pi-anti-doom-loop 0.0.9 → 0.0.12

package/CHANGELOG.md

@@ -2,6 +2,53 @@
 
 All notable changes to **pi-anti-doom-loop**.
 
+## [0.0.12] — 2026-10-01
+
+### Added
+
+- **E2E tests against a real pi ≥ 0.99** (`tests/e2e/pi.test.ts` + `tests/e2e/pi-rig.ts`) — the rig downloads the real `@earendil-works/pi-coding-agent@0.99.2` (cached), runs pi's RPC entry headlessly with the repo extension loaded, and drives sessions with an in-process OpenAI-compatible fake LLM, fully offline. Verified: the extension blocks a scripted identical-`bash` doom loop in a real session; a **real codemode worker** executing a script that polls a file 5× inside ONE `codemode` call is blocked by the nested 2× rule and the script fails with the `BLOCKED by anti-doom-loop` reason; the recommended distinct `Promise.allSettled` batch completes untouched. Skips cleanly when the npm registry is unreachable. Run with `pnpm run e2e:pi`.
+- **Codemode nested-loop fixtures** — `codemodeNestedLoop` (in-script poll loop), `codemodeErrorRetryLoop` (identical retry after an in-script error), `codemodeCrossScriptRepeat` (second script re-issuing a blocked signature → escalation), and `codemodeHealthyBatch` (the documented `Promise.allSettled` pattern stays unblocked), each driven through the controller exactly as pi delivers nested events, plus a contrast test proving a 2× loop blocks nested while staying under the top-level 3× threshold.
+
+### Changed
+
+- **Tooling migrated to pnpm (latest, 12.8.1)** — `packageManager` pin, `pnpm-lock.yaml` with the default virtual store (`node_modules/.pnpm`), all scripts and docs use `pnpm`, the release workflow installs via `pnpm/action-setup` + `--frozen-lockfile` and publishes with `pnpm publish --no-git-checks`; the tarball e2e asserts via `pnpm pack` and pins the tooling.
+
+### Fixed
+
+- **Fresh installs failed under pnpm 12** — unapproved dependency build scripts made `pnpm install --frozen-lockfile` exit `ERR_PNPM_IGNORED_BUILDS`, which would have aborted the release workflow before the quality gate. The dev-only transitives pi pulls (`esbuild`, `protobufjs`, `@google/genai`) are now explicitly denied in `pnpm-workspace.yaml`; their binaries come from optional platform packages.
+- **`oxlint-tsgolint` pin had no matching artifact** — `package.json` asked for `7.0.2003` while `@effect/tsgo` ships its patched tsgolint for `7.0.2001` only. The devDependency now matches the artifact (the workspace override already pinned it), so `prepare` no longer looks for a missing binary.
+- **Bounded codemode memory** — a script's window now keeps only its most recent 100 calls (args are capped at 100 KB each), so a long-running script cannot pin unbounded memory; in-script loops repeat adjacent calls and still block at 2×.
+- **Real-pi e2e reported green when it never ran** — offline runs returned early from each test, which `node:test` records as passing. They now report `skipped`, so `pnpm test` can no longer claim coverage it did not execute.
+
+### Tests
+
+- 122 → 133: 4 real-pi e2e sessions, 6 codemode fixture tests, pnpm-pack artifact assertions, and the bounded nested-window case.
+
+## [0.0.11] — 2026-10-01
+
+### Added
+
+- **Codemode awareness (pi ≥ 0.99)** — pi's `codemode` tool runs model-written scripts that call other tools via `tools.<name>(args)`; those nested calls carry `parentToolCallId` in the `tool_call`/`tool_result` events and previously bypassed detection entirely (a script can issue hundreds of calls inside ONE top-level tool call). The extension now tracks them: identical calls inside one script block at **2×** (stricter than the top-level 3× — a repeated in-script call is never progress; store the result and reuse it), near-identical args count toward the same rule, and an identical retry of a call that already **errored** in the same script blocks immediately. Nested traffic is windowed **per script** and fully isolated from the top-level window in both directions. A NEW script re-issuing a signature blocked in an earlier script this prompt **escalates** (aborts the turn), mirroring top-level block escalation. `PI_ANTI_LOOP_TOOLS_EXCLUDE` applies to nested calls; nested identity is storage-capped (100 KB per call, most recent 100 calls per script) so huge payloads (whole-file reads) stay cheap; `/loopcheck` reports `nested: calls=N blocks=M`.
+- **The information wall** — a nested block reason reaches the _script_ as a tool error, not the model (pi delivers only the script's return value). If a script swallows block errors, the loop signal was lost. The extension now arms a one-shot **steer** on the next assistant `message_end` after any nested block, telling the model to call each tool once per script and reuse results — so a script that ignores tool errors can no longer silently eat the loop signal.
+
+### Tests
+
+- 99 → 122: nested unit semantics (2× rule, per-script isolation, error-retry, cross-script escalation, payload cap, exclude-list), adapter wiring (`parentToolCallId` forwarding, `NESTED_STEER_TEXT` via `sendMessage`, escalation aborts), and nested fuzz streams (never throw, injected in-script loops always block, random unique-args streams never false-positive).
+
+## [0.0.10] — 2026-09-23
+
+### Fixed
+
+- **Counters reset per user prompt, not per run** — the extension reset on `before_agent_start`, which omp emits on _every_ run start: auto-continue turns (`role:"developer"`), steers/resumes, advisor cards, and queued async-result drains all restart the run, wiping counters (including block-escalation state) between the iterations of exactly the cross-run loops this extension exists to catch. Reported identical `ssh`-polling loops ran 7+ times unblocked while intra-run repeats fired correctly — replaying the incident session on detector-visible input reproduces its 9 exact blocks, with the only discrepancies landing right after post-abort run restarts, where the per-run reset had cleared the window. Reset now keys off `message_end` with `role:"user"` (emitted with the run's input messages on omp and pi alike), matching the documented per-user-prompt contract; steers and auto-continues keep counting, so the steer→abort escalation ladder survives run restarts too.
+
+### Added
+
+- **Near-identical tool-call detection** — when no exact signature repeats, `check()` counts same-tool window entries whose canonical args share ≥ 55% whitespace tokens (token union ≥ 5): sleep-wrapped polls (`gh run list…` → `sleep 150; gh run list…`), flag/grep-pattern/tail drift. Block reason prefix: _"…" was called with near-identical arguments N times…_. Short inputs stay exact-only via the union guard; exact repeats still block first with the exact reason.
+
+### Notes
+
+- omp strips the harness intent label (`i`) at parse (`extractIntent`), before extension events — this detector never sees it; no handling was added. pi has no intent field at all.
+
 ## [0.0.9] — 2026-09-07
 
