hop2 0.11.75 → 0.11.77

package/hay/apps/server/src/rooms.ts

@@ -142,6 +142,11 @@ export type RoomSummary = {
 // 6MB still exceeds every reader: the deep-history replay asks 1.5MB, the
 // serialized attach reads the grid, and `hop restore` persists 64KB tails.
 // Override with HAY_SNAPSHOT_BUFFER_BYTES for deeper rings at GC's expense.
+// DEC private modes worth restoring on adopt: cursor keys, mouse (any
+// flavour and encoding), focus events, alternate screen, bracketed paste,
+// cursor visibility.
+const TRACKED_DEC_MODES = new Set(["1", "25", "47", "1000", "1002", "1003", "1004", "1005", "1006", "1015", "1047", "1049", "2004"]);
+
 const MAX_BUFFER_SIZE = (() => {
   const env = Number(process.env.HAY_SNAPSHOT_BUFFER_BYTES);
   return Number.isFinite(env) && env > 0 ? env : 6_000_000;
@@ -321,6 +326,13 @@ export class Room extends EventEmitter {
   private mouseReporting = false;
   private mouseSgr = false;
   private cursorHidden = false;
+  // The DEC private modes an app set (alternate screen, mouse, focus,
+  // bracketed paste…), exactly. An app sets them once at startup; a host
+  // restart rebuilds the room from a bounded replay that no longer holds
+  // that moment, so the room forgot Codex was full-screen and the wheel
+  // scrolled the page instead of the app (2026-10-12). The host saves
+  // modePrefix() and puts it back in front of the replay on adopt.
+  private decModes = new Map<string, boolean>();
   private controlSequenceTail = "";
   private oscBuffer = "";
   private cleanupTimer: NodeJS.Timeout | null = null;
@@ -678,10 +690,13 @@ export class Room extends EventEmitter {
 
     let nextMouseReporting = hasNewRis ? false : this.mouseReporting;
     let nextMouseSgr = hasNewRis ? false : this.mouseSgr;
+    const modesBefore = this.modePrefix();
+    if (hasNewRis) this.decModes.clear();
     while ((match = regex.exec(stateInput)) !== null) {
       const params = match[1].split(";").filter(Boolean);
       const mode = match[2];
       for (const param of params) {
+        if (TRACKED_DEC_MODES.has(param)) this.decModes.set(param, mode === "h");
         if (param === "25") {
           nextCursorHidden = mode === "l";
         } else if (param === "47" || param === "1047" || param === "1049") {
@@ -738,6 +753,9 @@ export class Room extends EventEmitter {
       stateChanged = true;
     }
 
+    const modesAfter = this.modePrefix();
+    if (modesAfter !== modesBefore) this.emit("modes", modesAfter);
+
     if (stateChanged) {
       this.emit("pty_state", {
         roomId: this.id,
@@ -1204,6 +1222,22 @@ export class Room extends EventEmitter {
   // omit cells until the app happens to repaint (for example, on scroll).
   // Begin tracking at TUI entry; dependency loading is shared and normally
   // finishes first, but the callback covers a TUI that starts immediately.
+  /**
+   * The escape sequences that put a fresh terminal into this app's current
+   * modes: the alternate screen first (so the rest apply to it), then each
+   * mode that is on, and a hidden cursor. "" for a plain shell.
+   */
+  modePrefix(): string {
+    let alt = "", rest = "";
+    for (const [mode, on] of this.decModes) {
+      if (mode === "25") { if (!on) rest += "\x1b[?25l"; continue; }
+      if (!on) continue;
+      if (mode === "1049" || mode === "1047" || mode === "47") alt = `\x1b[?${mode}h`;
+      else rest += `\x1b[?${mode}h`;
+    }
+    return alt + rest;
+  }
+
   private startTuiGrid() {
     if (!SERIALIZED_ATTACH_ENABLED || this.grid || this.gridStartPending || this.gridUnavailable || this.ended) return;
     if (!this.alternateScreen && !this.mouseReporting) return;
@@ -1244,7 +1278,11 @@ export class Room extends EventEmitter {
             const nl = tail.indexOf("\n");
             if (nl !== -1 && nl < 8192) tail = tail.slice(nl + 1);
           }
-          this.grid.write(tail);
+          // The tail rarely reaches back to where the app set its modes
+          // (an adopted room's saved prefix sits at the very front of the
+          // ring): put the room's current modes first, or the grid serializes
+          // a full-screen app as a plain shell. The tail's own changes win.
+          this.grid.write(this.modePrefix() + tail);
         }
       }
     }

