v4.8.0
v4.8.0: comprehension first, now with an MCP server
Added 5
- Add ponytail-mcp, an MCP server that serves the ruleset to any MCP-capable agent
- Add /ponytail-gain measured-impact scoreboard showing less code, less cost, and more speed from benchmark medians
- Add Antigravity support via .agents/rules/ponytail.md
- Add CodeWhale support with native AGENTS.md reader and zero setup
- Add argument-hint on the ponytail skill
Fixed 12
- Implement comprehension-first guard and reuse rung to climb the ladder only after understanding the problem and reusing what already lives in the repo
- Do not embed shell-unsafe install paths in the statusline setup nudge
- Make Python command in robustness-audit.js portable for Windows
- Do not write output on SessionStart for Copilot
- Register skills dir via config hook so OpenCode discovers ponytail skills
- Avoid Gemini loading Claude hook events
- Make statusline read the flag from CLAUDE_CONFIG_DIR, not just ~/.claude
- Guard final writeHookOutput against stdout EPIPE in ponytail-activate
- Strip UTF-8 BOM before parsing settings.json in ponytail-activate
- Resolve test failure on Node.js < 20.11.0
- Only deactivate on a standalone 'stop ponytail' or 'normal mode' command
- Pin all four safety carve-outs in the rule-drift canary
Security 1
- Bump @modelcontextprotocol/sdk to ^1.26.0 to address CVE-2026-25536
From ponytail
He read the whole thing first, then wrote less.
This release sharpens the core ruleset (comprehension before laziness, reuse before rewriting), ships an MCP server for the rules, adds a measured-impact scoreboard, and lands a security bump. Two more agents join the family.
✨ Features
ponytail-mcp: an MCP server that serves the ruleset to any MCP-capable agent (#91)/ponytail-gain: measured-impact scoreboard — less code, less cost, more speed from the benchmark medians (#108)- Antigravity support via
.agents/rules/ponytail.md(#119) - CodeWhale support — native AGENTS.md reader, zero setup (#124)
argument-hinton the ponytail skill (#85)
🔒 Security
- Bump
@modelcontextprotocol/sdkto^1.26.0(CVE-2026-25536) (#208)
🛠 Fixes
- Comprehension-first guard + reuse rung — climb the ladder only after understanding the problem; reuse what already lives in the repo before rewriting it (#245, #217)
- Don't embed shell-unsafe install paths in the statusline setup nudge (#224)
- Portable Python command in
robustness-audit.js(Windows) (#209) - Don't write output on SessionStart for Copilot (#168)
- Register skills dir via config hook so OpenCode discovers ponytail skills (#138)
- Avoid Gemini loading Claude hook events (#139)
- Statusline reads the flag from
CLAUDE_CONFIG_DIR, not just~/.claude(#154) - Guard final
writeHookOutputagainst stdout EPIPE inponytail-activate(#149) - Strip UTF-8 BOM before parsing settings.json in
ponytail-activate(#148) - Resolve test failure on Node.js < 20.11.0 (#157)
- Only deactivate on a standalone "stop ponytail" / "normal mode" (#162)
- Pin all four safety carve-outs in the rule-drift canary (#114)
📊 Benchmarks
- Agentic LOC + safety benchmark against a fair agentic baseline (#126, #158)
- Completeness judge so LOC wins can't hide under-delivery (#171)
- critic-email task reproducing the critique's own example (#173)
📚 Docs & examples
- Spanish (LATAM) README translation (#110)
- 6 new over-engineering survivors + platform-native guide (#109)
- Agentic benchmark chart and corrected cost claim (42–75%, 30-rep) in the README (#160, #129)
Full changelog: https://github.com/DietrichGebert/ponytail/compare/v4.7.0...v4.8.0