hop2 0.11.63 → 0.11.65

package/hay/apps/web/src/utils/switcherModel.ts

@@ -35,6 +35,9 @@ export type SwitcherSession = {
   foregroundProcess?: string;
   /** What the session runs, by its hooks' records: claude, codex, or nothing known. */
   agent?: "claude" | "codex" | null;
+  /** Server-decided: a turn in flight / the last turn finished; turnSeen = a human opened it since. */
+  agentPhase?: "working" | "done" | null;
+  turnSeen?: boolean;
   agentPermitted?: boolean;
   cols?: number;
   rows?: number;

package/hay/apps/web/src/utils/voiceHold.ts

@@ -49,9 +49,26 @@ export type VoiceHoldOptions = {
   thresholdMs?: number;
 };
 
+// A ring of what the controller saw and did — key events with their
+// verdicts, recogniser lifecycle, why a hold ended. Read from the console
+// (window.__hopVoiceTrace) or shipped with the client diagnostics, so a
+// "dictation stopped and spaces started typing" report can be replayed
+// instead of guessed at.
+const TRACE_MAX = 240;
+export const voiceTrace: string[] = [];
+const trace = (line: string) => {
+  voiceTrace.push(`${new Date().toISOString().slice(11, 23)} ${line}`);
+  if (voiceTrace.length > TRACE_MAX) voiceTrace.splice(0, voiceTrace.length - TRACE_MAX);
+};
+if (typeof window !== "undefined") (window as unknown as { __hopVoiceTrace?: string[] }).__hopVoiceTrace = voiceTrace;
+
 export const createVoiceHold = (opts: VoiceHoldOptions) => {
   const threshold = opts.thresholdMs ?? 550;
   const MAX_HOLD_MS = 60000;
+  // A recogniser that ends this soon after starting, having heard nothing,
+  // was refused (no mic, no service), not silent: Chrome's own silence
+  // timeout is several seconds. Only refusals count toward giving up.
+  const REFUSED_MS = 1500;
   let timer = 0;
   let watchdog = 0;
   let active = false;
@@ -66,8 +83,9 @@ export const createVoiceHold = (opts: VoiceHoldOptions) => {
   /** Consecutive recogniser restarts that produced nothing — a loop guard. */
   let emptyRestarts = 0;
 
-  const finish = (sendText: boolean) => {
+  const finish = (sendText: boolean, why = "") => {
     if (!active) return;
+    trace(`finish send=${sendText} why=${why} final=${JSON.stringify(finalText.slice(-40))} interim=${JSON.stringify(interimText.slice(-40))}`);
     active = false;
     pending = false;
     stopping = false;
@@ -91,7 +109,8 @@ export const createVoiceHold = (opts: VoiceHoldOptions) => {
     const Ctor = speechRecognitionCtor();
     // Silence here read as "voice randomly does nothing": the space vanished
     // (or didn't) and no overlay ever appeared, with no reason given.
-    if (!Ctor) { opts.notify("Voice input is not supported in this browser"); return; }
+    if (!Ctor) { trace("start: no recogniser"); opts.notify("Voice input is not supported in this browser"); return; }
+    trace(`start spacesTyped=${spacesTyped}`);
     active = true;
     stopping = false;
     emptyRestarts = 0;
@@ -103,7 +122,7 @@ export const createVoiceHold = (opts: VoiceHoldOptions) => {
     armWatchdog();
     window.addEventListener("blur", onWindowBlur);
     opts.setOverlay("");
-    if (!listen(Ctor)) { opts.notify("Voice input could not start"); finish(false); }
+    if (!listen(Ctor)) { opts.notify("Voice input could not start"); finish(false, "listen-failed"); }
   };
 
