pi-anti-doom-loop 0.0.10 → 0.0.13

package/CHANGELOG.md

@@ -2,6 +2,55 @@
 
 All notable changes to **pi-anti-doom-loop**.
 
+## [0.0.13] — 2026-10-20
+
+### Fixed
+
+- **`tinypool` critical advisories** — `oxfmt` 0.62.0 pinned `tinypool` 2.1.0, which carries two critical prototype-pollution-to-RCE advisories (`GHSA-85c8-ppgw-ccpr`, `GHSA-5gmw-xhrv-c9v3`); dev-only, but critical. `oxfmt` is now 0.74.0 (`tinypool` 2.2.0) and `pnpm audit` is clean.
+- **Deprecated Actions runtime** — `actions/checkout` and `actions/setup-node` were pinned to v4 commits, which GitHub now forces from Node 20 to Node 24 with a warning on every run. Both are on v7, which targets Node 24 natively.
+
+### Changed
+
+- **Toolchain refresh** — TypeScript 7.0.2 (the compiler no longer includes `@types/node` implicitly, so `tsconfig` lists `"node"`), `@effect/tsgo` 0.53.3 with its matching `oxlint-tsgolint` 7.0.2004 override, `oxlint` 1.88.0, `effect` 4.0.5, and `@earendil-works/pi-coding-agent` 1.3.0 for development. `@types/node` stays on 22 so the types match `engines` rather than the newest Node release. `typescript/no-floating-promises` is off for `tests/` only: `node:test` awaits the promises its callbacks return itself.
+
+### Added
+
+- **CI on every push and pull request** — `.github/workflows/ci.yml` runs the same gate as `prepublishOnly`, so master can no longer drift from the release check.
+- **Dependabot** — weekly npm and GitHub Actions updates (minor/patch grouped), with vulnerability alerts and automated security fixes enabled on the repository.
+
+## [0.0.12] — 2026-10-01
+
+### Added
+
+- **E2E tests against a real pi ≥ 0.99** (`tests/e2e/pi.test.ts` + `tests/e2e/pi-rig.ts`) — the rig downloads the real `@earendil-works/pi-coding-agent@0.99.2` (cached), runs pi's RPC entry headlessly with the repo extension loaded, and drives sessions with an in-process OpenAI-compatible fake LLM, fully offline. Verified: the extension blocks a scripted identical-`bash` doom loop in a real session; a **real codemode worker** executing a script that polls a file 5× inside ONE `codemode` call is blocked by the nested 2× rule and the script fails with the `BLOCKED by anti-doom-loop` reason; the recommended distinct `Promise.allSettled` batch completes untouched. Skips cleanly when the npm registry is unreachable. Run with `pnpm run e2e:pi`.
+- **Codemode nested-loop fixtures** — `codemodeNestedLoop` (in-script poll loop), `codemodeErrorRetryLoop` (identical retry after an in-script error), `codemodeCrossScriptRepeat` (second script re-issuing a blocked signature → escalation), and `codemodeHealthyBatch` (the documented `Promise.allSettled` pattern stays unblocked), each driven through the controller exactly as pi delivers nested events, plus a contrast test proving a 2× loop blocks nested while staying under the top-level 3× threshold.
+
+### Changed
+
+- **Tooling migrated to pnpm (latest, 12.8.1)** — `packageManager` pin, `pnpm-lock.yaml` with the default virtual store (`node_modules/.pnpm`), all scripts and docs use `pnpm`, the release workflow installs via `pnpm/action-setup` + `--frozen-lockfile` and publishes with `pnpm publish --no-git-checks`; the tarball e2e asserts via `pnpm pack` and pins the tooling.
+
+### Fixed
+
+- **Fresh installs failed under pnpm 12** — unapproved dependency build scripts made `pnpm install --frozen-lockfile` exit `ERR_PNPM_IGNORED_BUILDS`, which would have aborted the release workflow before the quality gate. The dev-only transitives pi pulls (`esbuild`, `protobufjs`, `@google/genai`) are now explicitly denied in `pnpm-workspace.yaml`; their binaries come from optional platform packages.
+- **`oxlint-tsgolint` pin had no matching artifact** — `package.json` asked for `7.0.2003` while `@effect/tsgo` ships its patched tsgolint for `7.0.2001` only. The devDependency now matches the artifact (the workspace override already pinned it), so `prepare` no longer looks for a missing binary.
+- **Bounded codemode memory** — a script's window now keeps only its most recent 100 calls (args are capped at 100 KB each), so a long-running script cannot pin unbounded memory; in-script loops repeat adjacent calls and still block at 2×.
+- **Real-pi e2e reported green when it never ran** — offline runs returned early from each test, which `node:test` records as passing. They now report `skipped`, so `pnpm test` can no longer claim coverage it did not execute.
+
+### Tests
+
+- 122 → 133: 4 real-pi e2e sessions, 6 codemode fixture tests, pnpm-pack artifact assertions, and the bounded nested-window case.
+
+## [0.0.11] — 2026-10-01
+
+### Added
+
+- **Codemode awareness (pi ≥ 0.99)** — pi's `codemode` tool runs model-written scripts that call other tools via `tools.<name>(args)`; those nested calls carry `parentToolCallId` in the `tool_call`/`tool_result` events and previously bypassed detection entirely (a script can issue hundreds of calls inside ONE top-level tool call). The extension now tracks them: identical calls inside one script block at **2×** (stricter than the top-level 3× — a repeated in-script call is never progress; store the result and reuse it), near-identical args count toward the same rule, and an identical retry of a call that already **errored** in the same script blocks immediately. Nested traffic is windowed **per script** and fully isolated from the top-level window in both directions. A NEW script re-issuing a signature blocked in an earlier script this prompt **escalates** (aborts the turn), mirroring top-level block escalation. `PI_ANTI_LOOP_TOOLS_EXCLUDE` applies to nested calls; nested identity is storage-capped (100 KB per call, most recent 100 calls per script) so huge payloads (whole-file reads) stay cheap; `/loopcheck` reports `nested: calls=N blocks=M`.
+- **The information wall** — a nested block reason reaches the _script_ as a tool error, not the model (pi delivers only the script's return value). If a script swallows block errors, the loop signal was lost. The extension now arms a one-shot **steer** on the next assistant `message_end` after any nested block, telling the model to call each tool once per script and reuse results — so a script that ignores tool errors can no longer silently eat the loop signal.
+
+### Tests
+
+- 99 → 122: nested unit semantics (2× rule, per-script isolation, error-retry, cross-script escalation, payload cap, exclude-list), adapter wiring (`parentToolCallId` forwarding, `NESTED_STEER_TEXT` via `sendMessage`, escalation aborts), and nested fuzz streams (never throw, injected in-script loops always block, random unique-args streams never false-positive).
+
 ## [0.0.10] — 2026-09-23
 
