dsh-plugin-prompt-tool 0.1.4 → 0.2.0

package/preset/near-anchor.mjs

@@ -0,0 +1,117 @@
+/**
+ * near-anchor — prompt-tool 近距离首句锚定（替代独立锚定轮）。
+ *
+ * 依据 dsh-router-standard P13/P14/P15/P22 与作者勘误：
+ *   - 行为引导放 system（远距离）会衰减甚至反向；放在真实用户消息之后
+ *     （近距离）零衰减；
+ *   - 只要求首句一次：模型自回归续写会维持语域，越锚越牢；
+ *   - 强制“每个 reasoning 块都以某句开头/回顾开头”是负效果；
+ *   - 日常任务锚 We（官方后训练压出的高效路径），复杂规划放行 Let
+ *     （未收敛旧路径携带更深规划能力），不做唯一解。
+ *
+ * 实现：在首条真实用户消息之后追加一条锚点消息，不拆轮、不挪任务；
+ * 幂等性来自持久事件（source.plugin === 'near-anchor'）+ 进程内 memo。
+ * 自定义开关：config.useCustom 为 true 时固定使用 config.anchorText；
+ * false（默认）时忽略 anchorText，按任务与模型自动选择文本。
+ */
+
+/** Cordis 插件名，供 loader 诊断使用。 */
+export const name = 'near-anchor'
+
+/** 无服务依赖，只监听 pre-step 消息组装。 */
+export const inject = []
+
+/** 开发/生成类任务关键词。 */
+const BUILD_RE = /(开发|创建|写一个|生成|从零|做一个|构建|新项目|搭建|实现|做出|上线|落地|脚本|工具|应用|build|create|develop|generate|implement|make a|new project)/i
+/** 复杂规划/修复类任务关键词：放行 Let 深度路径。 */
+const COMPLEX_RE = /(架构|重构|设计|系统|全面|深度|迁移|兼容|审查|architecture|refactor|comprehensive|design|system|migrate|review)/i
+
+/** 开发类：we 直接产出并验证。 */
+const ANCHOR_BUILD = "Start your reasoning with the exact sentence: 'We need to build it directly and verify it.'"
+/** 检查/日常类：we 先看代码。 */
+const ANCHOR_INSPECT = "Start your reasoning with the exact sentence: 'We need to inspect the code first.'"
+/** 复杂规划类：放行 Let 深度规划路径。 */
+const ANCHOR_DEEP = "Start your reasoning with the exact sentence: 'Let me think through the design before changing anything.'"
+
+/** Flash 模型附加三锚（回顾已完成 + 信息足够就产出 + 禁止环境检查/穷举）。 */
+const FLASH_ANCHORS = ' Before acting, briefly review what you have already done in this session and continue from where you left off; do not repeat completed steps. When you have gathered enough information, stop exploring and produce the deliverable. Do not run environment checks (echo, whoami, uname, node --version, date) or exhaustive grep/glob scans.'
+
+/** 生成消息 id：优先加密随机 id，旧运行时回退到随机串。 */
+function newMessageId() {
+  return typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function'
+    ? crypto.randomUUID()
+    : `near-anchor-${Date.now()}-${Math.random().toString(36).slice(2)}`
+}
+
+/** 从 user/message 的 data 中提取纯文本；兼容 data.message 嵌套形状。 */
+function extractText(data) {
+  if (!data) return ''
+  const payload = data && typeof data.message === 'object' && data.message !== null ? data.message : data
+  const content = Array.isArray(payload.content) ? payload.content : []
+  return content.map((block) => (typeof block === 'string' ? block : (block?.text ?? ''))).join(' ').trim()
+}
+
+/** 按开关与任务选择锚点：useCustom=true 固定用自定义；false 自动选择。 */
+function chooseAnchor(text, modelId, customText, useCustom) {
+  if (useCustom === true) {
+    return typeof customText === 'string' ? customText.trim() : ''
+  }
+  let anchor
+  if (COMPLEX_RE.test(text)) anchor = ANCHOR_DEEP
+  else if (BUILD_RE.test(text)) anchor = ANCHOR_BUILD
+  else anchor = ANCHOR_INSPECT
+  if (typeof modelId === 'string' && /flash/i.test(modelId)) return anchor + FLASH_ANCHORS
+  return anchor
+}
+
+export function apply(ctx, config) {
+  const customText = typeof config.anchorText === 'string' ? config.anchorText : ''
+  const useCustom = config.useCustom === true
+
+  /** 本进程已处理过的会话（真相在持久事件流）。 */
+  const handled = new Set()
+
+  /** 持久事件里是否已有本插件的锚点消息。 */
+  const seenAnchor = (session) => session.events.some((event) => {
+    const payload = event.data && typeof event.data.message === 'object' && event.data.message !== null
+      ? event.data.message
+      : event.data
+    return payload?.source?.plugin === 'near-anchor'
+  })
+
+  ctx.on('agent/pre-step', async ({ agent }, next) => {
+    const decision = await next()
+    if (decision.kind === 'reject') return decision
+    if (agent === undefined) return decision
+    const session = agent.session
+    if (session === undefined || handled.has(session.id) || seenAnchor(session)) return decision
+    // 子代理不注入锚点：让 dsh-mnemon 等结构化 worker 按自己的提示词工作。
+    if ((session.header?.delegationDepth ?? 0) > 0) return decision
+
+    const messages = Array.isArray(decision.messages) ? decision.messages : []
+    // 只锚真实用户消息；插件消息原样保留。
+    const userIndex = messages.findIndex((message) => message?.source?.kind === 'user')
+    if (userIndex < 0) return decision
+    const taskText = extractText(messages[userIndex])
+    if (taskText.length === 0) return decision
+
+    const anchorText = chooseAnchor(taskText, agent.options?.model, customText, useCustom)
+    if (anchorText.length === 0) return decision
+    handled.add(session.id)
+
+    const anchor = {
+      id: newMessageId(),
+      role: 'user',
+      content: [{ type: 'text', text: anchorText }],
+      source: {
+        kind: 'near-anchor',
+        plugin: 'near-anchor',
+        form: 'notice',
+        summary: 'near-anchor 近距离首句锚点',
+      },
+    }
+    const nextMessages = [...messages]
+    nextMessages.splice(userIndex + 1, 0, anchor)
+    return { ...decision, messages: nextMessages }
+  })
+}

