muonroi-cli 1.3.4 → 1.4.1

package/dist/src/orchestrator/tool-args-repair.d.ts

@@ -0,0 +1,93 @@
+/**
+ * src/orchestrator/tool-args-repair.ts
+ *
+ * Conservative repair for malformed tool-call argument strings emitted by
+ * models whose tokenization breaks structured JSON. Two distinct Qwen3-30B
+ * defects observed in sessions 080fe2fcbf24 and 11bb9218f605 (2026-05-26):
+ *
+ *   1. Native-format leak — Qwen's `<tool_call>...</tool_call>` tags and
+ *      extra trailing `}` leak into the OpenAI-compatible `arguments`
+ *      string field:
+ *         {"pattern": "..."}}
+ *         </tool_call>
+ *
+ *   2. Missing close-quote — when a string value ends with an escape
+ *      sequence like `\\}` (regex), the model drops the closing `"`:
+ *         {"pattern": "catch\\s*\\{\\s*\\}, "path": "src", ...}
+ *      Intended:
+ *         {"pattern": "catch\\s*\\{\\s*\\}", "path": "src", ...}
+ *
+ * The repair function is intentionally narrow: it only modifies inputs that
+ * FAIL JSON.parse, and only applies the two specific transforms above. If
+ * the post-transform string still fails to parse, return null so the caller
+ * (AI SDK's repairToolCall hook) falls through to InvalidToolInputError.
+ *
+ * Tests live in tool-args-repair.test.ts and pin both observed samples
+ * plus a control "valid JSON is never modified" assertion.
+ */
+/**
+ * Try to recover a JSON object from a malformed tool-call argument string.
+ *
+ * Returns:
+ *   - { ok: true, value, transforms } when JSON.parse succeeds after repair
+ *     (or initially — same fast-path return so callers can be uniform).
+ *   - { ok: false } when the string still fails to parse after all
+ *     conservative transforms. Caller should report tool-error.
+ */
+export type RepairResult = {
+    ok: true;
+    value: unknown;
+    transforms: string[];
+} | {
+    ok: false;
+};
+export declare function repairToolCallArgs(raw: string): RepairResult;
+/**
+ * Strip Qwen native chat-format leakage that appears in OpenAI-compatible
+ * `arguments` strings. Patterns observed:
+ *   - trailing `</tool_call>` literal
+ *   - trailing `</tool_calls>` literal (plural variant)
+ *   - trailing `<|tool_call_end|>` sentinel
+ *   - whitespace + extra newlines after either of the above
+ * Strips ONLY at the trailing end. Body of the JSON is not touched, so
+ * legitimate strings that happen to contain `<tool_call>` as data are safe.
+ */
+declare function stripNativeFormatLeak(s: string): string;
+/**
+ * If the string has more closing `}` than opening `{`, strip trailing `}`
+ * one at a time (skipping whitespace) until balanced — but only up to
+ * MAX_TRAILING_BRACE_STRIPS so a wildly malformed string doesn't get
+ * gutted. The check is naive (doesn't track string vs object braces) which
+ * is OK because we only run this when the original parse already failed.
+ */
+declare function stripUnbalancedTrailingBraces(s: string): string;
+/**
+ * Insert a missing close-quote on the value of a JSON key=value pair where
+ * the model emitted an escape sequence as the final visible characters
+ * before the next key. Pattern:
+ *   ...\\X,  "next-key":...
+ * where X is `}`, `]`, `)`, `>` or another `\\` — i.e. characters that the
+ * tokenizer treats as escape-sequence terminators. The fix inserts `"`
+ * between the escape and the comma:
+ *   ...\\X",  "next-key":...
+ *
+ * Refuses to fire when the input already contains a balanced quote count
+ * preceding the comma — that means the failure is something other than a
+ * missing close-quote and our naive insert would corrupt valid JSON.
