pi-anti-doom-loop 0.0.6 → 0.0.8

package/CHANGELOG.md

@@ -2,7 +2,20 @@
 
 All notable changes to **pi-anti-doom-loop**.
 
-## [Unreleased]
+## [0.0.8] — 2026-08-24
+
+### Added
+
+- **Within-message tool-call spam detection** — `onMessageEnd` now inspects the assistant message's `toolCall` blocks and aborts immediately when `textRepeatThreshold` identical `(tool, args)` calls are batched in ONE message (`LoopDetector.checkDuplicateCalls`). Catches degenerate parallel batches — e.g. a single response emitting 1405 identical `bash "true"` calls (observed in production) — which per-call detection never sees as a streak because every call arrives at once, and which can be aborted before any call executes. Respects `PI_ANTI_LOOP_TOOLS_EXCLUDE`; aborts rather than steers since steering cannot retract emitted calls.
+
+## [0.0.7] — 2026-08-13
+
+### Changed
+
+- **Effect 4.0 RC** — upgraded `effect` from `^4.0.0-beta.103` to `^4.0.0-rc.108`.
+- **Anti-slop lint hardening** — vendored an opinionated Oxlint rule set (`tools/oxlint/anti-slop/`) and enabled it in `oxlint.config.ts`; resolved all 23 findings by introducing a JSON-safe `ToolInput` domain type decoded at the pi boundary, replacing `unknown` parameters, `typeof` checks, `Record<string, unknown>`, and value widening.
+
+## [0.0.6] — 2026-08-12
 
 ### Added
 
@@ -97,7 +110,10 @@ All notable changes to **pi-anti-doom-loop**.
 - GitHub Actions release workflow: quality gate → version bump guard → dry-run → publish, triggered by `v*` tags.
 - `pi-package` keyword + `pi` manifest for the pi.dev gallery.
 
+[0.0.7]: https://github.com/irfndi/pi-anti-doom-loop/compare/v0.0.6...v0.0.7
+[0.0.6]: https://github.com/irfndi/pi-anti-doom-loop/compare/v0.0.5...v0.0.6
 [0.0.5]: https://github.com/irfndi/pi-anti-doom-loop/compare/v0.0.4...v0.0.5
 [0.0.4]: https://github.com/irfndi/pi-anti-doom-loop/compare/v0.0.3...v0.0.4
+[0.0.3]: https://github.com/irfndi/pi-anti-doom-loop/compare/v0.0.2...v0.0.3
 [0.0.2]: https://github.com/irfndi/pi-anti-doom-loop/compare/v0.0.1...v0.0.2
 [0.0.1]: https://github.com/irfndi/pi-anti-doom-loop/releases/tag/v0.0.1

package/extensions/controller.ts

@@ -13,7 +13,7 @@
  * a fresh session (new controller) starts over.
  */
 import { LoopDetector, readOptions } from "./detector.ts";
-import type { LoopOptions } from "./detector.ts";
+import type { LoopOptions, ToolInput } from "./detector.ts";
 
 /** Minimal shapes of the pi events the controller consumes (structural). */
 export interface ToolCallEventLite {
@@ -37,6 +37,18 @@ export interface CommandCtxLite {
   ui: { notify(message: string, level: string): void };
 }
 
+/** One content block of an assistant message; text blocks carry text, tool
+ * calls carry name + arguments (pi's AgentMessage block shape). */
+export interface MessageContentBlock {
+  readonly type: string;
+  readonly text?: string;
+  readonly name?: string;
+  readonly arguments?: unknown;
+}
+
+/** The list of content blocks of an assistant message. */
+export type MessageContent = readonly MessageContentBlock[];
+
 export interface ToolCallOutcome {
   block: true;
   reason: string;
@@ -56,11 +68,11 @@ export const RESUME_BUDGET = 1;
 
 export interface AntiLoopController {
   /** Returns a block decision for a tool call, or null to let it run. */
-  onToolCall(toolName: string, input: unknown, toolCallId: string): ToolCallOutcome | null;
+  onToolCall(toolName: string, input: ToolInput, toolCallId: string): ToolCallOutcome | null;
   /** Record a finished tool result (blocked calls' results are ignored). */
   onToolResult(toolName: string, toolCallId: string, isError: boolean): void;
   /** Detect assistant-text loops; returns a steer/abort decision or null. */
-  onMessageEnd(role: string, content: unknown): TextLoopOutcome | null;
+  onMessageEnd(role: string, content: MessageContent): TextLoopOutcome | null;
   /** Full reset (session start, user prompt, /loopcheck reset). */
   reset(): void;
   /** Suspend detection until the next reset (escape hatch for intentional repetition). */
@@ -106,6 +118,16 @@ export function createController(opts: LoopOptions = readOptions()): AntiLoopCon
     onMessageEnd(role, content) {
       if (suspended) return null;
       if (role !== "assistant") return null;
+
+      // Within-message duplicate tool-call spam fires first: it aborts (the
+      // calls are already emitted, steering cannot retract them), so it must
+      // outrank the steer-able text ladder.
+      const calls = content
+        .filter((c) => c.type === "toolCall")
+        .map((c) => ({ toolName: c.name ?? "", input: c.arguments as ToolInput }));
+      const batch = detector.checkDuplicateCalls(calls);
+      if (batch.isOk()) return { reason: batch.value.reason, action: "abort", resume: false };
+
       const text = extractText(content);
       if (!text) return null;
       const hit = detector.checkText(text);
@@ -164,13 +186,6 @@ export function createController(opts: LoopOptions = readOptions()): AntiLoopCon
 }
 
