groove-dev 0.27.181 → 0.27.182

package/CLAUDE.md

@@ -295,3 +295,10 @@ Audit-driven release. Multi-agent orchestration system with 7 coordination layer
 - Dashboard: routing donut, cache panel, context health gauges
 - Monitor/QC agent mode (stay active, loop)
 - Distribution: demo video, HN launch, Twitter content
+
+<!-- GROOVE:START -->
+## GROOVE Orchestration (auto-injected)
+Active agents: 0
+See AGENTS_REGISTRY.md for full agent state.
+**Memory policy:** GROOVE manages project memory automatically. Do not read or write MEMORY.md or .groove/memory/ files directly.
+<!-- GROOVE:END -->

package/node_modules/@groove-dev/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/cli",
-  "version": "0.27.181",
+  "version": "0.27.182",
   "description": "GROOVE CLI — manage AI coding agents from your terminal",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/node_modules/@groove-dev/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/daemon",
-  "version": "0.27.181",
+  "version": "0.27.182",
   "description": "GROOVE daemon — agent orchestration engine",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/node_modules/@groove-dev/daemon/scripts/repair-tokens.mjs

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+// FSL-1.1-Apache-2.0 — see LICENSE
+//
+// One-off ledger repair for ~/.groove/tokens.json (2026-07 efficiency audit).
+//
+// Entry c3789b6f recorded $20,536.57 from a duplicate-ingestion loop (4,631
+// session records in 380s, payloads duplicated up to 10×). The ingestion bug
+// is fixed in claude-code.js, but the poisoned data still dominates every cost
+// dashboard: recorded all-time spend ~$24K vs ~$3.5K real. This script:
+//   1. Sets the poisoned entry's totalCostUsd to its audited real value (~$325)
+//   2. Truncates every entry's sessions array to the last 500 records
+//      (matches SESSION_CAP in tokentracker.js; aggregates are untouched)
+//   3. Writes a timestamped .bak of the original file first
+//
+// MUST run with the daemon STOPPED — the daemon holds the ledger in memory and
+// rewrites the file, so a live edit gets clobbered. The script checks and aborts.
+//
+// Usage: node repair-tokens.mjs [path-to-tokens.json] [--entry c3789b6f] [--cost 325]
+
+import { readFileSync, writeFileSync, copyFileSync, existsSync } from 'fs';
+import { resolve } from 'path';
+import { homedir } from 'os';
+
+const args = process.argv.slice(2);
+const flag = (name, dflt) => {
+  const i = args.indexOf(`--${name}`);
+  return i !== -1 && args[i + 1] ? args[i + 1] : dflt;
+};
+const tokensPath = args[0] && !args[0].startsWith('--')
+  ? resolve(args[0])
+  : resolve(homedir(), '.groove', 'tokens.json');
+const entryId = flag('entry', 'c3789b6f');
+const correctedCost = Number(flag('cost', '325'));
+const SESSION_CAP = 500;
+
+// Refuse to edit under a live daemon
+try {
+  const res = await fetch('http://127.0.0.1:31415/api/health', { signal: AbortSignal.timeout(1500) });
+  if (res.ok) {
+    console.error('ABORT: GROOVE daemon is running on :31415. Stop it first (groove stop) — it rewrites tokens.json and will clobber this repair.');
+    process.exit(1);
+  }
+} catch { /* no daemon — safe to proceed */ }
+
+if (!existsSync(tokensPath)) {
+  console.error(`ABORT: ${tokensPath} not found. Pass the path explicitly: node repair-tokens.mjs /path/to/tokens.json`);
+  process.exit(1);
+}
+
+const backupPath = `${tokensPath}.${new Date().toISOString().replace(/[:.]/g, '-')}.bak`;
+copyFileSync(tokensPath, backupPath);
+console.log(`Backup written: ${backupPath}`);
+
+const data = JSON.parse(readFileSync(tokensPath, 'utf8'));
+const usage = data.usage || data;
+
+const target = usage[entryId];
+if (target) {
+  const before = target.totalCostUsd;
+  target.totalCostUsd = correctedCost;
+  target.note = `totalCostUsd corrected ${before} -> ${correctedCost} on ${new Date().toISOString().slice(0, 10)} (duplicate-ingestion inflation, see 2026-07 efficiency audit)`;
+  console.log(`Entry ${entryId}: totalCostUsd ${before} -> ${correctedCost}`);
+} else {
+  console.warn(`Entry ${entryId} not found — skipping cost correction.`);
+}
+
+let trimmed = 0;
+for (const entry of Object.values(usage)) {
+  if (Array.isArray(entry?.sessions) && entry.sessions.length > SESSION_CAP) {
+    trimmed += entry.sessions.length - SESSION_CAP;
+    entry.sessions.splice(0, entry.sessions.length - SESSION_CAP);
+  }
+}
+console.log(`Trimmed ${trimmed} session records across all entries (cap ${SESSION_CAP}).`);
+
+writeFileSync(tokensPath, JSON.stringify(data, null, 2));
+const sizeMb = (Buffer.byteLength(JSON.stringify(data)) / 1024 / 1024).toFixed(1);
+console.log(`Repaired ledger written: ${tokensPath} (${sizeMb}MB)`);

