pi-anti-doom-loop 0.0.8 → 0.0.10

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 All notable changes to **pi-anti-doom-loop**.
 
+## [0.0.10] — 2026-09-23
+
+### Fixed
+
+- **Counters reset per user prompt, not per run** — the extension reset on `before_agent_start`, which omp emits on _every_ run start: auto-continue turns (`role:"developer"`), steers/resumes, advisor cards, and queued async-result drains all restart the run, wiping counters (including block-escalation state) between the iterations of exactly the cross-run loops this extension exists to catch. Reported identical `ssh`-polling loops ran 7+ times unblocked while intra-run repeats fired correctly — replaying the incident session on detector-visible input reproduces its 9 exact blocks, with the only discrepancies landing right after post-abort run restarts, where the per-run reset had cleared the window. Reset now keys off `message_end` with `role:"user"` (emitted with the run's input messages on omp and pi alike), matching the documented per-user-prompt contract; steers and auto-continues keep counting, so the steer→abort escalation ladder survives run restarts too.
+
+### Added
+
+- **Near-identical tool-call detection** — when no exact signature repeats, `check()` counts same-tool window entries whose canonical args share ≥ 55% whitespace tokens (token union ≥ 5): sleep-wrapped polls (`gh run list…` → `sleep 150; gh run list…`), flag/grep-pattern/tail drift. Block reason prefix: _"…" was called with near-identical arguments N times…_. Short inputs stay exact-only via the union guard; exact repeats still block first with the exact reason.
+
+### Notes
+
+- omp strips the harness intent label (`i`) at parse (`extractIntent`), before extension events — this detector never sees it; no handling was added. pi has no intent field at all.
+
+## [0.0.9] — 2026-09-07
+
+### Added
+
+- **Full anti-slop rule set** — synced the vendored Oxlint plugin with upstream: 5 missing generic rules (`no-module-mocking`, `no-reflect-apply`, `no-reflect-get`, `no-unknown-returns`, `require-safety-comment-for-type-assertion`), the opt-in Effect plugin (`no-service-constructor-imports`, enabled — this repo declares `effect`), and the supporting shared helpers. All 15 generic rules plus the Effect rule run at `error`.
+- **Complexity gate** — `eslint/complexity` with `{ max: 10 }`; anything in the 11+ "refactor now" band fails the build.
+
+### Fixed
+
+- **Within-message false positive on status lists** — `repeatedSegment` no longer splits on `:` (status updates like "worker dispatched: a. worker dispatched: b. worker dispatched: c." stay whole and distinct). Separator-less concatenation (`S:S:S:`) and truncated repeats are still caught by the new `tandemPrefix` check.
+- **Complexity + slop findings in owned code** — extracted `collectBlockReasons` (`check` CC 11 → 6); replaced `as` casts at I/O boundaries with `SAFETY:` invariants, real `isManifest` / `hasStringVersion` guards, a named `PiHandlerResult` contract, and assertion-free tests.
+
 ## [0.0.8] — 2026-08-24
 
 ### Added

package/extensions/controller.ts

@@ -122,6 +122,7 @@ export function createController(opts: LoopOptions = readOptions()): AntiLoopCon
       // Within-message duplicate tool-call spam fires first: it aborts (the
       // calls are already emitted, steering cannot retract them), so it must
       // outrank the steer-able text ladder.
+      // SAFETY: tool-call arguments arrive as JSON-safe values matching ToolInput.
       const calls = content
         .filter((c) => c.type === "toolCall")
         .map((c) => ({ toolName: c.name ?? "", input: c.arguments as ToolInput }));

package/extensions/detector.ts

@@ -102,6 +102,12 @@ export function canonical(input: ToolInput): string {
   return JSON.stringify(input) ?? "";
 }
 
+/**
+ * Callers pass detector-visible input: hosts strip harness-internal fields
+ * (omp removes the intent label `i` at parse via `extractIntent`) before the
+ * `tool_call` event, so identity is the executed args exactly as the detector
+ * receives them.
+ */
 export function signature(toolName: string, input: ToolInput): string {
   return `${toolName}:${canonical(input)}`;
 }
@@ -113,6 +119,35 @@ export interface BlockDecision {
   escalate: boolean;
 }
 
