dsh-anchored-gpt-patch 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 roc-20 and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE

@@ -0,0 +1,22 @@
+dsh-anchored-gpt-patch
+======================
+
+This project is an independent, community-built agent preset for DeepSeek
+Harness (DSH).
+
+- It is NOT an official DeepSeek product, and it is not affiliated with or
+  endorsed by DeepSeek.
+- The two-phase "anchored bootstrap" design is forked from Jungod1121's
+  `dsh-anchored-standard` (MIT), which itself was inspired by the published
+  work of xiaobright (`xiaobright/dsh-anchored-standard`,
+  `xiaobright/modeltest`). The GPT Patch change — first-request anchors and
+  promoted catalog use the bundled OpenAI Codex `apply_patch` instead of
+  `edit`/`write` — was written for this fork.
+- The preset composition follows the structure of the shipped
+  `standard`/`minimal` agent presets of the official
+  deepseek-ai/deepseek-harness repository, which is licensed under its own
+  terms.
+- `preset/bin/apply_patch` is the OpenAI Codex patch-execution binary,
+  covered by its own license in `preset/bin/LICENSE-OpenAI-Codex.txt`.
+  It is redistributed here as the tool backend for the `apply_patch` preset
+  tool.

package/README.md

@@ -0,0 +1,55 @@
+# dsh-anchored-gpt-patch
+
+锚定标准模式（GPT Patch）：把 `anchored-standard` 的两阶段锚定拿过来，首轮和全量目录里的 `edit` / `write` 全部换成内置的 OpenAI Codex `apply_patch`。适合 GPT / Codex 模型。
+
+> Forked from [`Jungod1121/dsh-anchored-standard`](https://github.com/Jungod1121/dsh-anchored-standard) (MIT, itself inspired by `xiaobright/dsh-anchored-standard`). Community project — not an official DeepSeek preset, not affiliated with or endorsed by DeepSeek.
+
+## 与上游的差别
+
+| | 上游 `anchored-standard` | 本包 `anchored-gpt-patch` |
+|---|---|---|
+| 首轮 spec 锚定 | `bash + read + edit` | `bash + read + apply_patch` |
+| 首轮 react 锚定 | `bash + read + write` | `bash + read + apply_patch` |
+| 晋升后全量目录 | 全部 25 个 Standard 工具（含 `edit/write`） | 过滤掉 `edit`/`write`，文件改动只走 `apply_patch` |
+| 工具后端 | 无 | 自带 `preset/bin/apply_patch` 二进制（见下） |
+| UI | 无 | 建议同装 `dsh-apply-patch-ui`，把 `apply_patch` 调用渲染成 diff 卡 |
+
+## 安装
+
+```sh
+dsh plugin --profile web add dsh-anchored-gpt-patch
+dsh plugin --profile web add dsh-apply-patch-ui
+```
+
+重启 DeepSeek Harness，bundle 会把 preset 拷到 `$DSH_HOME/.agent-presets/anchored-gpt-patch/`（幂等：本地改过的文件不会被覆盖），然后新建空白会话选择 **锚定标准模式（GPT Patch）**。设为新会话默认：
+
+```yaml
+# $DSH_HOME/settings.yaml
+agent-presets:
+  default: anchored-gpt-patch
+```
+
+## 验证
+
+导出会话 JSONL，看 `request/header` 事件：首个 header 只有 `bash/read/apply_patch` 三件套，第一次 `tool/call` 之后恢复全量目录（不再含 `edit`/`write`）。
+
+## 当前限制
+
+- `preset/bin/` 目前只带 Windows 的 `apply_patch.exe`，macOS / Linux 暂不支持（装得上但工具执行会失败）。
+- `apply_patch` 二进制是 OpenAI Codex 的产物，遵循 `preset/bin/LICENSE-OpenAI-Codex.txt`，随包再分发。
+- Harness 处在 developer preview，升级前先看上游 breaking changes。
+
+## 卸载
+
+```sh
+dsh plugin --profile web remove dsh-anchored-gpt-patch
+rm -rf "${DSH_HOME:-$HOME/.dsh}/.agent-presets/anchored-gpt-patch"
+```
+
+## 兼容性
+
+从 harness `0.1.1-rc.2` + `anchored-standard` 的 `0.1.0-rc.6` 验证基线 fork，实测以你本地为准。
+
+## License
+
+MIT — [LICENSE](./LICENSE)，第三方二进制见 [NOTICE](./NOTICE)。

package/cordis.patch.yml

@@ -0,0 +1,5 @@
+# The `dsh-anchored-gpt-patch` bundle layer: one installer entry that copies the
+# bundled preset into the user preset root on boot.
+- insert:
+    - id: anchored-gpt-patch-installer
+      name: dsh-anchored-gpt-patch

