pi-makora-provider 1.5.0 → 1.7.0

package/README.md

@@ -160,20 +160,27 @@ Do **not** edit `models.json` directly — it is auto-generated from the API. To
 
 ## Death-Loop Guard
 
-GLM 5.2 (NVFP4 / FP8) occasionally degenerates into an unbroken `!` repetition
-loop (`!!!!...`) that eats the whole response. This extension ships a guard
-that watches the streamed assistant output (both the visible answer and the
-reasoning trace) and, when it detects a long run of `!` characters, **aborts
+GLM 5.2 (NVFP4 / FP8) occasionally degenerates into a repetition loop — an
+unbroken run of a single character or token, spaced or not (observed: `!` →
+`!!!!...`, `0` → `0000...`, and `0` → `0 0 0 ...`) — that eats the whole
+response. This extension ships a guard that watches the streamed assistant
+output (both the visible answer and the reasoning trace) and, when it detects a
+long run of any one non-whitespace character **or token**, **aborts
 the runaway generation and resumes the agentic loop invisibly** — no new user
 message is injected, using the
 [pi-invisible-continue](https://github.com/monotykamary/pi-invisible-continue)
 pattern (`agent.prompt([])`).
 
 On abort, pi finalizes the in-flight assistant message **with its accumulated
-`!!!` content** into the transcript, so the guard drops that partial message
-before resuming — otherwise the model would just re-read its own `!!!` and loop
-again. The recovery is bounded per prompt (default 3 attempts) to avoid
-abort/continue thrash.
+repeated-character content** into the transcript, so the guard drops that
+partial message before resuming — otherwise the model would just re-read its
+own repeated text and loop again. Recovery retries **indefinitely with exponential backoff (2s→60s,
+2×)**, like [pi-retry](https://github.com/monotykamary/pi-retry) — long-horizon
+agent work can trip the loop many times in a session, so a retry cap would
+strand the agent mid-task. The loop exits only on a clean turn, a user abort
+(Esc), or a session change (`/new`, `/resume`). Backoff is interruptible
+(polls every 100ms) so Esc and `/new` take effect within 100ms instead of
+waiting out the full delay.
 
 The guard is scoped to the Makora GLM 5.2 family by default and is tunable via
 constants at the top of [`death-loop-guard.ts`](./death-loop-guard.ts):
@@ -181,8 +188,13 @@ constants at the top of [`death-loop-guard.ts`](./death-loop-guard.ts):
 | Constant | Default | Meaning |
 |---|---|---|
 | `GUARDED_MODEL_IDS` | `zai-org/GLM-5.2-NVFP4`, `zai-org/GLM-5.2-FP8` | Which model IDs to guard. Add `'*'` to guard every Makora model. |
-| `BANG_THRESHOLD` | `40` | Consecutive `!` characters that trip the guard. 40 is far above anything normal prose/code produces. |
-| `MAX_RECOVERS_PER_RUN` | `3` | Max invisible recoveries per user prompt before the guard stops intervening. |
+| `REPEAT_THRESHOLD` | `40` | Consecutive identical characters that trip the guard. Applies to any non-whitespace character (whitespace can legitimately repeat). 40 is far above anything normal prose/code produces. (`BANG_THRESHOLD` is kept as a deprecated alias.) |
+| `IGNORED_REPEAT_CHARS` | `space, tab, LF, CR, FF, VT` | Characters whose repetition never trips the guard. |
+| `TOKEN_REPEAT_THRESHOLD` | `40` | Consecutive identical whitespace-delimited tokens that trip the guard. Catches spaced loops like `0 0 0` that the character run can't see. |
+| `TOKEN_REPEAT_BUFFER_CHARS` | `1024` | Tail length kept for token-run detection. Must hold ≥ `TOKEN_REPEAT_THRESHOLD` copies of the repeated unit. |
+| `BACKOFF_BASE_MS` | `2000` | Initial recovery backoff delay. |
+| `BACKOFF_MAX_MS` | `60000` | Maximum backoff delay (cap). |
+| `BACKOFF_MULTIPLIER` | `2` | Backoff growth factor per retry. |
 
