dsh-anchored-standard

1. 安装并启动 DeepSeek Harness：npx @deepseek-ai/dsh web
2. 在终端执行上面的安装命令（CLI 会解析插件并核验来源）
3. 用 dsh plugins list 确认已安装，必要时重启 Harness 生效

插件以当前 dsh 进程的权限运行，安装时可能执行代码。请先通读仓库源码与许可证，确认无破坏性命令与越权访问；本站只做索引，不对第三方插件安全性作担保。

事实信息来自公开插件目录快照（2026-10-03），介绍文案由本站再加工。

以下为插件仓库 README 全文（原始内容，由公开目录抓取整理）。

dsh-anchored-standard

中文说明

Experimental DeepSeek Harness agent presets — a base mode, two live-anchor
variants, and one seeded prefab mode — that anchor a session's model trajectory
on the Minimal condition
(real Minimal tool schema, no auto-injected context), then promote to a small
resident catalog once the session is durable, unlocking heavier Standard tools
on demand.

This is a community project. It is not an official DeepSeek preset and is not
affiliated with or endorsed by DeepSeek.

The project is frozen — new issues and pull requests are no longer accepted (see
Project status). For ideas for new plugins or useful
findings, please submit them under the
repository.

Project status (frozen 2026-09-10)

This project is frozen. On 2026-09-10 DeepSeek released V4.1 Flash and announced that
V4 Pro — the model these presets were measured on and tuned for — is retired on
2026-09-14 12:00, with its traffic routed to V4.1 Flash. The presets exist to re-anchor a
trajectory that the successor does not appear to need patched: the flash family anchored
under every condition in our first-round dose-response probes (32/32), which is why the
project never tuned for it. V4.1 Flash's own first-round trajectory has NOT been measured
(no API budget in maintenance mode), so treat that as an inference from the earlier
flash data, not a result. The model the work was built around is going away, so the
maintenance period ends here. New issues and pull requests are no longer accepted or
handled. The repository stays online with its history, data and acknowledgement record
intact.

This is the ending FAREWELL.md asked for: "let the next model eat more
diverse harness environments during training, so that patch engineering like this is no
longer necessary." That file now ends with a closing note written by the successor model
itself, V4.1 Flash. What stays valid is the model-agnostic part — the context-gate
unified injection control, the prefab pipeline, the discovery-tool dose-response data, and
the general observation that the API-visible surface conditions the trajectory. Research
material remains open in
DeepseekCotexplorations.

Earlier status (2026-08-17, kept for the record): following the price increases on both the
DeepSeek official API and the opencode go subscription, active development had already
stopped — the evaluation loops these presets depend on (Project2-class runs and multi-trial
roll/probe experiments) were no longer affordable, leaving the repository in maintenance
only mode (bug fixes and harness-compatibility updates when feasible). A personal note
from the maintainer: FAREWELL.md (Chinese). Contributors and collaborators
are listed in ACKNOWLEDGEMENTS.md.

Community projects that users report perform better in some scenarios, plus
ecosystem tooling built around these presets:

dsh-routing-suite — a runtime injector
plus task-aware thinking-mode routing presets (the router-standard family).

J-Space Cognition Suite
— a model-agnostic inference-time cognitive control layer packaged as a Skill.

both-anchored (auto-b7n) —
an independently developed two-phase anchored preset: no first-request output
cap, no promotion gate, promotion on the first durable tool/call or
assistant/message, with the full PTC SDK kept intact via post-promotion wire
trimming (the #85 feedback and experiment data live in the research repository,
with sample sizes and boundary caveats stated in the original contribution).

dsh-recovery — a zero-dependency
self-healing CLI plus watchdog plugin: broken-preset quarantine/rollback,
safe-mode whitelists, and boot probes.

Modes at a glance

Mode
Directory
First model request
Anchor mechanism
Promotion signal
Cost

Anchored Standard
preset/
2 tools (the Minimal pair)
Minimal tool schema
first durable tool/call or assistant/message (promoteOn: either)
none

Zero-Anchored Standard
zero-anchored-standard/
0 tools
one fixed anchor turn
the anchor reply (assistant/message)
+1 model call

Whoami Standard
whoami-standard/
0 tools
one "你是谁" self-introduction turn
the self-introduction reply (assistant/message)
+1 model call

Prefab Anchored Standard
prefab/
seeded rolled history
bundled successful trajectory
already promoted in the seed
no model call to instantiate

Eternal Minimal
eternal-minimal/
2 tools, forever
the visible catalog never grows; heavier tools run via the dshx bash gateway
none (no phases)
none

Wire Think-Execute Standard
wire-think-standard/
tools present, tool_choice: none on the wire
sibling provider route per think step
per-turn: the steer itself
+1 model call/turn, prefix-cache churn

Combo Anchored
combo-anchored/
0 tools, on every user turn
think/execute split + depth gate + deliberation drip as three independent rows
per-mechanism
+1 model call/turn

Every mode directory is self-contained and installs alone under whatever id
you copy it to (see Install). The prefab hydrates the blank session
in place when its preset is selected; no per-workspace import is required.