   // One recogniser session. The hold outlives it: browser recognisers end
@@ -117,6 +136,7 @@ export const createVoiceHold = (opts: VoiceHoldOptions) => {
     let r: RecognitionLike;
     try { r = new Ctor(); } catch { return false; }
     let heard = false;
+    const startedAt = Date.now();
     r.lang = navigator.language || "en-US";
     r.continuous = true;
     r.interimResults = true;
@@ -133,21 +153,35 @@ export const createVoiceHold = (opts: VoiceHoldOptions) => {
       opts.setOverlay((finalText + interim).trim());
     };
     const ended = () => {
+      const age = Date.now() - startedAt;
+      trace(`rec end heard=${heard} age=${age}ms stopping=${stopping} current=${rec === r}`);
       if (!active || rec !== r) return;      // an old recogniser, or already finished
-      if (stopping) { finish(true); return; } // released: type what we have
+      if (stopping) { finish(true, "released"); return; } // released: type what we have
       // A finished phrase is folded in; the interim is gone with the session.
       interimText = "";
-      // Three recognisers in a row that heard nothing is the service refusing
-      // us, not silence — give the space bar back rather than spin forever.
-      if (!heard && ++emptyRestarts >= 3) { finish(true); return; }
+      // Silence is not a reason to stop: Space is still down, and the hold
+      // ending on its own is exactly what "dictation just cut out and then
+      // spaces typed" looks like from the chair. Only a recogniser that is
+      // REFUSING us — ending at once, three times, having heard nothing —
+      // gives the space bar back rather than spin forever.
+      if (!heard && age < REFUSED_MS) {
+        if (++emptyRestarts >= 3) { finish(true, "refused"); return; }
+      } else {
+        emptyRestarts = 0;
+      }
       opts.setOverlay(finalText.trim());
-      if (!listen(Ctor)) finish(true);
+      if (!listen(Ctor)) finish(true, "restart-failed");
     };
     r.onerror = (ev) => {
       const code = ev?.error || "unknown";
+      trace(`rec error ${code} stopping=${stopping} current=${rec === r}`);
+      // Our own stop() is finishing this hold with the words it has; an
+      // error the recogniser raises on the way out ("aborted") must not
+      // finish it again WITHOUT them.
+      if (stopping || rec !== r) return;
       // Quiet or interrupted while still held: not a failure, just this
       // recogniser's session ending — the onend that follows restarts it.
-      if (active && !stopping && (code === "no-speech" || code === "aborted")) return;
+      if (active && (code === "no-speech" || code === "aborted")) return;
       // EVERY real failure explains itself. Only mic-denial was surfaced
       // before; Chrome's cloud recogniser routinely fails with "network",
       // and that silent death read as "voice randomly doesn't work".
@@ -160,7 +194,7 @@ export const createVoiceHold = (opts: VoiceHoldOptions) => {
       } else if (code !== "aborted") {
         opts.notify(`Voice input failed: ${code}`);
       }
-      finish(false);
+      finish(false, `error:${code}`);
     };
     r.onend = ended;
     rec = r;
@@ -170,6 +204,7 @@ export const createVoiceHold = (opts: VoiceHoldOptions) => {
 
   const stop = () => {
     const r = rec;
+    trace("stop");
     stopping = true;
     try { r?.stop(); } catch { /* already gone */ }
     rec = null;
@@ -179,7 +214,7 @@ export const createVoiceHold = (opts: VoiceHoldOptions) => {
     // true — and since every space is deliberately eaten while active, that
     // is a terminal that cannot type a space AT ALL. onend arriving later is
     // harmless; finish() is a no-op once inactive.
-    finish(true);
+    finish(true, "stop");
   };
 
   // Last line of defence. Nothing should hold the microphone for a minute,
@@ -223,8 +258,10 @@ export const createVoiceHold = (opts: VoiceHoldOptions) => {
     }
     // A keypress carries no `code` in some engines; fall back to the key.
     const isSpace = ev.code === "Space" || (ev.type === "keypress" && ev.key === " ");
-    if (isSpace && !ev.metaKey && !ev.ctrlKey && !ev.altKey && !ev.shiftKey
-        && !!speechRecognitionCtor() && (active || pending || opts.eligible())) {
+    if (isSpace && !ev.metaKey && !ev.ctrlKey && !ev.altKey && !ev.shiftKey) {
+      const eligible = active || pending || opts.eligible();
+      trace(`space ${ev.type}${ev.repeat ? " repeat" : ""} active=${active} pending=${pending} eligible=${eligible}`);
+      if (!speechRecognitionCtor() || !eligible) return undefined;
       if (ev.type === "keydown") {
         if (active) {
           // A genuine auto-repeat is the only thing that may be eaten while

package/hay/apps/web/test/agentPhase.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, it } from "vitest";
+import { cardPhase, phaseLabel } from "../src/utils/agentPhase";
+
+describe("cardPhase — the wall's three agent colours come from the daemon's verdict", () => {
+  it("working while a turn is in flight", () => {
+    expect(cardPhase({ agentPhase: "working", turnSeen: true })).toBe("working");
+  });
+  it("done and unread until a human has opened it since the turn ended", () => {
+    expect(cardPhase({ agentPhase: "done", turnSeen: false })).toBe("done-unread");
+    expect(cardPhase({ agentPhase: "done", turnSeen: true })).toBe("done-read");
+  });
+  it("nothing for a plain shell or an agent that has not finished a turn", () => {
+    expect(cardPhase({ agentPhase: null })).toBe(null);
+    expect(cardPhase({})).toBe(null);
+  });
+  it("labels", () => {
+    expect(phaseLabel("working")).toBe("WORKING");
+    expect(phaseLabel("done-unread")).toBe("DONE");
+    expect(phaseLabel("done-read")).toBe("READ");
+    expect(phaseLabel(null)).toBe("");
+  });
+});

