pi-anti-doom-loop 0.0.9 → 0.0.10

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to **pi-anti-doom-loop**.
 
+## [0.0.10] — 2026-09-23
+
+### Fixed
+
+- **Counters reset per user prompt, not per run** — the extension reset on `before_agent_start`, which omp emits on _every_ run start: auto-continue turns (`role:"developer"`), steers/resumes, advisor cards, and queued async-result drains all restart the run, wiping counters (including block-escalation state) between the iterations of exactly the cross-run loops this extension exists to catch. Reported identical `ssh`-polling loops ran 7+ times unblocked while intra-run repeats fired correctly — replaying the incident session on detector-visible input reproduces its 9 exact blocks, with the only discrepancies landing right after post-abort run restarts, where the per-run reset had cleared the window. Reset now keys off `message_end` with `role:"user"` (emitted with the run's input messages on omp and pi alike), matching the documented per-user-prompt contract; steers and auto-continues keep counting, so the steer→abort escalation ladder survives run restarts too.
+
+### Added
+
+- **Near-identical tool-call detection** — when no exact signature repeats, `check()` counts same-tool window entries whose canonical args share ≥ 55% whitespace tokens (token union ≥ 5): sleep-wrapped polls (`gh run list…` → `sleep 150; gh run list…`), flag/grep-pattern/tail drift. Block reason prefix: _"…" was called with near-identical arguments N times…_. Short inputs stay exact-only via the union guard; exact repeats still block first with the exact reason.
+
+### Notes
+
+- omp strips the harness intent label (`i`) at parse (`extractIntent`), before extension events — this detector never sees it; no handling was added. pi has no intent field at all.
+
 ## [0.0.9] — 2026-09-07
 
 ### Added

package/extensions/detector.ts

@@ -102,6 +102,12 @@ export function canonical(input: ToolInput): string {
   return JSON.stringify(input) ?? "";
 }
 
+/**
+ * Callers pass detector-visible input: hosts strip harness-internal fields
+ * (omp removes the intent label `i` at parse via `extractIntent`) before the
+ * `tool_call` event, so identity is the executed args exactly as the detector
+ * receives them.
+ */
 export function signature(toolName: string, input: ToolInput): string {
   return `${toolName}:${canonical(input)}`;
 }
@@ -149,7 +155,7 @@ function collectBlockReasons(
  */
 export class LoopDetector {
   readonly opts: LoopOptions;
-  private recentSigs: { sig: string; ts: number }[] = [];
+  private recentSigs: { sig: string; tool: string; args: string; ts: number }[] = [];
   private recentResults: { tool: string; error: boolean; ts: number }[] = [];
   private blockedBySig = new Map<string, number>();
   private recentTexts: { text: string; ts: number }[] = [];
@@ -167,7 +173,8 @@ export class LoopDetector {
       return Result.err(undefined);
     }
     this.evictSigs();
-    const sig = signature(toolName, input);
+    const args = canonical(input);
+    const sig = `${toolName}:${args}`;
     const repeats = this.recentSigs.filter((s) => s.sig === sig).length;
     const total = repeats + 1; // including this call
 
@@ -183,6 +190,21 @@ export class LoopDetector {
       this.opts,
     );
 
+    // Exact-signature miss: a loop that varies cosmetic fields (the `i` intent
+    // label, tail flags, timeouts) never repeats a signature. Production data:
+    // 7 of 9 commands repeated ≥3× in a live session had fully distinct args
+    // with an identical `command`. Same tool + ≥55% shared arg tokens still
+    // counts as a repeat.
+    if (reasons.length === 0) {
+      const near = this.nearRepeats(toolName, args);
+      if (near >= 1) this.wastedTokens += estimateTokens(stringify(input));
+      if (near + 1 >= this.opts.repeatThreshold) {
+        reasons.push(
+          `"${toolName}" was called with near-identical arguments ${near + 1} times in the last ${this.opts.windowSize} tool calls (only minor changes)`,
+        );
+      }
+    }
+
     if (reasons.length === 0) return Result.err(undefined);
 
     const blockedCount = (this.blockedBySig.get(sig) ?? 0) + 1;
@@ -200,10 +222,22 @@ export class LoopDetector {
 
   record(toolName: string, input: ToolInput): void {
     if (this.opts.toolExclude.has(toolName)) return;
-    this.recentSigs.push({ sig: signature(toolName, input), ts: Date.now() });
+    const args = canonical(input);
+    this.recentSigs.push({ sig: `${toolName}:${args}`, tool: toolName, args, ts: Date.now() });
     this.evictSigs();
   }
 
