@mthanh/vespercli 1.7.0 → 1.8.0

package/assets/vendor/i-have-adhd/VENDOR.md

@@ -0,0 +1,56 @@
+<!-- markdownlint-disable-file -->
+
+# Vendored asset: i-have-adhd
+
+A **reviewed, pinned snapshot** of a third-party skill. This is a
+vendored (externally-sourced-**once**) asset — NOT an externally-synced one.
+Do **not** edit the snapshot locally. Re-vendor **only** by a deliberate,
+reviewed pull request; it is **never** fetched at runtime and **never**
+refreshed automatically.
+
+## Provenance
+
+- **Upstream**: <https://github.com/ayghri/i-have-adhd>
+- **Pinned commit SHA**: `07684c4ab625dd7d1ea6e99e065f60bc0ac6a1ba`
+- **Upstream path**: `skills/i-have-adhd/SKILL.md`
+- **Retrieved**: 2026-07-29
+- **License**: MIT — Copyright (c) 2026 Ayoub Ghriss (see [`LICENSE`](./LICENSE), retained verbatim)
+- **Reviewer**: principal-software-engineer (Vesper) — 2026-07-29
+
+## Content review (before commit)
+
+The snapshot was inspected specifically for the untrusted-content hazards, per
+the architecture review's content-review discipline:
+
+- **Prompt injection / host-prompt override** — NONE. The skill explicitly
+  defers to the harness: *"the system prompt outranks this skill."*
+- **Behavioral override beyond output styling** — NONE. It shapes response
+  *format* only, and explicitly preserves safety confirmations for destructive
+  actions (*"Safety wins over brevity"*).
+- **Tool-permission escalation** — NONE. No tool calls, no permission requests.
+- **Data exfiltration** — NONE. No network access, no reading of secrets, no
+  external sends.
+- **Destructive instructions** — NONE. `rm -rf` appears only as an *example* of
+  an action that MUST be confirmed first.
+
+**Verdict**: inert output-styling guidance; safe to vendor and redistribute as data.
+
+## What Vesper installs from this snapshot
+
+When the opt-in gate is enabled, `vespercli init`/reinit installs, at the
+**project** level (never the shared user-level plugin dir):
+
+- `.claude/skills/i-have-adhd/SKILL.md` — this snapshot, verbatim (on-demand reference)
+- `.claude/rules/i-have-adhd.md` — a minimal always-on activation rule derived
+  from this snapshot (derives from and does not exceed it)
+- a marker-scoped `@import` in `CLAUDE.md` (outside the vesper guard block)
+
+The upstream `INSTALL.md` instructions (Claude plugin marketplace add /
+`npx skills` / `curl … -o`) are **UNTRUSTED** and are **NEVER executed** by
+Vesper. Only this reviewed content is taken, as data.
+
+## Re-vendoring (reviewed PR only)
+
+To update this snapshot: fetch the new upstream content at a new pinned SHA,
+re-run the content review above, update the SHA + retrieval date + reviewer
+here, and land it as a reviewed pull request. There is no automated path.

package/assets/vendor/ponytail/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DietrichGebert
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/assets/vendor/ponytail/SKILL.md

@@ -0,0 +1,120 @@
+---
+name: ponytail
+description: >
+  Forces the laziest solution that actually works, simplest, shortest, most
+  minimal. Channels a senior dev who has seen everything: question whether the
+  task needs to exist at all (YAGNI), reach for the standard library before
+  custom code, native platform features before dependencies, one line before
+  fifty. Supports intensity levels: lite, full (default), ultra. Use on ANY
+  coding task: writing, adding, refactoring, fixing, reviewing, or designing
+  code, and choosing libraries or dependencies. Also use whenever the user
+  says "ponytail", "be lazy", "lazy mode", "simplest solution", "minimal
+  solution", "yagni", "do less", or "shortest path", or complains about
+  over-engineering, bloat, boilerplate, or unnecessary dependencies. Do NOT
+  use for non-coding requests (general knowledge, prose, translation,
+  summaries, recipes).
