hop2 0.11.82 → 0.11.83

package/hay/apps/web/src/App.tsx

@@ -88,10 +88,12 @@ const getLocationRoom = () => {
 
 const buildSessionPath = (sessionName: string) => `/s/${encodeURIComponent(sessionName)}/`;
 
-const resolveWsUrl = () => {
-  // On the machine hop runs on, terminal sockets skip the tunnel.
-  const local = localWsBase();
-  if (local) return local;
+// On the machine hop runs on, terminal sockets skip the tunnel.
+const resolveWsUrl = () => localWsBase() ?? resolveTunnelWsUrl();
+
+// The page's own socket url. Wall tiles and panes take this and choose the
+// fast path per connect (currentWsBase), so a dead fast path never strands them.
+const resolveTunnelWsUrl = () => {
   // Check for hop session config (when embedded in hop)
   const hopSession = (window as unknown as { __HOP_SESSION__?: { wsUrl?: string } }).__HOP_SESSION__;
   if (hopSession?.wsUrl) {
@@ -4350,7 +4352,7 @@ const App = () => {
             }}
             onRefresh={() => fetchSessions({ showLoading: false })}
             onNotice={showToast}
-            tileWsBase={resolveWsUrl()}
+            tileWsBase={resolveTunnelWsUrl()}
             onOpenViews={(scope, item) => setViewsOpen({ session: scope, item })}
             onOpenCheckbacks={(scope) => setCheckbacksOpen(scope)}
             userName={name}
@@ -4975,7 +4977,7 @@ const App = () => {
                     <SecondaryPane
                       sessionName={leaf.session as string}
                       procLabel={paneProc === "zsh" || paneProc === "bash" ? "" : paneProc}
-                      wsUrl={resolveWsUrl()}
+                      wsUrl={resolveTunnelWsUrl()}
                       userName={name}
                       cols={120}
                       rows={30}
@@ -5015,7 +5017,7 @@ const App = () => {
             }}
             onRefresh={() => fetchSessions({ showLoading: false })}
             onNotice={showToast}
-            tileWsBase={resolveWsUrl()}
+            tileWsBase={resolveTunnelWsUrl()}
             onFocusSession={focusSessionInPlace}
             folders={folders}
             onOpenViews={(scope, item) => setViewsOpen({ session: scope, item })}

package/hay/apps/web/src/components/SecondaryPane.tsx

@@ -8,6 +8,7 @@ import { PaneButtons, PaneIcon, type DragHandle } from "./PaneLayout";
 import { enableMathHover } from "../utils/mathLinkProvider";
 import { getMathTip } from "../utils/mathTooltip";
 import type { Side } from "../utils/paneTree";
+import { currentWsBase, noteSocketClosed } from "../utils/localLink";
 
 // A lightweight additional pane: its own WS attach + xterm for one session,
 // typing forwarded when focused. A FOCUSED pane claims its box size (crisp
@@ -115,14 +116,17 @@ export const SecondaryPane = ({
     };
 
     const connect = () => {
-      const sep = wsUrl.includes("?") ? "&" : "?";
-      const ws = new WebSocket(
-        `${wsUrl}${sep}room=${encodeURIComponent(sessionName)}&name=${encodeURIComponent(userName + " (pane)")}` +
-          `&cols=${sizeRef.current.cols}&rows=${sizeRef.current.rows}`
-      );
+      // The fast path while it works, else the tunnel url this pane was given.
+      const base = currentWsBase(wsUrl);
+      const sep = base.includes("?") ? "&" : "?";
+      const url = `${base}${sep}room=${encodeURIComponent(sessionName)}&name=${encodeURIComponent(userName + " (pane)")}` +
+          `&cols=${sizeRef.current.cols}&rows=${sizeRef.current.rows}`;
+      const ws = new WebSocket(url);
       wsRef.current = ws;
       showConnecting();
+      let opened = false;
       ws.onopen = () => {
+        opened = true;
         everConnected = true;
         attempt = 0; // a healed link earns a fresh immediate retry next time
         window.clearTimeout(chromeTimer);
@@ -167,6 +171,7 @@ export const SecondaryPane = ({
         }
       };
       ws.onclose = () => {
+        noteSocketClosed(url, opened);
         if (!shouldReconnect) return;
         showConnecting();
         // Immediate first retry: most drops are a tunnel blip that has

