claude-rpc 0.12.1 → 0.13.2

package/src/notify.js

@@ -6,21 +6,36 @@
 import { spawn } from 'node:child_process';
 import { platform } from 'node:os';
 
-// Best-effort native desktop notification. Never throws.
+/**
+ * Best-effort native desktop notification (osascript / PowerShell / notify-send).
+ * Never throws — a missing notifier binary is swallowed.
+ * @param {string} title - Notification title.
+ * @param {string} [body] - Notification body text.
+ * @returns {boolean} true if a notifier was spawned, false on failure.
+ */
 export function desktopNotify(title, body = '') {
   try {
     const p = platform();
+    // A missing notifier binary (e.g. no `notify-send`) makes spawn emit an
+    // async 'error' event — with no listener that surfaces as an UNCAUGHT
+    // exception that the sync try/catch below can't stop, which would crash
+    // the daemon's render loop. The no-op 'error' listener keeps the promise
+    // in this function ("never throws") actually true.
+    const swallow = (child) => {
+      child.on('error', () => {});
+      child.unref();
+    };
     if (p === 'darwin') {
       const script = `display notification ${JSON.stringify(body)} with title ${JSON.stringify(title)}`;
-      spawn('osascript', ['-e', script], { stdio: 'ignore', detached: true }).unref();
+      swallow(spawn('osascript', ['-e', script], { stdio: 'ignore', detached: true }));
     } else if (p === 'win32') {
       const script = `Add-Type -AssemblyName System.Windows.Forms;`
         + `$n=New-Object System.Windows.Forms.NotifyIcon;`
         + `$n.Icon=[System.Drawing.SystemIcons]::Information;$n.Visible=$true;`
         + `$n.ShowBalloonTip(5000, ${JSON.stringify(title)}, ${JSON.stringify(body)}, 'Info')`;
-      spawn('powershell', ['-NoProfile', '-NonInteractive', '-Command', script], { stdio: 'ignore', detached: true, windowsHide: true }).unref();
+      swallow(spawn('powershell', ['-NoProfile', '-NonInteractive', '-Command', script], { stdio: 'ignore', detached: true, windowsHide: true }));
     } else {
-      spawn('notify-send', ['-a', 'Claude Code', title, body], { stdio: 'ignore', detached: true }).unref();
+      swallow(spawn('notify-send', ['-a', 'Claude Code', title, body], { stdio: 'ignore', detached: true }));
     }
     return true;
   } catch {
@@ -28,7 +43,13 @@ export function desktopNotify(title, body = '') {
   }
 }
 
-// Fire-and-forget JSON POST. Never throws. Uses global fetch (Node 18+).
+/**
+ * Fire-and-forget JSON POST. Never throws; rejections are swallowed.
+ * Uses global fetch (Node 18+).
+ * @param {string} url - Webhook endpoint. Falsy → no-op.
+ * @param {unknown} payload - JSON-serializable body.
+ * @returns {void}
+ */
 export function postWebhook(url, payload) {
   try {
     if (!url || typeof fetch !== 'function') return;
@@ -42,7 +63,13 @@ export function postWebhook(url, payload) {
   }
 }
 
-// Should a status transition fire the webhook? Pure — exported for tests.
+/**
+ * Should a status transition fire the webhook? Pure — exported for tests.
+ * @param {{url?: string, on?: string[]}} webhookCfg - Webhook config.
+ * @param {string} prevStatus - Previous presence status.
+ * @param {string} newStatus - Incoming presence status.
+ * @returns {boolean}
+ */
 export function shouldWebhook(webhookCfg, prevStatus, newStatus) {
   if (!webhookCfg || !webhookCfg.url) return false;
   if (prevStatus === newStatus) return false;