 It is only active for the `makora` provider, so it never interferes when you
 switch to another provider. If you also run `pi-invisible-continue`, the two

package/death-loop-guard.ts

@@ -2,13 +2,24 @@
  * Death-loop guard for Makora reasoning models.
  *
  * Some Makora models (notably GLM 5.2 NVFP4 / FP8) occasionally fall into a
- * degenerate repetition loop, emitting an unbroken run of '!' characters
- * (e.g. "!!!!...") that consumes the whole response. This guard watches the
+ * degenerate repetition loop, emitting an unbroken run of a single character
+ * (observed: '!' -> "!!!!..." and '0' -> "0000...") or a repeated token
+ * (observed: '0' -> "0 0 0 ...") that consumes the whole response. This guard
+ * watches the
  * streamed assistant output (both the visible answer and the reasoning
  * trace); when that run is detected it aborts the runaway generation, drops
  * the partial (toxic) assistant message from the transcript, and resumes the
  * agentic loop invisibly via agent.prompt([]) — the same pattern
- * pi-invisible-continue uses, so no new user message pollutes the context.
+ * pi-invisible-continue / pi-retry uses, so no new user message pollutes the
+ * context.
+ *
+ * Infinite retries with exponential backoff. Long-horizon agent work can trip
+ * the loop many times in one session; capping retries would strand the agent
+ * mid-task. Instead the recovery loops indefinitely (like pi-retry) until the
+ * model produces a clean turn, the user aborts (Esc), or the session changes
+ * (/new, /resume). Backoff (2s→60s, 2×) paces retries and gives the user a
+ * window to intervene; interruptible sleep polls every 100ms so Esc and /new
+ * take effect within 100ms instead of waiting out the full delay.
  *
  * Why trim the aborted message: on abort, pi finalizes the in-flight
  * assistant message WITH its accumulated '!!!' content and stopReason
@@ -17,6 +28,14 @@
  * last (aborted) assistant message leaves the context ending at the prior
  * user/toolResult message — a clean continuation point.
  *
+ * Distinguishing our abort from a user Esc: both call agent.abort(), so both
+ * surface as stopReason "aborted" at turn_end. The handler sets _weAborted
+ * before aborting; turn_end only treats an abort as user-initiated (setting
+ * _userAborted to exit the loop) when _weAborted is false. Caveat: if the
+ * user hits Esc in the ~ms between our trip and the abort completing, the
+ * abort is mis-attributed to us and one unwanted retry fires. The backoff
+ * window lets the user Esc again, which then works normally.
+ *
  * Module resolution: @earendil-works/pi-agent-core is a devDependency only
  * (types + test resolution). At runtime pi's extension loader aliases that
  * specifier to its bundled copy, so the Agent class patched below is the
@@ -38,12 +57,63 @@ export const GUARDED_MODEL_IDS = new Set<string>([
   "zai-org/GLM-5.2-FP8",
 ]);
 