 ### Fixed

package/README.md

@@ -51,7 +51,7 @@ Environment variables, read at session/prompt start:
 | `PI_ANTI_LOOP_TIME_WINDOW`   | `0`     | Elapsed-time window in ms (`0` = disabled, count-only): evicts window entries older than this so slow chronic loops over a long session are caught |
 | `PI_ANTI_LOOP_FAIL_RATE`     | `0`     | Fail-rate block threshold `0..1` (`0` = disabled): block when a tool's error share of its in-window calls reaches this                             |
 | `PI_ANTI_LOOP_FAIL_RATE_MIN` | `3`     | Minimum calls before the fail-rate window can block                                                                                                |
-| `PI_ANTI_LOOP_TOOLS_EXCLUDE` | —       | Comma-separated tool names to disable detection for entirely (never block, never enter the window)                                                 |
+| `PI_ANTI_LOOP_TOOLS_EXCLUDE` | —       | Comma-separated tool names to disable detection for entirely (never block, never enter the window — applies to nested codemode calls too)          |
 | `PI_ANTI_LOOP_DISABLE`       | —       | Set to `1` to disable the extension entirely                                                                                                       |
 
 ## Command
@@ -61,6 +61,38 @@ Environment variables, read at session/prompt start:
 - `/loopcheck suspend` — pause detection until the next prompt (escape hatch for intentional repetition)
 - `/loopcheck resume` — re-enable detection early
 
+### Codemode (pi ≥ 0.99): nested script calls
+
+pi's `codemode` tool lets the model run a JavaScript script that calls other
+tools via `tools.<name>(args)` — a script can loop hundreds of calls inside
+ONE top-level tool call, which per-call detection never sees as a streak.
+Since pi 0.99, those nested calls still flow through the `tool_call`/
+`tool_result` events tagged with `parentToolCallId` — and this extension
+tracks them:
+
+- **Stricter in-script threshold** — inside one script, the 2nd identical
+  call blocks (top-level detection needs 3). A repeated call inside a script
+  is never progress: the script can store its first result in a variable and
+  reuse it. Near-identical args (sleep-wrapped polls, flag drift) count too.
+- **Error-retry rule** — an identical retry of a call that already errored
+  inside the same script blocks immediately with a "the identical call
+  already failed inside this script" reason.
+- **Script-level isolation** — nested traffic never enters the top-level
+  window and vice versa, so script loops cannot hide from their own 2× rule
+  and legitimate top-level repetition is never inflated by scripts.
+- **The information wall** — a nested block reason reaches the _script_ as a
+  tool error, not the model (only the script's return value does). When a
+  script swallows it anyway, the next assistant message gets a one-shot steer
+  telling the model to call each tool once and reuse results — so the loop
+  signal can never be silently eaten by a script that ignores tool errors.
+- **Cross-script escalation** — counters are per-script (a new script starts
+  clean), but re-issuing a signature blocked in an earlier script this prompt
+  escalates and aborts the turn, mirroring top-level block-escalation.
+
+Huge nested payloads (whole-file reads) are identity-capped (100 KB per call)
+and each script keeps only its most recent 100 calls, so memory stays bounded. `/loopcheck` reports `nested: calls=N blocks=M`. Disable with
+`PI_ANTI_LOOP_DISABLE=1` as usual.
+
 ## Token-cost awareness
 