package/index.js

@@ -0,0 +1,104 @@
+/**
+ * Installer for the `anchored-gpt-patch` agent preset.
+ *
+ * This bundle plugin copies the bundled preset (preset/agent.cordis.yml,
+ * preset/preset.yml, preset/tool-bootstrap.mjs, preset/apply-patch.mjs, plus
+ * the patch-execution backend under preset/bin/) into the user preset root
+ * `$DSH_HOME/.agent-presets/anchored-gpt-patch/` exactly once on boot, so
+ * `dsh plugin --profile web add dsh-anchored-gpt-patch`
+ * also makes the preset selectable in the session preset list.
+ *
+ * Forked from Jungod1121's `dsh-anchored-standard` installer (MIT).
+ * The GPT Patch difference: the preset replaces `edit`/`write` with the
+ * bundled OpenAI Codex `apply_patch` tool, so the binary backend must be
+ * installed alongside the preset sources.
+ *
+ * Idempotent and non-destructive:
+ *  - a missing target file is written;
+ *  - an identical target file is left untouched (no-op);
+ *  - a DIFFERENT target file is left untouched with a one-time-ish warning,
+ *    so a locally edited preset is never overwritten.
+ * Uninstalling this bundle never deletes the installed preset — delete the
+ * `anchored-gpt-patch` directory under the user preset root manually if you
+ * want it gone.
+ */
+
+import { existsSync } from 'node:fs'
+import { mkdir, readFile, writeFile, chmod } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+/** Cordis plugin name used by loader diagnostics. */
+export const name = 'anchored-gpt-patch-installer'
+
+const PRESET_ID = 'anchored-gpt-patch'
+const PRESET_FILES = ['agent.cordis.yml', 'preset.yml', 'tool-bootstrap.mjs', 'apply-patch.mjs']
+const BIN_FILES = ['bin/apply_patch.exe', 'bin/LICENSE-OpenAI-Codex.txt']
+
+export async function apply(ctx) {
+  const log = {
+    info(message) {
+      try {
+        if (ctx.logger && typeof ctx.logger.info === 'function') ctx.logger.info(message)
+      } catch {
+        // logger unavailable — nothing to do
+      }
+    },
+    warn(message) {
+      try {
+        if (ctx.logger && typeof ctx.logger.warn === 'function') ctx.logger.warn(message)
+      } catch {
+        // logger unavailable — nothing to do
+      }
+    },
+  }
+
+  try {
+    const packageDir = dirname(fileURLToPath(import.meta.url))
+    const sourceDir = join(packageDir, 'preset')
+    const dshHome = process.env.DSH_HOME || join(homedir(), '.dsh')
+    const targetDir = join(dshHome, '.agent-presets', PRESET_ID)
+
+    await mkdir(targetDir, { recursive: true })
+
+    let installed = 0
+    let kept = 0
+    for (const file of [...PRESET_FILES, ...BIN_FILES]) {
+      const source = join(sourceDir, file)
+      const target = join(targetDir, file)
+      const content = await readFile(source)
+      if (existsSync(target)) {
+        const existing = await readFile(target)
+        if (existing.equals(content)) continue
+        log.warn(`${name}: ${target} exists with different content; leaving it untouched`)
+        kept += 1
+        continue
+      }
+      await mkdir(dirname(target), { recursive: true })
+      await writeFile(target, content)
+      installed += 1
+    }
+
+    // POSIX users running a non-.exe backend keep exec permission when the
+    // backend is refreshed by this installer. Best-effort: never fail boot.
+    try {
+      const backend = join(targetDir, 'bin', 'apply_patch')
+      if (existsSync(backend)) await chmod(backend, 0o755)
+    } catch {
+      // ignore — Windows backends need no chmod
+    }
+
+    log.info(
+      installed > 0
+        ? `${name}: installed preset '${PRESET_ID}' (${installed} file(s)) at ${targetDir}`
+        : kept > 0
+          ? `${name}: preset '${PRESET_ID}' already present at ${targetDir} (${kept} locally edited file(s) kept untouched)`
+          : `${name}: preset '${PRESET_ID}' already present and up to date at ${targetDir}`,
+    )
+    log.info(`${name}: the '${PRESET_ID}' preset is now selectable for new sessions; set settings 'agent-presets.default' to make it the default.`)
+  } catch (error) {
+    // An installer failure must never take the bundle down with it.
+    log.warn(`${name}: preset install failed (plugin continues without it): ${String((error && error.message) || error)}`)
+  }
+}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "dsh-anchored-gpt-patch",
+  "version": "1.0.0",
+  "description": "Anchored Standard preset with GPT Patch mode: task-aware first-request anchors using the bundled OpenAI Codex apply_patch instead of edit/write. Built for GPT/Codex models.",
+  "type": "module",
+  "main": "index.js",
+  "exports": {
+    ".": "./index.js"
+  },
+  "files": [
+    "index.js",
+    "cordis.patch.yml",
+    "preset/",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "keywords": [
+    "dsh",
+    "deepseek-harness",
+    "dsh-plugin",
+    "agent-preset",
+    "anchored-standard",
+    "gpt-patch",
+    "apply-patch",
+    "openai-codex"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/roc-20/dsh-anchored-gpt-patch.git"
+  },
+  "homepage": "https://github.com/roc-20/dsh-anchored-gpt-patch#readme",
+  "bugs": {
+    "url": "https://github.com/roc-20/dsh-anchored-gpt-patch/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "MIT"
+}

