hop2 0.11.74 → 0.11.76

package/hop

@@ -2733,6 +2733,20 @@ const CLAUDE_UI_RE = /bypass permissions on|shift\+tab to cycle|Welcome back|esc
 const TRUST_PROMPT_RE = /Quick\s*safety\s*check|Yes,?\s*I\s*trust\s*this\s*folder|Is\s*this\s*a\s*project\s*you\s*created\s*or\s*one\s*you\s*trust/i;
 // Trust-dialog reading lives in lib/trust-dialog.js so it can be unit-tested.
 const { trustDialogWorkspace, trustDialogAnswer, samePath } = require('./lib/trust-dialog.js');
+// The transport cloudflared uses to reach Cloudflare's edge. Its default is
+// QUIC (UDP): on networks that shape or drop UDP — campus networks often do —
+// a lost packet stalls every request in flight on that connection for a
+// retransmit timeout, and keystrokes from a phone or laptop arrive in
+// 1–3 s bursts while the host itself is idle (measured 2026-10-11: QUIC
+// connection 0 had 120 timeout losses; one request in four took 1.2–2.9 s).
+// "http2" runs the tunnel over TCP instead. Set `tunnel_protocol` in
+// ~/.hop2 config ("quic" | "http2" | "auto") or HOP_TUNNEL_PROTOCOL.
+function getTunnelProtocol() {
+    const raw = String(process.env.HOP_TUNNEL_PROTOCOL || getHopConfig().tunnel_protocol || '').toLowerCase();
+    return raw === 'quic' || raw === 'http2' || raw === 'auto' ? raw : null;
+}
+const tunnelProtocolLine = () => { const p = getTunnelProtocol(); return p ? `protocol: ${p}\n` : ''; };
+
 function getResumeMode() {
     const mode = String(getHopConfig().resume_mode || '').toLowerCase();
     return mode === 'summary' || mode === 'ask' ? mode : 'full';
@@ -6021,6 +6035,20 @@ function runShellProbe(command, cwd) {
 // agent-turn path has always sent them as separate writes; this is that.
 const sleepMs = (ms) => new Promise((r) => setTimeout(r, ms));
 // Is the message still sitting in the composer (the `›` line) — typed, not sent?
+/**
+ * Is this session's agent up and showing its own UI — the only thing a
+ * check-back may type into? Not running, a plain shell, a trust or resume
+ * dialog, or an unreadable screen are all "no".
+ */
+async function agentScreenReady(entry) {
+    if (!entry || entry.live !== true) return { ok: false, reason: 'waiting: the session is not running' };
+    const verdict = await roomIsRedoable(entry);
+    // roomIsRedoable says "not redoable, and here is whether the agent is
+    // idle" exactly when an agent's UI owns the screen.
+    if (!verdict.ok && verdict.agentIdle !== undefined) return { ok: true };
+    return { ok: false, reason: `waiting: no agent on screen (${verdict.reason})` };
+}
+
 async function composerStillHolds(internalName, message) {
     try {
         const hostRes = await callExternalHayHostApi(`/rooms/${encodeURIComponent(internalName)}/serialized`);
@@ -6100,6 +6128,17 @@ async function runCheckbackSweep() {
                     continue;
                 }
                 if (!checkbacks.mayDeliver(cb, ctx)) continue; // mid-turn: next sweep
+                // Type only into a RUNNING agent. Attaching to a stopped
+                // session creates its room — as a bare shell — and the
+                // message then ran as shell commands ("zsh: command not
+                // found: Collect"); worse, that shell made restore think the
+                // session was up and skip it (surf, alphagenome, 2026-10-12
+                // after a reboot). Wait until the agent's own UI is on screen.
+                const ready = await agentScreenReady(entry);
+                if (!ready.ok) {
+                    if (cb.lastError !== ready.reason) { cb.lastError = ready.reason; dirty = true; }
+                    continue;
+                }
                 const e2 = await attachTerminalApiClient(cb.session, entry.displayName || cb.session, { actor: 'system', label: 'checkback', typeOnly: true });
                 try { await typeAndSubmit(e2, cb.session, cb.message); }
                 finally { try { closeTerminalApiEntry(e2.id); } catch (e) { /* closed */ } }
@@ -6384,8 +6423,13 @@ function rebuildClaudeLaunch(launchCmd) {
             if (!valued && out.includes(t)) continue;
             out.push(t);
             if (valued) out.push(tokens[++i]);
+            continue;
         }
-        // bare positional (initial prompt) — dropped
+        // A bare positional is the initial PROMPT, and everything after it
+        // is prompt text too — split on spaces, its words included things
+        // like "--source-ref" and "-q", which were kept as flags and made
+        // claude exit at once on every restore (pulse-1004-claude-o3).
+        break;