 ### Added

package/README.md

@@ -51,7 +51,7 @@ Environment variables, read at session/prompt start:
 | `PI_ANTI_LOOP_TIME_WINDOW`   | `0`     | Elapsed-time window in ms (`0` = disabled, count-only): evicts window entries older than this so slow chronic loops over a long session are caught |
 | `PI_ANTI_LOOP_FAIL_RATE`     | `0`     | Fail-rate block threshold `0..1` (`0` = disabled): block when a tool's error share of its in-window calls reaches this                             |
 | `PI_ANTI_LOOP_FAIL_RATE_MIN` | `3`     | Minimum calls before the fail-rate window can block                                                                                                |
-| `PI_ANTI_LOOP_TOOLS_EXCLUDE` | —       | Comma-separated tool names to disable detection for entirely (never block, never enter the window)                                                 |
+| `PI_ANTI_LOOP_TOOLS_EXCLUDE` | —       | Comma-separated tool names to disable detection for entirely (never block, never enter the window — applies to nested codemode calls too)          |
 | `PI_ANTI_LOOP_DISABLE`       | —       | Set to `1` to disable the extension entirely                                                                                                       |
 
 ## Command
@@ -61,6 +61,38 @@ Environment variables, read at session/prompt start:
 - `/loopcheck suspend` — pause detection until the next prompt (escape hatch for intentional repetition)
 - `/loopcheck resume` — re-enable detection early
 
+### Codemode (pi ≥ 0.99): nested script calls
+
+pi's `codemode` tool lets the model run a JavaScript script that calls other
+tools via `tools.<name>(args)` — a script can loop hundreds of calls inside
+ONE top-level tool call, which per-call detection never sees as a streak.
+Since pi 0.99, those nested calls still flow through the `tool_call`/
+`tool_result` events tagged with `parentToolCallId` — and this extension
+tracks them:
+
+- **Stricter in-script threshold** — inside one script, the 2nd identical
+  call blocks (top-level detection needs 3). A repeated call inside a script
+  is never progress: the script can store its first result in a variable and
+  reuse it. Near-identical args (sleep-wrapped polls, flag drift) count too.
+- **Error-retry rule** — an identical retry of a call that already errored
+  inside the same script blocks immediately with a "the identical call
+  already failed inside this script" reason.
+- **Script-level isolation** — nested traffic never enters the top-level
+  window and vice versa, so script loops cannot hide from their own 2× rule
+  and legitimate top-level repetition is never inflated by scripts.
+- **The information wall** — a nested block reason reaches the _script_ as a
+  tool error, not the model (only the script's return value does). When a
+  script swallows it anyway, the next assistant message gets a one-shot steer
+  telling the model to call each tool once and reuse results — so the loop
+  signal can never be silently eaten by a script that ignores tool errors.
+- **Cross-script escalation** — counters are per-script (a new script starts
+  clean), but re-issuing a signature blocked in an earlier script this prompt
+  escalates and aborts the turn, mirroring top-level block-escalation.
+
+Huge nested payloads (whole-file reads) are identity-capped (100 KB per call)
+and each script keeps only its most recent 100 calls, so memory stays bounded. `/loopcheck` reports `nested: calls=N blocks=M`. Disable with
+`PI_ANTI_LOOP_DISABLE=1` as usual.
+
 ## Token-cost awareness
 
 The detector estimates tokens burned on redundant repeats (~4 chars/token) and
@@ -77,29 +109,50 @@ Works with any model — cheap models just trigger it more often.
 
 ## Development
 
-Requires Node 22.18+ (plain `node` runs the TS self-check).
+Requires Node 22.18+ and [pnpm](https://pnpm.io) 12 (pinned via `packageManager`; the install uses pnpm's virtual store at `node_modules/.pnpm`).
 
 ```bash
-npm install
-npm test        # node --test: unit + fixture + fuzz + integration + e2e
-npm run check   # npm test + tsc + oxlint --deny-warnings + oxfmt
+pnpm install
+pnpm test        # node --test: unit + fixture + fuzz + integration + e2e (incl. real-pi e2e)
+pnpm run check   # pnpm test + tsc + oxlint --deny-warnings + oxfmt
+```
+
+### E2E against real pi ≥ 0.99
+
+`tests/e2e/pi.test.ts` downloads the real `@earendil-works/pi-coding-agent@0.99.2`
+once (cached in the OS temp dir), then drives it headlessly: an in-process
+OpenAI-compatible fake LLM scripts the assistant turns, pi's RPC entry runs
+with THIS repo's extension loaded, and the assertions read the real RPC event
+stream. Verified scenarios:
+
+- the extension loads into pi 0.99 and blocks a scripted identical-`bash` doom
+  loop with the instructive block reason
+- a **real codemode worker** executing a script that polls a file 5× inside
+  ONE `codemode` call gets blocked by the nested 2× rule — the script fails
+  with `BLOCKED by anti-doom-loop — inside one codemode script…`
+- the recommended distinct `Promise.allSettled` batch completes untouched
+
+Everything is offline (no API keys); if the npm registry is unreachable the
+real-pi tests skip cleanly instead of failing. Run just them with:
+
+```bash
+pnpm run e2e:pi
 ```
 
