pojia-next: replacing the built-in prompts of fifteen AI clients
一个脚本搞定 DSH / WorkBuddy / ZCode / Codex / Cursor / Claude 六客户端的提示词与人格替换：零依赖、双击即用、可自证、改前备份、一键还原。另附【免装 Python 的单文件 exe】；DSH 自动区分官方桌面版 / 社区桌面版。附 bandit/semgrep 扫描与 SHA256 校验。
At a glance
- What is it?
- pojia-next is a Windows tool that swaps the built-in prompts of fifteen AI command line clients for a persona file you write, with backups, a restore path, a dry run that writes nothing and a fixed self-check phrase for confirming the change took. It ships as a single executable and makes no network requests from its core.
- Who is it for?
- pojia-next suits a Windows user who wants a single set of instructions applied across several AI command line clients and who wants to see what will change before anything is written, since the dry run, the per file backups and the fixed self-check phrase address exactly the objections that make this kind of tool risky.
- Can I use it commercially?
- Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository last received commits 2 days ago.
- What is it written in?
- Mainly Python, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on October 23, 2026, and from our analysis. They are not legal advice.
Editorial analysis
Fifteen clients, one persona file, and a marker block
The project replaces the built-in prompts of AI command line clients with a persona file you write yourself, and the scope is stated in the first line of the documentation: fifteen clients, one tool, the same treatment for each.
The list is DSH, WorkBuddy, ZCode, Codex, Cursor, Claude Code, Gemini CLI, Qwen Code, iFlow, Trae, CodeBuddy, OpenCode, Windsurf, Cline and Copilot CLI. The tool does not guess at anything outside that list, and the documentation says so directly: if your client is not one of them, it is not supported.
How it reaches each one differs, and the difference is worth knowing before you run it. Most of the newer targets use a marked block. The tool appends only the section between a begin marker and an end marker, and your existing content is preserved. Uninstalling removes exactly that marked section, and running it twice does not stack the text.
The clients using that approach are Cursor, Claude Code, Gemini CLI, Qwen Code, iFlow, Trae, CodeBuddy, OpenCode and Windsurf. Cursor gets a rules file with an injected mdc file, and an existing project rules file is only synced if it is already there. Claude Code gets a marked block in its CLAUDE.md, and only at user level, so the project level file in each working directory is left alone. OpenCode gets a marked block in the AGENTS.md under its configuration directory, Windsurf gets one in the global rules file under its codeium directory, Cline gets one in its Rules directory, and the rest get their respective markdown files.
Two clients are handled differently because their configuration is structured. ZCode gets a file in its AGENTS.md, a memory file and skills, and its system prompt patch is on by default from version 8.3 with a flag to turn it off. Codex gets a line added to its config.toml pointing the model instructions at a managed prompt file, and marker blocks written into the older AGENTS.md are cleaned up automatically.
DSH gets three layers of file level patches, and WorkBuddy gets six, including a cloud memory block that is injected on every turn.
The executable is the product and the source is the audit trail
The delivery model is unusual and worth stating plainly. The repository publishes the built executable as a release attachment, and the source is not distributed alongside it. The attachment is a zip rather than the raw file, because GitHub only accepts English attachment names, so you unzip once and get a single executable that needs no Python installed on the machine.
The graphical interface is a native window built on the WebView2 runtime that ships with Windows 10 and 11, and on heavily stripped systems it falls back to running in the browser with the same features. The source route is two Python files, one for the interface and one for the core, and the documentation notes that they require Python 3.8 or newer and no third party packages from pip at all.
The reassurance around that is the interesting part. The documentation addresses the case where Windows blocks the unsigned executable, noting that SmartScreen warning is normal for personal open source software, and points at two ways to be sure of what you are running: the source is in the repository, and the attachment hashes can be checked.
The repository carries a bandit configuration file and a semgrep configuration file at the root, a security workflow badge, a SHA256SUMS file and a SHA256SUMS-exe.txt file, a script for filling hashes and another for refreshing the hashes in the documentation. There is also a file named persona.md, which is the file the tool writes, and a launcher.py at the root alongside the build and release scripts.
The badges make the project's own claims checkable. Alongside the stars, release, licence, Python version and Windows platform badges, there are two that state numbers: zero dependencies and zero core network requests.
[](https://github.com/z91772524-ai/pojia-next/stargazers)
[](https://github.com/z91772524-ai/pojia-next/releases)
[](LICENSE)
[](https://www.python.org/downloads/)
[](https://www.microsoft.com/windows)
[](#安全审查你可以自己验)
[](#安全审查你可以自己验)
[](https://github.com/z91772524-ai/pojia-next/actions/workflows/security.yml)The documentation explains what the second claim means, and it is the more interesting of the pair.
Zero core network calls, two exceptions, and a dry run that writes nothing
The network claim is scoped, and the scope is what makes it meaningful.
The core makes zero network requests, and the documentation says continuous integration asserts that on every commit. The interface touches the network in exactly two places: a local loopback address on 127.0.0.1 to serve its own window, which does not leave the machine, and the moment you actively press the download button on the environment tab, which reaches official download sources whose URLs are literal strings in the code.
The second exception is a good design choice rather than a leak. The environment tab detects what is installed on the machine, Python, Java, Node, Git, WebView2, ADB and so on, and offers to install whatever is missing from official sources. That is the one operation that genuinely has to reach out, and the user has to ask for it explicitly.
