ci: publish via npm trusted publishing (OIDC), drop NPM_TOKEN

Authenticate the release workflow through GitHub OIDC instead of a long-lived
npm token: no secret to leak or rotate, provenance attached automatically.
Upgrade npm on the runner since OIDC publishing needs npm >= 11.5.1 (Node 22
ships npm 10).

.github/workflows/publish.yml

@@ -0,0 +1,24 @@
+name: publish
+
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      # Trusted publishing (OIDC) needs npm >= 11.5.1; Node 22 ships npm 10.
+      - run: npm install -g npm@latest
+      # No token: id-token: write above lets npm authenticate via OIDC, and
+      # provenance is attached automatically. access set in publishConfig.
+      - run: npm publish

.opencode/plugins/ponytail.mjs

@@ -1,11 +1,13 @@
 // ponytail — OpenCode plugin.
 //
 // Injects the ponytail ruleset into every chat's system prompt at the active
-// intensity, and persists /ponytail mode switches. Reuses the shared instruction
-// builder so Claude Code, Codex, pi, and OpenCode all read one source of truth.
+// intensity, persists /ponytail mode switches, and registers slash commands so
+// they work when the package is installed from npm. Reuses the shared
+// instruction builder so Claude Code, Codex, pi, and OpenCode all read one
+// source of truth.
 //
 // OpenCode loads this as a server plugin — add it to your opencode.json:
-//   { "plugin": ["./.opencode/plugins/ponytail.mjs"] }
+//   { "plugin": ["@dietrichgebert/ponytail"] }
 
 import { createRequire } from 'module';
 import fs from 'fs';
@@ -40,6 +42,15 @@ function writeMode(mode) {
   fs.writeFileSync(statePath, mode);
 }
 
+export function parseCommandFile(filePath) {
+  const content = fs.readFileSync(filePath, 'utf8');
+  // Tolerate CRLF: a Windows checkout (autocrlf) delivers \r\n, npm ships \n.
+  const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/);
+  if (!match) return null;
+  const description = match[1].match(/description:\s*(.+)/)?.[1]?.trim();
+  return { description, template: match[2].trim() };
+}
+
 export default async ({ client } = {}) => {
   const log = (level, message) => {
     try { client && client.app && client.app.log({ body: { service: 'ponytail', level, message } }); } catch (e) {}
@@ -48,8 +59,18 @@ export default async ({ client } = {}) => {
   const ponytailSkillsDir = path.resolve(__dirname, '../../skills');
 
   return {
-    // Register skills directory so opencode discovers ponytail skills.
+    // Register slash commands + skills directory.
     config: async (config) => {
+      if (!config.command) config.command = {};
+      const commandDir = path.join(__dirname, '..', 'command');
+      try {
+        for (const file of fs.readdirSync(commandDir).filter((f) => f.endsWith('.md'))) {
+          const name = path.basename(file, '.md');
+          const parsed = parseCommandFile(path.join(commandDir, file));
+          if (parsed) config.command[name] = parsed;
+        }
+      } catch (e) {}
+
       config.skills = config.skills || {};
       config.skills.paths = config.skills.paths || [];
       if (!config.skills.paths.includes(ponytailSkillsDir)) {

README.md

@@ -105,8 +105,11 @@ The Claude Code and Codex plugins run two tiny Node.js lifecycle hooks, so `node
 
 ```
 /plugin marketplace add DietrichGebert/ponytail
+```
+```
 /plugin install ponytail@ponytail
 ```
+(You have to send two separate prompts for the install to work) 
 
 The desktop app has no `/plugin` command. Install it from the UI instead: Customize, the + by personal plugins, Create plugin and add marketplace, Add from repository, then enter the repo URL (thanks @NiklasDHahn, #98).
 
