pi-antiloop 1.4.1 → 1.5.0

package/README.md

@@ -61,7 +61,7 @@ pi remove npm:pi-antiloop
 /antiloop config     # adjust thresholds to taste
 ```
 
-That's it. Antiloop is on by default. If the model ever starts repeating itself, you'll see a `⚠️ antiloop(N)` warning; if it keeps looping past the force-break threshold, antiloop injects an "abort this pattern now" instruction into the context.
+That's it. Antiloop is on by default. If the model ever starts repeating itself, you'll see a `⚠️` warning; if it keeps looping past the force-break threshold, antiloop steers a break message into the *running* agent before its next tool call — and if the model ignores it and keeps repeating verbatim, antiloop aborts the run. Loops always terminate.
 
 ## Commands
 
@@ -353,7 +353,8 @@ Modular extension with zero external dependencies (only pi's bundled `@earendil-
 - **Sliding window** — only the last `detectionWindow` messages participate, capping memory at O(W × message_size)
 - **Early bail** — short messages and empty tool calls skip similarity computation entirely
 - **TUI integration** — uses `ctx.ui.select` for the config menu and the log viewer; `ctx.ui.notify` for state notifications; `ctx.ui.setStatus` + a custom `ctx.ui.setFooter` component for the persistent footer indicator, live level info, and the `esc+a` keyboard toggle (`ctx.ui.onTerminalInput`, never consumes input)
-- **Hooks** — `message_end` (track messages + tool call ids), `turn_end` (attach result fingerprints + detect), `input` (decay), `before_agent_start` (inject intervention — force/abort only), `context` (modify context in force-break mode), `session_start` (load config + install footer + reset), `session_shutdown` (restore built-in footer)
+- **Hooks** — `message_end` (track messages + tool call ids), `turn_end` (attach result fingerprints, detect, and intervene: steer the force break / abort the run), `input` (decay on real user messages only), `session_start` (load config + install footer + reset), `session_shutdown` (restore built-in footer)
+- **Intervention runs on the turn loop, not on user prompts** — escalation is decided at `turn_end`, the break is steered into the running agent before its next LLM call, and the guaranteed hard stop aborts the run (`ctx.abort`, fire-and-forget — never awaited, so the hook can't deadlock). No custom-role messages are injected into the conversation at any level (steering a real user message + aborting are the only levers; custom-role injections were removed because a model can stall on an unexpected injected message)
 
 ## License
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-antiloop",
-  "version": "1.4.1",
-  "description": "Antiloop: detect reasoning loops and force a break (warn \u2192 force \u2192 abort) across text, tool, thinking, and structural patterns. Tool-loop detection is result-aware: only near-identical repeated calls with the same outcome count, so sequential bash operations and retries that make progress don't false-positive. Task-stream recognition: when an extension (punched, plan, \u2026) makes the model call the SAME tool many times with DIFFERENT content \u2014 N distinct tasks of one type, e.g. appending lines or adding plan tasks \u2014 antiloop stays silent.",
+  "version": "1.5.0",
+  "description": "Antiloop: detect reasoning loops and force a break (warn \u2192 force \u2192 abort) across text, tool, thinking, and structural patterns. The force break is delivered mid-run: a real break message is steered into the running agent right before its next LLM call, and if the model ignores it and keeps repeating verbatim, antiloop aborts the run \u2014 an autonomous tool loop always terminates. Tool-loop detection is result-aware: only near-identical repeated calls with the same outcome count, so sequential bash operations and retries that make progress don't false-positive. Task-stream recognition: when an extension (punched, plan, \u2026) makes the model call the SAME tool many times with DIFFERENT content \u2014 N distinct tasks of one type, e.g. appending lines or adding plan tasks \u2014 antiloop stays silent.",
