@mengyuly/dsh-ponytail 0.1.3 → 0.1.5

package/CHANGELOG.md

@@ -0,0 +1,138 @@
+# Changelog
+
+All notable changes to `@mengyuly/dsh-ponytail` are documented here.
+Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+## [0.1.5] - 2026-08-24
+
+### Fixed
+
+- Windows 下验证脚本无法启动 `npm.cmd`：`spawnSync('npm', …)` 在 Windows 上对
+  `.cmd` 无效（`status === null`）。现在统一走 `process.execPath + npm_execpath`
+  （npm script 环境内为 npm 自身 CLI，跨平台可靠），并在 `npm_execpath` 缺失或
+  指向其他包管理器（pnpm/yarn/bun shim）时回退到 `npm`/`npm.cmd`。
+- `spawnSync` 启动失败时错误信息丢失：统一 `formatSpawnFailure` 输出 command、
+  args、cwd、status、signal、`result.error.message`、stdout/stderr 尾部
+  （各 4KB 上限）；`status === null` 明确判为启动失败或被信号终止，不再显示为
+  普通退出码。
+- `verify-dist` 不再有未定义 `existsSync` 的潜伏分支：改为**直接拒绝**任何
+  `sourceMappingURL`（与 v0.1.4 起 `declarationMap: false` 的发布策略一致），
+  并新增回归测试证明声明文件重现 source map 时验证会明确失败。
+- 删除 CI 中 checkout 后立即执行的无效 `git diff --exit-code -- lib` 步骤
+  （工作区天然干净，证明不了任何事）；防漂移表述与真实能力对齐。
+
+### Changed
+
+- `verify-pack` / `test-consumer` 共用 `scripts/lib/run-command.mjs` 跨平台进程
+  工具，不再各自维护一套 `spawnSync('npm', …)`。
+- `verify-pack` 如实报告实际安装的依赖（npm 会解析全部声明 peers，包括宿主
+  契约 peers；bundle 运行时只 import `@deepseek-ai/cordis` 由独立外链检查证明）。
+- CI 增加 Windows Runner（`windows-latest` + `ubuntu-latest` 矩阵，Node 24，
+  不允许跳过或 continue-on-error）。
+- `sync:dist` 生成 `dist-provenance.json`：`sourceCommit` 来自权威 checkout 的
+  `git rev-parse HEAD`（真实 SHA，不手工填写），工具链版本取自 checkout 的
+  node_modules，不含本机绝对路径；`verify:dist` 校验其格式。
+- tarball 现在包含 `dist-provenance.json`。
+- 产物一致性检查命名与真实能力一致：`verify:dist` 是静态一致性检查（src/d.ts
+  导出、关键签名、主入口运行时导出、无 source map、provenance），不是与权威
+  构建的字节级等价证明。
+
+### Tests
+
+- Ubuntu：verify:dist / verify:pack / test:consumer / test:regressions 全部通过。
+- Windows：CI 矩阵真实执行 verify:dist / verify:pack / test:consumer。
+- npm tarball smoke（仅声明依赖安装后加载）。
+- NodeNext + skipLibCheck:false consumer。
+- 子进程启动失败诊断回归测试。
+- declaration source map 回归测试。
+
+## [0.1.4] - 2026-08-24
+
+### Fixed
+
+- 修复运行时 JS 与 TypeScript declarations 不一致：v0.1.3 只同步了
+  `lib/index.js`/`lib/invariant.js`，声明文件停留在旧版本。
+- `compileSubagentMatcher` 声明恢复正确（`{ matcher, invalid }`），与运行时一致。
+- 补齐 `readDefaultModeInfo`、`sessionKey` 及诊断类型
+  （`DefaultModeIssueKind` / `DefaultModeIssue` / `DefaultModeResolution`）的声明。
+- `writeDefaultMode` 声明注释补充「写入失败会抛出异常」。
+- 移除失效的 declaration source map 引用：声明生成关闭 `declarationMap`，
+  发布的 `.d.ts` 不再携带指向不存在 `.d.ts.map` 的 `sourceMappingURL`。
+
+### Changed
+
+- 发布流程改为同步**完整** `lib/`（两个运行时 bundle + 全部 `.d.ts`）：
+  `npm run sync:dist`（要求 `DSH_CHECKOUT`，在权威 checkout 中重建后整体同步）。
+- CI 增加防漂移检查：src 导出 ↔ 声明导出、运行时导出 ↔ 声明导出、
+  `modes.d.ts` 关键签名、无悬空 source map、tarball 内容/版本/安装后 smoke、
+  NodeNext + `skipLibCheck:false` 的声明消费测试。
+- tarball 现在包含 `CHANGELOG.md`。
+
+### Tests
+
+- npm tarball smoke test（仅声明 peer 安装后加载）。
+- TypeScript consumer test（打包安装后编译，非相对路径读 src）。
+- 运行时/声明导出一致性验证。
+- src↔d.ts 漂移检查（CI 与 `verify:dist` 双保险）。
+
+## [0.1.3] - 2026-08-23
+
+### Fixed
+
+- Bare `/ponytail` on an `off` session now re-enables at the effective default
+  (or `full` when that default is `off` too), matching the documented "resume
+  anytime with `/ponytail`" behavior. It still only reports when already enabled.
+- `/ponytail default <mode>` no longer bypasses `PONYTAIL_DEFAULT_MODE`: the
+  effective default is recomputed after the write, so the env var keeps its
+  documented highest priority; the result distinguishes saved vs effective.
+- Typo: `Ponyytail default set` → `Ponytail default set`.
+- Deactivation phrases now also strip CJK sentence enders (`。？！`), so
+  `normal mode？` and `stop ponytail。` deactivate as expected.
+- Config writes are now atomic (temp file + rename); a failed write returns an
+  error instead of a false success.
+- A temporarily invalid config during hot-reload keeps the last known good
+  default instead of snapping back to `full`.
+
+### Changed
+
+- `/ponytail status` added as a pure query (never modifies the session).
+- Command hints and error text updated to the new surface
+  (`[status|default <mode>|lite|full|ultra|off]`).
+- Invalid config JSON / `defaultMode` / read failures and invalid
+  `PONYTAIL_SUBAGENT_MATCHER` now warn exactly once (fail-open preserved,
+  missing config file stays silent).
+- Session identity is centralized in one `sessionKey(agent)` helper; mode
+  overrides are released on `agent/disposed`, so long-running hosts do not
+  accumulate stale per-session entries.
+
+### Tests
+
+- 47 unit/integration tests (was 24): command semantics (bare `/ponytail`
+  restore paths, `status`, `default` saved-vs-effective, write failure),
+  priority (env > config > full, invalid env falls back to config),
+  session isolation and disposal cleanup, CJK/ASCII deactivation punctuation,
+  config file edge cases (BOM, empty, invalid JSON, array root, unknown-field
+  preservation, atomic write), hot-reload keep-last-good, and a headless
+  (no command plane) mount.
+
+## [0.1.2] - 2026-08-23
+
+### Changed
+
+- Self-contained bundle: `dsh-llm` / `dsh-skill` are inlined, so the runtime
+  only depends on the `@deepseek-ai/cordis` peer — installable from GitHub,
+  tarball, or npm without a dsh source tree.
+- npm scope renamed to `@mengyuly/dsh-ponytail` (matches the npm account).
+
+### Tests
+
+- CI smoke verifies the bundle leaves no dsh core external and loads with only
+  cordis installed.
+
+## [0.1.0] - 2026-08-23
+
+### Added
+
+- Initial release: always-on lazy-senior-developer ruleset, lite/full/ultra/off
+  intensities, six skills and slash commands, deactivation phrases,
+  `PONYTAIL_DEFAULT_MODE` / config-file defaults, subagent matcher.