package/hay/apps/web/src/components/SessionSwitcher.tsx

@@ -39,6 +39,7 @@ import {
 import { scanKeyboardProtocol } from "../utils/keyboardProtocol";
 import { isAppCtrlEnter, isFullscreenChord } from "../utils/fullscreenChord";
 import { chipWhen } from "../utils/checkbackText";
+import { currentWsBase, noteSocketClosed } from "../utils/localLink";
 import { DigestCard } from "./DigestCard";
 import { hasUnseenViews, loadViewsSeen } from "./ViewsPanel";
 
@@ -839,11 +840,12 @@ const LiveTile = ({ wsBase, room, userName, theme, live, deliberate, claudeApp,
       return;
     }
     lastClaimRef.current = { cols: dims.cols, rows: dims.rows, at: performance.now() };
-    const sep = wsBase.includes("?") ? "&" : "?";
+    const base = currentWsBase(wsBase);
+    const sep = base.includes("?") ? "&" : "?";
     // Claim-only socket: no replay, closed as soon as the claim is sent. The
     // watch poll then repaints at the new size.
     const sock = new WebSocket(
-      wsBase + sep + "room=" + encodeURIComponent(room)
+      base + sep + "room=" + encodeURIComponent(room)
       + "&name=" + encodeURIComponent((userName || "user") + " (wall)")
       + "&source=monitor&replay=0&cols=" + dims.cols + "&rows=" + dims.rows
     );
@@ -970,10 +972,11 @@ const LiveTile = ({ wsBase, room, userName, theme, live, deliberate, claudeApp,
     // plenty, and preview → live becomes the SAME renderer painting the same
     // bytes at the same geometry. Full screen keeps WebGL.
     setConn("live");
-    const sep = wsBase.includes("?") ? "&" : "?";
-    const wsUrl = () =>
-      wsBase + sep + "room=" + encodeURIComponent(room) + "&name=" + encodeURIComponent(userName || "user")
+    const wsUrl = () => {
+      const base = currentWsBase(wsBase);
+      return base + (base.includes("?") ? "&" : "?") + "room=" + encodeURIComponent(room) + "&name=" + encodeURIComponent(userName || "user")
       + "&replay=65536&nudge=0&cols=" + term.cols + "&rows=" + term.rows;
+    };
     let ws: WebSocket | null = null;
     let disposed = false;
     let reconnectTimer = 0;
@@ -1030,9 +1033,12 @@ const LiveTile = ({ wsBase, room, userName, theme, live, deliberate, claudeApp,
       if (disposed) return;
       window.clearTimeout(reconnectTimer);
       if (ws) { try { ws.close(); } catch { /* replacing */ } }
-      const sock = new WebSocket(wsUrl());
+      const url = wsUrl();
+      const sock = new WebSocket(url);
       ws = sock;
+      let opened = false;
       sock.onopen = () => {
+        opened = true;
         if (disposed || ws !== sock) return;
         reconnectAttempt = 0;
         markLive();
@@ -1091,6 +1097,7 @@ const LiveTile = ({ wsBase, room, userName, theme, live, deliberate, claudeApp,
         } catch { /* non-JSON frame */ }
       };
       sock.onclose = () => {
+        noteSocketClosed(url, opened);
         if (disposed || ws !== sock) return;
         scheduleReconnect();
       };
@@ -2397,9 +2404,10 @@ export const SessionSwitcher = ({
     if (session.type !== "port" && !session.active && interactiveTiles && tileWsBase) {
       const key = sessionKey(session);
       try {
-        const sep = tileWsBase.includes("?") ? "&" : "?";
+        const base = currentWsBase(tileWsBase);
+        const sep = base.includes("?") ? "&" : "?";
         const kick = new WebSocket(
-          tileWsBase + sep + "room=" + encodeURIComponent(key)
+          base + sep + "room=" + encodeURIComponent(key)
           + "&name=" + encodeURIComponent((userName || "user") + " (start)")
           + "&replay=0&nudge=0&cols=80&rows=24"
         );