   "keywords": [
     "pi-package",
     "antiloop",

package/src/commands.ts

@@ -32,7 +32,6 @@ export async function handleCommand(
 			return showLog(ctx, rt);
 		case "reset":
 			resetState(rt.state);
-			rt.pendingIntervention = null;
 			ctx.ui.notify("antiloop: reset", "info");
 			rt.updateStatus(ctx);
 			return;
@@ -52,10 +51,10 @@ async function showStatus(ctx: ExtensionCommandContext, rt: Runtime): Promise<vo
 	const recent = rt.state.detections.slice(-5);
 	const lines = [
 		`state: ${rt.config.enabled ? "ON" : "OFF"} · level: ${lvl} · consecutive: ${rt.state.consecutiveDetections}`,
-		`total: ${rt.state.totalDetections} · tracked: ${rt.state.recentMessages.length} · forced: ${rt.state.inForcedBreak ? "yes" : "no"}`,
+		`total: ${rt.state.totalDetections} · tracked: ${rt.state.recentMessages.length} · forced: ${rt.state.inForcedBreak ? "yes" : "no"} · steer: ${rt.state.steerDelivered ? `sent (${rt.state.ignoredSteerCount} ignored)` : "armed"}`,
 		"",
 		"thresholds:",
-		`  warn: ${rt.config.warningThreshold}  force: ${rt.config.forceBreakThreshold}  abort: ${rt.config.abortThreshold || "off"}`,
+		`  warn: ${rt.config.warningThreshold}  force: ${rt.config.forceBreakThreshold}  abort: ${rt.config.abortThreshold || "off"}  stop-after-ignored-break: ${rt.config.ignoredSteerLimit}`,
 		`  similarity: ${(rt.config.similarityThreshold * 100).toFixed(0)}%  window: ${rt.config.detectionWindow}`,
 		`  tool sim: ${(rt.config.toolSimilarityThreshold * 100).toFixed(0)}%  tool repeat: ${rt.config.minToolRepeatCount}+ prior`,
 		`  result sim: ${(rt.config.resultSimilarityThreshold * 100).toFixed(0)}%  (same cmd + diff outcome = no loop)`,
@@ -87,6 +86,7 @@ async function showConfigMenu(ctx: ExtensionCommandContext, rt: Runtime): Promis
 		{ value: "warn" as const, label: `⚠️ warn after: ${c.warningThreshold}`, description: "repetitions before antiloop warns you" },
 		{ value: "force" as const, label: `🛑 force break after: ${c.forceBreakThreshold}`, description: "repetitions before forcing a change of approach" },
 		{ value: "abort" as const, label: `🚨 abort after: ${c.abortThreshold || "off"}`, description: "repetitions before aborting (0 = disabled)" },
+		{ value: "ignoredBreak" as const, label: `🛑 stop after ignored break: ${c.ignoredSteerLimit}`, description: "identical repeats allowed after the force break before antiloop stops the run" },
 		{ value: "sim" as const, label: `📏 text similarity: ${(c.similarityThreshold * 100).toFixed(0)}%`, description: "how similar two messages must be to count as a loop" },
 		{ value: "toolSim" as const, label: `🔧 call similarity: ${(c.toolSimilarityThreshold * 100).toFixed(0)}%`, description: "how identical tool calls must be to count as the same call" },
 		{ value: "toolRepeat" as const, label: `🔁 call repeats: ${c.minToolRepeatCount}+`, description: "how many times the same call must repeat before it flags" },
@@ -230,6 +230,15 @@ async function showConfigMenu(ctx: ExtensionCommandContext, rt: Runtime): Promis
 			if (v !== undefined) { c.taskStreamTwinThreshold = v; saveConfig(c); ctx.ui.notify(`twin threshold: ${(v * 100).toFixed(0)}%`, "info"); }
 			break;
 		}
+		case "ignoredBreak": {
+			const v = await selectFrom(ctx, "🛑 stop after ignored break (identical repeats after the force break)", [
+				{ value: 1, label: "⚡ 1 (sensitive — one identical repeat after the break stops the run)" },
