pi-antiloop 1.5.1 → 1.7.0

package/src/index.ts

@@ -1,6 +1,6 @@
 /**
  * antiloop — detect reasoning loops and intervene.
- * Hooks: message_end, input, turn_end, session_start, session_shutdown.
+ * Hooks: message_end, tool_call, input, turn_end, session_start, session_shutdown.
  * Commands: /antiloop [enable|disable|status|config|log|reset|test]
  *
  * Intervention model (v1.5):
@@ -15,9 +15,26 @@
  *     (≥98% similar / identical tool loop) ignoredSteerLimit times, antiloop
  *     hard-stops the run (ctx.abort).
  *   abort   (level 3, opt-in via abortThreshold) — stops the run outright.
+ *
+ * v1.6 adds the intra-message degenerate detector: a model whose decoder
+ * anchors on a token repeats it hundreds of times INSIDE one message / tool
+ * call (the real 46 KB bash "noguerol ×5145" meltdown). That needs no peer
+ * message, so it is caught at message_end — BEFORE the tool calls execute —
+ * and degenerate bash commands are additionally blocked in the tool_call
+ * hook (blockDegenerateBash). One degenerate turn counts degenerateTurnWeight
+ * (2) consecutive points: warning on first sight, force-break steer on the
+ * second consecutive meltdown, hard stop shortly after if it keeps repeating.
+ *
+ * v1.7 adds the intra-message BLOCK detector for the narration-loop class:
+ * ONE message that replays whole sentences/phrases ("Let me start by checking
+ * the environment…" ×5), which every cross-message detector misses because
+ * there is no peer message and the degenerate scan only watches single words.
+ * Same message_end timing and strong turn weight; the bash gate refuses a
+ * command that is itself a replayed block.
  */
 
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { isToolCallEventType } from "@earendil-works/pi-coding-agent";
 import { truncateToWidth } from "@earendil-works/pi-tui";
 import { loadConfig, saveConfig } from "./config.ts";
 import type { AntiloopState, LoopDetection, Runtime, TrackedToolCall } from "./types.ts";
@@ -38,6 +55,7 @@ function newState(): AntiloopState {
 		lastDetectedTurnIndex: -1,
 		steerDelivered: false,
 		ignoredSteerCount: 0,
+		turnSeq: 0,
 	};
 }
 
@@ -235,7 +253,7 @@ export default function antiloopExtension(pi: ExtensionAPI) {
 		});
 	}
 
