muonroi-cli 1.3.4 → 1.4.1

package/dist/src/orchestrator/text-tool-call-detector.js

@@ -0,0 +1,163 @@
+/**
+ * src/orchestrator/text-tool-call-detector.ts
+ *
+ * Detect when a model emitted a TOOL CALL as plain assistant TEXT instead of
+ * using the real tool-calling interface. Some models (esp. cheap ones trained
+ * on other agent harnesses — Cline / Roo / Continue dialects) write tool calls
+ * as XML blocks like:
+ *
+ *     <read_file>
+ *       <path>src/app/foo.ts</path>
+ *     </read_file>
+ *
+ * The OpenAI-compatible layer never recognizes these as tool calls, so the SDK
+ * reports finishReason="stop" with this XML as the final answer — the agentic
+ * loop ends, the intended action never runs, and (live: storyflow_ui A/B,
+ * deepseek-v4-flash session 905d564dbde4) the turn is silently wasted, often
+ * leaving a half-finished edit behind. This detector lets the orchestrator
+ * surface the failure instead of returning the broken text as a "final answer".
+ *
+ * Distinct from tool-args-repair.ts, which repairs the `arguments` JSON of a
+ * tool call the SDK ALREADY recognized. Here there is NO recognized tool call.
+ *
+ * Precision is the priority — a false positive would wrongly flag a legitimate
+ * final answer (e.g. documentation that quotes a tool block). The detector only
+ * fires when a KNOWN tool-name tag appears as a structural invocation: an
+ * opening tag immediately followed (whitespace/newlines allowed) by either a
+ * known nested parameter tag or its own closing tag. A bare inline mention
+ * ("use the <read_file> tool") never matches.
+ */
+// Tool-name tags from the common text-dialect agent harnesses (Cline, Roo,
+// Continue, aider-ish) plus the generic wrappers. These are the OPENING tags a
+// model emits when it tries to invoke a tool as text.
+const TOOL_TAGS = [
+    "read_file",
+    "write_to_file",
+    "write_file",
+    "edit_file",
+    "apply_diff",
+    "replace_in_file",
+    "search_and_replace",
+    "insert_content",
+    "search_files",
+    "list_files",
+    "list_code_definition_names",
+    "execute_command",
+    "run_command",
+    "browser_action",
+    "use_mcp_tool",
+    "access_mcp_resource",
+    "ask_followup_question",
+    "attempt_completion",
+    // muonroi builtin tool names the NON_ANTHROPIC_TOOL_PREAMBLE explicitly
+    // forbids as text. Live: deepseek emitted `<bash>find …</bash>` as text at
+    // turn end (session ab/ds-final) — `bash` was missing here so it slipped the
+    // detector → no re-steer. Match only with a close tag or nested param,
+    // never a bare mention.
+    "bash",
+    "grep",
+    "glob",
+    "read_multiple_files",
+    "delegate",
+    "task",
+];
+// Nested parameter tags that legitimately appear INSIDE a text-dialect tool
+// block. An opening tool tag followed shortly by one of these is a strong
+// signal of an actual (mis-formatted) invocation rather than a prose mention.
+const PARAM_TAGS = [
+    "path",
+    "content",
+    "command",
+    "diff",
+    "args",
+    "query",
+    "regex",
+    "file_path",
+    "search",
+    "replace",
+    "line",
+    "operations",
+    "question",
+    "result",
+    "recursive",
+    "uri",
+    "server_name",
+    "tool_name",
+    "arguments",
+];
+const PARAM_ALTERNATION = PARAM_TAGS.join("|");
+// Generic tool-call wrappers used by other native formats. `<invoke name="...">`
+// is the Anthropic XML style; `<tool_call>` / `<function_calls>` are Qwen/other.
+// These are matched directly (the wrapper itself is the signal).
+const GENERIC_WRAPPER_RE = /<\/?(?:tool_call|function_calls|tool_use)\b|<invoke\b[^>]*\bname\s*=|<function\b[^>]*\bname\s*=/i;
+// DeepSeek native tool-call markup leaking into text content. Signature is the
+// fullwidth-bar sentinel `｜｜DSML｜｜` (U+FF5C, NOT ASCII pipes) wrapping
+// invoke/tool_calls/parameter tokens, e.g. `<｜｜DSML｜｜invoke name="read_file">`.
