groove-dev 0.27.180 → 0.27.182

package/packages/daemon/src/process.js

@@ -324,6 +324,15 @@ function sanitizeFilename(name) {
   return String(name).replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 64);
 }
 
+// Agent log files are keyed by sanitized agent NAME, not id — a rotated agent
+// keeps its name and appends to the same file, preserving conversation history
+// across rotations. Every reader must resolve paths through this helper: an
+// id-based path silently misses the file and downstream consumers (handoff
+// briefs, conversation resume, synthesis) fall back to empty context.
+export function agentLogPath(grooveDir, agent) {
+  return resolve(grooveDir, 'logs', `${sanitizeFilename(agent.name)}.log`);
+}
+
 // Apply Claude Code billing mode to a spawn env, in place.
 // The `claude` CLI bills to usage credits when ANTHROPIC_API_KEY is present and
 // to the OAuth subscription otherwise. 'subscription' (default) strips any
@@ -363,6 +372,14 @@ export class ProcessManager {
     this._stalledAgents = new Set(); // agentIds already flagged as stalled (avoids duplicate broadcasts)
     this._exitHandled = new Set();
     this._resultReceived = new Set();
+    // In-flight user messages, kept until a turn actually completes so a
+    // dropped turn can be re-issued instead of losing the user's message.
+    // agentId -> { message, attempts }
+    this._pendingUserMessage = new Map();
+    // Retry count carried across the agent-id change that resume() performs.
+    // Kept separate so teardown of the old agent can't reset it to 0 and
+    // turn a bounded retry into an infinite respawn loop. oldAgentId -> attempts
+    this._retryAttemptCarry = new Map();
     this._truncationFlagged = new Set(); // agentIds that have had any truncation in their session
     this._lastAssistantBlocks = new Map(); // agentId -> last assistant content blocks (for abandoned tool_use detection)
     this._previousCacheReadTokens = new Map(); // agentId -> previous turn's cacheReadTokens
@@ -1138,7 +1155,7 @@ For normal file edits within your scope, proceed without review.
     // Set up log capture (shared between CLI and agent loop paths)
     const logDir = resolve(this.daemon.grooveDir, 'logs');
     mkdirSync(logDir, { recursive: true });
-    const logPath = resolve(logDir, `${sanitizeFilename(agent.name)}.log`);
+    const logPath = agentLogPath(this.daemon.grooveDir, agent);
     const logStream = createWriteStream(logPath, { flags: 'a', mode: 0o600 });
 
     // Inject API key from credential store for agent-loop providers
@@ -1559,26 +1576,54 @@ For normal file edits within your scope, proceed without review.
 