package/preset/agent.cordis.yml

@@ -0,0 +1,214 @@
+# The `anchored-standard` user preset (v2): task-aware first-request anchors,
+# then the full Standard tool catalog after the first durable tool call.
+#
+# Composition plan (verified on harness 0.1.0-rc.6):
+#   1. `tool-bootstrap` classifies the session's FIRST user message into an
+#      anchor — spec (fix/maintain: Minimal persona + bash/read/edit), react
+#      (build/create: doer persona + bash/read/write), or weak (ambiguous:
+#      model self-picks + bash/read). `glob`/`grep` stay out of the bootstrap
+#      catalogs (measured trajectory boundary for V4 Pro).
+#   2. On the first request the persona is the ONLY prompt section and
+#      runtime contexts are cleared — the cleanest possible opening.
+#   3. After the first durable `tool/call`, every later request sees the
+#      full Standard catalog; the chosen persona stays constant and the
+#      remaining sections (plan-mode etc.) return. Nothing is injected
+#      after turn one (measured: anchors hurt Pro).
+#
+# This is a community preset. It is not an official DeepSeek preset and is not
+# affiliated with or endorsed by DeepSeek. The upstream harness is a developer
+# preview with breaking changes; review upstream changes before upgrading.
+
+# ── identity ────────────────────────────────────────────────────────────────
+
+# Fallback persona only: `tool-bootstrap` replaces the persona section on
+# every assembly with the task-matched anchor persona (spec/react/weak).
+# Keep this text byte-identical to the Minimal preset as the safe fallback.
+- id: persona
+  name: '@deepseek-ai/dsh-persona'
+  config:
+    text: You are a helpful software engineer assistant.
+
+- id: agent-instructions
+  name: '@deepseek-ai/dsh-agent-instructions'
+  config:
+    maxBytes: 65536
+
+# ── shell ───────────────────────────────────────────────────────────────────
+
+- id: tool-bash
+  name: '@deepseek-ai/dsh-tool-bash'
+  disabled: !!js process.platform === 'win32'
+
+- id: tool-pwsh
+  name: '@deepseek-ai/dsh-tool-pwsh'
+  disabled: !!js process.platform !== 'win32'
+
+# ── filesystem ──────────────────────────────────────────────────────────────
+
+- id: tool-fs
+  name: '@deepseek-ai/dsh-tool-fs'
+
+- id: tool-fs-search
+  name: '@deepseek-ai/dsh-tool-fs-search'
+  config:
+    sampleOverCapGlobResults: false
+
+# ── background jobs ────────────────────────────────────────────────────────
+
+- id: tool-jobs
+  name: '@deepseek-ai/dsh-tool-jobs'
+
+# ── skills ──────────────────────────────────────────────────────────────────
+
+- id: skill-filesystem
+  name: '@deepseek-ai/dsh-skill-filesystem'
+
+- id: tool-skill
+  name: '@deepseek-ai/dsh-tool-skill'
+
+# ── goals ───────────────────────────────────────────────────────────────────
+
+- id: tool-goal
+  name: '@deepseek-ai/dsh-tool-goal'
+
+# ── plan mode ───────────────────────────────────────────────────────────────
+
+- id: planning
+  name: cordis:group
+  group: true
+  isolate:
+    planMode: true
+  config:
+    - id: plan-mode
+      name: '@deepseek-ai/dsh-plan-mode'
+      config:
+        section: |
+              You are in plan mode. Stay in plan mode until exit_plan_mode succeeds or the user switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
+
+              Explore first. Use non-mutating reads, searches, static analysis, and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan. Prefer existing functions and patterns over new machinery.
+
+              The tool catalog stays the same across modes for request-cache stability. These plan-mode rules override any later tool description or guidance that suggests using mutation tools; those tools remain listed to keep the tool catalog unchanged. Do not use todo_write to track this planning phase: it tracks implementation after an approved plan, while the plan itself belongs in exit_plan_mode.
+
+              Resolve discoverable facts by inspection. Use ask_user_question only for user-owned choices or material ambiguity that inspection cannot answer. Do not ask the user where code lives or how current behavior works when you can find out.
+
+              Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.
+
+              When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
+
+# ── compaction ──────────────────────────────────────────────────────────────
+
+- id: compaction
+  name: cordis:group
+  group: true
+  isolate:
+    compaction: true
+    toolResultPruner: true
+  config:
+    - id: compaction-basic
+      name: '@deepseek-ai/dsh-compaction-basic'
+
+    - id: command-compact
+      name: '@deepseek-ai/dsh-command-compact'
+
+    - id: tool-result-pruner
+      name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+      config:
+        thresholdChars: 8192
+        headChars: 4096
+        tailChars: 1024
+
+# ── delegation and workflows ────────────────────────────────────────────────
+
+- id: delegation
+  name: cordis:group
+  group: true
+  isolate:
+    workflowEngine: true
+  config:
+    - id: tool-subagent-control
+      name: '@deepseek-ai/dsh-tool-subagent-control'
+
+    - id: tool-subagent-list-agents
+      name: '@deepseek-ai/dsh-tool-subagent-control/list-agents'
+
+    - id: tool-subagent
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: spawn
+        toolName: subagent
+        backgroundMode: continuable
+        agentOptions:
+          provider: openai-codex
+          model: gpt-5.6-luna
+          maxTokens: 128000
+
+    - id: tool-subagent-fork
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: fork
+        toolName: subagent_fork
+        backgroundMode: continuable
+
+    - id: tool-subagent-codex
+      name: '@deepseek-ai/dsh-tool-subagent'
+      disabled: true
+      config:
+        provider: codex
+        toolName: subagent_codex
+        enableRunInBackground: false
+        maxDepth: provider-managed
+
+    - id: tool-subagent-claude-code
+      name: '@deepseek-ai/dsh-tool-subagent'
+      disabled: true
+      config:
+        provider: claude-code
+        toolName: subagent_claude_code
+        enableRunInBackground: false
+        maxDepth: provider-managed
+
+    - id: workflow-worker-thread
+      name: '@deepseek-ai/dsh-workflow-worker-thread'
+      config:
+        provider: spawn
+
+    - id: tool-workflow
+      name: '@deepseek-ai/dsh-tool-workflow'
+
+    - id: tool-ralph
+      name: '@deepseek-ai/dsh-tool-ralph'
+      config:
+        subagentProvider: spawn
+        maxRounds: 64
+
+# ── remaining model-facing rows ─────────────────────────────────────────────
+
+- id: tool-ask-user
+  name: '@deepseek-ai/dsh-tool-ask-user'
+
+- id: tool-todo
+  name: '@deepseek-ai/dsh-tool-todo'
+  config:
+    allowParallelInProgress: true
+
+- id: tool-web
+  name: '@deepseek-ai/dsh-tool-web'
+  config:
+    fetch: false
+    searchTimeoutMs: 60000
+
+# ── bundled OpenAI Codex apply_patch ────────────────────────────────────────
+
+- id: apply-patch
+  name: ./apply-patch.mjs
+
+# ── anchored bootstrap (LAST: the final filter over the assembled catalog) ──
+
+# Task-aware first-request anchors (v2): the first user message picks the
+# anchor — spec (fix: bash+read+edit, Minimal persona), react (build:
+# bash+read+write, doer persona), or weak (ambiguous: bash+read, model
+# self-picks). After the session records its first durable `tool/call`,
+# later step assemblies expose every Standard tool registered above while
+# the chosen persona stays and the other prompt sections return.
+- id: tool-bootstrap
+  name: ./tool-bootstrap.mjs

