ever given
-// for the workspace the session was launched in - never for wherever a
-// shell happened to wander.
-function trustDialogWorkspace(screenText) {
-    const m = /Accessing\s*workspace:?\s*(\/[^\s\u2502\u2500]+)/i.exec(String(screenText || ''));
-    return m ? m[1].replace(/\/+$/, '') : null;
-}
-function samePath(a, b) {
-    const norm = (p) => {
-        let v = String(p || '').replace(/\/+$/, '');
-        try { v = fs.realpathSync(v); } catch (e) { /* keep as-is */ }
-        return v;
-    };
-    return !!a && !!b && norm(a) === norm(b);
-}
+// Trust-dialog reading lives in lib/trust-dialog.js so it can be unit-tested.
+const { trustDialogWorkspace, trustDialogAnswer, samePath } = require('./lib/trust-dialog.js');
 function getResumeMode() {
     const mode = String(getHopConfig().resume_mode || '').toLowerCase();
     return mode === 'summary' || mode === 'ask' ? mode : 'full';
@@ -6109,7 +6096,34 @@ async function sweepRestoreReconcile() {
             // The screen and foreground name lie for argv-launched sessions.
             const procUp = claudeProcessRunning(exp.sessionId);
             const running = !isShellProcName(entry.foregroundProcess);
-            const claudeUp = procUp || running || CLAUDE_UI_RE.test(text);
+            const alive = procUp || running;
+            // A trust dialog is only a dialog while claude is up to show it.
+            // Checked BEFORE "converged": a live claude parked at the dialog
+            // used to be declared running and left there forever, while the
+            // dialog's text lingering on a dead session's screen — the
+            // process gone, a shell prompt under it — was "answered" every
+            // tick, typing digits into the shell (motif, 2026-09-10).
+            const settledMs = now - Math.max(exp.lastDriveAt || 0, exp.recordedAt || 0);
+            if (TRUST_PROMPT_RE.test(text) && alive && settledMs >= 6000) {
+                const trust = trustDialogAnswer(text, exp.cwd);
+                if (trust.ours) {
+                    if (!exp.trustAnsweredAt || now - exp.trustAnsweredAt > 20_000) {
+                        try {
+                            const e2 = await attachTerminalApiClient(name, exp.displayName, { actor: 'system', label: 'reconcile' });
+                            try { sendTerminalInput(e2, trust.input); } finally { try { closeTerminalApiEntry(e2.id); } catch (e) {} }
+                            exp.trustAnsweredAt = now;
+                            changed = true;
+                            log(`[reconcile] ${exp.displayName}: accepted ${trust.preapproval ? 'pre-approved permissions' : 'workspace trust'} (${trust.how})`, DIM);
+                        } catch (e) { /* try again next tick */ }
+                    }
+                    continue;
+                }
+                // Trust dialog for some OTHER directory — not ours to answer.
+                exp.status = 'needs-attention';
+                exp.reason = `claude is asking to trust ${trust.asked || 'a directory'}, not ${exp.cwd}`;
+                changed = true;
+                continue;
+            const claudeUp = alive || CLAUDE_UI_RE.test(text);
             if (claudeUp) {
                 exp.status = 'converged';
                 exp.convergedAt = now;
@@ -6117,23 +6131,6 @@ async function sweepRestoreReconcile() {
                 log(`[reconcile] ${exp.displayName}: verified running`, DIM);
                 continue;
             }
-            // A dialog: the resume sweep answers resume prompts already; the
-            // trust dialog we answer here (only for this session's own cwd).
-            if (TRUST_PROMPT_RE.test(text)) {
-                const asked = trustDialogWorkspace(text);
-                if (asked && samePath(asked, exp.cwd)) {
-                    try {
-                        const e2 = await attachTerminalApiClient(name, exp.displayName, { actor: 'system', label: 'reconcile' });
-                        try { sendTerminalInput(e2, '1\r'); } finally { try { closeTerminalApiEntry(e2.id); } catch (e) {} }
-                        log(`[reconcile] ${exp.displayName}: accepted workspace trust`, DIM);
-                    } catch (e) { /* try again next tick */ }
-                    continue;
-                }
-                // Trust dialog for some OTHER directory — not ours to answer.
