dsh-repeat-tool-breaker

An agent loop in DeepSeek Harness hides a devious trap: the model swaps a description from 1st to 2nd, rotates --max-time between 60 and 30, or ping-pongs between open-data.canada.ca and open.canada.ca. Every call looks brand-new, so a naive byte-identical counter never advances. The official dsh-repeat-tool-reminder only injects a softer nudge after the call has already executed. dsh-repeat-tool-breaker steps in at the synchronous tools.guard gate: once the threshold is reached the tool body never runs at all, and the model receives an isError result prefixed with REPEAT_TOOL_BLOCKED that quotes the previous return value and suggests an alternative path.

The core mechanism is a semantic fingerprint pipeline. Before any fingerprint is built, decoy parameters are stripped away: ordinal descriptions, volatile flags such as --max-time, -sSL clusters, and host-alias folding. Eight independent dimensions then count over a per-agent sliding window of the last 16 calls: exact, cmd, net, host, site, sink, family, and verb. Any single dimension hitting its cap triggers a denial, so evading net still collides with cmd or sink. Three escalating stages fire on exact count equality: a light warning at 7, a mandatory written summary at 11 (verified facts, unverified assumptions, failure reasons, and at least two untried approaches, plus a nudge toward larger batch sizes to reduce round-trips), and a hard gate at 12 (the coarser host dimension caps at 16). At the gate the operator may accept a one-shot turn-scoped exemption (onLimit ask, the default) or deny outright; in every unattended scenario ask degrades to deny so a headless profile never stalls.

Built for DSH operators who let agents issue bash, curl, or HTTP tool calls, especially in unattended or headless production profiles. Zero runtime dependencies, requires Node 20 or above, and composes cleanly alongside the official reminder plugin: the reminder provides the soft nudge, the breaker provides the escalating hard stop.