package/node_modules/@groove-dev/daemon/src/api.js

@@ -1438,7 +1438,7 @@ Keep responses concise. Help them think, don't lecture them about the system the
       'port', 'journalistInterval', 'rotationThreshold', 'autoRotation',
       'qcThreshold', 'maxAgents', 'defaultProvider', 'defaultWorkingDir',
       'onboardingDismissed', 'defaultModel', 'defaultChatProvider', 'defaultChatModel',
-      'dataSharingDismissed',
+      'dataSharingDismissed', 'replayCeiling', 'velocityCeiling', 'journalistModelTier',
     ];
     for (const key of Object.keys(req.body)) {
       if (!ALLOWED_KEYS.includes(key)) {

package/node_modules/@groove-dev/daemon/src/index.js

@@ -836,6 +836,7 @@ export class Daemon {
     // Persist state before shutdown
     this.state.set('agents', this.registry.getAll());
     await this.state.save();
+    try { this.tokens.flush(); } catch { /* best-effort */ }
 
     // Stop background services
     await this.gateways.stop();

package/node_modules/@groove-dev/daemon/src/journalist.js

@@ -5,6 +5,7 @@ import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync } from 'fs
 import { resolve } from 'path';
 import { execFile, spawn as cpSpawn } from 'child_process';
 import { getProvider, getInstalledProviders, resolveProviderCommand } from './providers/index.js';
+import { agentLogPath } from './process.js';
 
 const DEFAULT_INTERVAL = 300_000; // 5 minutes (safety-net fallback; event-driven triggers handle the normal case)
 const MAX_LOG_CHARS = 100_000; // ~25k tokens budget for synthesis input (captures 80-90% of recent activity)
@@ -168,7 +169,7 @@ export class Journalist {
 
   hasNewActivity(agents) {
     for (const agent of agents) {
-      const logPath = resolve(this.daemon.grooveDir, 'logs', `${agent.id}.log`);
+      const logPath = agentLogPath(this.daemon.grooveDir, agent);
       if (!existsSync(logPath)) continue;
       try {
         const size = statSync(logPath).size;
@@ -182,7 +183,7 @@ export class Journalist {
     const result = {};
 
     for (const agent of agents) {
-      const logPath = resolve(this.daemon.grooveDir, 'logs', `${agent.id}.log`);
+      const logPath = agentLogPath(this.daemon.grooveDir, agent);
       if (!existsSync(logPath)) {
         result[agent.id] = { agent, entries: [], explorationEntries: [] };
         continue;
@@ -574,9 +575,15 @@ export class Journalist {
       const provider = getProvider(providerId);
       if (!provider) continue;
 