     // Session result data (cost, duration, turns)
     if (output.type === 'result') {
-      tokens.recordResult(agentId, {
-        costUsd: output.cost, durationMs: output.duration, turns: output.turns,
-      });
-      if (output.cost) updates.costUsd = (agent.costUsd || 0) + output.cost;
-      if (output.duration) updates.durationMs = output.duration;
-      if (output.turns) updates.turns = output.turns;
-
-      // Claude Code sometimes hangs after emitting the result event — the
-      // process stays alive instead of exiting.  Record that the result
-      // arrived so exit handlers know this was a successful completion even
-      // if we have to SIGTERM the process.  After a 5s grace period, force-
-      // kill any process that hasn't exited on its own.
-      this._resultReceived.add(agentId);
-      const handle = this.handles.get(agentId);
-      if (handle?.proc && typeof handle.proc.kill === 'function') {
-        setTimeout(() => {
-          if (this.handles.has(agentId) && this._resultReceived.has(agentId)) {
-            try { handle.proc.kill('SIGTERM'); } catch {}
-          }
-        }, 5_000);
+      // Did this result represent a turn that actually ran? CLI >= 2.1.212
+      // emits a 0-turn no-op `result` during --resume reconciliation, before
+      // the real turn starts. Both it and an aborted turn report
+      // duration_api_ms === 0 — the model was never called. Providers that
+      // don't report an API duration (codex, gemini, ollama) are unaffected.
+      const reachedModel = output.apiDurationMs === undefined || output.apiDurationMs > 0;
+
+      // Turn aborted before the model was called — re-deliver the message.
+      // Deliberately does NOT return: session id persistence and the GUI
+      // broadcast below still need to run, and the retry is scheduled async.
+      if (!reachedModel && output.isError) {
+        this._retryDroppedTurn(agentId, agent, output);
+      }
+
+      // Everything below is completion bookkeeping and must only run for a
+      // turn that actually executed. Running it for the resume handshake is
+      // what killed the process mid-turn.
+      if (reachedModel) {
+        // The user's message is safely delivered.
+        this._pendingUserMessage.delete(agentId);
+
+        tokens.recordResult(agentId, {
+          costUsd: output.cost, durationMs: output.duration, turns: output.turns,
+        });
+        if (output.cost) updates.costUsd = (agent.costUsd || 0) + output.cost;
+        if (output.duration) updates.durationMs = output.duration;
+        if (output.turns) updates.turns = output.turns;
+
+        // Claude Code sometimes hangs after emitting the result event — the
+        // process stays alive instead of exiting.  Record that the result
+        // arrived so exit handlers know this was a successful completion even
+        // if we have to SIGTERM the process.  After a 5s grace period, force-
+        // kill any process that hasn't exited on its own.
+        //
+        // MUST stay behind the reachedModel guard. CLI >= 2.1.212 emits a
+        // 0-turn no-op result ~180ms into --resume; arming this on that result
+        // SIGTERMs the process ~5.2s later, mid-turn, before a token is
+        // produced (fable TTFT observed at 34s). The CLI records the signal as
+        // "[Request interrupted by user]" and the user's message is destroyed.
+        this._resultReceived.add(agentId);
+        const handle = this.handles.get(agentId);
+        if (handle?.proc && typeof handle.proc.kill === 'function') {
+          setTimeout(() => {
+            if (this.handles.has(agentId) && this._resultReceived.has(agentId)) {
+              try { handle.proc.kill('SIGTERM'); } catch {}
+            }
+          }, 5_000);
+        }
       }
     }
 
@@ -2510,6 +2555,59 @@ After fixing all issues, run tests (npm test) and build (npm run build) to verif
    * spawns fresh with the full conversation thread instead of --resume.
    * This avoids degraded context from internal compaction.
    */
+  /**
+   * Re-issue a user message whose turn was aborted before reaching the model.
+   *
+   * Returns true if a retry was scheduled (caller should skip normal result
+   * handling), false if the turn should be treated as a real result.
+   */
+  _retryDroppedTurn(agentId, agent, output) {
+    const pending = this._pendingUserMessage.get(agentId);
+    if (!pending) return false; // nothing to re-issue — let it fall through
+
+    const MAX_RETRIES = 2;
+    if (pending.attempts >= MAX_RETRIES) {
+      this._pendingUserMessage.delete(agentId);
+      this.daemon.broadcast({
+        type: 'agent:output',
+        agentId,
+        data: {
+          type: 'activity',
+          subtype: 'error',
+          data: `Message could not be delivered after ${MAX_RETRIES + 1} attempts `
+            + `(${output.terminalReason || output.subtype || 'turn aborted'}). Please re-send.`,
+        },
+      });
+      return false;
+    }
+
+    pending.attempts += 1;
+    this._retryAttemptCarry.set(agentId, pending.attempts);
+    this.daemon.broadcast({
+      type: 'agent:output',
+      agentId,
+      data: {
+        type: 'activity',
+        subtype: 'info',
+        data: `Turn aborted before reaching the model — retrying (${pending.attempts}/${MAX_RETRIES})…`,
+      },
+    });
+
+    // Let the aborted process finish tearing down before re-spawning; resume()
+    // kills the current handle and re-registers under a new agent id.
+    setTimeout(() => {
+      this.resume(agentId, pending.message).catch((err) => {
+        this.daemon.broadcast({
+          type: 'agent:output',
+          agentId,
+          data: { type: 'activity', subtype: 'error', data: `Retry failed: ${err.message}` },
+        });
+      });
+    }, 500);
+
+    return true;
+  }
+
   async resume(agentId, message) {
     const { registry, locks } = this.daemon;
     const agent = registry.get(agentId);
@@ -2577,8 +2675,19 @@ After fixing all issues, run tests (npm test) and build (npm run build) to verif
       workingDir: config.workingDir || this.daemon.config?.defaultWorkingDir || undefined,
       name: config.name,
       teamId: config.teamId,
+      authMode: config.authMode,
     });
 
