@mengyuly/dsh-ponytail 0.1.6 → 0.2.0

package/CHANGELOG.md

@@ -3,6 +3,59 @@
 All notable changes to `@mengyuly/dsh-ponytail` are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.2.0] - 2026-08-24
+
+### Added
+
+- 真正区分 lite/full/ultra 的 Prompt：从「Markdown 正则过滤同一份正文」改为
+  **结构化片段组合**（Common 规则 + 永不可删的 Safety 边界 + 各档独立规则）。
+  - `lite`：完整交付明确要求、可一句话提示更简方案、不挑战明确需求；
+  - `full`：完整七级阶梯、默认最短正确实现、修根因；
+  - `ultra`：先删后加、主动质疑投机性功能/缓存/抽象/配置/新依赖、先给最小
+    正确版并说明完整版条件、不是无脑拒绝；
+  - 三档共享 Common + Safety（输入校验/数据丢失防护/安全/无障碍/明确验收项）。
+  - 常驻注入从 ~1.3k tokens 降到 **lite≈369 / full≈420 / ultra≈406** tokens。
+- **Cordis Profile 级 `defaultMode` 配置**：`config: { defaultMode }` 按
+  profile 生效（`web → full`、`tui → lite` 等），优先级
+  `会话 override > env > Profile > 用户 config.json > full`；非法值告警一次
+  并回退；Profile 配置初始化时读取（Cordis 无公开配置变更事件），重启生效；
+  `/ponytail default` 的 saved/effective 提示现在会点名覆盖来源
+  （`PONYTAIL_DEFAULT_MODE` / `profile configuration`）。
+- 兼容矩阵：CI 扩展为 **Node 22 × Node 24 × ubuntu × windows**（4 组合）；
+  `dist-provenance.json` 增加 `generatedBy.cordis`；README 记录实测矩阵
+  （含 web profile 本机验证、tui/headless 如实标注未验证）。
+- 结构化 Prompt 的行为测试、快照测试、token 统计测试；Profile 优先级测试
+  （env>profile、会话 override>env、非法回退、双 profile 不同默认）。
+
+### Changed
+
+- 默认模式解析加入 Profile 档（代码/测试/README 三处一致）。
+- README：三档真实差异、Profile 配置示例、兼容矩阵、子代理边界表述。
+
+### Fixed
+
+- 删除随旧实现遗留的 `filterSkillBodyForMode` 正则过滤路径及其测试
+  （被结构化组合取代）。
+
+### Security
+
+- 无变化（0.1.6 的 eval-free 产物与 dev-tooling 边界保持）。
+
+## Unreleased
+
+### Security
+
+- Documented the development-only `child_process` boundary (`SECURITY.md`):
+  `scripts/**` is excluded from the npm tarball, has no install lifecycle
+  hook, and is unreachable from the installed runtime entry.
+- Added tarball checks preventing `scripts/` (and `src/`, `tests/`, `test/`,
+  `tools/`) from being published, plus a post-install assertion that the
+  installed package contains no `scripts/`.
+- Added checks preventing `preinstall` / `install` / `postinstall` /
+  `prepare` lifecycle hooks from silently invoking development tooling.
+- Classified repository-only `child_process` findings as accepted
+  development-tooling risk.
+
 ## [0.1.6] - 2026-08-24
 
 ### Fixed

package/README.md

@@ -3,6 +3,7 @@
 ![CI](https://github.com/MengYuil/dsh-ponytail/actions/workflows/ci.yml/badge.svg)
 ![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)
 [![npm](https://img.shields.io/npm/v/@mengyuly/dsh-ponytail)](https://www.npmjs.com/package/@mengyuly/dsh-ponytail)
+[![dsh.so security](https://www.dsh.so/badge/dsh-ponytail-4.svg)](https://www.dsh.so/artifact/dsh-ponytail-4/)
 
 把 [DietrichGebert/ponytail](https://github.com/DietrichGebert/ponytail)（「懒惰资深开发者」最少代码心智）移植成 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 原生插件。功能与效率与上游一致：7 级阶梯规则集每轮注入、强度切换、`/ponytail-*` 斜杠命令。
 