-      const selectedModel = provider.constructor.models?.find((m) => m.tier === 'medium')
-        || provider.constructor.models?.find((m) => m.tier === 'light')
-        || provider.constructor.models?.[0];
+      // Digests are light-tier work (Haiku-shaped): default internal overhead to
+      // the cheapest tier, escalate via config only on evidence of quality issues.
+      // On Claude, medium→light cuts the journalist's marginal cost ~90%.
+      const models = provider.constructor.models || [];
+      const preferredTier = this.daemon.config?.journalistModelTier || 'light';
+      const selectedModel = models.find((m) => m.tier === preferredTier)
+        || models.find((m) => m.tier === 'light')
+        || models.find((m) => m.tier === 'medium')
+        || models[0];
       const modelId = selectedModel?.id || null;
 
       // Try CLI headless command first
@@ -1055,7 +1062,7 @@ export class Journalist {
    * Budget: keeps recent turns verbatim, summarizes oldest if over maxChars.
    */
   extractConversationThread(agent, { maxChars = 60000 } = {}) {
-    const logPath = resolve(this.daemon.grooveDir, 'logs', `${agent.id}.log`);
+    const logPath = agentLogPath(this.daemon.grooveDir, agent);
     if (!existsSync(logPath)) return null;
 
     let content;
@@ -1297,7 +1304,7 @@ export class Journalist {
    * Used by the Introducer to tell new agents what their teammates built.
    */
   getAgentFiles(agent) {
-    const logPath = resolve(this.daemon.grooveDir, 'logs', `${agent.id}.log`);
+    const logPath = agentLogPath(this.daemon.grooveDir, agent);
     if (!existsSync(logPath)) return [];
 
     try {
@@ -1335,7 +1342,7 @@ export class Journalist {
    * Used to capture planner conclusions, build summaries, etc.
    */
   getAgentResult(agent) {
-    const logPath = resolve(this.daemon.grooveDir, 'logs', `${agent.id}.log`);
+    const logPath = agentLogPath(this.daemon.grooveDir, agent);
     if (!existsSync(logPath)) return '';
 
     try {

package/node_modules/@groove-dev/daemon/src/process.js

@@ -324,6 +324,15 @@ function sanitizeFilename(name) {
   return String(name).replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 64);
 }
 
+// Agent log files are keyed by sanitized agent NAME, not id — a rotated agent
+// keeps its name and appends to the same file, preserving conversation history
+// across rotations. Every reader must resolve paths through this helper: an
+// id-based path silently misses the file and downstream consumers (handoff
+// briefs, conversation resume, synthesis) fall back to empty context.
+export function agentLogPath(grooveDir, agent) {
+  return resolve(grooveDir, 'logs', `${sanitizeFilename(agent.name)}.log`);
+}
+
 // Apply Claude Code billing mode to a spawn env, in place.
 // The `claude` CLI bills to usage credits when ANTHROPIC_API_KEY is present and
 // to the OAuth subscription otherwise. 'subscription' (default) strips any
@@ -1146,7 +1155,7 @@ For normal file edits within your scope, proceed without review.
     // Set up log capture (shared between CLI and agent loop paths)
     const logDir = resolve(this.daemon.grooveDir, 'logs');
     mkdirSync(logDir, { recursive: true });
-    const logPath = resolve(logDir, `${sanitizeFilename(agent.name)}.log`);
+    const logPath = agentLogPath(this.daemon.grooveDir, agent);
     const logStream = createWriteStream(logPath, { flags: 'a', mode: 0o600 });
 
     // Inject API key from credential store for agent-loop providers
@@ -1567,38 +1576,54 @@ For normal file edits within your scope, proceed without review.
 