+// Live: storyflow_ui explore-A/B, deepseek T3 (session 799f0508e830) emitted a
+// full `<｜｜DSML｜｜invoke name="read_file">…` block as text and made no real tool
+// call → empty, silent turn. The generic `<invoke` matcher misses it because the
+// `<` is followed by the sentinel, not `invoke`. (BUG-A telemetry already flags
+// the `｜｜DSML｜｜` substring; this wires it into detect → re-steer/surface.)
+const DSML_WRAPPER_RE = /｜｜DSML｜｜\s*(?:invoke|tool_calls?|parameter)\b/i;
+const DSML_INVOKE_NAME_RE = /｜｜DSML｜｜\s*invoke\s+name\s*=\s*"([^"]+)"/i;
+/** Build a per-tool detector: `<tool>` then (within a small gap) a `<param>` or `</tool>`. */
+function buildToolRegexes() {
+    return TOOL_TAGS.map((tag) => 
+    // <tag ...> [up to ~400 chars of whitespace/attrs/text] then <param> or </tag>
+    new RegExp(`<${tag}\\b[^>]*>[\\s\\S]{0,400}?(?:<(?:${PARAM_ALTERNATION})\\b[^>]*>|</${tag}>)`, "i"));
+}
+const TOOL_REGEXES = buildToolRegexes();
+/**
+ * Detect a tool call emitted as plain text. Returns the first matching tool
+ * name (or generic wrapper label) for telemetry. High precision: requires a
+ * structural invocation shape, not a bare tag mention.
+ */
+export function detectTextEmittedToolCall(text) {
+    if (!text || text.length === 0)
+        return { detected: false, tool: null };
+    // Cap the scan — pathological inputs shouldn't cost more than a glance.
+    const scan = text.length > 200_000 ? text.slice(0, 200_000) : text;
+    if (DSML_WRAPPER_RE.test(scan)) {
+        const nameMatch = scan.match(DSML_INVOKE_NAME_RE);
+        return { detected: true, tool: nameMatch ? nameMatch[1] : "dsml" };
+    }
+    if (GENERIC_WRAPPER_RE.test(scan)) {
+        const m = scan.match(GENERIC_WRAPPER_RE);
+        return { detected: true, tool: m ? normalizeWrapperName(m[0]) : "tool_call" };
+    }
+    for (let i = 0; i < TOOL_REGEXES.length; i++) {
+        if (TOOL_REGEXES[i].test(scan)) {
+            return { detected: true, tool: TOOL_TAGS[i] };
+        }
+    }
+    return { detected: false, tool: null };
+}
+function normalizeWrapperName(raw) {
+    const m = raw.match(/tool_call|function_calls|tool_use|invoke|function/i);
+    return m ? m[0].toLowerCase() : "tool_call";
+}
+const DSML_INVOKE_BLOCK_RE = /｜｜DSML｜｜\s*invoke\s+name\s*=\s*"([^"]+)"([\s\S]*?)(?=｜｜DSML｜｜\s*invoke\s|$)/gi;
+const DSML_PARAM_RE = /｜｜DSML｜｜\s*parameter\s+name\s*=\s*"([^"]+)"[^>]*>([\s\S]*?)<\/?｜｜DSML｜｜\s*parameter/gi;
+export function parseDsmlToolCalls(text) {
+    if (!text || !text.includes("｜｜DSML｜｜"))
+        return [];
+    const calls = [];
+    DSML_INVOKE_BLOCK_RE.lastIndex = 0;
+    let block;
+    // biome-ignore lint/suspicious/noAssignInExpressions: idiomatic regex.exec loop
+    while ((block = DSML_INVOKE_BLOCK_RE.exec(text)) !== null) {
+        const name = block[1];
+        const body = block[2] ?? "";
+        const args = {};
+        DSML_PARAM_RE.lastIndex = 0;
+        let p;
+        // biome-ignore lint/suspicious/noAssignInExpressions: idiomatic regex.exec loop
+        while ((p = DSML_PARAM_RE.exec(body)) !== null) {
+            args[p[1]] = (p[2] ?? "").trim();
+        }
+        calls.push({ name, args });
+    }
+    return calls;
+}
+export const _internals = { TOOL_TAGS, PARAM_TAGS, GENERIC_WRAPPER_RE };
+//# sourceMappingURL=text-tool-call-detector.js.map

package/dist/src/orchestrator/text-tool-call-detector.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/orchestrator/text-tool-call-detector.test.js

@@ -0,0 +1,89 @@
+import { describe, expect, it } from "vitest";
+import { detectTextEmittedToolCall, parseDsmlToolCalls } from "./text-tool-call-detector.js";
+describe("detectTextEmittedToolCall", () => {
+    it("detects the Cline/Roo <read_file><path> dialect (live deepseek failure)", () => {
+        // Verbatim shape from storyflow_ui A/B session 905d564dbde4: after a
+        // destructive edit, deepseek emitted this as plain assistant text to
+        // re-read the file — the CLI returned it as the final answer and the turn
+        // was silently wasted with a broken file left behind.
