[argus] loop_detector: edit-aware reset + raise default thresholds 5/8

Two changes that together stop the loop detector from killing legitimate
render-and-verify iteration. Observed in argus thread ff3c7aa8 (WebGL
minion task on local-qwen): hard-stop fired on the 5th invocation of an
identical render.py verifier command, even though the model had made six
distinct str_replace edits to the artifact between renders. The verifier
*has to* be re-run after each edit — that is the whole point of the
iterate loop — but the hash-based detector treated those reruns as
identical-call repetition.

1. Edit-aware reset (the principled fix). Track per-thread the set of
   paths mutated by write_file / str_replace. Before counting a new tool
   call's hash, check whether it references any of those mutated paths
   (path arg match, or substring match against command / cmd). If it
   does, clear that hash from the sliding window and consume the matched
   paths from the mutated set. The signal we want to catch is "doing the
   same thing in the same state" — an intervening edit means the state
   changed, so a re-probe is fresh observation, not a loop. Within-
   message edits don't reset their own hash (mutating paths are recorded
   *after* the check), so a coupled [str_replace, bash] in one message
   only resets a *future* identical bash.

2. Raise defaults: warn 3 -> 5, hard 5 -> 8. Cheap belt-and-suspenders
   for cases the edit-aware reset doesn't cover (verifiers that touch
   paths the model didn't explicitly edit, model-side noise, etc).
   This is a local single-user setup -- token burn from a few extra
   wasted iterations is preferable to killing a run one fix away from
   completion.

Tests: 8 new cases in TestEditAwareReset covering the render-and-verify
pattern, unrelated-path edits not resetting, single-mutation-consumed-
once semantics, within-message coupling, per-thread isolation, and a
sanity check on the new default thresholds. All 56 loop-detection tests
pass; full backend suite is green modulo unrelated env-layout failures
(/tmp/scripts, /tmp/skills) that also fail on stock argus@743b7f21.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Nichol4s

backend/packages/harness/deerflow/agents/middlewares/loop_detection_middleware.py

@@ -28,8 +28,8 @@
 logger = logging.getLogger(__name__)
 
 # Defaults — can be overridden via constructor
-_DEFAULT_WARN_THRESHOLD = 3  # inject warning after 3 identical calls
-_DEFAULT_HARD_LIMIT = 5  # force-stop after 5 identical calls
+_DEFAULT_WARN_THRESHOLD = 5  # inject warning after 5 identical calls
+_DEFAULT_HARD_LIMIT = 8  # force-stop after 8 identical calls
 _DEFAULT_WINDOW_SIZE = 20  # track last N tool calls
 _DEFAULT_MAX_TRACKED_THREADS = 100  # LRU eviction limit
 _DEFAULT_TOOL_FREQ_WARN = 30  # warn after 30 calls to the same tool type
@@ -105,6 +105,42 @@ def _stable_tool_key(name: str, args: dict, fallback_key: str | None) -> str:
     return json.dumps(args, sort_keys=True, default=str)
 
 
+_MUTATING_TOOLS = frozenset({"write_file", "str_replace"})
+
+
+def _mutated_path(name: str, args: dict) -> str | None:
+    """Return the file path mutated by *name* (write_file / str_replace), or None."""
+    if name not in _MUTATING_TOOLS:
+        return None
+    path = args.get("path")
+    if isinstance(path, str) and path:
+        return path
+    return None
+
+
+def _matches_mutated(args: dict, mutated_paths: set[str]) -> set[str]:
+    """Return the subset of *mutated_paths* that this tool call references.
+
+    A call references a mutated path when:
+      - its ``path`` arg equals the mutated path, or
+      - its ``command``/``cmd`` arg contains the mutated path as a substring
+        (verifier scripts, cat, grep, python -c "...", etc).
+    """
+    if not mutated_paths:
+        return set()
+    matched: set[str] = set()
+    arg_path = args.get("path")
+    cmd = args.get("command") or args.get("cmd")
+    cmd_str = cmd if isinstance(cmd, str) else None
+    for mp in mutated_paths:
+        if arg_path == mp:
+            matched.add(mp)
+            continue
+        if cmd_str is not None and mp in cmd_str:
+            matched.add(mp)
+    return matched
+
+
 def _hash_tool_calls(tool_calls: list[dict]) -> str:
     """Deterministic hash of a set of tool calls (name + stable key).
 