 ### Test suite (Node built-in runner, no framework)
 
-| Suite       | File                                          | What it proves                                                                                                    |
-| ----------- | --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
-| unit        | `tests/unit.test.ts`                          | detector semantics: repeat/failure/text signals, window eviction, options clamping, helpers                       |
-| fixture     | `tests/fixtures.ts` + `tests/fixture.test.ts` | real doom-loop transcripts (CI-log loops, verbatim repeats) are caught; healthy sessions are not                  |
-| fuzz        | `tests/fuzz.test.ts`                          | seeded random streams: never throws, no false positives, injected loops always block, canonical stability         |
-| integration | `tests/integration.test.ts`                   | controller + `index.ts` adapter driven through a fake `PiLike`: blocks, escalations, aborts, resets, `/loopcheck` |
-| e2e         | `tests/e2e.test.ts`                           | real subprocesses: detector self-check, version guard, tarball contents (extensions/scripts ship, tests don't)    |
+| Suite       | File                                          | What it proves                                                                                                                                                                      |
+| ----------- | --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| unit        | `tests/unit.test.ts`                          | detector semantics: repeat/failure/text/nested signals, window eviction, options clamping, helpers                                                                                  |
+| fixture     | `tests/fixtures.ts` + `tests/fixture.test.ts` | real doom-loop transcripts (CI-log loops, verbatim repeats, codemode script loops) are caught; healthy sessions are not                                                             |
+| fuzz        | `tests/fuzz.test.ts`                          | seeded random streams: never throws, no false positives, injected loops always block, canonical stability                                                                           |
+| integration | `tests/integration.test.ts`                   | controller + `index.ts` adapter driven through a fake `PiLike`: blocks, escalations, aborts, resets, `/loopcheck`                                                                   |
+| e2e         | `tests/e2e.test.ts` + `tests/e2e/pi.test.ts`  | real subprocesses: detector self-check, version guard, tarball contents (extensions/scripts ship, tests don't), and full sessions against a real pi ≥ 0.99 with a scripted fake LLM |
 
