pi-antiloop 1.7.0 → 1.8.1

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Javier Noguerol
+Copyright (c) 2026 antiloop contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -12,9 +12,10 @@
 
 ## Features
 
-- **Seven detection strategies** — text repetition (trigram Jaccard + Levenshtein), tool-call sequences (name + near-identical arguments + same outcome — result-aware, so retries that make progress don't false-positive), thinking blocks, structural opening-phrase patterns, **degenerate repetition** (a single message/call stuck repeating one word hundreds of times — the `noguerol ×5145` meltdown — caught at `message_end` with no repeated peer needed, and degenerate bash commands blocked before they execute), **block repetition** (ONE message replaying whole sentences/phrases — the narration loop: `Let me start by checking the environment…` ×5 — same `message_end` timing and strong turn weight), and **no-progress outcome runs** (the NFS `test A…QQQ` class: dozens of near-identical re-runs of the same experiment, every one ending in the *same failing outcome* — args mutate so tool-loop can't see it; the repeated failure signature can)
+- **Seven detection strategies** — text repetition (trigram Jaccard + Levenshtein), tool-call sequences (name + near-identical arguments + same outcome — result-aware, so retries that make progress don't false-positive), thinking blocks, structural opening-phrase patterns, **degenerate repetition** (a single message/call stuck repeating one word hundreds of times — the `lorem ×5145` meltdown — caught at `message_end` with no repeated peer needed, and degenerate bash commands blocked before they execute), **block repetition** (ONE message replaying whole sentences/phrases — the narration loop: `Let me start by checking the environment…` ×5 — same `message_end` timing and strong turn weight), and **no-progress outcome runs** (the NFS `test A…QQQ` class: dozens of near-identical re-runs of the same experiment, every one ending in the *same failing outcome* — args mutate so tool-loop can't see it; the repeated failure signature can)
 - **Stays alive in long sessions** — tracked messages carry a monotonic sequence number, so trimming the sliding window can never make the dedupe guard skip later messages (a bug that silently blinded antiloop after ~15 tracked messages)
 - **Task-stream recognition (batch work)** — when another extension (e.g. `punched` appending lines to pi.md, or `plan` adding tasks) makes the model call the *same* tool many times with *different* content, antiloop recognizes it as N distinct tasks of one type and stays silent — no warning, no force break. A genuine loop (the *same* call repeated verbatim) is still caught
+- **Snapshot/read-only tool exemption** — a coordinator closing N agents that already finished calls `trimegisto_harvest` once per agent and gets the *same* settled board every time; identical reads of a status snapshot are an idempotent serial close, not a loop, so `snapshotTools` (configurable) is exempt from tool-loop and no-progress detection — real `bash` loops next to it are still caught
 - **Progressive intervention** — `warning` reminds the model to vary its approach; `force break` steers a real break message into the running agent before its next LLM call; `abort` stops the run entirely
 - **Configurable thresholds** — independent dials for similarity cutoff, warning/force-break/abort counts, detection window, and which strategies are on
 - **Sliding window** — only the last N messages are compared, so detection is O(N) in the window size, not in the full session
@@ -106,7 +107,7 @@ Detection strategies:
 Recent detections:
   [text] Text similarity 85% with message 3 (2m ago)
   [tool] repeated 3x: bash (5m ago)
-  [degenerate] bash command: degenerate repetition — "noguerol" ×5145 (5m ago)
+  [degenerate] bash command: degenerate repetition — "lorem" ×5145 (5m ago)
   [block] message text: block repetition — 100% of 450 tokens replay repeated 5-word phrases (5m ago)
   [outcome] no progress: 9 near-identical bash attempts with the same failing outcome (5m ago)
 ```
@@ -130,7 +131,7 @@ Grouped interactive menu showing the current value in each option:
 - **🔧 call similarity** — `99 / 95 / 90 / 80%` — how identical tool-call *arguments* must be to count as the same call (default 95%: only near-identical repeats loop)
 - **🔁 call repeats** — `1 / 2 / 3` — how many times the same call must repeat before it flags (default 2)
 - **🧾 result similarity** — `95 / 80 / 60%` — how similar captured results must be to count as the *same outcome*; a repeated command that starts producing a different result is progress, not a loop (default 80%)
-- **🌀 degenerate run** — `8 / 16 / 24 / 48` — identical words in a row inside ONE message/call before it counts as stuck generation (default 16; the `noguerol ×5145` class)
+- **🌀 degenerate run** — `8 / 16 / 24 / 48` — identical words in a row inside ONE message/call before it counts as stuck generation (default 16; the `lorem ×5145` class)
 - **🔁 block repetition** — on/off — detect ONE message replaying whole sentences/phrases (the narration loop: `Let me start by checking the environment…` ×5) with no repeated peer needed
 - **🔁 block share** — `70 / 85 / 95%` — share of replayed 5-word phrases in one message before it counts as a replay (default 85%)
 - **⛔ block repetitive bash** — on/off — refuse a degenerate or replayed bash command before it executes, feeding the reason back to the model (default on)
@@ -141,6 +142,9 @@ Grouped interactive menu showing the current value in each option:
 - **📋 stream min calls** — `2 / 3 / 4 / 5` — same-tool calls required before a batch is recognized (default 3)
 - **📋 twin threshold** — `99 / 95 / 90%` — calls more similar than this count as the *same task* repeated; one twin invalidates the batch and normal detection resumes (default 99%)
 
+**📡 Snapshot tools** — read-only status boards (trimegisto_harvest, …) read serially are not a loop
+- **📡 snapshot tools** — `trimegisto_harvest` / off — repeated identical reads of a settled board stay silent all the way through (default on; add any other status/poll tool in `antiloop.json`)
+
 **🔍 Detectors**
 - **📝 text** — on/off — detect repeated text messages
 - **🔧 tools** — on/off — detect repeated tool calls
@@ -175,10 +179,10 @@ batch no detections    → silent (exp silent — 98.9% args would match without
 loop still detected     → tool (exp tool — identical repeats are NOT a stream) ✅
 loop survives batch gate→ tool (exp tool — bash repeats are real) ✅
 stream needs ≥3 calls   → no stream (exp no stream at 2 calls) ✅
-degenerate first sight   → degenerate (bash command: "noguerol" ×402 …) ✅   ← v1.6: ONE meltdown message, no peer
+degenerate first sight   → degenerate (bash command: "lorem" ×402 …) ✅   ← v1.6: ONE meltdown message, no peer
 degenerate legit cmd      → ok (exp ok) ✅
-degenerate interleaved    → flag (noguerol ×150) (exp flag — freq/share clause) ✅
-degenerate glued token    → flag (noguerol ×300) (exp flag — perfect power) ✅
+degenerate interleaved    → flag (lorem ×150) (exp flag — freq/share clause) ✅
+degenerate glued token    → flag (lorem ×300) (exp flag — perfect power) ✅
 degenerate turn weight    → degenerate 2, text 1 (exp 2, 1) ✅
 block S0 narration loop  → block (message text: 100% of 450 tokens replay repeated 5-word phrases) ✅   ← v1.7: ONE message replaying sentences, no peer
 block 3 cycles / 2 cycles→ flag (100%) / no (exp flag / no — needs ≥3 repeats) ✅
@@ -251,8 +255,8 @@ results are known. Each captured result becomes a normalized tail fingerprint
 ("err|" / "ok|" prefix + last 400 chars, so PID/timestamp noise is tolerated).
