[PsychMing]

改了什么 / What changed

New rule (a8) a8-cc-subagent-emoji in src/handlers/identity-neutralize.js. It rewrites one sentence that every Claude Code subagent system prompt carries:

For clear communication with the user the assistant MUST avoid using emojis.

to the same sentence with should.

Before: every Claude Code subagent (Agent tool: general-purpose, Explore, ...) fails with permission_denied / 400 Your request was blocked by our content policy, while the main session on the same proxy works. After: subagents work.

为什么 / Why

Main session and subagents share the same CLAUDE.md, memory and tool list, so those were ruled out early. The difference is the subagent's built-in system prompt block. Bisected with DEVIN_CONNECT_WIRE_DUMP=1, decoding the captured request and replaying variants through /v1/messages. Each variant ran 2x and gave the same result both times:

Variant	Result
Full captured subagent request	blocked
Same request, subagent block removed (CLAUDE.md, memory, tools kept)	passes
Subagent block only (2643 chars, no tools)	blocked
Only the Notes lines	blocked
Each Notes line alone	only the emoji line blocks
For clear communication with the user the assistant MUST avoid using emojis.	blocked
The assistant MUST avoid using emojis.	passes
Avoid using emojis.	passes
For clear communication with the user, avoid using emojis.	passes
For clear communication with the user the assistant should avoid using emojis.	passes
Full captured subagent request, only MUST -> should	passes 3/3

The trigger is the whole sentence, not one word. Rewriting MUST -> should keeps the instruction intact.

Verified myself: the table above, plus a real subagent dispatch through the patched proxy completing normally (Claude Code 2.1.310, model claude-opus-5-5, DEVIN_CONNECT, single account). Not verified: other Claude Code versions, other models, and how stable this is over time given that Devin's content policy has been observed to be non-deterministic. Every row above reproduced on repetition within one session.

Placement: unconditional on the main WINDSURFAPI_NEUTRALIZE_CLIENT_ID switch, like a1-a7. I did not put it in the (cc) block because ccActive is off by default, so a gated rule would leave default deployments' subagents failing. The regex is anchored on the full sentence (optional comma after user), so it should not hit unrelated content. The (cc) block comments now list a8 next to a1-a4.

测试 / Testing

Node v26.12.0 (not the 24.x release-gate toolchain).

node --import ./test/setup-env.mjs --test test/client-identity-neutralize.test.js
ℹ tests 42  ℹ pass 42  ℹ fail 0

Revert check: with the a8 rule removed, (a8) rewrites the Claude Code subagent emoji bullet... goes red (pass 41 / fail 1). The idempotence, near-miss and off-switch tests are expected to stay green without the rule, since they assert the absence of over-matching.

npm run test:release
Suite: 6610 pass / 10 fail / 5 skip (544/544 files measured)

Not green, and I am not reporting it as green. Every failing file was checked on a clean worktree at origin/master b00b3b9 (same machine, same Node):

File	PR branch (gate)	clean master b00b3b9
account-add-proxy-ordering	fail 1	fail 1
review-secret-scan	fail 2	fail 2
s1-p1-cache-key-error-path	fail 1	fail 1
spec-baseline-check	fail 5	fail 5
cascade-turn-flag	fail 1	pass; also pass 3/3 in isolation on this branch
update-script-release-target	90s timeout	pass 47; also pass 47 in isolation on this branch

So 9 failures reproduce on master, and the other two were flaky under full-suite load (they pass 3/3 in isolation on this branch). Neither touches the neutralizer. These are probably environment-related (Node 26 rather than 24); I have not dug into them.

Mutations: npm run mutate could not set up its workspace from my shallow fetch (Failed to traverse parents of commit ...), so the mutation sweep was not run. As a substitute I checked that all 25 anchors in mutation specs targeting identity-neutralize.js still match exactly once on this branch. That is not equivalent to running the sweep.

Checklist

• 代码风格和现有文件一致 / Code style matches existing files
• 没有引入 npm 运行时依赖 / No new npm runtime dependencies
• 测试跑过了,贴了结果 / Tests run, output pasted above (gate not green, see table)
• 新行为有测试,且断言行为而不是 grep 源码文本 / Behaviour tests, revert-checked
• 新开关默认关 / No new switch (rides the existing main switch, like a1-a7)
• 加了开关就同步了文档 / N/A, no new switch
• 涉及 wire 协议改动时注明来源 / N/A, no wire change
• Dashboard UI / N/A
• commit message 没有任何 AI 署名尾注 / No attribution trailers

[dwgx]

已合并（e399c15）。谢谢——证据链是我们收过最完整的之一：wire dump + /v1/messages 逐变体回放（整块拦 / 去块过 / 单句拦 / should 过 3/3 / 真实子代理跑通），并且明确说明触发是整句而非单词。修法也选得对：只改一个词、锚定整句、放在主开关下无条件生效（ccActive 默认关，放 (cc) 块会让默认部署继续坏）。

我们独立复核了你没跑到的部分，结论一致：

• Node 24 上 test/client-identity-neutralize.test.js master 38/38、你的分支 42/42。
• 15 个正则用例：近似句（无前导、"should" 版、双逗号、小写前导）全部原样；幂等；WINDSURFAPI_NEUTRALIZE_CLIENT_ID=0 原样；规则顺序只改 Notes 第 3 行。
• 25/25 个针对 identity-neutralize.js 的 mutation anchor 仍各命中一次；删掉 a8 后恰好 1 个测试变红（其余三个 a8 测试如你所说保持绿）。

两个我们合完后补的瑕疵，不是否决理由，但值得记一下：

1. mutation 基线没带上。新增 4 个测试让两个 spec 的基线漂移：identity-neutralize-paragraph-bound 63→67、neutralize-rewrite-visibility 72→76。增量门禁只查 spec 形状与 anchor、不测实际通过数，所以漏过了；我们跑实测后补钉（b17bf95）。你那边 npm run mutate 因浅克隆跑不了可以理解——只需把这两个数字按实测改掉即可，不用跑全扫。
2. 注释说得太满。"the regex is anchored on the full sentence ... so it should not hit unrelated content"：规则是全局正则，同一句出现在 fenced code block 或长段落里也会被改写（已实测）。没有实测危害（那句话在正常 prompt 里只会来自这个 Notes bullet），但注释应写成"只匹配这一整句"而不是"不会碰到无关内容"。我们把它记为 residual risk；如果以后要更保守，可以把改写范围限定在 Notes bullet 行内。

一个流程建议：PR 模板里"mutation 未运行"这一栏，附上受影响的 expectBaselinePass 实测值就够了——那是唯一会挡发布的东西。

再次谢谢，这个修复对每个用 Claude Code 子代理的人都是实打实的。