+				{ value: 2, label: "🎯 2 (default)" },
+				{ value: 3, label: "🐢 3 (lenient)" },
+			]);
+			if (v !== undefined) { c.ignoredSteerLimit = v; saveConfig(c); ctx.ui.notify(`stop after ignored break: ${v}`, "info"); }
+			break;
+		}
 		case "text":
 			c.detectTextLoops = !c.detectTextLoops; saveConfig(c);
 			ctx.ui.notify(`text: ${yn(c.detectTextLoops)}`, "info"); break;
@@ -241,7 +250,6 @@ async function showConfigMenu(ctx: ExtensionCommandContext, rt: Runtime): Promis
 			ctx.ui.notify(`thinking: ${yn(c.detectThinkingLoops)}`, "info"); break;
 		case "reset":
 			resetState(rt.state);
-			rt.pendingIntervention = null;
 			ctx.ui.notify("🧹 state reset", "info");
 			rt.updateStatus(ctx);
 			break;
@@ -270,6 +278,8 @@ export function resetState(state: AntiloopState): void {
 	state.inForcedBreak = false;
 	state.totalDetections = 0;
 	state.lastDetectedTurnIndex = -1;
+	state.steerDelivered = false;
+	state.ignoredSteerCount = 0;
 }
 
 async function runSelfTest(ctx: ExtensionCommandContext): Promise<void> {

package/src/config.ts

@@ -12,6 +12,7 @@ export const DEFAULT_CONFIG: AntiloopConfig = {
 	warningThreshold: 2,
 	forceBreakThreshold: 3,
 	abortThreshold: 0,
+	ignoredSteerLimit: 2,
 	similarityThreshold: 0.75,
 	toolSimilarityThreshold: 0.95,
 	minToolRepeatCount: 2,

package/src/detect.ts

@@ -287,15 +287,23 @@ export function detectLoops(state: AntiloopState, config: AntiloopConfig): LoopD
 	return out;
 }
 
-export function interventionMessage(level: 1 | 2 | 3, detections: LoopDetection[]): string {
-	const det = detections.map((d) => `- ${d.description}`).join("\n");
-	if (level === 1) {
-		return `[antiloop] ⚠️ loop warning\n${det}\nvary approach — try a different strategy.`;
-	}
-	if (level === 2) {
-		return `[antiloop] 🛑 stuck in loop\n${det}\nstop, change approach, do NOT repeat previous tool calls or reasoning.`;
-	}
-	return `[antiloop] 🚨 persistent loop\n${det}\nunable to break automatically — provide new instructions.`;
+/** Escalation level for a consecutive-detection count (mirror of the configured
+ * ladder). Abort (3) only when abortThreshold is enabled (> 0). */
+export function nextLevel(consecutiveDetections: number, config: AntiloopConfig): 0 | 1 | 2 | 3 {
+	if (config.abortThreshold > 0 && consecutiveDetections >= config.abortThreshold) return 3;
+	if (consecutiveDetections >= config.forceBreakThreshold) return 2;
+	if (consecutiveDetections >= config.warningThreshold) return 1;
+	return 0;
+}
+
+/** True when detections prove the model repeated a message/tool call essentially
+ * verbatim (≥98% text similarity or an identical tool-loop). Weaker signals
+ * (thinking echoes, structural repeated openings at 90%) do NOT count — a model
+ * that only *thinks* in circles but varies its actual output is still making an
+ * attempt and must not be hard-stopped. Used post-force-break: only verbatim
+ * repeats prove the model ignored the break instruction. */
+export function isVerbatimRepeat(detections: LoopDetection[]): boolean {
+	return detections.some((d) => d.type !== "thinking" && d.similarity >= 0.98);
 }
 
 // ---------------------------------------------------------------------------
@@ -369,7 +377,7 @@ export function runSelfTest(): string[] {
 	const noteArgs = (x: string) =>
 		JSON.stringify({ type: "note", title: `task ${x}`, body: "append this line to the project memory document so context is preserved" });
 	const tcfg: AntiloopConfig = {
-		enabled: true, warningThreshold: 2, forceBreakThreshold: 3, abortThreshold: 0,
+		enabled: true, warningThreshold: 2, forceBreakThreshold: 3, abortThreshold: 0, ignoredSteerLimit: 2,
 		similarityThreshold: 0.75, toolSimilarityThreshold: 0.95, minToolRepeatCount: 2,