     // Session result data (cost, duration, turns)
     if (output.type === 'result') {
-      // Phantom-interrupt abort: on --resume with an orphaned background shell
-      // task, the CLI injects a synthetic "[Request interrupted by user]" that
-      // aborts the turn before the model is ever called. Fingerprint is an
-      // error result that never reached the API (apiDurationMs === 0, so zero
-      // cost). Retrying is free and succeeds ~94% of the time — treating it as
-      // a normal result is what made user messages vanish silently.
-      if (output.isError && output.apiDurationMs === 0) {
-        if (this._retryDroppedTurn(agentId, agent, output)) return;
-      }
-      // A turn completed for real — the user's message is safely delivered.
-      this._pendingUserMessage.delete(agentId);
-
-      tokens.recordResult(agentId, {
-        costUsd: output.cost, durationMs: output.duration, turns: output.turns,
-      });
-      if (output.cost) updates.costUsd = (agent.costUsd || 0) + output.cost;
-      if (output.duration) updates.durationMs = output.duration;
-      if (output.turns) updates.turns = output.turns;
-
-      // Claude Code sometimes hangs after emitting the result event — the
-      // process stays alive instead of exiting.  Record that the result
-      // arrived so exit handlers know this was a successful completion even
-      // if we have to SIGTERM the process.  After a 5s grace period, force-
-      // kill any process that hasn't exited on its own.
-      this._resultReceived.add(agentId);
-      const handle = this.handles.get(agentId);
-      if (handle?.proc && typeof handle.proc.kill === 'function') {
-        setTimeout(() => {
-          if (this.handles.has(agentId) && this._resultReceived.has(agentId)) {
-            try { handle.proc.kill('SIGTERM'); } catch {}
-          }
-        }, 5_000);
+      // Did this result represent a turn that actually ran? CLI >= 2.1.212
+      // emits a 0-turn no-op `result` during --resume reconciliation, before
+      // the real turn starts. Both it and an aborted turn report
+      // duration_api_ms === 0 — the model was never called. Providers that
+      // don't report an API duration (codex, gemini, ollama) are unaffected.
+      const reachedModel = output.apiDurationMs === undefined || output.apiDurationMs > 0;
+
+      // Turn aborted before the model was called — re-deliver the message.
+      // Deliberately does NOT return: session id persistence and the GUI
+      // broadcast below still need to run, and the retry is scheduled async.
+      if (!reachedModel && output.isError) {
+        this._retryDroppedTurn(agentId, agent, output);
+      }
+
+      // Everything below is completion bookkeeping and must only run for a
+      // turn that actually executed. Running it for the resume handshake is
+      // what killed the process mid-turn.
+      if (reachedModel) {
+        // The user's message is safely delivered.
+        this._pendingUserMessage.delete(agentId);
+
+        tokens.recordResult(agentId, {
+          costUsd: output.cost, durationMs: output.duration, turns: output.turns,
+        });
+        if (output.cost) updates.costUsd = (agent.costUsd || 0) + output.cost;
+        if (output.duration) updates.durationMs = output.duration;
+        if (output.turns) updates.turns = output.turns;
+
+        // Claude Code sometimes hangs after emitting the result event — the
+        // process stays alive instead of exiting.  Record that the result
+        // arrived so exit handlers know this was a successful completion even
+        // if we have to SIGTERM the process.  After a 5s grace period, force-
+        // kill any process that hasn't exited on its own.
+        //
+        // MUST stay behind the reachedModel guard. CLI >= 2.1.212 emits a
+        // 0-turn no-op result ~180ms into --resume; arming this on that result
+        // SIGTERMs the process ~5.2s later, mid-turn, before a token is
+        // produced (fable TTFT observed at 34s). The CLI records the signal as
+        // "[Request interrupted by user]" and the user's message is destroyed.
+        this._resultReceived.add(agentId);
+        const handle = this.handles.get(agentId);
+        if (handle?.proc && typeof handle.proc.kill === 'function') {
+          setTimeout(() => {
+            if (this.handles.has(agentId) && this._resultReceived.has(agentId)) {
+              try { handle.proc.kill('SIGTERM'); } catch {}
+            }
+          }, 5_000);
+        }
       }
     }
 