 The detector estimates tokens burned on redundant repeats (~4 chars/token) and
@@ -77,29 +109,50 @@ Works with any model — cheap models just trigger it more often.
 
 ## Development
 
-Requires Node 22.18+ (plain `node` runs the TS self-check).
+Requires Node 22.18+ and [pnpm](https://pnpm.io) 12 (pinned via `packageManager`; the install uses pnpm's virtual store at `node_modules/.pnpm`).
 
 ```bash
-npm install
-npm test        # node --test: unit + fixture + fuzz + integration + e2e
-npm run check   # npm test + tsc + oxlint --deny-warnings + oxfmt
+pnpm install
+pnpm test        # node --test: unit + fixture + fuzz + integration + e2e (incl. real-pi e2e)
+pnpm run check   # pnpm test + tsc + oxlint --deny-warnings + oxfmt
+```
+
+### E2E against real pi ≥ 0.99
+
+`tests/e2e/pi.test.ts` downloads the real `@earendil-works/pi-coding-agent@0.99.2`
+once (cached in the OS temp dir), then drives it headlessly: an in-process
+OpenAI-compatible fake LLM scripts the assistant turns, pi's RPC entry runs
+with THIS repo's extension loaded, and the assertions read the real RPC event
+stream. Verified scenarios:
+
+- the extension loads into pi 0.99 and blocks a scripted identical-`bash` doom
+  loop with the instructive block reason
+- a **real codemode worker** executing a script that polls a file 5× inside
+  ONE `codemode` call gets blocked by the nested 2× rule — the script fails
+  with `BLOCKED by anti-doom-loop — inside one codemode script…`
+- the recommended distinct `Promise.allSettled` batch completes untouched
+
+Everything is offline (no API keys); if the npm registry is unreachable the
+real-pi tests skip cleanly instead of failing. Run just them with:
+
+```bash
+pnpm run e2e:pi
 ```
 
 ### Test suite (Node built-in runner, no framework)
 
-| Suite       | File                                          | What it proves                                                                                                    |
-| ----------- | --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
-| unit        | `tests/unit.test.ts`                          | detector semantics: repeat/failure/text signals, window eviction, options clamping, helpers                       |
-| fixture     | `tests/fixtures.ts` + `tests/fixture.test.ts` | real doom-loop transcripts (CI-log loops, verbatim repeats) are caught; healthy sessions are not                  |
-| fuzz        | `tests/fuzz.test.ts`                          | seeded random streams: never throws, no false positives, injected loops always block, canonical stability         |
-| integration | `tests/integration.test.ts`                   | controller + `index.ts` adapter driven through a fake `PiLike`: blocks, escalations, aborts, resets, `/loopcheck` |
-| e2e         | `tests/e2e.test.ts`                           | real subprocesses: detector self-check, version guard, tarball contents (extensions/scripts ship, tests don't)    |
+| Suite       | File                                          | What it proves                                                                                                                                                                      |
+| ----------- | --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| unit        | `tests/unit.test.ts`                          | detector semantics: repeat/failure/text/nested signals, window eviction, options clamping, helpers                                                                                  |
+| fixture     | `tests/fixtures.ts` + `tests/fixture.test.ts` | real doom-loop transcripts (CI-log loops, verbatim repeats, codemode script loops) are caught; healthy sessions are not                                                             |
+| fuzz        | `tests/fuzz.test.ts`                          | seeded random streams: never throws, no false positives, injected loops always block, canonical stability                                                                           |
+| integration | `tests/integration.test.ts`                   | controller + `index.ts` adapter driven through a fake `PiLike`: blocks, escalations, aborts, resets, `/loopcheck`                                                                   |
+| e2e         | `tests/e2e.test.ts` + `tests/e2e/pi.test.ts`  | real subprocesses: detector self-check, version guard, tarball contents (extensions/scripts ship, tests don't), and full sessions against a real pi ≥ 0.99 with a scripted fake LLM |
 