@@ -153,9 +189,9 @@ class LoopDetectionMiddleware(AgentMiddleware[AgentState]):
 
     Args:
         warn_threshold: Number of identical tool call sets before injecting
-            a warning message. Default: 3.
+            a warning message. Default: 5.
         hard_limit: Number of identical tool call sets before stripping
-            tool_calls entirely. Default: 5.
+            tool_calls entirely. Default: 8.
         window_size: Size of the sliding window for tracking calls.
             Default: 20.
         max_tracked_threads: Maximum number of threads to track before
@@ -191,6 +227,11 @@ def __init__(
         # Per-thread, per-tool-type cumulative call counts
         self._tool_freq: dict[str, dict[str, int]] = defaultdict(lambda: defaultdict(int))
         self._tool_freq_warned: dict[str, set[str]] = defaultdict(set)
+        # Per-thread set of paths mutated since the last reset. A subsequent call
+        # that references one of these paths clears identical-hash history (the
+        # file changed, so re-probing it isn't a loop), and consumes the path so
+        # a fresh edit is needed to reset again.
+        self._mutated_paths: dict[str, set[str]] = defaultdict(set)
 
     def _get_thread_id(self, runtime: Runtime) -> str:
         """Extract thread_id from runtime context for per-thread tracking."""
@@ -209,6 +250,7 @@ def _evict_if_needed(self) -> None:
             self._warned.pop(evicted_id, None)
             self._tool_freq.pop(evicted_id, None)
             self._tool_freq_warned.pop(evicted_id, None)
+            self._mutated_paths.pop(evicted_id, None)
             logger.debug("Evicted loop tracking for thread %s (LRU)", evicted_id)
 
     def _track_and_check(self, state: AgentState, runtime: Runtime) -> tuple[str | None, bool]:
@@ -220,6 +262,11 @@ def _track_and_check(self, state: AgentState, runtime: Runtime) -> tuple[str | N
              called many times with varying arguments (e.g. ``read_file``
              on 40 different files).
 
+        Edit-aware reset: if any tool call references a path that was mutated
+        (by a prior write_file/str_replace) since the last reset for that path,
+        clear identical-hash history before counting. The file changed, so the
+        verifier isn't probing the same state.
+
         Returns:
             (warning_message_or_none, should_hard_stop)
         """
@@ -247,13 +294,43 @@ def _track_and_check(self, state: AgentState, runtime: Runtime) -> tuple[str | N
                 self._evict_if_needed()
 
             history = self._history[thread_id]
+
+            # Edit-aware reset: collect mutated paths this message *probes*,
+            # then drop those paths from the mutated set and clear prior
+            # identical-hash occurrences. Mutating calls in this same message
+            # are recorded *after* this check, so they only affect the next
+            # message — within-message edits don't reset their own hash.
+            mutated = self._mutated_paths.get(thread_id)
+            if mutated:
+                consumed: set[str] = set()
+                for tc in tool_calls:
+                    args, _ = _normalize_tool_call_args(tc.get("args", {}))
+                    consumed |= _matches_mutated(args, mutated)
+                if consumed:
+                    history[:] = [h for h in history if h != call_hash]
+                    mutated -= consumed
+                    if not mutated:
+                        self._mutated_paths.pop(thread_id, None)
+                    self._warned.get(thread_id, set()).discard(call_hash)
+
             history.append(call_hash)
             if len(history) > self.window_size:
                 history[:] = history[-self.window_size :]
 
             count = history.count(call_hash)
             tool_names = [tc.get("name", "?") for tc in tool_calls]
 
+            # Record mutating paths *after* the edit-aware check above, so
+            # mutating calls in this same message only reset hash counts on
+            # *future* messages, not their own. Done before the warn/hard-stop
+            # branches so injected warnings still produce a fresh mutated set
+            # for whatever the model does next.
+            for tc in tool_calls:
+                args, _ = _normalize_tool_call_args(tc.get("args", {}))
+                mp = _mutated_path(tc.get("name", ""), args)
+                if mp:
+                    self._mutated_paths[thread_id].add(mp)
+
             # --- Layer 1: hash-based (identical call sets) ---
             if count >= self.hard_limit:
                 logger.error(
@@ -393,8 +470,10 @@ def reset(self, thread_id: str | None = None) -> None:
                 self._warned.pop(thread_id, None)
                 self._tool_freq.pop(thread_id, None)
                 self._tool_freq_warned.pop(thread_id, None)
+                self._mutated_paths.pop(thread_id, None)
             else:
                 self._history.clear()
                 self._warned.clear()
                 self._tool_freq.clear()
+                self._mutated_paths.clear()
                 self._tool_freq_warned.clear()