package/README.md

@@ -62,8 +62,27 @@ dsh plugin --profile web add @mengyuly/dsh-ponytail
 
 ## 测试环境与权威关系
 
-- 用 Node.js **v24.16.0** 在本机 deepseek-harness checkout 上测试（`tsc -b` + `tsdown` host 构建通过）。与之精确匹配的已发布 DSH/Cordis 版本**待确认**——checkout 是预发布工作树，非发布 tag。
-- 权威源码在 deepseek-harness monorepo 的 `packages/community/ponytail`（`@deepseek-ai/dsh-ponytail`）；本仓库（`@mengyuly/dsh-ponytail`）是**发行镜像**：随包附构建产物，`scripts/build.sh` 只做源码类型检查，不是独立真源。
+- 本机（Linux，Node.js **v24.16.0**，deepseek-harness checkout 构建）与 CI 矩阵（**ubuntu-latest + windows-latest**，Node 24）上验证通过。与之精确匹配的已发布 DSH/Cordis 版本**待确认**——checkout 是预发布工作树，非发布 tag。
+- 权威源码在 deepseek-harness monorepo 的 `packages/community/ponytail`（`@deepseek-ai/dsh-ponytail`）；本仓库（`@mengyuly/dsh-ponytail`）是**发行镜像**：随包附构建产物，不是独立真源。
+
+## 发行维护
+
+- **权威源码**：deepseek-harness monorepo 的 `packages/community/ponytail`（本仓库是发行镜像，只随包发布构建产物）。
+- **完整重新生成并同步 `lib/`**（JS 与声明必须作为同一产物同步，禁止只复制单个 JS 文件）：
+  ```bash
+  DSH_CHECKOUT=/path/to/deepseek-harness npm run sync:dist
+  ```
+  该命令在权威 checkout 中重建（`tsc` 生成声明 + `tsdown` 打包运行时），同步 `lib/index.js`、`lib/invariant.js`、`lib/types/*.d.ts`，生成 `dist-provenance.json`（记录权威 checkout 的真实 commit SHA 与工具链版本），并自动执行一致性校验；产物有变化时会提示提交。**完整构建一致性由本命令在发布流程中完成——发行镜像 CI 不会重新构建权威 monorepo。**
+- **验证命令**（Linux / Windows 通用，跨平台进程调用见 `scripts/lib/run-command.mjs`）：
+  ```bash
+  npm run verify:dist      # 静态一致性：src/d.ts 导出一致、关键签名、主入口运行时导出、无 source map、provenance 合法
+  npm run verify:pack      # tarball 内容/版本、安装后 smoke（如实报告实际安装的依赖）
+  npm run test:consumer    # NodeNext + skipLibCheck:false 的声明消费测试（对打包产物）
+  npm run test:regressions # 验证工具自身的回归测试（source map 策略、provenance、spawn 诊断）
+  ```
+- **CI 能力边界（如实）**：CI（ubuntu + windows 矩阵）执行上述静态验证与打包/消费测试，但**不重新构建权威 monorepo**；`verify:dist` 是导出表面/签名/运行时导出的一致性检查，**不是**与权威构建的字节级等价证明——后者由 `sync:dist` 在发布流程中保证。
+- `dist-provenance.json` 随 npm 包发布，便于审计构建来源。
+- 本机验证时若 `npm_execpath` 指向其他包管理器（如 pnpm/yarn shim），脚本会自动回退到 PATH 上的 `npm`；临时目录失败时保留需设 `PONYTAIL_VERIFY_KEEP_TEMP=1`。
 
 ## 许可
 

package/dist-provenance.json

@@ -0,0 +1,10 @@
+{
+  "sourceRepository": "https://github.com/deepseek-ai/deepseek-harness.git",
+  "sourceCommit": "b150a551b8d465e31e418e1b2eaf5e79bbb7d28e",
+  "sourcePackage": "packages/community/ponytail",
+  "generatedBy": {
+    "node": "v24.16.0",
+    "typescript": "6.0.3",
+    "tsdown": "0.22.2"
+  }
+}

