dsh-plugin-prompt-tool 0.4.2 → 0.5.0

package/preset/context-gate.mjs

@@ -1,165 +0,0 @@
-/**
- * anchored-context-gate — reusable unified injection control for ANY preset.
- *
- * Mount this one plugin to keep a session's first model request free of
- * auto-injected context, whatever its source, and to have every injection
- * return on the second round. It intercepts the harness's two unified
- * injection paths — not a per-source denylist — so it covers sources that do
- * not exist yet:
- *
- *  a. RUNTIME CONTEXT (system-prompt/assemble): while the session is
- *     unpromoted, the assembly's `contexts` are blanked. That covers the
- *     WHOLE `SystemPrompt.context()` family — the sandbox and approval
- *     policy snapshots and any third-party context provider — without
- *     enumerating them. The loop's own snapshot projection then emits no
- *     message during the gate (no snapshot ever existed), and at the first
- *     promoted request it emits exactly ONE fresh snapshot: "minimal first
- *     round, inject on the second round" falls out of the projection's
- *     diffing, with no reinjection logic here.
- *
- *  b. STEP MESSAGES (agent/pre-step): the waterfall payload carries the
- *     CLAIMED message batch (the inbox messages this step owns). While
- *     unpromoted, the gate keeps exactly the claimed messages plus a small
- *     kind allowlist, and strips everything any listener appended — skill
- *     catalog, AGENTS.md digest, time/tmux context, hooks, unknown
- *     third-party plugins — by DEFAULT, regardless of source identity. The
- *     default allowlist is `['skill-invocation']`: a user-initiated skill
- *     gesture is not an automatic injection, and stripping it would lose the
- *     skill content once the gesture scrolls out of the per-step claim.
- *     Durable history (compaction summaries included) never passes through
- *     this gate: it enters the request via the session surface, not the
- *     pre-step waterfall.
- *
- * The phase is the same epoch-aware promotion machine the anchored presets
- * use (see compaction-epoch.mjs): a durable `tool/call` and/or
- * `assistant/message` (per `promoteOn`, default `either`) promotes, and a
- * `compaction/end` boundary demotes again — the first post-compaction request
- * is a "second first request" and is gated the same way. Derived from durable
- * events, so resume and reload preserve it.
- *
- * SUBAGENTS: by default subagents (delegationDepth > 0) skip the gate (their
- * first request already sees full context). `includeSubagents: true` gates
- * them too — their first request is clean and their own first reply or tool
- * call opens the gate — so a delegation cannot reintroduce an uncontrolled
- * first request. Keep this flag in sync with any companion phase plugin
- * (e.g. the tool-bootstrap row).
- *
- * CONFIG:
- *  - `promoteOn`: 'either' (default) | 'tool-call' | 'assistant-message'.
- *  - `includeSubagents`: boolean, default false.
- *  - `enabled`: boolean, default true. `false` disables both interception
- *    paths (A/B testing without touching the row set).
- *  - `allowKinds`: message `source.kind` names allowed beyond the claimed
- *    batch, default ['skill-invocation']. An explicitly empty array keeps
- *    ONLY the claimed batch.
- *
- * ROW ORDER: mount this row FIRST in the composition. Waterfall after-next
- * transforms apply in reverse registration order, so registering first (plus
- * the pre-step listener's `prepend: true`) makes the gate the outermost
- * transform — nothing registered later re-injects past it.
- *
- * Robustness: both filters degrade to "keep everything" on their own
- * failures — a gate bug must never eat the user's context — and invalid
- * config fails at apply time, i.e. at preset mount, where it is visible.
- */
-
-import { createEpochPromotion } from './compaction-epoch.mjs'
-import { booleanOption, createWarnOnce, parsePromoteOn, validateConfig } from './shared.mjs'
-
-/** Cordis plugin name used by loader diagnostics. */
-export const name = 'anchored-context-gate'
-
-/**
- * Deliberately NO inject list: the listeners only touch services at event
- * time, and applying without an inject lets this row register before the
- * context-injecting plugins (dsh-agent-instructions, dsh-tool-skill, host
- * plane policy projections) when it sits first in the composition.
