Harden autopilot steers against prompt injection; fix scrollback flush flash

docs/guides/autopilot.md

@@ -10,20 +10,20 @@ tool calls, answering a command's interactive prompts, answering
 `AskUserQuestion`, and continuing finished turns toward a mission. Only
 gray-zone permission judging is on by default.
 
-Enter AutoPilot mode with `shift+tab` (cycle until the amber
+Enter Autopilot mode with `shift+tab` (cycle until the amber
 `⏵⏵ autopilot on`), and configure it with the `/autopilot` panel. To launch a
-mission hands-free, hit the panel's **Start** button — it engages AutoPilot and
+mission hands-free, hit the panel's **Start** button — it engages Autopilot and
 submits the opening step in one action (see [Start](#start-the-mission)). A
 resumed session (`san -r <id>`) comes back in the mode it was saved in.
 
 ## The six steers
 
 Steers are à-la-carte toggles, ordered by increasing autonomy. None fire unless
-AutoPilot mode is engaged.
+Autopilot mode is engaged.
 
 | Steer | Default | What it does |
 |---|---|---|
-| **Suggest** | off | Fills the input hint (ghost text) with the copilot's proposed next step — toward the mission when one is set, the generic prediction otherwise. `tab` accepts, `enter` sends. It suggests; it never acts. With Suggest *off*, AutoPilot suppresses the hint entirely so the copilot doesn't nudge. |
+| **Suggest** | off | Shows a next-step suggestion in the input box. When a mission is set, the suggestion follows the mission; otherwise it uses the generic input prediction. `tab` accepts the suggestion, and `enter` sends it. Suggest only fills the hint text and never submits on its own; when off, this hint is hidden. |
 | **Permission** | **on** | Auto-approves gray-zone tool calls the static rules couldn't resolve, judging reversibility, blast radius, and data exfiltration. Fails closed: any error escalates to you. |
 | **Bash** | off | Answers an already-approved command's interactive prompt (`Continue? [Y/n]`) when the answer just continues the approved action; skips anything that would widen scope. |
 | **Skill** | off | Approves the copilot's skill loads outright, without the judge — a deliberate "trust skills" toggle, separate from Permission because the judge tends to escalate a skill load (it can run scripts). Off ⇒ skill loads fall to the Permission judge (or you). |
@@ -44,7 +44,7 @@ irreversible, destructive, out-of-project, or data-leaking, mission or not.
 
 When the End steer decides the mission is **fully accomplished**, it retires
 it: the mission is cleared and the steers reset to the passive baseline
-(Permission + Bash) — AutoPilot stays on, you take the wheel back with the
+(Permission + Bash) — Autopilot stays on, you take the wheel back with the
 auto-approve safety net intact.
 
 ## Start the mission
@@ -55,12 +55,12 @@ pick, `enter` to run):
 - **Save** applies the config to the live session and writes it to
   `settings.json` as the default seed, without changing the mode. Use it when
   you're only tuning steers, or want to engage later with `shift+tab`.
-- **Start** does everything Save does, then engages AutoPilot and kicks the
+- **Start** does everything Save does, then engages Autopilot and kicks the
   mission hands-free: it derives the opening step from the mission and submits
   it itself, so briefing a mission and hitting Start is the whole launch. Start
   needs a mission — with none set it nudges you instead of engaging.
 
-Landing on AutoPilot via `shift+tab` no longer auto-starts; it only surfaces the
+Landing on Autopilot via `shift+tab` no longer auto-starts; it only surfaces the
 Suggest steer's proposal (if on). Kicking the mission is always the explicit
 Start button.
 
@@ -88,7 +88,7 @@ mkdir /tmp/autopilot-demo && cd /tmp/autopilot-demo && san
 - `esc` back.
 
 **3. Engage** — on the bottom row, press `→` to focus **Start** and hit
-`enter`. That's the last key you need to press: Start engages AutoPilot and,
+`enter`. That's the last key you need to press: Start engages Autopilot and,
 with a mission set, derives the opening step and submits it itself.
 
 **4. Watch the run.** Expect a transcript like:
@@ -110,7 +110,7 @@ with a mission set, derives the opening step and submits it itself.
 Every `❭` in the run carries the green `⎿ autopilot` mark — the copilot typed
 them all, opening step included; you never touched the composer. The `ls` is a
 gray-zone call the Permission steer approved inline. On `✓ mission complete` the mission is cleared and the steers drop back
-to the passive baseline — open `/autopilot` to confirm — while AutoPilot stays
+to the passive baseline — open `/autopilot` to confirm — while Autopilot stays
 engaged.
 
