fix: 长会话任务跑偏护栏——Tab 预填续跑指令 + 上下文回吐退化守卫

Author: universe-hcy

src/screens/REPL.tsx

@@ -1678,6 +1678,31 @@ export function REPL({
     [setIsPromptInputActive, repinScroll, trySuggestBgPRIntercept],
   );
 
+  // Pre-filled "按计划继续 Task #N …" instruction for a stalled long task, or
+  // null. Set when a turn ends with in_progress tasks (see the unfinished-task
+  // notice below), refreshed every turn so it can't go stale; consumed by Tab.
+  const [pendingContinuation, setPendingContinuation] = useState<string | null>(null);
+
+  // Tab on an empty prompt pre-fills the continuation instruction for the
+  // highest-priority unfinished task, letting the user re-anchor a stalled long
+  // task with one keystroke instead of blindly typing "继续". It only pre-fills —
+  // the user still presses Enter to send, so nothing is injected behind their
+  // back (unlike the removed silent <system-reminder> injection). The narrow
+  // isActive (empty input + a pending continuation, on the prompt screen) means
+  // normal Tab completion is never shadowed.
+  useInput(
+    (_input, key, event) => {
+      if (key.tab && !key.shift) {
+        setInputValue(pendingContinuation ?? '');
+        setPendingContinuation(null);
+        event.stopImmediatePropagation();
+      }
+    },
+    {
+      isActive: screen === 'prompt' && pendingContinuation !== null && inputValue === '',
+    },
+  );
+
   // Schedule a timeout to stop suppressing dialogs after the user stops typing.
   // Only manages the timeout — the immediate activation is handled by setInputValue above.
   useEffect(() => {
@@ -3522,6 +3547,53 @@ export function REPL({
         onQueryEvent(event);
       }
 
+      // ── Unfinished-task notice ──
+      // When a turn completes naturally (not interrupted) but a task the model
+      // itself marked in_progress is still unfinished, surface a display-only
+      // local notice so the user doesn't have to blindly nudge "继续". This is a
+      // 'system' message: never sent to the model (0 token cost). Best-effort —
+      // a task-read failure must not affect turn teardown.
+      if (!abortController.signal.aborted) {
+        try {
+          const [{ listTasks, getTaskListId }, { buildUnfinishedTaskNotice, buildContinuationPrompt }] =
+            await Promise.all([import('src/utils/tasks.js'), import('src/services/api/taskAnchorReminder.js')]);
+          const tasks = await listTasks(getTaskListId());
+          const notice = buildUnfinishedTaskNotice(tasks);
+          if (notice) {
+            setMessages(prev => [...prev, createSystemMessage(notice, 'warning')]);
+            setPendingContinuation(buildContinuationPrompt(tasks));
+          } else {
+            setPendingContinuation(null);
+          }
+        } catch {
+          // Ignore — the notice is a convenience, not part of the turn contract.
+        }
+      }
+
+      // ── Context-bleed / degradation guard ──
+      // If the model regurgitated an internal <system-reminder> tag as its own
+      // output, that's an early signal of long-context inference-side degradation
+      // (2026-07-27: the model then hallucinated "file corrupted / tool not
+      // executed" while every tool had actually run). Surface a display-only local
+      // warning suggesting /rewind. 'system' message: never sent to the model
+      // (0 token cost). Read messagesRef.current — the closure's `messages` may be
+      // stale. Best-effort — a detection failure must not affect turn teardown.
+      if (!abortController.signal.aborted) {
+        try {
+          const [{ getLastAssistantMessage, getAssistantMessageText }, { detectContextBleed }] = await Promise.all([
+            import('src/utils/messages.js'),
+            import('src/services/api/degradationGuard.js'),
+          ]);
+          const lastAssistant = getLastAssistantMessage(messagesRef.current);
+          const bleedNotice = lastAssistant ? detectContextBleed(getAssistantMessageText(lastAssistant)) : null;
+          if (bleedNotice) {
+            setMessages(prev => [...prev, createSystemMessage(bleedNotice, 'warning')]);
+          }
+        } catch {
+          // Ignore — the guard is a convenience, not part of the turn contract.
+        }
+      }
+
       if (feature('BUDDY') && typeof (globalThis as Record<string, unknown>).fireCompanionObserver === 'function') {
         const _fireCompanionObserver = (globalThis as Record<string, unknown>).fireCompanionObserver as (
           msgs: unknown,

