dsh-circuit-breaker

Running local models as agents, subagents can fall into degenerate repetition loops. The same search fires five hundred or a thousand times, every call succeeds and returns results, no error ever triggers an alert. Telling the model to stop only locks it deeper into the pattern, because repetition is a self-reinforcing attractor and instructions simply do not land once the state is established.

dsh-circuit-breaker puts the guard in code, outside the model, and never asks the model for its opinion. It registers a tool-call guard with two denial tiers: the same tool with the same significant arguments repeated past a threshold (default 6) inside a sliding window, and a lifetime call cap per agent object (default 300). Denials are monotonic; nothing downstream can re-allow a refused call. Denied calls are not counted toward the window, so the breaker cannot latch permanently. A model that can still read the denial text stops and reports back to the user. A truly degenerate model sees every call blocked before execution, consuming no inference slots and performing no real actions.

Built for anyone running local-model agents under DeepSeek Harness, especially unattended subagents. Model-agnostic: it inspects the pattern of tool calls, not model internals, so it works the same way behind any local or hosted model. Configuration is applied through a patch layer with no build step, plain ESM out of the box. The optional incident log appends one JSON line per first denial per agent, carrying the agent UUID, so a parent or supervisor can detect a tripped child, interrupt it, re-dispatch once, and record a gap on a second trip.