 > `peerDependencies` pins `@earendil-works/pi-coding-agent` at `"*"` on purpose — the
 > [pi packages docs](https://pi.dev/docs/latest/packages) require an unbounded range for
 > pi-core packages (pi provides them at runtime). The extension loads `.ts` directly via
 > jiti, so no build step ships; `prepublishOnly` runs the full quality gate before publish.
-
 > When a call is blocked, escalation still works without recording it in the window:
 > re-issuing the identical call increments a per-signature block counter and aborts the
 > turn on the second block. Thresholds are clamped to a minimum of 2 so a bad config
@@ -117,7 +170,7 @@ git tag v0.0.1
 git push origin v0.0.1
 ```
 
-CI runs the quality gate, then the **version bump guard** (`npm run guard`): it blocks publishing if the version is already on npm or the tag doesn't match `package.json`. After the first publish, the [pi.dev gallery](https://pi.dev/packages) picks the package up automatically via the `pi-package` keyword.
+CI runs the quality gate with pnpm, then the **version bump guard** (`pnpm run guard`): it blocks publishing if the version is already on npm or the tag doesn't match `package.json`. After publishing, the workflow polls the registry until the new version is actually installable — npm scans new publishes before serving them, so `publish` succeeding is not the same as `install` working. After the first publish, the [pi.dev gallery](https://pi.dev/packages) picks the package up automatically via the `pi-package` keyword.
 
 ## License
 

package/extensions/controller.ts

@@ -20,11 +20,15 @@ export interface ToolCallEventLite {
   toolName: string;
   toolCallId: string;
   input: unknown;
+  /** Set when another tool (for example a codemode script) issued this call (pi ≥ 0.99). */
+  parentToolCallId?: string;
 }
 export interface ToolResultEventLite {
   toolName: string;
   toolCallId: string;
   isError: boolean;
+  /** Set when another tool (for example a codemode script) issued this call (pi ≥ 0.99). */
+  parentToolCallId?: string;
 }
 export interface MessageEndEventLite {
   message: { role: string; content?: unknown };
@@ -54,6 +58,10 @@ export interface ToolCallOutcome {
   reason: string;
   /** True when this exact call was blocked before — caller should abort the turn. */
   escalate: boolean;
+  /** True for calls a codemode script made (`parentToolCallId` set, pi ≥ 0.99).
+   * Their block reason reaches the script as a tool error, not the model —
+   * the adapter must also steer so the model learns about the loop. */
+  nested?: boolean;
 }
 
 export interface TextLoopOutcome {
@@ -61,16 +69,29 @@ export interface TextLoopOutcome {
   action: "steer" | "abort";
   /** When aborting: also queue a single fresh-resume directive (bounded). */
   resume: boolean;
+  /** True when this steer surfaces a codemode script's swallowed nested block. */
+  nested?: boolean;
 }
 
 /** How many auto-resumes per session before we hand control back for real. */
 export const RESUME_BUDGET = 1;
 
 export interface AntiLoopController {
-  /** Returns a block decision for a tool call, or null to let it run. */
-  onToolCall(toolName: string, input: ToolInput, toolCallId: string): ToolCallOutcome | null;
+  /** Returns a block decision for a tool call, or null to let it run.
+   * `parentToolCallId` is set for calls a codemode script made (pi ≥ 0.99). */
+  onToolCall(
+    toolName: string,
+    input: ToolInput,
+    toolCallId: string,
+    parentToolCallId?: string,
+  ): ToolCallOutcome | null;
   /** Record a finished tool result (blocked calls' results are ignored). */
-  onToolResult(toolName: string, toolCallId: string, isError: boolean): void;
+  onToolResult(
+    toolName: string,
+    toolCallId: string,
+    isError: boolean,
+    parentToolCallId?: string,
+  ): void;
   /** Detect assistant-text loops; returns a steer/abort decision or null. */
   onMessageEnd(role: string, content: MessageContent): TextLoopOutcome | null;
   /** Full reset (session start, user prompt, /loopcheck reset). */
@@ -87,14 +108,39 @@ export function createController(opts: LoopOptions = readOptions()): AntiLoopCon
   let detector = new LoopDetector(opts);
   const blockedIds = new Set<string>();
   let steered = false;
+  /** Nested (codemode) blocks seen but not yet surfaced to the model: scripts
+   * receive the block reason as a tool error, but only the script's return
+   * value reaches the model — the next message_end steers once so the loop
+   * signal is never swallowed by a script that ignores tool errors. */
+  let steerAgain = false;
