pi-anti-doom-loop 0.0.7 → 0.0.9

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 All notable changes to **pi-anti-doom-loop**.
 
+## [0.0.9] — 2026-09-07
+
+### Added
+
+- **Full anti-slop rule set** — synced the vendored Oxlint plugin with upstream: 5 missing generic rules (`no-module-mocking`, `no-reflect-apply`, `no-reflect-get`, `no-unknown-returns`, `require-safety-comment-for-type-assertion`), the opt-in Effect plugin (`no-service-constructor-imports`, enabled — this repo declares `effect`), and the supporting shared helpers. All 15 generic rules plus the Effect rule run at `error`.
+- **Complexity gate** — `eslint/complexity` with `{ max: 10 }`; anything in the 11+ "refactor now" band fails the build.
+
+### Fixed
+
+- **Within-message false positive on status lists** — `repeatedSegment` no longer splits on `:` (status updates like "worker dispatched: a. worker dispatched: b. worker dispatched: c." stay whole and distinct). Separator-less concatenation (`S:S:S:`) and truncated repeats are still caught by the new `tandemPrefix` check.
+- **Complexity + slop findings in owned code** — extracted `collectBlockReasons` (`check` CC 11 → 6); replaced `as` casts at I/O boundaries with `SAFETY:` invariants, real `isManifest` / `hasStringVersion` guards, a named `PiHandlerResult` contract, and assertion-free tests.
+
+## [0.0.8] — 2026-08-24
+
+### Added
+
+- **Within-message tool-call spam detection** — `onMessageEnd` now inspects the assistant message's `toolCall` blocks and aborts immediately when `textRepeatThreshold` identical `(tool, args)` calls are batched in ONE message (`LoopDetector.checkDuplicateCalls`). Catches degenerate parallel batches — e.g. a single response emitting 1405 identical `bash "true"` calls (observed in production) — which per-call detection never sees as a streak because every call arrives at once, and which can be aborted before any call executes. Respects `PI_ANTI_LOOP_TOOLS_EXCLUDE`; aborts rather than steers since steering cannot retract emitted calls.
+
 ## [0.0.7] — 2026-08-13
 
 ### Changed

package/extensions/controller.ts

@@ -37,10 +37,13 @@ export interface CommandCtxLite {
   ui: { notify(message: string, level: string): void };
 }
 
-/** One content block of an assistant message; only text blocks carry text. */
+/** One content block of an assistant message; text blocks carry text, tool
+ * calls carry name + arguments (pi's AgentMessage block shape). */
 export interface MessageContentBlock {
   readonly type: string;
   readonly text?: string;
+  readonly name?: string;
+  readonly arguments?: unknown;
 }
 
 /** The list of content blocks of an assistant message. */
@@ -115,6 +118,17 @@ export function createController(opts: LoopOptions = readOptions()): AntiLoopCon
     onMessageEnd(role, content) {
       if (suspended) return null;
       if (role !== "assistant") return null;
+
+      // Within-message duplicate tool-call spam fires first: it aborts (the
+      // calls are already emitted, steering cannot retract them), so it must
+      // outrank the steer-able text ladder.
+      // SAFETY: tool-call arguments arrive as JSON-safe values matching ToolInput.
+      const calls = content
+        .filter((c) => c.type === "toolCall")
+        .map((c) => ({ toolName: c.name ?? "", input: c.arguments as ToolInput }));
+      const batch = detector.checkDuplicateCalls(calls);
+      if (batch.isOk()) return { reason: batch.value.reason, action: "abort", resume: false };
+
       const text = extractText(content);
       if (!text) return null;
       const hit = detector.checkText(text);