-                exp.status = 'needs-attention';
-                exp.reason = `claude is asking to trust ${asked || 'a directory'}, not ${exp.cwd}`;
-                changed = true;
-                continue;
             }
             if (RESUME_PROMPT_RE.test(text)) continue; // resume sweep owns this
             // A busy non-shell foreground we did not recognise as claude: the
@@ -6560,18 +6557,32 @@ async function restoreSavedSessionsUnlocked({ dryRun = false, includeAgents = fa
                     const grid = await getRoomGridPreviewShared(job.plan.internalName);
                     screen = String(grid?.text || '');
                 } catch (e) { continue; }
-                if (TRUST_PROMPT_RE.test(screen) && !job.trustAnswered) {
+                // Only a LIVE dialog: the same text lingers on screen after
+                // claude has exited (or before the new one has drawn), and
+                // answering it then types into a shell or into a claude that
+                // has not asked yet.
+                // ...and only once the fresh claude has had time to DRAW it:
+                // the previous claude's dialog text is still on screen for the
+                // first seconds after launch, and an answer sent then reaches
+                // a claude that has not asked yet (the Enter lands on whatever
+                // it shows next — for this dialog, the default "No, exit").
+                const dialogLive = TRUST_PROMPT_RE.test(screen) && Date.now() - job.since >= 6000 && (() => {
+                    const recId = readClaudeSessionRecord(job.plan.internalName)?.sessionId;
+                    const fg = getRuntimeSessionMetadata(job.plan.internalName)?.foregroundProcess;
+                    return (!!recId && claudeProcessRunning(recId)) || (!!fg && !isShellProcName(fg));
+                })();
+                if (dialogLive && !job.trustAnswered) {
                     // Answer only for the workspace this session was launched
                     // in. A dialog naming any other directory is not ours to
                     // wave through - leave it on screen and say so.
-                    const asked = trustDialogWorkspace(screen);
-                    if (asked && samePath(asked, job.plan.cwd)) {
-                        try { sendTerminalInput(job.entry, '1\r'); } catch (e) { finish('write-failed'); continue; }
-                        log(`  ${getSessionDisplayName(job.plan.internalName) || job.plan.internalName}: accepted workspace trust for ${asked}`, DIM);
+                    const trust = trustDialogAnswer(screen, job.plan.cwd);
+                    if (trust.ours) {
+                        try { sendTerminalInput(job.entry, trust.input); } catch (e) { finish('write-failed'); continue; }
+                        log(`  ${getSessionDisplayName(job.plan.internalName) || job.plan.internalName}: accepted ${trust.preapproval ? 'pre-approved permissions' : `workspace trust for ${trust.asked}`} (${trust.how})`, DIM);
                         job.trustAnswered = true;
                         job.since = Date.now();
                     } else {
-                        log(`  ${getSessionDisplayName(job.plan.internalName) || job.plan.internalName}: claude is asking to trust ${asked || 'an unknown directory'}, not ${job.plan.cwd} — left for you to answer`, YELLOW);
+                        log(`  ${getSessionDisplayName(job.plan.internalName) || job.plan.internalName}: claude is asking to trust ${trust.asked || 'an unknown directory'}, not ${job.plan.cwd} — left for you to answer`, YELLOW);
                         finish('trust-prompt');
                     }
                     continue;
@@ -10782,8 +10793,12 @@ happens until someone clicks it.