@@ -32,12 +33,18 @@ dsh plugin --profile web add @mengyuly/dsh-ponytail
 
 ## 功能
 
-- **核心模式** `/ponytail` — 每轮注入「懒惰阶梯」：能不做就不做（YAGNI）→ 代码库已有 → 标准库 → 平台原生 → 已装依赖 → 一行能解决 → 才是最少代码。
-  - `full`（默认）/ `lite` / `ultra` / `off` 四档，**会话级**（会话 A 的档位不影响会话 B，会话结束自动释放）。
-  - 裸 `/ponytail`：已启用时只报告；会话为 `off` 时恢复到有效默认档（有效默认也是 `off` 则回 `full`）。
+- **核心模式** `/ponytail` — 每轮注入结构化的懒惰开发者规则集，**三个档位是真实不同的 Prompt 片段**（不只是换一行）：
+  - **Common（所有非 off 档共享）**：先理解问题、追踪真实调用流；优先复用/标准库/原生能力/已有依赖；非平凡改动留一个最小可运行检查；解释简短但不省略关键决策。
+  - **Safety（任何档位都不可删）**：输入校验、防数据丢失的错误处理、安全措施、无障碍、明确验收项、先理解问题、「最小 diff ≠ 正确修复」。
+  - **`lite`**：完整交付明确要求；可以一句话指出更简方案，但**不挑战明确需求**；输出可略完整。
+  - **`full`（默认）**：完整七级阶梯（YAGNI → 复用 → 标准库 → 原生 → 已装依赖 → 一行 → 最小实现），默认选最短正确实现，修根因而非症状。
+  - **`ultra`**：YAGNI 极端（先删后加）；主动质疑投机性功能/缓存/抽象/配置/新依赖；复杂需求先给最小正确版并说明完整版条件；**不是无脑拒绝**。
+  - `off`：完全不注入。
+  - 档位**会话级**（会话 A 不影响会话 B，会话结束自动释放）。
+  - 裸 `/ponytail`：已启用时只报告；`off` 时恢复到有效默认档（默认也是 `off` 则回 `full`）。
   - `/ponytail status`：只查询、永不修改。
   - `/ponytail lite|full|ultra|off`：显式切换。
-  - `/ponytail default <mode>`：持久化默认值到配置文件（环境变量仍优先）。
+  - `/ponytail default <mode>`：持久化默认值到**用户级配置文件**（env/Profile 仍优先，命令分别提示 saved 与 effective）。
 - **一次性技能**（用哪个载哪个，不进常驻 prompt）：
   - `/ponytail-review` — 针对最近改动找过度工程，一行一条：位置 + 删什么 + 替代。
   - `/ponytail-audit` — 全仓库过度工程审计，排序清单。
@@ -45,23 +52,53 @@ dsh plugin --profile web add @mengyuly/dsh-ponytail
   - `/ponytail-gain` — 收益计分板（更少代码/更省成本/更快）。
   - `/ponytail-help` — 参考卡。
 - **停用**：说 `stop ponytail` 或 `normal mode`（兼容中英文句末标点）；随时 `/ponytail` 恢复。
-- **默认值**：环境变量 `PONYTAIL_DEFAULT_MODE` > `~/.config/ponytail/config.json`（Windows：`%APPDATA%\ponytail\config.json`）的 `{"defaultMode": "lite"}` > `full`。`/ponytail default` 写入的是配置文件，**环境变量设置且合法时仍压过保存值**（命令会分别提示 saved 与 effective）。
-- **子代理**：常驻段作用于当前会话自身；DSH 内置 `subagent` 工具跑的是隔离的全新子代理、不继承本 persona。`PONYTAIL_SUBAGENT_MATCHER`（匹配子代理 `agentPreset` 的正则）用于在 harness 会下发给子代理的场景里排除指定子代理；缺省全部注入。
-- **配置错误**：非法 JSON / 非法 `defaultMode` / 读取失败 / 非法正则只告警一次（不刷屏）；配置文件不存在属正常、不告警；热更新遇到临时非法内容保留上一个合法默认值。
+- **默认值优先级**（代码/测试/文档一致）：
+  ```
+  会话 override > PONYTAIL_DEFAULT_MODE > Profile config.defaultMode > 用户 config.json > full
+  ```
+  - **Profile 级配置**（Cordis 官方插件配置 API，各 profile 可不同）：
+    ```yaml
+    # ~/.dsh/profiles/tui/cordis.patch.yml 中给 ponytail 行补 config
+    - insert:
+        - id: ponytail
+          name: '@mengyuly/dsh-ponytail'
+          config:
+            defaultMode: lite
+    ```
+    例：`web → full`、`tui → lite`、`automation → off`。Profile 配置在插件初始化时读取（Cordis 无公开配置变更事件），**改后需重启该 profile**；非法值只告警一次并回退，不影响启动。用户 `config.json` 仍保持热更新。
+  - **用户 config.json**（`~/.config/ponytail/config.json`，Windows `%APPDATA%\ponytail\config.json`）：`{"defaultMode": "lite"}`，热更新（~1s 轮询），非法内容保留上次合法值。
+- **子代理（如实边界）**：DSH 内置 `subagent` 工具是**隔离派生**，默认**不继承**本插件的 system-prompt；`PONYTAIL_SUBAGENT_MATCHER`（匹配子代理 `agentPreset` 的正则）**只用于筛选能进入本 Prompt 管线的子代理**，不是继承开关；DSH 当前没有公开的子代理派生/可继承 Prompt API，因此**未实现、也不宣称父子 Prompt 继承**（有官方 API 后再考虑只读快照传播）。非法正则告警一次并 fail-open。
+- **配置错误**：非法 JSON / 非法 `defaultMode` / 读取失败 / 非法正则只告警一次（不刷屏）；配置文件不存在属正常、不告警。
 