package/preset/apply-patch.mjs

@@ -0,0 +1,234 @@
+import { spawn } from 'node:child_process'
+import { readFile } from 'node:fs/promises'
+import path from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+const presetDir = path.dirname(fileURLToPath(import.meta.url))
+const executable = path.join(presetDir, 'bin', 'apply_patch.exe')
+const dshNodeModules = path.join(
+  process.env.APPDATA || '',
+  'npm', 'node_modules', '@deepseek-ai', 'dsh', 'node_modules',
+)
+const { defineTool } = await import(pathToFileURL(path.join(
+  dshNodeModules, '@deepseek-ai', 'dsh-tools', 'lib', 'index.js',
+)).href)
+const { structuredPatch } = await import(pathToFileURL(path.join(
+  dshNodeModules, 'diff', 'libesm', 'index.js',
+)).href)
+
+export const name = 'bundled-codex-apply-patch'
+export const inject = ['tools', 'systemPrompt']
+
+function parsePatchOperations(input) {
+  const lines = input.replaceAll('\r\n', '\n').split('\n')
+  const operations = []
+  let index = 0
+  while (index < lines.length) {
+    const header = /^\*\*\* (Add|Update|Delete) File: (.+)$/.exec(lines[index])
+    if (!header) {
+      index += 1
+      continue
+    }
+    const kind = header[1].toLowerCase()
+    const sourcePath = header[2]
+    let end = index + 1
+    while (end < lines.length && !/^\*\*\* (?:Add|Update|Delete) File: /.test(lines[end]) && lines[end] !== '*** End Patch') end += 1
+    const block = lines.slice(index + 1, end)
+    const move = block.map((line) => /^\*\*\* Move to: (.+)$/.exec(line)).find(Boolean)
+    const targetPath = move?.[1] || sourcePath
+    const oldLines = []
+    const newLines = []
+    for (const line of block) {
+      if (line.startsWith('@@') || line === '*** End of File' || line.startsWith('*** Move to:')) continue
+      if (kind === 'add') {
+        if (line.startsWith('+')) newLines.push(line.slice(1))
+      } else if (line.startsWith(' ')) {
+        oldLines.push(line.slice(1))
+        newLines.push(line.slice(1))
+      } else if (line.startsWith('-')) oldLines.push(line.slice(1))
+      else if (line.startsWith('+')) newLines.push(line.slice(1))
+    }
+    operations.push({ kind, sourcePath, targetPath, oldLines, newLines })
+    index = end
+  }
+  return operations
+}
+
+function callDiffs(operations) {
+  return operations.map((operation) => {
+    if (operation.kind === 'add') return { path: operation.targetPath, oldText: null, newText: operation.newLines.join('\n') }
+    if (operation.kind === 'delete') return { path: operation.sourcePath, oldText: 'File will be deleted.', newText: '' }
+    if (operation.oldLines.length === 0 && operation.newLines.length === 0 && operation.sourcePath !== operation.targetPath) {
+      return { path: operation.targetPath, oldText: `Move from ${operation.sourcePath}`, newText: `Move to ${operation.targetPath}` }
+    }
+    return {
+      path: operation.targetPath,
+      oldText: operation.oldLines.length > 0 ? operation.oldLines.join('\n') : null,
+      newText: operation.newLines.join('\n'),
+    }
+  })
+}
+
+async function readUtf8(filePath) {
+  try {
+    return await readFile(filePath, 'utf8')
+  } catch (error) {
+    if (error?.code === 'ENOENT') return null
+    throw error
+  }
+}
+
+function computeHunkDiffs(filePath, before, after) {
+  if (before === null) return [{ path: filePath, oldText: null, newText: after }]
+  const patch = structuredPatch('', '', before, after, undefined, undefined, { context: 3 })
+  return patch.hunks.map((hunk) => {
+    const oldLines = []
+    const newLines = []
+    for (const line of hunk.lines) {
+      if (line.startsWith('\\')) continue
+      const text = line.slice(1)
+      if (line.startsWith('-')) oldLines.push(text)
+      else if (line.startsWith('+')) newLines.push(text)
+      else {
+        oldLines.push(text)
+        newLines.push(text)
+      }
+    }
+    return {
+      path: filePath,
+      oldText: oldLines.length > 0 ? oldLines.join('\n') : null,
+      newText: newLines.join('\n'),
+    }
+  })
+}
+
+function diffsFromMeta(meta) {
+  if (!meta || typeof meta !== 'object' || !Array.isArray(meta.diffs)) return undefined
+  const diffs = meta.diffs.filter((diff) => diff && typeof diff.path === 'string' && (diff.oldText === null || typeof diff.oldText === 'string') && typeof diff.newText === 'string')
+  return diffs.length > 0 ? diffs : undefined
+}
+
+function runPatch(input, cwd, signal) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(executable, [], {
+      cwd,
+      windowsHide: true,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    })
+    child.stdin.end(input)
+    const stdout = []
+    const stderr = []
+    let outputBytes = 0