         // file name. The legacy /assets/view/<s>/<f> form redirects here, so
         // an edge-cached response is at worst a redirect, never the bytes.
         const viewMatch = (req.method === 'GET' || req.method === 'HEAD')
-            && parsedUrl.pathname.match(/^\/view\/([^/]+)\/([^/]+?)(\/inline)?$/);
+            && parsedUrl.pathname.match(/^\/view\/([^/]+)\/([^/]+?)(\/inline|\/download)?$/);
         if (viewMatch) {
+            // /download: the stored file itself, as an attachment — the
+            // markdown an agent wrote rather than the page it renders into,
+            // the PDF rather than the viewer. Same bytes `hop view` copied in.
+            const wantDownload = viewMatch[3] === '/download';
             const viewRoot = path.resolve(VIEWS_DIR);
             const target = path.resolve(path.join(
                 viewRoot, decodeURIComponent(viewMatch[1]), decodeURIComponent(viewMatch[2])));
@@ -10794,11 +10809,31 @@ happens until someone clicks it.
                 return;
             }
             const viewExt = path.extname(target).toLowerCase();
+            // ?download=1 — the FILE, not the page: the bytes the agent
+            // published, under their real name, as an attachment. Rendered
+            // kinds (md/csv/json) come back raw here, not as the HTML the
+            // viewer shows (Jian: "I should be able to download a hop view
+            // item from the UI, right?").
+            if (parsedUrl.query.download === '1') {
+                const rawTypes = { '.md': 'text/markdown; charset=utf-8', '.markdown': 'text/markdown; charset=utf-8',
+                                   '.csv': 'text/csv; charset=utf-8', '.tsv': 'text/tab-separated-values; charset=utf-8',
+                                   '.json': 'application/json; charset=utf-8', '.txt': 'text/plain; charset=utf-8' };
+                const dlName = path.basename(target).replace(/["\r\n]/g, '_');
+                res.writeHead(200, {
+                    'Content-Type': rawTypes[viewExt] || STATIC_CONTENT_TYPES[viewExt] || 'application/octet-stream',
+                    'Content-Length': fs.statSync(target).size,
+                    'Content-Disposition': `attachment; filename="${dlName}"; filename*=UTF-8''${encodeURIComponent(dlName)}`,
+                    'Cache-Control': 'no-store'
+                });
+                if (req.method === 'HEAD') { res.end(); return; }
+                fs.createReadStream(target).pipe(res);
+                return;
+            }
             // Markdown is rendered, not dumped: an agent's write-up is a
             // RESULT, and handing over a wall of raw asterisks is the "just
             // text" outcome this feature exists to avoid. The stored file
             // stays the markdown the agent wrote.
-            if (VIEW_RENDERED.has(viewExt)) {
+            if (VIEW_RENDERED.has(viewExt) && !wantDownload) {
                 const sess = decodeURIComponent(viewMatch[1]);
                 const file = decodeURIComponent(viewMatch[2]);
                 const caption = readViewMeta(sess)[file]?.title || file;
@@ -10856,7 +10891,15 @@ happens until someone clicks it.
                 fs.createReadStream(target, { start, end }).pipe(res);
                 return;
             }
+            // RFC 6266: an ASCII fallback plus the UTF-8 form for names with
+            // anything else in them.