Terminology

trajectory — the style of the model's first reasoning chain. The
Minimal condition produces "We need…" first lines; the Standard condition
produces "Let me…" ("standard-like") first lines.

anchor — the first-request conditions that select the trajectory. Issue
11 isolated three levers: the tool schema, the output budget, and the

injected reminders.

bootstrap phase — request #1 of a session: the bootstrap tool pair, no
auto-injected context, optional output cap.

promotion — the durable session event that ends the bootstrap phase.
Base mode: first tool/call or assistant/message, whichever comes first.
Variants: the anchor reply.

durable — recorded in the session event log. Phase state is derived
from durable events, so resume and reload preserve it.

resident catalog — the promoted tool set: the bootstrap pair plus the
discovery tools plus every tool the model explicitly unlocked.

discovery tools — dev_tool_search, skill_search, skill_load: the
on-demand unlock surface for heavier Standard tools.

materialized copy — the committed copy of a shared/ plugin inside a
mode directory, generated by npm run sync.

How it works

The base mode in one request lifecycle (the variants change only the first
turn — see their sections):

user's first message
        │
        ▼
┌ request #1 ─ bootstrap phase ──────────────────────────────┐
│ tools    : bash + str_replace_editor (Minimal's real pair) │
│ context  : no AGENTS.md digest, no skill-catalog reminder  │
│ budget   : adapter default (`bootstrapMaxTokens` optional) │
└─────────────────────────────────────────────────────────────┘
        │ first durable tool/call OR assistant/message
        ▼ PROMOTION — derived from durable events, resume-safe
┌ request #2+ ─ resident phase ──────────────────────────────┐
│ tools    : bootstrap pair + discovery tools + unlocked     │
│ context  : standard injections restored                    │
│ budget   : adapter default (a cap is stripped on promote)  │
└─────────────────────────────────────────────────────────────┘

Three first-request levers decide the trajectory (issue #11):

Tool schema — the decisive variable at the adapter-default maxTokens
(256000). The real Minimal pair anchored 5/5; every standard-family schema
fell standard-like 11/11.

Output budget — a 1024 first-request cap also anchored the trajectory
(26/32), independent of the tool descriptions. That measurement kept the
first round inside the cap; when the first reply exceeds it, the
truncation-continuation loop amplifies drift instead (we-fingerprint 0.17
capped vs 0.98 uncapped, #85).
The base mode leaves this lever unset (bootstrapMaxTokens is opt-in).

Injected reminders — the AGENTS.md/CLAUDE.md digest and the
available-skills reminder. With the skill catalog present, the anchor did
not reproduce at all (0/9). The base mode now suppresses EVERY automatic
injection during bootstrap at the harness's two unified injection paths
(the context-gate plugin), not just the two measured ones.

Why

DeepSeek V4 Pro conditions strongly on the API-visible tool catalog. In the
Project2 evaluation, Standard and PTC produced scores of 91 and 92, while the
official Minimal preset produced 99 and 96. Permanently staying on Minimal,
however, gives up the Standard preset's broader tool set.

Anchored Standard separates initial trajectory selection from later tool use:

Keep the complete Minimal system prompt.

Expose the Minimal preset's REAL tool schemas — persistent bash +
str_replace_editor, byte-identical to the official Minimal composition —
on the first model request (lever 1 above).

Suppress EVERY auto-injected context on that first request — at the
harness's unified injection paths, not per source name (the context-gate
row, mounted FIRST; lever 3). While the session is unpromoted the
assembly's dynamic runtime-context contributions are blanked (the whole
SystemPrompt.context() family: sandbox/approval policy snapshots and any
third-party context provider), and the pre-step waterfall keeps only the
CLAIMED message batch plus a small kind allowlist (a user-initiated skill
gesture survives; skill catalog, AGENTS.md digest, time/tmux context,
hooks, and unknown third-party injections are stripped by default). After
promotion the gate opens and the loop's own snapshot projection diffs
exactly ONE fresh runtime-context message into the next request — minimal
first round, injections on the second round. A compaction/end boundary
re-closes the gate the same way.