+    const maxOutputBytes = 1024 * 1024
+    let settled = false
+
+    const fail = (error) => {
+      if (settled) return
+      settled = true
+      reject(error)
+    }
+    const collect = (target) => (chunk) => {
+      outputBytes += chunk.length
+      if (outputBytes > maxOutputBytes) {
+        child.kill()
+        fail(new Error('apply_patch output exceeded 1 MiB'))
+        return
+      }
+      target.push(chunk)
+    }
+    child.stdout.on('data', collect(stdout))
+    child.stderr.on('data', collect(stderr))
+
+    const abort = () => child.kill()
+    signal?.addEventListener('abort', abort, { once: true })
+    child.once('error', fail)
+    child.once('close', (code) => {
+      signal?.removeEventListener('abort', abort)
+      if (settled) return
+      const out = Buffer.concat(stdout).toString('utf8').trim()
+      const err = Buffer.concat(stderr).toString('utf8').trim()
+      if (signal?.aborted) return fail(new Error('apply_patch was canceled'))
+      if (code !== 0) return fail(new Error(err || out || `apply_patch exited with code ${code}`))
+      settled = true
+      resolve(out || 'Done!')
+    })
+  })
+}
+
+export function apply(ctx) {
+  ctx.systemPrompt.section({
+    name: 'tool:apply_patch',
+    order: 102,
+    text: 'Use apply_patch as the sole file-mutation tool. It does not require a prior read: when the conversation or available context already contains enough exact file context, apply the patch directly and avoid a redundant read. Read only when the target content is unknown, the patch context is uncertain, or a patch fails and must be refreshed. Send one complete Codex patch beginning with *** Begin Patch and ending with *** End Patch. It supports Add File, Update File, Delete File, and Move to operations. Use workspace-relative paths.',
+  })
+
+  ctx.tools.register(defineTool({
+    name: 'apply_patch',
+    description: 'Apply a Codex patch directly to files in the current workspace; no prior read is required when patch context is already known.',
+    parameters: {
+      input: {
+        type: 'string',
+        required: true,
+        description: 'Complete Codex patch text from *** Begin Patch through *** End Patch.',
+      },
+    },
+    output: {
+      schema: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          message: { type: 'string', required: true },
+          diffs: {
+            type: 'array',
+            required: true,
+            items: {
+              type: 'object',
+              additionalProperties: false,
+              properties: {
+                path: { type: 'string', required: true },
+                oldText: { required: true, oneOf: [{ type: 'string' }, { type: 'null' }] },
+                newText: { type: 'string', required: true },
+              },
+            },
+          },
+        },
+      },
+      render: (_args, value) => [{ type: 'text', text: value.message }],
+      presentationMeta: (_args, value) => ({ diffs: value.diffs }),
+    },
+    async execute(args, exec) {
+      if (!args.input.startsWith('*** Begin Patch') || !args.input.trimEnd().endsWith('*** End Patch')) {
+        throw new Error('input must be a complete Codex patch from *** Begin Patch through *** End Patch')
+      }
+      const cwd = exec.agent?.session.header.cwd
+      if (!cwd) throw new Error('apply_patch requires a session workspace')
+      const operations = parsePatchOperations(args.input)
+      if (operations.length === 0) throw new Error('apply_patch input contains no file operations')
+      const before = await Promise.all(operations.map((operation) => operation.kind === 'add'
+        ? null
+        : readUtf8(path.resolve(cwd, operation.sourcePath))))
+      const message = await runPatch(args.input, cwd, exec.signal)
+      const diffs = []
+      for (let index = 0; index < operations.length; index += 1) {
+        const operation = operations[index]
+        const after = operation.kind === 'delete' ? '' : (await readUtf8(path.resolve(cwd, operation.targetPath)) ?? '')
+        diffs.push(...computeHunkDiffs(operation.targetPath, before[index], after))
+      }
+      return { message, diffs }
+    },
+    presentCall(args) {
+      const diffs = callDiffs(parsePatchOperations(args.input))
+      return {
+        card: 'diff',
+        title: 'Apply patch',
+        diffs,
+        locations: diffs.map((diff) => ({ path: diff.path })),
+      }
+    },
+    presentResult(_args, result) {
+      if (result.isError) return undefined
+      const diffs = diffsFromMeta(result.meta)
+      return diffs ? { card: 'diff', title: 'Applied patch', diffs } : undefined
+    },
+  }))
+}