+/** Block reasons for one tool call: identical repeats, failure streak, failure rate. */
+function collectBlockReasons(
+  toolName: string,
+  total: number,
+  consecutiveFails: number,
+  rate: { calls: number; errors: number; rate: number },
+  opts: LoopOptions,
+): string[] {
+  const reasons: string[] = [];
+  if (total >= opts.repeatThreshold) {
+    reasons.push(
+      `"${toolName}" was called with identical arguments ${total} times in the last ${opts.windowSize} tool calls with no change`,
+    );
+  }
+  if (consecutiveFails >= opts.failThreshold) {
+    reasons.push(`"${toolName}" failed ${consecutiveFails} consecutive times`);
+  }
+  if (
+    opts.failRateThreshold > 0 &&
+    rate.calls >= opts.failRateMinCalls &&
+    rate.rate >= opts.failRateThreshold
+  ) {
+    reasons.push(
+      `"${toolName}" failed ${rate.errors} of ${rate.calls} calls in the window (${Math.round(rate.rate * 100)}%)`,
+    );
+  }
+  return reasons;
+}
+
 /**
  * Call `check` in `tool_call` (before executing). If it returns a decision,
  * block the call. Call `record` only for calls that were NOT blocked, and
@@ -120,7 +155,7 @@ export interface BlockDecision {
  */
 export class LoopDetector {
   readonly opts: LoopOptions;
-  private recentSigs: { sig: string; ts: number }[] = [];
+  private recentSigs: { sig: string; tool: string; args: string; ts: number }[] = [];
   private recentResults: { tool: string; error: boolean; ts: number }[] = [];
   private blockedBySig = new Map<string, number>();
   private recentTexts: { text: string; ts: number }[] = [];
@@ -138,33 +173,36 @@ export class LoopDetector {
       return Result.err(undefined);
     }
     this.evictSigs();
-    const sig = signature(toolName, input);
+    const args = canonical(input);
+    const sig = `${toolName}:${args}`;
     const repeats = this.recentSigs.filter((s) => s.sig === sig).length;
     const total = repeats + 1; // including this call
-    const consecutiveFails = this.consecutiveFails(toolName);
-    const rate = this.failRate(toolName);
 
     // Rough cost accounting (feature B): every redundant repeat of an already
     // present signature burns tokens with no new information.
     if (repeats >= 1) this.wastedTokens += estimateTokens(stringify(input));
 
-    const reasons: string[] = [];
-    if (total >= this.opts.repeatThreshold) {
-      reasons.push(
-        `"${toolName}" was called with identical arguments ${total} times in the last ${this.opts.windowSize} tool calls with no change`,
-      );
-    }
-    if (consecutiveFails >= this.opts.failThreshold) {
-      reasons.push(`"${toolName}" failed ${consecutiveFails} consecutive times`);
-    }
-    if (
-      this.opts.failRateThreshold > 0 &&
-      rate.calls >= this.opts.failRateMinCalls &&
-      rate.rate >= this.opts.failRateThreshold
-    ) {
-      reasons.push(
-        `"${toolName}" failed ${rate.errors} of ${rate.calls} calls in the window (${Math.round(rate.rate * 100)}%)`,
-      );
+    const reasons = collectBlockReasons(
+      toolName,
+      total,
+      this.consecutiveFails(toolName),
+      this.failRate(toolName),
+      this.opts,
+    );
+
+    // Exact-signature miss: a loop that varies cosmetic fields (the `i` intent
+    // label, tail flags, timeouts) never repeats a signature. Production data:
+    // 7 of 9 commands repeated ≥3× in a live session had fully distinct args
+    // with an identical `command`. Same tool + ≥55% shared arg tokens still
+    // counts as a repeat.
+    if (reasons.length === 0) {
+      const near = this.nearRepeats(toolName, args);
+      if (near >= 1) this.wastedTokens += estimateTokens(stringify(input));
+      if (near + 1 >= this.opts.repeatThreshold) {
+        reasons.push(
+          `"${toolName}" was called with near-identical arguments ${near + 1} times in the last ${this.opts.windowSize} tool calls (only minor changes)`,
+        );
+      }
     }
 