package/node_modules/@groove-dev/daemon/src/providers/claude-code.js

@@ -275,7 +275,15 @@ export class ClaudeCodeProvider extends Provider {
 
     // Merge events: prefer content-bearing events (activity/result) over usage/session.
     // Accumulate token counts across all events in this chunk.
-    let content = events.find((e) => e.type === 'result') || events.find((e) => e.type === 'activity') || events[events.length - 1];
+    // Prefer an error result over a success one when a single chunk carries
+    // both. During --resume the CLI emits a 0-turn no-op success result
+    // immediately before the real turn's result; taking the first would hide a
+    // subsequent abort and the failure would look like a clean completion.
+    const resultEvents = events.filter((e) => e.type === 'result');
+    let content = resultEvents.find((e) => e.isError)
+      || resultEvents[0]
+      || events.find((e) => e.type === 'activity')
+      || events[events.length - 1];
     const merged = { ...content };
 
     let totalTokens = 0;

package/node_modules/@groove-dev/daemon/src/rotator.js

@@ -18,6 +18,9 @@ const SCORE_HISTORY_MAX = 40;   // ~10 min at 15s intervals
 const COOLDOWN_MS = 5 * 60 * 1000;   // 5 minutes between rotations per agent
 const QUALITY_COOLDOWN_MS = 2 * 60 * 1000; // 2 minutes for quality degradation rotations
 const TOKEN_CEILING = 5_000_000;     // 5M tokens per agent (non-self-managing only)
+const REPLAY_CEILING = 0.50;         // Self-managing providers: rotate idle agents above this context usage
+const VELOCITY_CEILING = 250_000;    // New (non-cache) tokens per window before force rotation
+const VELOCITY_WINDOW_MS = 5 * 60_000;
 const ROLE_MULTIPLIERS = {
   planner: 2,
   fullstack: 4,
@@ -201,13 +204,34 @@ export class Rotator extends EventEmitter {
       const singleTask = providerInstance?.constructor?.singleTask ?? false;
       if (singleTask) continue;
 
-      // Skip agents idle for over 60s — no point scoring them every 15s
-      const idleMs = this._idleMs(agent);
-      if (idleMs > 60_000 && agent.contextUsage < HARD_CEILING) continue;
-
       // Determine if provider manages its own context (e.g. Claude Code compacts internally)
       const selfManagesContext = providerInstance?.constructor?.managesOwnContext ?? false;
 
+      // Velocity safety — new-token burn rate, all provider types. tokensUsed
+      // excludes cache reads, so this measures real generation. Caps worst-case
+      // runaway burn; bypasses cooldown (a runaway must be stopped, not waited out).
+      const velCeiling = this.daemon.config?.velocityCeiling ?? VELOCITY_CEILING;
+      const velocity = this.daemon.tokens?.getVelocity?.(agent.id, VELOCITY_WINDOW_MS) ?? 0;
+      if (velCeiling > 0 && velocity >= velCeiling) {
+        console.warn(`  Rotator: ${agent.name} burned ${velCeiling.toLocaleString()}+ new tokens in 5min — FORCE rotating (velocity)`);
+        await this.rotate(agent.id, { reason: 'velocity_ceiling' });
+        continue;
+      }
+
+      // Replay ceiling — self-managing providers only. Internal compaction keeps
+      // sessions functional but lets context ride at 60-85% indefinitely, and every
+      // subsequent message replays that much context on EVERY API call in the agent
+      // loop. A handoff-brief rotation costs ~10K tokens once; riding high costs
+      // 150-300K per call. Computed here because the idle-skip guard below must
+      // not hide the exact agents this targets (idle, high-context).
+      const replayCeiling = this.daemon.config?.replayCeiling ?? REPLAY_CEILING;
+      const overReplayCeiling = selfManagesContext && replayCeiling > 0
+        && agent.contextUsage >= replayCeiling;
+
+      // Skip agents idle for over 60s — no point scoring them every 15s
+      const idleMs = this._idleMs(agent);
+      if (idleMs > 60_000 && agent.contextUsage < HARD_CEILING && !overReplayCeiling) continue;
+
       if (!selfManagesContext) {
         // Non-Claude: threshold + ceiling + quality rotation
         // These providers fill up linearly and degrade without external rotation
@@ -260,6 +284,13 @@ export class Rotator extends EventEmitter {
             continue;
           }
         }
+      } else if (overReplayCeiling && !this._isOnCooldown(agent.id) && idleMs > 10_000) {
+        // Rotate while idle only — never mid-task — and respect the cooldown.
+        // Continuity comes from the conversation-thread resume; rotate() blocks
+        // the rotation entirely if the thread can't be extracted for a chat agent.
+        console.log(`  Rotator: ${agent.name} at ${Math.round(agent.contextUsage * 100)}% — rotating (replay ceiling)`);
+        await this.rotate(agent.id, { reason: 'replay_ceiling' });
+        continue;
       }
 