The dry run button is the other thing to try first. It reports which files would be modified and writes not a single byte, and the status lights shown when you open the window are described as read-only detection results, so looking at the tool without touching anything is explicitly allowed.
The remaining safety claims are about what the tool refuses to do. It performs file level patches only. It does not remove packages, does not touch the registry or services, does not install drivers, and even clearing caches is described as counting by default rather than deleting. Every change is backed up first, and the restore button returns things to the official original using a list of file paths so that files belonging to other software are not removed by mistake.
There is also a network verification step at first launch for the executable. A card explains the project is free and names the official group number, and entering the group number completes an online check. From version 8.6 the executable no longer bundles the core, so after the check succeeds the core is fetched automatically and later upgrades are automatic without replacing the executable. Users running from source skip that step entirely.
Why the self-check is a fixed phrase and not a question
There is a verification procedure that is unusually well reasoned, and the reasoning is the interesting part.
After running the tool and restarting a client, you open a new session and send a fixed four character command on its own. The expected answer is a single fixed line. The documentation is explicit that anything else, an extra word, an added explanation, or a refusal, means it was not really loaded.
The reason for using a fixed phrase rather than a question is spelled out. Asking the model what mode it is running in is a form of self suggestion, and the model will very likely answer along the lines of what you suggested, which makes the result untrustworthy. A fixed command with a fixed reply is the real criterion, and the command is written into the client's management directory, so it is something the tool can rely on being there.
The most common reason for a failure is stated next, and it is not the tool. Nine times out of ten the client was not restarted, so the documentation repeats the point several times across the pages: the client has to exit completely, including the icon in the system tray, and be opened again.
The documentation also handles the case where the reply is wrong in a specific way. If the answer is not the expected line, what you installed may not be the original project, and the instruction is to download it again from the official repository. That is a reasonable thing to say about a project whose whole purpose is changing files that a prompt injection would also target.
The resold copy is the thing the project warns about most
The loudest warning in the documentation is not about the mechanics at all. It is about a third party release.
The project states that it is completely free, and that a third party release sold under a different name, with two version numbers, is a reskinned second release of this project with the MIT copyright notice required to be retained deleted and replaced with a generic line. The instruction to anyone who paid for it is to ask for a refund immediately, and the documentation links to a separate notice file with the full evidence and a self verification method.
That is an unusual thing to find at the top of a project's documentation, and it tells you something about the project's circumstances. A tool that patches other people's clients at the file level, distributed as an unsigned executable, is exactly the shape of thing that gets wrapped and resold, and the author has been through that once.
The repository reflects the same attention to the problem. There is a dedicated notice file about the plagiarism, a separate file with the usage instructions, a beginner tutorial, a changelog, a repair report and an evidence directory, plus a directory whose name marks the regression tests and another named after a coding tool.
The release history is short. There is one tag, version 8.20, published on 2026-10-18, and its title says the prompts were changed to be the user's own and that a startup layer hang was fixed. The last push to the repository was on 2026-10-18 as well, and the licence is MIT.
The question this project leaves open is where it stands relative to the clients it modifies. The tool replaces prompts the user cannot otherwise change, and the clients can change their own layout at any time, which the documentation acknowledges by saying an upgrade may overwrite the patched directory and that pressing the apply button again fixes only what was lost.
Editorial conclusion
pojia-next suits a Windows user who wants a single set of instructions applied across several AI command line clients and who wants to see what will change before anything is written, since the dry run, the per file backups and the fixed self-check phrase address exactly the objections that make this kind of tool risky. It does not suit you if your client is not among the fifteen, and it does not suit you if you want the patches to survive a client upgrade, since the documentation says an upgrade can remove them and you reapply. Before you run it, check the attachment hash, run the dry run first, and take the executable only from the official release page, because a reskinned copy of this project has already been sold commercially.
Frequently asked questions
How do I install and run the pojia-next tool?
Download the zip from the Releases page, unzip it to get the single executable, and run it. The executable needs no Python on the machine, since it uses the WebView2 runtime built into Windows 10 and 11, and it falls back to a browser on stripped systems. Running from source needs Python 3.8 or newer and no third party packages.
How do I check that the tool actually worked?
Open a new session in the client and send the fixed self-check command on its own. The expected reply is one fixed line. Anything else, an extra word, an added explanation or a refusal, means it was not really loaded. The reason for using a fixed phrase rather than asking the model what mode it is in is that a question invites the model to agree with the suggestion.
Will the tool break my computer or delete my files?
It performs file level patches only. It does not remove packages, does not touch the registry or services, does not install drivers, and clearing caches counts by default rather than deleting. Every change is backed up first and the restore button returns files to the official original using a path list so other software's files are not removed.
Does the tool send my data anywhere?
The core makes zero network requests and continuous integration asserts that on every commit. The interface uses a loopback address on 127.0.0.1 to serve its own window, and reaches the network only when you press download on the environment tab to fetch an official installer, with the URLs being literal strings in the code.
What happens to my patches when the client is upgraded?
An upgrade overwrites the program directory and may remove the patches. The documentation says to press the apply button again, because the tool identifies which patches were lost and reapplies only those.
Official sources
Add this badge to your README
If you maintain this project, the badge below links readers to this analysis and shows its maintenance status from the daily GitHub snapshot. Paste the markdown into your README; add ?metric=license or ?metric=stars to the image URL for a different field.
[](https://hysenlabs.com/projects/z91772524-ai-pojia-next)Was this useful?