 If the same command produced a *different* outcome, the pair is progress:
 
-  [bash("...")] → err|error: invalid argument: ROCm0        (attempt 1)
-  [bash("...")] → ok|model loaded / listening on :8093      (attempt 2)
+  [bash("...")] → err|error: invalid argument: GPU0        (attempt 1)
+  [bash("...")] → ok|model loaded / listening on :8080      (attempt 2)
   → NOT a loop — the retry fixed the problem
 
   [bash("...")] → err|failed to create context …            (attempt 1)
@@ -297,6 +301,27 @@ size needed before recognition), `taskStreamTwinThreshold` (how similar args
 must be to count as *the same task* — lower it to treat near-duplicate
 entries as loops again).
 
+### Snapshot tools: the serial close of settled agents ≠ a loop
+
+A coordinator that closes N agents which have already finished calls the
+snapshot tool once per agent. When the agents are all settled, every one of
+those calls returns the **same** serialized board — same arguments (`{}`),
+same result. To the tool detector that is indistinguishable from a verbatim
+loop: `same args + same outcome` repeated N times, so it force-broke a run
+that was simply collecting finished results.
+
+Re-reading a state snapshot is an *idempotent read*, not a stuck generation,
+so tools listed in `snapshotTools` (default `["trimegisto_harvest"]`) are
+exempt from tool-loop **and** no-progress outcome detection. The exemption is
+deliberately narrow:
+
+- it only applies when *every* call in the message is a snapshot tool — a
+  real `bash` loop re-run alongside a harvest is still flagged;
+- it is name-based and configurable, so `antiloop.json` can list any other
+  status/poll tool (`"snapshotTools": ["trimegisto_harvest", "my_status"]`);
+- clearing it (`"snapshotTools": []` or **📡 off**) restores normal detection,
+  where the very same 5× harvest payload is a genuine verbatim tool loop.
+
 ### Degenerate repetition: ONE message stuck on a word ≠ a reasoning loop
 
 All strategies above need at least two similar messages — they detect a model
@@ -304,8 +329,8 @@ All strategies above need at least two similar messages — they detect a model
 failure mode they cannot see: the model's decoder **anchors on a token and
 stops producing new output**, repeating the same word hundreds of times
 *inside a single message or tool call*. Real case (session `2026-09-09T15-43`,
-/home/j — Qwen3.8-27B on llama.cpp): one 46 KB `bash` call whose SSH
-username wordlist repeated `noguerol` **5145 times** (a run of 5140 — 99% of
+a local llama.cpp server): one 46 KB `bash` call whose SSH
+username wordlist repeated `lorem` **5145 times** (a run of 5140 — 99% of
 the payload). Every cross-message detector stayed silent (nothing to compare
 against — it happened exactly once), and only a manual ESC stopped it.
 
@@ -319,7 +344,7 @@ occurrence, with no peer message:
   with ≥ `degenerateMaxShare` (40%) of all tokens catches interleaved
   meltdowns (`A B A B A B…`) that have no long run.
 - **Perfect power** — a single giant token with no separators at all
-  (`noguerolnoguerol…`) is checked for periodicity.
+  (`loremlorem…`) is checked for periodicity.
 
 Tokenization uses runs of letters (unicode), so JSON stringification noise
 (escaped `\n` in stored tool args, punctuation, digits, code symbols) never
@@ -392,7 +417,7 @@ A subtler meltdown than the degenerate one: the model re-runs the SAME
 experiment over and over, mutating a cosmetic label or permutation each time
 so no call ever repeats verbatim — while the outcome stays the SAME FAILURE.
 Real case (same session, rows 95–249): ~90 ssh `exportfs`/`mount` tests,
-labels `test A` … `test QQQ`, targets alternating Javi/Compartido — every one
+labels `test A` … `test QQQ`, targets alternating data-a/data-b — every one
 ending `access denied` / `rc=32`, with fresh journalctl noise per attempt.