 ## 效率
 
-- 常驻注入 ≈ 1.3k tokens/请求，`off` 归零；同模式字节级稳定，KV-cache 前缀命中，切模式后才重算一次。
+- 常驻注入：**lite ≈ 369 / full ≈ 420 / ultra ≈ 406 tokens**（结构化片段，不再是 ~1.3k）；`off` 归零；同模式字节级稳定，KV-cache 前缀命中。
 - 一次性技能 300–540 tokens 一个，零常驻开销。
 - 实测同任务 A/B：ponytail 臂 34 行 vs 完整实现臂 272 行，均标准库、均自测通过。
 
 ## 已知限制
 
-- 强度档位只切换阶梯表格/示例，阶梯正文恒定；lite/full/ultra 体积差异很小（行为倾向，非大小差异）。
+- 档位差异在**规则语义**上（见上），三者体积相近（≤ 满档 ×1.25）。
 - 上游 Claude 专属的 statusline 徽标无 DSH 对应物，MCP 服务器因 DSH 有一等 system-prompt 注入点而弃用。
-- 配置文件的默认档位热更新（fs 轮询 ~1s，作用于无覆盖的会话）；环境变量改动仍需重启。
+- 用户 `config.json` 热更新；`PONYTAIL_DEFAULT_MODE` 与 Profile config 需重启生效。
 - 发行 `lib/` 是预编译产物；改源码请回主仓重建后同步。
 
+## 兼容矩阵（实测，不虚构）
+
+| 组件 | 已验证环境 | 备注 |
+|---|---|---|
+| Node.js | 22.x / 24.x | CI 矩阵 4 组合全绿 |
+| OS | ubuntu-latest / windows-latest | CI 矩阵 |
+| DSH | commit `b150a551`（构建所用 checkout） | 与正式发布版本的精确对应关系**待确认** |
+| Cordis | 4.0.1（构建所用 vendor） | 同上 |
+| web profile | 已验证 | 本机真实 profile 长期运行 + 三路径隔离安装实测（npm / GitHub / tgz） |
+| tui profile | 未验证 | 未在 tui profile 中启动测试 |
+| headless profile | 未验证 | 未完整启动；插件单元测试运行于无 UI 环境 |
+| npm tarball | 已验证 | 内容/版本/安装后 smoke/NodeNext consumer |
+
+- `dist-provenance.json` 记录实际构建来源（checkout commit + node/typescript/tsdown/cordis 版本）。
+- 不要用 `continue-on-error` 掩盖失败——矩阵全绿才是绿。
+
 ## 测试环境与权威关系
 