+        const text = `Let me restore the file properly.
+
+<read_file>
+<path>src/app/screens/story-list/story-list.component.html</path>
+</read_file>`;
+        const r = detectTextEmittedToolCall(text);
+        expect(r.detected).toBe(true);
+        expect(r.tool).toBe("read_file");
+    });
+    it("detects write_to_file / execute_command / apply_diff blocks", () => {
+        expect(detectTextEmittedToolCall("<write_to_file>\n<path>a.ts</path>\n<content>x</content>\n</write_to_file>").detected).toBe(true);
+        expect(detectTextEmittedToolCall("<execute_command>\n<command>npm test</command>\n</execute_command>").detected).toBe(true);
+        expect(detectTextEmittedToolCall("<apply_diff>\n<path>a.ts</path>\n<diff>...</diff>\n</apply_diff>").detected).toBe(true);
+    });
+    it("detects an empty-but-closed tool block (open immediately closed)", () => {
+        expect(detectTextEmittedToolCall("here:\n<read_file></read_file>").detected).toBe(true);
+    });
+    it("detects builtin tool names emitted as text (<bash>, <grep>) — live deepseek <bash> leak", () => {
+        const r = detectTextEmittedToolCall("Starting:\n<bash>\nfind /workspace -name '*.html'\n</bash>");
+        expect(r.detected).toBe(true);
+        expect(r.tool).toBe("bash");
+        expect(detectTextEmittedToolCall("<grep>\n<pattern>foo</pattern>\n</grep>").detected).toBe(true);
+        expect(detectTextEmittedToolCall("<delegate>\n<agent>explore</agent>\n</delegate>").detected).toBe(true);
+    });
+    it("does NOT fire on a bare inline mention of bash (no invocation shape)", () => {
+        expect(detectTextEmittedToolCall("Run the build with the <bash> tool to verify.").detected).toBe(false);
+        expect(detectTextEmittedToolCall("I used bash to run the tests; they pass.").detected).toBe(false);
+    });
+    it("detects generic native wrappers (Qwen <tool_call>, Anthropic <invoke name=>)", () => {
+        expect(detectTextEmittedToolCall('<tool_call>{"name":"read_file"}</tool_call>').detected).toBe(true);
+        expect(detectTextEmittedToolCall('<invoke name="read_file"><parameter name="path">a</parameter></invoke>').detected).toBe(true);
+        expect(detectTextEmittedToolCall("<function_calls>...").detected).toBe(true);
+    });
+    it("detects the DeepSeek-native DSML leak (｜｜DSML｜｜invoke …) and extracts the tool name", () => {
+        // Live: storyflow_ui explore-A/B, deepseek T3 (session 799f0508e830) emitted
+        // this as text and made no real tool call → empty, silent turn. The generic
+        // <invoke matcher misses it because `<` is followed by the U+FF5C sentinel.
+        const text = `<｜｜DSML｜｜tool_calls>
+<｜｜DSML｜｜invoke name="read_file">
+<｜｜DSML｜｜parameter name="file_path" string="true">src/app/foo.html</｜｜DSML｜｜parameter>
+</｜｜DSML｜｜invoke>
+</｜｜DSML｜｜tool_calls>`;
+        const r = detectTextEmittedToolCall(text);
+        expect(r.detected).toBe(true);
+        expect(r.tool).toBe("read_file");
+    });
+    it("does NOT fire on a bare inline mention of a tool name (no invocation shape)", () => {
+        // Precision: a prose mention must not be flagged — it would wrongly mark a
+        // legitimate final answer as a broken tool call.