   let resumes = 0;
   let steers = 0;
   let aborts = 0;
   let suspended = false;
 
   return {
-    onToolCall(toolName, input, toolCallId) {
+    onToolCall(toolName, input, toolCallId, parentToolCallId) {
       if (suspended) return null;
+      // Nested codemode calls (pi ≥ 0.99) take the stricter per-script path:
+      // they never enter the top-level window, so a script-level loop cannot
+      // hide from its own 3× top-level threshold.
+      if (parentToolCallId !== undefined) {
+        const nested = detector.checkNested(parentToolCallId, toolName, input);
+        if (nested.isErr()) {
+          detector.recordNested(parentToolCallId, toolName, toolCallId, input);
+          return null;
+        }
+        blockedIds.add(toolCallId);
+        // The block reason becomes the script's tool error, not the model's:
+        // arm the one-shot steer so the model still learns about the loop.
+        steerAgain = true;
+        return {
+          block: true,
+          reason: nested.value.reason,
+          escalate: nested.value.escalate,
+          nested: true,
+        };
+      }
       const decision = detector.check(toolName, input);
       if (decision.isErr()) {
         detector.record(toolName, input);
@@ -105,13 +151,17 @@ export function createController(opts: LoopOptions = readOptions()): AntiLoopCon
       return { block: true, reason: block.reason, escalate: block.escalate };
     },
 
-    onToolResult(toolName, toolCallId, isError) {
+    onToolResult(toolName, toolCallId, isError, parentToolCallId) {
       // Blocked calls never ran, so their (error) result must not count as a
       // consecutive failure.
       if (blockedIds.has(toolCallId)) {
         blockedIds.delete(toolCallId);
         return;
       }
+      if (parentToolCallId !== undefined) {
+        detector.recordNestedResult(parentToolCallId, toolCallId, isError);
+        return;
+      }
       detector.recordResult(toolName, isError);
     },
 
@@ -129,6 +179,20 @@ export function createController(opts: LoopOptions = readOptions()): AntiLoopCon
       const batch = detector.checkDuplicateCalls(calls);
       if (batch.isOk()) return { reason: batch.value.reason, action: "abort", resume: false };
 
+      // A nested codemode block may have been swallowed by the script (only
+      // its return value reaches the model): deliver the loop signal once.
+      if (steerAgain && !steered) {
+        steerAgain = false;
+        steered = true;
+        steers++;
+        return {
+          reason: "a codemode script was blocked for repeating tool calls inside itself",
+          action: "steer",
+          resume: false,
+          nested: true,
+        };
+      }
+
       const text = extractText(content);
       if (!text) return null;
       const hit = detector.checkText(text);
@@ -154,6 +218,7 @@ export function createController(opts: LoopOptions = readOptions()): AntiLoopCon
       blockedIds.clear();
       steered = false;
       suspended = false;
+      steerAgain = false;
       // resumes/steers/aborts are intentionally NOT reset here: they are
       // session-scoped so a stuck model cannot cycle steer→abort forever and
       // /loopcheck can report lifetime counters.

package/extensions/detector.ts

@@ -163,6 +163,17 @@ export class LoopDetector {
   private textStreak = 0;
   private wastedTokens = 0;
 
+  // --- nested codemode calls (pi ≥ 0.99: `parentToolCallId` set) ---
+  /** Per-parent (per-script) call windows, keyed by the parent tool-call id. */
+  private nestedSigs = new Map<string, { sig: string; tool: string; args: string }[]>();
+  /** Nested call ids in flight, for wiring results back to their signature. */
+  private nestedIds = new Map<string, { tool: string; args: string }>();
+  /** Blocks per nested signature, prompt-scoped: a NEW script re-issuing a blocked signature escalates. */
+  private nestedBlockedBySig = new Map<string, number>();
+  /** Signatures whose identical nested call already errored inside that script. */
+  private nestedErrorSigs = new Map<string, Set<string>>();
+  private nestedCallCount = 0;
+
   constructor(opts: LoopOptions = DEFAULT_OPTIONS) {
     this.opts = opts;
   }
@@ -227,10 +238,101 @@ export class LoopDetector {
     this.evictSigs();
   }
 
+  /**
+   * Canonical args of a nested call, capped: scripts can issue huge payloads
+   * (a whole file read back) hundreds of times; identity only needs the head.
+   */
+  private canonicalNestedArgs(input: ToolInput): string {
+    const raw = canonical(input);