After the session records its first durable promotion signal — a tool/call
or the first assistant/message, whichever comes first — promote to the
RESIDENT catalog: the bootstrap pair plus the discovery tools plus whatever
the model has explicitly unlocked via dev_tool_search. Dumping the full
Standard catalog at promotion pulled the trajectory back to standard-like
behavior (the post-promotion regression), so heavier tools — web_search,
subagent, workflow, … — stay one dev_tool_search call away. Request
1 always sees the bootstrap catalog; request #2 always sees the resident

catalog, so a text-only first reply can no longer trap the session in
bootstrap. (promoteOn in the tool-bootstrap row selects the trigger:
either default, tool-call, or assistant-message.)

Derive the phase from durable session events so resume and reload preserve it.

The bootstrap catalog is the same on every platform: the Minimal pair
(bash/str_replace_editor). The preset's shell is the persistent PTY bash
(the sandboxed Standard bash row is disabled — both register the bash name
into the same layer, and the tools registry rejects duplicates; Windows never
had the sandboxed bash anyway). pwsh remains available in the promoted
catalog on Windows.

Results

The anchored family was validated on Project2 with three V4 Pro scores of
98, 99, and 99. Provenance note (issue #60): those three runs predate the
current composition — they used the Minimal system prompt with a first-request
pwsh + read surface and promoted to the full 25-tool Standard catalog;
the exact Minimal pair (persistent bash + str_replace_editor) with the
small resident catalog was introduced afterward. The bundled generic prefab
removes Project2-specific warm-up facts and was not re-benchmarked before the
API price change, so those scores must not be attributed to the generic
template.

Independent replications: the trajectory anchoring reproduces strongly, but
the ability gap is unresolved at small n — see
#65
(anchoring 9/9 separated by preset; anchored−standard +3.3, 95% CI
[−2.6, +9.3]) and
#51
(multi-env, Ability 85–90, 98/99 not reproduced). Treat the scores above as
our original observations, not a settled effect size.

Research write-ups live in the companion exploration repository
DeepseekCotexplorations
(data and methodology; this repository keeps the code):

Tool-surface dose-response + Project2 replication —
methodology, per-run scope, tool-surface experiments, and limitations.

Anchor-mass quantification + single-request probe methodology —
the prefab template quality model and the post-price-hike low-cost
evaluation loop.

Development-process records (what was done, why, and the pitfall lists) are
kept in this repository as HANDOFF.md and
HANDOFF-2.md.

Configuration reference

All knobs are rows in each mode's agent.cordis.yml. Unknown keys fail at
preset mount.

context-gate (mounted FIRST in preset/, zero-anchored-standard/, and
whoami-standard/ — waterfall registration order makes the gate the outermost
transform; the plugin lives in shared/context-gate.mjs and is reusable by
any other composition that wants unified injection control alone):

Key
Default
Meaning

promoteOn
either
Promotion trigger: either, tool-call, or assistant-message (the variants use assistant-message).

includeSubagents
false
Gate subagents too (true in the base mode and whoami; keep in sync with the bootstrap row).

enabled
true
false disables both interception paths (A/B testing without touching the row set).

allowKinds
[skill-invocation]
source.kind values allowed beyond the claimed batch; [] keeps ONLY the claimed batch.

Injection control division of labor: session-phase suppression (everything
keyed on a promotion boundary) belongs to context-gate. Two documented
exceptions keep their own enumerated suppressedContextSources strip because
the gate's phase machine does not map onto their scope: the think-step strip
in think-phase/wire-think (per-step, not per-session-phase) and the
permanent every-request strip in eternal-minimal (no promotion boundary;
frozen to the configuration its recorded measurements were taken under).

tool-bootstrap (in preset/agent.cordis.yml; mount right after
context-gate):

Key
Default
Meaning

bootstrapTools
[bash, str_replace_editor]
Tools visible on request #1.

promoteOn
either
Promotion trigger: either, tool-call, or assistant-message.

bootstrapMaxTokens
unset
Optional output cap for request #1; stripped after promotion. A cap below the first round's actual output truncates it and amplifies drift (#85) — the default stays unset for this reason.

includeSubagents
false
Subagents take the bootstrap phase too (true in the base mode).

compactionTools
[]
Extra tools available between a compaction boundary and re-promotion.

zero-tool-bootstrap (in zero-anchored-standard/ and whoami-standard/):
compactionTools has the same semantics (promotion is always the first
assistant/message), plus includeSubagents, whether subagents also take the
anchor phase (set true in whoami-standard, false in
zero-anchored-standard). Context suppression is NOT here — both variants
mount the context-gate row (above) with promoteOn: assistant-message;
the bootstrap's former suppressedContextSources key now fails at mount.