package/hay/apps/web/test/dragSelect.test.ts

@@ -0,0 +1,87 @@
+import { describe, expect, it } from "vitest";
+import { installDragSelect, shouldSelectLocally, type TrackingTerminal } from "../src/utils/dragSelect";
+
+const fakeTerminal = (mode: string, protocol: string) => {
+  const mouse = { activeProtocol: protocol };
+  const subs = new Set<() => void>();
+  const t = {
+    modes: { mouseTrackingMode: mode },
+    _core: { coreMouseService: mouse },
+    mouse,
+    selected: false,
+    hasSelection: () => t.selected,
+    onSelectionChange: (cb: () => void) => { subs.add(cb); return { dispose: () => subs.delete(cb) }; },
+    setSelected: (v: boolean) => { t.selected = v; for (const cb of subs) cb(); }
+  };
+  return t as TrackingTerminal & typeof t;
+};
+
+describe("shouldSelectLocally — a plain drag on an agent surface selects, tracking or not", () => {
+  const base = { button: 0, metaKey: false, ctrlKey: false, trackingMode: "drag", agentSurface: true };
+  it("yes for a plain left press while Claude/Codex track the mouse", () => {
+    expect(shouldSelectLocally(base)).toBe(true);
+  });
+  it("no when the app is not an agent (vim, htop, tmux keep their drags)", () => {
+    expect(shouldSelectLocally({ ...base, agentSurface: false })).toBe(false);
+  });
+  it("no when tracking is already off (xterm selects by itself), or for right/ctrl/cmd presses", () => {
+    expect(shouldSelectLocally({ ...base, trackingMode: "none" })).toBe(false);
+    expect(shouldSelectLocally({ ...base, button: 2 })).toBe(false);
+    expect(shouldSelectLocally({ ...base, ctrlKey: true })).toBe(false);
+    expect(shouldSelectLocally({ ...base, metaKey: true })).toBe(false);
+  });
+});
+
+describe("installDragSelect — tracking pauses for the drag and stays paused while the selection stands", () => {
+  const press = (el: HTMLElement) => el.dispatchEvent(new MouseEvent("mousedown", { button: 0, bubbles: true }));
+  const release = () => window.dispatchEvent(new MouseEvent("mouseup", { button: 0, bubbles: true }));
+  it("a drag that selected nothing hands the mouse back on release", () => {
+    const t = fakeTerminal("drag", "DRAG");
+    const el = document.createElement("div"); document.body.appendChild(el);
+    const off = installDragSelect(t, el, () => true);
+    press(el);
+    expect(t.mouse.activeProtocol).toBe("NONE");
+    release();
+    expect(t.mouse.activeProtocol).toBe("DRAG");
+    off();
+  });
+  it("a drag that selected text keeps tracking off until the selection clears — so ⌘C still has it", () => {
+    const t = fakeTerminal("drag", "DRAG");
+    const el = document.createElement("div"); document.body.appendChild(el);
+    const off = installDragSelect(t, el, () => true);
+    press(el); t.setSelected(true); release();
+    expect(t.mouse.activeProtocol).toBe("NONE");
+    // A second selecting press replaces the selection, still paused.
+    press(el); t.setSelected(true); release();
+    expect(t.mouse.activeProtocol).toBe("NONE");
+    // A keypress clears the selection (xterm does this): tracking returns.
+    t.setSelected(false);
+    expect(t.mouse.activeProtocol).toBe("DRAG");
+    off();
+  });
+  it("leaves a non-agent surface alone, and respects the app turning tracking off mid-drag", () => {
+    const t = fakeTerminal("drag", "DRAG");
+    const el = document.createElement("div"); document.body.appendChild(el);
+    let agent = false;
+    const off = installDragSelect(t, el, () => agent);
+    press(el);
+    expect(t.mouse.activeProtocol).toBe("DRAG");
+    release();
+    agent = true;
+    press(el);
+    expect(t.mouse.activeProtocol).toBe("NONE");
+    t.mouse.activeProtocol = "ANY"; // the app changed its mind during the drag
+    release();
+    expect(t.mouse.activeProtocol).toBe("ANY");
+    off();
+  });
+  it("a right or ctrl press while paused hands the mouse back first", () => {
+    const t = fakeTerminal("drag", "DRAG");
+    const el = document.createElement("div"); document.body.appendChild(el);
+    const off = installDragSelect(t, el, () => true);
+    press(el); t.setSelected(true); release();
+    el.dispatchEvent(new MouseEvent("mousedown", { button: 2, bubbles: true }));
+    expect(t.mouse.activeProtocol).toBe("DRAG");
+    off();
+  });
+});