-/** Trip after this many consecutive '!' characters in the streamed answer.
- *  40 is far above anything normal prose or code produces. */
-export const BANG_THRESHOLD = 40;
+/** Trip after this many consecutive identical characters in the streamed
+ *  answer. 40 is far above anything normal prose or code produces for any
+ *  single non-whitespace character. */
+export const REPEAT_THRESHOLD = 40;
+
+/** @deprecated alias kept for downstream forks; prefer REPEAT_THRESHOLD.
+ *  The guard now catches runs of any non-whitespace character, not just '!'. */
+export const BANG_THRESHOLD = REPEAT_THRESHOLD;
+
+/** Characters whose repetition we never trip on. Whitespace can legitimately
+ *  repeat (code indentation, blank lines, markdown padding), so a long
+ *  whitespace run is not treated as a degenerate loop. Every other character
+ *  is a candidate. Exported for tests/introspection. */
+export const IGNORED_REPEAT_CHARS = new Set<string>([
+  " ",
+  "\t",
+  "\n",
+  "\r",
+  "\f",
+  "\v",
+]);
+
+/** A trailing run of one repeated character in streamed text. `char` is ""
+ *  when `len` === 0. */
+export interface TrailingRun {
+  char: string;
+  len: number;
+}
+
+/** Trip after this many consecutive identical whitespace-delimited tokens.
+ *  Catches spaced repetition ("0 0 0 ...", "!!!! !!!! ...") that the
+ *  single-character run can't see (the separator resets it). 40 mirrors
+ *  REPEAT_THRESHOLD. */
+export const TOKEN_REPEAT_THRESHOLD = 40;
+
+/** Bounded tail kept for token-run detection. Must hold >=
+ *  TOKEN_REPEAT_THRESHOLD copies of the repeated unit; 1024 comfortably fits 40
+ *  copies of tokens up to ~25 chars. */
+export const TOKEN_REPEAT_BUFFER_CHARS = 1024;
+
+/** Exponential backoff for recovery retries. Mirrors pi-retry's defaults:
+ *  2s base, 60s cap, 2× multiplier. Tunable via these constants. */
+export const BACKOFF_BASE_MS = 2000;
+export const BACKOFF_MAX_MS = 60_000;
+export const BACKOFF_MULTIPLIER = 2;
+
+export interface BackoffConfig {
+  baseDelayMs: number;
+  maxDelayMs: number;
+  multiplier: number;
+}
 
-/** Max invisible recoveries per user prompt, to bound abort/continue thrash. */
-export const MAX_RECOVERS_PER_RUN = 3;
+export const DEFAULT_BACKOFF_CONFIG: BackoffConfig = {
+  baseDelayMs: BACKOFF_BASE_MS,
+  maxDelayMs: BACKOFF_MAX_MS,
+  multiplier: BACKOFF_MULTIPLIER,
+};
 
 export interface GuardedMessage {
   role: string;
@@ -60,18 +130,49 @@ export interface GuardedAgent {
 
 let _agent: GuardedAgent | null = null;
 
-/** Mutex held only across the abort+trim critical section — NOT across the
- *  resumed prompt([]) run, so the resumed stream stays monitored. */
+/** Mutex: only one recovery loop may be in-flight at a time. The
+ *  message_update handler still aborts mid-stream while this is held, but
+ *  only the loop driver re-issues prompt([]). */
 let _recovering = false;
 
-/** Trailing '!' run length in the current text block. */
-let _trailingBangs = 0;
+/** Trailing run of one repeated character in the current text block. */
+let _trailingRunChar = "";
+let _trailingRunLen = 0;
+
+/** Bounded trailing buffer for token-level repetition detection (e.g.
+ *  "0 0 0 ...", "!!!! !!!! ..."). Single-char runs don't see spaced
+ *  repetition, so we also tokenize the recent tail and count consecutive
+ *  identical tokens. Capped to keep memory/cost bounded on long streams. */
+let _tokenRepeatBuffer = "";
+
+/** Reset all per-turn/per-block detection state. */
+function resetDetection(): void {
+  _trailingRunChar = "";
+  _trailingRunLen = 0;
+  _tokenRepeatBuffer = "";
+}
 
 /** Latch: already tripped for the current assistant message. */
 let _tripped = false;
 
-/** Recoveries performed in the current user-initiated agent run. */
-let _recoversThisRun = 0;
+/** True when WE aborted the current turn (death-loop), false on user Esc.
+ *  Reset on message_start of each new assistant turn. */
+let _weAborted = false;
+
+/** True when the user cancelled (Esc). Set in turn_end, cleared on
+ *  session_start and fresh successful turns. Stops the recovery loop. */
+let _userAborted = false;
+
+/** Session generation counter: incremented on every session_start. The
+ *  recovery loop captures it on entry and exits when it changes (/new,
+ *  /resume), so a stale loop never drives a new session. */
+let _sessionGeneration = 0;
+
+/** notify() captured fresh from the most recent event ctx, since
+ *  ctx.ui.notify isn't available inside the loop driver. Mirrors pi-retry. */
+let _notifyFn:
+  | ((message: string, level: "info" | "warning" | "error") => void)
+  | null = null;
 
 export function isGuardedModel(
   model: { provider?: string; id?: string } | undefined | null,
@@ -82,17 +183,35 @@ export function isGuardedModel(
   return model.id != null && GUARDED_MODEL_IDS.has(model.id);
 }
 