+ *
+ * The regex is anchored to "comma + maybe-whitespace + ASCII-key-start"
+ * which strongly suggests a JSON-object key boundary, not arbitrary text.
+ */
+declare function insertMissingCloseQuote(s: string): string;
+/**
+ * True iff `prefix` has an odd number of un-escaped `"` characters — i.e.
+ * the next character would be inside an open JSON string.
+ */
+declare function isInsideOpenString(prefix: string): boolean;
+export declare const _internals: {
+    stripNativeFormatLeak: typeof stripNativeFormatLeak;
+    stripUnbalancedTrailingBraces: typeof stripUnbalancedTrailingBraces;
+    insertMissingCloseQuote: typeof insertMissingCloseQuote;
+    isInsideOpenString: typeof isInsideOpenString;
+};
+export {};

package/dist/src/orchestrator/tool-args-repair.js

@@ -0,0 +1,219 @@
+/**
+ * src/orchestrator/tool-args-repair.ts
+ *
+ * Conservative repair for malformed tool-call argument strings emitted by
+ * models whose tokenization breaks structured JSON. Two distinct Qwen3-30B
+ * defects observed in sessions 080fe2fcbf24 and 11bb9218f605 (2026-05-26):
+ *
+ *   1. Native-format leak — Qwen's `<tool_call>...</tool_call>` tags and
+ *      extra trailing `}` leak into the OpenAI-compatible `arguments`
+ *      string field:
+ *         {"pattern": "..."}}
+ *         </tool_call>
+ *
+ *   2. Missing close-quote — when a string value ends with an escape
+ *      sequence like `\\}` (regex), the model drops the closing `"`:
+ *         {"pattern": "catch\\s*\\{\\s*\\}, "path": "src", ...}
+ *      Intended:
+ *         {"pattern": "catch\\s*\\{\\s*\\}", "path": "src", ...}
+ *
+ * The repair function is intentionally narrow: it only modifies inputs that
+ * FAIL JSON.parse, and only applies the two specific transforms above. If
+ * the post-transform string still fails to parse, return null so the caller
+ * (AI SDK's repairToolCall hook) falls through to InvalidToolInputError.
+ *
+ * Tests live in tool-args-repair.test.ts and pin both observed samples
+ * plus a control "valid JSON is never modified" assertion.
+ */
+const MAX_INPUT_LENGTH = 50_000;
+const MAX_TRAILING_BRACE_STRIPS = 5;
+export function repairToolCallArgs(raw) {
+    if (typeof raw !== "string" || raw.length === 0)
+        return { ok: false };
+    if (raw.length > MAX_INPUT_LENGTH)
+        return { ok: false };
+    // Fast path: already valid JSON.
+    const initial = tryParse(raw);
+    if (initial.ok)
+        return { ok: true, value: initial.value, transforms: [] };
+    let working = raw;
+    const transforms = [];
+    // (1) Strip Qwen native-format suffix garbage. Multiple leak shapes seen.
+    const stripped = stripNativeFormatLeak(working);
+    if (stripped !== working) {
+        working = stripped;
+        transforms.push("strip-native-tags");
+        const after = tryParse(working);
+        if (after.ok)
+            return { ok: true, value: after.value, transforms };
+    }
+    // (2) Insert missing close-quote after escape-sequence end. The pattern
+    // we've seen is `\\}, "key":` — string ended with a `\\}` (escaped brace
+    // inside a regex) and the model dropped the closing `"`. Same logic
+    // applies to `\\]`, `\\)`, `\\>` and other escape-bracket-close sequences.
+    //
+    // Runs BEFORE strip-trailing-braces because the missing quote confuses the
+    // brace counter (it thinks the trailing `}}` is inside an open string).
+    const quoteFixed = insertMissingCloseQuote(working);
+    if (quoteFixed !== working) {
+        working = quoteFixed;
+        transforms.push("insert-missing-close-quote");
+        const after = tryParse(working);
+        if (after.ok)
+            return { ok: true, value: after.value, transforms };
+    }
+    // (3) Balance trailing braces. Models often emit one extra closing `}`.