 > `peerDependencies` pins `@earendil-works/pi-coding-agent` at `"*"` on purpose — the
 > [pi packages docs](https://pi.dev/docs/latest/packages) require an unbounded range for
 > pi-core packages (pi provides them at runtime). The extension loads `.ts` directly via
 > jiti, so no build step ships; `prepublishOnly` runs the full quality gate before publish.
-
 > When a call is blocked, escalation still works without recording it in the window:
 > re-issuing the identical call increments a per-signature block counter and aborts the
 > turn on the second block. Thresholds are clamped to a minimum of 2 so a bad config
@@ -117,7 +170,7 @@ git tag v0.0.1
 git push origin v0.0.1
 ```
 
-CI runs the quality gate, then the **version bump guard** (`npm run guard`): it blocks publishing if the version is already on npm or the tag doesn't match `package.json`. After the first publish, the [pi.dev gallery](https://pi.dev/packages) picks the package up automatically via the `pi-package` keyword.
+CI runs the quality gate with pnpm, then the **version bump guard** (`pnpm run guard`): it blocks publishing if the version is already on npm or the tag doesn't match `package.json`. After the first publish, the [pi.dev gallery](https://pi.dev/packages) picks the package up automatically via the `pi-package` keyword.
 
 ## License
 

package/extensions/controller.ts

@@ -20,11 +20,15 @@ export interface ToolCallEventLite {
   toolName: string;
   toolCallId: string;
   input: unknown;
+  /** Set when another tool (for example a codemode script) issued this call (pi ≥ 0.99). */
+  parentToolCallId?: string;
 }
 export interface ToolResultEventLite {
   toolName: string;
   toolCallId: string;
   isError: boolean;
+  /** Set when another tool (for example a codemode script) issued this call (pi ≥ 0.99). */
+  parentToolCallId?: string;
 }
 export interface MessageEndEventLite {
   message: { role: string; content?: unknown };
@@ -54,6 +58,10 @@ export interface ToolCallOutcome {
   reason: string;
   /** True when this exact call was blocked before — caller should abort the turn. */
   escalate: boolean;
+  /** True for calls a codemode script made (`parentToolCallId` set, pi ≥ 0.99).
+   * Their block reason reaches the script as a tool error, not the model —
+   * the adapter must also steer so the model learns about the loop. */
+  nested?: boolean;
 }
 
 export interface TextLoopOutcome {
@@ -61,16 +69,29 @@ export interface TextLoopOutcome {
   action: "steer" | "abort";
   /** When aborting: also queue a single fresh-resume directive (bounded). */
   resume: boolean;
+  /** True when this steer surfaces a codemode script's swallowed nested block. */
+  nested?: boolean;
 }
 
 /** How many auto-resumes per session before we hand control back for real. */
 export const RESUME_BUDGET = 1;
 
 export interface AntiLoopController {
-  /** Returns a block decision for a tool call, or null to let it run. */
-  onToolCall(toolName: string, input: ToolInput, toolCallId: string): ToolCallOutcome | null;
+  /** Returns a block decision for a tool call, or null to let it run.
+   * `parentToolCallId` is set for calls a codemode script made (pi ≥ 0.99). */
+  onToolCall(
+    toolName: string,
+    input: ToolInput,
+    toolCallId: string,
+    parentToolCallId?: string,
+  ): ToolCallOutcome | null;
   /** Record a finished tool result (blocked calls' results are ignored). */
-  onToolResult(toolName: string, toolCallId: string, isError: boolean): void;
+  onToolResult(
+    toolName: string,
+    toolCallId: string,
+    isError: boolean,
+    parentToolCallId?: string,
+  ): void;
   /** Detect assistant-text loops; returns a steer/abort decision or null. */
   onMessageEnd(role: string, content: MessageContent): TextLoopOutcome | null;
   /** Full reset (session start, user prompt, /loopcheck reset). */
@@ -87,14 +108,39 @@ export function createController(opts: LoopOptions = readOptions()): AntiLoopCon
   let detector = new LoopDetector(opts);
   const blockedIds = new Set<string>();
   let steered = false;
+  /** Nested (codemode) blocks seen but not yet surfaced to the model: scripts
+   * receive the block reason as a tool error, but only the script's return
+   * value reaches the model — the next message_end steers once so the loop
+   * signal is never swallowed by a script that ignores tool errors. */
+  let steerAgain = false;
   let resumes = 0;
   let steers = 0;
   let aborts = 0;
   let suspended = false;
 
   return {
-    onToolCall(toolName, input, toolCallId) {
+    onToolCall(toolName, input, toolCallId, parentToolCallId) {
       if (suspended) return null;
+      // Nested codemode calls (pi ≥ 0.99) take the stricter per-script path:
+      // they never enter the top-level window, so a script-level loop cannot
+      // hide from its own 3× top-level threshold.
+      if (parentToolCallId !== undefined) {
+        const nested = detector.checkNested(parentToolCallId, toolName, input);
+        if (nested.isErr()) {
+          detector.recordNested(parentToolCallId, toolName, toolCallId, input);
+          return null;
+        }
+        blockedIds.add(toolCallId);
+        // The block reason becomes the script's tool error, not the model's:
+        // arm the one-shot steer so the model still learns about the loop.
+        steerAgain = true;
+        return {
+          block: true,
+          reason: nested.value.reason,
+          escalate: nested.value.escalate,
+          nested: true,
+        };
+      }
       const decision = detector.check(toolName, input);
       if (decision.isErr()) {
         detector.record(toolName, input);
@@ -105,13 +151,17 @@ export function createController(opts: LoopOptions = readOptions()): AntiLoopCon
       return { block: true, reason: block.reason, escalate: block.escalate };
     },
 
-    onToolResult(toolName, toolCallId, isError) {
+    onToolResult(toolName, toolCallId, isError, parentToolCallId) {
       // Blocked calls never ran, so their (error) result must not count as a
       // consecutive failure.
       if (blockedIds.has(toolCallId)) {
         blockedIds.delete(toolCallId);
         return;
       }
+      if (parentToolCallId !== undefined) {
