fix: prevent reflection loop with global cross-instance re-entrant guard (#369)

* fix: prevent reflection loop with global cross-instance re-entrant guard

Previously each plugin instance maintained its own re-entrant guard Map.
When the runtime re-loaded the plugin during embedded agent turns (e.g.
command:new inside a reflection), a new instance would bypass the guard,
causing infinite reflection loops.

This change introduces two global guards using Symbol.for + globalThis
so ALL plugin instances share the same state:

1. **Global re-entrant lock** — prevents concurrent reflection calls for
   the same sessionKey across all plugin instances.
2. **Serial loop guard** — imposes a 2-minute cooldown per sessionKey
   between consecutive reflection runs, preventing gateway-level
   re-triggering chains (session_end → new session → command:new).

* fix: 仅在 reflection 实际运行后记录 serial cooldown

将 cooldown 时间戳的记录从 finally 无条件执行改为仅当 reflection
通过所有前置条件检查（cfg、session file、conversation）后才记录。
避免因前置条件不满足导致的提前退出误触 cooldown，阻塞后续正常重试。

回应 @rwmjhb 在 #369 的审查反馈。

---------

Co-authored-by: ZengGanghui <zgh@stsctech.com>

Author: ggzeng

index.ts

@@ -3215,8 +3215,48 @@ const memoryLanceDBProPlugin = {
         pruneReflectionSessionState();
       }, { priority: 20 });
 
+      // Global cross-instance re-entrant guard to prevent reflection loops.
+      // Each plugin instance used to have its own Map, so new instances created during
+      // embedded agent turns could bypass the guard. Using Symbol.for + globalThis
+      // ensures ALL instances share the same lock regardless of how many times the
+      // plugin is re-loaded by the runtime.
+      const GLOBAL_REFLECTION_LOCK = Symbol.for("openclaw.memory-lancedb-pro.reflection-lock");
+      const getGlobalReflectionLock = (): Map<string, boolean> => {
+        const g = globalThis as Record<symbol, unknown>;
+        if (!g[GLOBAL_REFLECTION_LOCK]) g[GLOBAL_REFLECTION_LOCK] = new Map<string, boolean>();
+        return g[GLOBAL_REFLECTION_LOCK] as Map<string, boolean>;
+      };
+
+      // Serial loop guard: track last reflection time per sessionKey to prevent
+      // gateway-level re-triggering (e.g. session_end → new session → command:new)
+      const REFLECTION_SERIAL_GUARD = Symbol.for("openclaw.memory-lancedb-pro.reflection-serial-guard");
+      const getSerialGuardMap = () => {
+        const g = globalThis as any;
+        if (!g[REFLECTION_SERIAL_GUARD]) g[REFLECTION_SERIAL_GUARD] = new Map<string, number>();
+        return g[REFLECTION_SERIAL_GUARD] as Map<string, number>;
+      };
+      const SERIAL_GUARD_COOLDOWN_MS = 120_000; // 2 minutes cooldown per sessionKey
+
       const runMemoryReflection = async (event: any) => {
         const sessionKey = typeof event.sessionKey === "string" ? event.sessionKey : "";
+        // Guard against re-entrant calls for the same session (e.g. file-write triggering another command:new)
+        // Uses global lock shared across all plugin instances to prevent loop amplification.
+        const globalLock = getGlobalReflectionLock();
+        if (sessionKey && globalLock.get(sessionKey)) {
+          api.logger.info(`memory-reflection: skipping re-entrant call for sessionKey=${sessionKey}; already running (global guard)`);
+          return;
+        }
+        // Serial loop guard: skip if a reflection for this sessionKey completed recently
+        if (sessionKey) {
+          const serialGuard = getSerialGuardMap();
+          const lastRun = serialGuard.get(sessionKey);
+          if (lastRun && (Date.now() - lastRun) < SERIAL_GUARD_COOLDOWN_MS) {
+            api.logger.info(`memory-reflection: skipping serial re-trigger for sessionKey=${sessionKey}; last run ${(Date.now() - lastRun) / 1000}s ago (cooldown=${SERIAL_GUARD_COOLDOWN_MS / 1000}s)`);
+            return;
+          }
+        }
+        if (sessionKey) globalLock.set(sessionKey, true);
+        let reflectionRan = false;
         try {
           pruneReflectionSessionState();
           const action = String(event?.action || "unknown");
@@ -3282,6 +3322,11 @@ const memoryLanceDBProPlugin = {
             return;
           }
 
+          // Mark that reflection will actually run — cooldown is only recorded
+          // for runs that pass all pre-condition checks, not for early exits
+          // (missing cfg, session file, or conversation).
+          reflectionRan = true;
+
           const now = new Date(typeof event.timestamp === "number" ? event.timestamp : Date.now());
           const nowTs = now.getTime();
           const dateStr = now.toISOString().split("T")[0];
@@ -3476,6 +3521,10 @@ const memoryLanceDBProPlugin = {
         } finally {
           if (sessionKey) {
             reflectionErrorStateBySession.delete(sessionKey);
+            getGlobalReflectionLock().delete(sessionKey);
+            if (reflectionRan) {
+              getSerialGuardMap().set(sessionKey, Date.now());
+            }
           }
           pruneReflectionSessionState();
         }