package/hay/apps/web/src/utils/localLink.ts

@@ -11,12 +11,19 @@
 // services on this device"); the probe waits while that prompt is up. It runs
 // beside the tunnel connection, so waiting costs nothing.
 const PROBE_TIMEOUT_MS = 120_000;
-const RETRY_AFTER_FAILURE_MS = 30_000;
+// After the fast path drops (almost always a daemon restart, which takes a
+// few seconds), look again soon and back off: 1 s, 2 s, 4 s … 30 s, then
+// stop until the next drop. A flat 30 s left a tab on the slow tunnel and
+// then yanked it back with a second reconnect half a minute later.
+const RETRY_BASE_MS = 1_000;
+const RETRY_MAX_MS = 30_000;
+const RETRY_LIMIT = 10;
 const OPT_OUT_KEY = "hop.localLink"; // "off" disables the fast path in this browser
 
 let localBase: string | null = null;
 let probing = false;
 let retryTimer = 0;
+let retries = -1; // -1: the fast path never worked here, so a failure is final
 let onFound: (() => void) | null = null;
 
 export const isLocalLinkUrl = (url: string) => /^ws:\/\/127\.0\.0\.1:\d+\//.test(url);
@@ -25,6 +32,19 @@ export const isLocalLinkUrl = (url: string) => /^ws:\/\/127\.0\.0\.1:\d+\//.test
 // or null to use the page's host.
 export const localWsBase = () => localBase;
 
+// The base a socket should dial NOW: the fast path while it works, else the
+// tunnel base it was given. Wall tiles and panes ask on every (re)connect —
+// holding the fast-path url from their first render, they kept redialing it
+// after it died (a daemon restart, a lapsed ticket) and only full screen,
+// which falls back, could connect.
+export const currentWsBase = (tunnelBase: string) => localBase ?? tunnelBase;
+
+// Any terminal socket that closed: one dialed on the fast path that never
+// opened means the fast path is down for every socket on the page.
+export function noteSocketClosed(url: string, opened: boolean) {
+  if (!opened && isLocalLinkUrl(url)) localLinkFailed();
+}
+
 export function localLinkEligible(
   loc: { protocol: string; hostname: string } = window.location,
   ua: string = navigator.userAgent,
@@ -64,9 +84,18 @@ function probe(port: number, ticket: string): Promise<boolean> {
   });
 }
 
+function scheduleRetry() {
+  if (retries < 0 || retries >= RETRY_LIMIT) return;
+  const delay = Math.min(RETRY_BASE_MS * 2 ** retries, RETRY_MAX_MS);
+  retries += 1;
+  window.clearTimeout(retryTimer);
+  retryTimer = window.setTimeout(() => void attempt(), delay);
+}
+
 async function attempt() {
   if (probing || localBase) return;
   probing = true;
+  let found = false;
   try {
     const res = await fetch("/api/local-link", { credentials: "same-origin", cache: "no-store" });
     if (!res.ok) return;
@@ -74,11 +103,14 @@ async function attempt() {
     if (!Number.isInteger(body.port) || typeof body.ticket !== "string") return;
     if (!(await probe(body.port as number, body.ticket))) return;
     localBase = `ws://127.0.0.1:${body.port}/ws?token=${encodeURIComponent(body.ticket)}`;
+    found = true;
+    retries = 0;
     onFound?.();
   } catch {
     /* no fast path; the tunnel works as before */
   } finally {
     probing = false;
+    if (!found) scheduleRetry();
   }
 }
 
@@ -90,12 +122,11 @@ export function startLocalLink(found: () => void) {
   void attempt();
 }
 