+        detector.recordNestedResult(parentToolCallId, toolCallId, isError);
+        return;
+      }
       detector.recordResult(toolName, isError);
     },
 
@@ -129,6 +179,20 @@ export function createController(opts: LoopOptions = readOptions()): AntiLoopCon
       const batch = detector.checkDuplicateCalls(calls);
       if (batch.isOk()) return { reason: batch.value.reason, action: "abort", resume: false };
 
+      // A nested codemode block may have been swallowed by the script (only
+      // its return value reaches the model): deliver the loop signal once.
+      if (steerAgain && !steered) {
+        steerAgain = false;
+        steered = true;
+        steers++;
+        return {
+          reason: "a codemode script was blocked for repeating tool calls inside itself",
+          action: "steer",
+          resume: false,
+          nested: true,
+        };
+      }
+
       const text = extractText(content);
       if (!text) return null;
       const hit = detector.checkText(text);
@@ -154,6 +218,7 @@ export function createController(opts: LoopOptions = readOptions()): AntiLoopCon
       blockedIds.clear();
       steered = false;
       suspended = false;
+      steerAgain = false;
       // resumes/steers/aborts are intentionally NOT reset here: they are
       // session-scoped so a stuck model cannot cycle steer→abort forever and
       // /loopcheck can report lifetime counters.

package/extensions/detector.ts

@@ -102,6 +102,12 @@ export function canonical(input: ToolInput): string {
   return JSON.stringify(input) ?? "";
 }
 
+/**
+ * Callers pass detector-visible input: hosts strip harness-internal fields
+ * (omp removes the intent label `i` at parse via `extractIntent`) before the
+ * `tool_call` event, so identity is the executed args exactly as the detector
+ * receives them.
+ */
 export function signature(toolName: string, input: ToolInput): string {
   return `${toolName}:${canonical(input)}`;
 }
@@ -149,7 +155,7 @@ function collectBlockReasons(
  */
 export class LoopDetector {
   readonly opts: LoopOptions;
-  private recentSigs: { sig: string; ts: number }[] = [];
+  private recentSigs: { sig: string; tool: string; args: string; ts: number }[] = [];
   private recentResults: { tool: string; error: boolean; ts: number }[] = [];
   private blockedBySig = new Map<string, number>();
   private recentTexts: { text: string; ts: number }[] = [];
@@ -157,6 +163,17 @@ export class LoopDetector {
   private textStreak = 0;
   private wastedTokens = 0;
 
+  // --- nested codemode calls (pi ≥ 0.99: `parentToolCallId` set) ---
+  /** Per-parent (per-script) call windows, keyed by the parent tool-call id. */
+  private nestedSigs = new Map<string, { sig: string; tool: string; args: string }[]>();
+  /** Nested call ids in flight, for wiring results back to their signature. */
+  private nestedIds = new Map<string, { tool: string; args: string }>();
+  /** Blocks per nested signature, prompt-scoped: a NEW script re-issuing a blocked signature escalates. */
+  private nestedBlockedBySig = new Map<string, number>();
+  /** Signatures whose identical nested call already errored inside that script. */
+  private nestedErrorSigs = new Map<string, Set<string>>();
+  private nestedCallCount = 0;
+
   constructor(opts: LoopOptions = DEFAULT_OPTIONS) {
     this.opts = opts;
   }
@@ -167,7 +184,8 @@ export class LoopDetector {
       return Result.err(undefined);
     }
     this.evictSigs();
-    const sig = signature(toolName, input);
+    const args = canonical(input);
+    const sig = `${toolName}:${args}`;
     const repeats = this.recentSigs.filter((s) => s.sig === sig).length;
     const total = repeats + 1; // including this call
 
@@ -183,6 +201,21 @@ export class LoopDetector {
       this.opts,
     );
 
+    // Exact-signature miss: a loop that varies cosmetic fields (the `i` intent
+    // label, tail flags, timeouts) never repeats a signature. Production data:
+    // 7 of 9 commands repeated ≥3× in a live session had fully distinct args
+    // with an identical `command`. Same tool + ≥55% shared arg tokens still
+    // counts as a repeat.
+    if (reasons.length === 0) {
+      const near = this.nearRepeats(toolName, args);
+      if (near >= 1) this.wastedTokens += estimateTokens(stringify(input));
+      if (near + 1 >= this.opts.repeatThreshold) {
+        reasons.push(
+          `"${toolName}" was called with near-identical arguments ${near + 1} times in the last ${this.opts.windowSize} tool calls (only minor changes)`,
+        );
+      }
+    }
+
     if (reasons.length === 0) return Result.err(undefined);
 
     const blockedCount = (this.blockedBySig.get(sig) ?? 0) + 1;
@@ -200,10 +233,113 @@ export class LoopDetector {
 
   record(toolName: string, input: ToolInput): void {
     if (this.opts.toolExclude.has(toolName)) return;
-    this.recentSigs.push({ sig: signature(toolName, input), ts: Date.now() });
+    const args = canonical(input);
+    this.recentSigs.push({ sig: `${toolName}:${args}`, tool: toolName, args, ts: Date.now() });
     this.evictSigs();
   }
 
+  /**
+   * Canonical args of a nested call, capped: scripts can issue huge payloads
+   * (a whole file read back) hundreds of times; identity only needs the head.
+   */
+  private canonicalNestedArgs(input: ToolInput): string {
+    const raw = canonical(input);
+    return raw.length > NESTED_ARG_STORAGE_LIMIT ? raw.slice(0, NESTED_ARG_STORAGE_LIMIT) : raw;
+  }
+
+  /**
+   * Stricter detection for calls a codemode script made (`parentToolCallId` set).
+   * Inside one script a repeated call is never progress — the script can store
+   * and reuse its first result — so identical args block at
+   * `NESTED_REPEAT_THRESHOLD` (2), and an identical retry of a call that
+   * already errored in this script blocks immediately. The block reason
+   * becomes the script's tool error; `escalate` is true when this signature
+   * was already blocked in an earlier script this prompt.
+   */
+  checkNested(parentToolCallId: string, toolName: string, input: ToolInput): NestedDecision {
+    if (this.opts.toolExclude.has(toolName)) return Result.err(undefined);
+    const args = this.canonicalNestedArgs(input);