     if (reasons.length === 0) return Result.err(undefined);
@@ -184,10 +222,22 @@ export class LoopDetector {
 
   record(toolName: string, input: ToolInput): void {
     if (this.opts.toolExclude.has(toolName)) return;
-    this.recentSigs.push({ sig: signature(toolName, input), ts: Date.now() });
+    const args = canonical(input);
+    this.recentSigs.push({ sig: `${toolName}:${args}`, tool: toolName, args, ts: Date.now() });
     this.evictSigs();
   }
 
+  /** Windowed same-tool entries whose args are ≥55% shared tokens (identical counts). */
+  private nearRepeats(toolName: string, args: string): number {
+    let n = 0;
+    for (const s of this.recentSigs) {
+      if (s.tool !== toolName) continue;
+      const sim = argSimilarity(args, s.args);
+      if (sim !== null && sim >= NEAR_ARGS_SIMILARITY_THRESHOLD) n++;
+    }
+    return n;
+  }
+
   recordResult(toolName: string, error: boolean): void {
     this.recentResults.push({ tool: toolName, error, ts: Date.now() });
     this.evictResults();
@@ -414,6 +464,38 @@ export const MIN_REPEAT_CHUNK = 16;
 /** Jaccard similarity threshold for "near-identical" consecutive texts. */
 export const TEXT_SIMILARITY_THRESHOLD = 0.55;
 
+/** Shared-whitespace-token threshold for near-identical tool-call arguments. */
+export const NEAR_ARGS_SIMILARITY_THRESHOLD = 0.55;
+
+/**
+ * Minimum token union before two arg strings are comparable. Short inputs
+ * ({"i":"…","op":"view"}) would score 1.0 on one shared token; they rely on
+ * exact matching only. Long inputs — shell commands — always clear this.
+ */
+export const NEAR_ARGS_MIN_UNION = 5;
+// ponytail: 0.55 misses ONE shape — short (~11-token) commands that change
+// BOTH ends at once (added wrapper + changed tail glue → ~0.53); single-axis
+// drift and longer commands clear. Upgrade path if that shape shows up:
+// tokenize on punctuation boundaries instead of whitespace.
+
+/**
+ * Case-insensitive whitespace-token Jaccard over canonical args.
+ * Full tokens (no word filtering): a changed field glues into its own token,
+ * so only genuinely shared structure counts — same command with a rephrased
+ * `i` label scores ~0.8, two different commands score far below the threshold.
+ * Returns null when the union is too small to judge.
+ */
+export function argSimilarity(a: string, b: string): number | null {
+  const as = new Set(a.toLowerCase().split(/\s+/).filter(Boolean));
+  const bs = new Set(b.toLowerCase().split(/\s+/).filter(Boolean));
+  if (as.size === 0 || bs.size === 0) return null;
+  let inter = 0;
+  for (const t of as) if (bs.has(t)) inter++;
+  const union = as.size + bs.size - inter;
+  if (union < NEAR_ARGS_MIN_UNION) return null;
+  return inter / union;
+}
+
 /** Stable string form of a tool input (used for token estimation). */
 export function stringify(input: ToolInput): string {
   return JSON.stringify(input) ?? "";
@@ -456,15 +538,20 @@ export function tokenSimilarity(a: string, b: string): number {
  * within a single normalized message, or null.
  *
  * Catches growing doom loops where the model self-concatenates the same
- * sentence ("…X:…X:…X") — the pattern that evaded cross-message verbatim
+ * sentence ("…X…X…X") — the pattern that evaded cross-message verbatim
  * detection in production (each message differs, so no streak forms).
  * Short segments (< MIN_REPEAT_CHUNK) are ignored so pasted logs with
  * repeated one-word lines never false-positive.
+ *
+ * ':' is deliberately NOT a sentence boundary: status lists like
+ * "worker dispatched: a. worker dispatched: b. worker dispatched: c."
+ * must stay whole so distinct sentences never count as repeats.
+ * Separator-less concatenation ("S:S:S:") is caught by tandemPrefix instead.
  */
 export function repeatedSegment(normalized: string, threshold: number): string | null {
   const segments = normalized
-    .split(/(?<=[.:!?])\s*/)
-    .map((s) => s.trim().replace(/[.:!?]+$/, ""))
+    .split(/(?<=[.!?])\s+/)
+    .map((s) => s.trim().replace(/[.!?]+$/, ""))
     .filter((s) => s.length >= MIN_REPEAT_CHUNK);
   const counts = new Map<string, number>();
   for (const seg of segments) {
@@ -472,9 +559,47 @@ export function repeatedSegment(normalized: string, threshold: number): string |
     if (n >= threshold) return seg;
     counts.set(seg, n);
   }
+  return tandemPrefix(normalized, threshold);
+}
+
+/** Messages longer than this are pasted logs, not loop utterances — skip. */
+const TANDEM_MAX_LEN = 2000;
+/** Longest repeated block worth scanning (real loop sentences are < 200 chars). */
+const TANDEM_MAX_CHUNK = 500;
+
+/**
+ * Whole-message consecutive repetition anchored at the start ("S:S:S:",
+ * "S: S: S:", regex fragments "X X X"). Returns the stripped block or null.
+ * Skips long inputs (pasted logs) and pure-separator blocks.
+ */
+export function tandemPrefix(normalized: string, threshold: number): string | null {
+  if (normalized.length < MIN_REPEAT_CHUNK * threshold) return null;
+  if (normalized.length > TANDEM_MAX_LEN) return null;
+  const padded = normalized.endsWith(" ") ? normalized : `${normalized} `;
+  const maxL = Math.min(TANDEM_MAX_CHUNK, Math.floor((padded.length - 1) / (threshold - 1)));
+  for (let len = MIN_REPEAT_CHUNK; len <= maxL; len++) {
+    const first = stripBlock(padded.slice(0, len));
+    if (first.length < MIN_REPEAT_CHUNK) continue;
+    let ok = true;
+    for (let k = 1; k < threshold; k++) {
+      if (stripBlock(padded.slice(k * len, (k + 1) * len)) !== first) {
+        ok = false;
+        break;
+      }
+    }
+    if (ok) return first;
+  }
   return null;
 }
 