 The tool-loop detector is blind to it BY DESIGN (args mutate every turn:
 mean adjacent trigram similarity 0.93, but the label always changes, so the
@@ -484,7 +509,7 @@ Persisted as JSON at `~/.pi/agent/antiloop.json`:
 | `toolSimilarityThreshold` | `0.95` | How close tool-call arguments must be (0.0–1.0) to count as the *same* call — see [tool loops](#how-it-works) |
 | `minToolRepeatCount` | `2` | Prior occurrences of a near-identical call set required before a tool loop is flagged (2 = same call seen 3×) |
 | `resultSimilarityThreshold` | `0.8` | Minimum similarity between captured result tails to still count as the *same outcome*; below this, a repeated command is treated as progress, not a loop |
-| `detectDegenerate` | `true` | Detect intra-message degenerate repetition — one message/call stuck repeating a single word (the `noguerol ×5145` class). Needs no repeated peer message; scanned at `message_end` and on every bash `tool_call` |
+| `detectDegenerate` | `true` | Detect intra-message degenerate repetition — one message/call stuck repeating a single word (the `lorem ×5145` class). Needs no repeated peer message; scanned at `message_end` and on every bash `tool_call` |
 | `degenerateMinTokens` | `50` | Minimum normalized tokens in a payload before it is scanned for degenerate repetition (shorter payloads aren't conclusive) |
 | `degenerateMaxRun` | `16` | Consecutive identical words inside one payload that flag it as degenerate |
 | `degenerateMaxFreq` | `60` | One word's total occurrences (with `degenerateMaxShare` of the payload) that flags interleaved meltdowns |
@@ -503,6 +528,7 @@ Persisted as JSON at `~/.pi/agent/antiloop.json`:
 | `detectTaskStreams` | `true` | Recognize homogeneous batch work (same tool called with distinct content — e.g. punched/plan/obsidian extensions) and stay silent; see [task streams](#task-streams-n-tasks-of-one-type--a-loop) |
 | `taskStreamMinCalls` | `3` | Same-tool calls required inside the window before a task stream is recognized |
 | `taskStreamTwinThreshold` | `0.99` | Arguments this similar (or identical) count as *the same task* — a twin invalidates the stream and re-enables normal loop detection |
+| `snapshotTools` | `["trimegisto_harvest"]` | Read-only snapshot/status tools: repeated identical reads (the serial close of N settled agents) never count as a tool loop or no-progress run. Add any other status/poll tool by name |
 | `detectTextLoops` | `true` | Detect full-text repetition |
 | `detectToolLoops` | `true` | Detect tool-call sequence + argument repetition |
 | `detectThinkingLoops` | `true` | Detect repeated thinking/reasoning content |
@@ -520,7 +546,7 @@ Persisted as JSON at `~/.pi/agent/antiloop.json`:
 4. **Per-strategy toggles** — if the model's reasoning legitimately repeats (e.g. it's working through a checklist), disable `thinking` detection and leave text/tool on.
 5. **Watch the log** — `/antiloop log` shows what's actually triggering. If you see false positives, raise `similarityThreshold` instead of disabling the strategy entirely.
 6. **Let user input clear state** — each user message decays the consecutive counter by 2, so a fresh prompt naturally resets without `/antiloop reset`.
-7. **Degenerate detector needs no tuning for most setups** — a run of ≥ 16 identical words (or one word ≥ 40% of a ≥ 50-token payload) inside a single message is conclusive stuck generation; the 46 KB `noguerol ×5145` SSH-wordlist meltdown is caught on first sight (warning), its bash never executes (`blockDegenerateBash`), and a second consecutive meltdown gets the force-break steer. If a model legitimately writes repetitive payloads, raise `degenerateMaxRun` / `degenerateMaxFreq` via `/antiloop config` — don't disable the detector.
+7. **Degenerate detector needs no tuning for most setups** — a run of ≥ 16 identical words (or one word ≥ 40% of a ≥ 50-token payload) inside a single message is conclusive stuck generation; the 46 KB `lorem ×5145` SSH-wordlist meltdown is caught on first sight (warning), its bash never executes (`blockDegenerateBash`), and a second consecutive meltdown gets the force-break steer. If a model legitimately writes repetitive payloads, raise `degenerateMaxRun` / `degenerateMaxFreq` via `/antiloop config` — don't disable the detector.
 8. **Outcome detector catches mutated re-run loops** — a model that re-issues the same experiment with cosmetic changes (labels, permutations) while every attempt fails identically gets a warning after `outcomeMinRepeats` (8) same-failure attempts, a steer on the next, and a hard stop shortly after. Converging sweeps, evolving failures and repeated successes stay silent by design. Lower `outcomeMinRepeats` if you want earlier cutoffs.
 9. **Block detector catches narration loops** — a single message replaying whole sentences (the `Let me start by checking the environment…` ×5 class) warns on first sight and escalates like a meltdown. It only fires when ≥ 85% of the message's 5-word phrases recur, so ordinary prose and templated logs/code stay silent. Raise `blockRepeatShare` (or `blockMinRepeats`) if you ever see a false positive.
 10. **`/antiloop test`** — runs the real detection engine (text + tool-call + task-stream + degenerate + block + outcome regression cases) to verify calibration after any change.
@@ -555,4 +581,4 @@ Modular extension with zero external dependencies (only pi's bundled `@earendil-
 
 ## License
 
-[MIT](LICENSE) © Javier Noguerol
+[MIT](LICENSE) © antiloop contributors

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-antiloop",
-  "version": "1.7.0",
-  "description": "Antiloop: detect reasoning loops and force a break (warn → force → abort) across text, tool, thinking, structural, degenerate-repetition, block/narration-repetition, and no-progress outcome patterns. Degenerate (one message stuck repeating a word hundreds of times — noguerol ×5145) is caught at message_end and its bash blocked before executing. Block (ONE message replaying whole sentences/phrases — the 'Let me start by checking the environment…' ×5 narration loop, invisible to every cross-message detector because there is no peer) fires on the first such message with the same strong turn weight and blocks a replayed bash command. No-progress (the NFS test-A…QQQ class: ~90 mutated re-runs of the same experiment, every one failing identically) fires when the same failing outcome repeats ≥ outcomeMinRepeats times with near-identical args. Fixes antiloop going blind mid-session: tracked messages use a monotonic sequence so the trim of the sliding window can never collide turn indices. The force break is delivered mid-run (steer before the next LLM call) and if the model ignores it antiloop aborts the run — an autonomous tool loop always terminates. Result-aware tool-loop detection keeps sequential bash and converging sweeps quiet; task-stream recognition keeps punched/plan batch work quiet.",
+  "version": "1.8.1",