+    const sig = `${toolName}:${args}`;
+    const pool = this.nestedSigs.get(parentToolCallId) ?? [];
+    const repeats = pool.filter((s) => s.sig === sig).length;
+    const reasons = collectNestedBlockReasons(
+      toolName,
+      repeats,
+      this.nestedErrorSigs.get(parentToolCallId)?.has(sig) === true,
+      () => this.nearRepeats(toolName, args, pool),
+    );
+    if (reasons.length === 0) return Result.err(undefined);
+
+    const blockedCount = (this.nestedBlockedBySig.get(sig) ?? 0) + 1;
+    this.nestedBlockedBySig.set(sig, blockedCount);
+    return Result.ok({
+      reason:
+        reasons.join("; ") +
+        `. BLOCKED by anti-doom-loop — inside a script, store the first result in a variable and reuse it instead of calling again.`,
+      escalate: blockedCount > 1,
+    });
+  }
+
+  /** Record an allowed nested call into its parent script's window. */
+  recordNested(
+    parentToolCallId: string,
+    toolName: string,
+    toolCallId: string,
+    input: ToolInput,
+  ): void {
+    if (this.opts.toolExclude.has(toolName)) return;
+    const args = this.canonicalNestedArgs(input);
+    let pool = this.nestedSigs.get(parentToolCallId);
+    if (!pool) {
+      pool = [];
+      this.nestedSigs.set(parentToolCallId, pool);
+    }
+    pool.push({ sig: `${toolName}:${args}`, tool: toolName, args });
+    if (pool.length > NESTED_POOL_LIMIT) pool.splice(0, pool.length - NESTED_POOL_LIMIT);
+    this.nestedIds.set(toolCallId, { tool: toolName, args });
+    this.nestedCallCount++;
+  }
+
+  /** Wire a nested result back: an errored signature blocks its identical retry. */
+  recordNestedResult(parentToolCallId: string, toolCallId: string, isError: boolean): void {
+    const entry = this.nestedIds.get(toolCallId);
+    this.nestedIds.delete(toolCallId);
+    if (!isError || !entry) return;
+    let errs = this.nestedErrorSigs.get(parentToolCallId);
+    if (!errs) {
+      errs = new Set();
+      this.nestedErrorSigs.set(parentToolCallId, errs);
+    }
+    errs.add(`${entry.tool}:${entry.args}`);
+    if (errs.size > NESTED_POOL_LIMIT) {
+      const oldest = errs.values().next();
+      if (!oldest.done) errs.delete(oldest.value);
+    }
+  }
+
+  /** Nested codemode counters for /loopcheck (allowed calls recorded, blocks issued). */
+  nestedStats(): NestedStats {
+    return {
+      calls: this.nestedCallCount,
+      blocks: [...this.nestedBlockedBySig.values()].reduce((a, b) => a + b, 0),
+    };
+  }
+
+  /** Windowed same-tool entries whose args are ≥55% shared tokens (identical counts). */
+  private nearRepeats(
+    toolName: string,
+    args: string,
+    pool: readonly { tool: string; args: string }[] = this.recentSigs,
+  ): number {
+    let n = 0;
+    for (const s of pool) {
+      if (s.tool !== toolName) continue;
+      const sim = argSimilarity(args, s.args);
+      if (sim !== null && sim >= NEAR_ARGS_SIMILARITY_THRESHOLD) n++;
+    }
+    return n;
+  }
+
   recordResult(toolName: string, error: boolean): void {
     this.recentResults.push({ tool: toolName, error, ts: Date.now() });
     this.evictResults();
@@ -390,10 +526,12 @@ export class LoopDetector {
       .map(([s, n]) => `"${truncate(s, 24)}" x${n}`)
       .join(", ");
 
+    const nested = this.nestedStats();
     return (
       `calls[${this.recentSigs.length}] ${topSigs || "none"}; ` +
       `texts[${this.recentTexts.length}] ${topTexts || "none"}; ` +
-      `wastedTokens=${this.wastedTokens}`
+      `wastedTokens=${this.wastedTokens}; ` +
+      `nested: calls=${nested.calls} blocks=${nested.blocks}`
     );
   }
 
@@ -405,6 +543,11 @@ export class LoopDetector {
     this.lastText = null;
     this.textStreak = 0;
     this.wastedTokens = 0;
+    this.nestedSigs.clear();
+    this.nestedIds.clear();
+    this.nestedBlockedBySig.clear();
+    this.nestedErrorSigs.clear();
+    this.nestedCallCount = 0;
   }
 
   summary(): string {
@@ -430,6 +573,95 @@ export const MIN_REPEAT_CHUNK = 16;
 /** Jaccard similarity threshold for "near-identical" consecutive texts. */
 export const TEXT_SIMILARITY_THRESHOLD = 0.55;
 
+/** Shared-whitespace-token threshold for near-identical tool-call arguments. */
+export const NEAR_ARGS_SIMILARITY_THRESHOLD = 0.55;
+
+/**
+ * Minimum token union before two arg strings are comparable. Short inputs
+ * ({"i":"…","op":"view"}) would score 1.0 on one shared token; they rely on
+ * exact matching only. Long inputs — shell commands — always clear this.
+ */
+export const NEAR_ARGS_MIN_UNION = 5;
+
+/** Decision for a nested (codemode) tool call — same shape as BlockDecision. */
+export type NestedDecision = Result<BlockDecision, undefined>;
+
+/**
+ * Block reasons for one nested codemode call: identical repeats (2× rule),
+ * an identical retry of a call that already errored in this script, and —
+ * only when neither fired — near-identical args at the same 2× threshold.
+ * `nearRepeats` is lazy so random traffic never pays the tokenization cost.
+ */
+function collectNestedBlockReasons(
+  toolName: string,
+  repeats: number,
+  erroredBefore: boolean,
+  nearRepeats: () => number,
+): string[] {
+  const reasons: string[] = [];
+  if (repeats + 1 >= NESTED_REPEAT_THRESHOLD) {
+    reasons.push(
+      `"${toolName}" was called with identical arguments ${repeats + 1} times inside one codemode script`,
+    );
+  }
+  if (erroredBefore) {
+    reasons.push(`the identical "${toolName}" call already failed inside this script`);
+  }
+  if (reasons.length === 0 && repeats === 0 && nearRepeats() + 1 >= NESTED_REPEAT_THRESHOLD) {
+    reasons.push(
+      `"${toolName}" was called with near-identical arguments ${nearRepeats() + 1} times inside one codemode script (only minor changes)`,
+    );
+  }
+  return reasons;
+}
+
+/** Counters for nested codemode traffic, reported by /loopcheck. */
+export interface NestedStats {
+  calls: number;
+  blocks: number;
+}
+
+/**
+ * Nested codemode calls (pi ≥ 0.99, `parentToolCallId` set) block at a stricter
+ * threshold than top-level calls: inside one script a repeated call is never
+ * progress — the script can reuse its first result — so 2 occurrences block
+ * where top-level detection needs 3.
+ */
+export const NESTED_REPEAT_THRESHOLD = 2;