- */
-export const inject = []
-
-/** Every config key this plugin accepts — anything else is a typo. */
-const ALLOWED_KEYS = new Set(['promoteOn', 'includeSubagents', 'enabled', 'allowKinds'])
-
-/**
- * Message kinds allowed through the pre-step gate beyond the claimed batch.
- * A user-initiated skill gesture is the only default entry: it is not an
- * automatic injection (see the header note).
- */
-const DEFAULT_ALLOW_KINDS = ['skill-invocation']
-
-
-/**
- * Validate the kind allowlist. An explicitly empty array is meaningful: keep
- * ONLY the claimed batch, stripping even user skill gestures.
- */
-function allowKindList(value, field) {
-  if (value === undefined) return new Set(DEFAULT_ALLOW_KINDS)
-  if (!Array.isArray(value) || value.some((item) => typeof item !== 'string' || item.length === 0)) {
-    throw new TypeError(`${name}: ${field} must be an array of non-empty strings`)
-  }
-  return new Set(value)
-}
-
-
-/** Register the unified context gate. */
-export function apply(ctx, config) {
-  const source = validateConfig(name, config, ALLOWED_KEYS)
-  const promoteEvents = parsePromoteOn(name, source.promoteOn)
-  const includeSubagents = booleanOption(name, source.includeSubagents, 'includeSubagents', false)
-  const enabled = booleanOption(name, source.enabled, 'enabled', true)
-  const allowKinds = allowKindList(source.allowKinds, 'allowKinds')
-
-  const promotion = createEpochPromotion(promoteEvents, { includeSubagents })
-  ctx.on('session/event', (session, event) => promotion.observe(session, event))
-
-  const warnOnce = createWarnOnce(ctx, name)
-
-  // Path (a): blank the dynamic runtime-context contributions while the
-  // session is unpromoted. Covers the whole SystemPrompt.context() family
-  // without enumerating it; the loop's snapshot projection then stays silent
-  // and diffs exactly ONE fresh snapshot in at the first promoted request.
-  ctx.on('system-prompt/assemble', async (_assembly, context, next) => {
-    // Downstream errors propagate untouched; only this filter's own logic is guarded.
-    const assembled = await next()
-    if (enabled === false) return assembled
-    try {
-      if (promotion.status(context.agent).promoted) return assembled
-      if (!Array.isArray(assembled.contexts) || assembled.contexts.length === 0) return assembled
-      return { ...assembled, contexts: [] }
-    } catch (error) {
-      // A gate bug must never break assembly: degrade to the assembled value.
-      warnOnce(`${name}: runtime-context suppression failed, keeping contexts: ${String((error && error.message) || error)}`)
-      return assembled
-    }
-  })
-
-  // Path (b): claimed-baseline deny on the pre-step waterfall. The payload's
-  // `messages` is the batch this step CLAIMED from the inbox — the baseline
-  // every injection appends to. Keep that baseline plus the kind allowlist,
-  // strip every appended message regardless of its source identity.
-  ctx.on('agent/pre-step', async ({ agent, messages: claimed }, next) => {
-    // Downstream errors propagate untouched; only this filter's own logic is guarded.
-    const decision = await next()
-    if (decision.kind === 'reject') return decision
-    if (enabled === false) return decision
-    try {
-      if (promotion.status(agent).promoted) return decision
-      if (!Array.isArray(decision.messages)) return decision
-      if (!Array.isArray(claimed)) return decision
-      const baseline = new Set(claimed)
-      const baselineIds = new Set(claimed
-        .map((message) => message?.id)
-        .filter((id) => id !== undefined && id !== null))
-      const kept = decision.messages.filter((message) =>
-        baseline.has(message)
-        || (message?.id !== undefined && message?.id !== null && baselineIds.has(message.id))
-        || allowKinds.has(message?.source?.kind),
-      )
-      return kept.length === decision.messages.length ? decision : { ...decision, messages: kept }
-    } catch (error) {
-      // A gate bug must never eat context: degrade to keeping every message.