package/extensions/detector.ts

@@ -113,6 +113,35 @@ export interface BlockDecision {
   escalate: boolean;
 }
 
+/** Block reasons for one tool call: identical repeats, failure streak, failure rate. */
+function collectBlockReasons(
+  toolName: string,
+  total: number,
+  consecutiveFails: number,
+  rate: { calls: number; errors: number; rate: number },
+  opts: LoopOptions,
+): string[] {
+  const reasons: string[] = [];
+  if (total >= opts.repeatThreshold) {
+    reasons.push(
+      `"${toolName}" was called with identical arguments ${total} times in the last ${opts.windowSize} tool calls with no change`,
+    );
+  }
+  if (consecutiveFails >= opts.failThreshold) {
+    reasons.push(`"${toolName}" failed ${consecutiveFails} consecutive times`);
+  }
+  if (
+    opts.failRateThreshold > 0 &&
+    rate.calls >= opts.failRateMinCalls &&
+    rate.rate >= opts.failRateThreshold
+  ) {
+    reasons.push(
+      `"${toolName}" failed ${rate.errors} of ${rate.calls} calls in the window (${Math.round(rate.rate * 100)}%)`,
+    );
+  }
+  return reasons;
+}
+
 /**
  * Call `check` in `tool_call` (before executing). If it returns a decision,
  * block the call. Call `record` only for calls that were NOT blocked, and
@@ -141,31 +170,18 @@ export class LoopDetector {
     const sig = signature(toolName, input);
     const repeats = this.recentSigs.filter((s) => s.sig === sig).length;
     const total = repeats + 1; // including this call
-    const consecutiveFails = this.consecutiveFails(toolName);
-    const rate = this.failRate(toolName);
 
     // Rough cost accounting (feature B): every redundant repeat of an already
     // present signature burns tokens with no new information.
     if (repeats >= 1) this.wastedTokens += estimateTokens(stringify(input));
 
-    const reasons: string[] = [];
-    if (total >= this.opts.repeatThreshold) {
-      reasons.push(
-        `"${toolName}" was called with identical arguments ${total} times in the last ${this.opts.windowSize} tool calls with no change`,
-      );
-    }
-    if (consecutiveFails >= this.opts.failThreshold) {
-      reasons.push(`"${toolName}" failed ${consecutiveFails} consecutive times`);
-    }
-    if (
-      this.opts.failRateThreshold > 0 &&
-      rate.calls >= this.opts.failRateMinCalls &&
-      rate.rate >= this.opts.failRateThreshold
-    ) {
-      reasons.push(
-        `"${toolName}" failed ${rate.errors} of ${rate.calls} calls in the window (${Math.round(rate.rate * 100)}%)`,
-      );
-    }
+    const reasons = collectBlockReasons(
+      toolName,
+      total,
+      this.consecutiveFails(toolName),
+      this.failRate(toolName),
+      this.opts,
+    );
 
     if (reasons.length === 0) return Result.err(undefined);
 
@@ -274,6 +290,36 @@ export class LoopDetector {
     return Result.err(undefined);
   }
 