package/preset/router-first-turn.mjs

@@ -0,0 +1,59 @@
+/**
+ * router-first-turn — prompt-tool 本地附加件（最优组合）。
+ *
+ * 依据 dsh-router-standard 的 router-bootstrap 组装逻辑：
+ *   - 只替换 persona 段为官方训练原句，保留计划模式段与其他第三方
+ *     section（applyPersona 语义，不是整段丢弃）；
+ *   - 首轮隐藏 mnemon:* 自动注入段（记忆路由/热记忆上下文）并清空 contexts，
+ *     晋升后两者都恢复——与 anchored-standard 的“首轮剥离自动注入”一致；
+ *   - 子代理（委托深度 > 0）直接放行完整结果，保证 dsh-mnemon 等插件
+ *     通过工具白名单要求的 mnemon_* 工具首轮可见。
+ *
+ * 工具目录裁剪仍由上游 tool-bootstrap 负责（首轮 = 真实 Minimal 工具对；
+ * 晋升后 = resident 集），本模块不触碰 tools，避免两层过滤器冲突。
+ * 计划模式段必须保留：router-standard 早期实测证明整段替换 section 会
+ * 丢失 plan 边界，导致模型离开计划模式后重复探索（“失忆”问题）。
+ */
+
+/** Cordis 插件名，供 loader 诊断使用。 */
+export const name = 'router-first-turn'
+
+/** 无服务依赖，只监听 system-prompt 组装。 */
+export const inject = []
+
+/** 官方 RL 训练原句（保持与 Minimal 预设逐字节一致）。 */
+const RL_PERSONA = 'You are a helpful software engineer assistant.'
+
+/** 是否为 persona 段：旧 persona 段由本模块替换。 */
+function isPersonaSection(section) {
+  if (section === null || typeof section !== 'object') return false
+  const name = String(section.name ?? '')
+  return name === 'persona' || /persona/i.test(name)
+}
+
+/** 首轮需要隐藏的 mnemon 自动注入段（晋升后恢复）。 */
+function isMnemonSection(section) {
+  if (section === null || typeof section !== 'object') return false
+  return String(section.name ?? '').startsWith('mnemon:')
+}
+
+export function apply(ctx) {
+  ctx.on('system-prompt/assemble', async (_assembly, context, next) => {
+    const assembled = await next()
+    const agent = context.agent
+    if (agent === undefined) return assembled
+    const session = agent.session
+    if (session === undefined) return assembled
+
+    // 子代理不裁剪任何 section/context：它与 dsh-mnemon 的工具白名单协作。
+    if ((session.header?.delegationDepth ?? 0) > 0) return assembled
+
+    const sections = assembled.sections ?? []
+    const promoted = session.events.some((event) => event.type === 'tool/call')
+    const kept = sections.filter((section) => !isPersonaSection(section) && (promoted || !isMnemonSection(section)))
+    const routerSections = [...kept, { name: 'router-persona', text: RL_PERSONA, order: 0 }]
+    return promoted
+      ? { ...assembled, sections: routerSections }
+      : { ...assembled, sections: routerSections, contexts: [] }
+  })
+}