-/** Update the trailing-'!' run length given a new text delta. O(len(delta)).
- *  Trailing run depends only on the delta's suffix: if the delta contains any
- *  non-'!' char, the prior run is cut off at that char; if the delta is all
- *  '!', it extends the prior run. */
-export function nextTrailingBangs(prev: number, delta: string): number {
+/** Update the trailing single-character run given a new text delta.
+ *  O(len(delta)). Tracks runs of any one character (so the guard catches a
+ *  degenerate loop regardless of which character the model fixates on),
+ *  including whitespace -- the trip decision in isDegenerateRun filters those.
+ *
+ *  Trailing run depends only on the delta's suffix: if the delta ends with a
+ *  different character than the prior run, the prior run is cut off and the
+ *  new run is the delta's trailing run of its last character; if the delta is
+ *  entirely the prior run's character, it extends the prior run. */
+export function nextTrailingRun(prev: TrailingRun, delta: string): TrailingRun {
   const len = delta.length;
   if (len === 0) return prev;
+  const lastCode = delta.charCodeAt(len - 1);
   let i = len - 1;
-  while (i >= 0 && delta.charCodeAt(i) === 0x21) i--; // '!' === 0x21
+  while (i >= 0 && delta.charCodeAt(i) === lastCode) i--;
+  const lastChar = delta[len - 1];
   const trailingInDelta = len - 1 - i;
-  return i >= 0 ? trailingInDelta : prev + len;
+  // Delta is entirely one char and it matches the prior run: extend it.
+  if (i < 0 && prev.len > 0 && prev.char === lastChar) {
+    return { char: prev.char, len: prev.len + len };
+  }
+  return { char: lastChar, len: trailingInDelta };
+}
+
+/** @deprecated '!'-only alias kept for downstream forks. Returns the trailing
+ *  '!' run length (0 once the run switches to any other character). */
+export function nextTrailingBangs(prev: number, delta: string): number {
+  const run = nextTrailingRun({ char: "!", len: prev }, delta);
+  return run.char === "!" ? run.len : 0;
 }
 
 export function extractText(content: unknown): string {
@@ -114,40 +233,214 @@ export function extractText(content: unknown): string {
   return "";
 }
 
-/** Trailing '!' run length of a finalized message's text content. */
-export function messageTrailingBangs(msg: GuardedMessage): number {
+/** Trailing single-character run of a finalized message's text content. */
+export function messageTrailingRun(msg: GuardedMessage): TrailingRun {
   const text = extractText(msg.content);
+  if (text.length === 0) return { char: "", len: 0 };
+  const lastCode = text.charCodeAt(text.length - 1);
   let i = text.length - 1;
-  while (i >= 0 && text.charCodeAt(i) === 0x21) i--;
-  return text.length - 1 - i;
+  while (i >= 0 && text.charCodeAt(i) === lastCode) i--;
+  return { char: text[text.length - 1], len: text.length - 1 - i };
+}
+
+/** @deprecated '!'-only alias kept for downstream forks. */
+export function messageTrailingBangs(msg: GuardedMessage): number {
+  const run = messageTrailingRun(msg);
+  return run.char === "!" ? run.len : 0;
+}
+
+/** True when a trailing run is long enough to be a degenerate loop. Whitespace
+ *  runs never count (see IGNORED_REPEAT_CHARS). Exported so the trip decision
+ *  is unit-testable independently of the streaming handler. */
+export function isDegenerateRun(
+  run: TrailingRun,
+  threshold: number = REPEAT_THRESHOLD,
+): boolean {
+  return (
+    run.len >= threshold &&
+    run.char !== "" &&
+    !IGNORED_REPEAT_CHARS.has(run.char)
+  );
+}
+
+/** A trailing run of one repeated whitespace-delimited token. `token` is ""
+ *  when `count` === 0. */
+export interface TokenRun {
+  token: string;
+  count: number;
 }
 
