fix: path-scoped cycle detection; SafetyGuard list-depth bound (#33)

- _arguments_depth/argumentsDepth: enter/exit bookkeeping so only ancestor back-references are cycles; acyclic shared (DAG) references are allowed, true cycles still fail closed (Greptile P1)

- SafetyGuard._nested_content: increment depth for list children so list-only nesting is bounded; deep or cyclic lists return a decision instead of RecursionError (T-Rex P1)

Tests: 214 passed; taint 0; black clean; tsc clean

Author: rahuldass19

npm/src/guards.ts

@@ -370,26 +370,35 @@ export class ToolGuard extends BaseGuard {
 
     /**
      * Non-recursive max container nesting depth of a value.
-     * Returns -1 when a container cycle is detected (fail closed).
+     * Returns -1 when an ancestor back-reference (true cycle) is detected.
+     * Containers shared by siblings (acyclic DAG references) are allowed —
+     * enter/exit bookkeeping keeps the visited set to the active path only.
      */
     private static argumentsDepth(obj: any): number {
         if (obj === null || typeof obj !== 'object') return 0;
         let max = 0;
-        const stack: Array<[any, number]> = [[obj, 1]];
-        const seen = new Set<any>([obj]);
+        type Frame = [any, number, boolean];
+        const stack: Frame[] = [[obj, 1, true]];
+        const onPath = new Set<any>();
         while (stack.length > 0) {
-            const pair = stack.pop()!;
-            const node = pair[0];
-            const depth = pair[1];
+            const frame = stack.pop()!;
+            const node = frame[0];
+            const depth = frame[1];
+            const entering = frame[2];
+            if (!entering) {
+                onPath.delete(node);
+                continue;
+            }
+            if (onPath.has(node)) return -1;
+            onPath.add(node);
             if (depth > max) max = depth;
+            stack.push([node, depth, false]);
             const children: any[] = Array.isArray(node)
                 ? node
                 : Object.values(node);
             for (const child of children) {
                 if (child !== null && typeof child === 'object') {
-                    if (seen.has(child)) return -1;
-                    seen.add(child);
-                    stack.push([child, depth + 1]);
+                    stack.push([child, depth + 1, true]);
                 }
             }
         }

src/qwed_open_responses/guards/safety_guard.py

@@ -254,7 +254,10 @@ def _nested_content(self, value: Any, depth: int) -> str:
         if isinstance(value, dict):
             return self._extract_content(value, depth)
         if isinstance(value, list):
-            collected = [self._nested_content(item, depth) for item in value]
+            # Increment depth for list children too — otherwise list-only
+            # nesting never reaches _MAX_CONTENT_DEPTH and a deeply (or
+            # cyclically) nested list recurses until RecursionError (T-Rex P1).
+            collected = [self._nested_content(item, depth + 1) for item in value]
             return " ".join(collected)
         if isinstance(value, str):
             return value

src/qwed_open_responses/guards/tool_guard.py

@@ -364,23 +364,32 @@ def _arguments_depth(obj: Any) -> int:
         Used to fail closed on deeply-nested dict arguments before
         ``str(arguments)`` / json.dumps can raise RecursionError (Greptile P1).
         Uses an explicit stack, so it never recurses itself. Returns -1 when
-        a container cycle is detected, so callers fail closed (Greptile P1).
+        an ancestor back-reference (true cycle) is detected, so callers fail
+        closed (Greptile P1). Containers shared by siblings (acyclic DAG
+        references) are allowed — enter/exit bookkeeping keeps the visited
+        set limited to the active traversal path, not the whole traversal.
         """
         if not ToolGuard._is_container(obj):
             return 0
         max_depth = 0
-        stack = [(obj, 1)]
-        seen = {id(obj)}
+        # (node, depth, entering) frames: entering=False marks the exit of a
+        # node, so `on_path` holds only true ancestors at any moment.
+        stack: List[Tuple[Any, int, bool]] = [(obj, 1, True)]
+        on_path: Set[int] = set()
         while stack:
-            node, depth = stack.pop()
+            node, depth, entering = stack.pop()
+            if not entering:
+                on_path.discard(id(node))
+                continue
+            if id(node) in on_path:
+                return -1
+            on_path.add(id(node))
             if depth > max_depth:
                 max_depth = depth
+            stack.append((node, depth, False))
             for child in ToolGuard._container_children(node):
                 if ToolGuard._is_container(child):
-                    if id(child) in seen:
-                        return -1
-                    seen.add(id(child))
-                    stack.append((child, depth + 1))
+                    stack.append((child, depth + 1, True))
         return max_depth
 
     @staticmethod

tests/test_guard_envelope_coverage.py

@@ -527,6 +527,45 @@ def test_cyclic_arguments_fail_closed_no_hang(self):
         ok = guard.check({"type": "function_call", "name": "f", "arguments": {"a": {"b": 1}}})
         assert ok.passed is True
 
+    # ------------------------------------------------------------------
+    # Shared (acyclic) references between siblings are NOT cycles — only
+    # ancestor back-edges are rejected (Greptile P1).
+    # ------------------------------------------------------------------
+
+    def test_shared_reference_arguments_not_flagged_as_cycle(self):
+        shared = {"q": "benign"}
+        guard = ToolGuard()
+        result = guard.check({
+            "type": "function_call",
+            "name": "f",
+            "arguments": {"left": shared, "right": shared},
+        })
+        assert result.passed is True
+        assert ToolGuard._arguments_depth({"left": shared, "right": shared}) == 2
+        # True cycle is still rejected.
+        cyclic = {"a": 1}
+        cyclic["self"] = cyclic
+        assert ToolGuard._arguments_depth(cyclic) == -1
+
+    # ------------------------------------------------------------------
+    # List-only nesting must count toward SafetyGuard's content-depth
+    # bound — deep or cyclic lists must not raise RecursionError (T-Rex P1).
+    # ------------------------------------------------------------------
+
+    def test_deep_list_nesting_bounded_in_safety_guard(self):
+        sg = SafetyGuard()
+        deep = ["leaf"]
+        for _ in range(1100):
+            deep = [deep]
+        # Must return a decision, not raise RecursionError.
+        result = sg.check({"result": deep})
+        assert isinstance(result.passed, bool)
+        # Cyclic list structure must terminate too.
+        cyc = ["x"]
+        cyc.append(cyc)
+        result2 = sg.check({"result": cyc})
+        assert isinstance(result2.passed, bool)
+
     # ------------------------------------------------------------------
     # Multiple top-level tool collections are ambiguous - rejected, not
     # double-counted (Sentry LOW)