package/lib/index.js

@@ -1713,7 +1713,7 @@ function errorMessage(error) {
 * `skill` tool). `ponytail` is the source the system-prompt ruleset is
 * filtered from; the other five ship verbatim as runtime skills.
 *
-* @module @mengyuly/dsh-ponytail
+* @module @deepseek-ai/dsh-ponytail
 */
 /** The always-on lazy-senior-dev ruleset: also registered as a loadable skill. */
 const PONYTAIL_SKILL_BODY = `
@@ -2114,7 +2114,7 @@ function ponytailSkills() {
 * level via the `/ponytail` command is session-scoped and lives in an
 * in-memory, per-agent {@link ModeStore}.
 *
-* @module @mengyuly/dsh-ponytail
+* @module @deepseek-ai/dsh-ponytail
 */
 const DEFAULT_MODE = "full";
 const RUNTIME_MODES = [
@@ -2309,7 +2309,7 @@ function isSubagentSession(header) {
 * `hooks/ponytail-instructions.js`, so the injected text is byte-for-byte the
 * same ruleset every other host emits, filtered to the active intensity.
 *
-* @module @mengyuly/dsh-ponytail
+* @module @deepseek-ai/dsh-ponytail
 */
 /**
 * Keep a line of the skill body only when it belongs to every mode or to the
@@ -2373,7 +2373,7 @@ const instructionCache = /* @__PURE__ */ new Map();
 * from `PONYTAIL_DEFAULT_MODE` then `~/.config/ponytail/config.json` (see
 * {@link readDefaultMode}).
 *
-* @module @mengyuly/dsh-ponytail
+* @module @deepseek-ai/dsh-ponytail
 */
 const name = "ponytail";
 const inject = ["systemPrompt", "skills"];

package/lib/invariant.js

@@ -1,9 +1,9 @@
 //#region lib/types/invariant.js
 /**
-* Package-owned invariant companion for `@mengyuly/dsh-ponytail`.
-* @module @mengyuly/dsh-ponytail/invariant
+* Package-owned invariant companion for `@deepseek-ai/dsh-ponytail`.
+* @module @deepseek-ai/dsh-ponytail/invariant
 */
-const PACKAGE_NAME = "@mengyuly/dsh-ponytail";
+const PACKAGE_NAME = "@deepseek-ai/dsh-ponytail";
 /** Cordis companion plugin name. */
 const name = "ponytail-invariant";
 /** Service required before the companion can reserve package ownership. */