-// A terminal socket to the fast path closed before it opened (the daemon
-// restarted and forgot the ticket, or it stopped): use the tunnel, and look
-// again a little later with a fresh ticket.
+// A terminal socket to the fast path closed before it opened (the daemon is
+// restarting, or stopped): use the tunnel meanwhile, and look again shortly.
 export function localLinkFailed() {
   if (!localBase) return;
   localBase = null;
-  window.clearTimeout(retryTimer);
-  retryTimer = window.setTimeout(() => void attempt(), RETRY_AFTER_FAILURE_MS);
+  retries = 0;
+  scheduleRetry();
 }

package/hay/apps/web/test/localLink.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { isLocalLinkUrl, localLinkEligible } from "../src/utils/localLink";
+import { currentWsBase, isLocalLinkUrl, localLinkEligible, noteSocketClosed } from "../src/utils/localLink";
 
 const MAC = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0 Safari/537.36";
 const IPHONE = "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148";
@@ -21,4 +21,10 @@ describe("same-machine fast path", () => {
     expect(isLocalLinkUrl("ws://127.0.0.1:13575/ws?token=ll_x&room=a")).toBe(true);
     expect(isLocalLinkUrl("wss://hop.zhoulab.io/ws?room=a")).toBe(false);
   });
+  it("hands tiles the tunnel base while there is no fast path", () => {
+    expect(currentWsBase("wss://hop.zhoulab.io/ws")).toBe("wss://hop.zhoulab.io/ws");
+    // A tunnel socket that never opened says nothing about the fast path.
+    noteSocketClosed("wss://hop.zhoulab.io/ws?room=a", false);
+    expect(currentWsBase("wss://hop.zhoulab.io/ws")).toBe("wss://hop.zhoulab.io/ws");
+  });
 });

package/hop

@@ -976,6 +976,18 @@ ensurePrivateDir(LOG_DIR);
 ensurePrivateDir(WORKSPACES_DIR);
 ensurePrivateDir(RUNTIME_DATA_DIR);
 
+// A session name made from free text (a Codex thread title, a display name
+// from before names were checked): runs of anything outside the name
+// alphabet become one dash, accents fold to their letters, and an empty
+// result falls back. "Find grant opportunities and draft" →
+// "Find-grant-opportunities-and-draft".
+function sessionNameFromText(text, fallback = 'session', max = 40) {
+    const slug = String(text || '').normalize('NFKD').replace(/[\u0300-\u036f]/g, '')
+        .replace(/[^A-Za-z0-9_-]+/g, '-').replace(/-{2,}/g, '-').replace(/^[-_]+|[-_]+$/g, '')
+        .slice(0, max).replace(/[-_]+$/, '');
+    return slug || fallback;
+}
+
 function toInternalSessionName(displayName) {
     if (!displayName || typeof displayName !== 'string') return null;
     if (!SESSION_NAME_RE.test(displayName)) return null;
@@ -1422,7 +1434,11 @@ function isDisplayNameInUse(displayName) {
 // the internal name so it always renames the session the user clicked.
 function renameSessionDisplayName(oldDisplayName, newDisplayName, explicitInternalName) {
     const resolvedOldDisplayName = resolveDisplayNameAlias(oldDisplayName);
-    if (!SESSION_NAME_RE.test(resolvedOldDisplayName)) {
+    // A session addressed by its internal name can always be renamed — that
+    // is how one carrying a malformed old name (spaces, from a Codex title)
+    // gets a valid one.
+    const explicitOk = !!(explicitInternalName && SESSION_NAME_RE.test(explicitInternalName));
+    if (!explicitOk && !SESSION_NAME_RE.test(resolvedOldDisplayName)) {
         const err = new Error('Invalid old name');
         err.status = 400;
         throw err;
@@ -10651,24 +10667,30 @@ function isDirectLoopbackRequest(req) {
 // can open a WebSocket to 127.0.0.1 with it, attaches there instead. A ticket
 // stands in for the login that asked for it and only on a DIRECT loopback
 // connection, so a copy is worthless off this machine; revoking the login
-// ends its tickets too. Kept in memory: a daemon restart drops them, and the
-// page falls back to the tunnel and asks again.
-const LOCAL_LINK_TTL_MS = 12 * 3600 * 1000;
-const localLinkTickets = new Map(); // ticket -> { token, expiresAt }
+// ends its tickets too. Signed rather than remembered: a ticket names the
+// login and its expiry under an HMAC keyed by the daemon's persistent
+// secret, so it outlives a daemon restart. (Kept in memory, every restart
+// knocked each tab off the fast path onto the tunnel and, half a minute
+// later, back again — two drops per deploy.)
+const LOCAL_LINK_TTL_MS = 7 * 24 * 3600 * 1000;
+function localLinkSignature(body) {
+    return crypto.createHmac('sha256', String(SESSION_SECRET)).update('local-link:' + body).digest('base64url');
+}
 function issueLocalLinkTicket(sessionToken) {
-    const now = Date.now();
-    for (const [t, rec] of localLinkTickets) if (rec.expiresAt <= now) localLinkTickets.delete(t);
-    while (localLinkTickets.size >= 500) localLinkTickets.delete(localLinkTickets.keys().next().value);
-    const ticket = 'll_' + crypto.randomBytes(24).toString('base64url');
-    localLinkTickets.set(ticket, { token: sessionToken, expiresAt: now + LOCAL_LINK_TTL_MS });
-    return ticket;
+    const session = authSessions.verify(sessionToken);
+    if (!session) return null;
+    const body = `${session.id}.${(Date.now() + LOCAL_LINK_TTL_MS).toString(36)}`;
+    return `ll_${body}.${localLinkSignature(body)}`;
 }
 function verifyLocalLinkTicket(ticket) {
-    const rec = localLinkTickets.get(ticket);
-    if (!rec) return null;
-    const session = rec.expiresAt > Date.now() ? authSessions.verify(rec.token) : null;
-    if (!session) localLinkTickets.delete(ticket);
-    return session;
+    const m = /^ll_([A-Za-z0-9_-]+)\.([0-9a-z]+)\.([A-Za-z0-9_-]+)$/.exec(String(ticket || ''));
+    if (!m) return null;
+    const body = `${m[1]}.${m[2]}`;
+    const want = Buffer.from(localLinkSignature(body));
+    const got = Buffer.from(m[3]);
+    if (want.length !== got.length || !crypto.timingSafeEqual(want, got)) return null;
+    if (parseInt(m[2], 36) <= Date.now()) return null;
+    return authSessions.list().find((s) => s.id === m[1]) || null;
 }
 