package/hay/apps/web/test/sizeClaim.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { claimOnAttach, claimOnClick, isPlainClick } from "../src/utils/sizeClaim";
+import { claimOnAttach, claimOnClick, claimOnTileFocus, isPlainClick, sizeIsForeign } from "../src/utils/sizeClaim";
 
 describe("claimOnAttach — only a deliberate open takes the size", () => {
   const base = { viewMode: "fit" as const, visible: true, deliberate: true };
@@ -40,3 +40,26 @@ describe("isPlainClick — the release of a drag is not a click", () => {
     expect(isPlainClick({ x: 100, y: 100 }, { x: 100, y: 100 }, true)).toBe(false);
   });
 });
+
+describe("claimOnTileFocus — a tile you engaged fits itself, a tile the wall pre-focused does not", () => {
+  const natural = { cols: 90, rows: 28 };
+  it("claims when a click lands on a tile wearing a full-screen size", () => {
+    expect(claimOnTileFocus({ deliberate: true, natural, current: { cols: 180, rows: 48 } })).toBe(true);
+  });
+  it("stays quiet when the session already fits, within rounding", () => {
+    expect(claimOnTileFocus({ deliberate: true, natural, current: { cols: 88, rows: 30 } })).toBe(false);
+    expect(claimOnTileFocus({ deliberate: true, natural, current: natural })).toBe(false);
+  });
+  it("never claims for the wall's own pre-focus of the current session", () => {
+    expect(claimOnTileFocus({ deliberate: false, natural, current: { cols: 180, rows: 48 } })).toBe(false);
+  });
+  it("needs a measurable tile and refuses a degenerate fit", () => {
+    expect(claimOnTileFocus({ deliberate: true, natural: null, current: { cols: 180, rows: 48 } })).toBe(false);
+    expect(claimOnTileFocus({ deliberate: true, natural: { cols: 12, rows: 3 }, current: { cols: 180, rows: 48 } })).toBe(false);
+  });
+  it("sizeIsForeign is the same tolerance the ⤢ badge uses", () => {
+    expect(sizeIsForeign({ cols: 93, rows: 30 }, natural)).toBe(false);
+    expect(sizeIsForeign({ cols: 120, rows: 28 }, natural)).toBe(true);
+    expect(sizeIsForeign({ cols: 90, rows: 40 }, natural)).toBe(true);
+  });
+});

package/hay/apps/web/test/voiceHold.test.ts

@@ -261,7 +261,7 @@ describe("hold-space dictation", () => {
     expect(FakeRecognition.last).not.toBe(first);
   });
 
-  it("gives the space bar back when recognisers keep ending without hearing anything", () => {
+  it("gives the space bar back when recognisers REFUSE — ending at once, three times, hearing nothing", () => {
     const hold = makeHold();
     hold.handleKey(keydown());
     vi.advanceTimersByTime(500);
@@ -273,6 +273,36 @@ describe("hold-space dictation", () => {
     expect(overlays[overlays.length - 1]).toBe(null);
   });
 