anchor-turn (in both variants): text — the synthetic first user message
(default "This round is a test. Tools are not open yet; all tools will open
next round." in zero-anchored, "你是谁" in whoami); includeSubagents —
whether subagents also take the anchor turn.

eternal-minimal (in eternal-minimal/; the row must stay FIRST):

Key
Default
Meaning

guide
true
Append the short dshx capability guide to the system prompt; false keeps the persona byte-pure.

gateway
true
Intercept dshx shell commands and execute the real tools; false leaves the bare Minimal pair.

gatewayCommand
dshx
The interception word.

maxGatewayChars
12000
Cap on one gateway result payload.

suppressedContextSources
[agent-instructions, skill-catalog]
Stripped on every request (no promotion boundary; the enum intentionally stays — see the division-of-labor note above).

cot-drip (in combo-anchored/):

Key
Default
Meaning

every
4
Attach one deliberation beat after every Nth tool result; 0 disables the drip.

maxPerTurn
1
Beats per turn.

text
built-in beat
The reminder text (one "We …" sentence restating the remaining goal).

includeSubagents
false
Whether subagent calls are dripped too.

toolchoice-adapter (in wire-think-standard/; the row must stay the first LOCAL row):

Key
Default
Meaning

provider
deepseek-wire-think
The sibling route id the adapter owns; registering an id twice throws DUPLICATE_ADAPTER (caught, degraded).

toolChoice
none
The wire tool_choice sent whenever tool definitions are present.

baseURL / apiKeyEnv
settings/env
Row config first, then the llm-deepseek settings section, then DEEPSEEK_BASE_URL / DEEPSEEK_API_KEY.

logprobs
false
Opt-in research hook: request token logprobs and log a per-request mean summary (no StreamChunk surface exists).

wire-think (in wire-think-standard/): same mode / suppressedContextSources /
includeSubagents / steerText semantics as think-phase, plus
provider (must match the toolchoice-adapter row's id) and defaultProvider
(the route execute steps restore onto, default deepseek-official).

instruction-hint (all modes): promoteOn matching the mode's promotion
semantics (either in the base mode, assistant-message in the variants) —
the one-shot "instruction files exist, read them before acting" hint waits
for promotion.

Repository layout

preset/                  Anchored Standard — the base mode
zero-anchored-standard/  variant: fixed zero-tool anchor turn
whoami-standard/         variant: "你是谁" anchor turn, subagents inherit
eternal-minimal/         variant: Minimal pair forever + dshx bash gateway
wire-think-standard/     variant: wire-level condition (tools + tool_choice=none)
combo-anchored/          combination package: think split + gate + drip rows
shared/                  single source of truth for plugins used by 2+ modes
scripts/sync-modes.mjs   materializes shared/ plugins into every mode dir
test/                    zero-dependency test suite (npm test)
verify/                  one-shot headless verification runner
prefab/                  Prefab Anchored Standard + bundled session template

prefab/ ships a generic template by default and a Project2-specific template
as an explicit opt-in. Both contain real model reasoning; read the mode's
installation notes before use.

Invariants, enforced by npm run check:

Every mode directory is self-contained: installable by copying it alone;
agent.cordis.yml rows may reference only ./local.mjs files, never ../.

Plugins shared by several modes live once in shared/; the copies in mode
directories are generated. Edit shared/, run npm run sync, commit both —
never edit a materialized copy.

The context-gate row stays the FIRST row of preset/agent.cordis.yml
(the gate must register before every injecting plugin), with
tool-bootstrap right after it. The same first-row rule holds for the
context-gate row in zero-anchored-standard/ and whoami-standard/.

This repository deliberately ships no AGENTS.md/CLAUDE.md: the presets' whole
mechanism is a clean request #1, stripping exactly those instruction-file
digests from it (issue #6: 0/9 anchored with the injection present). Shipping
one would only feed later rounds and contradict the mechanism being
documented. Everything an assistant needs is in this README.

Compatibility

Developed and tested against:

DeepSeek Harness 0.1.0-rc.5

repository commit 47f9438

Node.js 24 on Windows

DeepSeek Harness 0.1.3-alpha.1 removed the public session.events array in
favor of session.snapshotEvents() (a frozen copy whose cache is invalidated on
every append). Since PR
#88 every
history scan prefers snapshotEvents() and falls back to session.events, so
the presets load on both old and new harness builds. Verified against the
0.1.3-alpha.1 source (the session API surface the plugins touch, plus the
plugin hook names) and by the mock suite; not by live runs on that build.