package/hay/apps/server/test/roomModes.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, it } from "vitest";
+import { RoomManager } from "../src/rooms";
+import type { PtyFactory } from "../src/pty";
+
+class FakePty {
+  private handlers: Array<(data: string) => void> = [];
+  onData(handler: (data: string) => void) { this.handlers.push(handler); }
+  onExit() {}
+  emit(data: string) { for (const h of this.handlers) h(data); }
+  write() {}
+  resize() {}
+  kill() {}
+}
+
+describe("terminal modes a room remembers", () => {
+  it("a room reports the DEC modes its app set, alternate screen first", () => {
+    const pty = new FakePty();
+    const manager = new RoomManager((() => pty) as unknown as PtyFactory);
+    const room = manager.getRoom("codex", { cols: 80, rows: 24 }, "/tmp");
+    const seen: string[] = [];
+    room.on("modes", (p: string) => seen.push(p));
+    pty.emit("\x1b[?2004h\x1b[?1004h\x1b[?1049h\x1b[?1003h\x1b[?1006h\x1b[?25l hello");
+    expect(room.modePrefix()).toBe("\x1b[?1049h\x1b[?2004h\x1b[?1004h\x1b[?1003h\x1b[?1006h\x1b[?25l");
+    expect(seen.at(-1)).toBe(room.modePrefix());
+    pty.emit("\x1b[?1003l\x1b[?1049l");
+    expect(room.modePrefix()).toBe("\x1b[?2004h\x1b[?1004h\x1b[?1006h\x1b[?25l");
+    pty.emit("\x1bc");
+    expect(room.modePrefix()).toBe("");
+  });
+});

package/hay/apps/web/src/App.tsx

@@ -49,6 +49,7 @@ import {
 } from "./utils/paneTree";
 import { ViewsPanel, hasUnseenViews, loadViewsSeen } from "./components/ViewsPanel";
 import type { ViewsSummary } from "./utils/switcherModel";
+import { isAppCtrlEnter, isFullscreenChord } from "./utils/fullscreenChord";
 
 const createRoomId = () => `room-${Math.random().toString(36).slice(2, 7)}`;
 
@@ -2329,13 +2330,21 @@ const App = () => {
     terminal.attachCustomKeyEventHandler((event) => {
       // ⌘⏎ leaves full screen for the wall — the mirror of ⌘⏎ on a wall
       // tile entering it. One chord toggles the mode from either side.
-      if (event.key === 'Enter' && (event.metaKey || event.ctrlKey) && !event.altKey && !event.shiftKey) {
+      // On a Mac only ⌘⏎ — Ctrl⏎ goes to the app (see fullscreenChord.ts).
+      if (isFullscreenChord(event)) {
         if (event.type === 'keydown') {
           event.preventDefault();
           setSwitcherOpen(true);
         }
         return false;
       }
+      if (isAppCtrlEnter(event) && (remoteKbdEnhancedRef.current || foregroundIsClaude())) {
+        if (event.type === 'keydown') {
+          event.preventDefault();
+          handleUserInput('\x1b[13;5u');
+        }
+        return false;
+      }
       // Long-press SPACE = voice input — shared controller; see voiceHold.ts.
       {
         const verdict = voiceHoldRef.current?.handleKey(event);

package/hay/apps/web/src/components/SessionSwitcher.tsx

@@ -37,6 +37,7 @@ import {
   type SwitcherSortMode,
   insertAfter, describeAccount, type AgentHome, type AgentHomes } from "../utils/switcherModel";
 import { scanKeyboardProtocol } from "../utils/keyboardProtocol";
+import { isAppCtrlEnter, isFullscreenChord } from "../utils/fullscreenChord";
 import { DigestCard } from "./DigestCard";
 import { hasUnseenViews, loadViewsSeen } from "./ViewsPanel";
 
@@ -693,10 +694,15 @@ const LiveTile = ({ wsBase, room, userName, theme, live, deliberate, claudeApp,
         if (ev.type === "keydown") sendInputRef.current?.("\x1b[13;2u");
         return false;
       }
-      if ((ev.metaKey || ev.ctrlKey) && !ev.altKey && !ev.shiftKey && ev.key === "Enter") {
+      // On a Mac only ⌘⏎ — Ctrl⏎ goes to the app (see fullscreenChord.ts).
+      if (isFullscreenChord(ev)) {
         if (ev.type === "keydown") onFullscreenRef.current();
         return false;
       }
+      if (isAppCtrlEnter(ev) && (kbdEnhancedRef.current || looksLikeClaude())) {
+        if (ev.type === "keydown") sendInputRef.current?.("\x1b[13;5u");
+        return false;
+      }
       if ((ev.metaKey || ev.ctrlKey) && !ev.altKey && !ev.shiftKey && ev.key === ".") {
         if (ev.type === "keydown") onUnfocusRef.current();
         return false;