+        expect(detectTextEmittedToolCall("Use the <read_file> tool to view the source.").detected).toBe(false);
+        expect(detectTextEmittedToolCall("The read_file and edit_file tools handle this.").detected).toBe(false);
+        expect(detectTextEmittedToolCall("I edited the file and ran the tests; everything passes.").detected).toBe(false);
+    });
+    it("parseDsmlToolCalls extracts name + args from the DSML block (for targeted re-steer)", () => {
+        const text = `<｜｜DSML｜｜tool_calls>
+<｜｜DSML｜｜invoke name="read_file">
+<｜｜DSML｜｜parameter name="file_path" string="true">src/app/foo.html</｜｜DSML｜｜parameter>
+<｜｜DSML｜｜parameter name="start_line" string="false">25</｜｜DSML｜｜parameter>
+</｜｜DSML｜｜invoke>
+</｜｜DSML｜｜tool_calls>`;
+        const calls = parseDsmlToolCalls(text);
+        expect(calls).toHaveLength(1);
+        expect(calls[0].name).toBe("read_file");
+        expect(calls[0].args.file_path).toBe("src/app/foo.html");
+        expect(calls[0].args.start_line).toBe("25");
+    });
+    it("parseDsmlToolCalls handles multiple invoke blocks and returns [] for non-DSML text", () => {
+        const text = `<｜｜DSML｜｜invoke name="read_file"><｜｜DSML｜｜parameter name="file_path">a.ts</｜｜DSML｜｜parameter></｜｜DSML｜｜invoke><｜｜DSML｜｜invoke name="edit_file"><｜｜DSML｜｜parameter name="path">b.ts</｜｜DSML｜｜parameter></｜｜DSML｜｜invoke>`;
+        const calls = parseDsmlToolCalls(text);
+        expect(calls.map((c) => c.name)).toEqual(["read_file", "edit_file"]);
+        expect(parseDsmlToolCalls("just a normal answer")).toEqual([]);
+    });
+    it("does NOT fire on ordinary prose / code answers", () => {
+        expect(detectTextEmittedToolCall("Final number: 16").detected).toBe(false);
+        expect(detectTextEmittedToolCall("```ts\nconst a = readFile(path);\n```").detected).toBe(false);
+        expect(detectTextEmittedToolCall("").detected).toBe(false);
+        // Angular template with self-closing/nested tags must not match a tool tag.
+        expect(detectTextEmittedToolCall('<span *ngIf="!story.cover" class="placeholder">{{ title }}</span>').detected).toBe(false);
+    });
+});
+//# sourceMappingURL=text-tool-call-detector.test.js.map

package/dist/src/orchestrator/tool-args-hash.d.ts

@@ -0,0 +1,51 @@
+/**
+ * src/orchestrator/tool-args-hash.ts
+ *
+ * Pure helpers for the tool-pattern loop guard (Fix #1). The guard tracks the
+ * last N tool calls in a ring buffer and asks the user when M of them collapse
+ * to the same hash — a near-certain signal the agent is fishing the same
+ * tool with cosmetic-only argument variations (e.g. `bunx vitest | tail -5`
+ * vs `bunx vitest | head -10`).
+ *
+ * The hash deliberately ignores parts of the arguments that don't change what
+ * the tool actually does:
+ *
+ *   - For `bash`: drop everything after the first unquoted `|` / `>` / `2>`,
+ *     strip leading `cd <dir> &&` prefix, collapse whitespace.
+ *   - For other tools: stable JSON of sorted keys.
+ *
+ * Extracted from tool-loop-cap.ts so it can be unit-tested without standing up
+ * the full streamText harness.
+ */
+export declare function isVerificationCommand(canonical: string): boolean;
+/**
+ * Strip the redirection / pipe suffix and leading `cd` prefix from a bash
+ * command so cosmetic variants collapse to the same canonical form.
+ *
+ * `cd /foo && bunx vitest run | tail -20` → `bunx vitest run`
+ * `cd /foo && bunx vitest run 2>&1 | grep FAIL` → `bunx vitest run`
+ * `bunx vitest run > /tmp/x.log` → `bunx vitest run`
+ *
+ * Exception (Phase 5 BUG-F, session c8840867dcab): when the leading command is
+ * one of PIPE_NATIVE_TOOLS (grep/sed/awk/...), the pipe IS the query — keep it.
+ * Only file redirections (`>`, `>>`, `2>`, `&>`) get cut for those.