+  "description": "Antiloop: detect reasoning loops and force a break (warn → force → abort) across text, tool, thinking, structural, degenerate-repetition, block/narration-repetition, and no-progress outcome patterns. Degenerate (one message stuck repeating a word hundreds of times — lorem ×5145) is caught at message_end and its bash blocked before executing. Block (ONE message replaying whole sentences/phrases — the 'Let me start by checking the environment…' ×5 narration loop, invisible to every cross-message detector because there is no peer) fires on the first such message with the same strong turn weight and blocks a replayed bash command. No-progress (the NFS test-A…QQQ class: ~90 mutated re-runs of the same experiment, every one failing identically) fires when the same failing outcome repeats ≥ outcomeMinRepeats times with near-identical args. Snapshot tools (trimegisto_harvest) are exempt: a coordinator closing N settled agents re-reads the SAME board serially, which is an idempotent read, not a loop — so isVerbatimRepeat never fires on it. Fixes antiloop going blind mid-session: tracked messages use a monotonic sequence so the trim of the sliding window can never collide turn indices. The force break is delivered mid-run (steer before the next LLM call) and if the model ignores it antiloop aborts the run — an autonomous tool loop always terminates. Result-aware tool-loop detection keeps sequential bash and converging sweeps quiet; task-stream recognition keeps punched/plan batch work quiet.",
   "keywords": [
     "pi-package",
     "antiloop",
@@ -9,7 +9,7 @@
     "reasoning",
     "monitoring"
   ],
-  "author": "Javier Noguerol <https://github.com/noguerol>",
+  "author": "antiloop contributors",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/commands.ts

@@ -62,6 +62,7 @@ async function showStatus(ctx: ExtensionCommandContext, rt: Runtime): Promise<vo
 		`  block repeats: ${yn(rt.config.detectBlockRepeats)} (≥ ${(rt.config.blockRepeatShare * 100).toFixed(0)}% of ≥ ${rt.config.blockMinTokens} tokens replay ${rt.config.blockNgram}-grams ×${rt.config.blockMinRepeats}+)`,
 		`  outcome: same failing result ≥ ${rt.config.outcomeMinRepeats} attempts (args ≥ ${(rt.config.outcomeArgSimilarity * 100).toFixed(0)}% sim, sig ≥ ${(rt.config.outcomeSigThreshold * 100).toFixed(0)}%)`,
 		`  task streams: ${yn(rt.config.detectTaskStreams)} (min ${rt.config.taskStreamMinCalls} calls, twins ≥ ${(rt.config.taskStreamTwinThreshold * 100).toFixed(0)}%)`,
+		`  snapshot tools: ${rt.config.snapshotTools?.length ? rt.config.snapshotTools.join(", ") : "off"} (repeated reads are not a loop)`,
 		"",
 		`detectors: text ${yn(rt.config.detectTextLoops)} · tool ${yn(rt.config.detectToolLoops)} · think ${yn(rt.config.detectThinkingLoops)} · degenerate ${yn(rt.config.detectDegenerate)} · block ${yn(rt.config.detectBlockRepeats)} · outcome ${yn(rt.config.detectOutcomeLoops)}`,
 		`footer: interactive ${yn(rt.config.interactiveFooter)} · toggle: ${rt.config.toggleShortcut}`,
@@ -95,7 +96,7 @@ async function showConfigMenu(ctx: ExtensionCommandContext, rt: Runtime): Promis
 		{ value: "toolRepeat" as const, label: `🔁 call repeats: ${c.minToolRepeatCount}+`, description: "how many times the same call must repeat before it flags" },
 		{ value: "resultSim" as const, label: `🧾 result similarity: ${(c.resultSimilarityThreshold * 100).toFixed(0)}%`, description: "same command + different result = progress, not a loop" },
 		// ── 🌀 Degenerate (intra-message meltdown) ───────────────────────
-		{ value: "degRun" as const, label: `🌀 degenerate run: ≥ ${c.degenerateMaxRun}`, description: "identical words in a row inside ONE message/call before it counts as stuck generation (noguerol ×5145 class)" },
+		{ value: "degRun" as const, label: `🌀 degenerate run: ≥ ${c.degenerateMaxRun}`, description: "identical words in a row inside ONE message/call before it counts as stuck generation (lorem ×5145 class)" },
 		{ value: "blk" as const, label: `🔁 block repetition: ${yn(c.detectBlockRepeats)}`, description: "ONE message replaying whole sentences/phrases (the narration loop: 'Let me start by checking…' ×5)" },
 		{ value: "blkShare" as const, label: `🔁 block share: ≥ ${(c.blockRepeatShare * 100).toFixed(0)}%`, description: "share of replayed 5-word phrases in one message before it counts as a replay" },
 		{ value: "degBlock" as const, label: `⛔ block repetitive bash: ${yn(c.blockDegenerateBash)}`, description: "stop a degenerate or replayed command before it executes (default on)" },
@@ -105,6 +106,7 @@ async function showConfigMenu(ctx: ExtensionCommandContext, rt: Runtime): Promis
 		{ value: "streams" as const, label: `📋 task streams: ${yn(c.detectTaskStreams)}`, description: "batch work (punched_log / plan_manager / …) is not a loop" },
 		{ value: "streamMin" as const, label: `📋 stream min calls: ${c.taskStreamMinCalls}`, description: "calls of the same tool before a batch is recognized" },
 		{ value: "streamTwin" as const, label: `📋 twin threshold: ${(c.taskStreamTwinThreshold * 100).toFixed(0)}%`, description: "calls more similar than this = the same task repeated, not a batch" },
+		{ value: "snapshot" as const, label: `📡 snapshot tools: ${c.snapshotTools?.length ? c.snapshotTools.join(", ") : "off"}`, description: "read-only status tools (trimegisto_harvest): re-reading settled agents serially is not a loop" },
 		// ── 🔍 Detectors ────────────────────────────────────────────
 		{ value: "text" as const, label: `📝 text: ${yn(c.detectTextLoops)}`, description: "detect repeated text messages" },
 		{ value: "tool" as const, label: `🔧 tools: ${yn(c.detectToolLoops)}`, description: "detect repeated tool calls" },
@@ -277,6 +279,18 @@ async function showConfigMenu(ctx: ExtensionCommandContext, rt: Runtime): Promis
 			if (v !== undefined) { c.taskStreamTwinThreshold = v; saveConfig(c); ctx.ui.notify(`twin threshold: ${(v * 100).toFixed(0)}%`, "info"); }
 			break;
 		}
+		case "snapshot": {
+			const v = await selectFrom(ctx, "📡 snapshot / read-only tools (repeated identical reads are never a loop)", [
+				{ value: "default" as const, label: "🎯 trimegisto_harvest (default)", description: "serial close of settled agents: same args + same snapshot ×N stays silent" },
+				{ value: "off" as const, label: "🚫 off", description: "treat every tool identically (harvest can loop-flag again)" },
+			]);
+			if (v !== undefined) {
+				c.snapshotTools = v === "off" ? [] : ["trimegisto_harvest"];
+				saveConfig(c);
+				ctx.ui.notify(`snapshot tools: ${c.snapshotTools.length ? c.snapshotTools.join(", ") : "off"}`, "info");
+			}
+			break;
+		}
 		case "ignoredBreak": {
 			const v = await selectFrom(ctx, "🛑 stop after ignored break (identical repeats after the force break)", [
 				{ value: 1, label: "⚡ 1 (sensitive — one identical repeat after the break stops the run)" },

package/src/config.ts

@@ -36,6 +36,7 @@ export const DEFAULT_CONFIG: AntiloopConfig = {
 	detectTaskStreams: true,
 	taskStreamMinCalls: 3,
 	taskStreamTwinThreshold: 0.99,
+	snapshotTools: ["trimegisto_harvest"],
 	detectToolLoops: true,
 	detectThinkingLoops: true,
 	detectTextLoops: true,

package/src/detect.ts

@@ -37,9 +37,9 @@ function opening(text: string, n = 10): string {
 // ---------------------------------------------------------------------------
 // Intra-message degenerate repetition (v1.6).