+    // Hold the message until a turn actually completes, so a turn aborted
+    // before reaching the model can be re-issued rather than lost. Carries the
+    // attempt count forward from the agent id we're replacing.
+    if (message) {
+      const carried = this._retryAttemptCarry.get(agentId);
+      this._retryAttemptCarry.delete(agentId);
+      this._pendingUserMessage.delete(agentId);
+      this._pendingUserMessage.set(newAgent.id, { message, attempts: carried || 0 });
+    }
+
     // Carry cumulative tokens
     if (config.tokensUsed > 0) {
       registry.update(newAgent.id, { tokensUsed: config.tokensUsed });
@@ -2959,6 +3068,10 @@ After fixing all issues, run tests (npm test) and build (npm run build) to verif
     if (throttle?.timer) clearTimeout(throttle.timer);
     this._streamThrottle.delete(agentId);
     this.pendingMessages.delete(agentId);
+    // Safe during a retry: resume() re-registers the message under the new
+    // agent id from its own `message` argument, and the attempt count lives in
+    // _retryAttemptCarry (which kill() must not touch).
+    this._pendingUserMessage.delete(agentId);
 
     // Unregister ambassador if this agent was one
     const agent = this.daemon.registry.get(agentId);

package/packages/daemon/src/providers/claude-code.js

@@ -257,6 +257,13 @@ export class ClaudeCodeProvider extends Provider {
             cost: data.total_cost_usd,
             duration: data.duration_ms,
             turns: data.num_turns,
+            // Error/abort signals. Without these an `error_during_execution`
+            // result looks identical to a successful one and the user's
+            // message is silently dropped.
+            subtype: data.subtype,
+            isError: data.is_error === true || data.subtype === 'error_during_execution',
+            apiDurationMs: data.duration_api_ms,
+            terminalReason: data.terminal_reason,
           });
         }
       } catch {
@@ -268,7 +275,15 @@ export class ClaudeCodeProvider extends Provider {
 
     // Merge events: prefer content-bearing events (activity/result) over usage/session.
     // Accumulate token counts across all events in this chunk.
-    let content = events.find((e) => e.type === 'result') || events.find((e) => e.type === 'activity') || events[events.length - 1];
+    // Prefer an error result over a success one when a single chunk carries
+    // both. During --resume the CLI emits a 0-turn no-op success result
+    // immediately before the real turn's result; taking the first would hide a
+    // subsequent abort and the failure would look like a clean completion.
+    const resultEvents = events.filter((e) => e.type === 'result');
+    let content = resultEvents.find((e) => e.isError)
+      || resultEvents[0]
+      || events.find((e) => e.type === 'activity')
+      || events[events.length - 1];
     const merged = { ...content };
 
     let totalTokens = 0;

package/packages/daemon/src/rotator.js

@@ -18,6 +18,9 @@ const SCORE_HISTORY_MAX = 40;   // ~10 min at 15s intervals
 const COOLDOWN_MS = 5 * 60 * 1000;   // 5 minutes between rotations per agent
 const QUALITY_COOLDOWN_MS = 2 * 60 * 1000; // 2 minutes for quality degradation rotations
 const TOKEN_CEILING = 5_000_000;     // 5M tokens per agent (non-self-managing only)
+const REPLAY_CEILING = 0.50;         // Self-managing providers: rotate idle agents above this context usage
+const VELOCITY_CEILING = 250_000;    // New (non-cache) tokens per window before force rotation
+const VELOCITY_WINDOW_MS = 5 * 60_000;
 const ROLE_MULTIPLIERS = {
   planner: 2,
   fullstack: 4,
@@ -201,13 +204,34 @@ export class Rotator extends EventEmitter {
       const singleTask = providerInstance?.constructor?.singleTask ?? false;
       if (singleTask) continue;
 