package/src/nudge.js

@@ -0,0 +1,87 @@
+// Share nudges — the gentle half of the viral loop. When you cross a genuine
+// milestone (a streak record, a round number of sessions or hours), the CLI
+// offers a one-liner to share it. Deliberately conservative:
+//
+//   - Only ever surfaces the single biggest *new* milestone, and only once
+//     (deduped by key in a tiny state file). Crossing nothing new → silence.
+//   - Off-switch: config.nudges.enabled === false.
+//   - Never throws and never blocks — it's the last thing printed, best-effort.
+//
+// pickShareNudge is pure (aggregate, lastKey) → nudge|null, so it's unit-tested
+// without touching disk.
+
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { STATE_DIR } from './paths.js';
+
+const NUDGE_STATE = join(STATE_DIR, 'nudge-state.json');
+
+// Largest milestone in `list` that `value` has reached, or null.
+function reached(value, list) {
+  let hit = null;
+  for (const m of list) if (value >= m) hit = m;
+  return hit;
+}
+
+const fmt = (n) => n >= 1000 ? n.toLocaleString('en-US') : String(n);
+
+// Returns { key, weight, message } for the biggest milestone the aggregate has
+// crossed, or null. `weight` ranks across milestone types so we only ever show
+// the single most impressive one.
+export function pickShareNudge(agg) {
+  if (!agg || typeof agg !== 'object') return null;
+  const out = [];
+
+  const streak = agg.streak || 0;
+  const longest = agg.longestStreak || 0;
+  // Only celebrate a streak when it's also a personal record — otherwise the
+  // "share your streak" prompt fires mid-decline, which feels off.
+  if (streak >= 3 && streak === longest) {
+    const m = reached(streak, [3, 7, 14, 30, 50, 100, 200, 365]);
+    if (m) out.push({
+      key: `streak:${m}`, weight: 1000 + m,
+      message: `${m}-day streak — a personal record. Drop a live badge in your README: \`claude-rpc badge --metric streak --gist\``,
+    });
+  }
+
+  const sessions = agg.sessions || 0;
+  const s = reached(sessions, [50, 100, 250, 500, 1000, 2500, 5000, 10000]);
+  if (s) out.push({
+    key: `sessions:${s}`, weight: s / 50,
+    message: `${fmt(s)} Claude Code sessions logged. Show it off: \`claude-rpc card --range all --out claude.svg\` (or --gist for a live one).`,
+  });
+
+  const hours = Math.floor((agg.activeMs || 0) / 3_600_000);
+  const h = reached(hours, [50, 100, 250, 500, 1000, 2000, 5000]);
+  if (h) out.push({
+    key: `hours:${h}`, weight: h,
+    message: `${fmt(h)}+ hours on Claude Code. Your year-in-review is ready — \`claude-rpc serve\` then open /wrapped and hit Share.`,
+  });
+
+  if (!out.length) return null;
+  out.sort((a, b) => b.weight - a.weight);
+  return out[0];
+}
+
+function readLastKey(path = NUDGE_STATE) {
+  try { return JSON.parse(readFileSync(path, 'utf8')).key || null; }
+  catch { return null; }
+}
+
+function writeLastKey(key, path = NUDGE_STATE) {
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify({ key, ts: Date.now() }));
+  } catch { /* best-effort */ }
+}
+
+// Resolve a nudge to print right now, honoring the config gate and once-only
+// dedup. Returns a string to print, or null. Marks the nudge as shown.
+export function maybeNudge(agg, config = {}, { path = NUDGE_STATE } = {}) {
+  if (config?.nudges?.enabled === false) return null;
+  const n = pickShareNudge(agg);
+  if (!n) return null;
+  if (n.key === readLastKey(path)) return null;   // already shown this one
+  writeLastKey(n.key, path);
+  return n.message;
+}

package/src/paths.js

@@ -16,6 +16,13 @@ export const ROOT = resolve(__dirname, '..');
 // SEA exe) and dev mode (cloned repo, no node_modules wrapper).
 export const IS_NPM_INSTALL = !IS_PACKAGED && /[\\/]node_modules[\\/]/i.test(ROOT);
 
+// True when we were launched via `npx claude-rpc` — npm stages the package in
+// its ephemeral `_npx/<hash>/node_modules/...` cache, which matches the
+// node_modules test above but is DELETED when the process exits. A hook wired
+// to the PATH-resolved `claude-rpc` bin would dangle, so setup must promote an
+// npx run to a real global install before wiring anything. See install.js.
+export const IS_NPX = IS_NPM_INSTALL && /[\\/]_npx[\\/]/i.test(ROOT);
+
 // "Installed" covers both real distribution paths — config and runtime
 // artifacts live outside the install tree so they survive package updates.
 export const IS_INSTALLED = IS_PACKAGED || IS_NPM_INSTALL;