package/hay/apps/web/src/utils/fullscreenChord.ts

@@ -0,0 +1,18 @@
+// The full-screen ⇄ wall chord inside a terminal. On a Mac it is ⌘⏎ only:
+// Ctrl⏎ belongs to the app (Claude Code binds it), and hop taking it meant
+// the keystroke never arrived. Elsewhere there is no ⌘, so Ctrl⏎ stays.
+export const IS_MAC = typeof navigator !== "undefined"
+  && /Mac|iPhone|iPad|iPod/.test(navigator.platform || navigator.userAgent || "");
+
+type Chord = { key: string; metaKey: boolean; ctrlKey: boolean; altKey: boolean; shiftKey: boolean };
+
+export function isFullscreenChord(ev: Chord, mac = IS_MAC): boolean {
+  if (ev.key !== "Enter" || ev.altKey || ev.shiftKey) return false;
+  return mac ? ev.metaKey && !ev.ctrlKey : ev.metaKey || ev.ctrlKey;
+}
+
+/** Ctrl⏎ passed to the app: CSI-u (13;5u), since xterm.js would send a bare \r. */
+export function isAppCtrlEnter(ev: Chord, mac = IS_MAC): boolean {
+  return ev.key === "Enter" && ev.ctrlKey && !ev.metaKey && !ev.altKey && !ev.shiftKey
+    && !isFullscreenChord(ev, mac);
+}

package/hay/apps/web/test/fullscreenChord.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, it } from "vitest";
+import { isAppCtrlEnter, isFullscreenChord } from "../src/utils/fullscreenChord";
+
+const key = (mods: Partial<{ metaKey: boolean; ctrlKey: boolean; altKey: boolean; shiftKey: boolean }>, k = "Enter") =>
+  ({ key: k, metaKey: false, ctrlKey: false, altKey: false, shiftKey: false, ...mods });
+
+describe("full-screen chord", () => {
+  it("on a Mac only ⌘⏎ toggles; Ctrl⏎ is the app's", () => {
+    expect(isFullscreenChord(key({ metaKey: true }), true)).toBe(true);
+    expect(isFullscreenChord(key({ ctrlKey: true }), true)).toBe(false);
+    expect(isAppCtrlEnter(key({ ctrlKey: true }), true)).toBe(true);
+  });
+  it("without ⌘ (Windows/Linux) Ctrl⏎ still toggles", () => {
+    expect(isFullscreenChord(key({ ctrlKey: true }), false)).toBe(true);
+    expect(isAppCtrlEnter(key({ ctrlKey: true }), false)).toBe(false);
+  });
+  it("other chords are untouched", () => {
+    expect(isFullscreenChord(key({ metaKey: true, shiftKey: true }), true)).toBe(false);
+    expect(isFullscreenChord(key({}), true)).toBe(false);
+    expect(isAppCtrlEnter(key({ ctrlKey: true }, "a"), true)).toBe(false);
+  });
+});