-	pi.on("message_end", async (event) => {
+	pi.on("message_end", async (event, ctx) => {
 		if (!config.enabled) return;
 		const msg = event.message;
 		if (msg.role !== "assistant") return;
@@ -263,12 +281,105 @@ export default function antiloopExtension(pi: ExtensionAPI) {
 				thinking: thinking || undefined,
 				toolCalls: toolCalls.length ? toolCalls : undefined,
 				timestamp: Date.now(),
-				turnIndex: state.recentMessages.length,
+				// Monotonic: the array is trimmed below (detectionWindow + 5), so
+				// recentMessages.length would repeat after the first trim and the
+				// turn_end dedupe guard (turnIndex === lastDetectedTurnIndex) would
+				// skip every later message — antiloop going blind mid-session.
+				turnIndex: state.turnSeq++,
 			});
 		}
 		if (state.recentMessages.length > config.detectionWindow + 5) {
 			state.recentMessages = state.recentMessages.slice(-(config.detectionWindow + 5));
 		}
+
+		// v1.6/v1.7 — intra-message repetition is handled HERE, at message_end,
+		// because turn_end only fires after tool execution (too late to stop the
+		// 46 KB "noguerol ×5000" bash from running) and an aborted generation may
+		// never reach turn_end at all. The signal is self-contained (one
+		// pathological payload, no peer message) so the full escalation ladder runs
+		// right now; the turn-guard makes the later turn_end pass skip this message
+		// and no detection is double-counted. Two flavors: degenerate (one word
+		// ×hundreds) and block (whole sentences/phrases replayed — the narration
+		// loop class where every cross-message detector is blind).
+		if (!config.detectDegenerate && !config.detectBlockRepeats) return;
+		const {
+			scanMessageDegenerate,
+			degenerateDescription,
+			scanMessageBlock,
+			blockRepeatDescription,
+			nextLevel,
+			isVerbatimRepeat,
+		} = await import("./detect.ts");
+		let det: LoopDetection | undefined;
+		if (config.detectDegenerate) {
+			const degHit = scanMessageDegenerate(content, toolCalls, config);
+			if (degHit) {
+				det = {
+					type: "degenerate",
+					similarity: 1,
+					messageIndices: [state.recentMessages.length - 1],
+					description: degenerateDescription(degHit),
+					timestamp: Date.now(),
+				};
+			}
+		}
+		if (!det && config.detectBlockRepeats) {
+			const blkHit = scanMessageBlock(content, toolCalls, config);
+			if (blkHit) {
+				det = {
+					type: "block",
+					similarity: 0.99,
+					messageIndices: [state.recentMessages.length - 1],
+					description: blockRepeatDescription(blkHit),
+					timestamp: Date.now(),
+				};
+			}
+		}
+		if (!det) return;
+		const tracked = state.recentMessages[state.recentMessages.length - 1];
+		if (tracked) state.lastDetectedTurnIndex = tracked.turnIndex;
+		const prevLevel = state.currentLevel;
+		state.consecutiveDetections += Math.max(1, config.degenerateTurnWeight);
+		state.totalDetections++;
+		state.detections.push(det);
+		if (state.detections.length > config.maxHistoryEntries) {
+			state.detections = state.detections.slice(-config.maxHistoryEntries);
+		}
+		applyLevel(nextLevel(state.consecutiveDetections, config));
+		const level = state.currentLevel;
+
+		if (level === 1 && prevLevel < 1) {
+			// Warning: informational only (never injects — a warning must not stall).
+			if (config.notifyOnDetection) {
+				ctx.ui.notify(`antiloop: warning — ${det.description}`, "warning");
+			}
+		} else if (level === 2) {
+			if (!state.steerDelivered) {
+				// Steer the break message before the next LLM call. The degenerate bash
+				// itself is blocked by the tool_call gate, so the model sees the block
+				// reason + the steer together and can still change approach.
+				if (ctx.signal !== undefined) {
+					deliverForceBreak(ctx, [det]);
+				} else if (prevLevel < 2 && config.notifyOnDetection) {
+					ctx.ui.notify(`antiloop: force break — ${det.description}`, "error");
+				}
+			} else if (isVerbatimRepeat([det])) {
+				// The model produced the same intra-message repetition AGAIN after the
+				// break message: count it; once the ignore limit is hit, cut the run.
+				state.ignoredSteerCount++;
+				if (state.ignoredSteerCount >= config.ignoredSteerLimit) {
+					hardStop(
+						ctx,
+						`antiloop: abort — repetitive output repeated ${state.ignoredSteerCount}× after the force break — run stopped; provide new instructions`,
+					);
+				}
+			}
+		} else if (level === 3) {
+			// abortThreshold configured and reached: stop the run BEFORE the degenerate
+			// tool calls can execute (ctx.abort kills the pending tool batch).
+			hardStop(ctx, `antiloop: abort — ${det.description} — run stopped; provide new instructions`);
+		}
+		updateStatus(ctx);
 	});
 
 	pi.on("input", async (event) => {
@@ -291,9 +402,43 @@ export default function antiloopExtension(pi: ExtensionAPI) {
 		return { action: "continue" };
 	});
 