-async function recover(agent: GuardedAgent): Promise<void> {
+/** Is `code` a whitespace code unit we split tokens on? Mirrors
+ *  IGNORED_REPEAT_CHARS (space, tab, LF, CR, FF, VT). */
+function isWhitespaceChar(code: number): boolean {
+  switch (code) {
+    case 0x20: case 0x09: case 0x0a: case 0x0d: case 0x0c: case 0x0b:
+      return true;
+    default:
+      return false;
+  }
+}
+
+/** Trailing run of one repeated whitespace-delimited token in `text`. Walks
+ *  backward from the end: skips trailing whitespace, captures the last token,
+ *  then counts consecutive preceding copies separated only by whitespace.
+ *  O(run length * token length). Used on a bounded tail buffer, so cost stays
+ *  bounded regardless of total stream length. */
+export function trailingTokenRun(text: string): TokenRun {
+  const len = text.length;
+  let end = len;
+  while (end > 0 && isWhitespaceChar(text.charCodeAt(end - 1))) end--;
+  if (end === 0) return { token: "", count: 0 };
+  let start = end;
+  while (start > 0 && !isWhitespaceChar(text.charCodeAt(start - 1))) start--;
+  const token = text.slice(start, end);
+  let count = 1;
+  let i = start;
+  while (i > 0) {
+    let j = i;
+    while (j > 0 && isWhitespaceChar(text.charCodeAt(j - 1))) j--;
+    if (j === 0) break;
+    let prevEnd = j;
+    let prevStart = prevEnd;
+    while (prevStart > 0 && !isWhitespaceChar(text.charCodeAt(prevStart - 1))) {
+      prevStart--;
+    }
+    if (text.slice(prevStart, prevEnd) !== token) break;
+    count++;
+    i = prevStart;
+  }
+  return { token, count };
+}
+
+/** True when a trailing token run is long enough to be a degenerate loop.
+ *  Tokens are non-whitespace by construction, so no whitespace exclusion is
+ *  needed (unlike isDegenerateRun). Exported for unit testing. */
+export function isDegenerateTokenRun(
+  run: TokenRun,
+  threshold: number = TOKEN_REPEAT_THRESHOLD,
+): boolean {
+  return run.count >= threshold && run.token !== "";
+}
+
+/** Exponential backoff delay, capped at maxDelayMs. Mirrors pi-retry. */
+export function calculateDelay(
+  attempt: number,
+  config: BackoffConfig = DEFAULT_BACKOFF_CONFIG,
+): number {
+  const delay = config.baseDelayMs * Math.pow(config.multiplier, attempt - 1);
+  return Math.min(delay, config.maxDelayMs);
+}
+
+/** Format a duration for user-facing messages. Mirrors pi-retry. */
+export function formatDuration(ms: number): string {
+  if (ms < 1000) return `${ms}ms`;
+  if (ms < 60000) return `${(ms / 1000).toFixed(1)}s`;
+  const minutes = Math.floor(ms / 60000);
+  const seconds = ((ms % 60000) / 1000).toFixed(0);
+  return `${minutes}m ${seconds}s`;
+}
+
+/** Interruptible sleep: polls _userAborted and _sessionGeneration every
+ *  100ms. Returns true if interrupted (Esc or /new), false if the full delay
+ *  elapsed. Mirrors pi-retry. */
+function interruptibleSleep(ms: number, generation: number): Promise<boolean> {
+  if (ms <= 0) return Promise.resolve(false);
+  return new Promise((resolve) => {
+    const checkInterval = 100;
+    let elapsed = 0;
+    const timer = setInterval(() => {
+      elapsed += checkInterval;
+      if (_userAborted || _sessionGeneration !== generation) {
+        clearInterval(timer);
+        resolve(true);
+      } else if (elapsed >= ms) {
+        clearInterval(timer);
+        resolve(false);
+      }
+    }, checkInterval);
+  });
+}
+
+/** Remove a trailing aborted/death-loop assistant message so the next
+ *  prompt([]) sends a clean context ending at the prior user/toolResult. */
+function trimAbortedDeathLoop(agent: GuardedAgent): void {