@@ -151,7 +154,13 @@ pi install git:github.com/DietrichGebert/ponytail
 
 ### OpenCode
 
-Run OpenCode from a checkout of this repo (the plugin reuses its `hooks/` and `skills/`), and add to `opencode.json`:
+Add to `opencode.json`:
+
+```json
+{ "plugin": ["@dietrichgebert/ponytail"] }
+```
+
+Run from a checkout instead (the plugin reuses `hooks/` and `skills/`):
 
 ```json
 { "plugin": ["./.opencode/plugins/ponytail.mjs"] }
@@ -186,6 +195,20 @@ It reuses this repo's `gemini-extension.json`. One difference: Antigravity conve
 
 Reads `AGENTS.md` from the project root, zero setup. Copy [`AGENTS.md`](AGENTS.md) to your project, or run `codewhale` from a checkout of this repo. That's it.
 
+### Swival
+
+Stage the collection in your library first, then add the skills you want:
+
+```bash
+swival skills add --global https://github.com/DietrichGebert/ponytail  # stage into ~/.config/swival/library
+swival skills add ponytail                                             # install the collection into this project
+swival skills add --global ponytail                                    # or activate it in every project
+```
+
+Swival also reads `AGENTS.md` from the project root and `~/.config/swival/AGENTS.md` globally, the instruction-only fallback.
+
+On the command line, use a `$` prefix to explicitly activate a skill. For example: `$ponytail-review`.
+
 ### OpenClaw
 
 ```bash
@@ -200,7 +223,7 @@ Active every session, with a handful of commands (see [Commands](#commands)). `/
 
 Set the level for every new session with the `PONYTAIL_DEFAULT_MODE` env var (`lite`/`full`/`ultra`/`off`), or a `defaultMode` field in `~/.config/ponytail/config.json` (`%APPDATA%\ponytail\config.json` on Windows). The default is `full`.
 
-Cursor, Windsurf, Cline, GitHub Copilot (editor), Aider, Kiro, Zed, CodeWhale: copy the matching rules file from this repo ([`.cursor/rules/`](.cursor/rules/), [`.windsurf/rules/`](.windsurf/rules/), [`.clinerules/`](.clinerules/), [`.github/copilot-instructions.md`](.github/copilot-instructions.md), [`AGENTS.md`](AGENTS.md), [`.kiro/steering/`](.kiro/steering/)).
+Cursor, Windsurf, Cline, GitHub Copilot (editor), Aider, Kiro, Zed, CodeWhale, Swival: copy the matching rules file from this repo ([`.cursor/rules/`](.cursor/rules/), [`.windsurf/rules/`](.windsurf/rules/), [`.clinerules/`](.clinerules/), [`.github/copilot-instructions.md`](.github/copilot-instructions.md), [`AGENTS.md`](AGENTS.md), [`.kiro/steering/`](.kiro/steering/)).
 
 Kiro: copy `.kiro/steering/ponytail.md` to `~/.kiro/steering/` (global) or `.kiro/steering/` in your project.
 
@@ -232,7 +255,7 @@ These remove the plugin's own files. They leave behind a small amount of state p
 | `/ponytail-gain` | Show the measured impact scoreboard (less code, less cost, more speed) from the benchmark. |
 | `/ponytail-help` | Quick reference for the commands above. |
 
-Commands need a skill-capable host (Claude Code, Codex, OpenCode, Gemini, pi). In Codex they're skills, invoke with `@` (`@ponytail-review`). The instruction-only adapters (Cursor, Windsurf, Cline, Copilot, Kiro, Antigravity) load the always-on ruleset without the commands.
+Commands need a skill-capable host (Claude Code, Codex, OpenCode, Gemini, pi, Swival). In Codex they're skills, invoke with `@` (`@ponytail-review`). The instruction-only adapters (Cursor, Windsurf, Cline, Copilot, Kiro, Antigravity) load the always-on ruleset without the commands.
 
 ## Development
 

benchmarks/benchmark-local.py

@@ -15,6 +15,7 @@ import json
 import re
 import time
 import urllib.request
+import urllib.parse
 from pathlib import Path
 
 ROOT = Path(__file__).parent.parent
@@ -149,6 +150,11 @@ def main():
     parser.add_argument("--repeat",     type=int, default=1, help="Runs per cell; median reported (default: 1)")
     parser.add_argument("--ollama-url", default="http://localhost:11434", help="Ollama base URL")
     args = parser.parse_args()
+
+    parsed_url = urllib.parse.urlparse(args.ollama_url)
+    if parsed_url.scheme not in ("http", "https"):
+        parser.error(f"Invalid --ollama-url scheme: '{parsed_url.scheme}'. Only 'http' and 'https' are supported.")
+
     run(args.model, args.repeat, args.ollama_url)
 