 // Every way a request can prove itself, in one place.
@@ -12593,7 +12615,13 @@ happens until someone clicks it.
                     // says "node" and cannot), or a plain shell.
                     const turn = readTurnInfo(source);
                     const codexId = turn?.agent === 'codex' ? codexRootThreadId(turn.sessionId) : null;
-                    const runsCodex = !!codexId
+                    // A session continued from the Codex app names its thread
+                    // in its record from the start; the turn file only comes
+                    // with its first finished turn in hop, and until then the
+                    // session read as a plain shell ("no claude or codex
+                    // conversation to hand off").
+                    const codexAppId = /^[0-9a-f-]{36}$/.test(String(meta?.fromCodexApp || '')) ? meta.fromCodexApp : null;
+                    const runsCodex = !!codexId || !!codexAppId
                         || /codex/i.test(String(config.foregroundProcess || ''))
                         || /codex/i.test(String(getRuntimeSessionMetadata(source)?.foregroundProcess || ''));
                     const sourceKind = rec ? 'claude' : runsCodex ? 'codex' : 'shell';
@@ -12618,15 +12646,21 @@ happens until someone clicks it.
                         return;
                     }
                     const codexRollout = sourceKind === 'codex'
-                        ? ((codexId && findCodexRolloutById(codexId)) || resolveCodexTranscriptByCwd(cwd))
+                        // The app thread itself, not hop's fork of it: a fork's
+                        // rollout points back at its parent instead of copying
+                        // the history, so it alone reads as an empty conversation.
+                        ? ((codexId && findCodexRolloutById(codexId)) || (codexAppId && findCodexRolloutById(codexAppId)) || resolveCodexTranscriptByCwd(cwd))
                         : null;
 