+ */
+export declare function canonicalizeBashCommand(command: string): string;
+/**
+ * Compute a short hash for a tool call so the pattern detector can compare
+ * "is this the same call again?" without retaining full args in memory.
+ *
+ * Returns the prefix `<toolName>:` followed by a sha1[0..12) of the canonical
+ * form. Same `toolName` with cosmetic-only arg changes hash identically.
+ *
+ * Special cases beyond the generic JSON hash:
+ *
+ *   - `bash`: canonical command form (strip pipes/redirects/cd prefix).
+ *   - `edit_file` / `write_file`: hash by file_path only — fires when the
+ *     agent re-edits the same file with different old_string/new_string
+ *     pairs. Observed in session 39884b072b5f where the agent edited
+ *     `src/ee/export-transcripts.ts` 7+ times fighting biome auto-format,
+ *     each attempt with a different old_string. Generic JSON hash never
+ *     collapsed them. Now collapses.
+ */
+export declare function hashToolArgs(toolName: string, args: unknown): string;

package/dist/src/orchestrator/tool-args-hash.js

@@ -0,0 +1,219 @@
+/**
+ * src/orchestrator/tool-args-hash.ts
+ *
+ * Pure helpers for the tool-pattern loop guard (Fix #1). The guard tracks the
+ * last N tool calls in a ring buffer and asks the user when M of them collapse
+ * to the same hash — a near-certain signal the agent is fishing the same
+ * tool with cosmetic-only argument variations (e.g. `bunx vitest | tail -5`
+ * vs `bunx vitest | head -10`).
+ *
+ * The hash deliberately ignores parts of the arguments that don't change what
+ * the tool actually does:
+ *
+ *   - For `bash`: drop everything after the first unquoted `|` / `>` / `2>`,
+ *     strip leading `cd <dir> &&` prefix, collapse whitespace.
+ *   - For other tools: stable JSON of sorted keys.
+ *
+ * Extracted from tool-loop-cap.ts so it can be unit-tested without standing up
+ * the full streamText harness.
+ */
+import { createHash } from "node:crypto";
+function sha1(text) {
+    return createHash("sha1").update(text).digest("hex").slice(0, 12);
+}
+function stableJson(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(",")}]`;
+    const keys = Object.keys(value).sort();
+    const pairs = keys.map((k) => `${JSON.stringify(k)}:${stableJson(value[k])}`);
+    return `{${pairs.join(",")}}`;
+}
+/**
+ * Tools whose primary work IS the pipe chain — for these the pipe is part of
+ * the actual query, not a cosmetic view. `grep -n "foo" f | head -5` vs
+ * `grep -n "foo" f | wc -l` ask different questions of the same data;
+ * collapsing them was a false-positive in session c8840867dcab where 3
+ * legitimately-different grep invocations on src/index.ts tripped the
+ * pattern-loop detector (canonical cut after `|` made all 3 hash equal).
+ *
+ * For these leading tokens we keep the FULL command (still strip leading
+ * `cd ... &&` and redirections to disk, just not pipe truncation).
+ */
+const PIPE_NATIVE_TOOLS = new Set(["grep", "sed", "awk", "jq", "find", "rg", "xargs", "cut", "tr", "sort", "uniq"]);
+/**
+ * Verification commands that the agent re-runs as part of a normal
+ * edit-typecheck-fix iteration cycle. The pattern detector should NOT count
+ * re-runs of these as a loop signal — they are PROGRESS markers, not wandering.
+ * Same session c8840867dcab tripped on 3x `bunx tsc --noEmit` between edits.
+ *
+ * The list intentionally tracks command STARTS (first 1-3 tokens) — once the
+ * canonical form starts with any of these, hashToolArgs returns a `verify:`
+ * sentinel which the detector ignores.
+ */
+const VERIFICATION_COMMAND_PREFIXES = [
+    // bun-family typecheckers & runners
+    "bunx tsc",
+    "bun x tsc",
+    "bun tsc",
+    "tsc --noEmit",
+    "tsc -p",
+    // bunx variants for tools
+    "bunx vitest",
+    "bunx jest",
+    "bunx eslint",
+    "bunx biome",
+    "bunx prettier",
+    "bun test",
+    "bun run test",
+    "bun run lint",
+    "bun run typecheck",
+    "bun run check",
+    "bun run build",
+    // npx variants — Phase 5 BUG-F2 (session c96105db6ab6): agent fell back
+    // to `npx tsc --noEmit` when `bunx tsc` was slow; the npx form was NOT
+    // whitelisted, so repeated runs would have tripped the pattern guard.