package/src/profile.js

@@ -150,7 +150,7 @@ export function renderProfileCard(aggregate, { handle = '', generatedAt = new Da
   <!-- footer -->
   <text x="40" y="${H - 18}"
         font-family="JetBrains Mono, ui-monospace, monospace"
-        font-size="11" fill="${PALETTE.inkFaint}">${escapeXml(`best streak ${t.longestStreak}d · ≈${fmtCost(t.cost)} · claude-rpc v${VERSION}`)}</text>
+        font-size="11" fill="${PALETTE.inkFaint}">${escapeXml(`best streak ${t.longestStreak}d · ≈${fmtCost(t.cost)} · claude-rpc.vercel.app`)}</text>
 </svg>`;
 }
 

package/src/scanner.js

@@ -1,4 +1,4 @@
-import { readdirSync, readFileSync, statSync, existsSync, writeFileSync, mkdirSync, renameSync } from 'node:fs';
+import { readdirSync, readFileSync, statSync, existsSync, writeFileSync, mkdirSync, renameSync, openSync, readSync, closeSync } from 'node:fs';
 import { join, dirname, basename } from 'node:path';
 import { homedir } from 'node:os';
 import { CLAUDE_PROJECTS, SCAN_CACHE_PATH, AGGREGATE_PATH, DATA_DIR, EVENTS_LOG_PATH } from './paths.js';
@@ -35,6 +35,33 @@ function hourKey(ts) {
   return new Date(ts).getHours();
 }
 
+// Reject malformed or implausible transcript timestamps before they poison
+// firstTs/lastTs (which drive wallMs) and the day/week/hour buckets. A NaN from
+// a bad string, a year-0 epoch artifact, or a far-future entry from a skewed
+// clock would otherwise inflate lifetime totals. Floor: before Claude Code
+// could plausibly exist. Ceiling: now + a generous clock-skew margin.
+const TS_FLOOR = Date.UTC(2020, 0, 1);
+const TS_SKEW_MS = 48 * 60 * 60 * 1000;
+function parseTs(raw) {
+  if (!raw) return null;
+  const t = Date.parse(raw);
+  if (!Number.isFinite(t)) return null;
+  if (t < TS_FLOOR || t > Date.now() + TS_SKEW_MS) return null;
+  return t;
+}
+
+// Calendar day index (whole days since the Unix epoch) anchored at UTC noon.
+// Subtracting two of these always yields an exact number of calendar days —
+// immune to DST, where subtracting two local-midnight Dates gives a 23h or 25h
+// span that Math.floor/Math.round can turn into an off-by-one day.
+function dayNum(y, mZeroBased, d) {
+  return Math.floor(Date.UTC(y, mZeroBased, d, 12) / 86_400_000);
+}
+function dayKeyNum(key) {
+  const [y, m, d] = key.split('-').map(Number);
+  return dayNum(y, m - 1, d);
+}
+
 const EDITING_TOOLS = new Set(['Write', 'Edit', 'NotebookEdit']);
 
 // First non-env token of a shell command. `FOO=bar git status` → `git`.
@@ -151,10 +178,40 @@ function collectFilePath(input = {}) {
   return input.file_path || input.path || input.notebook_path || null;
 }
 