src/services/api/__tests__/degradationGuard.test.ts

@@ -0,0 +1,64 @@
+import { describe, expect, test } from 'bun:test'
+import { detectContextBleed } from '../degradationGuard'
+
+describe('detectContextBleed', () => {
+  test('fires on a closed reminder block whose body matches a harness fingerprint', () => {
+    // Real sample from session 816c6bda (2026-07-27): a whole assistant text
+    // block that is just a regurgitated internal reminder.
+    const text =
+      '<system-reminder>\nWarning: this tool result is 5 hours old. The user may have continued working since sending it.\n</system-reminder>'
+    const notice = detectContextBleed(text)
+    expect(notice).not.toBeNull()
+    expect(notice).toContain('/rewind')
+  })
+
+  test('fires when the block appears mid-text', () => {
+    const text =
+      '我发现问题了。<system-reminder>This memory is 3 days old, verify before trusting.</system-reminder> 继续核对。'
+    expect(detectContextBleed(text)).not.toBeNull()
+  })
+
+  test('does not fire on normal prose that merely mentions "system reminder"', () => {
+    const text =
+      'The harness injects a system reminder into the user turn, not the assistant.'
+    expect(detectContextBleed(text)).toBeNull()
+  })
+
+  test('does not fire when the tag is named without a closed block', () => {
+    const text = '模型不应该在输出里回吐 <system-reminder> 这种内部标记。'
+    expect(detectContextBleed(text)).toBeNull()
+  })
+
+  test('does not fire on source code that references the tag literal', () => {
+    const text = "const SYSTEM_REMINDER_OPEN = '<system-reminder>'"
+    expect(detectContextBleed(text)).toBeNull()
+  })
+
+  test('does not fire when discussing the degradation, quoting its hallucination phrases', () => {
+    // This is exactly what a CCB dev session does: it names the tag and quotes
+    // the symptom phrases. The old naive `includes('<system-reminder>')` check
+    // false-fired here; the tightened one must not.
+    const text =
+      '收紧后,即使我在回复里提到 <system-reminder> 并引用"文件被污染/工具未执行"这些幻觉短语,也不该误报。'
+    expect(detectContextBleed(text)).toBeNull()
+  })
+
+  test('does not fire on a closed block whose body has no harness fingerprint', () => {
+    // e.g. quoting the language-restriction reminder verbatim for illustration.
+    const text =
+      '<system-reminder>语言限制：只允许中文或英文。</system-reminder>'
+    expect(detectContextBleed(text)).toBeNull()
+  })
+
+  test('returns null for null, empty, and whitespace-only input', () => {
+    expect(detectContextBleed(null)).toBeNull()
+    expect(detectContextBleed('')).toBeNull()
+    expect(detectContextBleed('   \n\t ')).toBeNull()
+  })
+
+  test('returns null for ordinary assistant output', () => {
+    expect(
+      detectContextBleed('Task 1 done. Now onemin_cut_process.py.'),
+    ).toBeNull()
+  })
+})

