DietrichGebert/ponytail

No problems traced to this repository code in these checks.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• PONYTAIL_DEFAULT_MODE sets the default level: Real input produced the expected result: level: ultra

  Source: An optional `~/.config/ponytail/config.json` or `PONYTAIL_DEFAULT_MODE` env var can set the default level, but nothing is required.

  Input: PONYTAIL_DEFAULT_MODE=ultra

  Expected: activation text reports level ultra

  Command: env PONYTAIL_DEFAULT_MODE=ultra CLAUDE_CONFIG_DIR=/tmp/ponytail-claude-cfg node hooks/ponytail-activate.js

  Observed: level: ultra # Ponytail You are a lazy senior developer. The best code is the code never written. You solve the whole problem with the least new code. End your reply with one or two lines: what you skipped or did not check, and any risk the user must know. Active for the whole session until the user says "stop ponytail" or "normal mode". Switch level: `/ponytail lite|full|ultra`. ## Before you write Read the task and the code it touches. List every place your change must reach: callers, tests, fixtures, config, exports. Check what your change could break for users: data it would destroy o

• Startup text shows the current mode: Real input produced the expected result: level: full

  Source: Startup and mode-change text shows the current mode.

  Input: no PONYTAIL_DEFAULT_MODE set

  Expected: activation text reports level full (the default)

  Command: env -u PONYTAIL_DEFAULT_MODE CLAUDE_CONFIG_DIR=/tmp/ponytail-claude-cfg node hooks/ponytail-activate.js

  Observed: level: full # Ponytail You are a lazy senior developer. The best code is the code never written. You solve the whole problem with the least new code. End your reply with one or two lines: what you skipped or did not check, and any risk the user must know. Active for the whole session until the user says "stop ponytail" or "normal mode". Switch level: `/ponytail lite|full|ultra`. ## Before you write Read the task and the code it touches. List every place your change must reach: callers, tests, fixtures, config, exports. Check what your change could break for users: data it would destroy or

Examples

• CI rule-copy check passes: command completed successfully

  Source: .github/workflows/test.yml

  Input: repo at pinned commit

  Expected: Rule copies match AGENTS.md; 10 rule invariants present

  Command: node scripts/check-rule-copies.js

  Observed: Rule copies match AGENTS.md; 10 rule invariants present in SKILL.md and AGENTS.md.

• Examples are illustrative outputs, not runnable programs: examples/ holds markdown before/after code samples with no runnable entrypoint; the runnable offline checks are the node test suite (CI runs node --test; 144/144 passed with pandas installed in /tmp/venv-ponytail) and the rule-copy check above

  Source: examples/README.md

  Expected: documented command completes successfully

  Observed: examples/ holds markdown before/after code samples with no runnable entrypoint; the runnable offline checks are the node test suite (CI runs node --test; 144/144 passed with pandas installed in /tmp/venv-ponytail) and the rule-copy check above

Local or hosted: local

Run the Ponytail SessionStart activation hook (hooks/ponytail-activate.js) and read back the activated level from its output, including the PONYTAIL_DEFAULT_MODE override.

cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat README.md 2>/dev/null | head -200
ls -la <guest-path> /inputs 2>/dev/null; ls <guest-path> 2>/dev/null
cd <guest-path> && cat package.json && echo ---- && cat plugin.yaml plugin.json && echo ---- && ls scripts tests examples hooks docs && echo ---- && head -80 INSTALL.md && echo ---- && cat after-install.md && node -v; npm -v; which uv; sudo -n true && echo SUDO_OK
cd <guest-path> && cat /etc/os-release | head -3; grep -rn -i "node" README.md INSTALL.md | grep -i -E "version|>=|[0-9]+\.[0-9]+|install" | head -20; grep -rn "engines" package.json pi-extension/package.json 2>/dev/null; echo ----; head -30 hooks/ponytail-activate.js; echo ----; cat .github/workflows/*.yml 2>/dev/null | head -60; echo ----; cat AGENTS.md | head -30
(sudo apt-get update -y >/tmp/apt-update.log 2>&1; echo apt-update rc=$?; sudo apt-get install -y ca-certificates curl gnupg >/tmp/apt-base.log 2>&1; echo base rc=$?; sudo mkdir -p /etc/apt/keyrings && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg; echo key rc=$?; echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" | sudo tee /etc/apt/sources.list.d/nodesource.list >/dev/null; sudo apt-get update -y >/tmp/apt-ns.log 2>&1; echo ns-update rc=$?; sudo apt-get install -y nodejs >/tmp/apt-node.log 2>&1; echo node-install rc=$?; tail -5 /tmp/apt-node.log) 2>&1; node -v; npm -v
cd <guest-path> && ls -la .coldpass && cat .coldpass/* 2>/dev/null | head -50; echo ----; tar -tzf <guest-path> | head -5; ls <guest-path> 2>&1 | head -2
cd <guest-path> && git init -q && git remote add origin https://github.com/DietrichGebert/ponytail && git fetch --depth 1 origin 09c434ab73ca43761c5d8b0c5d341926c2fba710 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1; git status --short | head -5; echo ----; sed -n 30,200p hooks/ponytail-activate.js | head -120
cd <guest-path> && node scripts/check-rule-copies.js; echo "rule-copies rc=$?"; node --test tests/*.test.js > /tmp/node-test.log 2>&1; echo "node-test rc=$?"; grep -E "^# (tests|pass|fail)" /tmp/node-test.log; echo ----; cat hooks/claude-codex-hooks.json | head -40; echo ----; ls pi-extension; cat pi-extension/package.json | head -30
cd <guest-path> && grep -n -B3 -A25 "^not ok" /tmp/node-test.log | head -80
cd <guest-path> && python3 -m venv /tmp/venv-ponytail 2>&1 | tail -2; /tmp/venv-ponytail/bin/pip install -q pandas 2>&1 | tail -3; echo "pip rc=$?"; PATH=/tmp/venv-ponytail/bin:$PATH node --test tests/*.test.js > /tmp/node-test2.log 2>&1; echo "node-test rc=$?"; grep -E "^# (tests|pass|fail)" /tmp/node-test2.log
cd <guest-path> && rm -rf /tmp/venv-ponytail && sudo apt-get install -y python3.12-venv >/tmp/apt-venv.log 2>&1; echo "apt rc=$?"; python3 -m venv /tmp/venv-ponytail && /tmp/venv-ponytail/bin/pip install -q pandas; echo "pip rc=$?"; PATH=/tmp/venv-ponytail/bin:$PATH node --test tests/*.test.js > /tmp/node-test2.log 2>&1; echo "node-test rc=$?"; grep -E "^# (tests|pass|fail)" /tmp/node-test2.log
cd <guest-path> && export CLAUDE_CONFIG_DIR=/tmp/ponytail-claude-cfg; mkdir -p $CLAUDE_CONFIG_DIR; node hooks/ponytail-activate.js </dev/null > /tmp/act.out 2>/tmp/act.err; echo rc=$?; wc -c /tmp/act.out; head -c 1200 /tmp/act.out; echo; echo ---ERR; head -5 /tmp/act.err; echo ---; cat $CLAUDE_CONFIG_DIR/.ponytail-active 2>/dev/null; echo; grep -n "PONYTAIL_DEFAULT_MODE\|getDefaultMode" hooks/ponytail-config.js | head
cd <guest-path> && export CLAUDE_CONFIG_DIR=/tmp/ponytail-claude-cfg; PONYTAIL_DEFAULT_MODE=ultra node hooks/ponytail-activate.js </dev/null | head -1; echo; grep -rn -E "setInterval|cron|--once|--now|setTimeout\(.*loop" hooks scripts pi-extension/index.js 2>/dev/null | head; echo ---; grep -n "An optional \`~/.config/ponytail/config.json\` or \`PONYTAIL_DEFAULT_MODE\` env var can set the default level, but nothing is required." README.md; grep -n "Startup and mode-change text shows the current mode." README.md
