feat(loop-prevention): detect and escalate infinite clarification loops

[gutierrezx7]

Summary

• Detect when an agent asks for more instructions in plain text (without using the question tool) and prevent infinite continuation loops.
• Implement a 3-tier escalation that progresses from normal continuation → warning prompt → hard stop with task cancellation.
• Support detection across 11 languages covering ~92% of global language users.

Changes

New modules

• clarification-detection.ts — 174 regex patterns across 11 languages detecting plain-text clarification requests
• loop-state-persistence.ts — Save loop counters to .sisyphus/loop-state/{sessionID}.json with 1-hour expiry

Modified modules

• idle-event.ts — Insert clarification detection after pending-question check; BLOCKED check runs before consecutiveFailures gate
• types.ts — Add consecutiveClarifications, lastClarificationDetectedAt, inFlightSince
• constants.ts — Add escalation prompts (WARNING + BLOCKED), MAX_CLARIFICATION_CONSECUTIVE (3), cooldown (10s), in-flight timeout (30s)
• continuation-injection.ts — Accept promptOverride, track inFlightSince, persist loop state on failure/success; BLOCKED bypasses write-permission gate
• countdown.ts — Thread promptOverride through countdown chain
• handler.ts — Call setDirectory for persistence
• session-state.ts — Load persisted state on init, persist on mutations, recover stuck inFlight (30s timeout), reset clarification counters on progress
• task-message-analyzer.ts — Expand babysitter to all task types (not just Gemini/Minimax)

Escalation tiers

Counter	Tier	Behavior
1	Normal	CONTINUATION_PROMPT (agent may resolve on its own)
2	Warning	CLARIFICATION_ESCALATION_PROMPT ("Take action, don't ask again")
3+	Blocked	CLARIFICATION_BLOCKED_PROMPT (cancel all tasks, write summary, hard stop)

Testing

• bun test src/hooks/todo-continuation-enforcer/ — 132 tests ✅ (incl. clarity detection, persistence, stagnation, integration)
• bun run typecheck ✅
• bun run build ✅
• Manual scenario simulation verified all 3 tiers fire at correct thresholds

Related Issues

N/A — feature request.

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews

---

Summary by cubic

Prevents infinite “please clarify” loops by detecting plain‑text clarification requests and escalating to a hard stop, with state persisted across restarts. Also adds native deepseek-v4 support with an optimized Sisyphus prompt and routing.

• New Features

  • Detect plain‑text clarification seeking in 11 languages and escalate: normal → warning → blocked (cancel remaining tasks, write summary). Tracks consecutiveClarifications, applies a 10s cooldown, and times out stuck in‑flight injections after 30s.
  • Persist loop state in .sisyphus/loop-state/{sessionID}.json with a 1‑hour expiry; auto‑load/save via the session store so restarts don’t reset counters.
  • Native deepseek-v4 support: model detection (Pro/Flash/R1), V4‑specific Sisyphus prompt, enable thinking for Pro, and add to Sisyphus/Oracle fallback chains.

• Bug Fixes

  • Ensure BLOCKED prompt is delivered before failure gates and bypass write‑permission when using prompt overrides; keep the todo list when overrides are used.
  • Reset clarification counters on progress/completion and expand the babysitter to all tasks; add tests for detection, persistence, and model guards.

^{Written for commit 832bd33. Summary will update on new commits. Review in cubic}

[cubic-dev-ai]

5 issues found across 18 files

Confidence score: 2/5

• Merge risk is high because there are multiple medium-to-high severity issues (6–7/10) with strong confidence, including security-sensitive behavior changes.
• Most severe: src/hooks/todo-continuation-enforcer/loop-state-persistence.ts builds filesystem paths from an unsanitized sessionID, which can enable path traversal outside .sisyphus/loop-state.
• src/hooks/todo-continuation-enforcer/continuation-injection.ts appears to broaden prompt-override write bypasses beyond blocked-mode enforcement, potentially bypassing escalation-related permission checks; src/hooks/todo-continuation-enforcer/handler.ts may also miss persisted state when sessions are created before session.idle.
• Pay close attention to src/hooks/todo-continuation-enforcer/loop-state-persistence.ts, src/hooks/todo-continuation-enforcer/continuation-injection.ts, src/hooks/todo-continuation-enforcer/handler.ts, src/hooks/todo-continuation-enforcer/clarification-detection.ts - security-sensitive path handling, permission bypass scope, persistence initialization ordering, and clarification-turn parsing correctness.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/hooks/todo-continuation-enforcer/continuation-injection.ts">

<violation number="1" location="src/hooks/todo-continuation-enforcer/continuation-injection.ts:151">
P2: Write-permission bypass is too broad: any prompt override now bypasses tool permission checks, including escalation warning prompts, not just blocked-mode enforcement.</violation>
</file>

<file name="src/hooks/todo-continuation-enforcer/handler.ts">

<violation number="1" location="src/hooks/todo-continuation-enforcer/handler.ts:64">
P2: Session-state persistence directory is initialized only on `session.idle`, so earlier `getState()` calls can instantiate sessions before persistence is configured, skipping persisted state load for that session.</violation>
</file>