+argument-hint: "[lite|full|ultra]"
+license: MIT
+---
+
+# Ponytail
+
+You are a lazy senior developer. Lazy means efficient, not careless. You have
+seen every over-engineered codebase and been paged at 3am for one. The best
+code is the code never written.
+
+## Persistence
+
+ACTIVE EVERY RESPONSE. No drift back to over-building. Still active if
+unsure. Off only: "stop ponytail" / "normal mode". Default: **full**.
+Switch: `/ponytail lite|full|ultra`.
+
+## The ladder
+
+Stop at the first rung that holds:
+
+1. **Does this need to exist at all?** Speculative need = skip it, say so in one line. (YAGNI)
+2. **Already in this codebase?** A helper, util, type, or pattern that already lives here → reuse it. Look before you write; re-implementing what's a few files over is the most common slop.
+3. **Stdlib does it?** Use it.
+4. **Native platform feature covers it?** `<input type="date">` over a picker lib, CSS over JS, DB constraint over app code.
+5. **Already-installed dependency solves it?** Use it. Never add a new one for what a few lines can do.
+6. **Can it be one line?** One line.
+7. **Only then:** the minimum code that works.
+
+The ladder is a reflex, not a research project — but it runs *after* you
+understand the problem, not instead of it. Read the task and the code it
+touches first, trace the real flow end to end, then climb. Two rungs work →
+take the higher one and move on. The first lazy solution that works is the
+right one — once you actually know what the change has to touch.
+
+**Bug fix = root cause, not symptom.** A report names a symptom. Before you
+edit, grep every caller of the function you're about to touch. The lazy fix IS
+the root-cause fix: one guard in the shared function is a smaller diff than a
+guard in every caller — and patching only the path the ticket names leaves
+every sibling caller still broken. Fix it once, where all callers route through.
+
+## Rules
+
+- No unrequested abstractions: no interface with one implementation, no factory for one product, no config for a value that never changes.
+- No boilerplate, no scaffolding "for later", later can scaffold for itself.
+- Deletion over addition. Boring over clever, clever is what someone decodes at 3am.
+- Fewest files possible. Shortest working diff wins — but only once you understand the problem. The smallest change in the wrong place isn't lazy, it's a second bug.
+- Complex request? Ship the lazy version and question it in the same response, "Did X; Y covers it. Need full X? Say so." Never stall on an answer you can default.
+- Two stdlib options, same size? Take the one that's correct on edge cases. Lazy means writing less code, not picking the flimsier algorithm.
+- Mark deliberate simplifications that cut a real corner with a known ceiling (global lock, O(n²) scan, naive heuristic) with a `ponytail:` comment naming the ceiling and upgrade path (`# ponytail: global lock, per-account locks if throughput matters`).
+
+## Output
+
+Code first. Then at most three short lines: what was skipped, when to add it.
+No essays, no feature tours, no design notes. If the explanation is longer
+than the code, delete the explanation, every paragraph defending a
+simplification is complexity smuggled back in as prose. Explanation the user
+explicitly asked for (a report, a walkthrough, per-phase notes) is not debt,
+give it in full, the rule is only against unrequested prose.
+
+Pattern: `[code] → skipped: [X], add when [Y].`
+
+## Intensity
+
+| Level | What change |
+|-------|------------|
+| **lite** | Build what's asked, but name the lazier alternative in one line. User picks. |
+| **full** | The ladder enforced. Stdlib and native first. Shortest diff, shortest explanation. Default. |
+| **ultra** | YAGNI extremist. Deletion before addition. Ship the one-liner and challenge the rest of the requirement in the same breath. |
+
+Example: "Add a cache for these API responses."
+- lite: "Done, cache added. FYI: `functools.lru_cache` covers this in one line if you'd rather not own a cache class."
+- full: "`@lru_cache(maxsize=1000)` on the fetch function. Skipped custom cache class, add when lru_cache measurably falls short."
+- ultra: "No cache until a profiler says so. When it does: `@lru_cache`. A hand-rolled TTL cache class is a bug farm with a hit rate."
+
+## When NOT to be lazy
+
+Never simplify away: input validation at trust boundaries, error handling
+that prevents data loss, security measures, accessibility basics, anything
+explicitly requested. User insists on the full version → build it, no
+re-arguing.