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["node","hooks/ponytail-activate.js"],"cwd":"<guest-path>","env":{"CLAUDE_CONFIG_DIR":"/tmp/ponytail-claude-cfg"},"expected_text":"PONYTAIL MODE ACTIVE"}
EOF
cat > .coldpass/claims.json <<'EOF'
[
{"kind":"claim","claim":"PONYTAIL_DEFAULT_MODE sets the default level","source":"An optional `~/.config/ponytail/config.json` or `PONYTAIL_DEFAULT_MODE` env var can set the default level, but nothing is required.","input":"PONYTAIL_DEFAULT_MODE=ultra","expected":"activation text reports level ultra","probe_kind":"cli","argv":["node","hooks/ponytail-activate.js"],"env":{"CLAUDE_CONFIG_DIR":"/tmp/ponytail-claude-cfg","PONYTAIL_DEFAULT_MODE":"ultra"},"expected_text":"level: ultra","cwd":"<guest-path>"},
{"kind":"claim","claim":"Startup text shows the current mode","source":"Startup and mode-change text shows the current mode.","input":"no PONYTAIL_DEFAULT_MODE set","expected":"activation text reports level full (the default)","probe_kind":"cli","argv":["node","hooks/ponytail-activate.js"],"env":{"CLAUDE_CONFIG_DIR":"/tmp/ponytail-claude-cfg"},"expected_text":"level: full","cwd":"<guest-path>"}
]
EOF
cat > .coldpass/examples.json <<'EOF'
[
{"kind":"example","claim":"CI rule-copy check passes","source":".github/workflows/test.yml","input":"repo at pinned commit","expected":"Rule copies match AGENTS.md; 10 rule invariants present","argv":["node","scripts/check-rule-copies.js"],"cwd":"<guest-path>","env":{},"expected_text":"Rule copies match AGENTS.md"},
{"kind":"example","claim":"Examples are illustrative outputs, not runnable programs","source":"examples/README.md","reason":"examples/ holds markdown before/after code samples with no runnable entrypoint; the runnable offline checks are the node test suite (CI runs node --test; 144/144 passed with pandas installed in /tmp/venv-ponytail) and the rule-copy check above"}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: hooks/*.js run only when the host fires lifecycle events (SessionStart, SubagentStart, UserPromptSubmit per hooks/claude-codex-hooks.json); scripts/ and pi-extension contain no setInterval, cron, --once, or --now. No product scheduler or loop exists, so no cycle was triggered.","checks":[]}
EOF
for f in probe claims examples cycles; do python3 -m json.tool .coldpass/$f.json >/dev/null && echo "$f ok"; done; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay; echo "checker rc=$?"
grep -n "env" <guest-path> | head -40
sed -n 600,625p <guest-path>; echo ....; sed -n 800,812p <guest-path>; echo ....; sed -n 1110,1120p <guest-path>
cd <guest-path> && cat > .coldpass/claims.json <<'EOF'
[
{"kind":"claim","claim":"PONYTAIL_DEFAULT_MODE sets the default level","source":"An optional `~/.config/ponytail/config.json` or `PONYTAIL_DEFAULT_MODE` env var can set the default level, but nothing is required.","input":"PONYTAIL_DEFAULT_MODE=ultra","expected":"activation text reports level ultra","probe_kind":"cli","argv":["env","PONYTAIL_DEFAULT_MODE=ultra","CLAUDE_CONFIG_DIR=/tmp/ponytail-claude-cfg","node","hooks/ponytail-activate.js"],"expected_text":"level: ultra","cwd":"<guest-path>"},
{"kind":"claim","claim":"Startup text shows the current mode","source":"Startup and mode-change text shows the current mode.","input":"no PONYTAIL_DEFAULT_MODE set","expected":"activation text reports level full (the default)","probe_kind":"cli","argv":["env","-u","PONYTAIL_DEFAULT_MODE","CLAUDE_CONFIG_DIR=/tmp/ponytail-claude-cfg","node","hooks/ponytail-activate.js"],"expected_text":"level: full","cwd":"<guest-path>"}