+
+/** Max chars of one nested call's canonical args kept for identity/similarity. */
+export const NESTED_ARG_STORAGE_LIMIT = 100_000;
+
+/**
+ * Max recent calls a codemode script's window keeps. Entries hold up to
+ * `NESTED_ARG_STORAGE_LIMIT` chars each, so an unbounded per-script window
+ * would let one script pin hundreds of MB; in-script loops repeat adjacent
+ * calls, which a recent window still catches.
+ */
+export const NESTED_POOL_LIMIT = 100;
+// ponytail: 0.55 misses ONE shape — short (~11-token) commands that change
+// BOTH ends at once (added wrapper + changed tail glue → ~0.53); single-axis
+// drift and longer commands clear. Upgrade path if that shape shows up:
+// tokenize on punctuation boundaries instead of whitespace.
+
+/**
+ * Case-insensitive whitespace-token Jaccard over canonical args.
+ * Full tokens (no word filtering): a changed field glues into its own token,
+ * so only genuinely shared structure counts — same command with a rephrased
+ * `i` label scores ~0.8, two different commands score far below the threshold.
+ * Returns null when the union is too small to judge.
+ */
+export function argSimilarity(a: string, b: string): number | null {
+  const as = new Set(a.toLowerCase().split(/\s+/).filter(Boolean));
+  const bs = new Set(b.toLowerCase().split(/\s+/).filter(Boolean));
+  if (as.size === 0 || bs.size === 0) return null;
+  let inter = 0;
+  for (const t of as) if (bs.has(t)) inter++;
+  const union = as.size + bs.size - inter;
+  if (union < NEAR_ARGS_MIN_UNION) return null;
+  return inter / union;
+}
+
 /** Stable string form of a tool input (used for token estimation). */
 export function stringify(input: ToolInput): string {
   return JSON.stringify(input) ?? "";
@@ -686,5 +918,70 @@ if (import.meta.main) {
     "distinct parallel args are not spam",
   );
 
+  // 14. command-tail/wrapper drift: same poll wrapped or slightly reworded —
+  //     near-identical token overlap catches what exact identity cannot.
+  d.reset();
+  const ghTail = (command: string) => ({ command, cwd: "/w/flash", timeout: 30 });
+  assert.ok(d.check("bash", ghTail("gh run list --branch main --limit 3 2>&1 | head -6")).isErr());
+  d.record("bash", ghTail("gh run list --branch main --limit 3 2>&1 | head -6"));
+  assert.ok(
+    d
+      .check("bash", ghTail("sleep 150; gh run list --branch main --limit 3 2>&1 | head -6"))
+      .isErr(),
+  );
+  d.record("bash", ghTail("sleep 150; gh run list --branch main --limit 3 2>&1 | head -6"));
+  const nearHit = d.check(
+    "bash",
+    ghTail("timeout 30; gh run list --branch main --limit 3 2>&1 | head -6"),
+  );
+  assert.ok(nearHit.isOk(), "3rd command-tail variant should block");
+  if (nearHit.isOk()) {
+    assert.match(nearHit.value.reason, /near-identical arguments 3 times/);
+    assert.equal(nearHit.value.escalate, false, "first near block does not escalate");
+  }
+  // genuinely different command with the same tool stays unblocked
+  assert.ok(d.check("bash", { command: "cargo test -p pools 2>&1 | tail -5" }).isErr());
+
+  // 15. nested codemode calls: stricter 2× threshold, error-retry block, no
+  //     leakage into the top-level window
+  d.reset();
+  assert.ok(d.checkNested("p1", "read", { path: "a.ts" }).isErr(), "1st nested call passes");
+  d.recordNested("p1", "read", "p1/1", { path: "a.ts" });
+  const nHit = d.checkNested("p1", "read", { path: "a.ts" });
+  assert.ok(nHit.isOk(), "2nd identical nested call blocks");
+  if (nHit.isOk()) {
+    assert.equal(nHit.value.escalate, false, "first in-script block does not escalate");
+    assert.match(nHit.value.reason, /identical arguments 2 times inside one codemode script/);
+  }
+  assert.ok(d.checkNested("p2", "read", { path: "a.ts" }).isErr(), "a new script starts clean");
+  // identical-after-error blocks even at the first occurrence in a parent
+  d.recordNested("p2", "bash", "p2/1", { command: "npm test" });
+  d.recordNestedResult("p2", "p2/1", true);
+  const errHit = d.checkNested("p2", "bash", { command: "npm test" });
+  assert.ok(errHit.isOk(), "identical retry after a nested error blocks");
+  if (errHit.isOk()) assert.match(errHit.value.reason, /already failed inside this script/);
+  // a NEW script re-issuing a signature blocked before escalates
+  const crossScript = d.checkNested("p3", "bash", { command: "npm test" });
+  assert.ok(crossScript.isErr(), "fresh script with a fresh call passes");
+  d.recordNested("p3", "bash", "p3/1", { command: "npm test" });
+  const crossBlock = d.checkNested("p3", "bash", { command: "npm test" });
+  assert.ok(crossBlock.isOk() && crossBlock.value.escalate, "cross-script repeat escalates");
+  // nested traffic never enters the top-level window
+  d.reset();
+  d.recordNested("p", "bash", "p/1", { command: "poll" });
+  d.recordNested("p", "bash", "p/2", { command: "poll" });
+  assert.ok(
+    d.check("bash", { command: "poll" }).isErr(),
+    "top-level window empty of nested traffic",
+  );
+  // huge nested payloads stay capped and never throw
+  assert.doesNotThrow(() => {
+    const huge = "x".repeat(300_000);
+    for (let i = 0; i < 50; i++) {
+      d.checkNested("p", "read", { path: `f${i}.ts`, content: huge });
+      d.recordNested("p", "read", `p/h${i}`, { path: `f${i}.ts`, content: huge });
+    }
+  });
+
   console.log("detector self-check: all assertions passed");
 }

package/extensions/index.ts

@@ -7,6 +7,9 @@
  *
  *  - identical (tool, args) repeated `PI_ANTI_LOOP_REPEATS` times (default 3)
  *    in the last `PI_ANTI_LOOP_WINDOW` calls → block with an instructive reason
+ *  - near-identical same-tool args (≥ 55% shared whitespace tokens, union ≥ 5)
+ *    count toward the same threshold — sleep-wrapped polls, flag/pattern/tail
+ *    drift that exact identity misses by construction
  *  - the same tool failing `PI_ANTI_LOOP_FAILS` consecutive times (default 3)
  *    → block with a "stop retrying, fix the root cause" reason
  *  - the model repeating text: verbatim, near-identical (token similarity),
@@ -19,8 +22,12 @@
  * instructive reason (that is the steer); re-issuing the exact same blocked
  * call aborts the turn.
  *
- * Counters reset on every user prompt, so a task legitimately repeated later