package/{vendor → upstream}/dsh-anchored-standard/NOTICE

@@ -10,5 +10,10 @@ DeepSeek Harness is distributed under the MIT License:
 
 The full MIT permission notice is included in this repository's LICENSE file.
 
+shared/toolchoice-adapter.mjs additionally adapts a minimal, protocol-faithful subset
+of the DeepSeek Harness llm-deepseek adapter pipeline (request serialization,
+SSE parsing, and chunk translation) from the same repository and commit; the
+same MIT attribution above covers it.
+
 DeepSeek and DeepSeek Harness are names of their respective owner. This
 community project is not affiliated with or endorsed by DeepSeek.

package/upstream/dsh-anchored-standard/REVISION

@@ -0,0 +1 @@
+ba7a27cf92f80ef3a73a16a05b9df46a20ebbb2a

package/{vendor → upstream}/dsh-anchored-standard/preset/agent.cordis.yml

@@ -18,34 +18,53 @@
 # pool instances — `provide()` throws on the second registration under the
 # same realm symbol; labels join REALMS, and are not what this file needs.)
 
-# ── bootstrap (must stay FIRST) ─────────────────────────────────────────────
-
-# This row deliberately sits before every other row: dsh-agent-instructions and
-# dsh-tool-skill inject workspace instructions and the skill catalog into the
-# first request via the agent/pre-step waterfall, and waterfall after-next
-# transforms apply in reverse registration order. Registering first (plus the
-# plugin empty inject list and the listener's `prepend` flag) makes this filter
-# strip the final transform, so request #1 stays Minimal-exact (see issue #6).
+# ── context gate (must stay FIRST) ──────────────────────────────────────────
+
+# Unified injection control (shared/context-gate.mjs, reusable by any preset):
+# while the session is unpromoted, BOTH unified injection paths are closed.
+# The assembly's dynamic runtime-context contributions are blanked — the whole
+# `SystemPrompt.context()` family (sandbox/approval policy snapshots and any
+# third-party context provider) without enumerating them — and the pre-step
+# waterfall keeps ONLY the claimed message batch plus the `allowKinds` entries
+# (a user skill gesture survives; every automatic injection — skill catalog,
+# AGENTS.md digest, time/tmux context, hooks, unknown third-party plugins — is
+# stripped by default). After the first durable promotion signal (a tool call
+# OR the first assistant message, `promoteOn: either`) the gate opens, and the
+# loop's own snapshot projection diffs exactly ONE fresh runtime-context
+# message into the next request: minimal first round, injections on the second
+# round. A `compaction/end` boundary re-closes the gate the same way.
 #
-# V4 Pro conditions strongly on the API tool catalog AND the first request
-# output budget. Bootstrap request #1 with the OFFICIAL Minimal preset's real
-# tool pair — persistent `bash` + `str_replace_editor` — which anchors at the
+# This row deliberately sits before every other row: waterfall after-next
+# transforms apply in reverse registration order, so registering first (plus
+# the empty inject list and the pre-step listener's `prepend` flag) makes the
+# gate the outermost transform — nothing registered later re-injects past it
+# (see issue #6).
+#
+# `includeSubagents: true` gates subagents the same way — their first request
+# is clean too, and their own first reply or tool call opens the gate — so a
+# delegation cannot reintroduce an uncontrolled first request (issues #38 and
+# #52). Keep this flag in sync with the tool-bootstrap row below.
+- id: context-gate