-      // Skip agents idle for over 60s — no point scoring them every 15s
-      const idleMs = this._idleMs(agent);
-      if (idleMs > 60_000 && agent.contextUsage < HARD_CEILING) continue;
-
       // Determine if provider manages its own context (e.g. Claude Code compacts internally)
       const selfManagesContext = providerInstance?.constructor?.managesOwnContext ?? false;
 
+      // Velocity safety — new-token burn rate, all provider types. tokensUsed
+      // excludes cache reads, so this measures real generation. Caps worst-case
+      // runaway burn; bypasses cooldown (a runaway must be stopped, not waited out).
+      const velCeiling = this.daemon.config?.velocityCeiling ?? VELOCITY_CEILING;
+      const velocity = this.daemon.tokens?.getVelocity?.(agent.id, VELOCITY_WINDOW_MS) ?? 0;
+      if (velCeiling > 0 && velocity >= velCeiling) {
+        console.warn(`  Rotator: ${agent.name} burned ${velCeiling.toLocaleString()}+ new tokens in 5min — FORCE rotating (velocity)`);
+        await this.rotate(agent.id, { reason: 'velocity_ceiling' });
+        continue;
+      }
+
+      // Replay ceiling — self-managing providers only. Internal compaction keeps
+      // sessions functional but lets context ride at 60-85% indefinitely, and every
+      // subsequent message replays that much context on EVERY API call in the agent
+      // loop. A handoff-brief rotation costs ~10K tokens once; riding high costs
+      // 150-300K per call. Computed here because the idle-skip guard below must
+      // not hide the exact agents this targets (idle, high-context).
+      const replayCeiling = this.daemon.config?.replayCeiling ?? REPLAY_CEILING;
+      const overReplayCeiling = selfManagesContext && replayCeiling > 0
+        && agent.contextUsage >= replayCeiling;
+
+      // Skip agents idle for over 60s — no point scoring them every 15s
+      const idleMs = this._idleMs(agent);
+      if (idleMs > 60_000 && agent.contextUsage < HARD_CEILING && !overReplayCeiling) continue;
+
       if (!selfManagesContext) {
         // Non-Claude: threshold + ceiling + quality rotation
         // These providers fill up linearly and degrade without external rotation
@@ -260,6 +284,13 @@ export class Rotator extends EventEmitter {
             continue;
           }
         }
+      } else if (overReplayCeiling && !this._isOnCooldown(agent.id) && idleMs > 10_000) {
+        // Rotate while idle only — never mid-task — and respect the cooldown.
+        // Continuity comes from the conversation-thread resume; rotate() blocks
+        // the rotation entirely if the thread can't be extracted for a chat agent.
+        console.log(`  Rotator: ${agent.name} at ${Math.round(agent.contextUsage * 100)}% — rotating (replay ceiling)`);
+        await this.rotate(agent.id, { reason: 'replay_ceiling' });
+        continue;
       }
 