+  /** Windowed same-tool entries whose args are ≥55% shared tokens (identical counts). */
+  private nearRepeats(toolName: string, args: string): number {
+    let n = 0;
+    for (const s of this.recentSigs) {
+      if (s.tool !== toolName) continue;
+      const sim = argSimilarity(args, s.args);
+      if (sim !== null && sim >= NEAR_ARGS_SIMILARITY_THRESHOLD) n++;
+    }
+    return n;
+  }
+
   recordResult(toolName: string, error: boolean): void {
     this.recentResults.push({ tool: toolName, error, ts: Date.now() });
     this.evictResults();
@@ -430,6 +464,38 @@ export const MIN_REPEAT_CHUNK = 16;
 /** Jaccard similarity threshold for "near-identical" consecutive texts. */
 export const TEXT_SIMILARITY_THRESHOLD = 0.55;
 
+/** Shared-whitespace-token threshold for near-identical tool-call arguments. */
+export const NEAR_ARGS_SIMILARITY_THRESHOLD = 0.55;
+
+/**
+ * Minimum token union before two arg strings are comparable. Short inputs
+ * ({"i":"…","op":"view"}) would score 1.0 on one shared token; they rely on
+ * exact matching only. Long inputs — shell commands — always clear this.
+ */
+export const NEAR_ARGS_MIN_UNION = 5;
+// ponytail: 0.55 misses ONE shape — short (~11-token) commands that change
+// BOTH ends at once (added wrapper + changed tail glue → ~0.53); single-axis
+// drift and longer commands clear. Upgrade path if that shape shows up:
+// tokenize on punctuation boundaries instead of whitespace.
+
+/**
+ * Case-insensitive whitespace-token Jaccard over canonical args.
+ * Full tokens (no word filtering): a changed field glues into its own token,
+ * so only genuinely shared structure counts — same command with a rephrased
+ * `i` label scores ~0.8, two different commands score far below the threshold.
+ * Returns null when the union is too small to judge.
+ */
+export function argSimilarity(a: string, b: string): number | null {
+  const as = new Set(a.toLowerCase().split(/\s+/).filter(Boolean));
+  const bs = new Set(b.toLowerCase().split(/\s+/).filter(Boolean));
+  if (as.size === 0 || bs.size === 0) return null;
+  let inter = 0;
+  for (const t of as) if (bs.has(t)) inter++;
+  const union = as.size + bs.size - inter;
+  if (union < NEAR_ARGS_MIN_UNION) return null;
+  return inter / union;
+}
+
 /** Stable string form of a tool input (used for token estimation). */
 export function stringify(input: ToolInput): string {
   return JSON.stringify(input) ?? "";
@@ -686,5 +752,29 @@ if (import.meta.main) {
     "distinct parallel args are not spam",
   );
 
+  // 14. command-tail/wrapper drift: same poll wrapped or slightly reworded —
+  //     near-identical token overlap catches what exact identity cannot.
+  d.reset();
+  const ghTail = (command: string) => ({ command, cwd: "/w/flash", timeout: 30 });
+  assert.ok(d.check("bash", ghTail("gh run list --branch main --limit 3 2>&1 | head -6")).isErr());
+  d.record("bash", ghTail("gh run list --branch main --limit 3 2>&1 | head -6"));
+  assert.ok(
+    d
+      .check("bash", ghTail("sleep 150; gh run list --branch main --limit 3 2>&1 | head -6"))
+      .isErr(),
+  );
+  d.record("bash", ghTail("sleep 150; gh run list --branch main --limit 3 2>&1 | head -6"));
+  const nearHit = d.check(
+    "bash",
+    ghTail("timeout 30; gh run list --branch main --limit 3 2>&1 | head -6"),
+  );
+  assert.ok(nearHit.isOk(), "3rd command-tail variant should block");
+  if (nearHit.isOk()) {
+    assert.match(nearHit.value.reason, /near-identical arguments 3 times/);
+    assert.equal(nearHit.value.escalate, false, "first near block does not escalate");
+  }
+  // genuinely different command with the same tool stays unblocked
+  assert.ok(d.check("bash", { command: "cargo test -p pools 2>&1 | tail -5" }).isErr());
+
   console.log("detector self-check: all assertions passed");
 }