+    return raw.length > NESTED_ARG_STORAGE_LIMIT ? raw.slice(0, NESTED_ARG_STORAGE_LIMIT) : raw;
+  }
+
+  /**
+   * Stricter detection for calls a codemode script made (`parentToolCallId` set).
+   * Inside one script a repeated call is never progress — the script can store
+   * and reuse its first result — so identical args block at
+   * `NESTED_REPEAT_THRESHOLD` (2), and an identical retry of a call that
+   * already errored in this script blocks immediately. The block reason
+   * becomes the script's tool error; `escalate` is true when this signature
+   * was already blocked in an earlier script this prompt.
+   */
+  checkNested(parentToolCallId: string, toolName: string, input: ToolInput): NestedDecision {
+    if (this.opts.toolExclude.has(toolName)) return Result.err(undefined);
+    const args = this.canonicalNestedArgs(input);
+    const sig = `${toolName}:${args}`;
+    const pool = this.nestedSigs.get(parentToolCallId) ?? [];
+    const repeats = pool.filter((s) => s.sig === sig).length;
+    const reasons = collectNestedBlockReasons(
+      toolName,
+      repeats,
+      this.nestedErrorSigs.get(parentToolCallId)?.has(sig) === true,
+      () => this.nearRepeats(toolName, args, pool),
+    );
+    if (reasons.length === 0) return Result.err(undefined);
+
+    const blockedCount = (this.nestedBlockedBySig.get(sig) ?? 0) + 1;
+    this.nestedBlockedBySig.set(sig, blockedCount);
+    return Result.ok({
+      reason:
+        reasons.join("; ") +
+        `. BLOCKED by anti-doom-loop — inside a script, store the first result in a variable and reuse it instead of calling again.`,
+      escalate: blockedCount > 1,
+    });
+  }
+
+  /** Record an allowed nested call into its parent script's window. */
+  recordNested(
+    parentToolCallId: string,
+    toolName: string,
+    toolCallId: string,
+    input: ToolInput,
+  ): void {
+    if (this.opts.toolExclude.has(toolName)) return;
+    const args = this.canonicalNestedArgs(input);
+    let pool = this.nestedSigs.get(parentToolCallId);
+    if (!pool) {
+      pool = [];
+      this.nestedSigs.set(parentToolCallId, pool);
+    }
+    pool.push({ sig: `${toolName}:${args}`, tool: toolName, args });
+    if (pool.length > NESTED_POOL_LIMIT) pool.splice(0, pool.length - NESTED_POOL_LIMIT);
+    this.nestedIds.set(toolCallId, { tool: toolName, args });
+    this.nestedCallCount++;
+  }
+
+  /** Wire a nested result back: an errored signature blocks its identical retry. */
+  recordNestedResult(parentToolCallId: string, toolCallId: string, isError: boolean): void {
+    const entry = this.nestedIds.get(toolCallId);
+    this.nestedIds.delete(toolCallId);
+    if (!isError || !entry) return;
+    let errs = this.nestedErrorSigs.get(parentToolCallId);
+    if (!errs) {
+      errs = new Set();
+      this.nestedErrorSigs.set(parentToolCallId, errs);
+    }
+    errs.add(`${entry.tool}:${entry.args}`);
+    if (errs.size > NESTED_POOL_LIMIT) {
+      const oldest = errs.values().next();
+      if (!oldest.done) errs.delete(oldest.value);
+    }
+  }
+
+  /** Nested codemode counters for /loopcheck (allowed calls recorded, blocks issued). */
+  nestedStats(): NestedStats {
+    return {
+      calls: this.nestedCallCount,
+      blocks: [...this.nestedBlockedBySig.values()].reduce((a, b) => a + b, 0),
+    };
+  }
+
   /** Windowed same-tool entries whose args are ≥55% shared tokens (identical counts). */
-  private nearRepeats(toolName: string, args: string): number {
+  private nearRepeats(
+    toolName: string,
+    args: string,
+    pool: readonly { tool: string; args: string }[] = this.recentSigs,
+  ): number {
     let n = 0;
-    for (const s of this.recentSigs) {
+    for (const s of pool) {
       if (s.tool !== toolName) continue;
       const sim = argSimilarity(args, s.args);
       if (sim !== null && sim >= NEAR_ARGS_SIMILARITY_THRESHOLD) n++;
@@ -424,10 +526,12 @@ export class LoopDetector {
       .map(([s, n]) => `"${truncate(s, 24)}" x${n}`)
       .join(", ");
 
+    const nested = this.nestedStats();
     return (
       `calls[${this.recentSigs.length}] ${topSigs || "none"}; ` +
       `texts[${this.recentTexts.length}] ${topTexts || "none"}; ` +
-      `wastedTokens=${this.wastedTokens}`
+      `wastedTokens=${this.wastedTokens}; ` +
+      `nested: calls=${nested.calls} blocks=${nested.blocks}`
     );
   }
 
@@ -439,6 +543,11 @@ export class LoopDetector {
     this.lastText = null;
     this.textStreak = 0;
     this.wastedTokens = 0;
+    this.nestedSigs.clear();
+    this.nestedIds.clear();
+    this.nestedBlockedBySig.clear();
