[bug] #644 follow-up (post-#646, v0.1.97): typo'd render-tag echo (<acip …) bypasses the strip regex and passes through as a 43-char degenerate end_turn turn — agent stalls mid-orchestration until manual nudge

[chenshuangci]

Summary

Follow-up of #644, observed on v0.1.97 which already includes the #646 fix. A new escape form: the model emits a typo'd render-tag echo — <acip tokens="36" type="text">m00473</acip> (acip, not acp). None of the tag-echo strip regexes match it, so the malformed fragment is passed through verbatim as the turn's entire text (43 chars), with stop_reason="end_turn" and zero tool_use, while the thinking block still contains a complete next-step plan. The agent records a degenerate turn as a normal completion and stalls mid-orchestration until a manual nudge.

Two gaps:

1. Strip requires exact <acp spelling — a one-letter typo structurally bypasses every defense added in fix: bound close-side tag-echo tail so a malformed </acp can't eat following content (#644) #646.
2. No degenerate-turn detection — post-strip text empty or a pure echo fragment + end_turn + zero tool_use + non-empty thinking is treated as a normal completed turn by the model, bili, and the host. Nobody catches it.

Evidence chain (three-way closure, all UTC 2026-09-09)

1. Upstream raw SSE dump ~/.local/share/billion-context/raw/1788980229387-0166b4ba-afc8-4d0b-92b0-a8f599f5bcbd-raw.sse (30,341 bytes / 226 events):

• All text deltas concatenated = exactly the 43-char fragment <acip tokens="36" type="text">m00473</acip> — this is the turn's entire visible output.
• message_delta carries genuine stop_reason="end_turn" with usage input=419, cache_read=115584, output=223 (ruling out the emitError fabrication path, which has an [acp-proxy: ...] text prefix and all-zero usage).
• Zero tool_use content blocks.
• The thinking block (386 chars) ends with a complete next-step plan — the model degenerated mid-orchestration (thinking–act disconnect), it did not deliberately finish.

2. bili.log: last acp-usage for the session at 18:57:13.762Z (input=116003 = 419+115584, closes with the dump), then zero session activity until 18:59:09Z when the user manually sends "continue" (processTurn: 267 msgs resumes normally). The string acip has 0 matches in the entire log — the strip never saw the fragment. The 6 [tag-echo] stripped lines in the surrounding window (18:55–18:58Z) are all exact-spelling <acp from other turns.

3. Host side (client log): the turn is recorded as a normal completion — responseLength=43, toolCallCount=0, finishReason="stop", followed by turn.completed, no error events.

The echoed ref m00473 is the message id the user later quoted when reporting the stall — confirming the stream belongs to the affected session.

Why current defenses miss

Strip regexes in dist/index.js (~offset 2223722):

PAIRED     = /<acp\s[^<>]{0,256}>([^<>]{0,64})<\/acp>/
LONE_OPEN  = /<acp(?:\s[^<>]{0,256})?>/
TRUNC_OPEN = /<acp\s[^<>]*$/

All require the exact <acp opening; the string acip appears 0 times in the whole bundle. The typo'd tag is never matched, so #646's close-side bound handling never engages — the fragment rides through untouched.

The typo is chronic, not a one-off

Later dumps from the same day show the variant repeatedly, e.g. one turn mixing a correct <acp opening with a typo'd </acip closing (dump 1788980392406). Variant tolerance matters beyond a single fluke.

Impact

• Mid-orchestration stall until a human nudge (~2 min here; the same family has caused multi-hour silent gaps).
• The 43-char garbage fragment is shown to the user as the turn's report.

Suggestions

1. Echo detection should not depend on exact spelling — e.g. tolerate close variants of the tag name (<acp/<acip-ish shapes wrapping an acp-style tokens=/ref payload), scoped tightly so legit text is not eaten.
2. Degenerate-turn detection: after stripping, if the final text is empty or a pure echo fragment AND stop_reason=end_turn AND zero tool_use AND the thinking block is non-empty → emit a warning (or auto-retry the turn once). Currently all three layers treat it as a normal completion, which is what turns a model glitch into a silent stall.

Environment: bili v0.1.97 (includes #646, shipped in v0.1.96), GLM-5.3 upstream, dumps under ~/.local/share/billion-context/raw/.

[ranxianglei]

🤖 Powered by ework · qwen3.8-27b

[bot] 🏷 Acknowledged — verified at the code level before touching anything.