+  const msgs = agent.state.messages;
+  const last = msgs[msgs.length - 1];
+  if (
+    last &&
+    last.role === "assistant" &&
+    (last.stopReason === "aborted" ||
+      isDegenerateRun(messageTrailingRun(last)) ||
+      isDegenerateTokenRun(trailingTokenRun(extractText(last.content))))
+  ) {
+    agent.state.messages = msgs.slice(0, -1);
+  }
+}
+
+/** Recovery loop driver — the core. Loops until a clean turn, user abort,
+ *  or session change. Backoff sleep happens AFTER each prompt([]) settles,
+ *  so it does not block the agent; Esc and /new take effect within 100ms. */
+async function triggerRecovery(): Promise<void> {
+  if (!_agent) return;
+  if (_userAborted) return;
+  if (_recovering) return;
   _recovering = true;
+
+  const myGeneration = _sessionGeneration;
+
   try {
-    agent.abort();
-    await agent.waitForIdle();
-    const msgs = agent.state.messages;
-    const last = msgs[msgs.length - 1];
-    if (
-      last &&
-      last.role === "assistant" &&
-      (last.stopReason === "aborted" || messageTrailingBangs(last) >= BANG_THRESHOLD)
-    ) {
-      // Drop the toxic partial so it isn't re-fed to the model on resume.
-      // The state setter copies the array, leaving a clean transcript that
-      // ends at the prior user/toolResult message.
-      agent.state.messages = msgs.slice(0, -1);
+    await _agent.waitForIdle();
+    if (_userAborted || _sessionGeneration !== myGeneration) return;
+
+    // Trim the aborted !!! message from the initial trip.
+    trimAbortedDeathLoop(_agent);
+
+    let attempt = 0;
+    // Loop until success, user abort, or session change.
+    while (true) {
+      if (_userAborted || _sessionGeneration !== myGeneration) return;
+
+      attempt++;
+      const delay = calculateDelay(attempt);
+      if (_notifyFn) {
+        _notifyFn(
+          `Makora death-loop guard: resuming after runaway repeated-character ` +
+            `output (retry ${attempt}, backoff ${formatDuration(delay)})...`,
+          "warning",
+        );
+      }
+
+      // Interruptible sleep with backoff BEFORE the retry. Lets Esc and
+      // /new take effect within 100ms instead of waiting the full delay.
+      const interrupted = await interruptibleSleep(delay, myGeneration);
+      if (interrupted) return;
+      if (_userAborted || _sessionGeneration !== myGeneration) return;
+
+      // _weAborted is also reset on message_start, but reset here too in
+      // case message_start already fired before we reached this point.
+      _weAborted = false;
+      try {
+        await _agent.prompt([]);
+      } catch {
+        // "Agent is already processing" or other transient error — bail.
+        return;
+      }
+      if (_userAborted || _sessionGeneration !== myGeneration) return;
+
+      // Did the resumed turn death-loop again? If we aborted it, trim and
+      // loop; otherwise it completed cleanly (or the user aborted) — exit.
+      if (_weAborted) {
+        trimAbortedDeathLoop(_agent);
+        continue;
+      }
+      return;
     }
   } finally {
-    // Release before resuming so the resumed stream stays monitored.
-    _recovering = false;
-  }
-  try {
-    // Invisible continue: fresh agent loop, no new message injected.
-    await agent.prompt([]);
-  } catch {
-    // "Agent is already processing" or other transient error — best effort.
+    // Only release the mutex if the session hasn't changed. If /new fired,
+    // a new recovery loop may already own it — resetting here would clobber.
+    if (_sessionGeneration === myGeneration) {
+      _recovering = false;
+    }
   }
 }
 