 - 本机（Linux，Node.js **v24.16.0**，deepseek-harness checkout 构建）与 CI 矩阵（**ubuntu-latest + windows-latest**，Node 24）上验证通过。与之精确匹配的已发布 DSH/Cordis 版本**待确认**——checkout 是预发布工作树，非发布 tag。
@@ -85,6 +122,7 @@ dsh plugin --profile web add @mengyuly/dsh-ponytail
 - **CI 能力边界（如实）**：CI（ubuntu + windows 矩阵）执行上述静态验证与打包/消费测试，但**不重新构建权威 monorepo**；`verify:dist` 是导出表面/签名/运行时导出的一致性检查，**不是**与权威构建的字节级等价证明——后者由 `sync:dist` 在发布流程中保证。
 - `dist-provenance.json` 随 npm 包发布，便于审计构建来源。
 - 本机验证时若 `npm_execpath` 指向其他包管理器（如 pnpm/yarn shim），脚本会自动回退到 PATH 上的 `npm`；临时目录失败时保留需设 `PONYTAIL_VERIFY_KEEP_TEMP=1`。
+- **安全**：`scripts/**` 仅用于开发/构建/发行验证，**不进入 npm tarball**、无安装生命周期钩子、运行时入口不引用；`child_process` 告警属于可接受的开发工具风险。详见 [SECURITY.md](SECURITY.md)。
 
 ## 许可
 

package/dist-provenance.json

@@ -5,6 +5,7 @@
   "generatedBy": {
     "node": "v24.16.0",
     "typescript": "6.0.3",
-    "tsdown": "0.22.2"
+    "tsdown": "0.22.2",
+    "cordis": "4.0.1"
   }
 }