     }
     return out.join(' ');
 }
@@ -6965,6 +7009,7 @@ async function restoreSavedSessionsUnlocked({ dryRun = false, includeAgents = fa
         const { resolved, unknown } = resolveRestoreTargets(only, snapshot);
         for (const name of unknown) skipped.push({ name, reason: 'no such session' });
         onlySet = resolved;
+        let closedAny = false;
         for (const internalName of resolved) {
             if (!live.has(internalName)) continue;
             const entry = snapshot.entries.find((e) => e.internalName === internalName);
@@ -6999,7 +7044,13 @@ async function restoreSavedSessionsUnlocked({ dryRun = false, includeAgents = fa
             }
             log(`  ${display}: closed the ${verdict.reason} left by the last restore`, DIM);
             live.delete(internalName);
+            closedAny = true;
         }
+        // The keeper ends the old terminal a beat AFTER the room closes. A
+        // relaunch inside that beat was refused ("already running"), and
+        // then the old one exited too — both sessions vanished (alphagenome,
+        // angler-codex-claude-codex, 2026-10-12). Let the old ones go first.
+        if (closedAny) await new Promise((r) => setTimeout(r, 2000));
     }
     const candidates = snapshot.entries.filter((e) => e && e.type === 'terminal' && !live.has(e.internalName));
     // Primary source: the SessionStart-hook records. Add any recorded session that
@@ -13320,7 +13371,11 @@ happens until someone clicks it.
                     const result = await restoreSavedSessions({
                         dryRun: parsed.dryRun === true,
                         includeAgents: parsed.includeAgents === true,
-                        only: Array.isArray(parsed.only) ? parsed.only.filter((n) => typeof n === 'string').slice(0, 200) : null
+                        only: Array.isArray(parsed.only) ? parsed.only.filter((n) => typeof n === 'string').slice(0, 200) : null,
+                        // Restart named agents that sit idle at their prompt
+                        // (never one mid-turn) — e.g. one resumed the wrong
+                        // conversation. Only together with `only`.
+                        replaceIdleAgent: parsed.replaceIdleAgent === true && Array.isArray(parsed.only)
                     });
                     res.writeHead(200, { 'Content-Type': 'application/json' });
                     res.end(JSON.stringify(result));
@@ -14497,7 +14552,24 @@ happens until someone clicks it.
                         return;
                     }
                     await reconcileExternalRuntimeSessions();
-                    await ensureExternalRuntimeSession(sessionName, sessionConfig?.cwd, getSessionDisplayName(sessionName), {
+                    // A dead session that holds an agent conversation comes
+                    // back AS that agent, whoever opens it — a viewer, a
+                    // check-back, a tile. Creating a bare shell here left
+                    // surf a zsh prompt after a reboot (a check-back's attach
+                    // beat restore by two seconds, and restore then skipped
+                    // the "running" session). Same plan restore would use.
+                    let revive = null;
+                    if (!sessionConfig?.startup && !(await runtimeTerminalSessionExists(sessionName))) {
+                        try {
+                            const plan = restorePlanForSession({ internalName: sessionName, cwd: sessionConfig?.cwd, startup: sessionConfig?.startup, autoStart: sessionConfig?.autoStart });
+                            if (plan?.command) {
+                                revive = plan;
+                                log(`[ws] ${sessionName}: not running — starting it as its agent (${plan.command.slice(0, 80)})`, DIM);
+                            }
+                        } catch (e) { /* no plan: a plain shell, as before */ }
+                    }
+                    await ensureExternalRuntimeSession(sessionName, revive?.cwd || sessionConfig?.cwd, getSessionDisplayName(sessionName), {
+                        command: revive?.command || undefined,
                         shell: sessionConfig?.shell,
                         env: sessionConfig?.env,
                         cols: sessionConfig?.cols,
@@ -14729,7 +14801,7 @@ function startTunnel(isRestart = false) {
         const tunnelConfig = `
 url: http://${localTunnelHost}:${PROXY_PORT}
 tunnel: ${domainConfig.tunnelName}
-`;
+${tunnelProtocolLine()}`;
         writePrivateFile(tunnelConfigPath, tunnelConfig);
 