       // --- Change 4: Truncation-triggered rotation ---
@@ -409,6 +440,7 @@ export class Rotator extends EventEmitter {
       // empty or the thread is too short to be useful.
       let brief;
       let usedConversationThread = false;
+      const isAutoRotation = options.reason && options.reason !== 'manual';
       if (typeof journalist.buildConversationResumePrompt === 'function') {
         const conversationPrompt = journalist.buildConversationResumePrompt(
           agent,
@@ -421,6 +453,22 @@ export class Rotator extends EventEmitter {
         }
       }
       if (!usedConversationThread) {
+        // Chat-continuity protection: an agent with a live user conversation must
+        // carry that dialogue into the fresh session. If the thread can't be
+        // extracted, a boilerplate brief would wipe the agent's memory of the
+        // conversation — skip the auto-rotation instead (context stays intact,
+        // worst case is status quo). Manual rotations proceed; the user accepts the risk.
+        if (isAutoRotation && this.userMessageTimes.has(agentId)) {
+          console.warn(`  Rotator: ${agent.name} has chat history but no extractable conversation thread — skipping rotation`);
+          this.rotating.delete(agentId);
+          this.daemon.broadcast({
+            type: 'rotation:blocked',
+            agentId,
+            agentName: agent.name,
+            reason: 'no_conversation_thread',
+          });
+          return null;
+        }
         brief = await journalist.generateHandoffBrief(agent, {
           reason: options.reason,
           qualityScore: options.qualityScore,
@@ -435,11 +483,14 @@ export class Rotator extends EventEmitter {
       // with too little meaningful content, the new agent will arrive blind.
       // Block it rather than spawning an agent that can't continue the work.
       // Manual rotations (user-requested) are never blocked — the user accepts the risk.
-      const isAutoRotation = options.reason && options.reason !== 'manual';
       if (isAutoRotation && !usedConversationThread) {
         const briefContent = brief
           .replace(/^#.*$/gm, '')           // strip markdown headers
           .replace(/^[-*].*role:.*$/gim, '') // strip metadata lines
+          // Strip the static Instructions boilerplate generateHandoffBrief always
+          // appends (~400 chars) — padding must not defeat the content threshold
+          .replace(/^- (Do NOT|If the task).*$/gm, '')
+          .replace(/^Continue and finish the in-progress task.*$/gm, '')
           .replace(/^\s*$/gm, '')           // strip blank lines
           .trim();
         if (briefContent.length < 200) {
@@ -716,6 +767,8 @@ export class Rotator extends EventEmitter {
     const hardCeilingRotations = this.rotationHistory.filter((r) => r.reason === 'hard_ceiling').length;
     const tokenCeilingRotations = this.rotationHistory.filter((r) => r.reason === 'token_ceiling').length;
     const estimatedCeilingRotations = this.rotationHistory.filter((r) => r.reason === 'estimated_context_ceiling').length;
+    const replayCeilingRotations = this.rotationHistory.filter((r) => r.reason === 'replay_ceiling').length;
+    const velocityCeilingRotations = this.rotationHistory.filter((r) => r.reason === 'velocity_ceiling').length;
     return {
       enabled: this.enabled,
       totalRotations,
@@ -726,6 +779,8 @@ export class Rotator extends EventEmitter {
       hardCeilingRotations,
       tokenCeilingRotations,
       estimatedCeilingRotations,
+      replayCeilingRotations,
+      velocityCeilingRotations,
       rotating: Array.from(this.rotating),
       liveScores: this.liveScores,
       scoreHistory: this.scoreHistory,
@@ -734,6 +789,8 @@ export class Rotator extends EventEmitter {
       qualityThreshold: QUALITY_THRESHOLD,
       cooldownMs: COOLDOWN_MS,
       tokenCeiling: TOKEN_CEILING,
+      replayCeiling: this.daemon.config?.replayCeiling ?? REPLAY_CEILING,
+      velocityCeiling: this.daemon.config?.velocityCeiling ?? VELOCITY_CEILING,
       roleMultipliers: ROLE_MULTIPLIERS,
     };
   }