@@ -155,7 +448,7 @@ export function registerDeathLoopGuard(pi: ExtensionAPI): void {
   // Capture the live Agent instance by chaining Agent.prototype.subscribe.
   // subscribe() fires when AgentSession attaches — on every fresh session
   // and every resume — so _agent always points at the active Agent. Chain
-  // any prior patch (e.g. pi-invisible-continue) so both extensions coexist.
+  // any prior patch (e.g. pi-invisible-continue, pi-retry) so all coexist.
   const proto = Agent.prototype as unknown as {
     subscribe: (this: GuardedAgent, ...args: unknown[]) => unknown;
   };
@@ -166,35 +459,45 @@ export function registerDeathLoopGuard(pi: ExtensionAPI): void {
   };
 
   pi.on("session_start", () => {
+    // Bump generation so any in-flight recovery loop from a previous session
+    // exits within 100ms (during backoff) or right after prompt([]) returns.
+    _sessionGeneration++;
     _recovering = false;
-    _trailingBangs = 0;
+    resetDetection();
     _tripped = false;
-    _recoversThisRun = 0;
+    _weAborted = false;
+    _userAborted = false;
   });
 
   // before_agent_start fires only for user prompts (the AgentSession path),
-  // not for the recovery's direct agent.prompt([]), so the recovery cap is
-  // bounded per user prompt instead of reset on every recovery continuation.
+  // not for the recovery's direct agent.prompt([]), so these resets bound
+  // detection to the current user prompt without clearing mid-recovery.
   pi.on("before_agent_start", () => {
-    _recovering = false;
-    _trailingBangs = 0;
+    resetDetection();
     _tripped = false;
-    _recoversThisRun = 0;
+    _weAborted = false;
+    // A new user prompt is fresh activity — clear a stale user-abort flag.
+    _userAborted = false;
   });
 
   pi.on("message_start", (event) => {
     if (event.message?.role === "assistant") {
-      _trailingBangs = 0;
+      resetDetection();
       _tripped = false;
+      _weAborted = false;
     }
   });
 
   pi.on("message_update", (event, ctx) => {
+    // Refresh notify on every handler so it stays current after session
+    // switches (a stale ctx goes invalid). Same approach as pi-retry.
+    _notifyFn = (message, level) => ctx.ui.notify(message, level);
+
     if (_recovering || _tripped) return;
     const ame = event.assistantMessageEvent;
     if (ame.type === "text_start" || ame.type === "thinking_start") {
-      // New content block (answer or reasoning) — trailing run starts fresh.
-      _trailingBangs = 0;
+      // New content block (answer or reasoning) — detection starts fresh.
+      resetDetection();
       return;
     }
     // Watch both the visible answer and the reasoning trace: GLM 5.2 is a
@@ -202,37 +505,60 @@ export function registerDeathLoopGuard(pi: ExtensionAPI): void {
     if (ame.type !== "text_delta" && ame.type !== "thinking_delta") return;
     if (!isGuardedModel(ctx.model)) return;
 
-    _trailingBangs = nextTrailingBangs(_trailingBangs, ame.delta);
-    if (_trailingBangs < BANG_THRESHOLD) return;
+    const run = nextTrailingRun(
+      { char: _trailingRunChar, len: _trailingRunLen },
+      ame.delta,
+    );
+    _trailingRunChar = run.char;
+    _trailingRunLen = run.len;
 