+  name: ./context-gate.mjs
+  config:
+    promoteOn: either
+    includeSubagents: true
+    allowKinds: [skill-invocation]
+
+# ── bootstrap ───────────────────────────────────────────────────────────────
+
+# Tool catalog control (mode-owned tool-bootstrap.mjs). V4 Pro conditions
+# strongly on the API tool catalog AND the first request output budget:
+# request #1 exposes the OFFICIAL Minimal preset's real tool pair —
+# persistent `bash` + `str_replace_editor` — which anchors at the
 # adapter-default maxTokens (256000) with no output cap needed (issue #11:
 # 5/5 anchored vs 11/11 standard-like for every standard-family schema);
 # after the session records its first durable promotion signal (a tool call OR
 # the first assistant message, default `promoteOn: either`), later steps
 # narrow to the minimal RESIDENT set (see below). `bootstrapMaxTokens` is
 # opt-in for standard-schema bootstraps; unset, the adapter default flows. See
-# tool-bootstrap.mjs for the other triggers.
-#
-# The same phase gate suppresses AUTO-INJECTED context on request #1:
-# `suppressedContextSources` lists the `agent/pre-step` message sources the
-# bootstrap filter strips while the session is unpromoted. The defaults are the
-# two automatic injections Standard adds over Minimal — the available-skills
-# reminder (`skill-catalog`) and the workspace instruction digest
-# (`agent-instructions`). User-initiated skill gestures are not filtered, and
-# both injections return unchanged from request #2 on. Set the list to [] to
-# disable the context filter while keeping the tool bootstrap.
+# tool-bootstrap.mjs for the other triggers. Context stripping is NOT here —
+# the context-gate row above owns it.
 #
 # POST-PROMOTION (local addition): the promoted catalog is NOT the full
 # Standard dump — it stays on the bootstrap pair + the three discovery tools
@@ -57,12 +76,16 @@
 # to the controlled phase — bootstrap pair + `compactionTools` — until a NEW
 # durable promotion signal exists past the boundary (epoch-aware, see
 # compaction-epoch.mjs).
+#
+# `includeSubagents: true` keeps the subagent phase in sync with the
+# context-gate row: a subagent's first request sees the bootstrap pair, then
+# its own first reply or tool call promotes it to the resident set.
 - id: tool-bootstrap
   name: ./tool-bootstrap.mjs
   config:
     bootstrapTools: [bash, str_replace_editor]
     promoteOn: either
-    suppressedContextSources: [agent-instructions, skill-catalog]
+    includeSubagents: true
     # Post-compaction core work set: the model is mid-task and needs to keep
     # working, but faces a small catalog instead of the full Standard set.
     compactionTools: [read, write, edit, glob, grep, todo_write, ask_user_question]
@@ -85,11 +108,17 @@
 # that perturbs the trajectory even after promotion. Instead, after promotion
 # ONE short hint is injected once per session — "these instruction files
 # exist; read them before acting" — and the model reads the files itself via
-# the filesystem tools when relevant.
+# the filesystem tools when relevant. The once-per-session guard is DERIVED
+# FROM DURABLE EVENTS (restart-safe): a process restart must never inject a
+# second hint with the same deterministic message id — the duplicate id
+# breaks history replay. `includeSubagents: true` makes a subagent's own
+# first reply or tool call open its hint, keeping it out of the context
+# gate's stripped first request.
 - id: instruction-hint
   name: ./instruction-hint.mjs
   config:
     promoteOn: either
+    includeSubagents: true
 