 		resultSimilarityThreshold: 0.8, detectToolLoops: true, detectThinkingLoops: true,
 		detectTextLoops: true, notifyOnDetection: true, maxHistoryEntries: 100,
@@ -379,7 +387,8 @@ export function runSelfTest(): string[] {
 	const asState = (recentMessages: TrackedMessage[]): AntiloopState =>
 		({ recentMessages, detections: [], activeTaskStreams: [], currentLevel: 0,
 			consecutiveDetections: 0, inForcedBreak: false, totalDetections: 0,
-			lastUserMessageTime: 0, lastDetectedTurnIndex: -1 });
+			lastUserMessageTime: 0, lastDetectedTurnIndex: -1,
+			steerDelivered: false, ignoredSteerCount: 0 });
 	const NARR = "Now I will append the next decision entry to the project memory document so we keep the context.";
 
 	// 1) punched_log batch: 3 DIFFERENT appends (args 98.9% similar, NOT twins)
@@ -421,5 +430,18 @@ export function runSelfTest(): string[] {
 	const twoStreams = detectTaskStreams(twoMsgs, tcfg);
 	out.push(`stream needs ≥3 calls   → ${twoStreams.size === 0 ? "no stream" : "stream"} (exp no stream at 2 calls) ${twoStreams.size === 0 ? "✅" : "❌"}`);
 
+	// --- v1.5: escalation ladder + post-steer verbatim-repeat gating ---
+	const lvl = (n: number) => nextLevel(n, tcfg);
+	out.push(`ladder 0→0 1→0 2→1 3→2 4→2  → ${[0, 1, 2, 3, 4].map(lvl).join(",")} (exp 0,0,1,2,2) ${[0, 1, 2, 3, 4].map(lvl).join(",") === "0,0,1,2,2" ? "✅" : "❌"}`);
+	const abortCfg: AntiloopConfig = { ...tcfg, abortThreshold: 5 };
+	out.push(`ladder abort@5 → 5→3       → ${nextLevel(5, abortCfg)} (exp 3) ${nextLevel(5, abortCfg) === 3 ? "✅" : "❌"}`);
+	const dl = (type: LoopDetection["type"], sim: number): LoopDetection[] =>
+		[{ type, similarity: sim, messageIndices: [0, 1], description: `${type} ${sim}`, timestamp: Date.now() }];
+	out.push(`verbatim text 1.00        → ${isVerbatimRepeat(dl("text", 1)) ? "yes" : "no"} (exp yes) ${isVerbatimRepeat(dl("text", 1)) ? "✅" : "❌"}`);
+	out.push(`verbatim text 0.97        → ${isVerbatimRepeat(dl("text", 0.97)) ? "yes" : "no"} (exp no — changed output = attempt) ${!isVerbatimRepeat(dl("text", 0.97)) ? "✅" : "❌"}`);
+	out.push(`verbatim tool-loop        → ${isVerbatimRepeat(dl("tool", 1)) ? "yes" : "no"} (exp yes) ${isVerbatimRepeat(dl("tool", 1)) ? "✅" : "❌"}`);
+	out.push(`thinking-only 1.00        → ${isVerbatimRepeat(dl("thinking", 1)) ? "yes" : "no"} (exp no — output varies) ${!isVerbatimRepeat(dl("thinking", 1)) ? "✅" : "❌"}`);
+	out.push(`structural 0.90           → ${isVerbatimRepeat(dl("structural", 0.9)) ? "yes" : "no"} (exp no) ${!isVerbatimRepeat(dl("structural", 0.9)) ? "✅" : "❌"}`);
+
 	return out;
 }

package/src/index.ts

@@ -1,7 +1,20 @@
 /**
  * antiloop — detect reasoning loops and intervene.
- * Hooks: message_end, input, before_agent_start, context, turn_end, session_start, session_shutdown.
+ * Hooks: message_end, input, turn_end, session_start, session_shutdown.
  * Commands: /antiloop [enable|disable|status|config|log|reset|test]
+ *
+ * Intervention model (v1.5):
+ *   warning (level 1) — informational only (notify). Never injects: an injected
+ *     message at warning level made models stall on the unexpected message.
+ *   force   (level 2) — a REAL user message is steered into the running agent
+ *     (pi.sendUserMessage, deliverAs "steer"); pi delivers it right after the
+ *     current tool results, immediately before the next LLM call, so it lands at
+ *     the exact spot where the model anchors — even a deterministic model stuck
+ *     on an identical context tail must respond to it. One steer per episode.
+ *     If the model ignores the steer and repeats the same message verbatim
+ *     (≥98% similar / identical tool loop) ignoredSteerLimit times, antiloop
+ *     hard-stops the run (ctx.abort).
+ *   abort   (level 3, opt-in via abortThreshold) — stops the run outright.
