v4.8.0
v4.8.0: comprehension first, now with an MCP server
Added
- Add ponytail-mcp, an MCP server that serves the ruleset to any MCP-capable agent
- Add /ponytail-gain measured-impact scoreboard showing less code, less cost, and more speed from benchmark medians
- Add Antigravity support via .agents/rules/ponytail.md
- Add CodeWhale support with native AGENTS.md reader and zero setup
- Add argument-hint on the ponytail skill
Fixed
- Implement comprehension-first guard and reuse rung to climb the ladder only after understanding the problem and reusing what already lives in the repo
- Do not embed shell-unsafe install paths in the statusline setup nudge
- Make Python command in robustness-audit.js portable for Windows
- Do not write output on SessionStart for Copilot
- Register skills dir via config hook so OpenCode discovers ponytail skills
- Avoid Gemini loading Claude hook events
- Make statusline read the flag from CLAUDE_CONFIG_DIR, not just ~/.claude
- Guard final writeHookOutput against stdout EPIPE in ponytail-activate
- Strip UTF-8 BOM before parsing settings.json in ponytail-activate
- Resolve test failure on Node.js < 20.11.0
- Only deactivate on a standalone 'stop ponytail' or 'normal mode' command
- Pin all four safety carve-outs in the rule-drift canary
Security
- Bump @modelcontextprotocol/sdk to ^1.26.0 to address CVE-2026-25536
He read the whole thing first, then wrote less.
This release sharpens the core ruleset (comprehension before laziness, reuse before rewriting), ships an MCP server for the rules, adds a measured-impact scoreboard, and lands a security bump. Two more agents join the family.
✨ Features
ponytail-mcp: an MCP server that serves the ruleset to any MCP-capable agent (#91)/ponytail-gain: measured-impact scoreboard — less code, less cost, more speed from the benchmark medians (#108)- Antigravity support via
.agents/rules/ponytail.md(#119) - CodeWhale support — native AGENTS.md reader, zero setup (#124)
argument-hinton the ponytail skill (#85)
🔒 Security
- Bump
@modelcontextprotocol/sdkto^1.26.0(CVE-2026-25536) (#208)
🛠 Fixes
- Comprehension-first guard + reuse rung — climb the ladder only after understanding the problem; reuse what already lives in the repo before rewriting it (#245, #217)
- Don't embed shell-unsafe install paths in the statusline setup nudge (#224)
- Portable Python command in
robustness-audit.js(Windows) (#209) - Don't write output on SessionStart for Copilot (#168)
- Register skills dir via config hook so OpenCode discovers ponytail skills (#138)
- Avoid Gemini loading Claude hook events (#139)
- Statusline reads the flag from
CLAUDE_CONFIG_DIR, not just~/.claude(#154) - Guard final
writeHookOutputagainst stdout EPIPE inponytail-activate(#149) - Strip UTF-8 BOM before parsing settings.json in
ponytail-activate(#148) - Resolve test failure on Node.js < 20.11.0 (#157)
- Only deactivate on a standalone "stop ponytail" / "normal mode" (#162)
- Pin all four safety carve-outs in the rule-drift canary (#114)
📊 Benchmarks
- Agentic LOC + safety benchmark against a fair agentic baseline (#126, #158)
- Completeness judge so LOC wins can't hide under-delivery (#171)
- critic-email task reproducing the critique's own example (#173)
📚 Docs & examples
- Spanish (LATAM) README translation (#110)
- 6 new over-engineering survivors + platform-native guide (#109)
- Agentic benchmark chart and corrected cost claim (42–75%, 30-rep) in the README (#160, #129)
Full changelog: https://github.com/DietrichGebert/ponytail/compare/v4.7.0...v4.8.0