package/node_modules/@groove-dev/daemon/src/tokentracker.js

@@ -12,6 +12,14 @@ const COLD_START_PER_FILE = 15;
 const COLD_START_PER_DIR = 40;
 // Estimated tokens wasted per file conflict (agent discovers, backs off, retries)
 const CONFLICT_OVERHEAD = 500;
+// Max per-agent session records kept. Aggregates are cumulative and unaffected;
+// windowed queries (getVelocity/getTokensInWindow) only need the recent tail,
+// which 500 records covers by orders of magnitude. Uncapped, tokens.json grew
+// to 13.8MB and was rewritten on every assistant stream event.
+const SESSION_CAP = 500;
+// Debounce window for persisting to disk. record() fires per assistant event —
+// writing the full ledger each time is a hot-path full-file rewrite.
+const SAVE_DEBOUNCE_MS = 5_000;
 
 export class TokenTracker {
   constructor(grooveDir) {
@@ -23,6 +31,7 @@ export class TokenTracker {
     this.coldStartsSkipped = 0;
     this.projectFiles = 0;   // Set from indexer stats
     this.projectDirs = 0;
+    this._saveTimer = null;
     this.load();
   }
 
@@ -47,6 +56,7 @@ export class TokenTracker {
           if (!entry.totalDurationMs) entry.totalDurationMs = 0;
           if (!entry.totalTurns) entry.totalTurns = 0;
           if (!entry.modelDistribution) entry.modelDistribution = {};
+          this._capSessions(entry);
         }
       } catch {
         this.usage = {};
@@ -55,6 +65,10 @@ export class TokenTracker {
   }
 
   save() {
+    if (this._saveTimer) {
+      clearTimeout(this._saveTimer);
+      this._saveTimer = null;
+    }
     writeFileSync(this.path, JSON.stringify({
       usage: this.usage,
       rotationSavings: this.rotationSavings,
@@ -64,6 +78,30 @@ export class TokenTracker {
     }, null, 2));
   }
 
+  // Debounced persistence for hot-path recording. In-memory state is always
+  // current; at most SAVE_DEBOUNCE_MS of records are at risk on a crash.
+  _scheduleSave() {
+    if (this._saveTimer) return;
+    this._saveTimer = setTimeout(() => {
+      this._saveTimer = null;
+      try { this.save(); } catch { /* best-effort */ }
+    }, SAVE_DEBOUNCE_MS);
+    this._saveTimer.unref?.();
+  }
+
+  // Write any pending debounced state to disk. Call on daemon shutdown.
+  flush() {
+    if (this._saveTimer) {
+      try { this.save(); } catch { /* best-effort */ }
+    }
+  }
+
+  _capSessions(entry) {
+    if (Array.isArray(entry.sessions) && entry.sessions.length > SESSION_CAP) {
+      entry.sessions.splice(0, entry.sessions.length - SESSION_CAP);
+    }
+  }
+
   _initAgent(agentId) {
     if (!this.usage[agentId]) {
       this.usage[agentId] = {
@@ -89,7 +127,8 @@ export class TokenTracker {
     if (typeof detail === 'number') {
       entry.total += detail;
       entry.sessions.push({ tokens: detail, timestamp: new Date().toISOString() });
-      this.save();
+      this._capSessions(entry);
+      this._scheduleSave();
       return;
     }
 
@@ -121,8 +160,9 @@ export class TokenTracker {
       projectRoot: detail.projectRoot || null,
       timestamp: new Date().toISOString(),
     });
+    this._capSessions(entry);
 