+    this.nestedErrorSigs.clear();
+    this.nestedCallCount = 0;
   }
 
   summary(): string {
@@ -473,6 +582,63 @@ export const NEAR_ARGS_SIMILARITY_THRESHOLD = 0.55;
  * exact matching only. Long inputs — shell commands — always clear this.
  */
 export const NEAR_ARGS_MIN_UNION = 5;
+
+/** Decision for a nested (codemode) tool call — same shape as BlockDecision. */
+export type NestedDecision = Result<BlockDecision, undefined>;
+
+/**
+ * Block reasons for one nested codemode call: identical repeats (2× rule),
+ * an identical retry of a call that already errored in this script, and —
+ * only when neither fired — near-identical args at the same 2× threshold.
+ * `nearRepeats` is lazy so random traffic never pays the tokenization cost.
+ */
+function collectNestedBlockReasons(
+  toolName: string,
+  repeats: number,
+  erroredBefore: boolean,
+  nearRepeats: () => number,
+): string[] {
+  const reasons: string[] = [];
+  if (repeats + 1 >= NESTED_REPEAT_THRESHOLD) {
+    reasons.push(
+      `"${toolName}" was called with identical arguments ${repeats + 1} times inside one codemode script`,
+    );
+  }
+  if (erroredBefore) {
+    reasons.push(`the identical "${toolName}" call already failed inside this script`);
+  }
+  if (reasons.length === 0 && repeats === 0 && nearRepeats() + 1 >= NESTED_REPEAT_THRESHOLD) {
+    reasons.push(
+      `"${toolName}" was called with near-identical arguments ${nearRepeats() + 1} times inside one codemode script (only minor changes)`,
+    );
+  }
+  return reasons;
+}
+
+/** Counters for nested codemode traffic, reported by /loopcheck. */
+export interface NestedStats {
+  calls: number;
+  blocks: number;
+}
+
+/**
+ * Nested codemode calls (pi ≥ 0.99, `parentToolCallId` set) block at a stricter
+ * threshold than top-level calls: inside one script a repeated call is never
+ * progress — the script can reuse its first result — so 2 occurrences block
+ * where top-level detection needs 3.
+ */
+export const NESTED_REPEAT_THRESHOLD = 2;
+
+/** Max chars of one nested call's canonical args kept for identity/similarity. */
+export const NESTED_ARG_STORAGE_LIMIT = 100_000;
+
+/**
+ * Max recent calls a codemode script's window keeps. Entries hold up to
+ * `NESTED_ARG_STORAGE_LIMIT` chars each, so an unbounded per-script window
+ * would let one script pin hundreds of MB; in-script loops repeat adjacent
+ * calls, which a recent window still catches.
+ */
+export const NESTED_POOL_LIMIT = 100;
 // ponytail: 0.55 misses ONE shape — short (~11-token) commands that change
 // BOTH ends at once (added wrapper + changed tail glue → ~0.53); single-axis
 // drift and longer commands clear. Upgrade path if that shape shows up:
@@ -776,5 +942,46 @@ if (import.meta.main) {
   // genuinely different command with the same tool stays unblocked
   assert.ok(d.check("bash", { command: "cargo test -p pools 2>&1 | tail -5" }).isErr());
 
+  // 15. nested codemode calls: stricter 2× threshold, error-retry block, no
+  //     leakage into the top-level window
+  d.reset();
+  assert.ok(d.checkNested("p1", "read", { path: "a.ts" }).isErr(), "1st nested call passes");
+  d.recordNested("p1", "read", "p1/1", { path: "a.ts" });
+  const nHit = d.checkNested("p1", "read", { path: "a.ts" });
+  assert.ok(nHit.isOk(), "2nd identical nested call blocks");
+  if (nHit.isOk()) {
+    assert.equal(nHit.value.escalate, false, "first in-script block does not escalate");
+    assert.match(nHit.value.reason, /identical arguments 2 times inside one codemode script/);
+  }
+  assert.ok(d.checkNested("p2", "read", { path: "a.ts" }).isErr(), "a new script starts clean");
+  // identical-after-error blocks even at the first occurrence in a parent
+  d.recordNested("p2", "bash", "p2/1", { command: "npm test" });
+  d.recordNestedResult("p2", "p2/1", true);
+  const errHit = d.checkNested("p2", "bash", { command: "npm test" });
+  assert.ok(errHit.isOk(), "identical retry after a nested error blocks");
+  if (errHit.isOk()) assert.match(errHit.value.reason, /already failed inside this script/);
+  // a NEW script re-issuing a signature blocked before escalates
+  const crossScript = d.checkNested("p3", "bash", { command: "npm test" });
+  assert.ok(crossScript.isErr(), "fresh script with a fresh call passes");
+  d.recordNested("p3", "bash", "p3/1", { command: "npm test" });
+  const crossBlock = d.checkNested("p3", "bash", { command: "npm test" });
+  assert.ok(crossBlock.isOk() && crossBlock.value.escalate, "cross-script repeat escalates");
+  // nested traffic never enters the top-level window
+  d.reset();