 # On-demand tool discovery (the tool-search pattern, local addition): the
 # promoted catalog keeps a minimal resident set; heavier Standard tools
@@ -170,7 +199,7 @@
   name: ./custom-bash.mjs
   disabled: !!js process.platform !== 'win32'
   config:
-    bashPath: 'bash.exe'
+    bashPath: 'C:\Program Files\Git\bin\bash.exe'
 
 # ── filesystem ──────────────────────────────────────────────────────────────
 

package/upstream/dsh-anchored-standard/preset/context-gate.mjs

@@ -0,0 +1,202 @@
+/**
+ * anchored-context-gate — reusable unified injection control for ANY preset.
+ *
+ * Mount this one plugin to keep a session's first model request free of
+ * auto-injected context, whatever its source, and to have every injection
+ * return on the second round. It intercepts the harness's two unified
+ * injection paths — not a per-source denylist — so it covers sources that do
+ * not exist yet:
+ *
+ *  a. RUNTIME CONTEXT (system-prompt/assemble): while the session is
+ *     unpromoted, the assembly's `contexts` are blanked. That covers the
+ *     WHOLE `SystemPrompt.context()` family — the sandbox and approval
+ *     policy snapshots and any third-party context provider — without
+ *     enumerating them. The loop's own snapshot projection then emits no
+ *     message during the gate (no snapshot ever existed), and at the first
+ *     promoted request it emits exactly ONE fresh snapshot: "minimal first
+ *     round, inject on the second round" falls out of the projection's
+ *     diffing, with no reinjection logic here.
+ *
+ *  b. STEP MESSAGES (agent/pre-step): the waterfall payload carries the
+ *     CLAIMED message batch (the inbox messages this step owns). While
+ *     unpromoted, the gate keeps exactly the claimed messages plus a small
+ *     kind allowlist, and strips everything any listener appended — skill
+ *     catalog, AGENTS.md digest, time/tmux context, hooks, unknown
+ *     third-party plugins — by DEFAULT, regardless of source identity. The
+ *     default allowlist is `['skill-invocation']`: a user-initiated skill
+ *     gesture is not an automatic injection, and stripping it would lose the
+ *     skill content once the gesture scrolls out of the per-step claim.
+ *     Durable history (compaction summaries included) never passes through
+ *     this gate: it enters the request via the session surface, not the
+ *     pre-step waterfall.
+ *
+ * The phase is the same epoch-aware promotion machine the anchored presets
+ * use (see compaction-epoch.mjs): a durable `tool/call` and/or
+ * `assistant/message` (per `promoteOn`, default `either`) promotes, and a
+ * `compaction/end` boundary demotes again — the first post-compaction request
+ * is a "second first request" and is gated the same way. Derived from durable
+ * events, so resume and reload preserve it.
+ *
+ * SUBAGENTS: by default subagents (delegationDepth > 0) skip the gate (their
+ * first request already sees full context). `includeSubagents: true` gates
+ * them too — their first request is clean and their own first reply or tool
+ * call opens the gate — so a delegation cannot reintroduce an uncontrolled
+ * first request. Keep this flag in sync with any companion phase plugin
+ * (e.g. the tool-bootstrap row).
+ *
+ * CONFIG:
+ *  - `promoteOn`: 'either' (default) | 'tool-call' | 'assistant-message'.
+ *  - `includeSubagents`: boolean, default false.
+ *  - `enabled`: boolean, default true. `false` disables both interception
+ *    paths (A/B testing without touching the row set).
+ *  - `allowKinds`: message `source.kind` names allowed beyond the claimed
+ *    batch, default ['skill-invocation']. An explicitly empty array keeps
+ *    ONLY the claimed batch.
+ *
+ * ROW ORDER: mount this row FIRST in the composition. Waterfall after-next
+ * transforms apply in reverse registration order, so registering first (plus
+ * the pre-step listener's `prepend: true`) makes the gate the outermost
+ * transform — nothing registered later re-injects past it.
+ *
+ * Robustness: both filters degrade to "keep everything" on their own
+ * failures — a gate bug must never eat the user's context — and invalid
+ * config fails at apply time, i.e. at preset mount, where it is visible.
+ */
+
+import { createEpochPromotion } from './compaction-epoch.mjs'
+
+/** Cordis plugin name used by loader diagnostics. */
+export const name = 'anchored-context-gate'
+
+/**
+ * Deliberately NO inject list: the listeners only touch services at event
+ * time, and applying without an inject lets this row register before the
+ * context-injecting plugins (dsh-agent-instructions, dsh-tool-skill, host
+ * plane policy projections) when it sits first in the composition.
+ */
+export const inject = []
+
+/** Durable session event types that count as a promotion signal per mode. */
+const PROMOTE_EVENTS = {
+  'tool-call': ['tool/call'],
+  'assistant-message': ['assistant/message'],
+  either: ['tool/call', 'assistant/message'],
+}
+
+/** Every config key this plugin accepts — anything else is a typo. */
+const ALLOWED_KEYS = new Set(['promoteOn', 'includeSubagents', 'enabled', 'allowKinds'])
+
+/**
+ * Message kinds allowed through the pre-step gate beyond the claimed batch.