 To see the gentler end of the spectrum, rerun with only **Suggest** on and
@@ -135,18 +135,26 @@ approvals tally there too (`· 3 approved · 1 escalated`).
 ## Configuration
 
 The panel edits the live session config. The model, steers, and continuation cap
-are saved to `settings.json` as the default for new sessions. The **system
-prompt** and **mission** are per-session: they ride the transcript and restore on
+are saved to `settings.json` as the default for new sessions. The **Steering
+Prompt** and **mission** are per-session: they ride the transcript and restore on
 `/resume`, but are never written as the default — a new session starts from the
-built-in prompt with no mission. To carry a custom prompt or mission to another
-session, export it as a preset and import it there.
+built-in steering instructions with no mission. To carry custom steering
+instructions or a mission to another session, export them as a preset and import
+the preset there.
+
+The Steering Prompt controls how the copilot drives; it does not replace the
+immutable control-plane policy. Every LLM steer always receives that policy,
+which fixes the trust boundaries, fail-closed behavior, task-specific safety
+rules, and output contract. The existing `systemPrompt` / `systemPromptFile`
+configuration keys are retained for compatibility and supply only the editable
+steering-instructions portion.
 
 ```jsonc
 {
   "autoPilot": {
     "model": "anthropic/claude-haiku-4-5", // steer decisions; empty = session model
-    "systemPrompt": "…",                   // "how it drives"; per-session, not written here by the panel
-    "systemPromptFile": "~/prompts/pilot.md", // persistent custom default; used when systemPrompt is empty
+    "systemPrompt": "…",                   // Steering Prompt; per-session, not written here by the panel
+    "systemPromptFile": "~/prompts/pilot.md", // persistent steering default; used when systemPrompt is empty
     "mission": "…",                        // per-session; set via the panel
     "maxContinuations": 20,
     "steers": {
@@ -161,7 +169,7 @@ session, export it as a preset and import it there.
 }
 ```
 
-Named presets bundle the whole copilot config — system prompt, mission, and
+Named presets bundle the whole copilot config — Steering Prompt, mission, and
 steers. In the `/autopilot` menu, `e` exports the current config and `i` imports
 one, stored under `~/.san/autopilot/<name>.json`.
 

docs/guides/autopilot.zh.md

@@ -8,20 +8,20 @@ Autopilot 是 San 的自动驾驶系统,旨在最大限度减少人工介入:由
 工具调用、回答命令的交互问询、回答 `AskUserQuestion`,以及在回合结束后朝
 mission 继续推进。默认仅开启灰区权限判定。
 
-用 `shift+tab` 切换到 AutoPilot 模式(循环到琥珀色的 `⏵⏵ autopilot on`),
+用 `shift+tab` 切换到 Autopilot 模式(循环到琥珀色的 `⏵⏵ autopilot on`),
 用 `/autopilot` 面板配置。要免人工启动一个 mission,按面板的 **Start** 按钮
-—— 它一步完成「开启 AutoPilot + 提交开场那一步」(见
+—— 它一步完成「开启 Autopilot + 提交开场那一步」(见
 [启动 mission](#启动-mission))。恢复会话(`san -r <id>`)会回到保存时所在
 的模式。
 
 ## 六个 steer
 
-Steer 是按需组合的开关,按自主程度从低到高排列。AutoPilot 模式未开启时,
+Steer 是按需组合的开关,按自主程度从低到高排列。Autopilot 模式未开启时,
 任何 steer 都不会触发。
 
 | Steer | 默认 | 作用 |
 |---|---|---|
-| **Suggest** | 关 | 把副驾提议的下一步填进输入提示(幽灵文本)—— 有 mission 时朝 mission 提议,没有则退回通用预测。`tab` 接受、`enter` 发送。只建议、不代发。Suggest *关闭*时,AutoPilot 会整体压掉提示,避免副驾怂恿你。 |
+| **Suggest** | 关 | 在输入框里显示下一步建议。设置了 mission 时,建议会围绕 mission;没有 mission 时,显示通用输入预测。`tab` 接受建议,`enter` 发送。Suggest 只填提示文本,不会自动发送;关闭后不显示这类提示。 |
 | **Permission** | **开** | 自动放行静态规则解不了的灰区工具调用,按可逆性、影响面、数据外泄三轴判断。失败即收紧:任何错误都升级给你。 |
 | **Bash** | 关 | 回答已批准命令的交互问询(`Continue? [Y/n]`),仅当回答只是让已批准的动作继续;会扩大范围的一律跳过。 |
 | **Skill** | 关 | 直接放行副驾的 skill 加载(不经判官)—— 一个独立的"信任 skill"开关。因为 skill 可能跑脚本,判官往往会把它升级给你;单开这个就能让副驾自动加载 skill,而不必打开整个灰区。关闭时,skill 加载回落到 Permission 判官(或你)。 |
@@ -39,7 +39,7 @@ steer 都读它:推进类 steer(Suggest、Question、End)朝它开;安全类 ste
 数据的动作,无论是否契合 mission,一律仍升级给你。
 
 当 End steer 判定 mission **已完全达成**,会将其退役:清空 mission、steer 归位
-到被动基线(Permission + Bash)—— AutoPilot 保持开启,你重新接手,自动放行的
+到被动基线(Permission + Bash)—— Autopilot 保持开启,你重新接手,自动放行的
 安全网仍在。
 