                     const sourceDisplay = getSessionDisplayName(source) || source;
                     const suffix = !handoff ? '-fork' : wantTarget === sourceKind ? '-cont' : '-' + wantTarget;
-                    let forkName = sourceDisplay + suffix;
+                    // The fork's name is also its internal name, so it must be
+                    // a valid one even when the source's display name is not.
+                    const forkBase = SESSION_NAME_RE.test(sourceDisplay) ? sourceDisplay : sessionNameFromText(sourceDisplay);
+                    let forkName = forkBase + suffix;
                     let n = 2;
                     while (isDisplayNameInUse(forkName) || hopSessionExists(toInternalSessionName(forkName))) {
-                        forkName = sourceDisplay + suffix + n;
+                        forkName = forkBase + suffix + n;
                         n += 1;
                     }
                     const forkInternal = toInternalSessionName(forkName);
@@ -12653,7 +12687,7 @@ happens until someone clicks it.
                         const stage = path.join(HOME_DIR, 'uploads', forkInternal);
                         fs.mkdirSync(stage, { recursive: true, mode: 0o700 });
                         const stamp = new Date().toISOString().slice(0, 19).replace(/[:T]/g, '-');
-                        const extractPath = path.join(stage, `handoff-from-${sourceDisplay}-${stamp}.md`);
+                        const extractPath = path.join(stage, `handoff-from-${forkBase}-${stamp}.md`);
                         writePrivateFile(extractPath, result.text);
                         const bytes = Buffer.byteLength(result.text);
                         const prompt = trajectoryExtract.handoffPrompt(extractPath, bytes, sourceKind);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hop2",
-  "version": "0.11.82",
+  "version": "0.11.83",
   "description": "🐰 Hop into your terminal from anywhere. Secure remote shell access with 2FA via Cloudflare Tunnel. Next-gen rewrite with native terminal sharing.",
   "main": "hop",
   "bin": {

package/scripts/trajectory-extract.js

@@ -16,6 +16,7 @@
 // Streams line by line: real transcripts run to hundreds of MB.
 
 const fs = require('fs');
+const path = require('path');
 const readline = require('readline');
 
 const NOISE_PREFIXES = [
@@ -170,10 +171,36 @@ async function codexRolloutId(file) {
  * character budget fills — the most recent context is what the receiver
  * needs — then harness noise is dropped.
  */
+// Every file of one Codex thread, oldest first. Codex starts a new segment
+// file (rollout-<time>-<thread>_<segment>.jsonl) partway through a long
+// thread, so the newest file alone is only its last stretch — a handoff from
+// it carried the final hour of a two-day conversation. Segments live in the
+// day folders under the same sessions/ root.
+function codexThreadSegments(file) {
+    const id = (/rollout-[0-9T-]+-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/.exec(path.basename(file)) || [])[1];
+    const sessions = path.resolve(path.dirname(file), '..', '..', '..');
+    if (!id || path.basename(sessions) !== 'sessions') return [file];
+    const found = [];
+    const list = (dir) => { try { return fs.readdirSync(dir); } catch { return []; } };
+    for (const y of list(sessions)) for (const m of list(path.join(sessions, y))) for (const d of list(path.join(sessions, y, m))) {
+        for (const n of list(path.join(sessions, y, m, d))) {
+            if (n.endsWith('.jsonl') && n.includes(`-${id}`)) found.push(path.join(sessions, y, m, d, n));
+        }
+    }
+    found.sort((a, b) => path.basename(a).localeCompare(path.basename(b)));
+    return found.includes(file) ? found : [file];
+}
+
 async function extractConversation(file, { maxChars = 800000, tool } = {}) {
     const kind = tool || detectTool(file);
     if (kind === 'gemini') throw new Error('Gemini transcripts are not supported for handoff');
-    const turns = kind === 'codex' ? await readCodexTurns(file) : await readClaudeTurns(file);
+    let turns;
+    if (kind === 'codex') {
+        turns = [];
+        for (const f of codexThreadSegments(file)) turns.push(...await readCodexTurns(f));
+    } else {
+        turns = await readClaudeTurns(file);
+    }
     const selected = [];
     let total = 0;
     for (let i = turns.length - 1; i >= 0; i--) {