DeepSeek Harness 0.1.3-alpha.2 replaced the dsh-persona row's text key
with a required prefix (plus an optional suffix), so every mode's preset
failed to mount with invalid config: $.prefix missing required value. Since PR
#90 the persona
rows use prefix: — the persona TEXT is unchanged (it still matches the
official 0.1.3 minimal persona row byte-for-byte), so the byte-pure Minimal
anchor condition is unaffected. This part is a one-way migration: a preset
row cannot carry both keys (unknown keys fail at mount), so on dsh
0.1.3-alpha.1 and older the persona row must use text: again — change that
one line per mode directory, or use the commit before #90.

The persistent shell resolves shellPath adaptively: it keeps the
terminal-bash plugin default /bin/bash on hosts where that absolute path
exists, and falls back to bash (PATH lookup) otherwise — e.g. NixOS, where
bash lives under the Nix store. Hosts that ship /bin/bash keep the previous
behavior exactly; the fallback only activates where the default would make
every bash call fail with "PTY shell exited during startup".

On the 0.1.0-rc.5 source checkout, bootstrapMaxTokens reaches the actual
first request (the first request/header records the cap, adapterDefaults
stays empty), because llm.prepareCall only materializes a default maxTokens
when the proposed config has none. One prebuilt profile package observed in
issue #11 (CLI launcher reporting 0.1.0-rc.6) overwrote the proposed cap
with adapterDefaults.maxTokens; there the cap is a no-op. The default
composition therefore relies on the Minimal tool schema alone (which anchors
at the adapter default with no cap) and leaves bootstrapMaxTokens as an
opt-in for standard-schema bootstraps.

DeepSeek Harness is currently a developer preview and explicitly permits
breaking changes. This preset is a full snapshot of the Standard composition,
so review upstream changes before using it with a newer release.

Install

For the prefab mode, the recommended path is AI-assisted one-command setup.
Give your coding agent this repository and ask it to follow the
installation-agent contract. When it reports
INSTALL READY, start DSH, select Prefab Anchored Standard, create a new
session in the target workspace, and send the real task prompt. This installs
the generic template; the Project2 benchmark template requires an explicit
--template project2 selection and installs under a separate preset id.

Clone this repository, then copy the entire preset directory into the user
preset root under the id anchored-standard. Every mode directory in this
repository is self-contained: the zero-anchored-standard/,
whoami-standard/, prefab/, eternal-minimal/, wire-think-standard/, and
combo-anchored/ variants install the same way, alone or together, with no
other directory required (see their sections below). prefab/ automatically
hydrates both sessions switched to it and sessions created with it as the
default preset; follow prefab/README.md.

PowerShell:

$target = Join-Path $env:USERPROFILE '.dsh\.agent-presets\anchored-standard'
if (Test-Path -LiteralPath $target) { throw "Preset already exists: $target" }
New-Item -ItemType Directory -Force -Path (Split-Path -Parent $target) | Out-Null
Copy-Item -Recurse -LiteralPath '.\preset' -Destination $target

Linux/macOS:

dsh_home="${DSH_HOME:-$HOME/.dsh}"
mkdir -p "$dsh_home/.agent-presets"
test ! -e "$dsh_home/.agent-presets/anchored-standard"
cp -R preset "$dsh_home/.agent-presets/anchored-standard"

Fully restart DeepSeek Harness, create a blank session, and select
Anchored Standard (experimental). Do not switch an active session from a
different preset.

Verify

Export the session JSONL and inspect request/header events. Reproduction
checklist (issue #11 asks for the first two explicitly, because both are the
variables that decide the anchor):

First-request config.maxTokens value: with bootstrapMaxTokens unset
(the default), the first header records the adapter default (e.g. 256000
with adapterDefaults.maxTokens: true); with a cap configured it records
the cap (e.g. 1024 with no maxTokens adapterDefault).

First-request tool schema source: the first header's tools array must
be exactly ["bash", "str_replace_editor"] — the official Minimal preset's
real schemas, not Standard's pwsh/read.

the first request's messages should contain no AGENTS.md/CLAUDE.md digest and
no available-skills reminder — only the user message and the minimal persona
system prompt;

after the first tool call or the first assistant reply, the next changed
header should contain the promoted resident catalog: the bootstrap pair plus
dev_tool_search/skill_search/skill_load plus any tools the model
already unlocked;

subsequent requests should keep that resident set (it grows only through
explicit dev_tool_search unlocks) and restore the standard context
injections.

Run the local zero-dependency tests with:

npm test

Important behavior

With the default promoteOn: either, the session promotes after its first
durable tool/call OR its first assistant/message, whichever comes first —
request #1 sees the bootstrap catalog and every later request sees the
resident catalog. A text-only first reply therefore still promotes at
request #2; set promoteOn: tool-call to restore the original behavior,
where a first response that makes no tool call never promotes.