  */
 
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
@@ -23,6 +36,8 @@ function newState(): AntiloopState {
 		totalDetections: 0,
 		lastUserMessageTime: 0,
 		lastDetectedTurnIndex: -1,
+		steerDelivered: false,
+		ignoredSteerCount: 0,
 	};
 }
 
@@ -54,8 +69,7 @@ export default function antiloopExtension(pi: ExtensionAPI) {
 		activeTui?.requestRender();
 	}
 
-	const rt: Runtime = { config, state, pendingIntervention: null, updateStatus, refreshFooter: installFooter };
-	const setPending = (v: string | null) => { rt.pendingIntervention = v; };
+	const rt: Runtime = { config, state, updateStatus, refreshFooter: installFooter };
 
 	/** Toggle enable/disable, persisting config and refreshing the footer. */
 	function toggleEnabled(ctx: ExtensionContext): void {
@@ -65,38 +79,65 @@ export default function antiloopExtension(pi: ExtensionAPI) {
 		updateStatus(ctx);
 	}
 
-	function processDetections(
-		detections: LoopDetection[],
-		interventionMessage: (level: 2 | 3, d: LoopDetection[]) => string,
-	): void {
-		if (!detections.length) {
-			if (state.consecutiveDetections > 0) state.consecutiveDetections = Math.max(0, state.consecutiveDetections - 1);
-			if (state.currentLevel > 0 && state.consecutiveDetections === 0) {
-				state.currentLevel = 0;
-				state.inForcedBreak = false;
+	/** Set the escalation level; keeps the derived inForcedBreak flag in sync. */
+	function applyLevel(level: 0 | 1 | 2 | 3): void {
+		state.currentLevel = level;
+		state.inForcedBreak = level >= 2;
+	}
+
+	/** level from the current consecutive count (lazy import wrapper). */
+	async function levelForConsecutive(): Promise<0 | 1 | 2 | 3> {
+		const { nextLevel } = await import("./detect.ts");
+		return nextLevel(state.consecutiveDetections, config);
+	}
+
+	/**
+	 * Force break: steer a real user message into the running agent. pi delivers
+	 * "steer" messages right after the current tool results and BEFORE the next
+	 * LLM call — the model must respond to it, which breaks the identical-context
+	 * anchoring that verbatim loops feed on. (before_agent_start injection was
+	 * abandoned: it only fires on the NEXT user prompt, never mid-run — the exact
+	 * reason antiloop previously failed to cut autonomous tool loops.)
+	 */
+	function deliverForceBreak(ctx: ExtensionContext, detections: LoopDetection[]): void {
+		const detail = detections[0]?.description ?? "repeated message/tool calls";
+		try {
+			pi.sendUserMessage(
+				`[antiloop] 🛑 Force break — loop detected (${detail}; ${state.consecutiveDetections} consecutive).\n` +
+					"Stop repeating previous text, reasoning and tool calls, and change approach now.\n" +
+					"If you cannot make progress with a different approach, do NOT call more tools — " +
+					"reply to the user briefly: what you tried, what is blocking you, and what you need.",
+				{ deliverAs: "steer" },
+			);
+			state.steerDelivered = true;
+			if (config.notifyOnDetection) {
+				ctx.ui.notify(`antiloop: force break — ${detail} (break message sent to the model)`, "error");
+			}
+		} catch (err) {
+			// Steer could not be queued (edge: run ended between detection and queue).
+			// Stay armed so the next steerable turn delivers the break.
+			state.steerDelivered = false;
+			if (config.notifyOnDetection) {
+				ctx.ui.notify(
+					`antiloop: force break — ${detail} (could not inject: ${err instanceof Error ? err.message : String(err)})`,
+					"error",
+				);
 			}
-			return;
 		}
-		state.consecutiveDetections++;
-		state.totalDetections++;
-		state.detections.push(...detections);
-		if (state.detections.length > config.maxHistoryEntries) state.detections = state.detections.slice(-config.maxHistoryEntries);
-
-		let next: 0 | 1 | 2 | 3 = 0;
-		if (state.consecutiveDetections >= config.abortThreshold && config.abortThreshold > 0) next = 3;
-		else if (state.consecutiveDetections >= config.forceBreakThreshold) next = 2;
-		else if (state.consecutiveDetections >= config.warningThreshold) next = 1;
-		if (next > state.currentLevel) state.currentLevel = next;
-
-		// Warning (level 1) is informational only: notify the user but DO NOT
-		// inject any message into the conversation. Injecting at warning level
-		// made the model respond to the warning, which could stall generation
-		// even though hard-kill turns remained. Only force (2) / abort (3) inject.