src/services/api/__tests__/taskAnchorReminder.test.ts

@@ -0,0 +1,92 @@
+import { describe, expect, test } from 'bun:test'
+import type { Task } from '../../../utils/tasks.js'
+import {
+  buildContinuationPrompt,
+  buildUnfinishedTaskNotice,
+} from '../taskAnchorReminder.js'
+
+function task(partial: Partial<Task> & Pick<Task, 'id' | 'status'>): Task {
+  return {
+    subject: `Task ${partial.id}`,
+    description: '',
+    blocks: [],
+    blockedBy: [],
+    ...partial,
+  }
+}
+
+describe('buildContinuationPrompt', () => {
+  test('returns null when there are no unfinished tasks', () => {
+    expect(buildContinuationPrompt([])).toBeNull()
+    expect(
+      buildContinuationPrompt([
+        task({ id: '1', status: 'completed' }),
+        task({ id: '2', status: 'completed' }),
+      ]),
+    ).toBeNull()
+  })
+
+  test('picks the in_progress task over pending ones', () => {
+    const prompt = buildContinuationPrompt([
+      task({ id: '1', status: 'pending', subject: 'first' }),
+      task({ id: '2', status: 'in_progress', subject: 'second' }),
+    ])
+    expect(prompt).toBe('按计划继续 Task #2 second')
+  })
+
+  test('among same status picks the lowest numeric id', () => {
+    const prompt = buildContinuationPrompt([
+      task({ id: '10', status: 'pending', subject: 'ten' }),
+      task({ id: '2', status: 'pending', subject: 'two' }),
+    ])
+    expect(prompt).toBe('按计划继续 Task #2 two')
+  })
+
+  test('ignores completed tasks when picking', () => {
+    const prompt = buildContinuationPrompt([
+      task({ id: '1', status: 'completed', subject: 'done' }),
+      task({ id: '3', status: 'pending', subject: 'todo' }),
+    ])
+    expect(prompt).toBe('按计划继续 Task #3 todo')
+  })
+})
+
+describe('buildUnfinishedTaskNotice', () => {
+  test('returns null when no task is in_progress', () => {
+    expect(buildUnfinishedTaskNotice([])).toBeNull()
+    expect(
+      buildUnfinishedTaskNotice([
+        task({ id: '1', status: 'pending' }),
+        task({ id: '2', status: 'completed' }),
+      ]),
+    ).toBeNull()
+  })
+
+  test('surfaces in_progress task names and pending count', () => {
+    const notice = buildUnfinishedTaskNotice([
+      task({ id: '1', status: 'in_progress', subject: '写模块' }),
+      task({ id: '2', status: 'pending' }),
+      task({ id: '3', status: 'pending' }),
+      task({ id: '4', status: 'completed' }),
+    ])!
+    expect(notice).toContain('#1 写模块')
+    expect(notice).toContain('2 个待办')
+  })
+
+  test('collapses overflow when more than three in_progress tasks', () => {
+    const notice = buildUnfinishedTaskNotice(
+      Array.from({ length: 5 }, (_, i) =>
+        task({ id: String(i + 1), status: 'in_progress' }),
+      ),
+    )!
+    expect(notice).toContain('等 5 个')
+  })
+
+  test('guides the user to press Tab instead of promising bare Enter', () => {
+    const notice = buildUnfinishedTaskNotice([
+      task({ id: '1', status: 'in_progress', subject: '写模块' }),
+    ])!
+    expect(notice).toContain('按 Tab')
+    expect(notice).not.toContain('可直接回车继续')
+  })
+})

src/services/api/degradationGuard.ts

@@ -0,0 +1,69 @@
+// Context-bleed / degradation guard.
+//
+// When the model regurgitates a whole internal <system-reminder> block as its
+// own assistant output, that is a clean early signal of long-context
+// inference-side degradation. These blocks are injected by the harness into the
+// USER side and are never legitimately authored by the model.
+//
+// Seen 2026-07-27 (session 816c6bda): after regurgitating a
+// "<system-reminder>...tool result is 5 hours old...</system-reminder>" block,
+// the model went on to hallucinate "file corrupted" / "tool calls were rendered
+// as literal text and not executed" — while every tool had actually run and
+// every edit had landed. Same inference-side hallucination family documented in
+// the context-contamination investigation.
+//
+// Detection is deliberately narrow: naming the <system-reminder> tag while
+// *discussing* the mechanism (as CCB development sessions constantly do — this
+// very repo has 90+ references across 34 files), writing it in code, or quoting
+// the degradation's hallucination phrases ("文件被污染", "工具未执行") must NOT
+// trip the guard. We therefore require a *closed* <system-reminder>…</system-reminder>
+// block whose body carries fingerprint text that only harness-generated
+// reminders contain. A false alarm here erodes trust and nags the user, so we
+// bias toward missing an unclosed/novel regurgitation over firing on normal prose.
+
+const SYSTEM_REMINDER_OPEN = '<system-reminder>'
+
+// Matches a fully closed reminder block; capture group 1 is the body.
+const CLOSED_REMINDER_BLOCK = /<system-reminder>([\s\S]*?)<\/system-reminder>/gi
+
+// Body-text fingerprints that appear *inside* harness-generated reminders
+// (tool-result staleness, memory age, todo nudge, hook context, the former
+// task-anchor injection…). Discussing the mechanism references the tag, not
+// these full internal sentences, so requiring one of these inside a closed
+// block is what keeps the false-positive rate low.
+const REMINDER_BODY_FINGERPRINTS = [
+  /tool result is\b/i,
+  /\b(?:hours?|minutes?) old\b/i,
+  /this memory is\b[\s\S]*\bdays? old\b/i,
+  /gentle reminder/i,
+  /never mention this reminder/i,
+  /hook additional context/i,
+  /generated by the client/i,
+  /not sent by the user/i,
+]
+
+const CONTEXT_BLEED_NOTICE =
+  '检测到模型在输出中回吐了完整的内部 <system-reminder> 提醒块——这通常是超长上下文下推理侧退化/上下文回吐的早期信号，模型接下来可能虚构"文件被污染/工具未执行"等并不存在的问题。建议 /rewind 回到上一轮，或先核对文件与工具结果均正常再继续。'
+
+/**
+ * Returns a display-only, user-facing warning when `assistantText` contains a
+ * regurgitated internal <system-reminder> block, else null. Requires a closed
+ * <system-reminder>…</system-reminder> block whose body matches a harness
+ * reminder fingerprint, so merely mentioning the tag (in discussion, code, or
+ * docs) does not fire. Zero token cost — the caller surfaces this as a local
+ * 'warning' system message, never sent to the model.
+ */
+export function detectContextBleed(
+  assistantText: string | null,
+): string | null {
+  if (!assistantText || !assistantText.includes(SYSTEM_REMINDER_OPEN)) {
+    return null
+  }
+  for (const match of assistantText.matchAll(CLOSED_REMINDER_BLOCK)) {
+    const body = match[1]
+    if (REMINDER_BODY_FINGERPRINTS.some(re => re.test(body))) {
+      return CONTEXT_BLEED_NOTICE
+    }
+  }
+  return null
+}

