[PR #178] [MERGED] fix: prevent infinite loop in performAgentChain on repeating tool calls #213

New Issue

2026-06-06T22:09:44-04:00

yindo commented

2026-06-06 22:09:44 -04:00

📋 Pull Request Information

Original PR: https://github.com/vxcontrol/pentagi/pull/178
Author: @mason5052
Created: 3/5/2026
Status: ✅ Merged
Merged: 3/11/2026
Merged by: @asdek

Base: feature/next_release ← Head: fix/agent-chain-iteration-cap

📝 Commits (2)

1f896a9 fix: add iteration cap and repeating escalation to performAgentChain
536ea86 fix: address review feedback on iteration cap and repeating escalation

📊 Changes

1 file changed (+20 additions, -6 deletions)

View changed files

📝 backend/pkg/providers/performer.go (+20 -6)

📄 Description

Description of the Change

Problem

The performAgentChain loop in performer.go is an unbounded for {} with no iteration cap. When a model repeatedly calls the same tool, the repeatingDetector fires and returns a message (nil error), so the loop never breaks. This can result in 4,800+ iterations in a single session, consuming resources indefinitely.

Closes #175

Solution

Add two safety mechanisms:

Iteration cap (maxAgentChainIterations = 100): Hard limit on the main loop. Normal pentest flows use far fewer iterations; 100 is generous while preventing runaway loops.
Repeating escalation (maxSoftDetectionsBeforeAbort = 4): After 4 consecutive soft detection warnings (7 total identical calls), escalate from a soft message to an actual error that terminates the chain. The existing soft response is preserved for the first 4 detections, giving the LLM a chance to course-correct.

Type of Change

Bug fix (non-breaking change which fixes an issue)

Areas Affected

Core Services (Backend API)

Testing and Verification

Test Configuration

PentAGI Version: master
Go Version: 1.24

Test Steps

Verified both constants follow existing naming patterns (maxRetriesToCallSimpleChain, etc.)
Confirmed for iteration := 0; ; iteration++ preserves all existing loop semantics
Verified len(detector.funcCalls) is accessible (same package) and correctly tracks consecutive identical calls (resets on different calls per helpers.go:detect())
Confirmed escalation threshold math: RepeatingToolCallThreshold(3) + maxSoftDetectionsBeforeAbort(4) = 7, so error fires on the 7th consecutive identical call
Timeline: calls 1-2 build up, call 3 triggers first detection, calls 3-6 get soft warnings (4 soft detections), call 7 aborts

Security Considerations

No security impact. This is a resource exhaustion prevention fix.

Checklist

My code follows the project's coding standards
All new and existing tests pass
I have run go fmt and go vet
Security implications considered
Changes are backward compatible

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/vxcontrol/pentagi/pull/178 **Author:** [@mason5052](https://github.com/mason5052) **Created:** 3/5/2026 **Status:** ✅ Merged **Merged:** 3/11/2026 **Merged by:** [@asdek](https://github.com/asdek) **Base:** `feature/next_release` ← **Head:** `fix/agent-chain-iteration-cap` --- ### 📝 Commits (2) - [`1f896a9`](https://github.com/vxcontrol/pentagi/commit/1f896a9aa48b4882ab52b342395a8ea6e10c1af5) fix: add iteration cap and repeating escalation to performAgentChain - [`536ea86`](https://github.com/vxcontrol/pentagi/commit/536ea86a55491ccfaae7a455729906e8e503221d) fix: address review feedback on iteration cap and repeating escalation ### 📊 Changes **1 file changed** (+20 additions, -6 deletions) <details> <summary>View changed files</summary> 📝 `backend/pkg/providers/performer.go` (+20 -6) </details> ### 📄 Description ### Description of the Change #### Problem The `performAgentChain` loop in `performer.go` is an unbounded `for {}` with no iteration cap. When a model repeatedly calls the same tool, the `repeatingDetector` fires and returns a message (`nil` error), so the loop never breaks. This can result in 4,800+ iterations in a single session, consuming resources indefinitely. Closes #175 #### Solution Add two safety mechanisms: 1. **Iteration cap** (`maxAgentChainIterations = 100`): Hard limit on the main loop. Normal pentest flows use far fewer iterations; 100 is generous while preventing runaway loops. 2. **Repeating escalation** (`maxSoftDetectionsBeforeAbort = 4`): After 4 consecutive soft detection warnings (7 total identical calls), escalate from a soft message to an actual error that terminates the chain. The existing soft response is preserved for the first 4 detections, giving the LLM a chance to course-correct. ### Type of Change - [x] Bug fix (non-breaking change which fixes an issue) ### Areas Affected - [x] Core Services (Backend API) ### Testing and Verification #### Test Configuration - PentAGI Version: master - Go Version: 1.24 #### Test Steps 1. Verified both constants follow existing naming patterns (`maxRetriesToCallSimpleChain`, etc.) 2. Confirmed `for iteration := 0; ; iteration++` preserves all existing loop semantics 3. Verified `len(detector.funcCalls)` is accessible (same package) and correctly tracks consecutive identical calls (resets on different calls per `helpers.go:detect()`) 4. Confirmed escalation threshold math: `RepeatingToolCallThreshold(3) + maxSoftDetectionsBeforeAbort(4) = 7`, so error fires on the 7th consecutive identical call 5. Timeline: calls 1-2 build up, call 3 triggers first detection, calls 3-6 get soft warnings (4 soft detections), call 7 aborts ### Security Considerations No security impact. This is a resource exhaustion prevention fix. ### Checklist - [x] My code follows the project's coding standards - [x] All new and existing tests pass - [x] I have run `go fmt` and `go vet` - [x] Security implications considered - [x] Changes are backward compatible --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

yindo added the pull-request label 2026-06-06 22:09:44 -04:00

yindo closed this issue

2026-06-06 22:09:44 -04:00

yindo referenced this issue

2026-06-06 22:09:50 -04:00

[PR #213] [MERGED] test: add unit tests for pkg/graph context helpers #239

yindo referenced this issue

2026-06-06 22:09:52 -04:00

[PR #222] [MERGED] Test Coverage & Performance Improvements #245

Sign in to join this conversation.