-		if (state.currentLevel >= 2) {
-			setPending(interventionMessage(state.currentLevel as 2 | 3, detections));
-			state.inForcedBreak = true;
-		} else if (state.currentLevel === 1) {
-			state.inForcedBreak = false;
+	}
+
+	/**
+	 * Hard stop: abort the current agent run (fire-and-forget — never awaited, so
+	 * the turn_end handler cannot deadlock on waitForIdle) and tell the user.
+	 */
+	function hardStop(ctx: ExtensionContext, text: string): void {
+		try {
+			ctx.abort();
+		} catch {
+			// abort must never throw out of a hook.
+		}
+		if (config.notifyOnDetection) {
+			ctx.ui.notify(text, "error");
 		}
 	}
 
@@ -222,44 +263,29 @@ export default function antiloopExtension(pi: ExtensionAPI) {
 		}
 	});
 
-	pi.on("input", async () => {
+	pi.on("input", async (event) => {
 		if (!config.enabled) return;
+		// Messages queued by extensions (including antiloop's own force-break
+		// steer) are NOT user input: they must not cool down the escalation or
+		// re-arm the steer — that would defeat the force break.
+		const source = (event as { source?: string } | undefined)?.source;
+		if (source === "extension") return { action: "continue" };
+
 		state.lastUserMessageTime = Date.now();
-		if (state.consecutiveDetections > 0) state.consecutiveDetections = Math.max(0, state.consecutiveDetections - 2);
-		if (state.consecutiveDetections < config.warningThreshold) {
-			state.currentLevel = 0;
-			state.inForcedBreak = false;
+		if (state.consecutiveDetections > 0) {
+			state.consecutiveDetections = Math.max(0, state.consecutiveDetections - 2);
 		}
+		// A real user message is a new chance: mirror the level off the cooled-down
+		// counter and re-arm the force break so a fresh loop gets a fresh steer.
+		applyLevel(await levelForConsecutive());
+		state.steerDelivered = false;
+		state.ignoredSteerCount = 0;
 		return { action: "continue" };
 	});
 
-	pi.on("before_agent_start", async () => {
-		if (!config.enabled || !rt.pendingIntervention) return;
-		const msg = rt.pendingIntervention;
-		rt.pendingIntervention = null;
-		return {
-			message: { customType: "antiloop-intervention", content: msg, display: true },
-		};
-	});
-
-	pi.on("context", async (event) => {
-		if (!config.enabled || state.currentLevel < 2) return;
-		const msgs = [...event.messages];
-		for (let i = msgs.length - 1; i >= 0; i--) {
-			if (msgs[i].role === "assistant") {
-				const m = msgs[i] as { content: string | Array<{ type: string; text?: string }> };
-				const inject = "\n\n[antiloop] break out of loop — try a different approach.";
-				if (typeof m.content === "string") m.content += inject;
-				else if (Array.isArray(m.content)) m.content.push({ type: "text", text: inject });
-				break;
-			}
-		}
-		return { messages: msgs };
-	});
-
 	pi.on("turn_end", async (event, ctx) => {
 		if (!config.enabled) return;
-		const { detectLoops, detectTaskStreams, interventionMessage, resultFingerprint } = await import("./detect.ts");
+		const { detectLoops, detectTaskStreams, isVerbatimRepeat, nextLevel, resultFingerprint } = await import("./detect.ts");
 
 		const last = state.recentMessages[state.recentMessages.length - 1];
 		if (!last || last.turnIndex === state.lastDetectedTurnIndex) {
@@ -288,12 +314,66 @@ export default function antiloopExtension(pi: ExtensionAPI) {
 		).map(([tool, count]) => ({ tool, count }));
 
 		const detections = detectLoops(state, config);
-		processDetections(detections, interventionMessage);
+		const prevLevel = state.currentLevel;
 
-		if (config.notifyOnDetection && detections.length && state.currentLevel > 0) {
-			const lvl = ["", "warning", "force", "abort"][state.currentLevel];
-			ctx.ui.notify(`antiloop: ${lvl} — ${detections[0].description}`, state.currentLevel >= 2 ? "error" : "warning");
+		// ---- clean turn: cool down ----------------------------------------
+		if (!detections.length) {
+			if (state.consecutiveDetections > 0) state.consecutiveDetections--;
+			applyLevel(nextLevel(state.consecutiveDetections, config));
+			if (state.currentLevel === 0) {
+				state.steerDelivered = false;
+				state.ignoredSteerCount = 0;
+			}
+			updateStatus(ctx);
+			return;
 		}
+
+		// ---- detection: escalate ------------------------------------------
+		state.consecutiveDetections++;
+		state.totalDetections++;
+		state.detections.push(...detections);
+		if (state.detections.length > config.maxHistoryEntries) {
+			state.detections = state.detections.slice(-config.maxHistoryEntries);
+		}
+		applyLevel(nextLevel(state.consecutiveDetections, config));
+		const level = state.currentLevel;
+
+		// The steer is only picked up when the run keeps going after this turn.