+    "npx tsc",
+    "npx vitest",
+    "npx jest",
+    "npx eslint",
+    "npx biome",
+    "npx prettier",
+    "npm test",
+    "npm run test",
+    "npm run lint",
+    "npm run typecheck",
+    "npm run build",
+    "pnpm test",
+    "pnpm lint",
+    "pnpm typecheck",
+    "pnpm build",
+    "pnpm exec tsc",
+    "pnpm exec vitest",
+    "yarn test",
+    "yarn lint",
+    "yarn typecheck",
+    "yarn build",
+    "vitest run",
+    "vitest",
+    "jest",
+    "pytest",
+    "cargo test",
+    "cargo check",
+    "cargo build",
+    "cargo clippy",
+    "go test",
+    "go build",
+    "go vet",
+    "dotnet test",
+    "dotnet build",
+    "mvn test",
+    "gradle test",
+    "biome check",
+    "biome ci",
+    "eslint",
+    "prettier --check",
+    "prettier -c",
+    "ruff check",
+    "mypy",
+    "phpunit",
+    "rspec",
+];
+export function isVerificationCommand(canonical) {
+    const lower = canonical.toLowerCase().trim();
+    for (const prefix of VERIFICATION_COMMAND_PREFIXES) {
+        if (lower.startsWith(prefix))
+            return true;
+    }
+    return false;
+}
+/**
+ * Strip the redirection / pipe suffix and leading `cd` prefix from a bash
+ * command so cosmetic variants collapse to the same canonical form.
+ *
+ * `cd /foo && bunx vitest run | tail -20` → `bunx vitest run`
+ * `cd /foo && bunx vitest run 2>&1 | grep FAIL` → `bunx vitest run`
+ * `bunx vitest run > /tmp/x.log` → `bunx vitest run`
+ *
+ * Exception (Phase 5 BUG-F, session c8840867dcab): when the leading command is
+ * one of PIPE_NATIVE_TOOLS (grep/sed/awk/...), the pipe IS the query — keep it.
+ * Only file redirections (`>`, `>>`, `2>`, `&>`) get cut for those.
+ */
+export function canonicalizeBashCommand(command) {
+    let s = command.trim();
+    // Strip leading cd <dir> && prefix (chained directory hops are noise here).
+    // Match `cd <path-or-quoted> && rest` — keep `rest`.
+    const cdMatch = s.match(/^cd\s+(?:"[^"]+"|'[^']+'|\S+)\s*&&\s*([\s\S]+)$/);
+    if (cdMatch)
+        s = cdMatch[1].trim();
+    // Inspect first token (after optional `time`/env-var prefix) to decide
+    // whether pipes are query-bearing.
+    const firstTokenMatch = s.match(/^(?:time\s+|[A-Z_]+=\S+\s+)*(\S+)/);
+    const firstToken = firstTokenMatch?.[1] ?? "";
+    const pipeNative = PIPE_NATIVE_TOOLS.has(firstToken);
+    if (pipeNative) {
+        // Only strip true file redirections (not pipes). Keep the whole pipeline.
+        const cutIdx = s.search(/\s+(?:>|2>|&>|>>)/);
+        if (cutIdx >= 0)
+            s = s.slice(0, cutIdx);
+    }
+    else {
+        // Cut at first unquoted redirection or pipe operator. We don't bother
+        // tracking quote state precisely — false-positive cuts inside quotes only
+        // produce a stricter (more conservative) hash, never a wrong-positive one.
+        const cutIdx = s.search(/\s+(?:\||>|2>|&>|>>)/);
+        if (cutIdx >= 0)
+            s = s.slice(0, cutIdx);
+    }
+    // Collapse internal whitespace runs to a single space.
+    return s.replace(/\s+/g, " ").trim();
+}
+/**
+ * Compute a short hash for a tool call so the pattern detector can compare
+ * "is this the same call again?" without retaining full args in memory.
+ *
+ * Returns the prefix `<toolName>:` followed by a sha1[0..12) of the canonical
+ * form. Same `toolName` with cosmetic-only arg changes hash identically.
+ *
+ * Special cases beyond the generic JSON hash:
+ *
+ *   - `bash`: canonical command form (strip pipes/redirects/cd prefix).