package/hop

@@ -802,7 +802,18 @@ async function withLifecycleLock(op, fn, { waitMs = 120_000, onWait } = {}) {
 }
 // Marker so the authenticator setup QR is only shown on first run (UX only; no auth logic).
 const AUTH_QR_SHOWN_FILE = path.join(HOME_DIR, '.auth_qr_shown');
-const HAY_HOST_READY_TIMEOUT_MS = parsePositiveIntEnv('HOP_HAY_HOST_READY_TIMEOUT_MS', 5000);
+// A keeper-backed host re-adopts every running terminal (replaying each
+// screen) BEFORE it opens its port. With 30 rooms that took ~8 s, then ~41 s
+// once one replay timed out (2026-10-12), so first a 5 s and then a 25 s
+// limit killed each new host mid-adoption and spawned the next — a restart
+// loop that left hop with no host, and took the daemon down with it ("Fatal:
+// Hay host did not open its port in time") while a `hop restore` was in
+// flight, which the CLI reported as "socket hang up". This is now a ceiling,
+// not the expected wait: the spawner keeps waiting while the host process is
+// alive (see waitForHayHostPort), gives up early only once it has died, and
+// refreshes the spawn lock as it waits so a rival spawner never mistakes a
+// long adoption for a stale lock.
+const HAY_HOST_READY_TIMEOUT_MS = parsePositiveIntEnv('HOP_HAY_HOST_READY_TIMEOUT_MS', 180000);
 const HAY_HOST_DISCOVERY_CACHE_MS = parsePositiveIntEnv('HOP_HAY_HOST_DISCOVERY_CACHE_MS', 10000);
 const HAY_HOST_HOME_HASH = crypto.createHash('sha256').update(path.resolve(HOME_DIR)).digest('hex').slice(0, 24);
 const HAY_HOST_HOME_FLAG = `--hop-home-hash=${HAY_HOST_HOME_HASH}`;
@@ -2733,6 +2744,20 @@ const CLAUDE_UI_RE = /bypass permissions on|shift\+tab to cycle|Welcome back|esc
 const TRUST_PROMPT_RE = /Quick\s*safety\s*check|Yes,?\s*I\s*trust\s*this\s*folder|Is\s*this\s*a\s*project\s*you\s*created\s*or\s*one\s*you\s*trust/i;
 // Trust-dialog reading lives in lib/trust-dialog.js so it can be unit-tested.
 const { trustDialogWorkspace, trustDialogAnswer, samePath } = require('./lib/trust-dialog.js');
+// The transport cloudflared uses to reach Cloudflare's edge. Its default is
+// QUIC (UDP): on networks that shape or drop UDP — campus networks often do —
+// a lost packet stalls every request in flight on that connection for a
+// retransmit timeout, and keystrokes from a phone or laptop arrive in
+// 1–3 s bursts while the host itself is idle (measured 2026-10-11: QUIC
+// connection 0 had 120 timeout losses; one request in four took 1.2–2.9 s).
+// "http2" runs the tunnel over TCP instead. Set `tunnel_protocol` in
+// ~/.hop2 config ("quic" | "http2" | "auto") or HOP_TUNNEL_PROTOCOL.
+function getTunnelProtocol() {
+    const raw = String(process.env.HOP_TUNNEL_PROTOCOL || getHopConfig().tunnel_protocol || '').toLowerCase();
+    return raw === 'quic' || raw === 'http2' || raw === 'auto' ? raw : null;
+}
+const tunnelProtocolLine = () => { const p = getTunnelProtocol(); return p ? `protocol: ${p}\n` : ''; };
+
 function getResumeMode() {
     const mode = String(getHopConfig().resume_mode || '').toLowerCase();
     return mode === 'summary' || mode === 'ask' ? mode : 'full';
@@ -6021,6 +6046,20 @@ function runShellProbe(command, cwd) {
 // agent-turn path has always sent them as separate writes; this is that.
 const sleepMs = (ms) => new Promise((r) => setTimeout(r, ms));
 // Is the message still sitting in the composer (the `›` line) — typed, not sent?
+/**
+ * Is this session's agent up and showing its own UI — the only thing a
+ * check-back may type into? Not running, a plain shell, a trust or resume
+ * dialog, or an unreadable screen are all "no".
+ */
+async function agentScreenReady(entry) {
+    if (!entry || entry.live !== true) return { ok: false, reason: 'waiting: the session is not running' };
+    const verdict = await roomIsRedoable(entry);
+    // roomIsRedoable says "not redoable, and here is whether the agent is
+    // idle" exactly when an agent's UI owns the screen.
+    if (!verdict.ok && verdict.agentIdle !== undefined) return { ok: true };
+    return { ok: false, reason: `waiting: no agent on screen (${verdict.reason})` };
+}
+
 async function composerStillHolds(internalName, message) {
     try {
         const hostRes = await callExternalHayHostApi(`/rooms/${encodeURIComponent(internalName)}/serialized`);
@@ -6100,6 +6139,17 @@ async function runCheckbackSweep() {
                     continue;
                 }
                 if (!checkbacks.mayDeliver(cb, ctx)) continue; // mid-turn: next sweep
+                // Type only into a RUNNING agent. Attaching to a stopped
+                // session creates its room — as a bare shell — and the
+                // message then ran as shell commands ("zsh: command not
+                // found: Collect"); worse, that shell made restore think the
+                // session was up and skip it (surf, alphagenome, 2026-10-12
+                // after a reboot). Wait until the agent's own UI is on screen.
+                const ready = await agentScreenReady(entry);
+                if (!ready.ok) {
+                    if (cb.lastError !== ready.reason) { cb.lastError = ready.reason; dirty = true; }
+                    continue;
+                }
                 const e2 = await attachTerminalApiClient(cb.session, entry.displayName || cb.session, { actor: 'system', label: 'checkback', typeOnly: true });
                 try { await typeAndSubmit(e2, cb.session, cb.message); }
                 finally { try { closeTerminalApiEntry(e2.id); } catch (e) { /* closed */ } }
@@ -6384,8 +6434,13 @@ function rebuildClaudeLaunch(launchCmd) {
             if (!valued && out.includes(t)) continue;
             out.push(t);
             if (valued) out.push(tokens[++i]);
+            continue;
         }
-        // bare positional (initial prompt) — dropped
+        // A bare positional is the initial PROMPT, and everything after it
+        // is prompt text too — split on spaces, its words included things
+        // like "--source-ref" and "-q", which were kept as flags and made
+        // claude exit at once on every restore (pulse-1004-claude-o3).
+        break;
     }
     return out.join(' ');
 }
@@ -6965,6 +7020,7 @@ async function restoreSavedSessionsUnlocked({ dryRun = false, includeAgents = fa
         const { resolved, unknown } = resolveRestoreTargets(only, snapshot);
         for (const name of unknown) skipped.push({ name, reason: 'no such session' });
         onlySet = resolved;
+        let closedAny = false;
         for (const internalName of resolved) {
             if (!live.has(internalName)) continue;
             const entry = snapshot.entries.find((e) => e.internalName === internalName);
@@ -6999,7 +7055,13 @@ async function restoreSavedSessionsUnlocked({ dryRun = false, includeAgents = fa
             }
             log(`  ${display}: closed the ${verdict.reason} left by the last restore`, DIM);
             live.delete(internalName);
+            closedAny = true;
         }
+        // The keeper ends the old terminal a beat AFTER the room closes. A
+        // relaunch inside that beat was refused ("already running"), and
+        // then the old one exited too — both sessions vanished (alphagenome,
+        // angler-codex-claude-codex, 2026-10-12). Let the old ones go first.
+        if (closedAny) await new Promise((r) => setTimeout(r, 2000));
     }
     const candidates = snapshot.entries.filter((e) => e && e.type === 'terminal' && !live.has(e.internalName));
     // Primary source: the SessionStart-hook records. Add any recorded session that
@@ -9655,6 +9717,27 @@ async function stopExternalHayHostProcess(hostState, timeoutMs = 1500) {
     return !isProcessAlive(pid);
 }
 