package/lib/index.js

@@ -1366,21 +1366,25 @@ function configPath(env = process.env) {
 	return join(configDir(env), "config.json");
 }
 /**
-* Read the configured default with diagnostics: environment variable first,
-* then the config file, then `full`. A missing config file is normal and
-* yields no issue; a broken one yields the fallback mode plus one issue for
-* the caller to warn about once.
+* Read the configured default with diagnostics. Priority:
+* `PONYTAIL_DEFAULT_MODE` → Cordis profile `defaultMode` → user config file →
+* `full`. A missing config file is normal and yields no issue; a broken one
+* yields the fallback mode plus one issue for the caller to warn about once.
+* @param env - the process environment to read.
+* @param profileMode - the validated Cordis profile `defaultMode`, or `null`
+*   when the profile config is absent or invalid (invalid values are reported
+*   by the caller; this function only consumes valid ones).
 */
-function readDefaultModeInfo(env = process.env) {
+function readDefaultModeInfo(env = process.env, profileMode = null) {
 	const path = configPath(env);
 	const envMode = normalizeRuntimeMode(env.PONYTAIL_DEFAULT_MODE);
 	let configText;
 	try {
 		configText = readFileSync(path, "utf8");
 	} catch (error) {
-		if (error.code === "ENOENT") return { mode: envMode ?? "full" };
+		if (error.code === "ENOENT") return { mode: envMode ?? profileMode ?? "full" };
 		return {
-			mode: envMode ?? "full",
+			mode: envMode ?? profileMode ?? "full",
 			issue: {
 				kind: "read",
 				detail: `${path}: ${error.message}`
@@ -1412,6 +1416,10 @@ function readDefaultModeInfo(env = process.env) {
 		mode: envMode,
 		...configIssue ? { issue: configIssue } : {}
 	};
+	if (profileMode) return {
+		mode: profileMode,
+		...configIssue ? { issue: configIssue } : {}
+	};
 	if (configIssue) return {
 		mode: DEFAULT_MODE,
 		issue: configIssue
@@ -1420,10 +1428,19 @@ function readDefaultModeInfo(env = process.env) {
 }
 /**
 * Read the configured default for this host: environment variable first, then
-* the config file, then `full`.
+* the Cordis profile `defaultMode`, then the user config file, then `full`.
+*/
+function readDefaultMode(env = process.env, profileMode = null) {
+	return readDefaultModeInfo(env, profileMode).mode;
+}
+/**
+* Why a `saved` default is not the effective one — for the `/ponytail default`
+* result message. `null` means the saved value is effective.
 */
-function readDefaultMode(env = process.env) {
-	return readDefaultModeInfo(env).mode;
+function defaultOverrideReason(env, profileMode) {
+	if (normalizeRuntimeMode(env.PONYTAIL_DEFAULT_MODE)) return "PONYTAIL_DEFAULT_MODE";
+	if (profileMode) return "profile configuration";
+	return null;
 }
 /**
 * Persist a new default level to the config file, preserving other fields.
@@ -1514,55 +1531,102 @@ function isSubagentSession(header) {
 //#endregion
 //#region lib/types/instructions.js
 /**
-* Build the mode-filtered ponytail ruleset. Ported from the upstream
-* `hooks/ponytail-instructions.js`, so the injected text is byte-for-byte the
-* same ruleset every other host emits, filtered to the active intensity.
+* Structured ponytail ruleset composition. Each intensity is built from
+* explicit fragments — common rules, a never-cut safety boundary list, and
+* the mode's own rules — instead of filtering one Markdown body with regexes.
+* The three intensities therefore differ in their actual instructions, not
+* just in a table row.
 *
 * @module @deepseek-ai/dsh-ponytail
 */
+/** Shared identity line, carried by every non-`off` mode. */
+const INTRO = "You are a lazy senior developer. Lazy means efficient, not careless. The best code is the code never written.";
 /**
-* Keep a line of the skill body only when it belongs to every mode or to the
-* active one. Both shape-sensitive spots (the intensity table rows and the
-* quoted worked examples) are keyed by a mode name; ordinary rules survive
-* verbatim, even ones whose prose starts with a mode-looking word.
+* Understanding-and-reuse baseline, identical in every non-`off` mode.
 */
-function filterSkillBodyForMode(body, mode) {
-	const effective = normalizeRuntimeMode(mode) ?? "full";
-	return body.split(/\r?\n/).filter((line) => {
-		const tableLabel = line.match(/^\|\s*\*\*(.+?)\*\*\s*\|/);
-		if (tableLabel) {
-			const labelMode = normalizeRuntimeMode(tableLabel[1]);
-			if (labelMode) return labelMode === effective;
-		}
-		const exampleLabel = line.match(/^-\s*([^:]+):\s*"/);
-		if (exampleLabel) {
-			const labelMode = normalizeRuntimeMode(exampleLabel[1]);
-			if (labelMode) return labelMode === effective;
-		}
-		return true;
-	}).join("\n");
-}
-/** Minimal instruction set if the skill body can't be read (parity fallback). */
-function fallbackInstructions(mode) {