+    // Now safe to run because quote fixup put the string boundaries back so
+    // the brace counter walks the structure correctly.
+    const balanced = stripUnbalancedTrailingBraces(working);
+    if (balanced !== working) {
+        working = balanced;
+        transforms.push("strip-trailing-braces");
+        const after = tryParse(working);
+        if (after.ok)
+            return { ok: true, value: after.value, transforms };
+    }
+    return { ok: false };
+}
+function tryParse(text) {
+    try {
+        return { ok: true, value: JSON.parse(text) };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+/**
+ * Strip Qwen native chat-format leakage that appears in OpenAI-compatible
+ * `arguments` strings. Patterns observed:
+ *   - trailing `</tool_call>` literal
+ *   - trailing `</tool_calls>` literal (plural variant)
+ *   - trailing `<|tool_call_end|>` sentinel
+ *   - whitespace + extra newlines after either of the above
+ * Strips ONLY at the trailing end. Body of the JSON is not touched, so
+ * legitimate strings that happen to contain `<tool_call>` as data are safe.
+ */
+function stripNativeFormatLeak(s) {
+    return s.replace(/\s*(?:<\/tool_calls?>|<\|tool_call(?:_end)?\|>)\s*$/i, "");
+}
+/**
+ * If the string has more closing `}` than opening `{`, strip trailing `}`
+ * one at a time (skipping whitespace) until balanced — but only up to
+ * MAX_TRAILING_BRACE_STRIPS so a wildly malformed string doesn't get
+ * gutted. The check is naive (doesn't track string vs object braces) which
+ * is OK because we only run this when the original parse already failed.
+ */
+function stripUnbalancedTrailingBraces(s) {
+    let open = 0;
+    let close = 0;
+    let inString = false;
+    let escaped = false;
+    for (const ch of s) {
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (ch === "\\") {
+            escaped = true;
+            continue;
+        }
+        if (ch === '"') {
+            inString = !inString;
+            continue;
+        }
+        if (inString)
+            continue;
+        if (ch === "{")
+            open++;
+        else if (ch === "}")
+            close++;
+    }
+    let extra = close - open;
+    if (extra <= 0)
+        return s;
+    if (extra > MAX_TRAILING_BRACE_STRIPS)
+        return s; // too damaged, refuse
+    let out = s;
+    while (extra > 0) {
+        const trimmed = out.replace(/\s+$/, "");
+        if (!trimmed.endsWith("}"))
+            break;
+        out = trimmed.slice(0, -1);
+        extra--;
+    }
+    return out;
+}
+/**
+ * Insert a missing close-quote on the value of a JSON key=value pair where
+ * the model emitted an escape sequence as the final visible characters
+ * before the next key. Pattern:
+ *   ...\\X,  "next-key":...
+ * where X is `}`, `]`, `)`, `>` or another `\\` — i.e. characters that the
+ * tokenizer treats as escape-sequence terminators. The fix inserts `"`
+ * between the escape and the comma:
+ *   ...\\X",  "next-key":...
+ *
+ * Refuses to fire when the input already contains a balanced quote count
+ * preceding the comma — that means the failure is something other than a
+ * missing close-quote and our naive insert would corrupt valid JSON.
+ *
+ * The regex is anchored to "comma + maybe-whitespace + ASCII-key-start"
+ * which strongly suggests a JSON-object key boundary, not arbitrary text.
+ */
+function insertMissingCloseQuote(s) {
+    // Match: backslash-sequence (\\X), optional space, comma, optional space,
+    // quote, ASCII key letter. Captures the escape so we can re-emit it +
+    // an inserted close-quote.
+    // Char class members: `}`, `]` (escaped), `)`, `>`, `\` (escaped).