+ *   - `edit_file` / `write_file`: hash by file_path only — fires when the
+ *     agent re-edits the same file with different old_string/new_string
+ *     pairs. Observed in session 39884b072b5f where the agent edited
+ *     `src/ee/export-transcripts.ts` 7+ times fighting biome auto-format,
+ *     each attempt with a different old_string. Generic JSON hash never
+ *     collapsed them. Now collapses.
+ */
+export function hashToolArgs(toolName, args) {
+    if (toolName === "bash" && args && typeof args === "object") {
+        const cmd = args.command;
+        if (typeof cmd === "string") {
+            const canonical = canonicalizeBashCommand(cmd);
+            // Verification commands (typecheck/test/lint) are re-run as part of
+            // normal iteration — return a `verify:` sentinel hash that the detector
+            // recognizes as "skip from loop accounting". Each verify invocation gets
+            // a unique trailing nonce so even back-to-back runs never collide.
+            if (isVerificationCommand(canonical)) {
+                return `verify:${sha1(canonical)}:${Date.now()}:${Math.floor(Math.random() * 1e6)}`;
+            }
+            return `bash:${sha1(canonical)}`;
+        }
+    }
+    if ((toolName === "edit_file" || toolName === "write_file") && args && typeof args === "object") {
+        const filePath = args.file_path;
+        if (typeof filePath === "string") {
+            // Normalize path separators so D:\Personal\... and D:/Personal/... collapse.
+            const normalized = filePath.replace(/\\/g, "/");
+            // Phase 5 BUG-F+G: hash by file_path only — fires when the agent re-edits
+            // the same file with different old_string/new_string pairs. Observed in
+            // session 39884b072b5f where the agent edited the same file 7+ times
+            // fighting biome auto-format. Generic JSON hash kept them distinct;
+            // the dedicated file_path hash now collapses them.
+            return `${toolName}:${sha1(normalized)}`;
+        }
+    }
+    return `${toolName}:${sha1(stableJson(args ?? null))}`;
+}
+//# sourceMappingURL=tool-args-hash.js.map

package/dist/src/orchestrator/tool-args-hash.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/orchestrator/tool-args-hash.test.js

@@ -0,0 +1,105 @@
+import { describe, expect, it } from "vitest";
+import { canonicalizeBashCommand, hashToolArgs } from "./tool-args-hash.js";
+describe("canonicalizeBashCommand", () => {
+    it("strips trailing pipe + tail/head/grep", () => {
+        expect(canonicalizeBashCommand("bunx vitest run | tail -20")).toBe("bunx vitest run");
+        expect(canonicalizeBashCommand("bunx vitest run | head -10")).toBe("bunx vitest run");
+        expect(canonicalizeBashCommand("bunx vitest run | grep FAIL")).toBe("bunx vitest run");
+    });
+    it("strips stderr merge + redirect", () => {
+        expect(canonicalizeBashCommand("bunx vitest run 2>&1 | tail -5")).toBe("bunx vitest run");
+        expect(canonicalizeBashCommand("bunx vitest run > /tmp/out.log")).toBe("bunx vitest run");
+        expect(canonicalizeBashCommand("bunx vitest run >> /tmp/out.log")).toBe("bunx vitest run");
+    });
+    it("strips leading cd && prefix", () => {
+        expect(canonicalizeBashCommand("cd /d/Personal/Core/muonroi-cli && bunx vitest run | tail -5")).toBe("bunx vitest run");
+        expect(canonicalizeBashCommand('cd "D:/Personal/Core/muonroi-cli" && bunx vitest')).toBe("bunx vitest");
+    });
+    it("collapses whitespace", () => {
+        expect(canonicalizeBashCommand("bunx    vitest   run")).toBe("bunx vitest run");
+    });
+    it("does not strip when no redirection present", () => {
+        expect(canonicalizeBashCommand("git status")).toBe("git status");
+    });
+});
+describe("hashToolArgs", () => {
+    // Phase 5 BUG-F+G: verification commands now return `verify:` sentinel
+    // hashes with a per-call nonce so they NEVER collide with each other (each
+    // re-run of typecheck is a fresh progress marker, not a loop signal).
+    // We pick a non-verification cosmetic-variant set (npm-style install) to
+    // assert the original collapse behaviour still works.