A failed tool execution still promotes the session because the durable
tool/call already exists.

The first request's output budget is NOT capped by default: the Minimal tool
schema anchors at the adapter-default maxTokens, so bootstrapMaxTokens is
opt-in. When set, the first request is capped and the cap is explicitly
stripped after promotion (the next request's seed proposal carries the
previous header's maxTokens forward).

The promoted catalog is the RESIDENT set — the bootstrap pair plus the
discovery tools plus everything the model unlocked via dev_tool_search —
not the full Standard dump. The Standard sandboxed bash row stays disabled
in favor of the persistent shell (same tool name, same layer; see Why). When
unlocked, the read/write/edit tools keep the sandboxed filesystem while
str_replace_editor uses the preset's local fs.

A missing bootstrap tool degrades to the full catalog with a one-time
warning instead of failing requests, so a composition drift cannot brick a
session; invalid promoteOn values fail at preset mount instead.

Promotion decisions are memoized per session for the process lifetime; the
durable event scan runs once per session per process.

While a session is unpromoted, the context-gate plugin closes BOTH unified
injection paths: the assembly's runtime-context contributions are blanked
(the whole SystemPrompt.context() family, without enumerating sources),
and the pre-step waterfall keeps only the claimed batch plus the
allowKinds entries. At promotion the loop's snapshot projection diffs in
exactly ONE fresh runtime-context message; a gate failure degrades to
keeping every message rather than eating context.

The tool catalog changes at promotion and again whenever dev_tool_search
unlocks a new tool; request-prefix cache continuity breaks at those points.

The preset has the same trust level as shell access. Review its files before
installation.

The plugin performs no network requests and adds no telemetry.

The Minimal persona is intentionally bare (You are a helpful software engineer assistant., complete: true) — the byte-pure condition the anchor
was measured under. A side effect: the model has no identity anchor and may
fall back to training priors on identity questions (observed:
deepseek-v4-pro answering "I am Claude" when asked who it is; see
#81). To pin
identity without touching the tool schema, append the official identity line
to the persona text: —
You are a helpful software engineer assistant. You are an AI agent powered by DeepSeek Harness.
— then recreate the session. This deviates from the measured condition, so
verify your own first-round trajectory if exact anchoring matters (see
#49).

Troubleshooting: a duplicate instruction-hint after a host restart

instruction-hint injects its hint at most once per session via a durable scan of
session.events. The scan is preventive, not guaranteed: if the first agent/pre-step
after a host restart runs before the session log is materialized, the scan sees an empty
event list and re-injects the hint. Older versions also used a deterministic id
(instruction-hint-<sessionId>), so a re-injected duplicate collided with the original
message and stopped history assembly. Since the unique-id change, a re-injection degrades
to a few wasted context tokens instead. If an old log was broken by the deterministic-id
collision, repairing it should dedup on source.kind === 'instruction-hint', which still
identifies the old rows (they share one id; new rows no longer do).

Zero-Anchored Standard (experimental)

An extra test mode that does not change the Anchored Standard logic above. It
uses the same Minimal-aligned system prompt, but instead of exposing two tools
on the first request it injects one fixed zero-tool anchor turn:

When the user sends their first message, the anchor-turn plugin prepends a
fixed user message — "This round is a test. Tools are not open yet; all
tools will open next round." — ahead of it.

The first real model request carries ZERO tools, so the session's first
reasoning chain follows the zero-injection "we" trajectory.

Once that anchor response is durable, the resident catalog is exposed
and the real message proceeds with it.

Anchoring on the first message — not on session creation — keeps the
blank-session preset switcher usable. Subagents always see the resident
catalog.

Measured behavior (opencode-go, DeepSeek V4 Pro, reasoningEffort=max): the
anchor request is stable "we"-style with zero let me; the following
tool-bearing requests return to the "The user wants…/Let me" style. This mode
is a comparison point for whether the zero-tool first turn is worth the extra
model call — not a claim that tool rounds stay "we"-style.

Install as a separate preset id:

dsh_home="${DSH_HOME:-$HOME/.dsh}"
mkdir -p "$dsh_home/.agent-presets"
test ! -e "$dsh_home/.agent-presets/zero-anchored-standard"
cp -R zero-anchored-standard "$dsh_home/.agent-presets/zero-anchored-standard"

Restart DeepSeek Harness, create a blank session, select Zero-Anchored
Standard (experimental), then send your first message.