package/preset/bin/LICENSE-OpenAI-Codex.txt

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1.  Definitions.
+
+    "License" shall mean the terms and conditions for use, reproduction,
+    and distribution as defined by Sections 1 through 9 of this document.
+
+    "Licensor" shall mean the copyright owner or entity authorized by
+    the copyright owner that is granting the License.
+
+    "Legal Entity" shall mean the union of the acting entity and all
+    other entities that control, are controlled by, or are under common
+    control with that entity. For the purposes of this definition,
+    "control" means (i) the power, direct or indirect, to cause the
+    direction or management of such entity, whether by contract or
+    otherwise, or (ii) ownership of fifty percent (50%) or more of the
+    outstanding shares, or (iii) beneficial ownership of such entity.
+
+    "You" (or "Your") shall mean an individual or Legal Entity
+    exercising permissions granted by this License.
+
+    "Source" form shall mean the preferred form for making modifications,
+    including but not limited to software source code, documentation
+    source, and configuration files.
+
+    "Object" form shall mean any form resulting from mechanical
+    transformation or translation of a Source form, including but
+    not limited to compiled object code, generated documentation,
+    and conversions to other media types.
+
+    "Work" shall mean the work of authorship, whether in Source or
+    Object form, made available under the License, as indicated by a
+    copyright notice that is included in or attached to the work
+    (an example is provided in the Appendix below).
+
+    "Derivative Works" shall mean any work, whether in Source or Object
+    form, that is based on (or derived from) the Work and for which the
+    editorial revisions, annotations, elaborations, or other modifications
+    represent, as a whole, an original work of authorship. For the purposes
+    of this License, Derivative Works shall not include works that remain
+    separable from, or merely link (or bind by name) to the interfaces of,
+    the Work and Derivative Works thereof.
+
+    "Contribution" shall mean any work of authorship, including
+    the original version of the Work and any modifications or additions
+    to that Work or Derivative Works thereof, that is intentionally
+    submitted to Licensor for inclusion in the Work by the copyright owner
+    or by an individual or Legal Entity authorized to submit on behalf of
+    the copyright owner. For the purposes of this definition, "submitted"
+    means any form of electronic, verbal, or written communication sent
+    to the Licensor or its representatives, including but not limited to
+    communication on electronic mailing lists, source code control systems,
+    and issue tracking systems that are managed by, or on behalf of, the
+    Licensor for the purpose of discussing and improving the Work, but
+    excluding communication that is conspicuously marked or otherwise
+    designated in writing by the copyright owner as "Not a Contribution."
+
+    "Contributor" shall mean Licensor and any individual or Legal Entity
+    on behalf of whom a Contribution has been received by Licensor and
+    subsequently incorporated within the Work.
+
+2.  Grant of Copyright License. Subject to the terms and conditions of
+    this License, each Contributor hereby grants to You a perpetual,
+    worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+    copyright license to reproduce, prepare Derivative Works of,
+    publicly display, publicly perform, sublicense, and distribute the
+    Work and such Derivative Works in Source or Object form.
+
+3.  Grant of Patent License. Subject to the terms and conditions of
+    this License, each Contributor hereby grants to You a perpetual,
+    worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+    (except as stated in this section) patent license to make, have made,
+    use, offer to sell, sell, import, and otherwise transfer the Work,
+    where such license applies only to those patent claims licensable
+    by such Contributor that are necessarily infringed by their
+    Contribution(s) alone or by combination of their Contribution(s)
+    with the Work to which such Contribution(s) was submitted. If You
+    institute patent litigation against any entity (including a
+    cross-claim or counterclaim in a lawsuit) alleging that the Work
+    or a Contribution incorporated within the Work constitutes direct
+    or contributory patent infringement, then any patent licenses
+    granted to You under this License for that Work shall terminate
+    as of the date such litigation is filed.
+
+4.  Redistribution. You may reproduce and distribute copies of the
+    Work or Derivative Works thereof in any medium, with or without
+    modifications, and in Source or Object form, provided that You
+    meet the following conditions:
+
+    (a) You must give any other recipients of the Work or
+    Derivative Works a copy of this License; and
+
+    (b) You must cause any modified files to carry prominent notices
+    stating that You changed the files; and
+
+    (c) You must retain, in the Source form of any Derivative Works
+    that You distribute, all copyright, patent, trademark, and
+    attribution notices from the Source form of the Work,
+    excluding those notices that do not pertain to any part of
+    the Derivative Works; and
+
+    (d) If the Work includes a "NOTICE" text file as part of its
+    distribution, then any Derivative Works that You distribute must
+    include a readable copy of the attribution notices contained
+    within such NOTICE file, excluding those notices that do not
+    pertain to any part of the Derivative Works, in at least one
+    of the following places: within a NOTICE text file distributed
+    as part of the Derivative Works; within the Source form or
+    documentation, if provided along with the Derivative Works; or,
+    within a display generated by the Derivative Works, if and
+    wherever such third-party notices normally appear. The contents
+    of the NOTICE file are for informational purposes only and
+    do not modify the License. You may add Your own attribution
+    notices within Derivative Works that You distribute, alongside
+    or as an addendum to the NOTICE text from the Work, provided
+    that such additional attribution notices cannot be construed
+    as modifying the License.
+
+    You may add Your own copyright statement to Your modifications and
+    may provide additional or different license terms and conditions
+    for use, reproduction, or distribution of Your modifications, or
+    for any such Derivative Works as a whole, provided Your use,
+    reproduction, and distribution of the Work otherwise complies with
+    the conditions stated in this License.
+
+5.  Submission of Contributions. Unless You explicitly state otherwise,
+    any Contribution intentionally submitted for inclusion in the Work
+    by You to the Licensor shall be under the terms and conditions of
+    this License, without any additional terms or conditions.
+    Notwithstanding the above, nothing herein shall supersede or modify
+    the terms of any separate license agreement you may have executed
+    with Licensor regarding such Contributions.
+
+6.  Trademarks. This License does not grant permission to use the trade
+    names, trademarks, service marks, or product names of the Licensor,
+    except as required for reasonable and customary use in describing the
+    origin of the Work and reproducing the content of the NOTICE file.
+
+7.  Disclaimer of Warranty. Unless required by applicable law or
+    agreed to in writing, Licensor provides the Work (and each
+    Contributor provides its Contributions) on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+    implied, including, without limitation, any warranties or conditions
+    of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+    PARTICULAR PURPOSE. You are solely responsible for determining the
+    appropriateness of using or redistributing the Work and assume any
+    risks associated with Your exercise of permissions under this License.
+
+8.  Limitation of Liability. In no event and under no legal theory,
+    whether in tort (including negligence), contract, or otherwise,
+    unless required by applicable law (such as deliberate and grossly
+    negligent acts) or agreed to in writing, shall any Contributor be
+    liable to You for damages, including any direct, indirect, special,
+    incidental, or consequential damages of any character arising as a
+    result of this License or out of the use or inability to use the
+    Work (including but not limited to damages for loss of goodwill,
+    work stoppage, computer failure or malfunction, or any and all
+    other commercial damages or losses), even if such Contributor
+    has been advised of the possibility of such damages.
+
+9.  Accepting Warranty or Additional Liability. While redistributing
+    the Work or Derivative Works thereof, You may choose to offer,
+    and charge a fee for, acceptance of support, warranty, indemnity,
+    or other liability obligations and/or rights consistent with this
+    License. However, in accepting such obligations, You may act only
+    on Your own behalf and on Your sole responsibility, not on behalf
+    of any other Contributor, and only if You agree to indemnify,
+    defend, and hold each Contributor harmless for any liability
+    incurred by, or claims asserted against, such Contributor by reason
+    of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+Copyright 2025 OpenAI
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/preset/preset.yml

