Why Autonomous AI Agents Enter Infinite Retry Loops (And How to Build SHA-256 Idempotency Arbiters in TypeScript)

{ "status": "error", "code": "ETIMEDOUT", "message": "Gateway timeout connecting to mail relay" } 

┌─────────────────────┐ │ Autonomous LLM Loop │ └──────────┬──────────┘ │ Tool Call: send_email(to, subject, body) ▼ ┌──────────────────────────────────────────────┐ │ Deterministic Idempotency Arbiter │ ├──────────────────────────────────────────────┤ │ 1. Canonicalize argument keys │ │ 2. Hash payload (SHA-256) │ │ 3. Check sliding-window TTL cache (e.g. 60s) │ └──────────┬────────────────────────┬──────────┘ │ │ [New Hash] [Duplicate Hash] │ │ ▼ ▼ ┌──────────────────────┐ ┌────────────────────────────────┐ │ Execute Tool Socket │ │ Intercept & Return HTTP 409 │ │ (Cache Hash in TTL) │ │ "Duplicate invocation dropped" │ └──────────────────────┘ └────────────────────────────────┘ 

import { createHash } from "node:crypto"; export interface ToolInvocation<T = Record<string, unknown>> { toolName: string; arguments: T; sessionId: string; } export interface ArbiterResult<R = unknown> { allowed: boolean; idempotencyKey: string; cachedResponse?: R; reason?: "DUPLICATE_CALL_SUPPRESSED" | "CIRCUIT_BREAKER_TRIPPED"; cooldownRemainingSeconds?: number; } interface CacheEntry<R> { idempotencyKey: string; firstSeenAt: number; lastAttemptAt: number; attemptCount: number; response?: R; } export class IdempotencyArbiter { private cache = new Map<string, CacheEntry<unknown>>(); private readonly windowMs: number; private readonly maxDuplicatesBeforeTrip: number; constructor(options?: { windowMs?: number; maxDuplicatesBeforeTrip?: number }) { this.windowMs = options?.windowMs ?? 60_000; // 60-second sliding cooldown this.maxDuplicatesBeforeTrip = options?.maxDuplicatesBeforeTrip ?? 3; // Background cleanup of expired keys every 30 seconds setInterval(() => this.sweepExpired(), 30_000).unref(); } /** * Deterministically canonicalizes any JSON-compatible object * by deeply sorting keys, guaranteeing identical hashes for identical inputs. */ public canonicalize(value: unknown): string { if (value === null || typeof value !== "object") { return JSON.stringify(value); } if (Array.isArray(value)) { return "[" + value.map((item) => this.canonicalize(item)).join(",") + "]"; } const record = value as Record<string, unknown>; const sortedKeys = Object.keys(record).sort(); const pairs = sortedKeys.map( (key) => `${JSON.stringify(key)}:${this.canonicalize(record[key])}` ); return "{" + pairs.join(",") + "}"; } /** * Computes a SHA-256 fingerprint for the specific tool and payload. */ public generateKey<T>(invocation: ToolInvocation<T>): string { const canonicalPayload = this.canonicalize(invocation.arguments); const raw = `${invocation.sessionId}:${invocation.toolName}:${canonicalPayload}`; return createHash("sha256").update(raw).digest("hex"); } /** * Evaluates whether the tool invocation is safe to execute or should be suppressed. */ public evaluate<T, R>(invocation: ToolInvocation<T>): ArbiterResult<R> { const key = this.generateKey(invocation); const now = Date.now(); const existing = this.cache.get(key); if (!existing) { // First time seeing this invocation: allow execution this.cache.set(key, { idempotencyKey: key, firstSeenAt: now, lastAttemptAt: now, attemptCount: 1, }); return { allowed: true, idempotencyKey: key }; } // Check if the sliding window has expired if (now - existing.firstSeenAt > this.windowMs) { this.cache.set(key, { idempotencyKey: key, firstSeenAt: now, lastAttemptAt: now, attemptCount: 1, }); return { allowed: true, idempotencyKey: key }; } // Duplicate call detected inside active window! existing.attemptCount += 1; existing.lastAttemptAt = now; const remainingSeconds = Math.ceil((this.windowMs - (now - existing.firstSeenAt)) / 1000); if (existing.attemptCount > this.maxDuplicatesBeforeTrip) { return { allowed: false, idempotencyKey: key, reason: "CIRCUIT_BREAKER_TRIPPED", cooldownRemainingSeconds: remainingSeconds, }; } return { allowed: false, idempotencyKey: key, reason: "DUPLICATE_CALL_SUPPRESSED", cachedResponse: existing.response as R | undefined, cooldownRemainingSeconds: remainingSeconds, }; } /** * Records the successful execution result to serve on subsequent duplicate requests. */ public recordResult<R>(idempotencyKey: string, response: R): void { const entry = this.cache.get(idempotencyKey); if (entry) { entry.response = response; } } private sweepExpired(): void { const now = Date.now(); for (const [key, entry] of this.cache.entries()) { if (now - entry.firstSeenAt > this.windowMs) { this.cache.delete(key); } } } } 

const arbiter = new IdempotencyArbiter({ windowMs: 60_000, // 1 minute protection maxDuplicatesBeforeTrip: 3, }); async function handleAgentToolCall(invocation: ToolInvocation) { const check = arbiter.evaluate(invocation); if (!check.allowed) { if (check.reason === "CIRCUIT_BREAKER_TRIPPED") { // Return a fatal error to force the LLM loop to halt return { isError: true, content: [ { type: "text", text: `[CIRCUIT BREAKER] Fatal: Agent attempted identical invocation ${check.idempotencyKey} repeatedly. Action locked for ${check.cooldownRemainingSeconds}s. Requesting human review.`, }, ], }; } // Return synthetic 409 Conflict with cached response or drop message return { isError: false, content: [ { type: "text", text: `[IDEMPOTENT] Duplicate action detected. Prior dispatch acknowledged. Cooldown active for ${check.cooldownRemainingSeconds}s.`, }, ], }; } try { // Safe to execute real network socket! const result = await realToolExecution(invocation.arguments); arbiter.recordResult(check.idempotencyKey, result); return { isError: false, content: [{ type: "text", text: JSON.stringify(result) }] }; } catch (error) { // If the network call failed, do NOT clear the arbiter immediately. // Let the cooldown prevent immediate identical retry storms. return { isError: true, content: [{ type: "text", text: `Execution failed: ${(error as Error).message}` }], }; } }