+    const pattern = /(\\\\[}\])>\\])(\s*,\s*)("[A-Za-z_])/g;
+    const out = s;
+    let lastIndex = 0;
+    let result = "";
+    let matched = false;
+    pattern.lastIndex = 0;
+    // biome-ignore lint/suspicious/noAssignInExpressions: idiomatic regex.exec loop
+    let m;
+    while ((m = pattern.exec(out)) !== null) {
+        // Safety: only fire when the prefix has ODD number of unescaped quotes
+        // (i.e. we're inside an open string). Otherwise valid JSON containing
+        // `\\}` followed by a comma would get corrupted.
+        const prefix = out.slice(0, m.index);
+        if (!isInsideOpenString(prefix))
+            continue;
+        result += out.slice(lastIndex, m.index) + m[1] + '"' + m[2] + m[3];
+        lastIndex = m.index + m[0].length;
+        matched = true;
+    }
+    if (!matched)
+        return s;
+    result += out.slice(lastIndex);
+    return result;
+}
+/**
+ * True iff `prefix` has an odd number of un-escaped `"` characters — i.e.
+ * the next character would be inside an open JSON string.
+ */
+function isInsideOpenString(prefix) {
+    let count = 0;
+    let escaped = false;
+    for (const ch of prefix) {
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (ch === "\\") {
+            escaped = true;
+            continue;
+        }
+        if (ch === '"')
+            count++;
+    }
+    return count % 2 === 1;
+}
+export const _internals = {
+    stripNativeFormatLeak,
+    stripUnbalancedTrailingBraces,
+    insertMissingCloseQuote,
+    isInsideOpenString,
+};
+//# sourceMappingURL=tool-args-repair.js.map

package/dist/src/orchestrator/tool-args-repair.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/orchestrator/tool-args-repair.test.js

@@ -0,0 +1,136 @@
+/**
+ * Regression for Qwen3-30B malformed tool-call args observed in sessions
+ *   080fe2fcbf24 and 11bb9218f605 (2026-05-26).
+ *
+ * Each describe block locks one observed failure mode plus controls that
+ * the repair must NOT corrupt valid JSON, ambiguous patterns outside open
+ * strings, or unrelated malformations.
+ */
+import { describe, expect, it } from "vitest";
+import { _internals, repairToolCallArgs } from "./tool-args-repair.js";
+describe("repairToolCallArgs — observed Qwen samples", () => {
+    it("repairs session 11bb9218f605: missing close-quote + trailing brace + </tool_call>", () => {
+        // Raw input as seen in interaction_logs.tool_call.argsPreview for the
+        // 3 consecutive grep failures.
+        const raw = '{"pattern": "catch\\\\s*\\\\{[^}]*\\\\}, "path": "src", "include": "*.ts"}}\n</tool_call>';
+        const result = repairToolCallArgs(raw);
+        if (!result.ok)
+            throw new Error(`expected ok, got: ${JSON.stringify(result)}`);
+        expect(result.value).toEqual({
+            pattern: "catch\\s*\\{[^}]*\\}",
+            path: "src",
+            include: "*.ts",
+        });
+        // Confirm the repair pipeline applied the expected transforms.