@@ -0,0 +1,3 @@
+name: 锚定标准模式（GPT Patch）
+description: 基于锚定标准模式，使用内置的 OpenAI Codex apply_patch 替代 edit；适合 GPT/Codex 模型。
+order: 5

package/preset/tool-bootstrap.mjs

@@ -0,0 +1,259 @@
+/**
+ * Anchored tool bootstrap v2 — task-aware reasoning-mode anchors.
+ *
+ * Classifies the session's FIRST user message into one of three anchors and
+ * keeps the first model request on a small, task-matched tool surface:
+ *
+ *   spec  (fix / maintain / debug)   → Minimal persona,  bash + read + edit
+ *   react (build / create / from 0) → doer persona,     bash + read + write
+ *   weak  (ambiguous)               → model self-picks; bash + read only
+ *
+ * After the session records its first durable `tool/call`, every later
+ * request sees the full preset catalog; the chosen persona stays constant,
+ * runtime contexts are cleared, and the remaining prompt sections (plan-mode
+ * etc.) come back. The mode derives from durable session events, so resume
+ * and reload preserve it.
+ *
+ * Design boundaries (measured evidence):
+ *  - `glob` is a trajectory boundary for V4 Pro (xiaobright probes): a
+ *    first-turn catalog with glob breaks the Minimal-like anchor. `grep` is
+ *    unverified. Both stay out of the bootstrap catalogs.
+ *  - `bash+edit` and `bash+write` both keep the Minimal-like anchor
+ *    (xiaobright probes), so the spec/react catalogs use them.
+ *  - Pro does NOT want post-anchor injected guidance (router-standard P24:
+ *    anchors hurt Pro). Flash benefits from neutral persona + classify
+ *    instruction (router-standard P11). Nothing is injected after turn one.
+ *
+ * Robustness: promotion is memoized per session; mode is memoized per
+ * session; a missing bootstrap tool degrades to the full catalog instead of
+ * throwing; any filter failure also degrades to the full catalog.
+ */
+
+/** Cordis plugin name used by loader diagnostics. */
+export const name = 'anchored-tool-bootstrap'
+
+/** Prompt assembly must exist before this request filter can register. */
+export const inject = ['systemPrompt']
+
+/* ── task classifier (ported from router-standard, zero dependencies) ───── */
+
+const REACT_RE = /(开发|创建|写一个|写个|生成|从零|做一个|做个|搞一个|游戏|网页|网站|构建|新项目|搭建|实现|做出|上线|落地|脚本|工具|应用|添加|新增|build|create|develop|generate|implement|make a|new project)/gi
+const SPEC_RE = /(修复|修一下|修改|改一下|调整|完善|润色|排版|措辞|替换|删除|删掉|移除|去掉|清理|整理|调试|重构|维护|排查|报错|出错|崩溃|优化|审查|review|fix|debug|refactor|maintain|repair|broken|break|为什么|异常|故障|迁移|升级|兼容|edit|modify|tweak|adjust|update|polish|rename|delete|remove|cleanup)/gi
+
+function countHits(regex, text) {
+  return [...String(text || '').matchAll(regex)].length
+}
+
+/** Classify a task text: clear keyword evidence picks spec/react; ambiguous
+ *  or unmatched text returns 'weak' (the model decides per task). */
+export function classifyTask(text) {
+  const react = countHits(REACT_RE, text)
+  const spec = countHits(SPEC_RE, text)
+  if (react > spec) return 'react'
+  if (spec > react) return 'spec'
+  return 'weak'
+}
+
+/** Unwrap the text of a durable user/message event (defensive shapes). */
+export function extractText(data) {
+  if (!data) return ''
+  const payload = data && typeof data.message === 'object' && data.message !== null ? data.message : data
+  const content = Array.isArray(payload.content) ? payload.content : []
+  return content.map((c) => (typeof c === 'string' ? c : (c && c.text) || '')).join(' ')
+}
+
+/** Per-session mode derived from durable events (resume-safe). */
+export function sessionMode(session) {
+  if (!session || !Array.isArray(session.events)) return 'weak'
+  const userMsg = session.events.find((event) => event && event.type === 'user/message')
+  return classifyTask(extractText(userMsg && userMsg.data))
+}
+
+/* ── personas ────────────────────────────────────────────────────────────── */
+
+const PERSONA_SPEC = 'You are a helpful software engineer assistant.'
+
+const PERSONA_REACT =
+  'You are a hands-on software engineer who delivers working output fast.\n'
+  + 'Work directly: write or edit code, then verify it by reading and running. '
+  + 'Keep the loop tight — produce, verify, fix — and do not build test '
+  + 'harnesses, scaffolding, or ceremony the user did not ask for. '
+  + 'Finish with a usable deliverable and a short summary.'
+
+/** Pro optimum (router-standard P11/P24): spec sentence + classify
+ *  instruction, NO anchors. */
+const PERSONA_WEAK_PRO =
+  'You are a helpful software engineer assistant.\n'
+  + 'Before acting, decide the task type (build or fix) and adopt the matching '
+  + 'style: build → hands-on production; fix → inspect-and-plan.'
+
+/** Flash optimum (router-standard P11/P23): neutral + classify + anchors. */
+const PERSONA_WEAK_FLASH =
+  'You are a helpful assistant.\n'
+  + 'Before acting, decide the task type (build or fix) and adopt the matching '
+  + 'style: build → hands-on production; fix → inspect-and-plan.\n'
+  + 'Before acting, briefly review what you have already done in this session '
+  + 'and continue from where you left off; do not repeat completed steps. '
+  + 'Do not run environment checks (echo, whoami, uname, node --version, date) '
+  + 'or exhaustive grep/glob scans.'
+
+function isFlashModel(modelId) {
+  return typeof modelId === 'string' && /flash/i.test(modelId)
+}
+
+/** Persona for a mode; weak picks the model-specific internal-routing text. */
+export function personaFor(mode, modelId) {
+  if (mode === 'react') return PERSONA_REACT
+  if (mode === 'spec') return PERSONA_SPEC
+  return isFlashModel(modelId) ? PERSONA_WEAK_FLASH : PERSONA_WEAK_PRO
+}
+
+/* ── first-turn core tools (shell added dynamically) ─────────────────────── */
+
+/** Bootstrap catalogs per mode. `glob`/`grep` are deliberately absent
+ *  (xiaobright boundary probes); edit/write are anchor-safe. */
+export function coreFor(mode, shell) {
+  const common = [shell, 'read']
+  if (mode === 'spec') return [...common, 'apply_patch']
+  if (mode === 'react') return [...common, 'apply_patch']