+  it("silence never ends a hold that is still held — sessions timing out are replaced for as long as Space is down", () => {
+    const hold = makeHold();
+    hold.handleKey(keydown());
+    vi.advanceTimersByTime(500);
+    // Chrome's no-speech comes after seconds of silence, session after session.
+    for (let i = 0; i < 6; i++) {
+      vi.advanceTimersByTime(8000);
+      FakeRecognition.last!.onerror?.({ error: "no-speech" });
+      FakeRecognition.last!.onend?.();
+      expect(hold.isActive()).toBe(true);
+      expect(overlays[overlays.length - 1]).not.toBe(null);
+    }
+    // Still held, still listening: an auto-repeat is eaten, not typed.
+    expect(pressSpace(hold, { repeat: true }).typed).toBe(false);
+    hold.handleKey(keyup());
+    expect(hold.isActive()).toBe(false);
+  });
+
+  it("an 'aborted' error raised while we are stopping does not throw the words away", () => {
+    const hold = makeHold();
+    hold.handleKey(keydown());
+    vi.advanceTimersByTime(500);
+    FakeRecognition.last!.onresult?.({ resultIndex: 0, results: [Object.assign([{ transcript: "keep this" }], { isFinal: true })] } as never);
+    const r = FakeRecognition.last!;
+    hold.handleKey(keyup());          // stop(): finishes with the words
+    r.onerror?.({ error: "aborted" }); // the recogniser objecting on its way out
+    r.onend?.();
+    expect(sent.filter((d) => d !== "\x7f")).toEqual(["keep this"]);
+  });
+
   it("a recogniser that never ends cannot kill the space bar", () => {
     // The regression that bit Jian: dictation started, the recogniser never
     // fired onend, `active` stuck true — and because every space is eaten

package/hop

@@ -18,6 +18,9 @@ const WebSocket = require('ws');
 const { resolveActorFromHeaders, canActorAccessSession } = require('./lib/terminal-access');
 const { generateSessionName, getThemeChoices, isValidTheme, DEFAULT_THEME } = require('./lib/naming-themes');
 const { AuthSessionStore, isSessionToken: isAuthSessionToken } = require('./lib/auth-sessions');
+const { agentPhase, screenSaysWorking } = require('./lib/agent-phase');
+const { snapshotFromMetas, planRefiles, pruneList, snapshotFileName } = require('./lib/identity-snapshot');
+const { withCodexIdentity } = require('./lib/codex-identity');
 const { rotateAuditFile, sweepStaleAuditDirs } = require('./lib/audit-rotation');
 const {
     createFailureTracker,
@@ -5357,6 +5360,65 @@ function readTurnAt(internalName) {
         return Number.isFinite(at) ? at : 0;
     } catch (e) { return 0; }
 }
+// When the agent's current turn BEGAN (Claude's UserPromptSubmit hook; Codex
+// has no equivalent, so 0 there). Paired with readTurnAt by agentPhase().
+function readPromptAt(internalName) {
+    try {
+        const at = Date.parse(JSON.parse(fs.readFileSync(
+            path.join(CLAUDE_SESSIONS_DIR, `${internalName}.prompt`), 'utf8')).at);
+        return Number.isFinite(at) ? at : 0;
+    } catch (e) { return 0; }
+}
+// The wall's three agent colours, decided here so the web and the phone
+// agree: working / done-unread / done-read. Plain shells get null.
+function agentPhaseFields(s, screenWorking = null) {
+    if (!s.agent) return { agentPhase: null, turnSeen: true, turnAt: null };
+    const turnAt = readTurnAt(s.internalName);
+    const r = agentPhase({
+        agent: s.agent,
+        turnAt,
+        promptAt: readPromptAt(s.internalName),
+        lastActivityAt: Number(s.lastActivityAt) || 0,
+        lastUserSeenAt: Number(s.lastUserSeenAt) || 0,
+        userAttached: s.userAttached === true,
+        screenWorking
+    });
+    return { agentPhase: r.phase, turnSeen: r.turnSeen, turnAt: turnAt || null };
+}
+// The screen's own word on whether a turn is running ("esc to interrupt" in
+// both TUIs), read from the host's live grid. Asked only for the sessions
+// the timing rules call working — the small set that can be wrong that way
+// (Codex repaints while idle: rotating tips, the user typing) — and memoised
+// for a few seconds so every client's poll shares one read per session.
+const screenWorkingMemo = new Map(); // internalName -> { t, p: Promise<boolean|null> }
+function screenWorkingOf(internalName) {
+    const now = Date.now();
+    const hit = screenWorkingMemo.get(internalName);
+    if (hit && now - hit.t < 4000) return hit.p;
+    const p = (async () => {
+        try {
+            const hostRes = await callExternalHayHostApi(`/rooms/${encodeURIComponent(internalName)}/serialized`);
+            const raw = hostRes?.data?.data;
+            if (typeof raw !== 'string' || !raw) return null;
+            return screenSaysWorking(stripAnsiForSearch(raw));
+        } catch (e) { return null; }
+    })();
+    screenWorkingMemo.set(internalName, { t: now, p });
+    if (screenWorkingMemo.size > 500) screenWorkingMemo.clear();
+    return p;
+}
+// Phase for every entry of a list, the screen consulted where it matters.
+async function agentPhaseFieldsForAll(entries) {
+    const verdicts = new Map();
+    await Promise.all(entries.map(async (s) => {
+        if (!s.agent) return;
+        if (agentPhaseFields(s).agentPhase !== 'working') return;
+        verdicts.set(s.internalName, await screenWorkingOf(s.internalName));
+    }));
+    const out = new Map();
+    for (const s of entries) out.set(s.internalName, agentPhaseFields(s, verdicts.has(s.internalName) ? verdicts.get(s.internalName) : null));
+    return out;
+}
 // The newest published view's time (ms) for a session, from the manifest
 // the views summary already reads. `hop view` rings one bell per publish.
 function latestViewAtMs(internalName) {
@@ -5708,6 +5770,55 @@ function listClaudeSessionMetas() {
     return out;
 }
 