 

docs/agent-portability.md

@@ -20,6 +20,7 @@ to load in a given agent.
 | GitHub Copilot CLI | `.github/plugin/`, `AGENTS.md`, `.github/copilot-instructions.md`, `~/.copilot/copilot-instructions.md` | Plugin-supported (`copilot plugin marketplace add DietrichGebert/ponytail` + `copilot plugin install ponytail@ponytail`). Fallback instruction mode remains: per-project from `AGENTS.md` or `.github/copilot-instructions.md`, or globally from `~/.copilot/copilot-instructions.md` (instruction-tier, no `/ponytail` levels or hooks). |
 | Antigravity | `AGENTS.md` | Reads `AGENTS.md` at the repo root as always-on rules (like `.cursorrules`/`CLAUDE.md`); `.agents/rules/` also works for workspace rules. Instruction-tier. |
 | CodeWhale | `AGENTS.md` | Reads `AGENTS.md` from the repo root as project instructions; also reads `CLAUDE.md` and `.claude/instructions.md` as fallbacks. Instruction-tier. |
+| Swival | `.swival/skills/`, `AGENTS.md` | `swival skills add https://github.com/DietrichGebert/ponytail` installs the six skills straight into `.swival/skills/`. Add `--global` to stage them in the library (`~/.config/swival/library`) first, then `swival skills add ponytail` (or `--global ponytail`) to activate per-project or everywhere. Also reads `AGENTS.md` from the repo root and `~/.config/swival/AGENTS.md` globally as instruction-tier fallback. |
 | VS Code + Codex extension | `AGENTS.md` | The Codex extension reads `AGENTS.md` (repo root, or `~/.codex/AGENTS.md` globally). Instruction-tier; the full Codex plugin row above adds `/ponytail` levels and hooks. |
 | Kiro | `.kiro/steering/ponytail.md` | Steering rule; copy globally or into a project. |
 | Generic agents | `AGENTS.md` or `skills/*/SKILL.md` | Copy the compact rule file or load the skill files directly. |

hooks/claude-codex-hooks.json

@@ -6,7 +6,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "command -v node >/dev/null 2>&1 && node \"${CLAUDE_PLUGIN_ROOT}/hooks/ponytail-activate.js\" || exit 0",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/ponytail-activate.js\"; exit 0",
             "commandWindows": "if (Get-Command node -ErrorAction SilentlyContinue) { node \"$env:CLAUDE_PLUGIN_ROOT\\hooks\\ponytail-activate.js\" }",
             "timeout": 5,
             "statusMessage": "Loading ponytail mode..."
@@ -19,7 +19,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "command -v node >/dev/null 2>&1 && node \"${CLAUDE_PLUGIN_ROOT}/hooks/ponytail-mode-tracker.js\" || exit 0",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/ponytail-mode-tracker.js\"; exit 0",
             "commandWindows": "if (Get-Command node -ErrorAction SilentlyContinue) { node \"$env:CLAUDE_PLUGIN_ROOT\\hooks\\ponytail-mode-tracker.js\" }",
             "timeout": 5,
             "statusMessage": "Tracking ponytail mode..."

package.json

@@ -1,14 +1,43 @@
 {
-  "name": "ponytail",
+  "name": "@dietrichgebert/ponytail",
   "version": "4.8.1",
   "description": "Lazy senior dev mode for AI agents. The best code is the code you never wrote.",
-  "keywords": ["pi-package", "pi", "skills", "ponytail"],
+  "keywords": ["opencode-plugin", "opencode", "ponytail", "pi-package", "pi", "skills"],
   "license": "MIT",
+  "author": {
+    "name": "Dietrich Gebert",
+    "url": "https://github.com/DietrichGebert"
+  },
+  "homepage": "https://github.com/DietrichGebert/ponytail",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/DietrichGebert/ponytail.git"
+  },
+  "bugs": {
+    "url": "https://github.com/DietrichGebert/ponytail/issues"
+  },
+  "main": "./.opencode/plugins/ponytail.mjs",
+  "exports": {
+    ".": "./.opencode/plugins/ponytail.mjs",
+    "./plugin": "./.opencode/plugins/ponytail.mjs"
+  },
+  "files": [
+    "AGENTS.md",
+    "hooks/",
+    "skills/",
+    ".opencode/",
+    "pi-extension/",
+    "assets/",
+    "LICENSE"
+  ],
   "scripts": {
     "test": "node --test tests/*.test.js && npm test --prefix pi-extension"
   },
   "pi": {
     "extensions": ["./pi-extension/index.js"],
     "skills": ["./skills"]
+  },
+  "publishConfig": {
+    "access": "public"
   }
 }