-    this.save();
+    this._scheduleSave();
   }
 
   // Sum tokens recorded for an agent since a given timestamp.
@@ -152,25 +192,25 @@ export class TokenTracker {
     if (costUsd) entry.totalCostUsd += costUsd;
     if (durationMs) entry.totalDurationMs += durationMs;
     if (turns) entry.totalTurns += turns;
-    this.save();
+    this._scheduleSave();
   }
 
   // Record that a rotation saved context tokens
   recordRotation(agentId, tokensBefore) {
     this.rotationSavings += Math.round(tokensBefore * 0.3); // ~30% of context was degraded
-    this.save();
+    this._scheduleSave();
   }
 
   // Record that a conflict was prevented (scope enforcement)
   recordConflictPrevented() {
     this.conflictsPrevented++;
-    this.save();
+    this._scheduleSave();
   }
 
   // Record that a cold-start was skipped (Journalist provided context)
   recordColdStartSkipped() {
     this.coldStartsSkipped++;
-    this.save();
+    this._scheduleSave();
   }
 
   // Set project size from indexer for dynamic cold-start estimation

package/node_modules/@groove-dev/daemon/test/claude-code-provider.test.js

@@ -69,6 +69,58 @@ describe('ClaudeCodeProvider result parsing', () => {
   });
 });
 
+describe('ClaudeCodeProvider resume handshake (CLI >= 2.1.212)', () => {
+  // The 0-turn no-op result the CLI emits ~180ms into --resume reconciliation.
+  const HANDSHAKE = JSON.stringify({
+    type: 'result', subtype: 'success', is_error: false,
+    duration_ms: 186, duration_api_ms: 0, num_turns: 0, total_cost_usd: 0,
+  });
+  const ABORT = JSON.stringify({
+    type: 'result', subtype: 'error_during_execution', is_error: true,
+    duration_ms: 5126, duration_api_ms: 0, num_turns: 2, total_cost_usd: 0,
+    terminal_reason: 'aborted_streaming',
+  });
+
+  // This is the gate the daemon uses to decide whether a result means "the
+  // turn completed". Treating the handshake as a completion arms a 5s
+  // force-kill that SIGTERMs the process mid-turn.
+  const reachedModel = (o) => o.apiDurationMs === undefined || o.apiDurationMs > 0;
+
+  it('does not count the resume handshake as a completed turn', () => {
+    const out = provider.parseOutput(HANDSHAKE);
+    assert.equal(out.isError, false);
+    assert.equal(reachedModel(out), false,
+      'handshake must not arm the force-kill or clear the queued message');
+  });
+
+  it('counts a real turn as completed', () => {
+    const out = provider.parseOutput(JSON.stringify({
+      type: 'result', subtype: 'success', is_error: false,
+      duration_ms: 17850, duration_api_ms: 17672, num_turns: 3, total_cost_usd: 0.42,
+    }));
+    assert.equal(reachedModel(out), true);
+  });
+
+  it('providers without an API duration still count as completed', () => {
+    // codex / gemini / ollama don't report duration_api_ms — they must be
+    // unaffected by the guard.
+    const out = provider.parseOutput(JSON.stringify({
+      type: 'result', subtype: 'success', duration_ms: 1200, num_turns: 1,
+    }));
+    assert.equal(out.apiDurationMs, undefined);
+    assert.equal(reachedModel(out), true);
+  });
+
+  // Regression: taking the first result in a chunk let the handshake mask a
+  // subsequent abort, so the failure looked like a clean completion.
+  it('surfaces the abort when a chunk carries handshake + abort together', () => {
+    const out = provider.parseOutput(`${HANDSHAKE}\n${ABORT}`);
+    assert.equal(out.isError, true, 'abort must win over the no-op success result');
+    assert.equal(out.terminalReason, 'aborted_streaming');
+    assert.equal(reachedModel(out), false);
+  });
+});
+
 describe('ClaudeCodeProvider models', () => {
   it('offers Fable 5', () => {
     assert.ok(ClaudeCodeProvider.models.some((m) => m.id === 'claude-fable-5'));