-      warnOnce(`${name}: pre-step gate failed, keeping injected context: ${String((error && error.message) || error)}`)
-      return decision
-    }
-  }, { prepend: true })
-}

package/preset/instruction-hint.mjs

@@ -1,217 +0,0 @@
-/**
- * instruction-hint — replace `dsh-agent-instructions`' full AGENTS.md/CLAUDE.md
- * injection with a minimal "these files exist" hint.
- *
- * WHY: the full workspace-instruction digest is a large injected block. After
- * the anchored bootstrap promotes, we want the model to KNOW the instruction
- * files exist (so it reads them before acting) without dumping their content
- * into every request. The model reads the files itself via the filesystem
- * tools when it needs them.
- *
- * Behavior:
- *  - After the session records its first durable promotion signal
- *    (`promoteOn`, default `either`), ONE hint message is injected, listing
- *    which instruction files were found:
- *      - user-global: `$DSH_HOME/AGENTS.md`
- *      - project chain: AGENTS.md / CLAUDE.md / AGENTS.local.md / CLAUDE.local.md
- *        walking up from the session cwd to the project root (a directory
- *        containing `.git`, or the cwd itself).
- *  - The hint is ONCE PER SESSION, DERIVED FROM DURABLE EVENTS: the guard
- *    scans the session log for an existing `instruction-hint` message (then
- *    O(1)), so a process restart — whose in-memory state starts empty —
- *    cannot inject a second copy. A duplicate would collide with the first
- *    message's deterministic id (`instruction-hint-<sessionId>`) and break
- *    history replay.
- *  - The hint instructs the model to READ the files before acting when
- *    relevant, without embedding their content.
- *  - Files are probed via `ctx.fs` (the host filesystem seam); a missing fs
- *    service or an unreadable probe degrades to no hint (never throws).
- *  - Pre-promotion requests get NO hint (matches the anchored bootstrap).
- *  - Subagents skip the phase wait by default (their first request already
- *    counts as promoted); `includeSubagents: true` makes a subagent's own
- *    first reply or tool call open the hint — which also keeps the injection
- *    out of the context gate's stripped first request (the gate strips
- *    non-claimed messages while unpromoted).
- *
- * ROW ORDER: this plugin registers its `agent/pre-step` handler with
- * `prepend: true` and after `context-gate`/`tool-bootstrap`, so it runs
- * inside the gate's outermost strip — but it emits AFTER promotion, when the
- * strip is inactive. The hint source kind is `instruction-hint`, which is
- * not in the gate's claimed-baseline allowlist, so the gate can strip it
- * only while the session is unpromoted (never the intended path).
- */
-
-import { readFileSync } from 'node:fs'
-import { createEpochPromotion } from './compaction-epoch.mjs'
-import { booleanOption, createWarnOnce, parsePromoteOn, validateConfig } from './shared.mjs'
-
-/** Cordis plugin name used by loader diagnostics. */
-export const name = 'instruction-hint'
-
-/** Optional prompt-tool hint text (agents-instruction.txt beside this module). */
-function readAgentsInstructionText() {
-  try {
-    return readFileSync(new URL('./agents-instruction.txt', import.meta.url), 'utf8').trim()
-  } catch {
-    return ''
-  }
-}
-
-/** Candidate file names, in probe order, for the project chain and user-global. */
-const PROJECT_CANDIDATES = ['AGENTS.md', 'CLAUDE.md', 'AGENTS.local.md', 'CLAUDE.local.md']
-const USER_GLOBAL_CANDIDATE = 'AGENTS.md'
-
-
-/** Every config key this plugin accepts — anything else is a typo. */
-const ALLOWED_KEYS = new Set(['promoteOn', 'includeSubagents'])
-
-
-/** Find the project root: first ancestor containing any root marker (e.g. .git). */
-async function findProjectRoot(fs, cwd, signal) {
-  let current = cwd
-  for (;;) {
-    for (const marker of ['.git', '.hg', '.svn']) {
-      try {
-        const target = await fs.resolve(joinPath(current, marker), { cwd, signal })
-        const info = await fs.stat(target, signal)
-        if (info !== undefined) return current
-      } catch {
-        // Probe failure = marker absent; continue.