 //
-// The "noguerol ×5145" class (verified against a real session — /home/j
-// 2026-09-09T15-43: ONE 46 KB bash call whose SSH username list repeats a
-// single word 5145 times, a run of 5140 — 99% of the payload). A model whose
+// The "lorem ×5145" class (verified against a real session: ONE 46 KB bash
+// call whose argument list repeats a single word 5145 times, a run of 5140 —
+// 99% of the payload). A model whose
 // decoder anchors on a token stops producing NEW output: it repeats the same
 // word hundreds of times INSIDE one message or tool call. The cross-message
 // detectors (text / tool / thinking / structural) all need >= 2 similar
@@ -132,7 +132,7 @@ export function findDegenerateRepetition(
 		}
 	}
 
-	// No-space meltdown: one giant periodic token ("noguerolnoguerol…" with all
+	// No-space meltdown: one giant periodic token ("loremlorem…" with all
 	// separators stripped) is a perfect power of a short motif. Independent of
 	// the token-count gate: a single 1200+ char token has no word runs at all.
 	if (raw.length <= 2) {
@@ -400,7 +400,7 @@ function failSig(fp: string): string | undefined {
 /** Same-FAILURE comparison for the outcome detector. Prefers the embedded error
  * signatures (they repeat across attempts of the same failure) with digits
  * stripped — timestamps, PIDs and rc values are noise; the target words that
- * legitimately vary between attempts (Javi vs Compartido) survive but the
+ * legitimately vary between attempts (e.g. distinct mount targets) survive but the
  * threshold is looser than the veto threshold on purpose. Falls back to the
  * full fingerprints when no signature is present. */
 function sameFailure(a: string, b: string, threshold: number): boolean {
@@ -495,6 +495,28 @@ export function detectTaskStreams(
 	return streams;
 }
 
+// ---------------------------------------------------------------------------
+// Snapshot / read-only tools (v1.8).
+//
+// A coordinator closing N agents that already finished calls the snapshot tool
+// once per agent and gets the SAME serialized board every time (all settled).
+// Same args + same result looks exactly like a verbatim tool loop to the
+// detector, but re-reading a state snapshot is an idempotent read — the serial
+// close of finished work, not a stuck generation. Tools listed in
+// config.snapshotTools (default: trimegisto_harvest) are therefore exempt from
+// tool-loop and outcome detection. Any other status/poll tool can be added.
+// ---------------------------------------------------------------------------
+
+/** Set of tool names whose repeated identical reads must never count as a loop. */
+function snapshotToolSet(config: AntiloopConfig): Set<string> {
+	return new Set((config.snapshotTools ?? []).map((n) => n.trim()).filter(Boolean));
+}
+
+/** True when every call in the set is a snapshot/status read. */
+function allSnapshotCalls(calls: TrackedToolCall[] | undefined, snapshots: Set<string>): boolean {
+	return !!calls && calls.length > 0 && calls.every((c) => snapshots.has(c.name));
+}
+
 export function detectLoops(state: AntiloopState, config: AntiloopConfig): LoopDetection[] {
 	const out: LoopDetection[] = [];
 	const msgs = state.recentMessages;
@@ -543,6 +565,7 @@ export function detectLoops(state: AntiloopState, config: AntiloopConfig): LoopD
 	// detections that only involve batch messages are suppressed too — the
 	// model is doing N different tasks of the same type, not looping.
 	const streams = detectTaskStreams(win, config);
+	const snapshots = snapshotToolSet(config);
 	const batchAt = new Set<number>();
 	win.forEach((m, idx) => {
 		const calls = m.toolCalls;
@@ -596,7 +619,10 @@ export function detectLoops(state: AntiloopState, config: AntiloopConfig): LoopD
 		const lastCalls = last.toolCalls;
 		// A message whose calls are all task-stream tools is batch work — skip
 		// it entirely (the stream gate already proved the calls are distinct).
-		if (lastCalls && lastCalls.length && !batchAt.has(msgs.length - 1)) {
+		// Snapshot/status tools (trimegisto_harvest…) are also skipped: repeated
+		// identical reads of a settled board are the serial close of finished
+		// agents, not a loop.
+		if (lastCalls && lastCalls.length && !batchAt.has(msgs.length - 1) && !allSnapshotCalls(lastCalls, snapshots)) {
 			const matched: number[] = [];
 			for (let i = 0; i < win.length - 1; i++) {
 				const prev = win[i].toolCalls;
@@ -622,8 +648,8 @@ export function detectLoops(state: AntiloopState, config: AntiloopConfig): LoopD
 	// -------------------------------------------------------------------
 	// No-progress outcome runs (v1.6.1).