         const runArgs = ['tunnel', '--config', tunnelConfigPath, 'run'];
@@ -14907,7 +14979,7 @@ function startClientTunnel(isRestart = false) {
 url: http://127.0.0.1:${PROXY_PORT}
 tunnel: ${tunnelId}
 credentials-file: ${path.resolve(credentialsPath)}
-`;
+${tunnelProtocolLine()}`;
     writePrivateFile(tunnelConfigPath, tunnelConfig);
 
     const tunnel = spawn('cloudflared', ['tunnel', '--config', tunnelConfigPath, 'run'], {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hop2",
-  "version": "0.11.74",
+  "version": "0.11.76",
   "description": "🐰 Hop into your terminal from anywhere. Secure remote shell access with 2FA via Cloudflare Tunnel. Next-gen rewrite with native terminal sharing.",
   "main": "hop",
   "bin": {

package/scripts/codex-notify-hook.js

@@ -38,7 +38,17 @@ function turnsDir() {
 // thread is the truth: if another session's turn record already names this
 // root thread, the turn is that session's. (hop launches codex without the
 // daemon now; this keeps the sessions that predate the change honest.)
+//
+// Retired (2026-10-12): every codex hop launches now carries its own session
+// in the per-thread overrides (lib/codex-identity.js), so HOP_SESSION is the
+// truth — and the "another record already names this thread" rule did harm:
+// once a record held the wrong thread, every later turn of that thread was
+// filed there for good. The hand-off session angler-codex-claude-codex lost
+// its whole conversation to angler-codex that way, and after a reboot
+// angler-codex resumed the hand-off's thread instead of its own. Kept only
+// for a launch with no session in its environment.
 function resolveHopSession(dir, rootId, envSession) {
+  if (envSession) return envSession;
   if (!rootId) return envSession;
   let names = [];
   try { names = fs.readdirSync(dir).filter((f) => f.endsWith(".turn")); } catch { return envSession; }
@@ -58,7 +68,9 @@ function resolveHopSession(dir, rootId, envSession) {
 // file — a long thread's rollout runs to hundreds of MB. Any failure leaves
 // the id as given; hop resolves it again at restore time.
 function findRollout(id) {
-  const root = path.join(os.homedir(), ".codex", "sessions");
+  // The account's own root: a session running as another Codex login keeps
+  // its rollouts under that CODEX_HOME.
+  const root = path.join(process.env.CODEX_HOME || path.join(os.homedir(), ".codex"), "sessions");
   const walk = (dir, depth) => {
     let names = [];
     try { names = fs.readdirSync(dir, { withFileTypes: true }); } catch { return null; }
@@ -101,14 +113,24 @@ function bumpTurn(payload) {
   const rawThread = (payload && typeof payload["thread-id"] === "string") ? payload["thread-id"]
              : (payload && typeof payload.thread_id === "string") ? payload.thread_id
              : (payload && typeof payload.session_id === "string") ? payload.session_id : null;
-  const rootId = rootThreadId(rawThread);
+  let rootId = rootThreadId(rawThread);
   const hopSession = resolveHopSession(dir, rootId, envSession);
   const file = path.join(dir, `${hopSession}.turn`);
   let count = 0;
+  let prev = null;
   try {
-    const prev = JSON.parse(fs.readFileSync(file, "utf8"));
+    prev = JSON.parse(fs.readFileSync(file, "utf8"));
     if (prev && Number.isInteger(prev.count) && prev.count >= 0) count = prev.count;
   } catch { /* missing/corrupt -> start at 0 */ }
+  // A thread Codex never saved cannot be the conversation. Codex's helper
+  // threads (the approval "guardian", among others) finish turns and notify
+  // like any other, but have no rollout — recording one replaced the real
+  // thread, and restore then had nothing to resume (alphagenome came back a
+  // bare shell). Keep the saved thread already on record.
+  if (rootId && !findRollout(rootId) && prev && typeof prev.sessionId === "string"
+      && prev.sessionId !== rootId && findRollout(prev.sessionId)) {
+    rootId = prev.sessionId;
+  }
   const rec = JSON.stringify({
     // The thread id is the conversation (and the rollout file's name); the
     // turn id names one turn and matches nothing on disk. With multi-agent