backend/tests/test_loop_detection_middleware.py

@@ -684,3 +684,165 @@ def test_hash_detection_takes_priority(self):
         msg = result["messages"][0]
         assert isinstance(msg, AIMessage)
         assert _HARD_STOP_MSG in msg.content
+
+
+class TestEditAwareReset:
+    """Edit-aware reset: an interleaved write_file/str_replace to a path that a
+    later call references should clear that call's hash from history. The
+    classic case is a render-and-verify loop where the model edits the artifact
+    between identical bash invocations of the verifier script.
+    """
+
+    @staticmethod
+    def _bash(cmd):
+        return {"name": "bash", "id": f"call_{hash(cmd) & 0xffff}", "args": {"command": cmd}}
+
+    @staticmethod
+    def _str_replace(path, old="A", new="B"):
+        return {
+            "name": "str_replace",
+            "id": f"call_sr_{hash((path, old, new)) & 0xffff}",
+            "args": {"path": path, "old_str": old, "new_str": new},
+        }
+
+    @staticmethod
+    def _write_file(path, content="x"):
+        return {
+            "name": "write_file",
+            "id": f"call_wf_{hash((path, content)) & 0xffff}",
+            "args": {"path": path, "content": content},
+        }
+
+    def test_str_replace_resets_bash_verifier_hash(self):
+        """The render-and-verify failure mode: model alternates render-bash and
+        str_replace edits to the artifact, but counter for the bash hash should
+        reset on each interleaved edit.
+        """
+        mw = LoopDetectionMiddleware(warn_threshold=3, hard_limit=4)
+        runtime = _make_runtime()
+        artifact = "/mnt/user-data/outputs/minion.html"
+        verify_cmd = f"python3 /mnt/skills/render.py {artifact}"
+        bash_call = [self._bash(verify_cmd)]
+
+        # Pattern: render, edit, render, edit, render, edit, render, edit
+        # Without reset, 4th render would hard-stop. With reset, never stops.
+        # Each edit varies its content so str_replace hashes don't collide.
+        for i in range(8):
+            r = mw._apply(_make_state(tool_calls=bash_call), runtime)
+            assert r is None, f"verifier bash should not trigger after edit (iter {i})"
+            edit = self._str_replace(artifact, old=f"old_{i}", new=f"new_{i}")
+            mw._apply(_make_state(tool_calls=[edit]), runtime)
+
+    def test_no_edit_still_triggers_loop(self):
+        """Sanity: without an interleaved edit, repeated identical bash still
+        hits hard_limit. Edit-aware reset must not disable basic detection.
+        """
+        mw = LoopDetectionMiddleware(warn_threshold=2, hard_limit=3)
+        runtime = _make_runtime()
+        bash_call = [self._bash("echo hello")]
+
+        for _ in range(2):
+            mw._apply(_make_state(tool_calls=bash_call), runtime)
+        result = mw._apply(_make_state(tool_calls=bash_call), runtime)
+        assert result is not None
+        assert _HARD_STOP_MSG in result["messages"][0].content
+
+    def test_edit_to_unrelated_path_does_not_reset(self):
+        """Edit to /tmp/other.html must NOT reset bash that probes /tmp/foo.html."""
+        mw = LoopDetectionMiddleware(warn_threshold=2, hard_limit=3)
+        runtime = _make_runtime()
+        target = "/tmp/foo.html"
+        verify = [self._bash(f"cat {target}")]
+
+        mw._apply(_make_state(tool_calls=verify), runtime)
+        mw._apply(_make_state(tool_calls=[self._str_replace("/tmp/other.html")]), runtime)
+        mw._apply(_make_state(tool_calls=verify), runtime)
+        # 3rd identical verify still triggers hard stop — edit was to a
+        # different path
+        result = mw._apply(_make_state(tool_calls=verify), runtime)
+        assert result is not None
+        assert _HARD_STOP_MSG in result["messages"][0].content
+
+    def test_edit_to_path_arg_resets(self):
+        """A str_replace path that matches the next call's path arg (not a bash
+        substring) should also reset.
+        """
