pi-anti-doom-loop 0.0.7 → 0.0.8

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to **pi-anti-doom-loop**.
 
+## [0.0.8] — 2026-08-24
+
+### Added
+
+- **Within-message tool-call spam detection** — `onMessageEnd` now inspects the assistant message's `toolCall` blocks and aborts immediately when `textRepeatThreshold` identical `(tool, args)` calls are batched in ONE message (`LoopDetector.checkDuplicateCalls`). Catches degenerate parallel batches — e.g. a single response emitting 1405 identical `bash "true"` calls (observed in production) — which per-call detection never sees as a streak because every call arrives at once, and which can be aborted before any call executes. Respects `PI_ANTI_LOOP_TOOLS_EXCLUDE`; aborts rather than steers since steering cannot retract emitted calls.
+
 ## [0.0.7] — 2026-08-13
 
 ### Changed

package/extensions/controller.ts

@@ -37,10 +37,13 @@ export interface CommandCtxLite {
   ui: { notify(message: string, level: string): void };
 }
 
-/** One content block of an assistant message; only text blocks carry text. */
+/** One content block of an assistant message; text blocks carry text, tool
+ * calls carry name + arguments (pi's AgentMessage block shape). */
 export interface MessageContentBlock {
   readonly type: string;
   readonly text?: string;
+  readonly name?: string;
+  readonly arguments?: unknown;
 }
 
 /** The list of content blocks of an assistant message. */
@@ -115,6 +118,16 @@ export function createController(opts: LoopOptions = readOptions()): AntiLoopCon
     onMessageEnd(role, content) {
       if (suspended) return null;
       if (role !== "assistant") return null;
+
+      // Within-message duplicate tool-call spam fires first: it aborts (the
+      // calls are already emitted, steering cannot retract them), so it must
+      // outrank the steer-able text ladder.
+      const calls = content
+        .filter((c) => c.type === "toolCall")
+        .map((c) => ({ toolName: c.name ?? "", input: c.arguments as ToolInput }));
+      const batch = detector.checkDuplicateCalls(calls);
+      if (batch.isOk()) return { reason: batch.value.reason, action: "abort", resume: false };
+
       const text = extractText(content);
       if (!text) return null;
       const hit = detector.checkText(text);

package/extensions/detector.ts

@@ -274,6 +274,36 @@ export class LoopDetector {
     return Result.err(undefined);
   }
 
+  /**
+   * Duplicate identical (tool, args) calls batched inside ONE assistant
+   * message (parallel tool-call spam). Degenerate models sometimes emit a
+   * single response containing hundreds of the same no-op call; per-call
+   * detection never sees it as a streak because every call arrives at once.
+   * Fires at textRepeatThreshold duplicates of any one signature. The calls
+   * are already emitted when this runs, so the controller aborts instead of
+   * steering — a steer cannot retract them.
+   */
+  checkDuplicateCalls(
+    entries: { toolName: string; input: ToolInput }[],
+  ): Result<{ reason: string }, undefined> {
+    const counts = new Map<string, { n: number; name: string; input: ToolInput }>();
+    for (const e of entries) {
+      if (this.opts.toolExclude.has(e.toolName)) continue;
+      const sig = signature(e.toolName, e.input);
+      const cur = counts.get(sig) ?? { n: 0, name: e.toolName, input: e.input };
+      cur.n++;
+      counts.set(sig, cur);
+      if (cur.n >= this.opts.textRepeatThreshold) {
+        return Result.ok({
+          reason:
+            `Assistant message contains ${cur.n} identical "${e.toolName}" calls ` +
+            `("${truncate(stringify(e.input), 60)}"). You appear to be in a loop.`,
+        });
+      }
+    }
+    return Result.err(undefined);
+  }
+
   /** Trail of results that are errors of this same tool (consecutive). */
   private consecutiveFails(toolName: string): number {
     let n = 0;
@@ -577,5 +607,25 @@ if (import.meta.main) {
   const two = readOptions({ PI_ANTI_LOOP_REPEATS: "2" });
   assert.equal(two.repeatThreshold, 2, "2 is the minimum accepted");
 
+  // 13. within-one-message duplicate tool-call spam (degenerate parallel batch)
+  d.reset();
+  const spamHit = d.checkDuplicateCalls(
+    Array.from({ length: 3 }, () => ({
+      toolName: "bash",
+      input: { command: "true" } as ToolInput,
+    })),
+  );
+  assert.ok(spamHit.isOk(), "3 identical calls in one message should fire");
+  if (spamHit.isOk()) assert.match(spamHit.value.reason, /identical "bash" calls/);
+  assert.ok(
+    d
+      .checkDuplicateCalls([
+        { toolName: "read", input: { path: "a.ts" } },
+        { toolName: "read", input: { path: "b.ts" } },
+      ])
+      .isErr(),
+    "distinct parallel args are not spam",
+  );
+
   console.log("detector self-check: all assertions passed");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-anti-doom-loop",
-  "version": "0.0.7",
+  "version": "0.0.8",
   "description": "Detect and break agent doom loops in pi: blocks identical repeated tool calls and blind retries before they burn tokens.",
   "keywords": [
     "anti-doom-loop",