 	//
-	// The NFS-test session (/home/j 2026-09-09, rows 95–249): ~90 mutated
-	// re-runs of the SAME experiment (sshpass+sudo+exportfs+mount, labels
+	// The NFS-test session (rows 95–249): ~90 mutated re-runs of the SAME
+	// experiment (ssh/sudo/exportfs/mount, labels
 	// "test A"…"test QQQ"), every one failing identically (rc=32 / access
 	// denied). The tool-loop detector is blind to it BY DESIGN: args mutate
 	// every turn (mean adjacent trigram similarity 0.93, but the label always
@@ -654,7 +680,9 @@ export function detectLoops(state: AntiloopState, config: AntiloopConfig): LoopD
 			// produce the SAME OK outcome every call — they must never count. And
 			// batch messages must NOT be skipped here: a "bash ×N stream" with
 			// identical failures is exactly the no-progress loop to catch.
-			if (lc.result && isFailResult(lc.result)) {
+			// Snapshot/status reads are excluded outright: an identical harvest
+			// snapshot is a state read, not a repeated failing experiment.
+			if (lc.result && isFailResult(lc.result) && !snapshots.has(lc.name)) {
 				let matches = 0;
 				for (let i = 0; i < win.length - 1; i++) {
 					const m = win[i];
@@ -749,12 +777,12 @@ export function runSelfTest(): string[] {
 
 	// --- tool calls (default thresholds: 95% args similarity, 2 prior repeats) ---
 	const common =
-		"cd /home/j/llm && ulimit -l unlimited 2>/dev/null; export ROCBLAS_USE_HIPBLASLT=1 HIP_VISIBLE_DEVICES=1; " +
-		"setsid ./kingjones30-boosted/build-unroll/bin/llama-server " +
-		"-m /home/j/llm/ling-rocmfp4/Ling-3.0-flash-ROCmFP4-STRIX-MTP-Q4_0-00001-of-00002.gguf " +
-		"-dev ROCm0 -ngl 999 -fa on -c 8192 -fit off -np 1 -sm row -ub 2048 " +
+		"cd /srv/work && ulimit -l unlimited 2>/dev/null; export GPU_WORKAROUND=1 ACCELERATOR_VISIBLE=0; " +
+		"setsid ./llama.cpp/build/bin/llama-server " +
+		"-m /srv/models/example-model-q4.gguf " +
+		"-dev GPU0 -ngl 999 -fa on -c 8192 -fit off -np 1 -sm row -ub 2048 " +
 		"--spec-type draft-mtp --spec-draft-n-max 2 --spec-draft-n-min 0 --spec-draft-p-min 0.4 " +
-		"--reasoning off --jinja --host 127.0.0.1 --port 8093 --no-webui";
+		"--reasoning off --jinja --host 127.0.0.1 --port 8080 --no-webui";
 	const sweepRun1 = `${common} -b 2048 -ctk q8_0 -ctv turbo4 > /tmp/sweep-turbo4.log 2>&1 & echo $!; sleep 60; grep "model loaded" /tmp/sweep-turbo4.log`;
 	const sweepRun2 = `${common} -b 8192 -ctk f16 -ctv f16 > /tmp/sweep-b8192.log 2>&1 & echo $!; sleep 70; grep "model loaded" /tmp/sweep-b8192.log`;
 
@@ -770,9 +798,9 @@ export function runSelfTest(): string[] {
 	out.push(`tool empty lists    → ${t4 ? "match" : "no match"} (exp no match) ${!t4 ? "✅" : "❌"}`);
 
 	// --- result veto: same command, different outcome = progress, not a loop ---
-	const rErr = resultFingerprint([{ type: "text", text: "error: invalid argument: ROCm0\nPID 74970" }], true)!;
-	const rErr2 = resultFingerprint([{ type: "text", text: "error: invalid argument: ROCm0\nPID 77788" }], true)!;
-	const rOk = resultFingerprint([{ type: "text", text: "model loaded\nserver is listening on http://127.0.0.1:8093" }], false)!;
+	const rErr = resultFingerprint([{ type: "text", text: "error: invalid argument: GPU0\nPID 74970" }], true)!;
+	const rErr2 = resultFingerprint([{ type: "text", text: "error: invalid argument: GPU0\nPID 77788" }], true)!;
+	const rOk = resultFingerprint([{ type: "text", text: "model loaded\nserver is listening on http://127.0.0.1:8080" }], false)!;
 	const sameCmdSameOut = toolCallsSimilar(
 		[{ name: "bash", args: sweepRun1, result: rErr }],
 		[{ name: "bash", args: sweepRun1, result: rErr2 }],
@@ -802,6 +830,7 @@ export function runSelfTest(): string[] {
 		detectTextLoops: true, notifyOnDetection: true, maxHistoryEntries: 100,
 		detectionWindow: 10, interactiveFooter: true, toggleShortcut: "esc+a",
 		detectTaskStreams: true, taskStreamMinCalls: 3, taskStreamTwinThreshold: 0.99,
+		snapshotTools: ["trimegisto_harvest"],
 		detectDegenerate: true, degenerateMinTokens: 50, degenerateMaxRun: 16,
 		degenerateMaxFreq: 60, degenerateMaxShare: 0.4, degenerateTurnWeight: 2, blockDegenerateBash: true,
 		detectBlockRepeats: true, blockMinTokens: 120, blockNgram: 5, blockMinRepeats: 3, blockRepeatShare: 0.85,
@@ -867,13 +896,13 @@ export function runSelfTest(): string[] {
 	out.push(`structural 0.90           → ${isVerbatimRepeat(dl("structural", 0.9)) ? "yes" : "no"} (exp no) ${!isVerbatimRepeat(dl("structural", 0.9)) ? "✅" : "❌"}`);
 
 	// --- v1.6: intra-message degenerate repetition (single-message meltdown) ---
-	// Regression: the real session /home/j 2026-09-09T15-43 — ONE 46 KB bash call
-	// whose username list repeats "noguerol" 5145 times (run of 5140). Every
-	// cross-message detector needs a peer message and stayed silent; the
+	// Regression: ONE 46 KB bash call whose argument list repeats "lorem" 5145
+	// times (run of 5140) — verified against a real stuck-generation session.