+        mw = LoopDetectionMiddleware(warn_threshold=2, hard_limit=3)
+        runtime = _make_runtime()
+        target = "/tmp/foo.py"
+        read_call = [{"name": "read_file", "id": "rf1", "args": {"path": target}}]
+
+        mw._apply(_make_state(tool_calls=read_call), runtime)
+        mw._apply(_make_state(tool_calls=read_call), runtime)
+        mw._apply(_make_state(tool_calls=[self._write_file(target)]), runtime)
+        # Next read_file of the same path: prior history cleared, no warn/stop
+        r = mw._apply(_make_state(tool_calls=read_call), runtime)
+        assert r is None
+
+    def test_edit_consumed_by_one_reset_only(self):
+        """A single mutation should only reset the *next* identical call. After
+        that, subsequent identical calls accumulate again.
+        """
+        mw = LoopDetectionMiddleware(warn_threshold=2, hard_limit=3)
+        runtime = _make_runtime()
+        target = "/tmp/x.html"
+        verify = [self._bash(f"cat {target}")]
+
+        # Build up 2 identical verifies (warn_threshold=2 → next would warn)
+        mw._apply(_make_state(tool_calls=verify), runtime)
+        mw._apply(_make_state(tool_calls=verify), runtime)
+        # Edit
+        mw._apply(_make_state(tool_calls=[self._str_replace(target)]), runtime)
+        # Reset consumes the mutation: next verify counts as fresh
+        r = mw._apply(_make_state(tool_calls=verify), runtime)
+        assert r is None
+        # No further edit — three more verifies must hit hard_limit=3
+        mw._apply(_make_state(tool_calls=verify), runtime)
+        r = mw._apply(_make_state(tool_calls=verify), runtime)
+        assert r is not None
+        assert _HARD_STOP_MSG in r["messages"][0].content
+
+    def test_within_message_edit_does_not_reset_itself(self):
+        """A message containing both [str_replace(path), bash that touches path]
+        must NOT use the same-message edit to reset the bash's history. The edit
+        only affects *future* messages.
+        """
+        mw = LoopDetectionMiddleware(warn_threshold=2, hard_limit=3)
+        runtime = _make_runtime()
+        target = "/tmp/y.html"
+        bash_only = [self._bash(f"cat {target}")]
+        coupled = [self._str_replace(target), self._bash(f"cat {target}")]
+
+        # First two bare bash calls
+        mw._apply(_make_state(tool_calls=bash_only), runtime)
+        mw._apply(_make_state(tool_calls=bash_only), runtime)
+        # Couple a same-message edit + bash. The bash here has a *different
+        # hash* than bash_only because the multiset includes str_replace, so
+        # this doesn't directly add to the bash_only count. But it does record
+        # /tmp/y.html as mutated → next bash_only call should be reset.
+        mw._apply(_make_state(tool_calls=coupled), runtime)
+        r = mw._apply(_make_state(tool_calls=bash_only), runtime)
+        assert r is None
+
+    def test_per_thread_mutated_paths_isolated(self):
+        """Mutated paths recorded for thread A must not affect thread B."""
+        mw = LoopDetectionMiddleware(warn_threshold=2, hard_limit=3)
+        runtime_a = _make_runtime("thread-a")
+        runtime_b = _make_runtime("thread-b")
+        target = "/tmp/shared.html"
+        verify = [self._bash(f"cat {target}")]
+
+        # Thread A: edit + verify (would reset)
+        mw._apply(_make_state(tool_calls=[self._str_replace(target)]), runtime_a)
+        # Thread B: two verifies, then a third — A's edit must NOT reset B
+        mw._apply(_make_state(tool_calls=verify), runtime_b)
+        mw._apply(_make_state(tool_calls=verify), runtime_b)
+        r = mw._apply(_make_state(tool_calls=verify), runtime_b)
+        assert r is not None
+        assert _HARD_STOP_MSG in r["messages"][0].content
+
+    def test_default_thresholds_match_documented(self):
+        """Sanity: defaults are 5/8 (after option-4 bump)."""
+        mw = LoopDetectionMiddleware()
+        assert mw.warn_threshold == 5
+        assert mw.hard_limit == 8