+// Wait for a freshly spawned host to open its port. Adopting a big fleet from
+// the pty-keeper can take a minute or more, so the wait is bounded by the
+// host's LIFE first and the ceiling second: a host that dies returns at once
+// instead of burning the whole ceiling, and one still working keeps the spawn
+// lock's mtime fresh so a concurrent spawner (30 s staleness rule) never calls
+// the lock stale and starts a rival host mid-adoption.
+async function waitForHayHostPort(started, ceilingMs) {
+    const deadline = Date.now() + ceilingMs;
+    let lastLockTouch = 0;
+    while (Date.now() < deadline) {
+        if (await waitForPort(started.port, '127.0.0.1', 1000, 120)) return true;
+        if (!isProcessAlive(started.pid)) return false;
+        if (Date.now() - lastLockTouch > 5000) {
+            lastLockTouch = Date.now();
+            const now = new Date();
+            try { fs.utimesSync(HAY_HOST_SPAWN_LOCK, now, now); } catch (e) { /* lock gone — nothing to refresh */ }
+        }
+    }
+    return false;
+}
+
 function markExternalHayHostResponsive(host) {
     const recovered = hayHostProbeFailures.recordSuccess(Number(host?.pid));
     if (recovered) {
@@ -9781,6 +9864,9 @@ async function ensureExternalHayHostReadyOnce() {
                 if (spawned && isProcessAlive(spawned.pid) && await probeExternalHayHostFromHost(spawned, 1500)) {
                     return markExternalHayHostResponsive(spawned);
                 }
+                // The winner releases the lock on success and failure alike;
+                // once it is gone there is nothing left to wait for.
+                if (!fs.existsSync(HAY_HOST_SPAWN_LOCK)) break;
             }
             // Winner never delivered — fall through and spawn ourselves.
         }
@@ -9866,10 +9952,13 @@ async function ensureExternalHayHostReadyOnce() {
         throw new Error(`Hay host failed to start; see ${hayHostLogFile}`);
     }
 
-    const ready = await waitForPort(started.port, '127.0.0.1', HAY_HOST_READY_TIMEOUT_MS, 120);
+    const ready = await waitForHayHostPort(started, HAY_HOST_READY_TIMEOUT_MS);
     if (!ready) {
+        const died = !isProcessAlive(started.pid);
         await stopExternalHayHostProcess(started);
-        throw new Error(`Hay host did not open its port in time; see ${hayHostLogFile}`);
+        throw new Error(died
+            ? `Hay host (pid ${started.pid}) exited before opening its port; see ${hayHostLogFile}`
+            : `Hay host did not open its port within ${Math.round(HAY_HOST_READY_TIMEOUT_MS / 1000)}s (still adopting its terminals? HOP_HAY_HOST_READY_TIMEOUT_MS raises the ceiling); see ${hayHostLogFile}`);
     }
     const healthy = await probeExternalHayHostFromHost(started, 1500);
     if (!healthy) {
@@ -13320,7 +13409,11 @@ happens until someone clicks it.
                     const result = await restoreSavedSessions({
                         dryRun: parsed.dryRun === true,
                         includeAgents: parsed.includeAgents === true,
-                        only: Array.isArray(parsed.only) ? parsed.only.filter((n) => typeof n === 'string').slice(0, 200) : null
+                        only: Array.isArray(parsed.only) ? parsed.only.filter((n) => typeof n === 'string').slice(0, 200) : null,
+                        // Restart named agents that sit idle at their prompt
+                        // (never one mid-turn) — e.g. one resumed the wrong
+                        // conversation. Only together with `only`.
+                        replaceIdleAgent: parsed.replaceIdleAgent === true && Array.isArray(parsed.only)
                     });
                     res.writeHead(200, { 'Content-Type': 'application/json' });
                     res.end(JSON.stringify(result));
@@ -14497,7 +14590,24 @@ happens until someone clicks it.
                         return;
                     }
                     await reconcileExternalRuntimeSessions();
-                    await ensureExternalRuntimeSession(sessionName, sessionConfig?.cwd, getSessionDisplayName(sessionName), {
+                    // A dead session that holds an agent conversation comes
+                    // back AS that agent, whoever opens it — a viewer, a
+                    // check-back, a tile. Creating a bare shell here left
+                    // surf a zsh prompt after a reboot (a check-back's attach
+                    // beat restore by two seconds, and restore then skipped
+                    // the "running" session). Same plan restore would use.
+                    let revive = null;
+                    if (!sessionConfig?.startup && !(await runtimeTerminalSessionExists(sessionName))) {
+                        try {
+                            const plan = restorePlanForSession({ internalName: sessionName, cwd: sessionConfig?.cwd, startup: sessionConfig?.startup, autoStart: sessionConfig?.autoStart });
+                            if (plan?.command) {
+                                revive = plan;
+                                log(`[ws] ${sessionName}: not running — starting it as its agent (${plan.command.slice(0, 80)})`, DIM);
+                            }
+                        } catch (e) { /* no plan: a plain shell, as before */ }
+                    }
+                    await ensureExternalRuntimeSession(sessionName, revive?.cwd || sessionConfig?.cwd, getSessionDisplayName(sessionName), {
+                        command: revive?.command || undefined,
                         shell: sessionConfig?.shell,
                         env: sessionConfig?.env,
                         cols: sessionConfig?.cols,
@@ -14729,7 +14839,7 @@ function startTunnel(isRestart = false) {
         const tunnelConfig = `
 url: http://${localTunnelHost}:${PROXY_PORT}
 tunnel: ${domainConfig.tunnelName}
-`;
+${tunnelProtocolLine()}`;
         writePrivateFile(tunnelConfigPath, tunnelConfig);
 