+	/**
+	 * v1.6 — degenerate bash gate. A meltdown message whose command repeats one
+	 * word hundreds of times (the 46 KB "noguerol ×5145" SSH-wordlist brute
+	 * force) must NEVER execute: it is pure context burn at best, and a real
+	 * brute-force / destructive repetition at worst. message_end already
+	 * escalated it; here we block the actual call before it runs. The block
+	 * reason is fed back to the model as the tool error, so the next LLM call
+	 * sees why the command was refused and can change approach.
+	 */
+	pi.on("tool_call", async (event, ctx) => {
+		if (!config.enabled || !config.blockDegenerateBash) return;
+		if (!isToolCallEventType("bash", event)) return;
+		const command = event.input.command ?? "";
+		const { findDegenerateRepetition, findRepetitiveBlock, degenerateDescription, blockRepeatDescription } = await import("./detect.ts");
+		if (config.detectDegenerate) {
+			const hit = findDegenerateRepetition(command, config);
+			if (hit) {
+				return {
+					block: true,
+					reason: `[antiloop] blocked: ${degenerateDescription({ ...hit, where: "bash command" })} — this is stuck generation, not a real command. Do NOT retry it: stop and take one small, concrete step instead.`,
+				};
+			}
+		}
+		if (config.detectBlockRepeats) {
+			const blk = findRepetitiveBlock(command, config);
+			if (blk) {
+				return {
+					block: true,
+					reason: `[antiloop] blocked: ${blockRepeatDescription({ ...blk, where: "bash command" })} — this is stuck generation, not a real command. Do NOT retry it: stop and take one small, concrete step instead.`,
+				};
+			}
+		}
+	});
+
 	pi.on("turn_end", async (event, ctx) => {
 		if (!config.enabled) return;
-		const { detectLoops, detectTaskStreams, isVerbatimRepeat, nextLevel, resultFingerprint } = await import("./detect.ts");
+		const { detectLoops, detectTaskStreams, detectionTurnWeight, isVerbatimRepeat, nextLevel, resultFingerprint } = await import("./detect.ts");
 
 		const last = state.recentMessages[state.recentMessages.length - 1];
 		if (!last || last.turnIndex === state.lastDetectedTurnIndex) {
@@ -337,7 +482,9 @@ export default function antiloopExtension(pi: ExtensionAPI) {
 		}
 
 		// ---- detection: escalate ------------------------------------------
-		state.consecutiveDetections++;
+		// Degenerate turns count degenerateTurnWeight (default 2) points so a
+		// single intra-message meltdown already reaches the warning level.
+		state.consecutiveDetections += detectionTurnWeight(detections, config);
 		state.totalDetections++;
 		state.detections.push(...detections);
 		if (state.detections.length > config.maxHistoryEntries) {