 /** Join the text content blocks of an assistant message. */
-export function extractText(content: unknown): string {
-  if (!Array.isArray(content)) return "";
-  return content
-    .map((c) =>
-      typeof c === "object" && c !== null && c.type === "text" && typeof c.text === "string"
-        ? c.text
-        : "",
-    )
-    .join(" ");
+export function extractText(content: MessageContent): string {
+  return content.map((c) => (c.type === "text" ? (c.text ?? "") : "")).join(" ");
 }

package/extensions/detector.ts

@@ -77,18 +77,32 @@ export function readOptions(env: Record<string, string | undefined> = process.en
   };
 }
 
+/**
+ * A JSON-safe tool-call argument value. Tool inputs arrive from the pi event
+ * loop as untyped data; they are decoded into this domain type at the I/O
+ * boundary (see index.ts) before the detector fingerprints them.
+ */
+export type ToolInput =
+  | null
+  | boolean
+  | number
+  | string
+  | ToolInput[]
+  | { readonly [key: string]: ToolInput };
+
 /** Keys sorted recursively so {a:1,b:2} and {b:2,a:1} share a signature. */
-export function canonical(input: unknown): string {
-  if (input === null || typeof input !== "object") return JSON.stringify(input);
+export function canonical(input: ToolInput): string {
   if (Array.isArray(input)) return `[${input.map(canonical).join(",")}]`;
-  const obj = input as Record<string, unknown>;
-  return `{${Object.keys(obj)
-    .sort()
-    .map((k) => `${JSON.stringify(k)}:${canonical(obj[k])}`)
-    .join(",")}}`;
+  if (input instanceof Object) {
+    return `{${Object.keys(input)
+      .sort()
+      .map((k) => `${JSON.stringify(k)}:${canonical(input[k])}`)
+      .join(",")}}`;
+  }
+  return JSON.stringify(input) ?? "";
 }
 
-export function signature(toolName: string, input: unknown): string {
+export function signature(toolName: string, input: ToolInput): string {
   return `${toolName}:${canonical(input)}`;
 }
 
@@ -118,7 +132,7 @@ export class LoopDetector {
     this.opts = opts;
   }
 
-  check(toolName: string, input: unknown): Result<BlockDecision, undefined> {
+  check(toolName: string, input: ToolInput): Result<BlockDecision, undefined> {
     if (this.opts.toolExclude.has(toolName)) {
       // record() is a no-op for excluded tools, so nothing enters the window.
       return Result.err(undefined);
@@ -168,7 +182,7 @@ export class LoopDetector {
     });
   }
 
-  record(toolName: string, input: unknown): void {
+  record(toolName: string, input: ToolInput): void {
     if (this.opts.toolExclude.has(toolName)) return;
     this.recentSigs.push({ sig: signature(toolName, input), ts: Date.now() });
     this.evictSigs();
@@ -260,6 +274,36 @@ export class LoopDetector {
     return Result.err(undefined);
   }
 
+  /**
+   * Duplicate identical (tool, args) calls batched inside ONE assistant
+   * message (parallel tool-call spam). Degenerate models sometimes emit a
+   * single response containing hundreds of the same no-op call; per-call
+   * detection never sees it as a streak because every call arrives at once.
+   * Fires at textRepeatThreshold duplicates of any one signature. The calls
+   * are already emitted when this runs, so the controller aborts instead of
+   * steering — a steer cannot retract them.
+   */
+  checkDuplicateCalls(
+    entries: { toolName: string; input: ToolInput }[],
+  ): Result<{ reason: string }, undefined> {
+    const counts = new Map<string, { n: number; name: string; input: ToolInput }>();
+    for (const e of entries) {
+      if (this.opts.toolExclude.has(e.toolName)) continue;
+      const sig = signature(e.toolName, e.input);
+      const cur = counts.get(sig) ?? { n: 0, name: e.toolName, input: e.input };
+      cur.n++;
+      counts.set(sig, cur);
+      if (cur.n >= this.opts.textRepeatThreshold) {
+        return Result.ok({
+          reason:
+            `Assistant message contains ${cur.n} identical "${e.toolName}" calls ` +
+            `("${truncate(stringify(e.input), 60)}"). You appear to be in a loop.`,
+        });
+      }
+    }
+    return Result.err(undefined);
+  }
+
   /** Trail of results that are errors of this same tool (consecutive). */
   private consecutiveFails(toolName: string): number {
     let n = 0;
@@ -272,7 +316,7 @@ export class LoopDetector {
   }
 