         const runArgs = ['tunnel', '--config', tunnelConfigPath, 'run'];
@@ -14907,7 +15017,7 @@ function startClientTunnel(isRestart = false) {
 url: http://127.0.0.1:${PROXY_PORT}
 tunnel: ${tunnelId}
 credentials-file: ${path.resolve(credentialsPath)}
-`;
+${tunnelProtocolLine()}`;
     writePrivateFile(tunnelConfigPath, tunnelConfig);
 
     const tunnel = spawn('cloudflared', ['tunnel', '--config', tunnelConfigPath, 'run'], {
@@ -17487,7 +17597,13 @@ async function main() {
         try {
             res = await callLocalApi(state, '/api/sessions/restore', 'POST', { dryRun, includeAgents, only: only.length ? only : undefined });
         } catch (e) {
-            log(`Restore request failed: ${e.message}`, RED);
+            // "socket hang up" here means the daemon closed the connection
+            // without answering: it was restarted, or died (e.g. its host
+            // never came up), while the restore was in flight. Nothing about
+            // the restore itself failed, so say what to do next.
+            const gone = !isServerRunning();
+            log(`Restore request failed: ${e.message}${gone ? ' — the daemon went away mid-request' : ''}.`, RED);
+            log(`  ${DIM}Check ${CYAN}hop logs${RESET}${DIM} (look for "Fatal:" or "Cleaning up"), then run ${CYAN}hop restore${RESET}${DIM} again — it only recreates sessions that are not running.${RESET}`, RESET);
             process.exit(1);
         }
         if (!res || res.status < 200 || res.status >= 300) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hop2",
-  "version": "0.11.75",
+  "version": "0.11.77",
   "description": "🐰 Hop into your terminal from anywhere. Secure remote shell access with 2FA via Cloudflare Tunnel. Next-gen rewrite with native terminal sharing.",
   "main": "hop",
   "bin": {

package/scripts/codex-notify-hook.js

@@ -38,7 +38,17 @@ function turnsDir() {
 // thread is the truth: if another session's turn record already names this
 // root thread, the turn is that session's. (hop launches codex without the
 // daemon now; this keeps the sessions that predate the change honest.)
+//
+// Retired (2026-10-12): every codex hop launches now carries its own session
+// in the per-thread overrides (lib/codex-identity.js), so HOP_SESSION is the
+// truth — and the "another record already names this thread" rule did harm:
+// once a record held the wrong thread, every later turn of that thread was
+// filed there for good. The hand-off session angler-codex-claude-codex lost
+// its whole conversation to angler-codex that way, and after a reboot
+// angler-codex resumed the hand-off's thread instead of its own. Kept only
+// for a launch with no session in its environment.
 function resolveHopSession(dir, rootId, envSession) {
+  if (envSession) return envSession;
   if (!rootId) return envSession;
   let names = [];
   try { names = fs.readdirSync(dir).filter((f) => f.endsWith(".turn")); } catch { return envSession; }
@@ -58,7 +68,9 @@ function resolveHopSession(dir, rootId, envSession) {
 // file — a long thread's rollout runs to hundreds of MB. Any failure leaves
 // the id as given; hop resolves it again at restore time.
 function findRollout(id) {
-  const root = path.join(os.homedir(), ".codex", "sessions");
+  // The account's own root: a session running as another Codex login keeps
+  // its rollouts under that CODEX_HOME.
+  const root = path.join(process.env.CODEX_HOME || path.join(os.homedir(), ".codex"), "sessions");
   const walk = (dir, depth) => {
     let names = [];
     try { names = fs.readdirSync(dir, { withFileTypes: true }); } catch { return null; }
@@ -101,14 +113,24 @@ function bumpTurn(payload) {
   const rawThread = (payload && typeof payload["thread-id"] === "string") ? payload["thread-id"]
              : (payload && typeof payload.thread_id === "string") ? payload.thread_id
              : (payload && typeof payload.session_id === "string") ? payload.session_id : null;
-  const rootId = rootThreadId(rawThread);
+  let rootId = rootThreadId(rawThread);
   const hopSession = resolveHopSession(dir, rootId, envSession);
   const file = path.join(dir, `${hopSession}.turn`);
   let count = 0;
+  let prev = null;
   try {
-    const prev = JSON.parse(fs.readFileSync(file, "utf8"));
+    prev = JSON.parse(fs.readFileSync(file, "utf8"));
     if (prev && Number.isInteger(prev.count) && prev.count >= 0) count = prev.count;
   } catch { /* missing/corrupt -> start at 0 */ }
+  // A thread Codex never saved cannot be the conversation. Codex's helper
+  // threads (the approval "guardian", among others) finish turns and notify
+  // like any other, but have no rollout — recording one replaced the real
+  // thread, and restore then had nothing to resume (alphagenome came back a
+  // bare shell). Keep the saved thread already on record.
+  if (rootId && !findRollout(rootId) && prev && typeof prev.sessionId === "string"
+      && prev.sessionId !== rootId && findRollout(prev.sessionId)) {
+    rootId = prev.sessionId;
+  }
   const rec = JSON.stringify({
     // The thread id is the conversation (and the rollout file's name); the
     // turn id names one turn and matches nothing on disk. With multi-agent