-      }
-    }
-    const parent = parentPath(current)
-    if (parent === current || parent.length === 0) return cwd
-    current = parent
-  }
-}
-
-/** List instruction files present in one directory (project candidates). */
-async function presentInDir(fs, dir, candidates, signal) {
-  const found = []
-  for (const candidate of candidates) {
-    try {
-      const target = await fs.resolve(joinPath(dir, candidate), { cwd: dir, signal })
-      const info = await fs.stat(target, signal)
-      if (info !== undefined && info.type === 'file') found.push(candidate)
-    } catch {
-      // Absent or unreadable — skip.
-    }
-  }
-  return found
-}
-
-/** Join one path segment onto a directory (platform-agnostic string join). */
-function joinPath(dir, segment) {
-  if (dir.endsWith('/') || dir.endsWith('\\')) return dir + segment
-  const sep = dir.includes('\\') ? '\\' : '/'
-  return dir + sep + segment
-}
-
-/** Parent of an absolute Windows or POSIX path. */
-function parentPath(path) {
-  const idx = Math.max(path.lastIndexOf('/'), path.lastIndexOf('\\'))
-  if (idx <= 0) return path
-  const parent = path.slice(0, idx)
-  return parent.length === 0 ? path : parent
-}
-
-/** Register the post-promotion instruction-hint injector. */
-export function apply(ctx, config) {
-  const source = validateConfig(name, config, ALLOWED_KEYS)
-  const promoteEvents = parsePromoteOn(name, source.promoteOn)
-  const includeSubagents = booleanOption(name, source.includeSubagents, 'includeSubagents', false)
-  const agentsInstructionText = readAgentsInstructionText()
-  const promotion = createEpochPromotion(promoteEvents, { includeSubagents })
-  ctx.on('session/event', (session, event) => promotion.observe(session, event))
-
-  /**
-   * Sessions whose hint is already durable in the event log — the
-   * restart-safe replacement for an in-memory "already hinted" set. Seeded by
-   * a one-time scan, then maintained incrementally through `session/event`.
-   */
-  const hinted = new Map()
-  const hintIsDurable = (session) => {
-    const known = hinted.get(session.id)
-    if (known !== undefined) return known
-    const found = (Array.isArray(session.events) ? session.events : []).some((event) =>
-      event.type === 'user/message' && event.data?.source?.kind === 'instruction-hint',
-    )
-    hinted.set(session.id, found)
-    return found
-  }
-  ctx.on('session/event', (session, event) => {
-    if (event.type === 'user/message' && event.data?.source?.kind === 'instruction-hint') {
-      hinted.set(session.id, true)
-    }
-  })
-
-  const warnOnce = createWarnOnce(ctx, name)
-
-  ctx.on('agent/pre-step', async ({ agent, signal }, next) => {
-    const decision = await next()
-    try {
-      if (promotion.status(agent).promoted !== true) return decision
-      const session = agent.session
-      if (session === undefined || hintIsDurable(session)) return decision
-      hinted.set(session.id, true)
-
-      if (agentsInstructionText.length > 0) {
-        return {
-          ...decision,
-          messages: [...decision.messages, {
-            id: `instruction-hint-${session.id}`,
-            role: 'user',
-            content: [{ type: 'text', text: agentsInstructionText }],
-            source: { kind: 'instruction-hint', form: 'hint' },
-          }],
-        }
-      }
-
-      const fs = ctx.get('fs')
-      if (fs === undefined) return decision
-      const cwd = session.header.cwd ?? process.cwd()
-
-      const projectFiles = []
-      const root = await findProjectRoot(fs, cwd, signal)
-      projectFiles.push(...await presentInDir(fs, root, PROJECT_CANDIDATES, signal))
-
-      const userGlobalFiles = []
-      try {
-        const dshHome = process.env.DSH_HOME ?? (process.env.USERPROFILE ? `${process.env.USERPROFILE}\\.dsh` : undefined)
-        if (dshHome !== undefined) {
-          userGlobalFiles.push(...await presentInDir(fs, dshHome, [USER_GLOBAL_CANDIDATE], signal))
-        }
-      } catch {
-        // Unreadable home probe — ignore.