+  return common // weak: conservative minimal anchor
+}
+
+/* ── prompt-section helpers ──────────────────────────────────────────────── */
+
+/** Replace only the persona section, keeping everything else (plan-mode
+ *  above all, which returns after promotion). */
+export function applyPersona(sections, personaText) {
+  const rest = (sections || []).filter(
+    (section) => !section || (section.name !== 'persona' && !/persona/i.test(section.name) && section.name !== 'tool:edit' && section.name !== 'tool:write'),
+  )
+  return [{ name: 'anchored-persona', text: personaText, order: 0 }, ...rest]
+}
+
+/* ── plugin ──────────────────────────────────────────────────────────────── */
+
+export function apply(ctx, config = {}) {
+  /** Sessions already promoted in this process. Promotion is append-only. */
+  const promoted = new Set()
+  /** Per-session resolved mode (append-only across the process lifetime). */
+  const modes = new Map()
+  /** First REAL user message text per session, captured from agent/pre-step
+   *  (the in-memory session.events array may not contain the first
+   *  user/message yet when the FIRST assembly runs — measured on rc.6). */
+  const firstTexts = new Map()
+  let warned = false
+  const warnOnce = (message) => {
+    if (warned) return
+    warned = true
+    try {
+      if (ctx.logger && typeof ctx.logger.warn === 'function') ctx.logger.warn(message)
+    } catch {
+      // Logger unavailable — the guard exists only to avoid spamming.
+    }
+  }
+
+  const messageText = (message) => {
+    if (!message) return ''
+    const content = Array.isArray(message.content) ? message.content : []
+    return content.map((c) => (typeof c === 'string' ? c : (c && c.text) || '')).join(' ')
+  }
+
+  /** Capture the first real user message of each session from the EARLIEST
+   *  durable point — agent/inbox/inserted — which fires when the message
+   *  enters the inbox, strictly before any prompt assembly. (Measured on
+   *  rc.6: the FIRST assembly of a fresh session runs BEFORE agent/pre-step,
+   *  so pre-step is too late for the first request.) */
+  ctx.on('agent/inbox/inserted', ({ agent, message }) => {
+    try {
+      const session = agent && agent.session
+      if (!session || firstTexts.has(session.id)) return
+      if (!message || !message.source || message.source.kind !== 'user') return
+      const text = messageText(message)
+      if (text.trim()) firstTexts.set(session.id, text)
+    } catch {
+      // Observation only.
+    }
+  })
+
+  /** Fallback capture point for sessions that never saw inbox/inserted. */
+  ctx.on('agent/pre-step', async (payload, next) => {
+    const decision = await next()
+    try {
+      const session = payload && payload.agent && payload.agent.session
+      if (!session || firstTexts.has(session.id)) return decision
+      const messages = Array.isArray(payload.messages) ? payload.messages : []
+      const first = messages.find((m) => m && m.source && m.source.kind === 'user')
+      if (first === undefined) return decision // system reminders do not classify
+      const text = messageText(first)
+      if (text.trim()) firstTexts.set(session.id, text)
+    } catch {
+      // Observation only — never disturb the step pipeline.
+    }
+    return decision
+  })
+
+  const resolveMode = (session) => {
+    if (modes.has(session.id)) return modes.get(session.id)
+    const cached = firstTexts.get(session.id)
+    const mode = cached !== undefined && cached.trim() !== ''
+      ? classifyTask(cached)
+      : sessionMode(session)
+    modes.set(session.id, mode)
+    return mode
+  }
+
+  const isPromoted = (session) => {
+    if (promoted.has(session.id)) return true
+    if (!Array.isArray(session.events)) return true
+    const hit = session.events.some((event) => event && event.type === 'tool/call')
+    if (hit) promoted.add(session.id)
+    return hit
+  }
+
+  ctx.on('system-prompt/assemble', async (assembly, context, next) => {
+    // Downstream errors propagate untouched; only this filter's own logic is guarded.
+    const assembled = await next()
+    try {
+      const agent = context && context.agent
+      const session = agent ? agent.session : undefined
+      if (session === undefined) return assembled
+      const mode = resolveMode(session)
+      const modelId = (agent.options && agent.options.model) || ''
+      const persona = personaFor(mode, modelId)
+
+      if (isPromoted(session)) {
+        // Promoted: full catalog; persona stays; contexts cleared; the other
+        // sections (plan-mode etc.) come back for the rest of the session.
+        return {
+          ...assembled,
+          sections: applyPersona(assembled.sections, persona),
+          contexts: [],
+          tools: (Array.isArray(assembled.tools) ? assembled.tools : []).filter((tool) => tool && tool.name !== 'edit' && tool.name !== 'write'),
+        }
+      }
+
+      const tools = Array.isArray(assembled.tools) ? assembled.tools : []
+      const available = new Set(tools.map((tool) => tool && tool.name))
+      const shell = available.has('bash') ? 'bash' : available.has('pwsh') ? 'pwsh' : undefined
+      if (shell === undefined) {
+        warnOnce(`${name}: no platform shell in the catalog — full catalog exposed`)
+        return assembled
+      }
+      const core = new Set(coreFor(mode, shell))
+
+      // First request: the cleanest possible opening (persona is the only
+      // section, contexts cleared — equivalent to a complete persona) plus
+      // the task-matched bootstrap catalog.
+      return {
+        ...assembled,
+        sections: [{ name: 'anchored-persona', text: persona, order: 0 }],
+        contexts: [],
+        tools: tools.filter((tool) => tool && core.has(tool.name)),
+      }
+    } catch (error) {
+      // A filter bug must never brick a session: degrade to the full catalog.
+      warnOnce(`${name}: bootstrap filter failed, exposing the full catalog: ${String((error && error.message) || error)}`)
+      return assembled
+    }
+  })
+}