-	return "PONYTAIL MODE ACTIVE — level: " + mode + "\n\nYou are a lazy senior developer. Lazy means efficient, not careless. The best code is the code never written.\n\n## Persistence\n\nACTIVE EVERY RESPONSE. No drift back to over-building. Still active if unsure. Off only: \"stop ponytail\" / \"normal mode\".\n\nCurrent level: **" + mode + "**. Switch: `/ponytail lite|full|ultra`.\n\n## The ladder\n\nBefore any code, stop at the first rung that holds (the ladder runs after you understand the problem, not instead of it — read the code it touches and trace the real flow first):\n1. Does this need to be built at all? (YAGNI)\n2. Does it already exist in this codebase? Reuse what is already here, do not re-write it.\n3. Does the standard library do this? Use it.\n4. Does a native platform feature cover it? Use it.\n5. Does an already-installed dependency solve it? Use it.\n6. Can this be one line? Make it one line.\n7. Only then: write the minimum code that works.\n\nBug fix = root cause, not symptom: grep every caller of the function you touch and fix the shared function once (a smaller diff than one guard per caller); patching only the path the ticket names leaves a sibling caller broken.\n\n## Rules\n\nNo abstractions that were not requested. No avoidable dependencies. No boilerplate nobody asked for. Deletion over addition. Boring over clever. Fewest files possible. Ship the lazy version and question the complex request in the same response — never stall. Between two same-size stdlib options, pick the one correct on edge cases. Mark deliberate simplifications that cut a real corner with a known ceiling, using a `ponytail:` comment that names the ceiling and upgrade path.\n\n## Output\n\nCode first. Then at most three short lines: what was skipped, when to add it. If the explanation is longer than the code, delete the explanation. Explanation the user explicitly asked for is not debt, give it in full.\n\n## When NOT to be lazy\n\nNever simplify away: understanding the problem (read it fully and trace the real flow before picking a rung — a small diff you do not understand is just laziness dressed up as efficiency), input validation at trust boundaries, error handling that prevents data loss, security measures, accessibility basics, the calibration real hardware needs (the platform is never the spec ideal), anything the user explicitly asked to keep. Lazy code without its check is unfinished: non-trivial logic leaves ONE runnable check behind (assert-based demo/self-check or one small test file; no frameworks). Trivial one-liners need no test.\n\n## Boundaries\n\nPonytail governs what you build, not how you talk. \"stop ponytail\" or \"normal mode\": revert. Level persists until changed.";
+const COMMON_RULES = [
+	"Understand the problem before choosing a solution: read the code the change touches and trace the real flow end to end. Laziness that skips comprehension ships a confident wrong fix.",
+	"Reuse what already exists in this codebase before writing anything new.",
+	"Reach for the standard library, platform-native features, and already-installed dependencies before custom code.",
+	"A non-trivial change leaves ONE minimal runnable check behind (an assert-based self-check or one small test file; no frameworks). Trivial one-liners need no test.",
+	"Explain briefly, but never omit the key decisions."
+].join("\n");
+/**
+* The never-cut list. Every non-`off` mode keeps these; intensities tune how
+* aggressively code is minimized, never what may be dropped.
+*/
+const SAFETY_BOUNDARIES = [
+	"Never cut, in any mode:",
+	"- Input validation at trust boundaries.",
+	"- Error handling that prevents data loss.",
+	"- Security measures.",
+	"- Accessibility basics.",
+	"- Explicit acceptance criteria the user asked for.",
+	"- Understanding the problem and tracing the real flow first.",
+	"- \"Minimal diff\" is not a substitute for \"correct fix\"."
+].join("\n");
+const MODE_RULES = {
+	lite: [
+		"Complete what is explicitly asked, including every acceptance criterion.",
+		"Prefer reuse, the standard library, native features, and installed dependencies.",
+		"You may name a simpler alternative in one line, but do not challenge or reject an explicit requirement.",
+		"Output may be a little more complete than full; never cut an acceptance item to save lines."
+	].join("\n"),
+	full: [
+		"The ladder — stop at the first rung that holds:",
+		"1. Does this need to exist at all? (YAGNI)",
+		"2. Does it already exist in this codebase? Reuse it.",
+		"3. Does the standard library do it? Use it.",
+		"4. Does a native platform feature cover it? Use it.",
+		"5. Does an already-installed dependency solve it? Use it.",
+		"6. Can this be one line? Make it one line.",
+		"7. Only then: the minimum code that works.",
+		"Default to the shortest correct implementation; prefer deletion and reuse.",
+		"Fix root causes, not symptoms: one guard in the shared function beats a guard in every caller."
+	].join("\n"),
+	ultra: [
+		"YAGNI extremist: default to deletion before addition.",
+		"Actively question speculative features, caches, abstractions, configuration, and new dependencies.",