-      }
-
-      const sections = []
-      if (projectFiles.length > 0) {
-        sections.push(`Workspace instruction files exist: ${projectFiles.join(', ')} (project root: ${root}).`)
-      }
-      if (userGlobalFiles.length > 0) {
-        sections.push(`A user-global instruction file exists: ${USER_GLOBAL_CANDIDATE}.`)
-      }
-      if (sections.length === 0) return decision
-
-      const text = [
-        ...sections,
-        'Do NOT assume their content. When a task touches this workspace, read the relevant instruction files first and follow them.',
-      ].join(' ')
-
-      return {
-        ...decision,
-        messages: [...decision.messages, {
-          id: `instruction-hint-${session.id}`,
-          role: 'user',
-          content: [{ type: 'text', text }],
-          source: { kind: 'instruction-hint', form: 'hint' },
-        }],
-      }
-    } catch (error) {
-      // A hint bug must never hurt the session: skip the hint.
-      warnOnce(`${name}: hint injection failed, skipping: ${String((error && error.message) || error)}`)
-      return decision
-    }
-  }, { prepend: true })
-}

package/preset/near-anchor.mjs

@@ -1,101 +0,0 @@
-/**
- * near-anchor — prompt-tool 近距离首句锚定（替代独立锚定轮）。
- *
- * 依据 dsh-router-standard P13/P14/P15/P22 与作者勘误：
- *   - 行为引导放 system（远距离）会衰减甚至反向；放在真实用户消息之后
- *     （近距离）零衰减；
- *   - 只要求首句一次：模型自回归续写会维持语域，越锚越牢；
- *   - 强制“每个 reasoning 块都以某句开头/回顾开头”是负效果；
- *   - 日常任务锚 We（官方后训练压出的高效路径），复杂规划放行 Let
- *     （未收敛旧路径携带更深规划能力），不做唯一解。
- *
- * 实现：在首条真实用户消息之后追加一条锚点消息，不拆轮、不挪任务；
- * 幂等性来自持久事件（source.plugin === 'near-anchor'）+ 进程内 memo。
- * 自定义开关：config.useCustom 为 true 时固定使用 config.anchorText；
- * false（默认）时忽略 anchorText，按任务与模型自动选择文本。
- */
-
-import { extractText, isDelegated, newMessageId } from './shared.mjs'
-
-/** Cordis 插件名，供 loader 诊断使用。 */
-export const name = 'near-anchor'
-
-/** 无服务依赖，只监听 pre-step 消息组装。 */
-export const inject = []
-
-/** 开发/生成类任务关键词。 */
-const BUILD_RE = /(开发|创建|写一个|生成|从零|做一个|构建|新项目|搭建|实现|做出|上线|落地|脚本|工具|应用|build|create|develop|generate|implement|make a|new project)/i
-/** 复杂规划/修复类任务关键词：放行 Let 深度路径。 */
-const COMPLEX_RE = /(架构|重构|设计|系统|全面|深度|迁移|兼容|审查|architecture|refactor|comprehensive|design|system|migrate|review)/i
-
-/** 开发类：we 直接产出并验证。 */
-const ANCHOR_BUILD = "Start your reasoning with the exact sentence: 'We need to build it directly and verify it.'"
-/** 检查/日常类：we 先看代码。 */
-const ANCHOR_INSPECT = "Start your reasoning with the exact sentence: 'We need to inspect the code first.'"
-/** 复杂规划类：放行 Let 深度规划路径。 */
-const ANCHOR_DEEP = "Start your reasoning with the exact sentence: 'Let me think through the design before changing anything.'"