pi-extension/index.js

@@ -56,6 +56,25 @@ export { writeDefaultMode };
 export default function ponytailExtension(pi) {
   let currentMode = DEFAULT_MODE;
   let configuredDefaultMode = getDefaultMode();
+  let isActive = false;
+  let lastCtx = null;
+
+  // -- Status bar --
+  function syncStatus(ctx) {
+    if (ctx) lastCtx = ctx;
+    const c = ctx || lastCtx;
+    if (!c?.ui?.setStatus || !c.ui.theme?.fg) return;
+    const theme = c.ui.theme;
+    if (currentMode === "off") {
+      c.ui.setStatus("ponytail", "");
+      return;
+    }
+    const levelIcons = { lite: "🌿", full: "⚡", ultra: "🔥" };
+    const icon = levelIcons[currentMode] || "";
+    const label = currentMode.toUpperCase();
+    const indicator = isActive ? theme.fg("accent", "●") : theme.fg("dim", "○");
+    c.ui.setStatus("ponytail", indicator + " 🐴 " + theme.fg("muted", "ponytail: ") + theme.fg("text", icon + " " + label));
+  }
 
   const setMode = (mode, ctx) => {
     const normalized = normalizePersistedMode(mode);
@@ -63,6 +82,7 @@ export default function ponytailExtension(pi) {
 
     currentMode = normalized;
     pi.appendEntry("ponytail-mode", { mode: normalized });
+    syncStatus(ctx);
     ctx?.ui?.notify?.(`Ponytail mode set to ${normalized}.`, "info");
   };
 
@@ -148,6 +168,18 @@ export default function ponytailExtension(pi) {
     const entries = ctx?.sessionManager?.getBranch?.() || ctx?.sessionManager?.getEntries?.() || [];
     configuredDefaultMode = getDefaultMode();
     currentMode = resolveSessionMode(entries, configuredDefaultMode);
+    syncStatus(ctx);
+    ctx?.ui?.notify?.(`Ponytail loaded: ${currentMode}`, "info");
+  });
+
+  pi.on("agent_start", async (_event, ctx) => {
+    isActive = true;
+    syncStatus(ctx);
+  });
+
+  pi.on("agent_end", async (_event, ctx) => {
+    isActive = false;
+    syncStatus(ctx);
   });
 
   pi.on("before_agent_start", async (event) => {

pi-extension/test/extension.test.js

@@ -135,3 +135,33 @@ test("a request mentioning normal mode stays active", async () => withTempConfig
   const result = await events.get("before_agent_start")({ systemPrompt: "BASE" }, ctx);
   assert.match(result.systemPrompt, /PONYTAIL MODE ACTIVE/);
 }));
+
+test("status bar renders the mode and flips active on agent_start", async () => withTempConfig(async () => {
+  const { events } = createPiHarness();
+  const statusWrites = [];
+  const ctx = createCommandContext({
+    sessionManager: { getEntries: () => [{ type: "custom", customType: "ponytail-mode", data: { mode: "ultra" } }] },
+    ui: { notify() {}, setStatus: (key, text) => statusWrites.push({ key, text }), theme: { fg: (_color, text) => text } },
+  });
+
+  await events.get("session_start")({ reason: "resume" }, ctx);
+  await events.get("agent_start")({}, ctx);
+
+  assert.equal(statusWrites.at(-2).key, "ponytail");
+  assert.match(statusWrites.at(-2).text, /○.*ULTRA/);
+  assert.match(statusWrites.at(-1).text, /●.*ULTRA/);
+}));
+
+test("status bar stays silent when ui lacks a theme", async () => withTempConfig(async () => {
+  const { events } = createPiHarness();
+  const calls = [];
+  const ctx = createCommandContext({
+    sessionManager: { getEntries: () => [{ type: "custom", customType: "ponytail-mode", data: { mode: "ultra" } }] },
+    ui: { notify() {}, setStatus: (_key, text) => calls.push(text) }, // setStatus present, theme absent
+  });
+
+  await events.get("session_start")({ reason: "resume" }, ctx);
+  await events.get("agent_start")({}, ctx);
+
+  assert.deepEqual(calls, []);
+}));

pi-extension/test/helpers.test.js

@@ -31,6 +31,13 @@ test("resolveSessionMode prefers latest persisted session mode", () => {
   assert.equal(resolveSessionMode(entries, "full"), "ultra");
 });
 