package/tests/terminal-api.integration.test.cjs

@@ -207,6 +207,8 @@ async function startDaemon() {
     ...process.env,
     HOP_HOME: hopHome,
     HOP_NO_TUNNEL: '1',
+    // Never the real ~/.codex: tests plant their own rollouts here.
+    CODEX_HOME: path.join(tempDir, 'codex_home'),
     PATH: `${binDir}:${process.env.PATH || ''}`,
     CLOUDFLARED_LOG: cloudflaredLog
   };
@@ -1027,6 +1029,84 @@ test('condense into the same agent hands off the trajectory to a fresh session',
 });
 
 
+// A session continued from the Codex app used to carry the thread's title
+// verbatim ("Find grant opportunities and draft") — spaces a session name
+// may not hold, so renaming it and Continue-in both failed. Such a session
+// can still be renamed by its internal name and forked under a valid name.
+test('a session whose display name has spaces can be renamed and forked', async () => {
+  const create = await requestJson(state.port, state.sessionSecret, 'POST', '/api/terminals', {
+    name: 'spacedsrc',
+    cwd: tempDir
+  }, agentHeaders);
+  assert.equal(create.status, 200);
+  const internal = create.data.sessionName;
+  const metaPath = path.join(hopHome, 'claude-sessions', `${internal}.meta`);
+  const meta = JSON.parse(await fs.readFile(metaPath, 'utf8').catch(() => '{}'));
+  await fs.writeFile(metaPath, JSON.stringify({ ...meta, internalName: internal, displayName: 'Find grant opportunities' }), { mode: 0o600 });
+  await fs.writeFile(path.join(hopHome, 'claude-sessions', `${internal}.json`), JSON.stringify({
+    sessionId: '22222222-3333-4444-5555-666666666666', cwd: tempDir, launchCmd: 'claude',
+    updatedAt: new Date().toISOString()
+  }), { mode: 0o600 });
+
+  const before = await requestJson(state.port, state.sessionSecret, 'GET', '/api/sessions');
+  assert.equal(before.data.sessions.find((s) => s.internalName === internal)?.displayName, 'Find grant opportunities');
+
+  const fork = await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/fork', {
+    internalName: internal
+  });
+  assert.equal(fork.status, 200, JSON.stringify(fork.data));
+  assert.match(fork.data.internalName, /^[A-Za-z0-9_-]+$/);
+
+  const rename = await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/rename', {
+    oldName: 'Find grant opportunities', newName: 'grant-search', internalName: internal
+  });
+  assert.equal(rename.status, 200, JSON.stringify(rename.data));
+
+  for (const name of [internal, fork.data.internalName]) {
+    await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/delete',
+      { name, internalName: name });
+  }
+});
+
+
+// A session continued from the Codex app has no turn record until its first
+// turn finishes in hop — and until then Continue-in-Claude refused it as a
+// plain shell. Its record names the app thread, and that thread's rollout
+// is the conversation to hand off (hop's own fork of it holds only a pointer).
+test('a Codex-app session hands off to claude before its first turn in hop', async () => {
+  const create = await requestJson(state.port, state.sessionSecret, 'POST', '/api/terminals', {
+    name: 'codexappsrc',
+    cwd: tempDir
+  }, agentHeaders);
+  assert.equal(create.status, 200);
+  const internal = create.data.sessionName;
+  const threadId = '01a14846-0000-7000-8000-00000000abcd';
+  const day = path.join(daemonEnv.CODEX_HOME, 'sessions', '2026', '10', '18');
+  await fs.mkdir(day, { recursive: true });
+  await fs.writeFile(path.join(day, `rollout-2026-10-18T10-00-00-${threadId}.jsonl`), [
+    { type: 'session_meta', timestamp: '2026-10-18T10:00:00Z', payload: { id: threadId, cwd: tempDir } },
+    { type: 'event_msg', timestamp: '2026-10-18T10:00:01Z', payload: { type: 'user_message', message: 'find grant opportunities for the lab' } },
+    { type: 'response_item', timestamp: '2026-10-18T10:00:05Z', payload: { type: 'message', role: 'assistant', content: [{ type: 'output_text', text: 'NSF MCB fits best.' }] } }
+  ].map((e) => JSON.stringify(e)).join('\n') + '\n');
+  const metaPath = path.join(hopHome, 'claude-sessions', `${internal}.meta`);
+  const meta = JSON.parse(await fs.readFile(metaPath, 'utf8').catch(() => '{}'));
+  await fs.writeFile(metaPath, JSON.stringify({ ...meta, internalName: internal, fromCodexApp: threadId }), { mode: 0o600 });
+
+  const handoff = await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/fork', {
+    internalName: internal, target: 'claude'
+  });
+  assert.equal(handoff.status, 200, JSON.stringify(handoff.data));
+  assert.equal(handoff.data.kind, 'handoff');
+  const extract = await fs.readFile(handoff.data.extract.path, 'utf8');
+  assert.match(extract, /find grant opportunities for the lab/);
+
+  for (const name of [internal, handoff.data.internalName]) {
+    await requestJson(state.port, state.sessionSecret, 'POST', '/api/sessions/delete',
+      { name, internalName: name });
+  }
+});
+
+
 // The briefing generator's coverage signal: the server witnesses who was
 // looking at what, and when. Only a HUMAN-viewing attach may stamp it —
 // wall tiles are spectators and terminal-api clients are agents.