+  /**
+   * Duplicate identical (tool, args) calls batched inside ONE assistant
+   * message (parallel tool-call spam). Degenerate models sometimes emit a
+   * single response containing hundreds of the same no-op call; per-call
+   * detection never sees it as a streak because every call arrives at once.
+   * Fires at textRepeatThreshold duplicates of any one signature. The calls
+   * are already emitted when this runs, so the controller aborts instead of
+   * steering — a steer cannot retract them.
+   */
+  checkDuplicateCalls(
+    entries: { toolName: string; input: ToolInput }[],
+  ): Result<{ reason: string }, undefined> {
+    const counts = new Map<string, { n: number; name: string; input: ToolInput }>();
+    for (const e of entries) {
+      if (this.opts.toolExclude.has(e.toolName)) continue;
+      const sig = signature(e.toolName, e.input);
+      const cur = counts.get(sig) ?? { n: 0, name: e.toolName, input: e.input };
+      cur.n++;
+      counts.set(sig, cur);
+      if (cur.n >= this.opts.textRepeatThreshold) {
+        return Result.ok({
+          reason:
+            `Assistant message contains ${cur.n} identical "${e.toolName}" calls ` +
+            `("${truncate(stringify(e.input), 60)}"). You appear to be in a loop.`,
+        });
+      }
+    }
+    return Result.err(undefined);
+  }
+
   /** Trail of results that are errors of this same tool (consecutive). */
   private consecutiveFails(toolName: string): number {
     let n = 0;
@@ -426,15 +472,20 @@ export function tokenSimilarity(a: string, b: string): number {
  * within a single normalized message, or null.
  *
  * Catches growing doom loops where the model self-concatenates the same
- * sentence ("…X:…X:…X") — the pattern that evaded cross-message verbatim
+ * sentence ("…X…X…X") — the pattern that evaded cross-message verbatim
  * detection in production (each message differs, so no streak forms).
  * Short segments (< MIN_REPEAT_CHUNK) are ignored so pasted logs with
  * repeated one-word lines never false-positive.
+ *
+ * ':' is deliberately NOT a sentence boundary: status lists like
+ * "worker dispatched: a. worker dispatched: b. worker dispatched: c."
+ * must stay whole so distinct sentences never count as repeats.
+ * Separator-less concatenation ("S:S:S:") is caught by tandemPrefix instead.
  */
 export function repeatedSegment(normalized: string, threshold: number): string | null {
   const segments = normalized
-    .split(/(?<=[.:!?])\s*/)
-    .map((s) => s.trim().replace(/[.:!?]+$/, ""))
+    .split(/(?<=[.!?])\s+/)
+    .map((s) => s.trim().replace(/[.!?]+$/, ""))
     .filter((s) => s.length >= MIN_REPEAT_CHUNK);
   const counts = new Map<string, number>();
   for (const seg of segments) {
@@ -442,9 +493,47 @@ export function repeatedSegment(normalized: string, threshold: number): string |
     if (n >= threshold) return seg;
     counts.set(seg, n);
   }
+  return tandemPrefix(normalized, threshold);
+}
+
+/** Messages longer than this are pasted logs, not loop utterances — skip. */
+const TANDEM_MAX_LEN = 2000;
+/** Longest repeated block worth scanning (real loop sentences are < 200 chars). */
+const TANDEM_MAX_CHUNK = 500;
+
+/**
+ * Whole-message consecutive repetition anchored at the start ("S:S:S:",
+ * "S: S: S:", regex fragments "X X X"). Returns the stripped block or null.
+ * Skips long inputs (pasted logs) and pure-separator blocks.
+ */
+export function tandemPrefix(normalized: string, threshold: number): string | null {
+  if (normalized.length < MIN_REPEAT_CHUNK * threshold) return null;
+  if (normalized.length > TANDEM_MAX_LEN) return null;
+  const padded = normalized.endsWith(" ") ? normalized : `${normalized} `;
+  const maxL = Math.min(TANDEM_MAX_CHUNK, Math.floor((padded.length - 1) / (threshold - 1)));
+  for (let len = MIN_REPEAT_CHUNK; len <= maxL; len++) {
+    const first = stripBlock(padded.slice(0, len));
+    if (first.length < MIN_REPEAT_CHUNK) continue;
+    let ok = true;
+    for (let k = 1; k < threshold; k++) {
+      if (stripBlock(padded.slice(k * len, (k + 1) * len)) !== first) {
+        ok = false;
+        break;
+      }
+    }
+    if (ok) return first;
+  }
   return null;
 }
 
+/** Compare blocks ignoring trailing separators so "X:" and "X" unify. */
+function stripBlock(block: string): string {
+  return block
+    .trim()
+    .replace(/[.:!?\s]+$/, "")
+    .trim();
+}
+
 // --- self-check (runs under `node extensions/detector.ts`, skipped when loaded by pi) ---
 if (import.meta.main) {
   const opts: LoopOptions = {
@@ -577,5 +666,25 @@ if (import.meta.main) {
   const two = readOptions({ PI_ANTI_LOOP_REPEATS: "2" });
   assert.equal(two.repeatThreshold, 2, "2 is the minimum accepted");
 
+  // 13. within-one-message duplicate tool-call spam (degenerate parallel batch)
+  d.reset();
+  const spamHit = d.checkDuplicateCalls(
+    Array.from({ length: 3 }, () => ({
+      toolName: "bash",
+      input: { command: "true" } satisfies ToolInput,
+    })),
+  );
+  assert.ok(spamHit.isOk(), "3 identical calls in one message should fire");
+  if (spamHit.isOk()) assert.match(spamHit.value.reason, /identical "bash" calls/);
+  assert.ok(
+    d
+      .checkDuplicateCalls([
+        { toolName: "read", input: { path: "a.ts" } },
+        { toolName: "read", input: { path: "b.ts" } },
+      ])
+      .isErr(),
+    "distinct parallel args are not spam",
+  );
+
   console.log("detector self-check: all assertions passed");
 }

package/extensions/index.ts

@@ -38,9 +38,18 @@ import {
 } from "./controller.ts";
 import { readOptions, type ToolInput } from "./detector.ts";
 
