feat(agents): add centralized GPT apply_patch permission guard

Extract hardcoded GPT apply_patch permission logic into a reusable module
to ensure consistent behavior across all agents. This prevents GPT models
from using the unreliable apply_patch tool while allowing other models.

- Add gpt-apply-patch-guard.ts with GPT_APPLY_PATCH_GUIDANCE and getGptApplyPatchPermission
- Update Hephaestus agent to use centralized permission logic
- Update Sisyphus-Junior agent to use centralized permission logic
- Update all GPT prompt builders to reference shared guidance constant

🤖 Generated with assistance of OhMyOpenCode

src/agents/sisyphus-junior/agent.ts

@@ -18,6 +18,7 @@ import {
   createAgentToolRestrictions,
   type PermissionValue,
 } from "../../shared/permission-compat"
+import { getGptApplyPatchPermission } from "../gpt-apply-patch-guard"
 
 import { buildDefaultSisyphusJuniorPrompt } from "./default"
 import { buildGptSisyphusJuniorPrompt } from "./gpt"
@@ -103,7 +104,11 @@ export function createSisyphusJuniorAgentWithOverrides(
     merged[tool] = "deny"
   }
   merged.call_omo_agent = "allow"
-  const toolsConfig = { permission: { ...merged, ...basePermission } }
+  const toolsConfig = { permission: { ...merged, ...basePermission } as Record<string, PermissionValue> }
+  const permission: Record<string, PermissionValue> = {
+    ...toolsConfig.permission,
+    ...getGptApplyPatchPermission(model),
+  }
 
   const base: AgentConfig = {
     description: override?.description ??
@@ -114,7 +119,7 @@ export function createSisyphusJuniorAgentWithOverrides(
     maxTokens: 64000,
     prompt,
     color: override?.color ?? "#20B2AA",
-    ...toolsConfig,
+    permission,
   }
 
   if (override?.top_p !== undefined) {

src/agents/sisyphus-junior/gpt-5-3-codex.ts

@@ -8,6 +8,7 @@
 
 import { resolvePromptAppend } from "../builtin-agents/resolve-file-uri"
 import { buildAntiDuplicationSection } from "../dynamic-agent-prompt-builder"
+import { GPT_APPLY_PATCH_GUIDANCE } from "../gpt-apply-patch-guard"
 
 export function buildGpt53CodexSisyphusJuniorPrompt(
   useTaskSystem: boolean,
@@ -92,7 +93,7 @@ Style:
 1. SEARCH existing codebase for similar patterns/styles
 2. Match naming, indentation, import styles, error handling conventions
 3. Default to ASCII. Add comments only for non-obvious blocks
-4. Use the \`edit\` and \`write\` tools for file changes. Do not use \`apply_patch\` on GPT models - it is unreliable here and can hang during verification.
+4. ${GPT_APPLY_PATCH_GUIDANCE}
 
 ### After Implementation (MANDATORY - DO NOT SKIP)
 

src/agents/sisyphus-junior/gpt-5-4.ts

@@ -11,6 +11,7 @@
 
 import { resolvePromptAppend } from "../builtin-agents/resolve-file-uri";
 import { buildAntiDuplicationSection } from "../dynamic-agent-prompt-builder";
+import { GPT_APPLY_PATCH_GUIDANCE } from "../gpt-apply-patch-guard";
 
 export function buildGpt54SisyphusJuniorPrompt(
   useTaskSystem: boolean,
@@ -96,7 +97,7 @@ Style:
 1. SEARCH existing codebase for similar patterns/styles
 2. Match naming, indentation, import styles, error handling conventions
 3. Default to ASCII. Add comments only for non-obvious blocks
-4. Use the \`edit\` and \`write\` tools for file changes. Do not use \`apply_patch\` on GPT models - it is unreliable here and can hang during verification.
+4. ${GPT_APPLY_PATCH_GUIDANCE}
 5. Do not chain bash commands with separators - each command should be a separate tool call
 
 ### After Implementation (MANDATORY - DO NOT SKIP)

src/agents/sisyphus-junior/gpt.ts

@@ -9,6 +9,7 @@
 
 import { resolvePromptAppend } from "../builtin-agents/resolve-file-uri"
 import { buildAntiDuplicationSection } from "../dynamic-agent-prompt-builder"
+import { GPT_APPLY_PATCH_GUIDANCE } from "../gpt-apply-patch-guard"
 
 export function buildGptSisyphusJuniorPrompt(
   useTaskSystem: boolean,
@@ -93,7 +94,7 @@ Style:
 1. SEARCH existing codebase for similar patterns/styles
 2. Match naming, indentation, import styles, error handling conventions
 3. Default to ASCII. Add comments only for non-obvious blocks
-4. Use the \`edit\` and \`write\` tools for file changes. Do not use \`apply_patch\` on GPT models - it is unreliable here and can hang during verification.
+4. ${GPT_APPLY_PATCH_GUIDANCE}
 
 ### After Implementation (MANDATORY - DO NOT SKIP)