package/extensions/index.ts

@@ -7,6 +7,9 @@
  *
  *  - identical (tool, args) repeated `PI_ANTI_LOOP_REPEATS` times (default 3)
  *    in the last `PI_ANTI_LOOP_WINDOW` calls → block with an instructive reason
+ *  - near-identical same-tool args (≥ 55% shared whitespace tokens, union ≥ 5)
+ *    count toward the same threshold — sleep-wrapped polls, flag/pattern/tail
+ *    drift that exact identity misses by construction
  *  - the same tool failing `PI_ANTI_LOOP_FAILS` consecutive times (default 3)
  *    → block with a "stop retrying, fix the root cause" reason
  *  - the model repeating text: verbatim, near-identical (token similarity),
@@ -19,8 +22,12 @@
  * instructive reason (that is the steer); re-issuing the exact same blocked
  * call aborts the turn.
  *
- * Counters reset on every user prompt, so a task legitimately repeated later
- * in the session is never a false positive. Disable with PI_ANTI_LOOP_DISABLE=1.
+ * Counters reset on every user prompt (`message_end` with `role:"user"`), so
+ * a task legitimately repeated later in the session is never a false positive.
+ * Run restarts (auto-continue, steers/resumes, async-result drains) do NOT
+ * reset — hosts emit `before_agent_start` on every run start, and resetting
+ * there wiped counters between the iterations of cross-run loops. Disable with
+ * PI_ANTI_LOOP_DISABLE=1.
  *
  * All logic lives in `controller.ts` (pure, pi-free, unit-tested); this file
  * is a thin adapter wiring it to pi's event loop. The pi API is consumed
@@ -82,10 +89,6 @@ export default function (pi: PiLike): void {
 
   pi.on("session_start", () => reset());
 
-  // Fresh counters per user prompt: only the loop happening *right now* counts.
-  // Internal reset keeps session-scoped steers/aborts/resume budget.
-  pi.on("before_agent_start", () => controller.reset());
-
   pi.on("tool_call", (event: ToolCallEventLite, ctx: CtxLite) => {
     // SAFETY: pi delivers JSON-safe tool arguments, which is exactly the ToolInput domain.
     // Decode them into the ToolInput domain type at this I/O boundary before the controller sees them.
@@ -108,8 +111,20 @@ export default function (pi: PiLike): void {
 
   // Text-only doom loops (model re-emits/rephrases the same thing with no
   // tool calls) never reach tool_call. Steer first, abort as escalation,
-  // then a bounded auto-resume so the work continues.
+  // then a bounded auto-resume so work continues.
   pi.on("message_end", (event: MessageEndEventLite, ctx: CtxLite) => {
+    // Fresh counters per genuine user prompt: only the loop happening *right
+    // now* counts (session-scoped steers/aborts/resume budget survive).
+    // Deliberately NOT on `before_agent_start`: hosts emit that on every run
+    // start — auto-continue turns, steers/resumes, advisor cards, and queued
+    // async-result drains — which wiped counters between the iterations of
+    // cross-run doom loops, so they never reached the repeat threshold.
+    // `role:"user"` input messages are emitted with the run's input messages
+    // (agent-core `emitInputMessages`) on omp and pi alike.
+    if (event.message.role === "user") {
+      controller.reset();
+      return;
+    }
     // SAFETY: pi delivers message content as JSON-safe blocks matching MessageContent.
     // Decode the untyped message content into MessageContent at this boundary.
     const outcome = controller.onMessageEnd(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-anti-doom-loop",
-  "version": "0.0.9",
+  "version": "0.0.10",
   "description": "Detect and break agent doom loops in pi: blocks identical repeated tool calls and blind retries before they burn tokens.",
   "keywords": [
     "anti-doom-loop",
@@ -37,19 +37,19 @@
     "lint": "oxlint --deny-warnings",
     "format": "oxfmt .",
     "format:check": "oxfmt --check .",
-    "prepare": "effect-tsgo patch --no-typescript --oxlint"
+    "prepare": "effect-tsgo patch --no-typescript --oxlint --skip-missing"
   },
   "dependencies": {
+    "@effect/tsgo": "^0.36.4",
     "better-result": "^3.0.0",
-    "effect": "^4.0.0-rc.108"
+    "effect": "^4.0.0-rc.108",
+    "oxlint": "1.77.0"
   },
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "*",
-    "@effect/tsgo": "^0.36.4",
     "@oxlint/plugins": "1.77.0",
     "@types/node": "^22.0.0",
     "oxfmt": "^0.62.0",
-    "oxlint": "1.77.0",
     "oxlint-tsgolint": "^7.0.2001",
     "typescript": "^5.6.0"
   },