+		// On error/aborted stop reasons the agent loop returns immediately and the
+		// queued message would go stale — stay armed and steer on a later turn.
+		const stopReason = (event as { message?: { stopReason?: string } } | undefined)?.message?.stopReason;
+		const steerable = stopReason !== "error" && stopReason !== "aborted" && ctx.signal !== undefined;
+
+		if (level === 1 && prevLevel < 1) {
+			// Warning: informational only (never injects — a warning must not stall).
+			if (config.notifyOnDetection) {
+				ctx.ui.notify(`antiloop: warning — ${detections[0].description}`, "warning");
+			}
+		} else if (level === 2) {
+			if (!state.steerDelivered) {
+				// First force-break turn of the episode: steer a break message
+				// before the next LLM call.
+				if (steerable) {
+					deliverForceBreak(ctx, detections);
+				} else if (prevLevel < 2 && config.notifyOnDetection) {
+					ctx.ui.notify(`antiloop: force break — ${detections[0].description}`, "error");
+				}
+			} else if (isVerbatimRepeat(detections)) {
+				// The model repeated the same message/call after being told to stop:
+				// count it; once the ignore limit is hit the run is cut for good.
+				state.ignoredSteerCount++;
+				if (state.ignoredSteerCount >= config.ignoredSteerLimit) {
+					hardStop(
+						ctx,
+						`antiloop: abort — the model repeated the same message ${state.ignoredSteerCount}× after the force break — run stopped; provide new instructions`,
+					);
+				}
+			}
+		} else if (level === 3) {
+			// abortThreshold configured and reached: stop the run outright.
+			hardStop(ctx, `antiloop: abort — ${detections[0].description} — run stopped; provide new instructions`);
+		}
+
 		updateStatus(ctx);
 	});
 
@@ -301,7 +381,6 @@ export default function antiloopExtension(pi: ExtensionAPI) {
 		// re-read config and reset state for a fresh session
 		Object.assign(config, loadConfig());
 		state = newState();
-		rt.pendingIntervention = null;
 		installFooter(ctx);
 		updateStatus(ctx);
 	});

package/src/types.ts

@@ -7,6 +7,15 @@ export interface AntiloopConfig {
 	forceBreakThreshold: number;
 	abortThreshold: number;
 	similarityThreshold: number;
+	/**
+	 * How many ESSENTIALLY IDENTICAL repeats (≥98% similar text / identical tool
+	 * loops) the model may produce AFTER the force-break message before antiloop
+	 * hard-stops the run (ctx.abort). Guards the force break: if the model ignores
+	 * the break instruction and keeps repeating verbatim, the run is cut instead of
+	 * burning context forever. Only verbatim repeats count — a model that changes
+	 * its output (even while still similar) gets room to escape on its own.
+	 */
+	ignoredSteerLimit: number;
 	/**
 	 * How close tool-call arguments must be (0..1) to count as the SAME call.
 	 * High by default: long bash commands share scaffolding (env setup, flags,
@@ -107,12 +116,18 @@ export interface AntiloopState {
 	lastUserMessageTime: number;
 	/** turnIndex of the last tracked message detection already ran on. */
 	lastDetectedTurnIndex: number;
+	/** True once the force-break user message was steered into the current episode.
+	 * One steer per episode: repeated steering would spam the conversation. Cleared
+	 * when the episode decays (currentLevel back to 0) or on real user input. */
+	steerDelivered: boolean;
+	/** Verbatim repeats counted AFTER the steer. When this reaches
+	 * config.ignoredSteerLimit the run is hard-stopped (aborted). */
+	ignoredSteerCount: number;
 }
 
 export interface Runtime {
 	config: AntiloopConfig;
 	state: AntiloopState;
-	pendingIntervention: string | null;
 	updateStatus(ctx: ExtensionContext): void;
 	/** Re-install the interactive footer (after config changes). */
 	refreshFooter?(ctx: ExtensionContext): void;