package/scripts/hay-host.js

@@ -91,10 +91,19 @@ function loadViewerColors(hay) {
         if (typeof hay.setDefaultViewerColors === 'function') hay.setDefaultViewerColors(saved.bg, saved.fg);
     } catch (e) { /* none yet: the dark default */ }
 }
+// Compared against what is on disk, not setDefaultViewerColors' "changed":
+// room.setClientColors already updates the defaults before this runs, so
+// that always said "unchanged" and the file was never written — every host
+// restart went back to the dark default (Codex's charcoal composer).
+let savedViewerColors = null;
 function rememberViewerColors(hay, bg, fg) {
     if (typeof hay.setDefaultViewerColors !== 'function') return;
-    if (!hay.setDefaultViewerColors(bg, fg)) return;
-    try { fs.writeFileSync(VIEWER_COLORS_FILE, JSON.stringify(hay.getDefaultViewerColors())); } catch (e) { /* best effort */ }
+    hay.setDefaultViewerColors(bg, fg);
+    const json = JSON.stringify(hay.getDefaultViewerColors());
+    if (savedViewerColors === null) { try { savedViewerColors = fs.readFileSync(VIEWER_COLORS_FILE, 'utf8'); } catch (e) { savedViewerColors = ''; } }
+    if (json === savedViewerColors) return;
+    try { fs.writeFileSync(VIEWER_COLORS_FILE, json); savedViewerColors = json; } catch (e) { /* best effort */ }
+}
 const CLAUDE_SESSIONS_DIR = path.join(HOP_HOME, 'claude-sessions');
 
 // Scrub Claude Code SESSION markers from our environment before any PTY is
@@ -153,9 +162,29 @@ const watchedRooms = new WeakSet();
 // restore <name>`): their records must survive the close, exactly as they
 // survive a host shutdown. Consumed once, on the next session_end.
 const preserveRecordsOnClose = new Set();
+// Each room's terminal modes (Room.modePrefix), saved as they change so a
+// re-adopted room starts in them: an app turns alternate screen and mouse
+// reporting on once, at startup, which a bounded replay no longer holds.
+const ROOM_MODES_DIR = path.join(HOP_HOME, 'room-modes');
+const roomModesFile = (id) => path.join(ROOM_MODES_DIR, `${id}.modes`);
+function loadRoomModes(id) {
+    if (!/^[A-Za-z0-9_.-]+$/.test(String(id || ''))) return '';
+    try { return fs.readFileSync(roomModesFile(id), 'utf8'); } catch (e) { return ''; }
+}
+function saveRoomModes(id, prefix) {
+    try {
+        if (!prefix) { fs.unlinkSync(roomModesFile(id)); return; }
+        fs.mkdirSync(ROOM_MODES_DIR, { recursive: true });
+        fs.writeFileSync(roomModesFile(id), prefix);
+    } catch (e) { /* best effort */ }
+}
 function watchRoomEnd(room) {
     if (!room || typeof room.on !== 'function' || watchedRooms.has(room)) return room;
     watchedRooms.add(room);
+    if (/^[A-Za-z0-9_.-]+$/.test(String(room.id || ''))) {
+        room.on('modes', (prefix) => saveRoomModes(String(room.id), String(prefix || '')));
+        if (typeof room.modePrefix === 'function') saveRoomModes(String(room.id), room.modePrefix());
+    }
     room.on('session_end', () => {
         if (shuttingDown) return;
         const id = String(room.id || '');
@@ -168,6 +197,7 @@ function watchRoomEnd(room) {
         // request to forget its conversation; that is an explicit delete's
         // job, daemon-side.
         try { fs.unlinkSync(path.join(BUFFER_DIR, `${id}.raw`)); } catch (e) { /* best effort */ }
+        try { fs.unlinkSync(roomModesFile(id)); } catch (e) { /* best effort */ }
     });
     return room;
 }