       // --- Change 4: Truncation-triggered rotation ---
@@ -409,6 +440,7 @@ export class Rotator extends EventEmitter {
       // empty or the thread is too short to be useful.
       let brief;
       let usedConversationThread = false;
+      const isAutoRotation = options.reason && options.reason !== 'manual';
       if (typeof journalist.buildConversationResumePrompt === 'function') {
         const conversationPrompt = journalist.buildConversationResumePrompt(
           agent,
@@ -421,6 +453,22 @@ export class Rotator extends EventEmitter {
         }
       }
       if (!usedConversationThread) {
+        // Chat-continuity protection: an agent with a live user conversation must
+        // carry that dialogue into the fresh session. If the thread can't be
+        // extracted, a boilerplate brief would wipe the agent's memory of the
+        // conversation — skip the auto-rotation instead (context stays intact,
+        // worst case is status quo). Manual rotations proceed; the user accepts the risk.
+        if (isAutoRotation && this.userMessageTimes.has(agentId)) {
+          console.warn(`  Rotator: ${agent.name} has chat history but no extractable conversation thread — skipping rotation`);
+          this.rotating.delete(agentId);
+          this.daemon.broadcast({
+            type: 'rotation:blocked',
+            agentId,
+            agentName: agent.name,
+            reason: 'no_conversation_thread',
+          });
+          return null;
+        }
         brief = await journalist.generateHandoffBrief(agent, {
           reason: options.reason,
           qualityScore: options.qualityScore,
@@ -435,11 +483,14 @@ export class Rotator extends EventEmitter {
       // with too little meaningful content, the new agent will arrive blind.
       // Block it rather than spawning an agent that can't continue the work.
       // Manual rotations (user-requested) are never blocked — the user accepts the risk.
-      const isAutoRotation = options.reason && options.reason !== 'manual';
       if (isAutoRotation && !usedConversationThread) {
         const briefContent = brief
           .replace(/^#.*$/gm, '')           // strip markdown headers
           .replace(/^[-*].*role:.*$/gim, '') // strip metadata lines
+          // Strip the static Instructions boilerplate generateHandoffBrief always
+          // appends (~400 chars) — padding must not defeat the content threshold
+          .replace(/^- (Do NOT|If the task).*$/gm, '')
+          .replace(/^Continue and finish the in-progress task.*$/gm, '')
           .replace(/^\s*$/gm, '')           // strip blank lines
           .trim();
         if (briefContent.length < 200) {
@@ -716,6 +767,8 @@ export class Rotator extends EventEmitter {
     const hardCeilingRotations = this.rotationHistory.filter((r) => r.reason === 'hard_ceiling').length;
     const tokenCeilingRotations = this.rotationHistory.filter((r) => r.reason === 'token_ceiling').length;
     const estimatedCeilingRotations = this.rotationHistory.filter((r) => r.reason === 'estimated_context_ceiling').length;
+    const replayCeilingRotations = this.rotationHistory.filter((r) => r.reason === 'replay_ceiling').length;
+    const velocityCeilingRotations = this.rotationHistory.filter((r) => r.reason === 'velocity_ceiling').length;
     return {
       enabled: this.enabled,
       totalRotations,
@@ -726,6 +779,8 @@ export class Rotator extends EventEmitter {
       hardCeilingRotations,
       tokenCeilingRotations,
       estimatedCeilingRotations,
+      replayCeilingRotations,
+      velocityCeilingRotations,
       rotating: Array.from(this.rotating),
       liveScores: this.liveScores,
       scoreHistory: this.scoreHistory,
@@ -734,6 +789,8 @@ export class Rotator extends EventEmitter {
       qualityThreshold: QUALITY_THRESHOLD,
       cooldownMs: COOLDOWN_MS,
       tokenCeiling: TOKEN_CEILING,
+      replayCeiling: this.daemon.config?.replayCeiling ?? REPLAY_CEILING,
+      velocityCeiling: this.daemon.config?.velocityCeiling ?? VELOCITY_CEILING,
       roleMultipliers: ROLE_MULTIPLIERS,
     };
   }

package/packages/daemon/src/tokentracker.js

@@ -12,6 +12,14 @@ const COLD_START_PER_FILE = 15;
 const COLD_START_PER_DIR = 40;
 // Estimated tokens wasted per file conflict (agent discovers, backs off, retries)
 const CONFLICT_OVERHEAD = 500;
+// Max per-agent session records kept. Aggregates are cumulative and unaffected;
+// windowed queries (getVelocity/getTokensInWindow) only need the recent tail,
+// which 500 records covers by orders of magnitude. Uncapped, tokens.json grew
+// to 13.8MB and was rewritten on every assistant stream event.
+const SESSION_CAP = 500;
+// Debounce window for persisting to disk. record() fires per assistant event —
+// writing the full ledger each time is a hot-path full-file rewrite.
+const SAVE_DEBOUNCE_MS = 5_000;
 
 export class TokenTracker {
   constructor(grooveDir) {
@@ -23,6 +31,7 @@ export class TokenTracker {
     this.coldStartsSkipped = 0;
     this.projectFiles = 0;   // Set from indexer stats
     this.projectDirs = 0;
+    this._saveTimer = null;
     this.load();
   }
 