 ## 启动 mission
@@ -49,11 +49,11 @@ steer 都读它:推进类 steer(Suggest、Question、End)朝它开;安全类 ste
 
 - **Save** 把配置应用到实时会话,并写入 `settings.json` 作为默认种子,但不
   改变模式。只调 steer、或想稍后再用 `shift+tab` 启动时用它。
-- **Start** 先做 Save 做的一切,再开启 AutoPilot 并免人工发动 mission:从
+- **Start** 先做 Save 做的一切,再开启 Autopilot 并免人工发动 mission:从
   mission 推出开场那一步并自己提交 —— 交代好 mission、按下 Start 就是完整的
   启动。Start 需要一个 mission,没设时它会提示你而不是空转开启。
 
-用 `shift+tab` 落到 AutoPilot 不再自动起步,只会浮出 Suggest steer 的提议
+用 `shift+tab` 落到 Autopilot 不再自动起步,只会浮出 Suggest steer 的提议
 (若开启)。发动 mission 始终是显式的 Start 按钮。
 
 ## Demo:一次免人工的脚手架搭建
@@ -79,7 +79,7 @@ mkdir /tmp/autopilot-demo && cd /tmp/autopilot-demo && san
 - `esc` 返回。
 
 **3. 启动巡航** —— 在底部一行按 `→` 选中 **Start**,回车。这是你需要按的
-最后一个键:Start 开启 AutoPilot,且在 mission 已设时自己推出开场那一步并
+最后一个键:Start 开启 Autopilot,且在 mission 已设时自己推出开场那一步并
 提交。
 
 **4. 观察运行。** 预期的转录大致是:
@@ -102,7 +102,7 @@ mkdir /tmp/autopilot-demo && cd /tmp/autopilot-demo && san
 copilot 敲入,你没有碰过输入框。那条 `ls` 是灰区调用,由 Permission steer
 就地放行。出现
 `✓ mission complete` 时,mission 被清空、steer 归位到被动基线(打开
-`/autopilot` 可确认),而 AutoPilot 保持开启。
+`/autopilot` 可确认),而 Autopilot 保持开启。
 
 想体验最轻的一档,只开 **Suggest** 重跑一遍、用 `shift+tab` 启动:copilot 把
 每一步以幽灵文本提议在输入框里,你用 `tab` + `enter` 接受发送。
@@ -125,16 +125,21 @@ copilot 敲入,你没有碰过输入框。那条 `ls` 是灰区调用,由 Permis
 ## 配置
 
 面板编辑的是本会话的实时配置。model、steer、续跑上限保存进 `settings.json`,作为
-新会话的默认值。**system prompt** 和 **mission** 则按会话走:它们随转录持久化、
-`/resume` 时恢复,但不会被写成默认值 —— 新会话从内置 prompt、无 mission 起步。要把
-自定义的 prompt 或 mission 带到另一个会话,导出成预设再在那边导入。
+新会话的默认值。**Steering Prompt（驾驶指令）**和 **mission** 则按会话走:它们随
+转录持久化、`/resume` 时恢复,但不会被写成默认值 —— 新会话从内置驾驶指令、无
+mission 起步。要把自定义驾驶指令或 mission 带到另一个会话,导出成预设再导入。
+
+Steering Prompt 只负责定义副驾“怎么开”,不会替换不可覆盖的 control-plane policy。
+每个 LLM steer 始终携带这层固定 policy,由它约束信任边界、fail-closed 行为、各任务的
+安全规则和输出格式。配置键 `systemPrompt` / `systemPromptFile` 为兼容保留,其内容只
+作为可编辑的驾驶指令。
 
 ```jsonc
 {
   "autoPilot": {
     "model": "anthropic/claude-haiku-4-5", // steer 判定用的模型;留空用会话模型
-    "systemPrompt": "…",                   // “怎么开”;按会话走,面板不会写到这里
-    "systemPromptFile": "~/prompts/pilot.md", // 持久的自定义默认;systemPrompt 为空时生效
+    "systemPrompt": "…",                   // Steering Prompt;按会话走,面板不会写到这里
+    "systemPromptFile": "~/prompts/pilot.md", // 持久驾驶指令;systemPrompt 为空时生效
     "mission": "…",                        // 按会话;在面板里设置
     "maxContinuations": 20,
     "steers": {
@@ -149,7 +154,7 @@ copilot 敲入,你没有碰过输入框。那条 `ls` 是灰区调用,由 Permis
 }
 ```
 
-命名预设打包整份副驾配置 —— system prompt、mission 和 steer。在 `/autopilot`
+命名预设打包整份副驾配置 —— Steering Prompt、mission 和 steer。在 `/autopilot`
 菜单里,`e` 导出当前配置、`i` 导入,存取于 `~/.san/autopilot/<name>.json`。
 
 ## 关联