+            const downloadName = path.basename(target);
+            const asciiName = downloadName.replace(/[^\x20-\x7e]/g, '_').replace(/["\\]/g, '_');
+            const disposition = wantDownload
+                ? { 'Content-Disposition': `attachment; filename="${asciiName}"; filename*=UTF-8''${encodeURIComponent(downloadName)}` }
+                : {};
             res.writeHead(200, {
+                ...disposition,
                 'Content-Type': viewType,
                 'Content-Length': viewSize,
                 'Accept-Ranges': 'bytes'
@@ -15362,7 +15405,7 @@ async function attachToAllSessions(existingTunnel) {
 const KNOWN_COMMANDS = [
     'client', 'start', 'attach', 'local', 'stop', 'status', 'doctor', 'logs',
     'help', 'config', 'url', 'qr', 'health', 'domain', 'domain-clear',
-    'password', 'user', 'workspace', 'session', 'wipe', 'restore', 'update', 'resume-waiting', 'claude-hook', 'codex-notify', 'codex-hook', 'claude-skill', 'agent-skill', 'math', 'view', 'port', 'notify', 'whoami', 'new',
+    'password', 'user', 'workspace', 'session', 'wipe', 'restore', 'recover', 'update', 'resume-waiting', 'claude-hook', 'codex-notify', 'codex-hook', 'claude-skill', 'agent-skill', 'math', 'view', 'port', 'notify', 'whoami', 'new',
     'mail', 'registration', 'canonical'
 ];
 
@@ -15485,6 +15528,7 @@ const HELP_SECTIONS = [
     ] },
     { title: 'Restore', lines: [
         `hop restore [--dry-run] [--agents]  Recreate your saved sessions, resuming claude conversations (--agents includes agent-created ones)`,
+        `hop recover [<session>]     Bring back the agent that last ran here: inside a session, relaunch its conversation in this terminal`,
         `hop restore <name>...     Redo just those sessions — even live ones, if they hold only an idle shell or a startup dialog`,
         `hop restore --health      Show sessions the reconciler could not bring back on its own, and why`,
         `hop update [--check|--no-host] Self-update from GitHub (daemon + host restart, host waits for the fleet to go idle; --no-host skips the host cycle)`,
@@ -16096,6 +16140,61 @@ async function main() {
     // Handle `hop resume-waiting` — answer claude's resume question for any
     // session currently parked on it (sessions restored before this existed,
     // or restored with resume_mode=ask and since reconsidered).
+    // hop recover [<session>] — bring back the agent that last ran in a
+    // session. Inside a session with no argument, it relaunches that
+    // session's own conversation IN THIS TERMINAL (the same flag-preserving
+    // command `hop restore` would use), so a claude that exited — crash,
+    // /exit, a wrong answer to a dialog — is one command away, and any
+    // dialog it shows is answered by the human sitting there. Named from
+    // anywhere, it is `hop restore <name>`.
+    if (process.argv[2] === 'recover') {
+        const args = process.argv.slice(3);
+        const dryRun = args.includes('--dry-run') || args.includes('-n');
+        const named = args.find((a) => !a.startsWith('-')) || null;
+        const here = process.env.HOP_SESSION || null;
+        if (!named && !here) {
+            log(`Run ${CYAN}hop recover${RESET} inside a hop session, or name one: ${CYAN}hop recover <session>${RESET}`, YELLOW);
+            process.exit(1);
+        }
+        const target = named ? (resolveSessionInternalName(named, named) || named) : here;
+        if (target !== here) {
+            // Not this terminal: the daemon relaunches it in its own room.
+            const child = spawn(process.execPath, [__filename, 'restore', ...(dryRun ? ['--dry-run'] : []), named], { stdio: 'inherit' });
+            child.on('exit', (code) => process.exit(code ?? 1));
+            return;
+        }
+        const display = getSessionDisplayName(target) || target;
+        const meta = readClaudeSessionMeta(target);
+        const cfg = getSessionConfig(target);
+        const cwd = meta?.cwd || cfg?.cwd || process.cwd();
+        const rec = readClaudeSessionRecord(target);
+        if (rec?.sessionId && claudeProcessRunning(rec.sessionId)) {
+            log(`${display}: its claude conversation ${String(rec.sessionId).slice(0, 8)}… is already running in this session.`, YELLOW);
+            process.exit(1);
+        }
+        const plan = restorePlanForSession({ internalName: target, cwd, startup: cfg?.startup, autoStart: cfg?.autoStart });
+        let command = plan?.command || null;
+        let kind = command ? 'claude' : null;
+        if (!command) {
+            // No claude record: a codex conversation is found by its rollout.