+	// Every cross-message detector needs a peer message and stayed silent; the
 	// degenerate scan must fire on the FIRST such message, alone in the window.
 	const argJson = (cmd: string) => JSON.stringify({ command: cmd }); // stored args form
 	const meltdownCmd =
-		`echo "=== brute usernames with petete pw ==="; for u in noguerol noguerol@ j javi javi@ root petete ${`noguerol `.repeat(400)}; do :; done`;
+		`echo "=== brute usernames ==="; for u in alice alice@ j bob bob@ root carol ${`lorem `.repeat(400)}; do :; done`;
 	const meltMsg = mk("", [{ name: "bash", args: argJson(meltdownCmd) }]);
 	const mDet = detectLoops(asState([meltMsg]), tcfg);
 	const mHit = mDet.find((d) => d.type === "degenerate");
@@ -893,17 +922,17 @@ export function runSelfTest(): string[] {
 	out.push(`degenerate legit cmd      → ${leg1 || leg2 || leg3 ? "flag" : "ok"} (exp ok) ${!leg1 && !leg2 && !leg3 ? "✅" : "❌"}`);
 
 	// Interleaved meltdown ("A B A B…") has no long run — caught via freq/share.
-	const inter = findDegenerateRepetition("noguerol petete ".repeat(150), tcfg);
+	const inter = findDegenerateRepetition("lorem ipsum ".repeat(150), tcfg);
 	out.push(`degenerate interleaved    → ${inter ? `flag (${inter.token} ×${inter.freq})` : "no"} (exp flag — freq/share clause) ${inter ? "✅" : "❌"}`);
 
 	// Word list written ACROSS lines: separators are the literal "\n" escapes
 	// inside the stored JSON args — must still tokenize word by word.
-	const acrossLines = argJson("for u in " + "noguerol\n".repeat(120) + "done");
+	const acrossLines = argJson("for u in " + "lorem\n".repeat(120) + "done");
 	const linesHit = findDegenerateRepetition(acrossLines, tcfg);
 	out.push(`degenerate across \n      → ${linesHit ? `flag (${linesHit.token} ×${linesHit.freq})` : "no"} (exp flag — escaped newlines) ${linesHit ? "✅" : "❌"}`);
 
-	// No-space giant token ("noguerol" glued) — perfect-power clause.
-	const glued = findDegenerateRepetition("noguerol".repeat(300), tcfg);
+	// No-space giant token ("lorem" glued) — perfect-power clause.
+	const glued = findDegenerateRepetition("lorem".repeat(300), tcfg);
 	out.push(`degenerate glued token    → ${glued ? `flag (${glued.token} ×${glued.freq})` : "no"} (exp flag — perfect power) ${glued ? "✅" : "❌"}`);
 
 	// Turn weight: one degenerate turn = 2 consecutive points (warning on first
@@ -964,15 +993,15 @@ export function runSelfTest(): string[] {
 
 	// --- v1.6.1: no-progress outcome runs (mutated re-runs, same outcome) ---
 	// Regression: the NFS session — ~90 mutated re-runs of the SAME experiment
-	// (ssh exportfs/mount, labels test A…test QQQ, targets alternating Javi /
-	// Compartido), every one failing rc=32. Args mutate each turn (same call
+	// (ssh exportfs/mount, labels test A…test QQQ, targets alternating
+	// data-a / data-b), every one failing rc=32. Args mutate each turn (same call
 	// never recurs → tool-loop silent) and journalctl noise varies per attempt,
 	// but the FAILURE SIGNATURE repeats: that IS the loop. Fires on the 9th
 	// attempt (8 prior same-failure matches ≥ outcomeMinRepeats).
 	const nfsCmd = (label: string, target: string) =>
 		argJson(
-			`sshpass -p X ssh -o ConnectTimeout=10 noguerol@petete 'cd /tmp && echo X | sudo -S bash -c "echo --- test ${label}: rootdir=/volume2, absolute paths, fsid=0 and 1, mount /${target} ---; ` +
-			`cat > /etc/exports << EOF\n/volume2/NAS-8TB-Javi *(rw,sync,no_subtree_check,fsid=0)\nEOF\nexportfs -ra\nsystemctl restart nfs-server\n` +
+			`sshpass -p X ssh -o ConnectTimeout=10 user@host 'cd /tmp && echo X | sudo -S bash -c "echo --- test ${label}: rootdir=/volume/data, absolute paths, fsid=0 and 1, mount /${target} ---; ` +
+			`cat > /etc/exports << EOF\n/volume/data *(rw,sync,no_subtree_check,fsid=0)\nEOF\nexportfs -ra\nsystemctl restart nfs-server\n` +
 			`mount -t nfs4 -o vers=4.2 127.0.0.1:/${target} /tmp/nfstest 2>&1; echo rc=\$?; journalctl -u nfs-mountd | tail -4"' 2>&1`,
 		);
 	const nfsFailFor = (target: string, sec: number) =>
@@ -982,13 +1011,13 @@ export function runSelfTest(): string[] {
 					type: "text",
 					text:
 						`--- mount /${target} --- | mount.nfs4: access denied by server while mounting 127.0.0.1:/${target} rc=32 | ` +
-						`Sep 09 18:${sec} petete systemd[1]: Started nfs-mountd.service (PID ${1000 + sec})`,
+						`Sep 09 18:${sec} host systemd[1]: Started nfs-mountd.service (PID ${1000 + sec})`,
 				},
 			],
 			false,
 		)!;
 	const nfsOk = resultFingerprint([{ type: "text", text: "rc=0 | TARGET SOURCE FSTYPE | /tmp/nfstest 127.0.0.1:/  nfs4  rw,relatime" }], false)!;
-	const targets = ["NAS-8TB-Javi", "NAS-8TB-Compartido"];
+	const targets = ["data-a", "data-b"];
 	const nfsMsgs = [..."ABCDEFGHI"].map((l, idx) =>
 		mk("", [{ name: "bash", args: nfsCmd(l, targets[idx % 2]), result: nfsFailFor(targets[idx % 2], 100 + idx) }]),
 	);
@@ -1052,5 +1081,32 @@ export function runSelfTest(): string[] {
 	out.push(`outcome identical OKs     → ${okDet.some((d) => d.type === "outcome") ? "outcome" : "silent"} (exp silent — success repeats ≠ loop) ${!okDet.some((d) => d.type === "outcome") ? "✅" : "❌"}`);
 	out.push(`isFailResult gate         → err| → ${isFailResult("err|boom") ? "fail" : "ok"}, rc32 → ${isFailResult("ok|rc32 denied") ? "fail" : "ok"}, rc0/ok → ${isFailResult("ok|rc 0 12 passed") ? "fail" : "ok"} (exp fail, fail, ok) ${isFailResult("err|boom") && isFailResult("ok|rc32 denied") && !isFailResult("ok|rc 0 12 passed") ? "✅" : "❌"}`);
 
+	// --- v1.8: snapshot/read-only tools are idempotent reads, not loops ---
+	// Regression (verified against a real session): a coordinator closed
+	// N agents that had ALREADY settled by calling trimegisto_harvest five times
+	// with `{}`; every call returned the SAME 2.3 KB cumulative snapshot (all
+	// agents done). Same args + same result ×5 → the tool detector force-broke
+	// the run. Re-reading a settled state board is the serial close of finished
+	// agents, not a stuck generation: with the snapshot exemption it is silent.