+// Iterate newline-delimited lines of a string without materializing the full
+// `.split('\n')` array (a second full-size copy of the file). Peak overhead is
+// one line slice instead of N strings — meaningful for multi-MB transcripts.
+function* iterLines(raw) {
+  let start = 0;
+  let nl;
+  while ((nl = raw.indexOf('\n', start)) !== -1) {
+    yield raw.slice(start, nl);
+    start = nl + 1;
+  }
+  if (start < raw.length) yield raw.slice(start);
+}
+
+// Read up to `maxBytes` from the head of a file without loading the whole
+// thing. Used to pull the cwd from a transcript's first lines — reading a
+// multi-MB transcript in full just to inspect its head was pure waste.
+function readHead(path, maxBytes = 65536) {
+  let fd;
+  try {
+    fd = openSync(path, 'r');
+    const buf = Buffer.allocUnsafe(maxBytes);
+    const n = readSync(fd, buf, 0, maxBytes, 0);
+    return buf.toString('utf8', 0, n);
+  } finally {
+    if (fd !== undefined) {
+      try { closeSync(fd); } catch { /* already closed */ }
+    }
+  }
+}
+
 // Parse a single transcript JSONL into a per-file summary.
 export function parseTranscript(filePath) {
   const raw = readFileSync(filePath, 'utf8');
-  const lines = raw.split('\n');
+  const lines = iterLines(raw);
   const summary = {
     sessionId: null,
     project: null,
@@ -207,7 +264,7 @@ export function parseTranscript(filePath) {
       summary.cwd = r.cwd;
       summary.project = cleanProjectName(basename(r.cwd));
     }
-    const ts = r.timestamp ? new Date(r.timestamp).getTime() : null;
+    const ts = parseTs(r.timestamp);
     const day = ts ? dayKey(ts) : null;
     const week = ts ? weekKey(ts) : null;
     const hour = ts ? hourKey(ts) : null;
@@ -377,8 +434,9 @@ function readTranscriptCwd(path, mtimeMs) {
   if (cached && cached.mtime === mtimeMs) return cached.cwd;
   let cwd = null;
   try {
-    const head = readFileSync(path, 'utf8').split('\n', 25);
-    for (const line of head) {
+    let seen = 0;
+    for (const line of iterLines(readHead(path))) {
+      if (++seen > 25) break;
       if (!line) continue;
       const r = safeJson(line);
       if (r?.cwd) { cwd = r.cwd; break; }
@@ -391,7 +449,22 @@ function readTranscriptCwd(path, mtimeMs) {
 // Per-transcript token cache. Reading a multi-MB .jsonl on every push tick
 // (4s) would be wasteful, so we only re-parse when the file's mtime has
 // advanced since the last read.
-const sessionTokenCache = new Map();  // path → { mtime, tokens }
+const sessionTokenCache = new Map();  // path → { mtime, size, offset, tokens }
+
+// Accumulate assistant-usage tokens from a chunk of complete JSONL lines.
+function sumUsageLines(text, tokens) {
+  for (const line of iterLines(text)) {
+    if (!line) continue;
+    const r = safeJson(line);
+    if (!r || r.type !== 'assistant') continue;
+    const u = r.message?.usage;
+    if (!u) continue;
+    tokens.input      += u.input_tokens || 0;
+    tokens.output     += u.output_tokens || 0;
+    tokens.cacheRead  += u.cache_read_input_tokens || 0;
+    tokens.cacheWrite += u.cache_creation_input_tokens || 0;
+  }
+}
 
 // Sum input/output/cache tokens from a single transcript JSONL.
 //
@@ -409,23 +482,44 @@ export function readSessionTokens(path) {
   const cached = sessionTokenCache.get(path);
   if (cached && cached.mtime === st.mtimeMs) return cached.tokens;
 
-  const tokens = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
+  // Transcripts are append-only JSONL. If the file only grew since the last
+  // read, parse just the appended tail from the cached byte offset instead of
+  // re-reading the whole (growing) file on every 4s daemon tick. Anything else
+  // (shrunk/truncated/rewritten) falls back to a full re-read.
+  const canAppend = cached && st.size >= cached.size && cached.offset <= st.size;
+  const tokens = canAppend
+    ? { ...cached.tokens }
+    : { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
+  const startOffset = canAppend ? cached.offset : 0;
+  let newOffset = startOffset;
+
+  let fd;
   try {
-    const raw = readFileSync(path, 'utf8');
-    for (const line of raw.split('\n')) {
-      if (!line) continue;
-      const r = safeJson(line);
-      if (!r || r.type !== 'assistant') continue;
-      const u = r.message?.usage;
-      if (!u) continue;
-      tokens.input      += u.input_tokens || 0;
-      tokens.output     += u.output_tokens || 0;
-      tokens.cacheRead  += u.cache_read_input_tokens || 0;
-      tokens.cacheWrite += u.cache_creation_input_tokens || 0;
+    fd = openSync(path, 'r');
+    const len = st.size - startOffset;
+    if (len > 0) {
+      const buf = Buffer.allocUnsafe(len);
+      const n = readSync(fd, buf, 0, len, startOffset);
+      const text = buf.toString('utf8', 0, n);
+      // Only consume through the last newline; a trailing partial line is left
+      // for a later read (offset stays before it). \n is single-byte ASCII so
+      // the boundary is exact even with multi-byte content in the lines.
+      const lastNl = text.lastIndexOf('\n');
+      if (lastNl !== -1) {
+        const complete = text.slice(0, lastNl + 1);
+        newOffset = startOffset + Buffer.byteLength(complete, 'utf8');
+        sumUsageLines(complete, tokens);
+      }
     }
-  } catch { return null; }
+  } catch {
+    return null;
+  } finally {
+    if (fd !== undefined) {
+      try { closeSync(fd); } catch { /* already closed */ }
+    }
+  }
 