src/services/api/taskAnchorReminder.ts

@@ -0,0 +1,63 @@
+import type { Task } from '../../utils/tasks.js'
+
+// Unfinished tasks are re-surfaced to the *user* (never injected into the model
+// request) after a turn ends with work still pending. See the long-session
+// drift investigation (2026-07-23): rather than silently re-injecting a
+// <system-reminder> — which a degraded model can misread as a prompt-injection
+// attack — we let the user re-anchor with one keystroke that pre-fills a real
+// user instruction into the input box.
+
+const STATUS_ORDER: Record<string, number> = {
+  in_progress: 0,
+  pending: 1,
+}
+
+/**
+ * Picks the highest-priority unfinished task (in_progress before pending, then
+ * by numeric id) and returns a ready-to-send user instruction re-anchoring the
+ * model to it, e.g. "按计划继续 Task #2 改 onemin_cut_process.py". Returns null
+ * when nothing is unfinished. The caller pre-fills this into the input box; it
+ * is sent only when the user actually presses Enter, so it costs no extra token
+ * and is never injected behind the user's back.
+ */
+export function buildContinuationPrompt(tasks: Task[]): string | null {
+  const unfinished = tasks.filter(t => t.status !== 'completed')
+  if (unfinished.length === 0) {
+    return null
+  }
+  const [top] = [...unfinished].sort((a, b) => {
+    const byStatus =
+      (STATUS_ORDER[a.status] ?? 2) - (STATUS_ORDER[b.status] ?? 2)
+    if (byStatus !== 0) {
+      return byStatus
+    }
+    return Number(a.id) - Number(b.id)
+  })
+  return `按计划继续 Task #${top.id} ${top.subject}`
+}
+
+// How many in_progress task names to spell out in the local notice.
+const MAX_NOTICE_TASK_NAMES = 3
+
+/**
+ * Builds a display-only, user-facing notice for when a turn ends naturally while
+ * tasks are still in_progress — a strong signal the model stopped mid-work. Only
+ * in_progress tasks trigger it (a pending backlog the user is pacing does not).
+ * Returns null when there is nothing worth surfacing. This text is shown in the
+ * REPL and never sent to the model (zero token cost).
+ */
+export function buildUnfinishedTaskNotice(tasks: Task[]): string | null {
+  const inProgress = tasks.filter(t => t.status === 'in_progress')
+  if (inProgress.length === 0) {
+    return null
+  }
+  const pendingCount = tasks.filter(t => t.status === 'pending').length
+  const names = inProgress
+    .slice(0, MAX_NOTICE_TASK_NAMES)
+    .map(t => `#${t.id} ${t.subject}`)
+    .join('、')
+  const overflow = inProgress.length - MAX_NOTICE_TASK_NAMES
+  const namesSuffix = overflow > 0 ? ` 等 ${inProgress.length} 个` : ''
+  const pendingSuffix = pendingCount > 0 ? `，另有 ${pendingCount} 个待办` : ''
+  return `还有进行中的任务未完成：${names}${namesSuffix}${pendingSuffix}。按 Tab 填入续跑指令（可编辑后回车发送）。`
+}