package/src/types.ts

@@ -16,6 +16,68 @@ export interface AntiloopConfig {
 	 * its output (even while still similar) gets room to escape on its own.
 	 */
 	ignoredSteerLimit: number;
+	/**
+	 * Intra-message degenerate repetition (the "noguerol \u00d75145" meltdown class): a model
+	 * stuck emitting the same token hundreds of times INSIDE one message / tool call.
+	 * Unlike the other detectors it needs no peer message: one pathological payload is
+	 * already conclusive. Fires on the first occurrence; each degenerate turn is weighted
+	 * (degenerateTurnWeight, default 2) so a single meltdown reaches the warning level.
+	 */
+	detectDegenerate: boolean;
+	/** Minimum normalized tokens in a payload before it is scanned (shorter = not conclusive). */
+	degenerateMinTokens: number;
+	/** Longest run of ONE identical word that flags a payload as degenerate. */
+	degenerateMaxRun: number;
+	/** Total occurrences of one word (anywhere, interleaved) that flags when combined with share. */
+	degenerateMaxFreq: number;
+	/** Word frequency share (freq/total) needed together with degenerateMaxFreq. */
+	degenerateMaxShare: number;
+	/** How many consecutive-detection points ONE degenerate turn adds (2 = warn on first sight). */
+	degenerateTurnWeight: number;
+	/** Block a bash tool call whose command shows degenerate OR block repetition BEFORE it executes. */
+	blockDegenerateBash: boolean;
+	/**
+	 * Intra-message BLOCK repetition (v1.7): the "narration loop" class where ONE
+	 * assistant message keeps replaying the same sentences/phrases (the real S0
+	 * coding session: ~5 near-verbatim cycles of "Let me start by checking the
+	 * environment…" inside a SINGLE generation, which every cross-message detector
+	 * misses because it produced only one message and the degenerate detector only
+	 * watches for ONE word repeated hundreds of times). A sliding window of
+	 * blockNgram-word n-grams over the normalized payload is built; when at least
+	 * blockRepeatShare of those positions recur, one n-gram appears at least
+	 * blockMinRepeats times and the payload has at least blockMinTokens words, the
+	 * message is a replay. Fires at message_end (before the message's tools run)
+	 * with the same strong turn weight as the degenerate detector.
+	 */
+	detectBlockRepeats: boolean;
+	/** Minimum normalized words in a payload before it is scanned for block repetition. */
+	blockMinTokens: number;
+	/** Word window of the n-grams whose recurrence is measured (default 5). */
+	blockNgram: number;
+	/** The MOST repeated n-gram must occur at least this many times to flag. */
+	blockMinRepeats: number;
+	/** Share of n-gram positions that must recur for the payload to count as a replay. */
+	blockRepeatShare: number;
+	/**
+	 * No-progress outcome runs (v1.6.1): a model that keeps re-running the SAME
+	 * experiment with cosmetic mutations (labels/permutations) while the outcome
+	 * stays the SAME FAILURE — the real NFS session where ~90 near-identical
+	 * ssh exportfs/mount tests (test A … test QQQ) all failed rc=32. The
+	 * tool-loop detector can't see it: args mutate every turn so the same call
+	 * never recurs (labels differ), and results only VETO tool loops today.
+	 * Signal: >= outcomeMinRepeats PRIOR attempts inside the window whose args
+	 * are >= outcomeArgSimilarity similar AND whose captured result is the same
+	 * outcome (>= resultSimilarityThreshold), all after the last real user input.
+	 */
+	detectOutcomeLoops: boolean;
+	outcomeMinRepeats: number;
+	outcomeArgSimilarity: number;
+	/** Same-FAILURE gate for the outcome detector: minimum similarity between the
+	 * digit-stripped error signatures of two failing attempts to count as the
+	 * SAME failure. Looser than the veto threshold on purpose: the signature
+	 * repeats across attempts of the same wall even when legitimately varying
+	 * words (mount targets) sit inside it. */
+	outcomeSigThreshold: number;
 	/**
 	 * How close tool-call arguments must be (0..1) to count as the SAME call.
 	 * High by default: long bash commands share scaffolding (env setup, flags,
@@ -66,7 +128,7 @@ export interface AntiloopConfig {
 	toggleShortcut: string;
 }
 
-export type LoopKind = "text" | "tool" | "thinking" | "structural";
+export type LoopKind = "text" | "tool" | "thinking" | "structural" | "degenerate" | "block" | "outcome";
 
 export interface LoopDetection {
 	type: LoopKind;
@@ -94,6 +156,10 @@ export interface TrackedMessage {
 	thinking?: string;
 	toolCalls?: TrackedToolCall[];
 	timestamp: number;
+	/** Monotonic push sequence (state.turnSeq++), NOT the window index: the
+	 * recent-messages array is trimmed to detectionWindow+5, so an array-length
+	 * based index would collide after trimming and make the turn_end dedupe
+	 * guard skip every later message (antiloop going blind mid-session). */
 	turnIndex: number;
 }
 
@@ -116,6 +182,10 @@ export interface AntiloopState {
 	lastUserMessageTime: number;
 	/** turnIndex of the last tracked message detection already ran on. */
 	lastDetectedTurnIndex: number;
+	/** Monotonic sequence for the next tracked message's turnIndex (see
+	 * TrackedMessage.turnIndex). Persists across trims; reset on /reset and at
+	 * session start. */
+	turnSeq: number;
 	/** True once the force-break user message was steered into the current episode.
 	 * One steer per episode: repeated steering would spam the conversation. Cleared
 	 * when the episode decays (currentLevel back to 0) or on real user input. */