Reproduction confirmed (static). Every tag-echo pattern in src/loop/tag-echo-filter.ts hard-codes the exact acp spelling (PAIRED / LONE_OPEN / LONE_CLOSE / TRUNC_OPEN / TRUNC_CLOSE / PARTIAL_TAIL), and the cheap per-chunk pre-check gate (RENDER_TAG_DETECT / mayStartRenderTag) also keys on the contiguous substring acp. A typo'd <acip …> contains no contiguous acp, so the streaming state machine never even engages — the fragment rides through byte-identical at every layer. That matches your log evidence exactly (zero acip matches, zero strip activity, genuine end_turn with real usage).

Layer judgment: root cause is the spelling-exact detection, not the client or the model contract. The #646 close-side bound was correct but only widened the exact-spelling path; the typo variant bypasses upstream of it.

Plan:

1. Extend echo detection to bounded typo variants of the tag name (the three core letters in any order, plus at most one duplicated/inserted letter from that set — covers acip/acpi/mixed open-close), applied uniformly across all patterns and the pre-check gate so tokenizer-sized fragments still stitch. Boundary requirements stay tight (name must be followed by whitespace/>, attrs stay bounded) so legit text like <acpi/acpi.h> includes, <caption> HTML, and the underscore-namespaced protocol triggers are provably untouched.
2. Degenerate-turn detection: after stripping, if the turn's visible text is empty AND stop_reason=end_turn AND zero tool_use AND the thinking block is non-empty → prominent [degenerate-turn] warning in bili.log, in both proxy mode (compress loop) and plugin passthrough.

On suggestion 2's "auto-retry once": shipping warn-only in this change. Auto-retry means the proxy re-issues the request server-side, which interacts with billing, recursion bounds, and client-side retry behavior — that deserves its own design pass (and probably an opt-in config key). If you want it, say so and I'll follow up with a proposal.

Will update here with a PR once tests are green.

[ranxianglei]

🤖 Powered by ework · qwen3.8-27b

[bot] 🏷 修好了,PR 已开:#674

审核结论(先审核后动手)

1. 复现/查证:成立。静态验证了你日志里的形态——typo'd 名字(如 acpi)不含连续的 acp,而 v0.1.97 的 strip 管线里每一个模式(RENDER_TAG_DETECT、PAIRED、LONE_、TRUNC_、PARTIAL_TAIL)都要求精确拼写,所以整个过滤机器根本没被触发,43 字符原样透传。你日志里 grep 不到任何 acip 相关记录与此完全一致。
2. 层次判断:精确拼写门是根因,agent 卡死是症状。只加"空回合告警"不修 strip,垃圾文本会继续进上下文污染 prefix cache;只修 strip 不加工具,同类新变体再出现时仍然静默。两个 gap 都要补,但检测器只做 WARN——auto-retry 涉及计费、kernel 状态、客户端自身重试策略的交互,这个决定留给你拍板(WARN 落地后,重试可以作为独立跟进项安全地加在它后面)。
3. 方案:
   • Gap 1:strip 模式改为匹配 acplike 名字集合(acp 的全排列 + 插入一个 a/c/p/i 字符,共 66 个成员,程序化生成便于审计),但每处仍强制名字边界(后跟空白或闭合符)——C 头文件 include(acpi/acpi.h)、caption、app、大写 ACPI_DEVICE、下划线触发词全部验证不受影响。吞并扫描(swallow-until-close)同时覆盖"开标签正确、闭标签 typo"的混合形态(你后面 dump 里出现过)。原有上限不变(128/4096/80),最坏误伤面受其约束。
   • Gap 2:新增纯函数判定 + 消息构造(src/degenerate-turn.ts):终态回合且可见文本为零 + tool call 为零(thinking 非空正是事故形态)→ 记 [degenerate-turn] warn,可 grep。接入全部三个 adapter(anthropic/openai/responses)+ 两条 plugin passthrough 管道;管道侧的可见性统计只计 content/text 字段,thinking/reasoning 不算可见文本。

预检:npm run typecheck 干净;npm test 1279/1279 全过(含新加的 split-parity typo 用例、gate 触发、安全词存活、stats 记账、warn 矩阵、adapter e2e、管道级 warn/no-warn);build 干净。E2E 套件需要本地 upstream,此环境没有跑,变更路径均有单测覆盖。

一句话:修了 typo'd render-tag 绕过 strip 的根因(精确拼写门 → acplike 容错匹配)并加了退化回合 WARN 观测,可以合并。