   /** Error share of all in-window results for a tool. */
-  private failRate(toolName: string): { calls: number; errors: number; rate: number } {
+  private failRate(toolName: string) {
     let calls = 0;
     let errors = 0;
     for (const r of this.recentResults) {
@@ -370,14 +414,9 @@ export const MIN_REPEAT_CHUNK = 16;
 /** Jaccard similarity threshold for "near-identical" consecutive texts. */
 export const TEXT_SIMILARITY_THRESHOLD = 0.55;
 
-/** Stable string form of an arbitrary tool input (used for token estimation). */
-export function stringify(input: unknown): string {
-  if (typeof input === "string") return input;
-  try {
-    return JSON.stringify(input);
-  } catch {
-    return String(input);
-  }
+/** Stable string form of a tool input (used for token estimation). */
+export function stringify(input: ToolInput): string {
+  return JSON.stringify(input) ?? "";
 }
 
 /**
@@ -568,5 +607,25 @@ if (import.meta.main) {
   const two = readOptions({ PI_ANTI_LOOP_REPEATS: "2" });
   assert.equal(two.repeatThreshold, 2, "2 is the minimum accepted");
 
+  // 13. within-one-message duplicate tool-call spam (degenerate parallel batch)
+  d.reset();
+  const spamHit = d.checkDuplicateCalls(
+    Array.from({ length: 3 }, () => ({
+      toolName: "bash",
+      input: { command: "true" } as ToolInput,
+    })),
+  );
+  assert.ok(spamHit.isOk(), "3 identical calls in one message should fire");
+  if (spamHit.isOk()) assert.match(spamHit.value.reason, /identical "bash" calls/);
+  assert.ok(
+    d
+      .checkDuplicateCalls([
+        { toolName: "read", input: { path: "a.ts" } },
+        { toolName: "read", input: { path: "b.ts" } },
+      ])
+      .isErr(),
+    "distinct parallel args are not spam",
+  );
+
   console.log("detector self-check: all assertions passed");
 }

package/extensions/index.ts

@@ -31,11 +31,12 @@ import {
   type AntiLoopController,
   type CommandCtxLite,
   type CtxLite,
+  type MessageContent,
   type MessageEndEventLite,
   type ToolCallEventLite,
   type ToolResultEventLite,
 } from "./controller.ts";
-import { readOptions } from "./detector.ts";
+import { readOptions, type ToolInput } from "./detector.ts";
 
 /** The subset of pi's ExtensionAPI this extension uses (structural). */
 export interface PiLike {
@@ -77,7 +78,13 @@ export default function (pi: PiLike): void {
   pi.on("before_agent_start", () => controller.reset());
 
   pi.on("tool_call", (event: ToolCallEventLite, ctx: CtxLite) => {
-    const outcome = controller.onToolCall(event.toolName, event.input, event.toolCallId);
+    // The pi event delivers untyped tool arguments; decode them into the
+    // ToolInput domain type at this I/O boundary before the controller sees them.
+    const outcome = controller.onToolCall(
+      event.toolName,
+      event.input as ToolInput,
+      event.toolCallId,
+    );
     if (outcome === null) return;
     if (outcome.escalate) {
       ctx.ui.notify("Anti-doom-loop: identical call blocked again — aborting turn", "error");
@@ -94,7 +101,11 @@ export default function (pi: PiLike): void {
   // tool calls) never reach tool_call. Steer first, abort as escalation,
   // then a bounded auto-resume so the work continues.
   pi.on("message_end", (event: MessageEndEventLite, ctx: CtxLite) => {
-    const outcome = controller.onMessageEnd(event.message.role, event.message.content);
+    // Decode the untyped message content into MessageContent at this boundary.
+    const outcome = controller.onMessageEnd(
+      event.message.role,
+      event.message.content as MessageContent,
+    );
     if (outcome === null) return;
 
     if (outcome.action === "steer") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-anti-doom-loop",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "description": "Detect and break agent doom loops in pi: blocks identical repeated tool calls and blind retries before they burn tokens.",
   "keywords": [
     "anti-doom-loop",
@@ -41,11 +41,12 @@
   },
   "dependencies": {
     "better-result": "^3.0.0",
-    "effect": "^4.0.0-beta.103"
+    "effect": "^4.0.0-rc.108"
   },
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "*",
     "@effect/tsgo": "^0.36.4",
+    "@oxlint/plugins": "^1.77.0",
     "@types/node": "^22.0.0",
     "oxfmt": "^0.62.0",
     "oxlint": "^1.77.0",