-  sessionTokenCache.set(path, { mtime: st.mtimeMs, tokens });
+  sessionTokenCache.set(path, { mtime: st.mtimeMs, size: st.size, offset: newOffset, tokens });
   return tokens;
 }
 
@@ -681,11 +775,12 @@ function aggregateFrom(cache) {
     }
     agg.bestDay = best;
 
-    // Days since first.
-    const firstDay = new Date(days[0] + 'T00:00:00');
+    // Days since first — computed on DST-immune calendar day indices.
+    const now = new Date();
     const today = new Date();
     today.setHours(0, 0, 0, 0);
-    agg.daysSinceFirst = Math.floor((today - firstDay) / 86_400_000) + 1;
+    const todayNum = dayNum(now.getFullYear(), now.getMonth(), now.getDate());
+    agg.daysSinceFirst = todayNum - dayKeyNum(days[0]) + 1;
 
     // Current streak: walk back from today.
     const has = (offset) => {
@@ -704,9 +799,7 @@ function aggregateFrom(cache) {
     let prev = null;
     for (const k of days) {
       if (prev) {
-        const d1 = new Date(prev + 'T00:00:00');
-        const d2 = new Date(k + 'T00:00:00');
-        const diff = Math.round((d2 - d1) / 86_400_000);
+        const diff = dayKeyNum(k) - dayKeyNum(prev);
         run = diff === 1 ? run + 1 : 1;
       } else {
         run = 1;

package/src/server/assets/dashboard.client.js

@@ -15,7 +15,7 @@
   'XML': '#0060ac', 'Protobuf': '#888', 'LaTeX': '#3D6117', 'Text': '#888',
   'reStructuredText': '#888', 'Lockfile': '#444', 'Gradle': '#02303a',
   'Crystal': '#000100', 'Nim': '#ffc200', 'V': '#4f87c4', 'Objective-C': '#438eff',
-  'Objective-C++': '#6866fb', 'Sass': '#a53b70', 'Less': '#1d365d', 'Vue': '#41b883',
+  'Objective-C++': '#6866fb', 'Sass': '#a53b70', 'Less': '#1d365d',
   'Scala': '#c22d40', 'Groovy': '#4298b8', 'Interface Builder': '#888', 'Env': '#888',
   'Config': '#888', 'Git': '#f1502f',
 };

package/src/server/assets/wrapped.client.js

@@ -17,6 +17,12 @@
   // anim-stagger style helper
   let _i = 0; const A = () => `style="--i:${_i++}"`;
 
+  // Landing-page CTA used by the finale share. The dashboard is served on
+  // localhost, so sharing `location.href` hands the recipient a dead link —
+  // the finale shares this public URL + a stats summary instead.
+  const LANDING = 'https://claude-rpc.vercel.app/?ref=wrapped';
+  let _shareText = '';   // built in the finale slide, consumed by wireFinale
+
   // ── build the story slides from the wrapped payload ──────────
   function buildSlides(d) {
     const out = [];
@@ -105,6 +111,11 @@
 