+		"Prefer one-liners, the standard library, and native capabilities.",
+		"Minimize files, dependencies, and code — but never the safety boundaries or acceptance criteria above.",
+		"For a complex request: ship the minimal correct version first and state what the full version would require.",
+		"Ultra is not \"refuse everything\": honor explicit user requirements."
+	].join("\n")
+};
+const MODE_LABELS = {
+	lite: "Lite",
+	full: "Full",
+	ultra: "Ultra"
+};
+/** Compose the complete section text for one intensity. */
+function render(effective) {
+	return [
+		`PONYTAIL MODE ACTIVE — level: ${effective}`,
+		"",
+		INTRO,
+		"",
+		"## Common rules (all modes)",
+		COMMON_RULES,
+		"",
+		"## Safety boundaries (never cut)",
+		SAFETY_BOUNDARIES,
+		"",
+		`## ${MODE_LABELS[effective]} rules`,
+		MODE_RULES[effective]
+	].join("\n");
 }
 /**
-* The full injected ruleset for one intensity: the "PONYTAIL MODE ACTIVE"
-* header plus the body filtered down to that mode's rows and examples.
-* Returns an empty string for `off` (ponytail contributes nothing).
+* The injected ruleset for one intensity, composed from the structured
+* fragments above. Returns an empty string for `off` (ponytail contributes
+* nothing). Renders are pure per mode and cached so every turn's bytes stay
+* identical.
 */
 function getPonytailInstructions(mode) {
 	const effective = normalizeRuntimeMode(mode) ?? "full";
 	if (effective === "off") return "";
 	const cached = instructionCache.get(effective);
 	if (cached !== void 0) return cached;
-	let body;
-	try {
-		body = filterSkillBodyForMode(PONYTAIL_SKILL_BODY, effective);
-	} catch {
-		return fallbackInstructions(effective);
-	}
-	const rendered = "PONYTAIL MODE ACTIVE — level: " + effective + "\n\n" + body;
+	const rendered = render(effective);
 	instructionCache.set(effective, rendered);
 	return rendered;
 }
@@ -1660,7 +1724,7 @@ function registerCommands(deps, commandCtx) {
 					kind: "error",
 					text: "Usage: /ponytail default [lite|full|ultra|off]"
 				};
-				const effective = readDefaultMode();
+				const effective = readDefaultMode(process.env, deps.profileMode);
 				deps.setDefault(effective);
 				if (written === effective) {
 					agent.steer(createUserMessage({
@@ -1678,10 +1742,11 @@ function registerCommands(deps, commandCtx) {
 						text: `Ponytail default set — new sessions start in ${written}.`
 					};
 				}
+				const reason = defaultOverrideReason(process.env, deps.profileMode) ?? "PONYTAIL_DEFAULT_MODE";
 				agent.steer(createUserMessage({
 					content: [{
 						type: "text",
-						text: `PONYTAIL DEFAULT SET — saved ${written}, effective ${effective} (PONYTAIL_DEFAULT_MODE).`
+						text: `PONYTAIL DEFAULT SET — saved ${written}, effective ${effective} (${reason}).`
 					}],
 					source: {
 						kind: "plugin",
@@ -1690,7 +1755,7 @@ function registerCommands(deps, commandCtx) {
 				}));
 				return {
 					kind: "success",
-					text: `Saved default: ${written}. Effective default: ${effective}, overridden by PONYTAIL_DEFAULT_MODE.`
+					text: `Saved default: ${written}. Effective default: ${effective}, overridden by ${reason}.`
 				};
 			}
 			if (input === "status") return {
@@ -1799,7 +1864,9 @@ function descriptionFor(skill) {
 * Register the always-on ruleset section, the runtime skills, the slash
 * commands, and the plain-text deactivation listener.
 */
-function apply(ctx) {
+function apply(ctx, config = {}) {
+	const profileMode = normalizeRuntimeMode(config.defaultMode);
+	if (config.defaultMode !== void 0 && profileMode === null) ctx.logger.warn(`[ponytail] profile config defaultMode is not lite|full|ultra|off: ${JSON.stringify(config.defaultMode)}; falling back`);
 	let defaultMode = null;
 	const warned = /* @__PURE__ */ new Set();
 	const warnOnce = (key, message) => {
@@ -1808,7 +1875,7 @@ function apply(ctx) {
 		ctx.logger.warn(`[ponytail] ${message}`);
 	};
 	const refreshDefault = () => {
-		const resolution = readDefaultModeInfo();
+		const resolution = readDefaultModeInfo(process.env, profileMode);
 		if (resolution.issue) warnOnce(`default:${resolution.issue.kind}`, `${resolution.issue.detail}; using ${resolution.mode}`);
 		defaultMode = resolution.mode;
 		return defaultMode;
@@ -1823,7 +1890,7 @@ function apply(ctx) {
 	if (matcherResult.invalid) warnOnce("matcher:invalid", "PONYTAIL_SUBAGENT_MATCHER is not a valid regular expression; ignoring it (fail-open).");
 	const configFile = configPath();
 	const onConfigChange = () => {
-		const resolution = readDefaultModeInfo();
+		const resolution = readDefaultModeInfo(process.env, profileMode);
 		if (resolution.issue) {
 			warnOnce(`config:${resolution.issue.kind}`, `${resolution.issue.detail}; keeping the previous default`);
 			return;
@@ -1853,6 +1920,7 @@ function apply(ctx) {
 		registerCommands({
 			ctx,
 			store,
+			profileMode,
 			defaultMode: readDefault,
 			setDefault
 		}, commandCtx);