package/tests/trajectory-extract.unit.test.cjs

@@ -65,6 +65,35 @@ test('codex rollout: user turns deduped, assistant paired, id readable', async (
     assert.equal(await codexRolloutId(file), 'abc-123');
 });
 
+// A long Codex thread continues in a segment file in a later day folder;
+// the handoff reads the thread from its first file, not just the newest.
+test('codex thread split across segment files is read whole, oldest first', async () => {
+    const dir = tmp();
+    const id = '01a14846-f12b-79b0-a607-19de9fdc0dbf';
+    const day1 = path.join(dir, '.codex', 'sessions', '2026', '10', '17');
+    const day2 = path.join(dir, '.codex', 'sessions', '2026', '10', '18');
+    fs.mkdirSync(day1, { recursive: true });
+    fs.mkdirSync(day2, { recursive: true });
+    const first = path.join(day1, `rollout-2026-10-17T00-12-51-${id}.jsonl`);
+    const later = path.join(day2, `rollout-2026-10-18T21-44-03-${id}_01a1520b-6e45-7560-af50-845d3f9983d4.jsonl`);
+    jsonl(first, [
+        { type: 'session_meta', timestamp: '2026-10-17T00:12:51.000Z', payload: { id, cwd: '/Users/me/grants' } },
+        { type: 'event_msg', timestamp: '2026-10-17T00:13:00.000Z', payload: { type: 'user_message', message: 'find grant opportunities' } }
+    ]);
+    jsonl(later, [
+        { type: 'session_meta', timestamp: '2026-10-18T21:44:03.000Z', payload: { id, cwd: '/Users/me/grants' } },
+        { type: 'event_msg', timestamp: '2026-10-18T21:45:00.000Z', payload: { type: 'user_message', message: 'draft the PO email' } }
+    ]);
+    // An unrelated thread in the same folder stays out.
+    jsonl(path.join(day2, 'rollout-2026-10-18T09-00-00-11111111-2222-3333-4444-555555555555.jsonl'), [
+        { type: 'event_msg', timestamp: '2026-10-18T09:00:01.000Z', payload: { type: 'user_message', message: 'unrelated work' } }
+    ]);
+    const r = await extractConversation(later, { tool: 'codex' });
+    assert.equal(r.totalTurns, 2);
+    assert.ok(r.text.indexOf('find grant opportunities') < r.text.indexOf('draft the PO email'));
+    assert.ok(!r.text.includes('unrelated work'));
+});
+
 test('handoff prompt names the file, its size, and the source tool', () => {
     const p = handoffPrompt('/x/handoff.md', 5 * 1024, 'claude');
     assert.match(p, /Read the ENTIRE file \/x\/handoff\.md \(5KB\)/);