+ * A user-initiated skill gesture is the only default entry: it is not an
+ * automatic injection (see the header note).
+ */
+const DEFAULT_ALLOW_KINDS = ['skill-invocation']
+
+function parsePromoteOn(value) {
+  if (value === undefined || value === 'either') return PROMOTE_EVENTS.either
+  if (value === 'tool-call' || value === 'assistant-message') return PROMOTE_EVENTS[value]
+  throw new TypeError(`${name}: promoteOn must be one of "tool-call", "assistant-message", "either"; got ${JSON.stringify(value)}`)
+}
+
+/**
+ * Validate the kind allowlist. An explicitly empty array is meaningful: keep
+ * ONLY the claimed batch, stripping even user skill gestures.
+ */
+function allowKindList(value, field) {
+  if (value === undefined) return new Set(DEFAULT_ALLOW_KINDS)
+  if (!Array.isArray(value) || value.some((item) => typeof item !== 'string' || item.length === 0)) {
+    throw new TypeError(`${name}: ${field} must be an array of non-empty strings`)
+  }
+  return new Set(value)
+}
+
+/** Validate an optional boolean flag with a default. */
+function booleanOption(value, field, fallback) {
+  if (value === undefined) return fallback
+  if (typeof value !== 'boolean') {
+    throw new TypeError(`${name}: ${field} must be a boolean`)
+  }
+  return value
+}
+
+/** Register the unified context gate. */
+export function apply(ctx, config) {
+  const source = config === undefined ? {} : config
+  if (typeof source !== 'object' || source === null || Array.isArray(source)) {
+    throw new TypeError(`${name}: config must be an object`)
+  }
+  const unknown = Object.keys(source).filter((key) => !ALLOWED_KEYS.has(key))
+  if (unknown.length > 0) {
+    throw new TypeError(
+      `${name}: unknown config key(s) ${unknown.join(', ')} — allowed keys: ${[...ALLOWED_KEYS].sort().join(', ')}`,
+    )
+  }
+  const promoteEvents = parsePromoteOn(source.promoteOn)
+  const includeSubagents = booleanOption(source.includeSubagents, 'includeSubagents', false)
+  const enabled = booleanOption(source.enabled, 'enabled', true)
+  const allowKinds = allowKindList(source.allowKinds, 'allowKinds')
+
+  const promotion = createEpochPromotion(promoteEvents, { includeSubagents })
+  ctx.on('session/event', (session, event) => promotion.observe(session, event))
+
+  let warned = false
+  const warnOnce = (message) => {
+    if (warned) return
+    warned = true
+    try {
+      ctx.logger.warn(message)
+    } catch {
+      // Logger unavailable — the guard exists only to avoid spamming.
+    }
+  }
+
+  // Path (a): blank the dynamic runtime-context contributions while the
+  // session is unpromoted. Covers the whole SystemPrompt.context() family
+  // without enumerating it; the loop's snapshot projection then stays silent
+  // and diffs exactly ONE fresh snapshot in at the first promoted request.
+  ctx.on('system-prompt/assemble', async (_assembly, context, next) => {
+    // Downstream errors propagate untouched; only this filter's own logic is guarded.
+    const assembled = await next()
+    if (enabled === false) return assembled
+    try {
+      if (promotion.status(context.agent).promoted) return assembled
+      if (!Array.isArray(assembled.contexts) || assembled.contexts.length === 0) return assembled
+      return { ...assembled, contexts: [] }
+    } catch (error) {
+      // A gate bug must never break assembly: degrade to the assembled value.
+      warnOnce(`${name}: runtime-context suppression failed, keeping contexts: ${String((error && error.message) || error)}`)
+      return assembled
+    }
+  })
+
+  // Path (b): claimed-baseline deny on the pre-step waterfall. The payload's
+  // `messages` is the batch this step CLAIMED from the inbox — the baseline
+  // every injection appends to. Keep that baseline plus the kind allowlist,
+  // strip every appended message regardless of its source identity.
+  ctx.on('agent/pre-step', async ({ agent, messages: claimed }, next) => {
+    // Downstream errors propagate untouched; only this filter's own logic is guarded.
+    const decision = await next()
+    if (decision.kind === 'reject') return decision
+    if (enabled === false) return decision
+    try {
+      if (promotion.status(agent).promoted) return decision
+      if (!Array.isArray(decision.messages)) return decision
+      if (!Array.isArray(claimed)) return decision
+      const baseline = new Set(claimed)
+      const baselineIds = new Set(claimed
+        .map((message) => message?.id)
+        .filter((id) => id !== undefined && id !== null))
+      const kept = decision.messages.filter((message) =>
+        baseline.has(message)
+        || (message?.id !== undefined && message?.id !== null && baselineIds.has(message.id))
+        || allowKinds.has(message?.source?.kind),
+      )
+      return kept.length === decision.messages.length ? decision : { ...decision, messages: kept }
+    } catch (error) {
+      // A gate bug must never eat context: degrade to keeping every message.
+      warnOnce(`${name}: pre-step gate failed, keeping injected context: ${String((error && error.message) || error)}`)
+      return decision
+    }
+  }, { prepend: true })
+}