+/** What an event handler hands back to pi: a tool-call block decision, or nothing.
+ * Mirrors pi's own `ExtensionHandler<E, R>` contract (`Promise<R | void> | R | void`)
+ * narrowed to this extension's result; handlers stay synchronous here.
+ */
+export type PiHandlerResult = { block: true; reason: string } | undefined;
+
 /** The subset of pi's ExtensionAPI this extension uses (structural). */
 export interface PiLike {
-  on<E = unknown, C = unknown>(event: string, handler: (event: E, ctx: C) => unknown): void;
+  on<E = unknown, C = unknown>(
+    event: string,
+    handler: (event: E, ctx: C) => PiHandlerResult | void,
+  ): void;
   registerCommand(
     name: string,
     opts: {
@@ -78,8 +87,8 @@ export default function (pi: PiLike): void {
   pi.on("before_agent_start", () => controller.reset());
 
   pi.on("tool_call", (event: ToolCallEventLite, ctx: CtxLite) => {
-    // The pi event delivers untyped tool arguments; decode them into the
-    // ToolInput domain type at this I/O boundary before the controller sees them.
+    // SAFETY: pi delivers JSON-safe tool arguments, which is exactly the ToolInput domain.
+    // Decode them into the ToolInput domain type at this I/O boundary before the controller sees them.
     const outcome = controller.onToolCall(
       event.toolName,
       event.input as ToolInput,
@@ -101,6 +110,7 @@ export default function (pi: PiLike): void {
   // tool calls) never reach tool_call. Steer first, abort as escalation,
   // then a bounded auto-resume so the work continues.
   pi.on("message_end", (event: MessageEndEventLite, ctx: CtxLite) => {
+    // SAFETY: pi delivers message content as JSON-safe blocks matching MessageContent.
     // Decode the untyped message content into MessageContent at this boundary.
     const outcome = controller.onMessageEnd(
       event.message.role,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-anti-doom-loop",
-  "version": "0.0.7",
+  "version": "0.0.9",
   "description": "Detect and break agent doom loops in pi: blocks identical repeated tool calls and blind retries before they burn tokens.",
   "keywords": [
     "anti-doom-loop",
@@ -46,10 +46,10 @@
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "*",
     "@effect/tsgo": "^0.36.4",
-    "@oxlint/plugins": "^1.77.0",
+    "@oxlint/plugins": "1.77.0",
     "@types/node": "^22.0.0",
     "oxfmt": "^0.62.0",
-    "oxlint": "^1.77.0",
+    "oxlint": "1.77.0",
     "oxlint-tsgolint": "^7.0.2001",
     "typescript": "^5.6.0"
   },

package/scripts/guard-publish.ts

@@ -35,14 +35,31 @@ const readManifest: Effect.Effect<string, GuardError> = Effect.tryPromise({
   catch: () => ({ message: "GUARD FAIL: could not read package.json" }),
 });
 
+/** True when an unknown JSON value has the manifest shape this guard needs. */
+const isManifest = (value: unknown): value is Manifest => {
+  if (typeof value !== "object" || value === null) return false;
+  if (!("name" in value) || !("version" in value)) return false;
+  return typeof value.name === "string" && typeof value.version === "string";
+};
+
+/** True when an unknown JSON value carries a string version field. */
+const hasStringVersion = (value: unknown): value is { version: string } => {
+  if (typeof value !== "object" || value === null) return false;
+  if (!("version" in value)) return false;
+  return typeof value.version === "string";
+};
+
 const parseManifest = (raw: string): Effect.Effect<Manifest, GuardError> => {
-  let manifest: Manifest;
+  let parsed: unknown;
   try {
-    manifest = JSON.parse(raw) as Manifest;
+    parsed = JSON.parse(raw);
   } catch {
     return Effect.fail({ message: "GUARD FAIL: package.json is not valid JSON" });
   }
-  return Effect.succeed(manifest);
+  if (!isManifest(parsed)) {
+    return Effect.fail({ message: "GUARD FAIL: package.json has no string name and version" });
+  }
+  return Effect.succeed(parsed);
 };
 const semverLike = (value: string): boolean => /^\d+\.\d+\.\d+$/.test(value);
 
@@ -77,7 +94,8 @@ const fetchPublished = (name: string): Effect.Effect<string | null> =>
         headers: { accept: "application/json" },
       });
       if (!res.ok) return null;
-      return ((await res.json()) as { version?: string }).version ?? null;
+      const body: unknown = await res.json();
+      return hasStringVersion(body) ? body.version : null;
     },
     catch: () => {
       console.warn(