DietrichGebert/ponytail

Install

Then open /hooks in Codex, trust its two lifecycle hooks, and start a new thread.

Any other agent: copy AGENTS.md into your project, or ask your agent to install skills/ponytail/SKILL.md as a skill. Step by step for Copilot, Cursor, OpenCode, Gemini and the rest: INSTALL.md.

Active every session, with a handful of commands (see Commands). /ponytail ultra exists for when the codebase has wronged you personally. Startup and mode-change text shows the current mode.

Only install ponytail from DietrichGebert/ponytail on GitHub or @dietrichgebert/ponytail on npm. It never ships .exe or .dll files; a copy that does is not mine.

/plugin marketplace add DietrichGebert/ponytail

How it works

The ladder runs after it understands the problem, not instead of it: it reads the code the change touches and traces the real flow before picking a rung. Lazy about the solution, never about reading.

Lazy, not negligent: trust-boundary validation, data-loss handling, security, and accessibility are never on the chopping block.

Logic with a branch, a loop, a parser, money or security leaves one small test behind. Every reply ends with what was skipped or not checked and any risk you should know.

FAQ

Does it need a config file? No. An optional ~/.config/ponytail/config.json or PONYTAILDEFAULTMODE env var can set the default level, but nothing is required.

Why does it write shortcut: comments? They mark a deliberate shortcut and when to revisit it, and /ponytail-debt collects them into a ledger. Want another word, or none? Say so in your project's CLAUDE.md or AGENTS.md, then run /ponytail-debt .

What if I really need the 120-line cache class? You don't. Insist anyway and he'll build it. Slowly. Correctly. While looking at you.

Does it scale? The code you never wrote scales infinitely. Zero bugs, zero CVEs, 100% uptime since forever.

概述

Ponytail 5: rebuilt from the ground up. -53% code · -41% time · -26% cost · -45% tokens And yet: 98% of risky logic ships with a test. Without Ponytail: 68%. Benchmarked in Claude Code, the same agent with and without the skill: 39 tasks including a real FastAPI + React repo, Opus 5.5, 5 runs each. Details.

Already built with Ponytail

You know him. Long ponytail. Oval glasses. Has been at the company longer than the version control. You show him fifty lines; he looks at them, says nothing, and replaces them with one.

Numbers

Two things the chart does not show: in a blind comparison, Ponytail 5's replies beat the previous Ponytail's 110 to 67. And on the six security tasks (SQL injection, path traversal, forged tokens, rate limiting, malformed CSV rows, caching) it passed all 30 runs: less code, no less safe. Method, per-task tables and limits: benchmarks/results/2026-10-07-agentic.md.

The rule was never "fewest tokens." It is: write only what the task needs, and never cut validation, error handling, security, or accessibility. The code ends up small because it is necessary, not golfed. Lower cost and latency are a side effect.