fix(core): mitigate infinite ReAct loops and prompt injection loops

[amelidev]

Summary

This PR mitigates the infinite ReAct loop/Quota Drain Denial of Service vulnerability caused by malicious workspace files containing indirect prompt injections. It implements a safer session-level default turn limit of 15 and introduces an enhanced, simplified tool call loop detection heuristic in LoopDetectionService to detect alternating and cyclic execution patterns.

Details

• Safe Session Default: Modified the default for maxSessionTurns in settingsSchema.ts, config.ts, and settings.schema.json from -1 (unlimited) to 15 turns per single user request interaction.
• Alternating Loop Detection: Updated checkToolCallLoop in LoopDetectionService to track the last two unique tool call keys and their respective alternating repetition counts. Alternating patterns (e.g., $A \rightarrow B \rightarrow A \rightarrow B$) are now captured immediately, halting the loop once the alternating count reaches 5 (typically on the 6th call).
• Reset Mechanism: Updated resetToolCallCount to clear the new tracking fields.

Related Issues

Fixes #1

How to Validate

1. Run the LoopDetectionService unit tests:

   npm test -w @google/gemini-cli-core -- src/services/loopDetectionService.test.ts

   All 55 tests should pass successfully.
2. Build all packages:

   npm run build

   All workspace targets should compile with no warnings or errors.

Pre-Merge Checklist

• Updated relevant documentation and README (if needed)
• Added/updated tests (if needed)
• Noted breaking changes (if any)
• Validated on required platforms/methods:
  • MacOS
    • npm run
    • npx
    • Docker
    • Podman
    • Seatbelt
  • Windows
    • npm run
    • npx
    • Docker
  • Linux
    • npm run
    • npx
    • Docker

[github-actions]

📊 PR Size: size/M

• Lines changed: 131
• Additions: +120
• Deletions: -11
• Files changed: 2

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a potential Denial of Service vulnerability related to infinite ReAct loops. By capping the maximum session turns to 15 and introducing a heuristic to detect cyclic tool call patterns, the system is now better protected against malicious prompt injection attempts that aim to drain quotas.

Highlights

• Security Mitigation: Implemented a default session turn limit of 15 to prevent infinite ReAct loops and potential quota exhaustion.
• Loop Detection: Enhanced LoopDetectionService to identify and halt alternating tool call patterns (e.g., A -> B -> A -> B).
• Testing: Added comprehensive unit tests to verify the new alternating loop detection logic.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request cleans up unused dependencies in package-lock.json, changes the default value of maxSessionTurns from -1 (unlimited) to 15 across settings schemas and configuration, and enhances LoopDetectionService to detect alternating tool call loops (cycles of length 2). Feedback on the changes highlights a vulnerability where the loop detection can still be bypassed using cycles of length 3 or more (e.g., A -> B -> C -> A -> B -> C). It is recommended to implement a more robust cycle detection algorithm using a history array of recent tool calls to detect repeating patterns of any length up to 5.

[amelidev]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates the default value of maxSessionTurns from -1 to 15 and enhances the LoopDetectionService to detect cyclic tool call loops of length up to 5 using a history of tool calls. It also adds corresponding unit tests. The review feedback suggests removing the redundant nullish coalescing operator when assigning maxSessionTurns in config.ts, relying instead on the schema as the single source of truth for configuration defaults.

[amelidev]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates the default value of maxSessionTurns from -1 (unlimited) to 15 in the settings schema and CLI configuration. It also enhances the LoopDetectionService to detect multi-step cyclic tool call loops (up to cycle length 5) using a history buffer, and adds corresponding unit tests. Regarding feedback, removing the fallback value when assigning this.maxSessionTurns in config.ts can result in undefined if the parameter is not provided, potentially bypassing limit checks and causing TypeScript compilation errors. A safe default fallback should be restored.

[amelidev]

/gemini review

[gemini-code-assist]

Code Review

This pull request enhances the LoopDetectionService to detect cyclic tool call loops of lengths up to 5 using a history of recent tool calls, and adds corresponding unit tests. It also changes the default value of maxSessionTurns from -1 (unlimited) to 15 in the configuration and settings schema. The reviewer raised a high-severity concern regarding this default change, pointing out that a limit of 15 turns can quickly lead to context truncation and the loss of the original user prompt during complex agent executions, suggesting instead to rely on the loop detection service or limit turns per execution.

[amelidev]

/gemini review

[gemini-code-assist]

Code Review

This pull request refactors the tool call loop detection mechanism in LoopDetectionService to support detecting cyclic loops of lengths up to 5 by tracking a history of tool calls, and adds corresponding unit tests. The reviewer suggested dynamically calculating the history limit based on TOOL_CALL_LOOP_THRESHOLD rather than hardcoding it to 50, to prevent potential bugs if the threshold is increased in the future.

[amelidev]

/gemini review on deep so we just need to do one more fix

[gemini-code-assist]

Code Review

This pull request refactors the tool call loop detection mechanism in LoopDetectionService to support detecting cyclic loops of lengths up to 5, rather than just repeating single tool calls. It replaces the single-key tracking with a toolCallHistory array and introduces pattern-matching logic to identify repeating cycles. Comprehensive unit tests have been added to verify the detection of cycles of lengths 2, 3, and 5, as well as to ensure that non-looping sequences do not trigger false positives. I have no feedback to provide as the implementation is clean and well-tested.

[DavidAPierce]

LGTM.
Nitpick:
The description appears to be outdated, and should be updated to remove references to the reverted maxSessionTurns changes.