package/lib/types/content.d.ts

@@ -4,7 +4,7 @@
  * `skill` tool). `ponytail` is the source the system-prompt ruleset is
  * filtered from; the other five ship verbatim as runtime skills.
  *
- * @module @mengyuly/dsh-ponytail
+ * @module @deepseek-ai/dsh-ponytail
  */
 import type { SkillRegistration } from '@deepseek-ai/dsh-skill';
 /** The always-on lazy-senior-dev ruleset: also registered as a loadable skill. */
@@ -18,8 +18,7 @@ export declare const DEBT_SKILL_BODY = "\nEvery deliberate ponytail shortcut is
 export declare const DEBT_DESCRIPTION: string;
 export declare const GAIN_SKILL_BODY = "\nDisplay this scoreboard when invoked. One-shot: do NOT change mode, write flag\nfiles, or persist anything.\n\nThe figures are the published benchmark medians (5 everyday tasks: email\nvalidator, debounce, CSV sum, countdown timer, rate limiter; three models:\nHaiku, Sonnet, Opus). They are measured, not computed from the current repo.\nSource: the upstream `benchmarks/` directory and README.\n\n## Scoreboard\n\nRender plain ASCII bars. The bar length shows the measured range; the label\ncarries the exact figure:\n\n```\n  ponytail gain                     benchmark median \u00B7 5 tasks \u00B7 3 models\n\n  Lines of code   no-skill  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  100%\n                  ponytail  \u2588\u2588\u258C\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7    6\u201320%   \u25BC 80\u201394%\n  Cost            no-skill  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  100%\n                  ponytail  \u2588\u2588\u2588\u2588\u2588\u258C\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7\u00B7   23\u201353%  \u25BC 47\u201377%\n  Speed           ponytail  \u25B8 3\u20136\u00D7 faster\n\n  This repo:  /ponytail-debt  (shortcuts you deferred)\n              /ponytail-audit (what's still cuttable)\n```\n\n## Honesty boundary\n\nThese are benchmark medians, not this repo. NEVER print a per-repo savings\nnumber (\"you saved X lines/tokens here\"): the unbuilt version was never\nwritten, so there is no real baseline to subtract from in a live repo. The\nonly real per-repo figures come from `/ponytail-debt` (a counted ledger), and\nthis card points there instead of inventing one.\n\n## Boundaries\n\nOne-shot display. Edits nothing, changes no mode.\n\"stop ponytail\" or \"normal mode\": revert.\n";
 export declare const GAIN_DESCRIPTION: string;
-export declare const HELP_SKILL_BODY = "\nDisplay this reference card when invoked. One-shot, do NOT change mode,\nwrite flag files, or persist anything.\n\n## Levels\n\n| Level | Trigger | What change |\n|-------|---------|-------------|\n| **Lite** | `/ponytail lite` | Build what's asked, name the lazier alternative in one line. |\n| **Full** | `/ponytail` | The ladder enforced: YAGNI \u2192 stdlib \u2192 native \u2192 one line \u2192 minimum. Default. |\n| **Ultra** | `/ponytail ultra` | YAGNI extremist. Deletion before addition. Challenges requirements before building. |\n| **Off** | `/ponytail off` | Ponytail stops injecting its ruleset for this session. |\n\nLevel is session-scoped until changed.\n\n## Skills\n\n| Skill | Trigger | What it does |\n|-------|---------|--------------|\n| **ponytail** | `/ponytail` | Lazy mode itself. Simplest solution that works. |\n| **ponytail-review** | `/ponytail-review` | Over-engineering review: `L42: yagni: factory, one product. Inline.` |\n| **ponytail-audit** | `/ponytail-audit` | Whole-repo over-engineering audit: ranked list of what to delete. |\n| **ponytail-debt** | `/ponytail-debt` | Harvest `ponytail:` shortcut comments into a tracked ledger. |\n| **ponytail-gain** | `/ponytail-gain` | Measured-impact scoreboard: less code, less cost, more speed. |\n| **ponytail-help** | `/ponytail-help` | This card. |\n\nYou can also load any of these with the `skill` tool.