+        expect(result.transforms).toContain("strip-native-tags");
+        expect(result.transforms).toContain("strip-trailing-braces");
+        expect(result.transforms).toContain("insert-missing-close-quote");
+    });
+    it("repairs session 080fe2fcbf24: missing close-quote + space-after-comma", () => {
+        const raw = '{"pattern": "catch\\\\s*\\\\{\\\\s*\\\\}, "path": ".", "include": "*.ts"}';
+        const result = repairToolCallArgs(raw);
+        if (!result.ok)
+            throw new Error(`expected ok, got: ${JSON.stringify(result)}`);
+        expect(result.value).toEqual({
+            pattern: "catch\\s*\\{\\s*\\}",
+            path: ".",
+            include: "*.ts",
+        });
+        expect(result.transforms).toContain("insert-missing-close-quote");
+    });
+});
+describe("repairToolCallArgs — must NOT corrupt valid input", () => {
+    it("returns fast-path with no transforms on already-valid JSON", () => {
+        const valid = '{"pattern": "catch\\\\s*\\\\{[^}]*\\\\}", "path": "src"}';
+        const result = repairToolCallArgs(valid);
+        if (!result.ok)
+            throw new Error("valid JSON must parse on fast path");
+        expect(result.value).toEqual({ pattern: "catch\\s*\\{[^}]*\\}", path: "src" });
+        expect(result.transforms).toEqual([]);
+    });
+    it("does not insert a quote when \\\\} appears outside an open string", () => {
+        // Object body contains `\\}` only inside a properly-closed string; the
+        // comma + key that follows is at the top level, not a malformed string.
+        // Note: the input below is intentionally NOT malformed — repair must be
+        // a no-op (initial parse succeeds).
+        const valid = '{"a": "x\\\\}", "b": "y"}';
+        const result = repairToolCallArgs(valid);
+        if (!result.ok)
+            throw new Error("valid JSON must parse");
+        expect(result.transforms).toEqual([]);
+    });
+    it("refuses to repair when more than 5 extra trailing braces (input too damaged)", () => {
+        const raw = '{"a": 1}}}}}}}}';
+        const result = repairToolCallArgs(raw);
+        expect(result.ok).toBe(false);
+    });
+    it("refuses to repair empty / non-string inputs", () => {
+        expect(repairToolCallArgs("").ok).toBe(false);
+        // @ts-expect-error — runtime guard for non-string
+        expect(repairToolCallArgs(null).ok).toBe(false);
+        // @ts-expect-error — runtime guard for non-string
+        expect(repairToolCallArgs(undefined).ok).toBe(false);
+    });
+    it("refuses to repair inputs > 50KB (out-of-scope adversarial)", () => {
+        const big = `{"x": "${"y".repeat(60_000)}"}`;
+        const result = repairToolCallArgs(big);
+        expect(result.ok).toBe(false);
+    });
+    it("returns ok=false (not throw) on totally unrelated garbage", () => {
+        expect(repairToolCallArgs("this is not json at all").ok).toBe(false);
+        expect(repairToolCallArgs("<xml>foo</xml>").ok).toBe(false);
+    });
+});
+describe("stripNativeFormatLeak", () => {
+    const { stripNativeFormatLeak } = _internals;
+    it("strips trailing </tool_call>", () => {
+        expect(stripNativeFormatLeak('{"a": 1}\n</tool_call>')).toBe('{"a": 1}');
+    });
+    it("strips trailing </tool_calls> plural variant", () => {
+        expect(stripNativeFormatLeak('{"a": 1}</tool_calls>')).toBe('{"a": 1}');
+    });
+    it("strips trailing <|tool_call_end|> Qwen sentinel", () => {
+        expect(stripNativeFormatLeak('{"a": 1}<|tool_call_end|>')).toBe('{"a": 1}');
+    });
+    it("only strips at end — interior occurrences are preserved (data, not control)", () => {
+        expect(stripNativeFormatLeak('{"description": "see </tool_call> in docs"}')).toBe('{"description": "see </tool_call> in docs"}');
+    });
+    it("is case-insensitive on the tag", () => {
+        expect(stripNativeFormatLeak('{"a": 1}</TOOL_CALL>')).toBe('{"a": 1}');
+    });
+});
+describe("stripUnbalancedTrailingBraces", () => {
+    const { stripUnbalancedTrailingBraces } = _internals;
+    it("strips a single extra trailing brace", () => {
+        expect(stripUnbalancedTrailingBraces('{"a": 1}}')).toBe('{"a": 1}');
+    });
+    it("does not strip when braces are balanced", () => {
+        expect(stripUnbalancedTrailingBraces('{"a": {"b": 1}}')).toBe('{"a": {"b": 1}}');
+    });
+    it("does not count braces inside string values", () => {
+        // 2 `{` open, 1 `}` close, plus literal `{` in string — must NOT touch.