package/{vendor → upstream}/dsh-anchored-standard/preset/dev-tool-search.mjs

@@ -104,20 +104,22 @@ export function apply(ctx) {
         // harness's own code mode (`registry.schemas(exec.agent)`).
         const schemas = ctx.tools.schemas(exec?.agent)
         const wanted = query.toLowerCase().split(/[^a-z0-9_]+/).filter(Boolean)
-        const matches = schemas
-          .filter((schema) => {
-            const haystack = `${schema.name} ${schema.description ?? ''}`.toLowerCase()
-            return wanted.every((token) => haystack.includes(token))
-          })
-          .slice(0, MAX_RESULTS)
-        if (matches.length === 0) {
+        const all = schemas.filter((schema) => {
+          const haystack = `${schema.name} ${schema.description ?? ''}`.toLowerCase()
+          return wanted.every((token) => haystack.includes(token))
+        })
+        const matches = all.slice(0, MAX_RESULTS)
+        if (all.length === 0) {
           lines.push(`No tools match "${query}".`)
         } else {
-          lines.push(`Matching tools (${matches.length}):`)
+          lines.push(`Matching tools (${matches.length}${all.length > MAX_RESULTS ? ` of ${all.length}` : ''}):`)
           for (const schema of matches) {
             const desc = (schema.description || '').split('\n')[0].slice(0, 90)
             lines.push(`- ${schema.name}: ${desc}`)
           }
+          if (all.length > MAX_RESULTS) {
+            lines.push(`(truncated at ${MAX_RESULTS} — add tokens to narrow the query, e.g. "mcp browser" or "mcp tavily")`)
+          }
           lines.push('Unlock with dev_tool_search({"toolNames": ["<exact name>"]}).')
         }
       } catch (error) {