+/** Compare blocks ignoring trailing separators so "X:" and "X" unify. */
+function stripBlock(block: string): string {
+  return block
+    .trim()
+    .replace(/[.:!?\s]+$/, "")
+    .trim();
+}
+
 // --- self-check (runs under `node extensions/detector.ts`, skipped when loaded by pi) ---
 if (import.meta.main) {
   const opts: LoopOptions = {
@@ -612,7 +737,7 @@ if (import.meta.main) {
   const spamHit = d.checkDuplicateCalls(
     Array.from({ length: 3 }, () => ({
       toolName: "bash",
-      input: { command: "true" } as ToolInput,
+      input: { command: "true" } satisfies ToolInput,
     })),
   );
   assert.ok(spamHit.isOk(), "3 identical calls in one message should fire");
@@ -627,5 +752,29 @@ if (import.meta.main) {
     "distinct parallel args are not spam",
   );
 
+  // 14. command-tail/wrapper drift: same poll wrapped or slightly reworded —
+  //     near-identical token overlap catches what exact identity cannot.
+  d.reset();
+  const ghTail = (command: string) => ({ command, cwd: "/w/flash", timeout: 30 });
+  assert.ok(d.check("bash", ghTail("gh run list --branch main --limit 3 2>&1 | head -6")).isErr());
+  d.record("bash", ghTail("gh run list --branch main --limit 3 2>&1 | head -6"));
+  assert.ok(
+    d
+      .check("bash", ghTail("sleep 150; gh run list --branch main --limit 3 2>&1 | head -6"))
+      .isErr(),
+  );
+  d.record("bash", ghTail("sleep 150; gh run list --branch main --limit 3 2>&1 | head -6"));
+  const nearHit = d.check(
+    "bash",
+    ghTail("timeout 30; gh run list --branch main --limit 3 2>&1 | head -6"),
+  );
+  assert.ok(nearHit.isOk(), "3rd command-tail variant should block");
+  if (nearHit.isOk()) {
+    assert.match(nearHit.value.reason, /near-identical arguments 3 times/);
+    assert.equal(nearHit.value.escalate, false, "first near block does not escalate");
+  }
+  // genuinely different command with the same tool stays unblocked
+  assert.ok(d.check("bash", { command: "cargo test -p pools 2>&1 | tail -5" }).isErr());
+
   console.log("detector self-check: all assertions passed");
 }