\n\n## Deactivate\n\nSay \"stop ponytail\" or \"normal mode\". Resume anytime with `/ponytail`.\n`/ponytail off` also works. Level is session-scoped; a new session starts\nfrom the configured default.\n\n## Configure Default Mode\n\nDefault mode = `full`, auto-active every session. Change it:\n\n**Environment variable** (highest priority):\n```bash\nexport PONYTAIL_DEFAULT_MODE=ultra\n```\n\n**Config file** (`~/.config/ponytail/config.json`, Windows: `%APPDATA%\\ponytail\\config.json`):\n```json\n{ \"defaultMode\": \"lite\" }\n```\n\nSet `\"off\"` to disable auto-activation on session start, activate manually\nwith `/ponytail` when wanted. `/ponytail default <mode>` persists a new\ndefault from inside a session.\n\nResolution: env var > config file > `full`.\n\n## More\n\nFull docs + examples: https://github.com/DietrichGebert/ponytail\n";
+export declare const HELP_SKILL_BODY = "\nDisplay this reference card when invoked. One-shot, do NOT change mode,\nwrite flag files, or persist anything.\n\n## Levels\n\n| Level | Trigger | What change |\n|-------|---------|-------------|\n| **Lite** | `/ponytail lite` | Build what's asked, name the lazier alternative in one line. |\n| **Full** | `/ponytail` | The ladder enforced: YAGNI \u2192 stdlib \u2192 native \u2192 one line \u2192 minimum. Default. |\n| **Ultra** | `/ponytail ultra` | YAGNI extremist. Deletion before addition. Challenges requirements before building. |\n| **Off** | `/ponytail off` | Ponytail stops injecting its ruleset for this session. |\n\nLevel is session-scoped until changed.\n\n## Skills\n\n| Skill | Trigger | What it does |\n|-------|---------|--------------|\n| **ponytail** | `/ponytail` | Lazy mode itself. Simplest solution that works. |\n| **ponytail-review** | `/ponytail-review` | Over-engineering review: `L42: yagni: factory, one product. Inline.` |\n| **ponytail-audit** | `/ponytail-audit` | Whole-repo over-engineering audit: ranked list of what to delete. |\n| **ponytail-debt** | `/ponytail-debt` | Harvest `ponytail:` shortcut comments into a tracked ledger. |\n| **ponytail-gain** | `/ponytail-gain` | Measured-impact scoreboard: less code, less cost, more speed. |\n| **ponytail-help** | `/ponytail-help` | This card. |\n\nYou can also load any of these with the `skill` tool.\n\n## Deactivate\n\nSay \"stop ponytail\" or \"normal mode\". Resume anytime with `/ponytail` \u2014\nit re-enables at the effective default (or `full` when that is off too).\n`/ponytail status` only shows the current level, never changes it.\n`/ponytail off` also works. Level is session-scoped; a new session starts\nfrom the configured default.\n\n## Configure Default Mode\n\nDefault mode = `full`, auto-active every session. Change it:\n\n**Environment variable** (highest priority):\n```bash\nexport PONYTAIL_DEFAULT_MODE=ultra\n```\n\n**Config file** (`~/.config/ponytail/config.json`, Windows: `%APPDATA%\\ponytail\\config.json`):\n```json\n{ \"defaultMode\": \"lite\" }\n```\n\nSet `\"off\"` to disable auto-activation on session start, activate manually\nwith `/ponytail` when wanted. `/ponytail default <mode>` persists a new\ndefault to the config file; an exported `PONYTAIL_DEFAULT_MODE` still\noutranks the saved value for new sessions.\n\nResolution: env var > config file > `full`.\n\n## More\n\nFull docs + examples: https://github.com/DietrichGebert/ponytail\n";
 export declare const HELP_DESCRIPTION: string;
 /** Ordered set of runtime skills surfaced to the model catalog and `/` menu. */
 export declare function ponytailSkills(): readonly SkillRegistration[];
-//# sourceMappingURL=content.d.ts.map