]
EOF
python3 -m json.tool .coldpass/claims.json >/dev/null && echo ok; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay | python3 -c 'import json,sys; d=json.load(sys.stdin); print("valid:",d.get("valid")); print("problems:",d.get("problems")); print({k:(v.get("status") if isinstance(v,dict) else v) for k,v in d.get("replay",{}).items()})' ; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run the Ponytail SessionStart activation hook (hooks/ponytail-activate.js) and read back the activated level from its output, including the PONYTAIL_DEFAULT_MODE override.","operation_scope":"Node.js 22 on Ubuntu 24.04 guest. Covers the local hook that the Claude Code/Codex/Cursor plugins run at session start. Does not exercise the slash-command skills (/ponytail-review, /ponytail-audit), which are LLM prompts and cannot be run offline, nor the Claude Code plugin install, which needs the host app.","steps":["git init; git remote add origin https://github.com/DietrichGebert/ponytail; git fetch --depth 1 origin 09c434ab73ca43761c5d8b0c5d341926c2fba710; git reset --mixed FETCH_HEAD","Install Node 22 via NodeSource apt repo (CI uses node-version 22): sudo apt-get install -y nodejs (node v22.23.4, npm 10.9.9)","python3 -m venv /tmp/venv-ponytail (after sudo apt-get install python3.12-venv); /tmp/venv-ponytail/bin/pip install pandas (CI step 'pip install pandas')","node scripts/check-rule-copies.js (CI 'Check rule copies')","PATH=/tmp/venv-ponytail/bin:$PATH node --test tests/*.test.js (144/144 pass)","CLAUDE_CONFIG_DIR=/tmp/ponytail-claude-cfg node hooks/ponytail-activate.js (prints 'PONYTAIL MODE ACTIVE — level: full' and writes the mode flag)","PONYTAIL_DEFAULT_MODE=ultra CLAUDE_CONFIG_DIR=/tmp/ponytail-claude-cfg node hooks/ponytail-activate.js (prints 'level: ultra')"],"deviations":["Guest had no node or npm; installed Node 22 from the NodeSource apt repo (CI version) instead of the distro Node 18.","First run of the offline suite had 1 failure (correctness: csv pandas one-liner) because pandas was missing; fixed by installing pandas into /tmp/venv-ponytail (python3.12-venv installed via apt first, since system pip is externally managed). Rerun: 144/144 pass.","The README has no runnable install command: the documented installs are Claude Code/Codex '/plugin' slash commands and host-app steps, which cannot run in this guest. Substituted the product's own SessionStart hook entrypoint, invoked as 'node hooks/ponytail-activate.js' rather than the 'node -e require(...)' form in hooks/claude-codex-hooks.json (same file, same function).","Claim checks set the variable with the coreutils 'env' wrapper in argv, because the checker's claim replay does not apply a claim's 'env' field (probe and example replay do).","Hook writes its mode flag to CLAUDE_CONFIG_DIR=/tmp/ponytail-claude-cfg, a scratch directory outside the workspace.","No telemetry or consent prompts were encountered. No servers were started, so none needed stopping."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for this operation. Optional: document the Node.js 22 requirement (and that the hooks need node on PATH) next to the install steps in README.md, and note that the offline suite needs pandas for the correctness tests."}
EOF
python3 -m json.tool .coldpass/report.json >/dev/null && echo report-ok; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay | python3 -c 'import json,sys; d=json.load(sys.stdin); print("valid:",d.get("valid"), "problems:",d.get("problems")); print("probe:", d.get("replay",{}).get("status"), d.get("replay",{}).get("details",{}).get("working") if d.get("replay",{}).get("details") else "")'; echo "rc=${PIPESTATUS[0]}"; ls -la .coldpass