+        expect(stripUnbalancedTrailingBraces('{"x": "{{{"}')).toBe('{"x": "{{{"}');
+    });
+    it("respects escape sequences inside strings", () => {
+        // `\\}` inside a string is one regex character, not a brace.
+        expect(stripUnbalancedTrailingBraces('{"x": "a\\\\}b"}')).toBe('{"x": "a\\\\}b"}');
+    });
+});
+describe("insertMissingCloseQuote", () => {
+    const { insertMissingCloseQuote } = _internals;
+    it('inserts close-quote after \\\\} when followed by `, "key"`', () => {
+        const before = '{"a": "x\\\\}, "b": 1}';
+        const after = insertMissingCloseQuote(before);
+        expect(after).toBe('{"a": "x\\\\}", "b": 1}');
+    });
+    it("handles \\\\] terminator", () => {
+        const before = '{"a": "x\\\\], "b": 1}';
+        const after = insertMissingCloseQuote(before);
+        expect(after).toBe('{"a": "x\\\\]", "b": 1}');
+    });
+    it("returns input unchanged when no inside-string match", () => {
+        const balanced = '{"a": "x", "b": 1}';
+        expect(insertMissingCloseQuote(balanced)).toBe(balanced);
+    });
+});
+//# sourceMappingURL=tool-args-repair.test.js.map

package/dist/src/orchestrator/tool-loop-cap.d.ts

@@ -0,0 +1,66 @@
+/**
+ * src/orchestrator/tool-loop-cap.ts
+ *
+ * Pure factory for the AI-SDK `stopWhen` predicate that backs two related
+ * "agent is going off the rails" guards:
+ *
+ *  1. **Cap guard** — when the streamText loop hits the cap, ask the user
+ *     whether to bump the cap (+50 default) or stop.
+ *  2. **Pattern guard (Fix #1)** — when the last 5 tool calls have ≥ 3 with
+ *     the same canonical args hash (e.g. agent ran `bunx vitest | tail -5`,
+ *     `bunx vitest | head -10`, `bunx vitest | grep FAIL` in a row), ask
+ *     the user whether to continue or stop *before* the cap runs out.
+ *
+ * Both guards are surfaced through the same `ask` callback using a tagged
+ * union (`kind: "cap" | "pattern"`) so callers can route to the right askcard
+ * phase. The pattern guard fires at most once per session — a single trip is
+ * enough to break the loop; firing repeatedly would be noise.
+ *
+ * Extracted from message-processor.ts so we can unit-test the algorithm
+ * without standing up a full streamText harness.
+ */
+export type ToolLoopCapAskInfo = {
+    kind: "cap";
+    stepNumber: number;
+    cap: number;
+    bumpBy: number;
+} | {
+    kind: "pattern";
+    toolName: string;
+    count: number;
+    windowSize: number;
+    /** Step count at the time the pattern fired — drives default-action heuristic. */
+    stepNumber: number;
+    /** Resolved natural ceiling for the current (taskType, size). Optional — undefined when caller can't compute it. */
+    naturalCeiling?: number;
+};
+export type ToolLoopCapAsk = (info: ToolLoopCapAskInfo) => Promise<"continue" | "stop">;
+export interface ToolLoopCapOptions {
+    initialCap: number;
+    bumpBy?: number;
+    ask?: ToolLoopCapAsk;
+    /** Override defaults — exposed for tests. */
+    patternWindow?: number;
+    patternThreshold?: number;
+    /**
+     * Natural step ceiling for the current (taskType, size). Passed to the ask
+     * handler so the askcard UI can pick a context-aware defaultIndex (continue
+     * early, stop late).