package/tests/codex-notify-hook.unit.test.cjs

@@ -10,10 +10,15 @@ const HOOK = path.join(__dirname, '..', 'scripts', 'codex-notify-hook.js');
 const freshHome = () => {
   const home = fs.mkdtempSync(path.join(os.tmpdir(), 'hop-codex-hook-'));
   fs.mkdirSync(path.join(home, 'claude-sessions'), { recursive: true });
+  fs.mkdirSync(path.join(home, 'codex', 'sessions', '2026', '10', '12'), { recursive: true });
   return home;
 };
+// A thread Codex saved has a rollout file named after it.
+const saveRollout = (home, id) => fs.writeFileSync(
+  path.join(home, 'codex', 'sessions', '2026', '10', '12', `rollout-2026-10-12T00-00-00-${id}.jsonl`),
+  JSON.stringify({ type: 'session_meta', payload: { id } }) + '\n');
 const run = (home, session, payload) => execFileSync(process.execPath, [HOOK, JSON.stringify(payload)], {
-  env: { ...process.env, HOP_HOME: home, HOP_SESSION: session }
+  env: { ...process.env, HOP_HOME: home, HOP_SESSION: session, CODEX_HOME: path.join(home, 'codex') }
 });
 const turn = (home, name) => { try { return JSON.parse(fs.readFileSync(path.join(home, 'claude-sessions', `${name}.turn`), 'utf8')); } catch { return null; } };
 
@@ -25,19 +30,30 @@ test('a turn is counted against HOP_SESSION when no other session claims the thr
   assert.equal(turn(home, 'alpha').agent, 'codex');
 });
 
-test("under a shared daemon the environment lies: the session whose record already names the thread gets the turn", () => {
+test('the turn belongs to the session it ran in, even when another record names the thread', () => {
+  // Retired rule: "a record already naming this thread owns it" filed the
+  // hand-off session's turns under angler-codex for good. Every hop launch
+  // now carries its own session, so the environment is the truth.
   const home = freshHome();
-  fs.writeFileSync(path.join(home, 'claude-sessions', 'surf.turn'), JSON.stringify({ sessionId: 'thread-S', count: 4, at: '2026-09-28T22:46:53.450Z', agent: 'codex' }));
-  fs.writeFileSync(path.join(home, 'claude-sessions', 'owner.turn'), JSON.stringify({ sessionId: 'thread-O', count: 9, at: '2026-09-29T20:00:00.000Z', agent: 'codex' }));
-  // The daemon runs notify with HOP_SESSION=owner, for surf's thread.
-  run(home, 'owner', { type: 'agent-turn-complete', 'thread-id': 'thread-S', 'turn-id': 't2' });
-  assert.equal(turn(home, 'surf').count, 5, 'surf got its turn');
-  assert.equal(turn(home, 'surf').sessionId, 'thread-S');
-  assert.equal(turn(home, 'owner').count, 9, 'the owner was not credited with it');
-  assert.equal(turn(home, 'owner').sessionId, 'thread-O', "and the owner's own thread id was not overwritten");
-  // The owner's own turn still lands on the owner.
-  run(home, 'owner', { type: 'agent-turn-complete', 'thread-id': 'thread-O', 'turn-id': 't3' });
-  assert.equal(turn(home, 'owner').count, 10);
+  saveRollout(home, 'thread-H'); saveRollout(home, 'thread-A');
+  fs.writeFileSync(path.join(home, 'claude-sessions', 'angler.turn'), JSON.stringify({ sessionId: 'thread-H', count: 9, at: '2026-10-09T00:00:00.000Z', agent: 'codex' }));
+  run(home, 'handoff', { type: 'agent-turn-complete', 'thread-id': 'thread-H', 'turn-id': 't1' });
+  assert.equal(turn(home, 'handoff').sessionId, 'thread-H');
+  assert.equal(turn(home, 'handoff').count, 1);
+  assert.equal(turn(home, 'angler').count, 9, 'the other record is left alone');
+});
+
+test("a thread Codex never saved (a helper like the approval guardian) does not replace the session's conversation", () => {
+  const home = freshHome();
+  saveRollout(home, 'thread-main');
+  run(home, 'alpha', { type: 'agent-turn-complete', 'thread-id': 'thread-main', 'turn-id': 't1' });
+  run(home, 'alpha', { type: 'agent-turn-complete', 'thread-id': 'thread-guardian', 'turn-id': 't2' });
+  assert.equal(turn(home, 'alpha').sessionId, 'thread-main', 'still the saved thread');
+  assert.equal(turn(home, 'alpha').count, 2, 'the turn still counts');
+  // A NEW saved thread (the person started over) does take over.
+  saveRollout(home, 'thread-next');
+  run(home, 'alpha', { type: 'agent-turn-complete', 'thread-id': 'thread-next', 'turn-id': 't3' });
+  assert.equal(turn(home, 'alpha').sessionId, 'thread-next');
 });
 
 test('other event types count nothing', () => {