+            const rollout = resolveCodexTranscriptByCwd(cwd);
+            const rolloutId = rollout ? await trajectoryExtract.codexRolloutId(rollout) : null;
+            if (rolloutId) {
+                command = `codex resume '${rolloutId.replace(/'/g, `'\\''`)}'`;
+                kind = 'codex';
+            }
+        }
+        if (!command) {
+            log(`${display}: nothing to recover — no claude or codex conversation is recorded for this session${plan?.warning ? ` (${plan.warning})` : ''}.`, YELLOW);
+            process.exit(1);
+        }
+        log(`${dryRun ? 'Would recover' : 'Recovering'} ${BOLD}${display}${RESET} (${kind}) in this terminal:`, RESET);
+        log(`  ${DIM}${command}${RESET}`, RESET);
+        if (dryRun) process.exit(0);
+        const child = spawn('/bin/zsh', ['-lc', command], { stdio: 'inherit', cwd: plan?.cwd || cwd, env: process.env });
+        child.on('exit', (code, signal) => process.exit(signal ? 1 : (code ?? 0)));
+        return;
+    }
     if (process.argv[2] === 'resume-waiting') {
         const state = isServerRunning();
         if (!state) { printNotRunningError(); process.exit(1); }
@@ -16258,7 +16357,7 @@ async function main() {
             log(`${na.length} session(s) need your attention:`, YELLOW);
             for (const it of na) {
                 log(`  ${YELLOW}⚠${RESET} ${it.name}  ${DIM}${it.reason}${RESET}`, RESET);
-                log(`      ${DIM}redo: ${CYAN}hop restore ${it.name}${RESET}`, RESET);
+                log(`      ${DIM}redo: ${CYAN}hop restore ${it.name}${RESET}${DIM}, or inside it: ${CYAN}hop recover${RESET}`, RESET);
             }
             process.exit(0);
         }

package/lib/trust-dialog.js

@@ -0,0 +1,65 @@
+'use strict';
+const fs = require('fs');
+
+// The directory the dialog is asking about, so an answer is only ever given
+// for the workspace the session was launched in - never for wherever a
+// shell happened to wander.
+function trustDialogWorkspace(screenText) {
+    const m = /Accessing\s*workspace:?\s*(\/[^\s\u2502\u2500]+)/i.exec(String(screenText || ''));
+    return m ? m[1].replace(/\/+$/, '') : null;
+}
+/**
+ * What a trust dialog on screen is asking, and the exact keys that say yes.
+ *
+ * Two variants exist. The classic one names the workspace ("Accessing
+ * workspace: /path") and numbers its options ("1. Yes, proceed / 2. No,
+ * exit"): typing the number answers it. The other appears when the folder's
+ * .claude/settings.json pre-approves tool permissions: it names no path (the
+ * folder IS the launch directory), lists "No, exit" FIRST, and is an ARROW
+ * SELECTOR — a ❯ marks the highlighted option and Enter confirms it. Typing
+ * a digit does nothing there, and the Enter that follows confirms the
+ * default: "No, exit". That is exactly how motif's restore was declined
+ * three times over — "1\r" on 2026-09-04, "2\r" on 2026-09-10 — and the
+ * session came back as a shell each time. So the answer is read off the
+ * screen: the number when the options are numbered, otherwise enough arrow
+ * presses to move the highlight onto the yes option, then Enter.
+ */
+function trustDialogAnswer(screenText, sessionCwd) {
+    const text = String(screenText || '');
+    const asked = trustDialogWorkspace(text);
+    const preapproval = /pre-?approves\s*\d+\s*tool\s*permissions|Only\s*proceed\s*if\s*you\s*trust\s*this\s*configuration/i.test(text);
+    const lines = text.split('\n');
+    const isYes = (l) => /Yes,?\s*(I\s*trust\s*this\s*folder|proceed)/i.test(l);
+    const isOption = (l) => isYes(l) || /No,?\s*exit/i.test(l);
+    const yesIdx = lines.findIndex(isYes);
+    let input = '1\r';
+    let how = 'option 1';
+    if (yesIdx >= 0) {
+        const numbered = /(?:^|\s)(\d+)\.\s*Yes/i.exec(lines[yesIdx]);
+        if (numbered) {
+            input = `${numbered[1]}\r`;
+            how = `option ${numbered[1]}`;
+        } else {
+            // Highlighted row → yes row, counting only option rows between.