package/lib/types/index.d.ts

@@ -10,7 +10,7 @@
  * from `PONYTAIL_DEFAULT_MODE` then `~/.config/ponytail/config.json` (see
  * {@link readDefaultMode}).
  *
- * @module @mengyuly/dsh-ponytail
+ * @module @deepseek-ai/dsh-ponytail
  */
 import type { Context } from '@deepseek-ai/cordis';
 export declare const name = "ponytail";
@@ -34,4 +34,3 @@ export declare function containsDeactivation(messages: readonly {
  * commands, and the plain-text deactivation listener.
  */
 export declare function apply(ctx: Context): void;
-//# sourceMappingURL=index.d.ts.map

package/lib/types/instructions.d.ts

@@ -3,7 +3,7 @@
  * `hooks/ponytail-instructions.js`, so the injected text is byte-for-byte the
  * same ruleset every other host emits, filtered to the active intensity.
  *
- * @module @mengyuly/dsh-ponytail
+ * @module @deepseek-ai/dsh-ponytail
  */
 import { type PonytailRuntimeMode } from './modes.ts';
 /**
@@ -21,4 +21,3 @@ export declare function fallbackInstructions(mode: PonytailRuntimeMode): string;
  * Returns an empty string for `off` (ponytail contributes nothing).
  */
 export declare function getPonytailInstructions(mode: PonytailRuntimeMode | null | undefined): string;
-//# sourceMappingURL=instructions.d.ts.map

package/lib/types/invariant.d.ts

@@ -1,6 +1,6 @@
 /**
- * Package-owned invariant companion for `@mengyuly/dsh-ponytail`.
- * @module @mengyuly/dsh-ponytail/invariant
+ * Package-owned invariant companion for `@deepseek-ai/dsh-ponytail`.
+ * @module @deepseek-ai/dsh-ponytail/invariant
  */
 import type { Context } from '@deepseek-ai/cordis';
 /** Cordis companion plugin name. */
@@ -13,4 +13,3 @@ export declare const inject: string[];
  * @returns the installed registration's disposer after setup succeeds.
  */
 export declare const apply: (ctx: Context) => Promise<() => void>;
-//# sourceMappingURL=invariant.d.ts.map