     // 11. finale summary
     const cell = (k, v, cls) => `<div><div class="cellk">${k}</div><div class="cellv ${cls || ''}">${v}</div></div>`;
+    // Summary that travels with the share — stats + the public install link,
+    // so anyone who receives it knows what it is and where to get it.
+    _shareText = `My year on Claude Code: ${fmtHours(d.activeMs)} across ${fmtNum(d.sessions)} sessions · `
+      + `${fmtNum(d.prompts)} prompts · ${fmtNum(d.tokens)} tokens · ${(d.longestStreak || 0)}d best streak.\n\n`
+      + `Made with claude-rpc → ${LANDING}`;
     S('ink', `
       <div class="summary">
         <div class="card pop" style="--i:0">
@@ -120,15 +131,15 @@
             ${cell('Lines', (d.linesNet >= 0 ? '+' : '−') + fmtNum(Math.abs(d.linesNet)), 'grass')}
             ${cell('Hotspot', d.hotspot ? esc(d.hotspot.name) : '—')}
           </div>
-          <div class="foot">made with claude-rpc · github.com/rar-file/claude-rpc</div>
+          <div class="foot">made with claude-rpc · claude-rpc.vercel.app</div>
         </div>
         <div class="actions">
           <button class="btn primary" id="w-replay">↺ replay</button>
           <a class="btn" id="w-poster" href="/api/card.svg?range=all" target="_blank">poster ↗</a>
-          <button class="btn" id="w-copy">copy link</button>
+          <button class="btn" id="w-share">share ↗</button>
         </div>
       </div>
-      <div class="hint">screenshot the card to share your wrapped</div>`, 9_000_000); // last slide: effectively no auto-advance
+      <div class="hint">screenshot the card, or tap share to spread your wrapped</div>`, 9_000_000); // last slide: effectively no auto-advance
 
     return out;
   }
@@ -220,11 +231,21 @@
     function wireFinale() {
       if (wired) return; wired = true;
       const r = document.getElementById('w-replay');
-      const c = document.getElementById('w-copy');
+      const c = document.getElementById('w-share');
       if (r) r.onclick = (e) => { e.stopPropagation(); go(0); };
       if (c) c.onclick = (e) => {
         e.stopPropagation();
-        navigator.clipboard?.writeText(location.href).then(() => { c.textContent = 'copied ✓'; setTimeout(() => c.textContent = 'copy link', 1500); }).catch(() => {});
+        const flash = (msg) => { c.textContent = msg; setTimeout(() => c.textContent = 'share ↗', 1600); };
+        // Native share sheet where available (mobile / modern browsers);
+        // fall back to copying the summary + install link to the clipboard.
+        if (navigator.share) {
+          navigator.share({ title: 'My Year on Claude Code', text: _shareText, url: LANDING })
+            .catch(() => {});
+        } else {
+          navigator.clipboard?.writeText(_shareText)
+            .then(() => flash('copied ✓'))
+            .catch(() => flash('copy failed'));
+        }
       };
     }
 

package/src/session-card.js

@@ -60,7 +60,7 @@ export function renderSessionCard(vars = {}, { generatedAt = new Date() } = {})
   ${statCell(C[1], 184, 'Est. cost', String(cost), PALETTE.blurple)}
   ${statCell(C[2], 184, 'Reads', String(v.filesRead ?? 0))}
 
-  <text x="40" y="${H - 16}" font-family="JetBrains Mono, ui-monospace, monospace" font-size="10" fill="${PALETTE.inkFaint}">${escapeXml(`${v.currentFilePretty ? 'last: ' + v.currentFilePretty + ' · ' : ''}claude-rpc v${VERSION}`)}</text>
+  <text x="40" y="${H - 16}" font-family="JetBrains Mono, ui-monospace, monospace" font-size="10" fill="${PALETTE.inkFaint}">${escapeXml(`${v.currentFilePretty ? 'last: ' + v.currentFilePretty + ' · ' : ''}claude-rpc.vercel.app · v${VERSION}`)}</text>
 </svg>`;
 }
 

package/src/state.js

@@ -1,5 +1,15 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync } from 'node:fs';
-import { dirname, basename } from 'node:path';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+  renameSync,
+  openSync,
+  closeSync,
+  unlinkSync,
+  statSync,
+} from 'node:fs';
+import { basename } from 'node:path';
 import { STATE_PATH, STATE_DIR } from './paths.js';
 
 const DEFAULT_STATE = {
@@ -46,6 +56,81 @@ function ensureDir() {
   if (!existsSync(STATE_DIR)) mkdirSync(STATE_DIR, { recursive: true });
 }
 