+            const highlighted = lines.findIndex((l) => /[❯›>]\s*(Yes|No)/i.test(l));
+            const from = highlighted >= 0 ? highlighted : lines.findIndex(isOption);
+            const between = lines.slice(Math.min(from, yesIdx), Math.max(from, yesIdx)).filter(isOption).length;
+            const steps = from === yesIdx ? 0 : Math.max(0, between - (from < yesIdx ? 0 : 0));
+            const arrow = from < yesIdx ? '\x1b[B' : '\x1b[A';
+            input = arrow.repeat(from === yesIdx ? 0 : Math.max(1, steps)) + '\r';
+            how = from === yesIdx ? 'Enter on the highlighted yes' : `${from < yesIdx ? 'down' : 'up'} ×${Math.max(1, steps)} + Enter`;
+        }
+    }
+    const ours = asked ? samePath(asked, sessionCwd) : preapproval;
+    return { input, how, asked, preapproval, ours };
+}
+function samePath(a, b) {
+    const norm = (p) => {
+        let v = String(p || '').replace(/\/+$/, '');
+        try { v = fs.realpathSync(v); } catch (e) { /* keep as-is */ }
+        return v;
+    };
+    return !!a && !!b && norm(a) === norm(b);
+}
+
+module.exports = { trustDialogWorkspace, trustDialogAnswer, samePath };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hop2",
-  "version": "0.11.45",
+  "version": "0.11.47",
   "description": "🐰 Hop into your terminal from anywhere. Secure remote shell access with 2FA via Cloudflare Tunnel. Next-gen rewrite with native terminal sharing.",
   "main": "hop",
   "bin": {

package/tests/trust-dialog.unit.test.cjs

@@ -0,0 +1,45 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { trustDialogAnswer } = require('../lib/trust-dialog');
+
+const classic = `
+ Quick safety check
+ Accessing workspace: /Users/me/proj
+ Is this a project you created or one you trust?
+ ❯ 1. Yes, proceed
+   2. No, exit
+`;
+const preapproval = `
+ ⚠ This folder pre-approves 15 tool permissions in .claude/settings.json:
+ mcp__x__read, mcp__y__write, and 7 more
+ These will apply without asking. Only proceed if you trust this configuration.
+ ❯ No, exit
+   Yes, I trust this folder
+ Enter to confirm · Esc to cancel
+`;
+
+test('classic numbered dialog: type the number of the yes option, only for the session\'s own workspace', () => {
+    const ours = trustDialogAnswer(classic, '/Users/me/proj');
+    assert.equal(ours.input, '1\r');
+    assert.equal(ours.asked, '/Users/me/proj');
+    assert.equal(ours.ours, true);
+    assert.equal(trustDialogAnswer(classic, '/Users/me/elsewhere').ours, false);
+});
+
+test('pre-approval dialog is an arrow selector with "No, exit" highlighted: Down then Enter (the motif regression)', () => {
+    const a = trustDialogAnswer(preapproval, '/Users/me');
+    assert.equal(a.preapproval, true);
+    assert.equal(a.input, '\x1b[B\r');
+    assert.equal(a.asked, null);   // names no path: the folder is the launch directory
+    assert.equal(a.ours, true);
+});
+
+test('a selector already highlighting yes needs only Enter', () => {
+    const t = preapproval.replace('❯ No, exit', '  No, exit').replace('  Yes, I trust', '❯ Yes, I trust');
+    assert.equal(trustDialogAnswer(t, '/Users/me').input, '\r');
+});
+
+test('a numbered pre-approval layout takes its number', () => {
+    const t = preapproval.replace('❯ No, exit', '  1. No, exit').replace('  Yes, I trust', '❯ 2. Yes, I trust');
+    assert.equal(trustDialogAnswer(t, '/Users/me').input, '2\r');
+});