package/extensions/index.ts

@@ -7,6 +7,9 @@
  *
  *  - identical (tool, args) repeated `PI_ANTI_LOOP_REPEATS` times (default 3)
  *    in the last `PI_ANTI_LOOP_WINDOW` calls → block with an instructive reason
+ *  - near-identical same-tool args (≥ 55% shared whitespace tokens, union ≥ 5)
+ *    count toward the same threshold — sleep-wrapped polls, flag/pattern/tail
+ *    drift that exact identity misses by construction
  *  - the same tool failing `PI_ANTI_LOOP_FAILS` consecutive times (default 3)
  *    → block with a "stop retrying, fix the root cause" reason
  *  - the model repeating text: verbatim, near-identical (token similarity),
@@ -19,8 +22,12 @@
  * instructive reason (that is the steer); re-issuing the exact same blocked
  * call aborts the turn.
  *
- * Counters reset on every user prompt, so a task legitimately repeated later
- * in the session is never a false positive. Disable with PI_ANTI_LOOP_DISABLE=1.
+ * Counters reset on every user prompt (`message_end` with `role:"user"`), so
+ * a task legitimately repeated later in the session is never a false positive.
+ * Run restarts (auto-continue, steers/resumes, async-result drains) do NOT
+ * reset — hosts emit `before_agent_start` on every run start, and resetting
+ * there wiped counters between the iterations of cross-run loops. Disable with
+ * PI_ANTI_LOOP_DISABLE=1.
  *
  * All logic lives in `controller.ts` (pure, pi-free, unit-tested); this file
  * is a thin adapter wiring it to pi's event loop. The pi API is consumed
@@ -38,9 +45,18 @@ import {
 } from "./controller.ts";
 import { readOptions, type ToolInput } from "./detector.ts";
 
+/** What an event handler hands back to pi: a tool-call block decision, or nothing.
+ * Mirrors pi's own `ExtensionHandler<E, R>` contract (`Promise<R | void> | R | void`)
+ * narrowed to this extension's result; handlers stay synchronous here.
+ */
+export type PiHandlerResult = { block: true; reason: string } | undefined;
+
 /** The subset of pi's ExtensionAPI this extension uses (structural). */
 export interface PiLike {
-  on<E = unknown, C = unknown>(event: string, handler: (event: E, ctx: C) => unknown): void;
+  on<E = unknown, C = unknown>(
+    event: string,
+    handler: (event: E, ctx: C) => PiHandlerResult | void,
+  ): void;
   registerCommand(
     name: string,
     opts: {
@@ -73,13 +89,9 @@ export default function (pi: PiLike): void {
 
   pi.on("session_start", () => reset());
 
-  // Fresh counters per user prompt: only the loop happening *right now* counts.
-  // Internal reset keeps session-scoped steers/aborts/resume budget.
-  pi.on("before_agent_start", () => controller.reset());
-
   pi.on("tool_call", (event: ToolCallEventLite, ctx: CtxLite) => {
-    // The pi event delivers untyped tool arguments; decode them into the
-    // ToolInput domain type at this I/O boundary before the controller sees them.
+    // SAFETY: pi delivers JSON-safe tool arguments, which is exactly the ToolInput domain.
+    // Decode them into the ToolInput domain type at this I/O boundary before the controller sees them.
     const outcome = controller.onToolCall(
       event.toolName,
       event.input as ToolInput,
@@ -99,8 +111,21 @@ export default function (pi: PiLike): void {
 