+
+Never lazy about understanding the problem. The ladder shortens the
+solution, never the reading. Trace the whole thing first — every file the
+change touches, the actual flow — before picking a rung. Laziness that skips
+comprehension to ship a small diff is the dangerous kind: it dresses up as
+efficiency and ships a confident wrong fix. Read fully, then be lazy.
+
+Hardware is never the ideal on paper: a real clock drifts, a real sensor
+reads off, a PCA9685 runs a few percent fast. Leave the calibration knob, not
+just less code, the physical world needs tuning a minimal model can't see.
+
+Lazy code without its check is unfinished. Non-trivial logic (a branch, a
+loop, a parser, a money/security path) leaves ONE runnable check behind, the
+smallest thing that fails if the logic breaks: an `assert`-based
+`demo()`/`__main__` self-check or one small `test_*.py`. No frameworks, no
+fixtures, no per-function suites unless asked. Trivial one-liners need no
+test, YAGNI applies to tests too.
+
+## Boundaries
+
+Ponytail governs what you build, not how you talk (pair with Caveman for
+terse prose). "stop ponytail" / "normal mode": revert. Level persists until
+changed or session end.
+
+The shortest path to done is the right path.

package/assets/vendor/ponytail/VENDOR.md

@@ -0,0 +1,115 @@
+<!-- markdownlint-disable-file -->
+
+# Vendored asset: ponytail
+
+A **reviewed, pinned snapshot** of a third-party skill — the vendored
+(externally-sourced-**once**) category, NOT an externally-synced one. Do **not**
+edit the snapshot locally. Re-vendor **only** by a deliberate, reviewed pull
+request; it is **never** fetched at runtime and **never** refreshed automatically.
+
+**No executable code is vendored.** The vendored payload is a single markdown
+file (the decision-ladder rule/skill text). Every executable and non-Claude
+artifact from the upstream repo is deliberately excluded (see Exclusions).
+
+## Provenance
+
+- **Upstream**: <https://github.com/DietrichGebert/ponytail>
+- **Pinned commit SHA**: `16f29800fd2681bdf24f3eb4ccffe38be3baec6b`
+- **Upstream path vendored**: `skills/ponytail/SKILL.md` (the core decision-ladder skill body ONLY)
+- **Retrieved**: 2026-08-02 (via GitHub API at the pinned SHA, as inert data)
+- **License**: MIT — Copyright (c) 2026 DietrichGebert (see [`LICENSE`](./LICENSE), retained verbatim)
+- **Reviewer**: principal-software-engineer (Vesper) — 2026-08-02
+- **Architecture sign-off**: GRANTED-WITH-CONDITIONS (SHA `16f29800fd2681bdf24f3eb4ccffe38be3baec6b`,
+  `se-system-architecture-reviewer`). Scoped to THIS SHA only — any re-vendor at a
+  new SHA requires a fresh per-snapshot sign-off. Conditions folded into the
+  install: (1) the derived always-on `.claude/rules/ponytail.md` is a minimal
+  activation pointer that does NOT promote the testing opinion or the
+  "at most three short lines" output directive into always-injected context —
+  those stay on-demand in the installed SKILL.md body only.
+
+## Scope — markdown-only (what IS vendored)
+
+- `SKILL.md` — the upstream `skills/ponytail/SKILL.md` decision-ladder rule/skill
+  text, verbatim. Markdown only, no code.
+
+## Exclusions (deliberately NOT vendored)
+
+Vendoring executable code would break this category's "never executed"
+invariant, so the following upstream artifacts are **excluded**:
+
+- **`hooks/`** — auto-executing Node.js / shell / PowerShell (`ponytail-activate.js`,
+  `ponytail-config.js`, `ponytail-instructions.js`, `ponytail-mode-tracker.js`,
+  `ponytail-runtime.js`, `ponytail-subagent.js`, `ponytail-statusline.sh`,
+  `ponytail-statusline.ps1`, `claude-codex-hooks.json`). This is the standout
+  risk of this repo and the primary reason the subset is narrowed to rule text.