+  d.recordNested("p", "bash", "p/1", { command: "poll" });
+  d.recordNested("p", "bash", "p/2", { command: "poll" });
+  assert.ok(
+    d.check("bash", { command: "poll" }).isErr(),
+    "top-level window empty of nested traffic",
+  );
+  // huge nested payloads stay capped and never throw
+  assert.doesNotThrow(() => {
+    const huge = "x".repeat(300_000);
+    for (let i = 0; i < 50; i++) {
+      d.checkNested("p", "read", { path: `f${i}.ts`, content: huge });
+      d.recordNested("p", "read", `p/h${i}`, { path: `f${i}.ts`, content: huge });
+    }
+  });
+
   console.log("detector self-check: all assertions passed");
 }

package/extensions/index.ts

@@ -76,6 +76,13 @@ const STEER_TEXT =
   "Stop. Re-read the actual error output, pick ONE different action, and execute it. " +
   "If you are stuck, ask the user instead of retrying.";
 
+/** Steer delivered after a codemode script swallowed a nested block: the script
+ * got the block reason as a tool error, but only its return reaches the model. */
+const NESTED_STEER_TEXT =
+  "Anti-doom-loop steering: a codemode script repeated identical tool calls inside itself. " +
+  "Inside a script, call each tool once, store the result in a variable, and reuse it — " +
+  "never poll or retry the same call in a loop. If the calls keep failing, stop and ask the user.";
+
 /** Queued once after an abort so the work can continue with a fresh approach. */
 const RESUME_TEXT =
   "Anti-doom-loop: the previous run was aborted because it looped. " +
@@ -96,6 +103,7 @@ export default function (pi: PiLike): void {
       event.toolName,
       event.input as ToolInput,
       event.toolCallId,
+      event.parentToolCallId,
     );
     if (outcome === null) return;
     if (outcome.escalate) {
@@ -106,7 +114,12 @@ export default function (pi: PiLike): void {
   });
 
   pi.on("tool_result", (event: ToolResultEventLite) => {
-    controller.onToolResult(event.toolName, event.toolCallId, event.isError === true);
+    controller.onToolResult(
+      event.toolName,
+      event.toolCallId,
+      event.isError === true,
+      event.parentToolCallId,
+    );
   });
 
   // Text-only doom loops (model re-emits/rephrases the same thing with no
@@ -134,9 +147,10 @@ export default function (pi: PiLike): void {
     if (outcome === null) return;
 
     if (outcome.action === "steer") {
+      const text = outcome.nested ? NESTED_STEER_TEXT : STEER_TEXT;
       ctx.ui.notify(`Anti-doom-loop: ${outcome.reason}`, "warning");
       pi.sendMessage?.(
-        { customType: "anti-doom-loop", content: STEER_TEXT, display: true },
+        { customType: "anti-doom-loop", content: text, display: true },
         { deliverAs: "steer", triggerTurn: true },
       );
       return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-anti-doom-loop",
-  "version": "0.0.10",
+  "version": "0.0.13",
   "description": "Detect and break agent doom loops in pi: blocks identical repeated tool calls and blind retries before they burn tokens.",
   "keywords": [
     "anti-doom-loop",
@@ -29,29 +29,19 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "check": "npm run test && tsc --noEmit && oxlint --deny-warnings && oxfmt --check .",
-    "prepublishOnly": "npm run check",
-    "test": "node --test tests/*.test.ts",
-    "guard": "node scripts/guard-publish.ts",
-    "lint": "oxlint --deny-warnings",
-    "format": "oxfmt .",
-    "format:check": "oxfmt --check .",
-    "prepare": "effect-tsgo patch --no-typescript --oxlint --skip-missing"
-  },
   "dependencies": {
-    "@effect/tsgo": "^0.36.4",
+    "@effect/tsgo": "0.53.3",
     "better-result": "^3.0.0",
-    "effect": "^4.0.0-rc.108",
-    "oxlint": "1.77.0"
+    "effect": "^4.0.0-rc.108"
   },
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "*",
-    "@oxlint/plugins": "1.77.0",
+    "@oxlint/plugins": "1.88.0",
     "@types/node": "^22.0.0",
-    "oxfmt": "^0.62.0",
-    "oxlint-tsgolint": "^7.0.2001",
-    "typescript": "^5.6.0"
+    "oxfmt": "0.74.0",
+    "oxlint": "1.88.0",
+    "oxlint-tsgolint": "7.0.2004",
+    "typescript": "^7.0.2"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "*"
@@ -63,5 +53,14 @@
     "extensions": [
       "./extensions"
     ]
+  },
+  "scripts": {
+    "check": "pnpm run test && tsc --noEmit && oxlint --deny-warnings && oxfmt --check .",
+    "test": "node --test tests/*.test.ts tests/e2e/*.test.ts",
+    "guard": "node scripts/guard-publish.ts",
+    "e2e:pi": "node --test tests/e2e/pi.test.ts",
+    "lint": "oxlint --deny-warnings",
+    "format": "oxfmt .",
+    "format:check": "oxfmt --check ."
   }
-}
+}