   // Text-only doom loops (model re-emits/rephrases the same thing with no
   // tool calls) never reach tool_call. Steer first, abort as escalation,
-  // then a bounded auto-resume so the work continues.
+  // then a bounded auto-resume so work continues.
   pi.on("message_end", (event: MessageEndEventLite, ctx: CtxLite) => {
+    // Fresh counters per genuine user prompt: only the loop happening *right
+    // now* counts (session-scoped steers/aborts/resume budget survive).
+    // Deliberately NOT on `before_agent_start`: hosts emit that on every run
+    // start — auto-continue turns, steers/resumes, advisor cards, and queued
+    // async-result drains — which wiped counters between the iterations of
+    // cross-run doom loops, so they never reached the repeat threshold.
+    // `role:"user"` input messages are emitted with the run's input messages
+    // (agent-core `emitInputMessages`) on omp and pi alike.
+    if (event.message.role === "user") {
+      controller.reset();
+      return;
+    }
+    // SAFETY: pi delivers message content as JSON-safe blocks matching MessageContent.
     // Decode the untyped message content into MessageContent at this boundary.
     const outcome = controller.onMessageEnd(
       event.message.role,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-anti-doom-loop",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "description": "Detect and break agent doom loops in pi: blocks identical repeated tool calls and blind retries before they burn tokens.",
   "keywords": [
     "anti-doom-loop",
@@ -37,19 +37,19 @@
     "lint": "oxlint --deny-warnings",
     "format": "oxfmt .",
     "format:check": "oxfmt --check .",
-    "prepare": "effect-tsgo patch --no-typescript --oxlint"
+    "prepare": "effect-tsgo patch --no-typescript --oxlint --skip-missing"
   },
   "dependencies": {
+    "@effect/tsgo": "^0.36.4",
     "better-result": "^3.0.0",
-    "effect": "^4.0.0-rc.108"
+    "effect": "^4.0.0-rc.108",
+    "oxlint": "1.77.0"
   },
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "*",
-    "@effect/tsgo": "^0.36.4",
-    "@oxlint/plugins": "^1.77.0",
+    "@oxlint/plugins": "1.77.0",
     "@types/node": "^22.0.0",
     "oxfmt": "^0.62.0",
-    "oxlint": "^1.77.0",
     "oxlint-tsgolint": "^7.0.2001",
     "typescript": "^5.6.0"
   },

package/scripts/guard-publish.ts

@@ -35,14 +35,31 @@ const readManifest: Effect.Effect<string, GuardError> = Effect.tryPromise({
   catch: () => ({ message: "GUARD FAIL: could not read package.json" }),
 });
 
+/** True when an unknown JSON value has the manifest shape this guard needs. */
+const isManifest = (value: unknown): value is Manifest => {
+  if (typeof value !== "object" || value === null) return false;
+  if (!("name" in value) || !("version" in value)) return false;
+  return typeof value.name === "string" && typeof value.version === "string";
+};
+
+/** True when an unknown JSON value carries a string version field. */
+const hasStringVersion = (value: unknown): value is { version: string } => {
+  if (typeof value !== "object" || value === null) return false;
+  if (!("version" in value)) return false;
+  return typeof value.version === "string";
+};
+
 const parseManifest = (raw: string): Effect.Effect<Manifest, GuardError> => {
-  let manifest: Manifest;
+  let parsed: unknown;
   try {
-    manifest = JSON.parse(raw) as Manifest;
+    parsed = JSON.parse(raw);
   } catch {
     return Effect.fail({ message: "GUARD FAIL: package.json is not valid JSON" });
   }
-  return Effect.succeed(manifest);
+  if (!isManifest(parsed)) {
+    return Effect.fail({ message: "GUARD FAIL: package.json has no string name and version" });
+  }
+  return Effect.succeed(parsed);
 };
 const semverLike = (value: string): boolean => /^\d+\.\d+\.\d+$/.test(value);
 
@@ -77,7 +94,8 @@ const fetchPublished = (name: string): Effect.Effect<string | null> =>
         headers: { accept: "application/json" },
       });
       if (!res.ok) return null;
-      return ((await res.json()) as { version?: string }).version ?? null;
+      const body: unknown = await res.json();
+      return hasStringVersion(body) ? body.version : null;
     },
     catch: () => {
       console.warn(