+// Claude Code fires lifecycle hooks in rapid bursts, and concurrent sessions /
+// subagents mean several `claude-rpc hook` processes can run at once. Each does
+// a read-modify-write of state.json; without a cross-process lock the last
+// writer wins and the others' increments (messages, tools, tokens, file lists)
+// are silently lost. The atomic tmp+rename in writeState only protects readers
+// from torn files — it does nothing for lost updates. So updateState/resetState
+// serialize through an exclusive lock file. The lock is strictly best-effort:
+// if we can't get it within LOCK_MAX_WAIT_MS we proceed anyway (a slightly racy
+// write is better than a dropped hook), and a stale lock from a crashed process
+// is reclaimed after LOCK_STALE_MS.
+const LOCK_PATH = STATE_PATH + '.lock';
+const LOCK_STALE_MS = 2000;
+const LOCK_RETRY_MS = 4;
+const LOCK_MAX_WAIT_MS = 1000;
+
+// Synchronous sleep — hooks are short-lived sync processes, so a blocking spin
+// with a real wait (no busy-loop) is the right tool. Atomics.wait on a throwaway
+// SharedArrayBuffer parks the thread without burning CPU.
+function sleepSync(ms) {
+  try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+  } catch {
+    /* SharedArrayBuffer unavailable — fall through, caller just retries sooner */
+  }
+}
+
+function acquireLock() {
+  const deadline = Date.now() + LOCK_MAX_WAIT_MS;
+  for (;;) {
+    try {
+      // 'wx' fails if the file exists — that's our mutex.
+      return openSync(LOCK_PATH, 'wx');
+    } catch (err) {
+      if (err.code !== 'EEXIST') return null; // unexpected (perms, etc.) — go lockless
+      try {
+        if (Date.now() - statSync(LOCK_PATH).mtimeMs > LOCK_STALE_MS) {
+          try {
+            unlinkSync(LOCK_PATH);
+          } catch {
+            /* someone else reclaimed it first */
+          }
+          continue;
+        }
+      } catch {
+        /* lock vanished between open and stat — retry immediately */
+      }
+      if (Date.now() >= deadline) return null; // give up, proceed best-effort
+      sleepSync(LOCK_RETRY_MS);
+    }
+  }
+}
+
+function releaseLock(fd) {
+  if (fd === null) return;
+  try {
+    closeSync(fd);
+  } catch {
+    /* already closed */
+  }
+  try {
+    unlinkSync(LOCK_PATH);
+  } catch {
+    /* already removed */
+  }
+}
+
+function withLock(fn) {
+  const fd = acquireLock();
+  try {
+    return fn();
+  } finally {
+    releaseLock(fd);
+  }
+}
+
 export function readState() {
   ensureDir();
   if (!existsSync(STATE_PATH)) return { ...DEFAULT_STATE };
@@ -59,22 +144,29 @@ export function readState() {
 
 export function writeState(next) {
   ensureDir();
-  const tmp = STATE_PATH + '.tmp';
+  // Per-process tmp name: two processes writing the shared STATE_PATH + '.tmp'
+  // would clobber each other's tmp before rename. The pid suffix keeps the
+  // atomic-rename guarantee intact even on the best-effort lockless path.
+  const tmp = `${STATE_PATH}.${process.pid}.tmp`;
   writeFileSync(tmp, JSON.stringify(next, null, 2));
   renameSync(tmp, STATE_PATH);
 }
 
 export function updateState(mutator) {
-  const current = readState();
-  const next = mutator({ ...current }) ?? current;
-  writeState(next);
-  return next;
+  return withLock(() => {
+    const current = readState();
+    const next = mutator({ ...current }) ?? current;
+    writeState(next);
+    return next;
+  });
 }
 
 export function resetState(seed = {}) {
-  const fresh = { ...DEFAULT_STATE, sessionStart: Date.now(), lastActivity: Date.now(), ...seed };
-  writeState(fresh);
-  return fresh;
+  return withLock(() => {
+    const fresh = { ...DEFAULT_STATE, sessionStart: Date.now(), lastActivity: Date.now(), ...seed };
+    writeState(fresh);
+    return fresh;
+  });
 }
 
 export function pushUnique(arr, value, max = 50) {

package/src/version.js

@@ -11,7 +11,7 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { ROOT } from './paths.js';
 
-const BAKED = '0.12.1';
+const BAKED = '0.13.2';
 
 function readPkgVersion() {
   try {