+// ---- Identity snapshots (lib/identity-snapshot.js) -------------------------
+// A second copy of the durable metas' user-authored fields — above all which
+// FOLDER each session is filed in — written at start, at stop and hourly.
+// The 2026-09-26 `stop --all` deleted every live session's records and the
+// rebuilt metas had no folder to go back to; the snapshot is what makes that
+// recoverable next time. restore re-files from the newest one.
+const IDENTITY_SNAPSHOT_DIR = path.join(HOME_DIR, 'restore-snapshots');
+function writeIdentitySnapshot(reason) {
+    try {
+        const snap = snapshotFromMetas(listClaudeSessionMetas(), sessionStore.folders, { reason });
+        fs.mkdirSync(IDENTITY_SNAPSHOT_DIR, { recursive: true, mode: 0o700 });
+        const file = path.join(IDENTITY_SNAPSHOT_DIR, snapshotFileName(snap.at));
+        writePrivateFile(file, JSON.stringify(snap, null, 1), 0o600);
+        for (const old of pruneList(fs.readdirSync(IDENTITY_SNAPSHOT_DIR))) {
+            try { fs.unlinkSync(path.join(IDENTITY_SNAPSHOT_DIR, old)); } catch (e) { /* best effort */ }
+        }
+        return file;
+    } catch (e) {
+        log(`[snapshot] could not write identity snapshot: ${e?.message || e}`, DIM);
+        return null;
+    }
+}
+function latestIdentitySnapshot() {
+    try {
+        const names = fs.readdirSync(IDENTITY_SNAPSHOT_DIR).filter((n) => /^identity-.*\.json$/.test(n)).sort();
+        if (!names.length) return null;
+        const file = path.join(IDENTITY_SNAPSHOT_DIR, names[names.length - 1]);
+        return { file, snapshot: JSON.parse(fs.readFileSync(file, 'utf8')) };
+    } catch (e) { return null; }
+}
+// Sessions whose meta has no folder at all but which the newest snapshot
+// remembers in a folder that still exists get their folder back. An
+// explicit `folderId: null` (unfiled on purpose) is respected.
+function refileFromIdentitySnapshot({ dryRun = false } = {}) {
+    const latest = latestIdentitySnapshot();
+    if (!latest) return [];
+    const plan = planRefiles(listClaudeSessionMetas(), latest.snapshot, sessionStore.folders);
+    for (const item of plan) {
+        const folderName = sessionStore.folders[item.folderId]?.name || item.folderId;
+        if (dryRun) { log(`  would re-file ${item.displayName} → ${folderName} (from ${path.basename(latest.file)})`, DIM); continue; }
+        const durable = readClaudeSessionMeta(item.internalName) || {};
+        writeClaudeSessionMeta(item.internalName, { ...durable, internalName: item.internalName, folderId: item.folderId });
+        rememberRuntimeSessionMetadata(item.internalName, { ...(getRuntimeSessionMetadata(item.internalName) || {}), folderId: item.folderId });
+        if (sessionStore.sessions[item.internalName]) moveSessionToFolder(item.internalName, item.folderId);
+        log(`  re-filed ${item.displayName} → ${folderName} (from ${path.basename(latest.file)})`, DIM);
+    }
+    return plan;
+}
+
 // Claude Code slugifies a project cwd for <config-root>/projects/<slug>/.
 // The rule has changed across versions (older: every non-alphanumeric -> '-';
 // newer builds preserve spaces: "nebula-notebook 2" keeps its space), so
@@ -6349,7 +6460,8 @@ async function sweepRestoreReconcile() {
             if (!/[%$#\u276f>]\s*$/.test(last)) continue; // not an idle prompt yet
             try {
                 const e2 = await attachTerminalApiClient(name, exp.displayName, { actor: 'system', label: 'reconcile' });
-                const cmd = exp.command.endsWith('\n') ? exp.command : `${exp.command}\n`;
+                const pinned = withCodexIdentity(exp.command, name);
+                const cmd = pinned.endsWith('\n') ? pinned : `${pinned}\n`;
                 try { sendTerminalInput(e2, cmd); } finally { try { closeTerminalApiEntry(e2.id); } catch (e) {} }
                 exp.redrives += 1;
                 exp.lastDriveAt = now;
@@ -6448,6 +6560,11 @@ function resolveRestoreTargets(names, snapshot) {
     return { resolved, unknown };
 }
 async function restoreSavedSessionsUnlocked({ dryRun = false, includeAgents = false, only = null } = {}) {
+    // Folders first: a session whose meta lost its folder (records deleted,
+    // meta rebuilt) is put back where the newest identity snapshot says it
+    // was, so the restored wall is filed the way the user left it.
+    const refiled = refileFromIdentitySnapshot({ dryRun });
+    if (refiled.length) log(`${dryRun ? 'Would re-file' : 'Re-filed'} ${refiled.length} session(s) into their folders from the identity snapshot.`, DIM);
     const snapshot = await listAllSessionEntriesRuntimeFirst();
     const live = new Set(snapshot.entries.filter((e) => e.live).map((e) => e.internalName));
     // Targeted redo (`hop restore <name>...`): the named sessions are planned