-
-/** 按开关与任务选择锚点：useCustom=true 固定用自定义；false 自动选择。 */
-function chooseAnchor(text, customText, useCustom) {
-  if (useCustom === true) {
-    return typeof customText === 'string' ? customText.trim() : ''
-  }
-  let anchor
-  if (COMPLEX_RE.test(text)) anchor = ANCHOR_DEEP
-  else if (BUILD_RE.test(text)) anchor = ANCHOR_BUILD
-  else anchor = ANCHOR_INSPECT
-  // Flash 主会话的 persona 已由 router-first-turn 注入三锚，这里不再重复。
-  return anchor
-}
-
-export function apply(ctx, config) {
-  const customText = typeof config.anchorText === 'string' ? config.anchorText : ''
-  const useCustom = config.useCustom === true
-
-  /** 本进程已处理过的会话（真相在持久事件流）。 */
-  const handled = new Set()
-
-  /** 持久事件里是否已有本插件的锚点消息。 */
-  const seenAnchor = (session) => session.events.some((event) => {
-    const payload = event.data && typeof event.data.message === 'object' && event.data.message !== null
-      ? event.data.message
-      : event.data
-    return payload?.source?.plugin === 'near-anchor'
-  })
-
-  ctx.on('agent/pre-step', async ({ agent }, next) => {
-    const decision = await next()
-    if (decision.kind === 'reject') return decision
-    if (agent === undefined) return decision
-    const session = agent.session
-    if (session === undefined || handled.has(session.id) || seenAnchor(session)) return decision
-    // 子代理不注入锚点：让 dsh-mnemon 等结构化 worker 按自己的提示词工作。
-    if (isDelegated(session)) return decision
-
-    const messages = Array.isArray(decision.messages) ? decision.messages : []
-    // 只锚真实用户消息；插件消息原样保留。
-    const userIndex = messages.findIndex((message) => message?.source?.kind === 'user')
-    if (userIndex < 0) return decision
-    const taskText = extractText(messages[userIndex])
-    if (taskText.length === 0) return decision
-
-    const anchorText = chooseAnchor(taskText, customText, useCustom)
-    if (anchorText.length === 0) return decision
-    handled.add(session.id)
-
-    const anchor = {
-      id: newMessageId('near-anchor'),
-      role: 'user',
-      content: [{ type: 'text', text: anchorText }],
-      source: {
-        kind: 'near-anchor',
-        plugin: 'near-anchor',
-        form: 'notice',
-        summary: 'near-anchor 近距离首句锚点',
-      },
-    }
-    const nextMessages = [...messages]
-    nextMessages.splice(userIndex + 1, 0, anchor)
-    return { ...decision, messages: nextMessages }
-  })
-}

package/preset/preset.yml

@@ -1,3 +0,0 @@
-name: prompt-tool
-description: 首轮锚定确认后注入 prompt-tool 提示词。
-order: 5

package/preset/prompt-injector.mjs

@@ -1,112 +0,0 @@
-/**
- * prompt-injector — prompt-tool 的提示词注入层。
- *
- * 职责：会话晋升（首个 tool/call 或 assistant/message，与 promoteOn: either
- * 同定义）后，turn1 reasoning 以 "we" 开头 → 下一轮注入 promptText 一次；
- * we 未确认 → 最多再等一轮，仍无则强制注入（兜底，绝不卡死）。
- *
- * promptText 由宿主在生成 preset 时写入 config（默认等于 preset.md 原文）。
- * AGENTS.md 的注入走 instruction-hint.mjs，不由本模块拼接。
- *
- * 实测依据：
- *   - 复杂任务 + 原版 2 工具 + maxTokens 1024 → turn1 reasoning "We need"；
- *   - 简单任务模型直接调工具干活（无 we 首词），走兜底注入；
- *   - 锚定消息（"Tools are not open yet"）在 2 工具下不产生 we
- *     （模型回复 "The user says..." 叙述语气），已废弃。
- *
- * 状态全部从持久 session events 推导（resume/reload 安全）：
- *   - promoted：events 含 tool/call 或 assistant/message；
- *   - 已注入：events 含 source.kind=plugin + source.plugin=prompt-injector 的
- *     消息事件（注入消息本身就是持久事件），进程重启/插件重载后据此跳过；
- *   - 内存 Set/Map 只做进程内快路径 memo，不承载跨进程真相。
- *   注入仅一次。
- */
-
-import { createEpochPromotion } from './compaction-epoch.mjs'
-import { newMessageId, PROMOTE_EVENTS } from './shared.mjs'