- * in the session is never a false positive. Disable with PI_ANTI_LOOP_DISABLE=1.
+ * Counters reset on every user prompt (`message_end` with `role:"user"`), so
+ * a task legitimately repeated later in the session is never a false positive.
+ * Run restarts (auto-continue, steers/resumes, async-result drains) do NOT
+ * reset — hosts emit `before_agent_start` on every run start, and resetting
+ * there wiped counters between the iterations of cross-run loops. Disable with
+ * PI_ANTI_LOOP_DISABLE=1.
  *
  * All logic lives in `controller.ts` (pure, pi-free, unit-tested); this file
  * is a thin adapter wiring it to pi's event loop. The pi API is consumed
@@ -69,6 +76,13 @@ const STEER_TEXT =
   "Stop. Re-read the actual error output, pick ONE different action, and execute it. " +
   "If you are stuck, ask the user instead of retrying.";
 
+/** Steer delivered after a codemode script swallowed a nested block: the script
+ * got the block reason as a tool error, but only its return reaches the model. */
+const NESTED_STEER_TEXT =
+  "Anti-doom-loop steering: a codemode script repeated identical tool calls inside itself. " +
+  "Inside a script, call each tool once, store the result in a variable, and reuse it — " +
+  "never poll or retry the same call in a loop. If the calls keep failing, stop and ask the user.";
+
 /** Queued once after an abort so the work can continue with a fresh approach. */
 const RESUME_TEXT =
   "Anti-doom-loop: the previous run was aborted because it looped. " +
@@ -82,10 +96,6 @@ export default function (pi: PiLike): void {
 
   pi.on("session_start", () => reset());
 
-  // Fresh counters per user prompt: only the loop happening *right now* counts.
-  // Internal reset keeps session-scoped steers/aborts/resume budget.
-  pi.on("before_agent_start", () => controller.reset());
-
   pi.on("tool_call", (event: ToolCallEventLite, ctx: CtxLite) => {
     // SAFETY: pi delivers JSON-safe tool arguments, which is exactly the ToolInput domain.
     // Decode them into the ToolInput domain type at this I/O boundary before the controller sees them.
@@ -93,6 +103,7 @@ export default function (pi: PiLike): void {
       event.toolName,
       event.input as ToolInput,
       event.toolCallId,
+      event.parentToolCallId,
     );
     if (outcome === null) return;
     if (outcome.escalate) {
@@ -103,13 +114,30 @@ export default function (pi: PiLike): void {
   });
 
   pi.on("tool_result", (event: ToolResultEventLite) => {
-    controller.onToolResult(event.toolName, event.toolCallId, event.isError === true);
+    controller.onToolResult(
+      event.toolName,
+      event.toolCallId,
+      event.isError === true,
+      event.parentToolCallId,
+    );
   });
 
   // Text-only doom loops (model re-emits/rephrases the same thing with no
   // tool calls) never reach tool_call. Steer first, abort as escalation,
-  // then a bounded auto-resume so the work continues.
+  // then a bounded auto-resume so work continues.
   pi.on("message_end", (event: MessageEndEventLite, ctx: CtxLite) => {
+    // Fresh counters per genuine user prompt: only the loop happening *right
+    // now* counts (session-scoped steers/aborts/resume budget survive).
+    // Deliberately NOT on `before_agent_start`: hosts emit that on every run
+    // start — auto-continue turns, steers/resumes, advisor cards, and queued
+    // async-result drains — which wiped counters between the iterations of
+    // cross-run doom loops, so they never reached the repeat threshold.
+    // `role:"user"` input messages are emitted with the run's input messages
+    // (agent-core `emitInputMessages`) on omp and pi alike.
+    if (event.message.role === "user") {
+      controller.reset();
+      return;
+    }
     // SAFETY: pi delivers message content as JSON-safe blocks matching MessageContent.
     // Decode the untyped message content into MessageContent at this boundary.
     const outcome = controller.onMessageEnd(
@@ -119,9 +147,10 @@ export default function (pi: PiLike): void {
     if (outcome === null) return;
 
     if (outcome.action === "steer") {
+      const text = outcome.nested ? NESTED_STEER_TEXT : STEER_TEXT;
       ctx.ui.notify(`Anti-doom-loop: ${outcome.reason}`, "warning");
       pi.sendMessage?.(
-        { customType: "anti-doom-loop", content: STEER_TEXT, display: true },
+        { customType: "anti-doom-loop", content: text, display: true },
         { deliverAs: "steer", triggerTurn: true },
       );
       return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-anti-doom-loop",
-  "version": "0.0.9",
+  "version": "0.0.12",
   "description": "Detect and break agent doom loops in pi: blocks identical repeated tool calls and blind retries before they burn tokens.",
   "keywords": [
     "anti-doom-loop",
@@ -29,28 +29,18 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "check": "npm run test && tsc --noEmit && oxlint --deny-warnings && oxfmt --check .",
-    "prepublishOnly": "npm run check",
-    "test": "node --test tests/*.test.ts",
-    "guard": "node scripts/guard-publish.ts",
-    "lint": "oxlint --deny-warnings",
-    "format": "oxfmt .",
-    "format:check": "oxfmt --check .",
-    "prepare": "effect-tsgo patch --no-typescript --oxlint"
-  },
   "dependencies": {
+    "@effect/tsgo": "0.36.4",
     "better-result": "^3.0.0",
     "effect": "^4.0.0-rc.108"
   },
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "*",
-    "@effect/tsgo": "^0.36.4",
     "@oxlint/plugins": "1.77.0",
     "@types/node": "^22.0.0",
-    "oxfmt": "^0.62.0",
+    "oxfmt": "0.62.0",
     "oxlint": "1.77.0",
-    "oxlint-tsgolint": "^7.0.2001",
+    "oxlint-tsgolint": "7.0.2001",
     "typescript": "^5.6.0"
   },
   "peerDependencies": {
@@ -63,5 +53,14 @@
     "extensions": [
       "./extensions"
     ]
+  },
+  "scripts": {
+    "check": "pnpm run test && tsc --noEmit && oxlint --deny-warnings && oxfmt --check .",
+    "test": "node --test tests/*.test.ts tests/e2e/*.test.ts",
+    "guard": "node scripts/guard-publish.ts",
+    "e2e:pi": "node --test tests/e2e/pi.test.ts",
+    "lint": "oxlint --deny-warnings",
+    "format": "oxfmt .",
+    "format:check": "oxfmt --check ."
   }
-}
+}