@@ -6702,7 +6819,11 @@ async function restoreSavedSessionsUnlocked({ dryRun = false, includeAgents = fa
                 // A fresh shell reports its own name once it has execed; that
                 // is our prompt-ready signal, and it beats guessing with a timer.
                 if (Date.now() - job.since < 400) continue;
-                const cmd = job.plan.command.endsWith('\n') ? job.plan.command : `${job.plan.command}\n`;
+                // A codex launch carries its hop session id in the thread's own
+                // config (lib/codex-identity.js): Codex's shared daemon would
+                // otherwise hand every session the FIRST session's identity.
+                const pinned = withCodexIdentity(job.plan.command, job.internalName);
+                const cmd = pinned.endsWith('\n') ? pinned : `${pinned}\n`;
                 try { sendTerminalInput(job.entry, cmd); } catch (e) { finish('write-failed'); continue; }
                 job.attempts += 1;
                 job.state = 'verify';
@@ -6822,7 +6943,9 @@ async function restoreSavedSessionsUnlocked({ dryRun = false, includeAgents = fa
 // The same script is registered for two events: SessionStart (records the
 // conversation id for `hop restore`) and Stop (bumps a per-turn counter a driver
 // can wait on). See scripts/claude-session-hook.js.
-const CLAUDE_HOOK_EVENTS = ['SessionStart', 'Stop', 'Notification', 'PreToolUse'];
+// UserPromptSubmit marks the START of a turn (with Stop's end, the wall
+// colours the session "working" / "done" — see lib/agent-phase.js).
+const CLAUDE_HOOK_EVENTS = ['SessionStart', 'Stop', 'Notification', 'PreToolUse', 'UserPromptSubmit'];
 // Notification (permission prompts, elicitation) and PreToolUse (the two tools
 // that open a dialog and wait) bump the per-session ASK record — "whenever an
 // agent asks me a question, notify me" (Jian). PreToolUse gets a matcher, or
@@ -9492,7 +9615,7 @@ async function ensureExternalRuntimeSession(sessionName, cwd, displayName, opts
     // Launch the room ON the relaunch command instead of typing it after the
     // shell is up: no prompt to race, nothing half-typed, no command echo.
     if (typeof opts.command === 'string' && opts.command) {
-        roomBody.command = opts.command;
+        roomBody.command = withCodexIdentity(opts.command, sessionName);
     }
     const response = await callExternalHayHostApi('/rooms', 'POST', roomBody, 2500);
     if (!response || response.status < 200 || response.status >= 300 || !response.data?.ok) {
@@ -11629,6 +11752,7 @@ happens until someone clicks it.
             // compares latestAt against its own last-seen mark. No new state,
             // no new poll, and the badge works the same everywhere.
             const viewsBySession = viewSummaryBySession();
+            const phaseBySession = await agentPhaseFieldsForAll(visibleEntries);
             const sessions = visibleEntries.map(s => ({
                 views: viewsBySession[s.internalName] || undefined,
                 name: s.displayName,
@@ -11644,6 +11768,9 @@ happens until someone clicks it.
                 cwd: s.cwd,
                 foregroundProcess: s.foregroundProcess,
                 agent: s.agent || null,
+                // working / done + whether the human has opened it since the
+                // turn ended (server-side seen witness, so every device agrees).
+                ...(phaseBySession.get(s.internalName) || { agentPhase: null, turnSeen: true, turnAt: null }),
                 lastActivityAt: s.lastActivityAt,
                 // For sessions armed with notify-on-finish, each completed turn
                 // adds to bellSeq so the phone treats a finished response like a
@@ -12570,13 +12697,16 @@ happens until someone clicks it.
             req.on('end', () => {
                 try {
                     const { name, internalName, folderId, index } = JSON.parse(body);
+                    // Unfiling is recorded as an explicit null: a meta with
+                    // NO folderId key is one that may have LOST it, and the
+                    // identity snapshot re-files those on restore.
                     const persistMembership = (target) => {
                         if (!target) return;
                         const durable = readClaudeSessionMeta(target) || {};
                         writeClaudeSessionMeta(target, {
                             ...durable,
                             internalName: target,
-                            folderId: folderId || undefined
+                            folderId: folderId || null
                         });
                     };
                     // Resolve like every other session endpoint: a live
@@ -13020,7 +13150,8 @@ happens until someone clicks it.
                     });
 