-    if (_recoversThisRun >= MAX_RECOVERS_PER_RUN) {
-      _tripped = true;
-      ctx.ui.notify(
-        "Makora death-loop guard: runaway '!' output detected, but the " +
-          "recovery limit for this prompt was reached — stopping " +
-          "intervention. Try /continue or rephrase.",
-        "warning",
-      );
-      return;
-    }
+    // Token-level repetition: a spaced loop like "0 0 0 ..." or "!!!! !!!!"
+    // never builds a single-char run (the separator resets it), so track the
+    // recent tail as whitespace-delimited tokens and count consecutive copies.
+    _tokenRepeatBuffer = (_tokenRepeatBuffer + ame.delta).slice(
+      -TOKEN_REPEAT_BUFFER_CHARS,
+    );
+    const tokenRun = trailingTokenRun(_tokenRepeatBuffer);
+
+    if (!isDegenerateRun(run) && !isDegenerateTokenRun(tokenRun)) return;
+
+    // Trip: abort the runaway stream and kick off the recovery loop (once,
+    // mutex-gated). The loop driver handles re-detection on resumed turns.
     _tripped = true;
-    _recoversThisRun++;
+    _weAborted = true;
     const agent = _agent;
     if (!agent) {
       ctx.ui.notify(
-        "Makora death-loop guard: runaway '!' output detected but the Agent " +
-          "instance was not captured; cannot recover automatically.",
+        "Makora death-loop guard: runaway repeated-character output detected " +
+          "but the Agent instance was not captured; cannot recover automatically.",
         "warning",
       );
       return;
     }
-    ctx.ui.notify(
-      `Makora death-loop guard: aborting runaway '!' output and resuming ` +
-        `(${_recoversThisRun}/${MAX_RECOVERS_PER_RUN}).`,
-      "warning",
-    );
-    // Detach: the handler must return so the run can unwind to idle before
-    // recover() awaits waitForIdle() and calls prompt([]).
-    void recover(agent);
+    agent.abort();
+    // Detach: the handler must return so the run unwinds to idle before the
+    // loop driver awaits waitForIdle(). Only kick off the loop if it isn't
+    // already running; otherwise the running loop catches this abort.
+    if (!_recovering) {
+      void triggerRecovery();
+    }
+  });
+
+  // Detect user aborts via turn_end. Our own death-loop abort also surfaces
+  // as stopReason "aborted", so _weAborted gates this: only a non-we-aborted
+  // aborted turn is treated as a user Esc and stops the recovery loop.
+  pi.on("turn_end", (event) => {
+    const msg = event.message as GuardedMessage | undefined;
+    if (msg?.role === "assistant" && msg.stopReason === "aborted" && !_weAborted) {
+      _userAborted = true;
+    }
+  });
+
+  // Also refresh notify on turn_end so the loop driver has a fresh fn even
+  // if message_update hasn't fired yet this session.
+  pi.on("turn_end", (_event, ctx) => {
+    if (!_notifyFn) {
+      _notifyFn = (message, level) => ctx.ui.notify(message, level);
+    }
   });
 }

package/index.ts

@@ -22,9 +22,11 @@
  *
  * A death-loop guard (see ./death-loop-guard.ts) is registered alongside the
  * provider. It watches the assistant text stream on the GLM 5.2 family and,
- * if the model falls into an unbroken '!' repetition loop, aborts the runaway
- * generation and resumes the agentic loop invisibly via agent.prompt([]) (the
- * pi-invisible-continue pattern) — no new user message is injected.
+ * if the model falls into a degenerate repetition loop — an unbroken run of a
+ * single character or token, spaced or not (observed: `!!!!`, `0000`, `0 0 0`)
+ * — it aborts the runaway generation and resumes the agentic loop invisibly
+ * via agent.prompt([]) (the pi-invisible-continue pattern); no new user
+ * message is injected.
  *
  * Developer role is NOT supported by any of the chat templates on Makora's
  * vLLM deployment (prompts with role: "developer" are silently dropped).
@@ -213,7 +215,8 @@ export default function (pi: ExtensionAPI) {
     models,
   });
 
-  // Abort runaway '!' repetition loops on the GLM 5.2 family and resume the
+  // Abort runaway repetition loops — a single character or token, spaced or
+  // not (e.g. '!!!!', '0000', '0 0 0') — on the GLM 5.2 family and resume the
   // agentic loop invisibly (no new user message). See ./death-loop-guard.ts.
   registerDeathLoopGuard(pi);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-makora-provider",
-  "version": "1.5.0",
+  "version": "1.7.0",
   "description": "Makora provider extension for pi - Access DeepSeek V4, GLM 5.2, Kimi K2.7 Code, Llama 3.3, Qwen 3.6, and more through the Makora inference API",
   "type": "module",
   "main": "index.ts",