Whoami Standard (experimental)

A usability-oriented variant of the zero-tool anchor idea: the first turn is a
natural self-introduction prompt instead of a fixed test message, and the
user's real first message is deferred to the next turn. Whatever the user types
first, the session warms up exactly one round and everything is ready when the
real message is processed:

When the user sends their first message, the anchor-turn plugin prepends a
fixed user message — "你是谁" (who are you) — ahead of it in the next-turn
inbox queue.

dsh claims exactly ONE next-turn message per turn, so the first model
request sees only the anchor on an EMPTY tool surface and replies with a
self-introduction; that reply is the promotion signal.

The real message is claimed by the NEXT turn, with the promoted resident
catalog (shells, str_replace_editor, the discovery tools) already
unlocked — heavier Standard tools are one dev_tool_search away.

The anchor text is configurable via the anchor-turn row's text option
(default "你是谁"). Anchoring on the first message — not session creation —
keeps the blank-session preset switcher usable.

Full-powered subagents

Whoami Standard ships with includeSubagents: true on both the
zero-tool-bootstrap and anchor-turn rows, so subagents spawned from a
session inherit the same anchor flow as top-level sessions:

A newly spawned subagent's first model request sees only the "你是谁"
anchor on an empty tool catalog.

The subagent's self-introduction reply is the promotion signal.

The delegated prompt runs on the next turn with the promoted resident
catalog (shells, str_replace_editor, and the discovery tools).

Set includeSubagents: false on both rows to restore the plain behavior,
where subagents start with the resident catalog immediately. Each subagent
costs one extra model call for its anchor turn — a delegation-heavy session
pays it per subagent.

zero-anchored-standard keeps subagents plain by default; enabling the same
flow there means setting includeSubagents: true on its zero-tool-bootstrap
and anchor-turn rows (its anchor text stays the fixed test notice).

The trade-off of the mode itself is one extra model call per session: the
anchor turn is always taken, even when the first message is urgent.

The directory is self-contained; install it alone or alongside any other mode.

Install as a separate preset id:

dsh_home="${DSH_HOME:-$HOME/.dsh}"
mkdir -p "$dsh_home/.agent-presets"
test ! -e "$dsh_home/.agent-presets/whoami-standard"
cp -R whoami-standard "$dsh_home/.agent-presets/whoami-standard"

Restart DeepSeek Harness, create a blank session, select Whoami Standard
(experimental), then send your first message — the self-introduction round
runs first, and your message is answered with the full tooling on the next
turn.

Eternal Minimal (experimental)

The "make the model believe it never left Minimal" mode: the model-visible
catalog stays EXACTLY the Minimal pair (bash + str_replace_editor) for
the WHOLE session — no anchor round, no promotion, no discovery tools, no
catalog growth — while the full Standard toolset stays registered and
executes FOR REAL behind the dshx bash gateway:

dshx list                           # list every gateway tool
dshx web_search '{"query": "..."}'  # execute the real web_search
dshx read_image '{"path": "..."}'   # execute the real read_image

Eternal pair: system-prompt/assemble keeps only the shells +
str_replace_editor on every request (think steps, post-compaction,
subagents — everything), and auto-injected context is stripped everywhere
(there is no promotion boundary to key suppression on).

Gateway: a tools/pre-execute listener intercepts bash commands
starting with dshx, dispatches them through ctx.tools.execute() (the
full registry pipeline — policy, guards, execution, rendering), and
returns the rendered output as the command result. The deny channel is the
only sanctioned pre-dispatch way to substitute a result, so gateway
payloads arrive flagged as errors — every payload states plainly that the
tool executed and its output follows, so the model reads it as output.
The real tool really ran: the user sees genuine effects (files, searches,
subagents) exactly as if it had been called by name.

Guide: a short dshx capability guide is appended to the system
prompt (guide: false for a byte-pure Minimal persona) so the model knows
the gateway exists without a third visible tool.

The gateway refuses to dispatch the shells/str_replace_editor themselves
("invoke them directly"), which also makes recursion impossible. Unknown
tools, malformed JSON, and tool failures all come back as readable payloads.
Set gateway: false for a bare two-tool session with no interception.

Install as a separate preset id:

dsh_home="${DSH_HOME:-$HOME/.dsh}"
mkdir -p "$dsh_home/.agent-presets"
test ! -e "$dsh_home/.agent-presets/eternal-minimal"
cp -R eternal-minimal "$dsh_home/.agent-presets/eternal-minimal"

Restart DeepSeek Harness, create a blank session, select Eternal Minimal
(experimental), then work as usual — the model composes shell commands,
and dshx … lines run the heavier Standard tools for real.