+    it("collapses cosmetic bash variations to one hash (non-verification)", () => {
+        const variants = [
+            { command: "bun add zod | tail -20" },
+            { command: "bun add zod 2>&1" },
+            { command: "bun add zod > /tmp/out.log" },
+            { command: "cd /d/Personal/Core/muonroi-cli && bun add zod" },
+        ];
+        const hashes = new Set(variants.map((v) => hashToolArgs("bash", v)));
+        expect(hashes.size).toBe(1);
+    });
+    // Verification commands NEVER collide — every call must return a unique hash
+    // so the pattern detector skips them (edit→typecheck→fix is normal work).
+    it("verification commands produce unique hashes per call", () => {
+        const a = hashToolArgs("bash", { command: "bunx vitest run | tail -20" });
+        const b = hashToolArgs("bash", { command: "bunx vitest run | head -10" });
+        expect(a).not.toBe(b);
+        expect(a.startsWith("verify:")).toBe(true);
+        expect(b.startsWith("verify:")).toBe(true);
+    });
+    it("distinguishes substantively different non-verify bash commands", () => {
+        const a = hashToolArgs("bash", { command: "git status" });
+        const b = hashToolArgs("bash", { command: "git log -5" });
+        expect(a).not.toBe(b);
+    });
+    it("hashes non-bash tools by stable JSON of args", () => {
+        const a = hashToolArgs("read_file", { file_path: "a.ts", start_line: 1 });
+        const b = hashToolArgs("read_file", { start_line: 1, file_path: "a.ts" });
+        expect(a).toBe(b);
+    });
+    it("different args produce different hashes for same tool", () => {
+        const a = hashToolArgs("read_file", { file_path: "a.ts" });
+        const b = hashToolArgs("read_file", { file_path: "b.ts" });
+        expect(a).not.toBe(b);
+    });
+    it("hash is namespaced by tool name", () => {
+        const a = hashToolArgs("bash", { command: "x" });
+        const b = hashToolArgs("read_file", { command: "x" });
+        expect(a.startsWith("bash:")).toBe(true);
+        expect(b.startsWith("read_file:")).toBe(true);
+        expect(a).not.toBe(b);
+    });
+    it("collapses edit_file calls on same file regardless of old/new string", () => {
+        // Real session 39884b072b5f scenario — agent edited the same file 7 times
+        // with different old_string each attempt. Generic JSON hash kept them
+        // distinct; the dedicated file_path hash now collapses them.
+        const variants = [
+            { file_path: "src/ee/export.ts", old_string: "@ts-expect-error", new_string: "@ts-ignore" },
+            { file_path: "src/ee/export.ts", old_string: "  @ts-expect-error", new_string: "// @ts-ignore" },
+            { file_path: "src/ee/export.ts", old_string: "    const mod", new_string: "// @ts-ignore\n    const mod" },
+        ];
+        const hashes = new Set(variants.map((v) => hashToolArgs("edit_file", v)));
+        expect(hashes.size).toBe(1);
+    });
+    it("distinguishes edit_file on different files", () => {
+        const a = hashToolArgs("edit_file", { file_path: "src/a.ts", old_string: "x", new_string: "y" });
+        const b = hashToolArgs("edit_file", { file_path: "src/b.ts", old_string: "x", new_string: "y" });
+        expect(a).not.toBe(b);
+    });
+    it("normalizes path separators (D:\\foo vs D:/foo collapse)", () => {
+        const win = hashToolArgs("edit_file", { file_path: "D:\\Personal\\Core\\file.ts", old_string: "x" });
+        const posix = hashToolArgs("edit_file", { file_path: "D:/Personal/Core/file.ts", old_string: "x" });
+        expect(win).toBe(posix);
+    });
+    it("write_file uses same file-path hash as edit_file (cross-tool overwrite loops collapse separately)", () => {
+        const e = hashToolArgs("edit_file", { file_path: "a.ts" });
+        const w = hashToolArgs("write_file", { file_path: "a.ts" });
+        // Same file, but namespaced by tool — overwrite-loop and edit-loop are
+        // tracked separately so a legitimate "edit then verify-via-write" doesn't
+        // trip the guard, but 5 repeated write_file does.
+        expect(e).not.toBe(w);
+        expect(e.startsWith("edit_file:")).toBe(true);
+        expect(w.startsWith("write_file:")).toBe(true);
+    });
+});
+//# sourceMappingURL=tool-args-hash.test.js.map