package/tests/codex-notify-hook.unit.test.cjs

@@ -10,10 +10,15 @@ const HOOK = path.join(__dirname, '..', 'scripts', 'codex-notify-hook.js');
 const freshHome = () => {
   const home = fs.mkdtempSync(path.join(os.tmpdir(), 'hop-codex-hook-'));
   fs.mkdirSync(path.join(home, 'claude-sessions'), { recursive: true });
+  fs.mkdirSync(path.join(home, 'codex', 'sessions', '2026', '10', '12'), { recursive: true });
   return home;
 };
+// A thread Codex saved has a rollout file named after it.
+const saveRollout = (home, id) => fs.writeFileSync(
+  path.join(home, 'codex', 'sessions', '2026', '10', '12', `rollout-2026-10-12T00-00-00-${id}.jsonl`),
+  JSON.stringify({ type: 'session_meta', payload: { id } }) + '\n');
 const run = (home, session, payload) => execFileSync(process.execPath, [HOOK, JSON.stringify(payload)], {
-  env: { ...process.env, HOP_HOME: home, HOP_SESSION: session }
+  env: { ...process.env, HOP_HOME: home, HOP_SESSION: session, CODEX_HOME: path.join(home, 'codex') }
 });
 const turn = (home, name) => { try { return JSON.parse(fs.readFileSync(path.join(home, 'claude-sessions', `${name}.turn`), 'utf8')); } catch { return null; } };
 
@@ -25,19 +30,30 @@ test('a turn is counted against HOP_SESSION when no other session claims the thr
   assert.equal(turn(home, 'alpha').agent, 'codex');
 });
 
-test("under a shared daemon the environment lies: the session whose record already names the thread gets the turn", () => {
+test('the turn belongs to the session it ran in, even when another record names the thread', () => {
+  // Retired rule: "a record already naming this thread owns it" filed the
+  // hand-off session's turns under angler-codex for good. Every hop launch
+  // now carries its own session, so the environment is the truth.
   const home = freshHome();
-  fs.writeFileSync(path.join(home, 'claude-sessions', 'surf.turn'), JSON.stringify({ sessionId: 'thread-S', count: 4, at: '2026-09-28T22:46:53.450Z', agent: 'codex' }));
-  fs.writeFileSync(path.join(home, 'claude-sessions', 'owner.turn'), JSON.stringify({ sessionId: 'thread-O', count: 9, at: '2026-09-29T20:00:00.000Z', agent: 'codex' }));
-  // The daemon runs notify with HOP_SESSION=owner, for surf's thread.
-  run(home, 'owner', { type: 'agent-turn-complete', 'thread-id': 'thread-S', 'turn-id': 't2' });
-  assert.equal(turn(home, 'surf').count, 5, 'surf got its turn');
-  assert.equal(turn(home, 'surf').sessionId, 'thread-S');
-  assert.equal(turn(home, 'owner').count, 9, 'the owner was not credited with it');
-  assert.equal(turn(home, 'owner').sessionId, 'thread-O', "and the owner's own thread id was not overwritten");
-  // The owner's own turn still lands on the owner.
-  run(home, 'owner', { type: 'agent-turn-complete', 'thread-id': 'thread-O', 'turn-id': 't3' });
-  assert.equal(turn(home, 'owner').count, 10);
+  saveRollout(home, 'thread-H'); saveRollout(home, 'thread-A');
+  fs.writeFileSync(path.join(home, 'claude-sessions', 'angler.turn'), JSON.stringify({ sessionId: 'thread-H', count: 9, at: '2026-10-09T00:00:00.000Z', agent: 'codex' }));
+  run(home, 'handoff', { type: 'agent-turn-complete', 'thread-id': 'thread-H', 'turn-id': 't1' });
+  assert.equal(turn(home, 'handoff').sessionId, 'thread-H');
+  assert.equal(turn(home, 'handoff').count, 1);
+  assert.equal(turn(home, 'angler').count, 9, 'the other record is left alone');
+});
+
+test("a thread Codex never saved (a helper like the approval guardian) does not replace the session's conversation", () => {
+  const home = freshHome();
+  saveRollout(home, 'thread-main');
+  run(home, 'alpha', { type: 'agent-turn-complete', 'thread-id': 'thread-main', 'turn-id': 't1' });
+  run(home, 'alpha', { type: 'agent-turn-complete', 'thread-id': 'thread-guardian', 'turn-id': 't2' });
+  assert.equal(turn(home, 'alpha').sessionId, 'thread-main', 'still the saved thread');
+  assert.equal(turn(home, 'alpha').count, 2, 'the turn still counts');
+  // A NEW saved thread (the person started over) does take over.
+  saveRollout(home, 'thread-next');
+  run(home, 'alpha', { type: 'agent-turn-complete', 'thread-id': 'thread-next', 'turn-id': 't3' });
+  assert.equal(turn(home, 'alpha').sessionId, 'thread-next');
 });
 
 test('other event types count nothing', () => {