package/lib/types/index.d.ts

@@ -15,6 +15,19 @@
 import type { Context } from '@deepseek-ai/cordis';
 export declare const name = "ponytail";
 export declare const inject: string[];
+/**
+ * Cordis profile-level configuration (set per profile via the bundle row's
+ * `config` in a profile patch). `defaultMode` sits between the environment
+ * variable and the user config file in the default-resolution chain.
+ *
+ * No `Config` schema is exported on purpose: cordis passes the raw config
+ * through unvalidated then, so an invalid `defaultMode` falls back with a
+ * one-time warning instead of failing the plugin mount.
+ */
+export interface PonytailConfig {
+    /** Profile-scoped default intensity, e.g. `web → full`, `tui → lite`. */
+    defaultMode?: unknown;
+}
 /** Extract the plain text of one user message (only its text blocks). */
 export declare function messageText(message: {
     content: readonly {
@@ -33,4 +46,4 @@ export declare function containsDeactivation(messages: readonly {
  * Register the always-on ruleset section, the runtime skills, the slash
  * commands, and the plain-text deactivation listener.
  */
-export declare function apply(ctx: Context): void;
+export declare function apply(ctx: Context, config?: PonytailConfig): void;

package/lib/types/instructions.d.ts

@@ -1,23 +1,17 @@
 /**
- * Build the mode-filtered ponytail ruleset. Ported from the upstream
- * `hooks/ponytail-instructions.js`, so the injected text is byte-for-byte the
- * same ruleset every other host emits, filtered to the active intensity.
+ * Structured ponytail ruleset composition. Each intensity is built from
+ * explicit fragments — common rules, a never-cut safety boundary list, and
+ * the mode's own rules — instead of filtering one Markdown body with regexes.
+ * The three intensities therefore differ in their actual instructions, not
+ * just in a table row.
  *
  * @module @deepseek-ai/dsh-ponytail
  */
 import { type PonytailRuntimeMode } from './modes.ts';
 /**
- * Keep a line of the skill body only when it belongs to every mode or to the
- * active one. Both shape-sensitive spots (the intensity table rows and the
- * quoted worked examples) are keyed by a mode name; ordinary rules survive
- * verbatim, even ones whose prose starts with a mode-looking word.
- */
-export declare function filterSkillBodyForMode(body: string, mode: PonytailRuntimeMode | null | undefined): string;
-/** Minimal instruction set if the skill body can't be read (parity fallback). */
-export declare function fallbackInstructions(mode: PonytailRuntimeMode): string;
-/**
- * The full injected ruleset for one intensity: the "PONYTAIL MODE ACTIVE"
- * header plus the body filtered down to that mode's rows and examples.
- * Returns an empty string for `off` (ponytail contributes nothing).
+ * The injected ruleset for one intensity, composed from the structured
+ * fragments above. Returns an empty string for `off` (ponytail contributes
+ * nothing). Renders are pure per mode and cached so every turn's bytes stay
+ * identical.
  */
 export declare function getPonytailInstructions(mode: PonytailRuntimeMode | null | undefined): string;

package/lib/types/modes.d.ts

@@ -47,17 +47,26 @@ export interface DefaultModeResolution {
     readonly issue?: DefaultModeIssue;
 }
 /**
- * Read the configured default with diagnostics: environment variable first,
- * then the config file, then `full`. A missing config file is normal and
- * yields no issue; a broken one yields the fallback mode plus one issue for
- * the caller to warn about once.
+ * Read the configured default with diagnostics. Priority:
+ * `PONYTAIL_DEFAULT_MODE` → Cordis profile `defaultMode` → user config file →
+ * `full`. A missing config file is normal and yields no issue; a broken one
+ * yields the fallback mode plus one issue for the caller to warn about once.
+ * @param env - the process environment to read.
+ * @param profileMode - the validated Cordis profile `defaultMode`, or `null`
+ *   when the profile config is absent or invalid (invalid values are reported
+ *   by the caller; this function only consumes valid ones).
  */
-export declare function readDefaultModeInfo(env?: NodeJS.ProcessEnv): DefaultModeResolution;
+export declare function readDefaultModeInfo(env?: NodeJS.ProcessEnv, profileMode?: PonytailRuntimeMode | null): DefaultModeResolution;
 /**
  * Read the configured default for this host: environment variable first, then
- * the config file, then `full`.
+ * the Cordis profile `defaultMode`, then the user config file, then `full`.
  */
-export declare function readDefaultMode(env?: NodeJS.ProcessEnv): PonytailRuntimeMode;
+export declare function readDefaultMode(env?: NodeJS.ProcessEnv, profileMode?: PonytailRuntimeMode | null): PonytailRuntimeMode;
+/**
+ * Why a `saved` default is not the effective one — for the `/ponytail default`
+ * result message. `null` means the saved value is effective.
+ */
+export declare function defaultOverrideReason(env: NodeJS.ProcessEnv, profileMode: PonytailRuntimeMode | null): 'PONYTAIL_DEFAULT_MODE' | 'profile configuration' | null;
 /**
  * Persist a new default level to the config file, preserving other fields.
  * Returns the normalized mode, or `null` when the value is not a runtime mode.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mengyuly/dsh-ponytail",
   "description": "Lazy senior dev mode for DeepSeek Harness: always-on minimal-code ruleset, intensity switching, and short review/audit/debt/gain/help skills",
-  "version": "0.1.6",
+  "version": "0.2.0",
   "publishConfig": {
     "access": "public"
   },