google-gemini / google-gemini/gemini-cli
fix(agent): prevent session context poisoning and infinite loops on interrupted turns
- Dominant language
- TypeScript
- Stars
- 107k
- Forks
- 14.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 45
Description
### Summary
When an agentic loop stream is interrupted (via SIGINT, timeout, or aborted tool execution), the CLI appends a synthetic assistant turn containing `✦ [The previous response was interrupted before it completed.]` directly into the chat session history.
This causes severe **in-context session poisoning**: on subsequent turns, the Gemini model recognizes this string as the expected completion pattern and begins parroting it back, breaking the agentic loop and blocking subsequent tool executions until the session is reset.
---
### Steps to Reproduce
1. Start an interactive agent session: `gemini`
2. Run a prompt that invokes a tool: `search the codebase for all API handlers`
3. Send `SIGINT` (`Ctrl+C`) or trigger a timeout while the model is streaming tokens or executing a tool.
4. Terminal displays: `✦ [The previous response was interrupted before it completed.]`
5. Send any follow-up prompt: `list the files in the directory`
**Actual Result:**
The agent immediately outputs `✦ [The previous response was interrupted before it completed.]` without making function calls or answering the prompt.
**Expected Result:**
The incomplete turn is rolled back or mapped to a benign message so that subsequent prompts execute normally and continue the agentic loop without context poisoning.
---
### Suggested Fix
Substitute `INTERRUPTED_RESPONSE_PLACEHOLDER` with a benign model turn text (like `"Continuing."`) in `extractCuratedHistory` to maintain correct turn-based roles (preventing user-turn fusion/coalescence) while avoiding in-context model poisoning.
Contributor guide
Research direction
Search for extractCuratedHistory and INTERRUPTED_RESPONSE_PLACEHOLDER, then trace how interrupted turns are added to the chat session history. Confirm the change preserves valid turn roles without retaining the poisoning text, and reproduce the SIGINT or timeout flow before verifying that a follow-up prompt can continue the agentic loop and invoke tools normally.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- ai, cli
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 74/100