                     if (startup && autoStart !== false) {
-                        sendTerminalInput(entry, startup.endsWith('\n') ? startup : `${startup}\n`);
+                        const pinnedStartup = withCodexIdentity(startup, internalName);
+                        sendTerminalInput(entry, pinnedStartup.endsWith('\n') ? pinnedStartup : `${pinnedStartup}\n`);
                     }
 
                     res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -13218,7 +13349,7 @@ happens until someone clicks it.
                         res.end(JSON.stringify({ error: 'Missing command' }));
                         return;
                     }
-                    const line = String(command);
+                    const line = withCodexIdentity(String(command), entry.sessionName);
                     sendTerminalInput(entry, line.endsWith('\n') ? line : `${line}\n`);
                     res.writeHead(200, { 'Content-Type': 'application/json' });
                     res.end(JSON.stringify({ ok: true }));
@@ -16563,7 +16694,7 @@ async function main() {
         log(`${dryRun ? 'Would recover' : 'Recovering'} ${BOLD}${display}${RESET} (${kind}) in this terminal:`, RESET);
         log(`  ${DIM}${command}${RESET}`, RESET);
         if (dryRun) process.exit(0);
-        const child = spawn('/bin/zsh', ['-lc', command], { stdio: 'inherit', cwd: plan?.cwd || cwd, env: process.env });
+        const child = spawn('/bin/zsh', ['-lc', withCodexIdentity(command, target)], { stdio: 'inherit', cwd: plan?.cwd || cwd, env: process.env });
         child.on('exit', (code, signal) => process.exit(signal ? 1 : (code ?? 0)));
         return;
     }
@@ -17392,6 +17523,9 @@ async function main() {
         } else {
             console.log(`View: ${proxyUrl}`);
         }
+        // Name the session it was filed under, so a wrong one is visible at
+        // once (an inherited HOP_SESSION can belong to another session).
+        console.log(`Filed under ${getSessionDisplayName(session) || session}${wantSession ? '' : ' (from HOP_SESSION; pass --session <name> to file elsewhere)'}.`);
         // Same one-bell convention as `hop view` — the human is usually
         // waiting on this, and the link scrolls away unannounced otherwise.
         process.stdout.write('\x07');
@@ -19317,6 +19451,12 @@ async function main() {
         // per file, and a no-op when the folder doesn't exist yet.
         setTimeout(enforceUploadBudget, 20000).unref?.();
         setInterval(enforceUploadBudget, 3600000).unref?.();
+
+        // Identity snapshot (folders, names, origins): once the boot settles,
+        // then hourly. Cheap — one small file — and the reason restore can
+        // put sessions back in their folders after their records are lost.
+        setTimeout(() => writeIdentitySnapshot('start'), 30000).unref?.();
+        setInterval(() => writeIdentitySnapshot('hourly'), 3600000).unref?.();
     }
 
     if (DAEMON_FLAG) {
@@ -19324,6 +19464,7 @@ async function main() {
             if (shuttingDown) return;
             shuttingDown = true;
             log(`Cleaning up...`, YELLOW);
+            writeIdentitySnapshot('stop');
 
             stopTunnelHealthMonitor();