Wire Think-Execute Standard (experimental)

The wire-level mode: every user turn opens with one think step that keeps
tool definitions PRESENT in the request while the wire forbids invocation
(tool_choice: "none"), then a steering notice opens the execute phase on
the official provider with the resident catalog.

tool_choice is outside the harness GenerateOptions vocabulary (the
official deepseek adapter documents the mapping as an MVP cut), so reaching
this condition takes the sanctioned wire seam:

Sibling route: toolchoice-adapter.mjs (row 1) registers a
zero-dependency DeepSeek chat-completions adapter under its OWN provider
id (deepseek-wire-think) that puts tool_choice: "none" on the wire
whenever tool definitions are present. The official DeepSeekAdapter
cannot be wrapped (its wire body is built inside a private generator), so
this file vendors a minimal, protocol-faithful subset of the official
serialize/SSE/translate pipeline — the same assistant-message nuances
(content: "" never null, reasoning_content replayed only on
tool-call turns, tool results as role: "tool" with an (no output)
fallback) and the same usage/finish translation. Connection facts
resolve row config > llm-deepseek settings section > env, exactly like
the official row, so the same DEEPSEEK_API_KEY serves both routes.

Per-step routing: wire-think.mjs keeps the think step's assembled
catalog UNTOUCHED (that is the condition being reproduced) and swaps ONLY
the provider in the agent/request waterfall — the frozen loop-built
request and the log-reconstructability invariant are preserved. Execute
steps (and every subagent) are routed back to the captured original
provider even when the folded session header seeds them with the think
route.

Steer + resident: agent/turn-stopping steers exactly once per turn
(resume-safe from durable steering/message events), and execute steps
see the promoted RESIDENT set.

Degradation ladder: if the sibling route is not registered (row removed, or
a second preset already mounted the same id — DUPLICATE_ADAPTER is caught
and warned), think steps fall back to the zero-tool condition, so a
composition mistake can never brick a session. mode: first-turn limits the
routing (and its costs) to the session's first user turn.

Costs to know before adopting: the think/execute alternation switches the
tools block of the request prefix twice per turn, so DeepSeek prefix-cache
reuse breaks from the first changed token each switch (provider id itself is
invisible to the backend cache; the tools block is what diverges). Each swap
appends a request/header change event. Set logprobs: true on the adapter
row for the opt-in research hook — the adapter requests token logprobs and
logs a per-request mean summary (the harness StreamChunk vocabulary has no
surface for logprob data, so logging is all a plugin can do today; that log
stream is exactly what offline trajectory analysis would consume).

Install as a separate preset id:

dsh_home="${DSH_HOME:-$HOME/.dsh}"
mkdir -p "$dsh_home/.agent-presets"
test ! -e "$dsh_home/.agent-presets/wire-think-standard"
cp -R wire-think-standard "$dsh_home/.agent-presets/wire-think-standard"

Combo Anchored (experimental) — the combination package

The everything-is-a-plugin showcase: THREE orthogonal anchoring mechanisms
composed as independent rows, each with its own knobs, each removable or
retunable by editing one line of agent.cordis.yml. They attack the
pre-tool deliberation collapse at different moments of a turn:

Row
Mechanism
Owns

think-phase
zero-tool think step + steering notice
the turn OPENING

deliberation-gate
depth gate denies the first tool call of a shallow turn
the FIRST ACTION

cot-drip
one "We …" beat after every Nth tool result (tools/post-execute additionalContexts — never blocking, never erroring)
the LONG MIDDLE

With mode: every-turn the think step opens every turn, the gate catches
the paths that skip it (steering continuations, resumed sessions,
straight-to-tools follow-ups), and the drip sustains deliberation across
long tool loops. Defaults are deliberately gentle (minChars: 400,
every: 4, one beat per turn); tune per workload. Swapping the
think-phase row for wire-think + toolchoice-adapter upgrades the
opening to the wire-level condition (see above) at the cost of the sibling
route and its prefix-cache churn.

Explored and rejected for this package: pure Code Mode presentation
(presentAs('code') collapses the catalog into one run_code tool) — a
single-tool surface measurably underperforms the two-tool condition in the
sibling project's evaluations; and text-only fake tools or ghost tool-call
histories — both proved unreliable anchors in practice.

Official ecosystem guidance

DeepSeek currently asks community plugin authors to publish plugins in their own
GitHub projects and add the dsh-plugin
repository topic for discovery. The official repository does not currently
accept external pull requests and does not mandate a community repository
template. See the official
CONTRIBUTING.md.

License

MIT. preset/agent.cordis.yml is derived from the DeepSeek Harness Standard
preset; the original DeepSeek copyright and MIT notice are retained in
NOTICE.