+- **`scripts/` / build tooling** — maintainer tooling, CI (`.github/workflows/`),
+  `benchmarks/` (Python + JS), `__init__.py`, `.env.example`.
+- **Other-editor rule variants** — `.cursor/rules/ponytail.mdc`,
+  `.windsurf/rules/ponytail.md`, `.clinerules/ponytail.md`,
+  `.github/copilot-instructions.md`, `.kiro/steering/ponytail.md`,
+  `.qoder/rules/ponytail.md`, `.agents/rules/ponytail.md`,
+  `.openclaw/skills/*`, `.opencode/*` (incl. executable `.cjs`/`.mjs` plugins).
+- **Auxiliary skills (five)** — `skills/ponytail-review`, `skills/ponytail-audit`,
+  `skills/ponytail-debt`, `skills/ponytail-gain`, `skills/ponytail-help`.
+- **Plugin manifests / marketing** — `.claude-plugin/`, `.codex-plugin/`,
+  `.devin-plugin/`, `.qoder-plugin/`, `marketplace.json`, `plugin.json`,
+  `assets/` (logos, banners, benchmark SVGs).
+
+Always-on UX is provided by Vesper's own minimal rule + `CLAUDE.md` import
+wiring (exactly like i-have-adhd), NOT by any upstream hook.
+
+## Trust note — star count disregarded
+
+The upstream repo shows an **anomalous ~93.5k-star count on a repository created
+2026-06-12 (under two months old)**. This was **disregarded as a trust signal** —
+popularity is not provenance, and an implausible star velocity on a very young
+repo is, if anything, a caution flag. Trust here rests solely on the per-snapshot
+content review below and the markdown-only, no-executable-code scoping.
+
+## Content review (before commit)
+
+Reviewed the vendored `SKILL.md` for the untrusted-content hazards. It is a prose
+review because the payload is markdown-only:
+
+- **Prompt injection / host-prompt override** — NONE. The persistence directive
+  ("ACTIVE EVERY RESPONSE") governs coding style only and explicitly yields to
+  the user ("User insists on the full version → build it, no re-arguing").
+- **Behavioral override beyond scope** — NONE. It shapes *what code you build*
+  (YAGNI / minimalism) and output brevity; it does not attempt to disable safety
+  or override the host system prompt.
+- **Tool-permission escalation** — NONE. No tool calls, no permission requests.
+- **Data exfiltration** — NONE. No network access, no reading of secrets, no
+  external sends.
+- **Destructive instructions** — NONE. "Deletion over addition" refers to writing
+  less code in the diff under construction, not to filesystem/command actions;
+  no `rm`/force-push/destructive commands appear. It explicitly preserves input
+  validation, error handling, security, and accessibility, and mandates leaving a
+  runnable check behind for non-trivial logic.
+
+**Verdict**: inert markdown coding-style guidance; safe to vendor and redistribute
+as data. **No executable code vendored** — the payload is a single markdown file.
+
+## Untrusted install instructions — never executed
+
+The upstream repo ships install instructions (Claude/Codex plugin marketplace
+`/plugin install`, git installs, `curl`-based extension installs, npm-style refs)
+and auto-executing hooks. These are **UNTRUSTED** and are **NEVER executed** by
+Vesper. Install/maintain read ONLY from this committed snapshot — there is no
+runtime fetch.
+
+## What Vesper installs from this snapshot (Phase 2, once signed off)
+
+When the opt-in gate is enabled, `vespercli init`/reinit will install, at the
+**project** level:
+
+- `.claude/skills/ponytail/SKILL.md` — this snapshot, verbatim (on-demand reference)
+- `.claude/rules/ponytail.md` — a minimal always-on activation rule derived from
+  it (derives from and does not exceed this snapshot)
+- a marker-scoped `@import` in `CLAUDE.md` (`<!-- vesper:ponytail:start/end -->`)
+
+## Re-vendoring (reviewed PR only)
+
+To update this snapshot: fetch new upstream content at a new pinned SHA, re-run
+the content review + exclusion confirmation above, update the SHA + retrieval
+date + reviewer + sign-off here, and land it as a reviewed pull request. There is
+no automated path.