@@ -47,6 +56,7 @@ export class TokenTracker {
           if (!entry.totalDurationMs) entry.totalDurationMs = 0;
           if (!entry.totalTurns) entry.totalTurns = 0;
           if (!entry.modelDistribution) entry.modelDistribution = {};
+          this._capSessions(entry);
         }
       } catch {
         this.usage = {};
@@ -55,6 +65,10 @@ export class TokenTracker {
   }
 
   save() {
+    if (this._saveTimer) {
+      clearTimeout(this._saveTimer);
+      this._saveTimer = null;
+    }
     writeFileSync(this.path, JSON.stringify({
       usage: this.usage,
       rotationSavings: this.rotationSavings,
@@ -64,6 +78,30 @@ export class TokenTracker {
     }, null, 2));
   }
 
+  // Debounced persistence for hot-path recording. In-memory state is always
+  // current; at most SAVE_DEBOUNCE_MS of records are at risk on a crash.
+  _scheduleSave() {
+    if (this._saveTimer) return;
+    this._saveTimer = setTimeout(() => {
+      this._saveTimer = null;
+      try { this.save(); } catch { /* best-effort */ }
+    }, SAVE_DEBOUNCE_MS);
+    this._saveTimer.unref?.();
+  }
+
+  // Write any pending debounced state to disk. Call on daemon shutdown.
+  flush() {
+    if (this._saveTimer) {
+      try { this.save(); } catch { /* best-effort */ }
+    }
+  }
+
+  _capSessions(entry) {
+    if (Array.isArray(entry.sessions) && entry.sessions.length > SESSION_CAP) {
+      entry.sessions.splice(0, entry.sessions.length - SESSION_CAP);
+    }
+  }
+
   _initAgent(agentId) {
     if (!this.usage[agentId]) {
       this.usage[agentId] = {
@@ -89,7 +127,8 @@ export class TokenTracker {
     if (typeof detail === 'number') {
       entry.total += detail;
       entry.sessions.push({ tokens: detail, timestamp: new Date().toISOString() });
-      this.save();
+      this._capSessions(entry);
+      this._scheduleSave();
       return;
     }
 
@@ -121,8 +160,9 @@ export class TokenTracker {
       projectRoot: detail.projectRoot || null,
       timestamp: new Date().toISOString(),
     });
+    this._capSessions(entry);
 
-    this.save();
+    this._scheduleSave();
   }
 
   // Sum tokens recorded for an agent since a given timestamp.
@@ -152,25 +192,25 @@ export class TokenTracker {
     if (costUsd) entry.totalCostUsd += costUsd;
     if (durationMs) entry.totalDurationMs += durationMs;
     if (turns) entry.totalTurns += turns;
-    this.save();
+    this._scheduleSave();
   }
 
   // Record that a rotation saved context tokens
   recordRotation(agentId, tokensBefore) {
     this.rotationSavings += Math.round(tokensBefore * 0.3); // ~30% of context was degraded
-    this.save();
+    this._scheduleSave();
   }
 
   // Record that a conflict was prevented (scope enforcement)
   recordConflictPrevented() {
     this.conflictsPrevented++;
-    this.save();
+    this._scheduleSave();
   }
 
   // Record that a cold-start was skipped (Journalist provided context)
   recordColdStartSkipped() {
     this.coldStartsSkipped++;
-    this.save();
+    this._scheduleSave();
   }
 
   // Set project size from indexer for dynamic cold-start estimation

package/packages/gui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/gui",
-  "version": "0.27.180",
+  "version": "0.27.182",
   "description": "GROOVE GUI — visual agent control plane",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",