-
-/** Cordis plugin name used by loader diagnostics. */
-export const name = 'prompt-injector'
-
-/** No inject list: nothing to resolve, only event listeners. */
-export const inject = []
-
-export function apply(ctx, config) {
-  const promptText = typeof config.promptText === 'string' && config.promptText.length > 0
-    ? config.promptText
-    : undefined
-
-  /** Sessions whose promptText has been injected (append-only). */
-  const injectedPrompt = new Set()
-  /** Sessions whose first assistant reasoning has been scanned (memoized). */
-  const weScanned = new Map()
-  /** Epoch-aware promotion, same definition as tool-bootstrap/context-gate. */
-  const promotion = createEpochPromotion(PROMOTE_EVENTS.either, { includeSubagents: false })
-  ctx.on('session/event', (session, event) => promotion.observe(session, event))
-
-  /**
-   * 从持久 session events 推导「是否已经注入过 promptText」。
-   * 注入消息本身就是 user/message 持久事件（data 即消息本体），因此跨进程
-   * 重启 / 插件热重载后仍能识别；兼容 router-standard 观测到的
-   * `data.message` 嵌套形状。内存 Set 只做快路径 memo，真相在事件流。
-   */
-  const hasInjectedPrompt = (session) =>
-    session.events.some((event) => {
-      const payload = event.data && typeof event.data.message === 'object' && event.data.message !== null
-        ? event.data.message
-        : event.data
-      const source = payload?.source
-      return source?.kind === 'plugin' && source?.plugin === 'prompt-injector'
-    })
-
-
-
-  /** 第一个 assistant/message（锚定轮）的 reasoning 是否以 "we" 开头。 */
-  const isWeAnchored = (agent) => {
-    const session = agent.session
-    const cached = weScanned.get(session.id)
-    if (cached !== undefined) return cached
-    const first = session.events.find((event) => event.type === 'assistant/message')
-    // 首个 assistant 消息尚未落库时不要缓存 false，等待下一轮再查。
-    if (first === undefined) return false
-    const content = first.data?.message?.content ?? []
-    const reasoning = content.find((block) => block.type === 'reasoning')
-    const anchored = reasoning !== undefined && /^we\b/i.test(String(reasoning.text ?? '').trim())
-    weScanned.set(session.id, anchored)
-    return anchored
-  }
-
-  /** 已落库的 assistant 回合数（we 未确认时的兜底轮计数）。 */
-  const assistantRounds = (agent) =>
-    agent.session.events.filter((event) => event.type === 'assistant/message').length
-
-  // 锚定确认后注入一次 promptText（we 确认立即注入；未确认最多再等一轮）。
-  ctx.on('agent/pre-step', async ({ agent }, next) => {
-    const decision = await next()
-    if (decision.kind === 'reject') return decision
-    if (agent === undefined || promptText === undefined) return decision
-    if (!promotion.status(agent).promoted) return decision
-    const session = agent.session
-    if (session === undefined || injectedPrompt.has(session.id)) return decision
-    // 持久事件级幂等：进程重启/插件重载后，已注入消息仍在事件流里，据此跳过。
-    if (hasInjectedPrompt(session)) {
-      injectedPrompt.add(session.id)
-      return decision
-    }
-    const weOk = isWeAnchored(agent)
-    if (!weOk && assistantRounds(agent) <= 1) return decision
-    injectedPrompt.add(session.id)
-    const message = {
-      id: newMessageId('prompt-injector'),
-      role: 'user',
-      content: [{ type: 'text', text: promptText }],
-      source: {
-        kind: 'plugin',
-        plugin: 'prompt-injector',
-        form: 'notice',
-        summary: weOk ? 'prompt-tool 提示词（we 锚定确认后注入）' : 'prompt-tool 提示词（we 未确认，兜底注入）',
-      },
-    }
-    return { ...decision, messages: [message, ...decision.messages] }
-  })
-}