+	const harvestSnap = resultFingerprint(
+		[{
+			type: "text",
+			text:
+				"## Trimegisto harvest (instant snapshot)\n\n### ✅ t0a [Active] — done (101s)\nTask: Explora el sistema en busca de LM Studio y sus runtimes.\n\n```\n# Informe: LM Studio en el sistema\n...\n```\n*10 turns, ↑32825 ↓2429*\n\n_All agents settled._",
+		}],
+		false,
+	)!;
+	const harvestMsgs = [0, 1, 2, 3, 4].map(() =>
+		mk("", [{ name: "trimegisto_harvest", args: "{}", result: harvestSnap }]),
+	);
+	const snapDet = detectLoops(asState(harvestMsgs), tcfg);
+	out.push(`snapshot harvest ×5       → ${snapDet.length ? snapDet.map((d) => d.type).join(",") : "silent"} (exp silent — serial close of settled agents) ${snapDet.length === 0 ? "✅" : "❌"}`);
+
+	// Guard: the exemption is what silences it — the SAME payload with
+	// snapshotTools off is a genuine verbatim tool loop.
+	const noSnapCfg: AntiloopConfig = { ...tcfg, snapshotTools: [] };
+	const snapLoud = detectLoops(asState(harvestMsgs), noSnapCfg);
+	out.push(`snapshot off = loop       → ${snapLoud.some((d) => d.type === "tool") ? "tool" : "no"} (exp tool — normal tools still loop) ${snapLoud.some((d) => d.type === "tool") ? "✅" : "❌"}`);
+
 	return out;
 }

package/src/index.ts

@@ -18,7 +18,7 @@
  *
  * v1.6 adds the intra-message degenerate detector: a model whose decoder
  * anchors on a token repeats it hundreds of times INSIDE one message / tool
- * call (the real 46 KB bash "noguerol ×5145" meltdown). That needs no peer
+ * call (the real 46 KB bash "lorem ×5145" meltdown). That needs no peer
  * message, so it is caught at message_end — BEFORE the tool calls execute —
  * and degenerate bash commands are additionally blocked in the tool_call
  * hook (blockDegenerateBash). One degenerate turn counts degenerateTurnWeight
@@ -294,7 +294,7 @@ export default function antiloopExtension(pi: ExtensionAPI) {
 
 		// v1.6/v1.7 — intra-message repetition is handled HERE, at message_end,
 		// because turn_end only fires after tool execution (too late to stop the
-		// 46 KB "noguerol ×5000" bash from running) and an aborted generation may
+		// 46 KB "lorem ×5000" bash from running) and an aborted generation may
 		// never reach turn_end at all. The signal is self-contained (one
 		// pathological payload, no peer message) so the full escalation ladder runs
 		// right now; the turn-guard makes the later turn_end pass skip this message
@@ -404,7 +404,7 @@ export default function antiloopExtension(pi: ExtensionAPI) {
 
 	/**
 	 * v1.6 — degenerate bash gate. A meltdown message whose command repeats one
-	 * word hundreds of times (the 46 KB "noguerol ×5145" SSH-wordlist brute
+	 * word hundreds of times (the 46 KB "lorem ×5145" argument-wordlist brute
 	 * force) must NEVER execute: it is pure context burn at best, and a real
 	 * brute-force / destructive repetition at worst. message_end already
 	 * escalated it; here we block the actual call before it runs. The block

package/src/types.ts

@@ -17,7 +17,7 @@ export interface AntiloopConfig {
 	 */
 	ignoredSteerLimit: number;
 	/**
-	 * Intra-message degenerate repetition (the "noguerol \u00d75145" meltdown class): a model
+	 * Intra-message degenerate repetition (the "lorem \u00d75145" meltdown class): a model
 	 * stuck emitting the same token hundreds of times INSIDE one message / tool call.
 	 * Unlike the other detectors it needs no peer message: one pathological payload is
 	 * already conclusive. Fires on the first occurrence; each degenerate turn is weighted
@@ -109,6 +109,18 @@ export interface AntiloopConfig {
 	detectTaskStreams: boolean;
 	taskStreamMinCalls: number;
 	taskStreamTwinThreshold: number;
+	/**
+	 * Read-only snapshot/status tools (default: ["trimegisto_harvest"]). These
+	 * return a view of changing state (a list of agents, a queue, a dashboard).
+	 * Calling one again with the SAME arguments is an idempotent read — most
+	 * strikingly when a coordinator closes N agents that already settled and the
+	 * serialized snapshot is byte-identical every time. That is the serial close
+	 * of finished agents, not a reasoning loop, so repeated calls to a snapshot
+	 * tool never count as a tool loop (nor as a no-progress outcome run). Names
+	 * are matched exactly against the tool name; add any other status/poll tool
+	 * here to keep antiloop quiet while it is read repeatedly.
+	 */
+	snapshotTools: string[];
 	detectToolLoops: boolean;
 	detectThinkingLoops: boolean;
 	detectTextLoops: boolean;