+test("resolveSessionMode returns fallback when entries is not an array", () => {
+  assert.equal(resolveSessionMode(null, "ultra"), "ultra");
+  assert.equal(resolveSessionMode(undefined, "lite"), "lite");
+  assert.equal(resolveSessionMode({}, "full"), "full");
+  assert.equal(resolveSessionMode("not an array"), "full"); // DEFAULT_MODE fallback
+});
+
 test("readDefaultMode and writeDefaultMode use XDG config path", () => {
   const tempDir = mkdtempSync(join(tmpdir(), "ponytail-config-"));
   const previousXdg = process.env.XDG_CONFIG_HOME;

tests/hooks-windows.test.js

@@ -18,6 +18,8 @@ const HOST_PLUGIN_MANIFESTS = [
 ];
 // cmd.exe variable syntax (%FOO%); PowerShell leaves it literal, breaking the path.
 const CMD_VAR_SYNTAX = /%[A-Za-z_][A-Za-z0-9_]*%/;
+// PowerShell 5.1 rejects these POSIX shell guards when a host runs `command`.
+const POSIX_GUARD_SYNTAX = /\bcommand\s+-v\b|&&|\|\||>\/dev\/null|2>&1/;
 // Pull the hooks/<script> a command launches, so we can check it exists.
 const HOOK_SCRIPT = /hooks[\\/]([\w.-]+\.(?:js|mjs|cjs|ps1|sh))/;
 
@@ -40,6 +42,26 @@ test('every commandWindows uses PowerShell $env: syntax, not cmd.exe %VAR%', ()
   }
 });
 
+test('shared hook commands avoid POSIX-only guard syntax', () => {
+  const commands = commandHooks()
+    .map((h) => h.command)
+    .filter(Boolean);
+  assert.ok(commands.length > 0, 'expected at least one shared command entry');
+  for (const cmd of commands) {
+    assert.doesNotMatch(cmd, POSIX_GUARD_SYNTAX, `command uses POSIX-only guard syntax: ${cmd}`);
+  }
+});
+
+test('shared hook commands keep lifecycle hooks non-blocking', () => {
+  const commands = commandHooks()
+    .map((h) => h.command)
+    .filter(Boolean);
+  assert.ok(commands.length > 0, 'expected at least one shared command entry');
+  for (const cmd of commands) {
+    assert.match(cmd, /;\s*exit 0$/, `command must exit successfully if node or the hook script fails: ${cmd}`);
+  }
+});
+
 test('every hook command points at a script that ships in hooks/', () => {
   for (const hook of commandHooks()) {
     for (const cmd of [hook.command, hook.commandWindows].filter(Boolean)) {

tests/opencode-plugin.test.js

@@ -18,10 +18,12 @@ process.env.XDG_CONFIG_HOME = tmp;
 delete process.env.PONYTAIL_DEFAULT_MODE;
 const statePath = path.join(tmp, 'opencode', '.ponytail-active');
 
-let loadPlugin;
+let loadPlugin, parseCommandFile;
 test.before(async () => {
   const url = pathToFileURL(path.join(__dirname, '..', '.opencode', 'plugins', 'ponytail.mjs'));
-  loadPlugin = (await import(url)).default;
+  const mod = await import(url);
+  loadPlugin = mod.default;
+  parseCommandFile = mod.parseCommandFile;
 });
 
 function transform(hooks) {
@@ -61,4 +63,21 @@ test('unrelated commands do not touch the flag', async () => {
   assert.equal(fs.existsSync(statePath), false);
 });
 
+test('parseCommandFile reads frontmatter description + body, LF and CRLF', () => {
+  const lf = path.join(tmp, 'cmd-lf.md');
+  fs.writeFileSync(lf, '---\ndescription: do a thing\n---\n\nthe template body\n');
+  assert.deepEqual(parseCommandFile(lf), { description: 'do a thing', template: 'the template body' });
+
+  // Windows checkouts (autocrlf) deliver CRLF — the parser must still match.
+  const crlf = path.join(tmp, 'cmd-crlf.md');
+  fs.writeFileSync(crlf, '---\r\ndescription: do a thing\r\n---\r\n\r\nthe template body\r\n');
+  assert.deepEqual(parseCommandFile(crlf), { description: 'do a thing', template: 'the template body' });
+});
+
+test('parseCommandFile returns null when there is no frontmatter', () => {
+  const bare = path.join(tmp, 'cmd-bare.md');
+  fs.writeFileSync(bare, 'no frontmatter here\n');
+  assert.equal(parseCommandFile(bare), null);
+});
+
 test.after(() => fs.rmSync(tmp, { recursive: true, force: true }));