+     */
+    naturalCeiling?: number;
+}
+export declare const DEFAULT_TOOL_LOOP_BUMP = 50;
+export declare const DEFAULT_PATTERN_WINDOW = 5;
+export declare const DEFAULT_PATTERN_THRESHOLD = 3;
+/**
+ * Build the async stopWhen predicate.
+ *
+ *   - Pattern dup ≥ threshold in window → ask("pattern"); fire-once per session
+ *   - `sn < cap`                        → false (keep going)
+ *   - cap hit, no `ask`                 → true  (legacy hard-stop, batch / headless)
+ *   - cap hit, ask=continue             → bump cap by `bumpBy`, return false
+ *   - cap hit, ask=stop                 → true  (graceful halt)
+ */
+export declare function createToolLoopCapPredicate(opts: ToolLoopCapOptions): (state: {
+    steps: ReadonlyArray<unknown>;
+}) => Promise<boolean>;

package/dist/src/orchestrator/tool-loop-cap.js

@@ -0,0 +1,138 @@
+/**
+ * src/orchestrator/tool-loop-cap.ts
+ *
+ * Pure factory for the AI-SDK `stopWhen` predicate that backs two related
+ * "agent is going off the rails" guards:
+ *
+ *  1. **Cap guard** — when the streamText loop hits the cap, ask the user
+ *     whether to bump the cap (+50 default) or stop.
+ *  2. **Pattern guard (Fix #1)** — when the last 5 tool calls have ≥ 3 with
+ *     the same canonical args hash (e.g. agent ran `bunx vitest | tail -5`,
+ *     `bunx vitest | head -10`, `bunx vitest | grep FAIL` in a row), ask
+ *     the user whether to continue or stop *before* the cap runs out.
+ *
+ * Both guards are surfaced through the same `ask` callback using a tagged
+ * union (`kind: "cap" | "pattern"`) so callers can route to the right askcard
+ * phase. The pattern guard fires at most once per session — a single trip is
+ * enough to break the loop; firing repeatedly would be noise.
+ *
+ * Extracted from message-processor.ts so we can unit-test the algorithm
+ * without standing up a full streamText harness.
+ */
+import { hashToolArgs } from "./tool-args-hash.js";
+export const DEFAULT_TOOL_LOOP_BUMP = 50;
+export const DEFAULT_PATTERN_WINDOW = 5;
+export const DEFAULT_PATTERN_THRESHOLD = 3;
+/**
+ * Hash an entire step (all tool calls in order) so two parallel reads of
+ * different files don't collide just because the first-positional call
+ * happens to be identical. Phase 5 BUG-G (session f1a2a2a547db) — agent
+ * issued 3 parallel-style steps reading layer16-clarity.ts + its test file;
+ * detecting only `toolCalls[0]` hashed all 3 to the same value and tripped
+ * the loop guard even though step-2 and step-4 also touched the test file.
+ *
+ * Skips `verify:` sentinel hashes — verification commands MUST NOT count
+ * toward the pattern window (they're iteration markers, not loop signal).
+ *
+ * Returns null when the step has no usable tool calls.
+ */
+function hashStep(step) {
+    if (!step?.toolCalls?.length)
+        return null;
+    const parts = [];
+    for (const tc of step.toolCalls) {
+        if (!tc?.toolName)
+            continue;
+        const argsCandidate = tc.input !== undefined ? tc.input : tc.args;
+        const h = hashToolArgs(tc.toolName, argsCandidate);
+        // Verification calls — drop entirely from the step signature so they
+        // can't cause repeated edit+typecheck cycles to look identical.
+        if (h.startsWith("verify:"))
+            continue;
+        parts.push(h);
+    }
+    if (parts.length === 0)
+        return null;
+    const firstToolName = step.toolCalls.find((tc) => tc?.toolName)?.toolName ?? "unknown";
+    // Join with `|` — order-sensitive on purpose: a step doing [read A, read B]
+    // is distinct from [read B, read A] in tool-emission order, so collapsing
+    // them risks hiding a real loop where the agent reorders calls.