package/lib/types/modes.d.ts

@@ -5,7 +5,7 @@
  * level via the `/ponytail` command is session-scoped and lives in an
  * in-memory, per-agent {@link ModeStore}.
  *
- * @module @mengyuly/dsh-ponytail
+ * @module @deepseek-ai/dsh-ponytail
  */
 /** One settable runtime intensity. `review` is command-only and never a default. */
 export type PonytailRuntimeMode = 'off' | 'lite' | 'full' | 'ultra';
@@ -31,6 +31,28 @@ export declare function configPath(env?: NodeJS.ProcessEnv): string;
  * then {@link DEFAULT_MODE}. Pure so callers can supply fixtures.
  */
 export declare function resolveDefaultMode(envMode: unknown, configText: string | undefined): PonytailRuntimeMode;
+/**
+ * One configuration problem worth surfacing exactly once. `read` covers
+ * permission/IO failures, `json` malformed documents, `shape` a root that is
+ * not an object, and `value` a `defaultMode` that is not a runtime level.
+ */
+export type DefaultModeIssueKind = 'read' | 'json' | 'shape' | 'value';
+export interface DefaultModeIssue {
+    readonly kind: DefaultModeIssueKind;
+    readonly detail: string;
+}
+/** The resolved default plus the first config problem found, if any. */
+export interface DefaultModeResolution {
+    readonly mode: PonytailRuntimeMode;
+    readonly issue?: DefaultModeIssue;
+}
+/**
+ * Read the configured default with diagnostics: environment variable first,
+ * then the config file, then `full`. A missing config file is normal and
+ * yields no issue; a broken one yields the fallback mode plus one issue for
+ * the caller to warn about once.
+ */
+export declare function readDefaultModeInfo(env?: NodeJS.ProcessEnv): DefaultModeResolution;
 /**
  * Read the configured default for this host: environment variable first, then
  * the config file, then `full`.
@@ -39,6 +61,8 @@ export declare function readDefaultMode(env?: NodeJS.ProcessEnv): PonytailRuntim
 /**
  * Persist a new default level to the config file, preserving other fields.
  * Returns the normalized mode, or `null` when the value is not a runtime mode.
+ * Throws when the write itself fails, so callers never report success for a
+ * file that was not written.
  */
 export declare function writeDefaultMode(mode: unknown, env?: NodeJS.ProcessEnv): PonytailRuntimeMode | null;
 /**
@@ -56,14 +80,26 @@ export declare class ModeStore {
     clear(agentId: string): void;
 }
 /**
- * Compile `PONYTAIL_SUBAGENT_MATCHER` into a case-insensitive regex, or `null`
- * — for "no matcher" and for invalid patterns, both of which mean the ruleset
- * applies to every agent (fail open, like upstream).
+ * Compile `PONYTAIL_SUBAGENT_MATCHER` into a case-insensitive regex. An unset
+ * matcher yields `null`; an invalid pattern stays fail-open (every agent gets
+ * the ruleset) but is reported so the caller can warn exactly once.
+ */
+export declare function compileSubagentMatcher(raw: string | undefined): {
+    matcher: RegExp | null;
+    invalid: boolean;
+};
+/**
+ * The stable per-session identity backing every mode override. DSH's `Agent`
+ * type documents `id` as "the single identity shared with session", so the
+ * agent id IS the SessionId: one entry per live session, never shared between
+ * two sessions, and stable across the session's lifetime. Centralized so the
+ * key choice lives in exactly one place.
  */
-export declare function compileSubagentMatcher(raw: string | undefined): RegExp | null;
+export declare function sessionKey(agent: {
+    readonly id: string;
+}): string;
 /** Whether a session is a subagent child (origin, or any delegation depth with no origin). */
 export declare function isSubagentSession(header: {
     origin?: 'subagent';
     delegationDepth?: number;
 }): boolean;
-//# sourceMappingURL=modes.d.ts.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mengyuly/dsh-ponytail",
   "description": "Lazy senior dev mode for DeepSeek Harness: always-on minimal-code ruleset, intensity switching, and short review/audit/debt/gain/help skills",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "publishConfig": {
     "access": "public"
   },
@@ -25,6 +25,8 @@
     "./package.json": "./package.json"
   },
   "files": [
+    "dist-provenance.json",
+    "CHANGELOG.md",
     "lib/index.js",
     "lib/invariant.js",
     "lib/types/**/*.d.ts",
@@ -43,5 +45,12 @@
     "@deepseek-ai/dsh-llm": ">=0.0.1-rc <2",
     "@deepseek-ai/dsh-skill": ">=0.0.1-rc <2",
     "@deepseek-ai/dsh-system-prompt": ">=0.0.1-rc <2"
+  },
+  "scripts": {
+    "sync:dist": "node scripts/sync-dist.mjs",
+    "verify:dist": "node scripts/verify-dist.mjs",
+    "verify:pack": "node scripts/verify-pack.mjs",
+    "test:consumer": "node scripts/test-consumer.mjs",
+    "test:regressions": "node scripts/test-regressions.mjs"
   }
-}
+}