<file name="src/hooks/todo-continuation-enforcer/loop-state-persistence.ts">

<violation number="1" location="src/hooks/todo-continuation-enforcer/loop-state-persistence.ts:17">
P1: Unsanitized `sessionID` is used in filesystem path construction, enabling potential path traversal outside `.sisyphus/loop-state`.</violation>
</file>

<file name="src/hooks/todo-continuation-enforcer/clarification-detection.ts">

<violation number="1" location="src/hooks/todo-continuation-enforcer/clarification-detection.ts:184">
P3: Duplicate regex pattern in the Hindi clarification-detection block causes redundant matching and future maintenance drift.</violation>

<violation number="2" location="src/hooks/todo-continuation-enforcer/clarification-detection.ts:243">
P2: Assistant messages without `parts` are skipped instead of treated as the terminal latest assistant turn, allowing stale older messages to drive clarification-loop detection.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: Unsanitized sessionID is used in filesystem path construction, enabling potential path traversal outside .sisyphus/loop-state.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/hooks/todo-continuation-enforcer/loop-state-persistence.ts, line 17:

<comment>Unsanitized `sessionID` is used in filesystem path construction, enabling potential path traversal outside `.sisyphus/loop-state`.</comment>

<file context>
@@ -0,0 +1,97 @@
+}
+
+function getStatePath(directory: string, sessionID: string): string {
+  return join(directory, LOOP_STATE_DIR, `${sessionID}.json`)
+}
+
</file context>

[cubic-dev-ai]

P2: Write-permission bypass is too broad: any prompt override now bypasses tool permission checks, including escalation warning prompts, not just blocked-mode enforcement.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/hooks/todo-continuation-enforcer/continuation-injection.ts, line 151:

<comment>Write-permission bypass is too broad: any prompt override now bypasses tool permission checks, including escalation warning prompts, not just blocked-mode enforcement.</comment>

<file context>
@@ -145,14 +148,15 @@ export async function injectContinuation(args: {
   }
 
-  if (!hasWritePermission(tools)) {
+  if (!hasWritePermission(tools) && !promptOverride) {
     log(`[${HOOK_NAME}] Skipped: agent lacks write permission`, { sessionID, agent: agentName })
     return
</file context>

[cubic-dev-ai]

P2: Session-state persistence directory is initialized only on session.idle, so earlier getState() calls can instantiate sessions before persistence is configured, skipping persisted state load for that session.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/hooks/todo-continuation-enforcer/handler.ts, line 64:

<comment>Session-state persistence directory is initialized only on `session.idle`, so earlier `getState()` calls can instantiate sessions before persistence is configured, skipping persisted state load for that session.</comment>

<file context>
@@ -61,6 +61,7 @@ export function createTodoContinuationHandler(args: {
       const sessionID = props?.sessionID as string | undefined
       if (!sessionID) return
 
+      sessionStateStore.setDirectory(ctx.directory)
       sessionStateStore.startPruneInterval()
       await handleSessionIdle({
</file context>

[cubic-dev-ai]

P2: Assistant messages without parts are skipped instead of treated as the terminal latest assistant turn, allowing stale older messages to drive clarification-loop detection.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/hooks/todo-continuation-enforcer/clarification-detection.ts, line 243:

<comment>Assistant messages without `parts` are skipped instead of treated as the terminal latest assistant turn, allowing stale older messages to drive clarification-loop detection.</comment>

<file context>
@@ -0,0 +1,287 @@
+
+    if (role === "user") return { isAskingForClarification: false }
+
+    if (role === "assistant" && msg.parts) {
+      const hasQuestionTool = msg.parts.some(
+        (part) =>
</file context>

[cubic-dev-ai]

P3: Duplicate regex pattern in the Hindi clarification-detection block causes redundant matching and future maintenance drift.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/hooks/todo-continuation-enforcer/clarification-detection.ts, line 184:

<comment>Duplicate regex pattern in the Hindi clarification-detection block causes redundant matching and future maintenance drift.</comment>

<file context>
@@ -0,0 +1,287 @@
+  // ── हिन्दी (HINDI) ──────────────────────────────────────
+  /\u092E\u0941\u091D\u0947 \u0914\u0930 (जानकारी|विवरण|निर्देश|स्पष्टीकरण|मार्गदर्शन|विशिष्टताएं|संदर्भ) (चाहिए|की जरूरत है)/i,
+  /\u0915\u0943\u092A\u092F\u093E[, ]?(स्पष्ट करें|समझाएं|निर्दिष्ट करें|बताएं|विस्तृत करें|परिभाषित करें|प्रदान करें)/i,
+  /\u092E\u0948\u0902 (क्या करूं|क्या करना चाहिए|क्या कर सकता हूं)/i,
+  /\u0915\u094C\u0928 \u0938\u093E (API|एंडपॉइंट|फ़ील्ड|पैरामीटर|तरीका|विकल्प)/i,
+  /(आपके|आपकी|आपका) (उत्तर|प्रतिक्रिया|फीडबैक|निर्णय|राय|जवाब) (का इंतजार है|प्रतीक्षा है|इंतजार कर रहा हूं)/i,
</file context>