+    return { hash: parts.join("|"), toolName: firstToolName };
+}
+/**
+ * Build the async stopWhen predicate.
+ *
+ *   - Pattern dup ≥ threshold in window → ask("pattern"); fire-once per session
+ *   - `sn < cap`                        → false (keep going)
+ *   - cap hit, no `ask`                 → true  (legacy hard-stop, batch / headless)
+ *   - cap hit, ask=continue             → bump cap by `bumpBy`, return false
+ *   - cap hit, ask=stop                 → true  (graceful halt)
+ */
+export function createToolLoopCapPredicate(opts) {
+    let cap = opts.initialCap;
+    const bumpBy = opts.bumpBy ?? DEFAULT_TOOL_LOOP_BUMP;
+    const ask = opts.ask;
+    const patternWindow = opts.patternWindow ?? DEFAULT_PATTERN_WINDOW;
+    const patternThreshold = opts.patternThreshold ?? DEFAULT_PATTERN_THRESHOLD;
+    // Pattern detector state — one-shot per session to avoid asking again after
+    // the user said "continue". The cap guard still catches the loop later.
+    const recent = [];
+    let patternAskFired = false;
+    let lastSeenStepCount = 0;
+    return async ({ steps }) => {
+        const sn = steps.length;
+        // Pattern detector — examine the most recently-added step's tool calls.
+        // streamText calls stopWhen between steps, so `steps[sn-1]` is the step
+        // that just finished. Multiple stopWhen invocations may pass the same
+        // step length (e.g. compaction reruns); only process new growth.
+        if (ask && !patternAskFired && sn > lastSeenStepCount) {
+            lastSeenStepCount = sn;
+            const lastStep = steps[sn - 1];
+            const stepSig = hashStep(lastStep);
+            if (stepSig) {
+                // File edits (edit_file / write_file) are normal productive refinement on the same target.
+                // Do not let repeated edits on one file contribute to pattern-loop detection.
+                // This prevents false-positive stop warnings during legitimate iterative work
+                // (e.g. session df2dbb878984 and similar "edit same file 3x" flows).
+                // The max-tool-rounds cap still protects against true runaway loops.
+                if (stepSig.toolName === "edit_file" || stepSig.toolName === "write_file") {
+                    // skip pattern accounting for fs edits
+                }
+                else {
+                    recent.push(stepSig);
+                    if (recent.length > patternWindow)
+                        recent.shift();
+                    const dupCount = recent.filter((r) => r.hash === stepSig.hash).length;
+                    if (dupCount >= patternThreshold) {
+                        patternAskFired = true; // one-shot regardless of verdict
+                        const verdict = await ask({
+                            kind: "pattern",
+                            toolName: stepSig.toolName,
+                            count: dupCount,
+                            windowSize: recent.length,
+                            stepNumber: sn,
+                            naturalCeiling: opts.naturalCeiling,
+                        });
+                        if (verdict === "stop")
+                            return true;
+                        // Continue → clear the ring so we don't immediately re-fire on the
+                        // next call (user explicitly accepted; give them breathing room).
+                        recent.length = 0;
+                    }
+                }
+            }
+        }
+        // Cap guard — unchanged behaviour.
+        if (sn < cap)
+            return false;
+        if (!ask)
+            return true;
+        const verdict = await ask({ kind: "cap", stepNumber: sn, cap, bumpBy });
+        if (verdict === "continue") {
+            cap += bumpBy;
+            return false;
+        }
+        return true;
+    };
+}
+//# sourceMappingURL=tool-loop-cap.js.map

package/dist/src/orchestrator/tool-loop-cap.test.d.ts

@@ -0,0 +1 @@
+export {};