@sayknow-cli/coding-agent 0.2.6 → 0.3.0

package/src/config/model-registry.ts

@@ -70,7 +70,7 @@ export function isAuthenticated(apiKey: string | undefined | null): apiKey is st
 	return Boolean(apiKey) && apiKey !== kNoAuth;
 }
 
-export type ModelRole = "default";
+export type ModelRole = "default" | "vision";
 
 export interface ModelRoleInfo {
 	tag?: string;
@@ -80,11 +80,12 @@ export interface ModelRoleInfo {
 
 export const MODEL_ROLES: Record<ModelRole, ModelRoleInfo> = {
 	default: { tag: "DEFAULT", name: "Default", color: "success" },
+	vision: { tag: "VISION", name: "Vision", color: "accent" },
 };
 
-export const MODEL_ROLE_IDS: ModelRole[] = ["default"];
+export const MODEL_ROLE_IDS: ModelRole[] = ["default", "vision"];
 
-export type SkcModelAssignmentTargetId = "default" | "executor" | "architect" | "planner" | "critic";
+export type SkcModelAssignmentTargetId = "default" | "vision" | "executor" | "architect" | "planner" | "critic";
 
 export interface SkcModelAssignmentTargetInfo extends ModelRoleInfo {
 	id: SkcModelAssignmentTargetId;
@@ -93,6 +94,7 @@ export interface SkcModelAssignmentTargetInfo extends ModelRoleInfo {
 
 export const SKC_MODEL_ASSIGNMENT_TARGET_IDS: SkcModelAssignmentTargetId[] = [
 	"default",
+	"vision",
 	"executor",
 	"architect",
 	"planner",
@@ -101,6 +103,7 @@ export const SKC_MODEL_ASSIGNMENT_TARGET_IDS: SkcModelAssignmentTargetId[] = [
 
 export const SKC_MODEL_ASSIGNMENT_TARGETS: Record<SkcModelAssignmentTargetId, SkcModelAssignmentTargetInfo> = {
 	default: { id: "default", tag: "DEFAULT", name: "Default", color: "success", settingsPath: "modelRoles" },
+	vision: { id: "vision", tag: "VISION", name: "Vision", color: "accent", settingsPath: "modelRoles" },
 	executor: {
 		id: "executor",
 		tag: "EXECUTOR",

package/src/config/models-config-schema.ts

@@ -81,7 +81,7 @@ const ModelBindingsSchema = z.object({
 	modelRoles: z.record(z.string(), z.string().min(1)).optional(),
 	agentModelOverrides: z.record(z.string(), z.string().min(1)).optional(),
 });
-export const ProfileRoleSchema = z.enum(["default", "executor", "architect", "planner", "critic"]);
+export const ProfileRoleSchema = z.enum(["default", "vision", "executor", "architect", "planner", "critic"]);
 
 function isValidProfileModelSelector(value: string): boolean {
 	if (value.includes(",")) return false;

package/src/config/settings-schema.ts

@@ -255,6 +255,22 @@ export const SETTINGS_SCHEMA = {
 	"auth.broker.url": { type: "string", default: undefined },
 	"auth.broker.token": { type: "string", default: undefined },
 
+	// Notifications (Telegram bundled reference client)
+	"notifications.enabled": { type: "boolean", default: false },
+	"notifications.telegram.botToken": { type: "string", default: undefined },
+	"notifications.telegram.chatId": { type: "string", default: undefined },
+	"notifications.redact": { type: "boolean", default: false },
+	"notifications.verbosity": {
+		type: "string",
+		default: "lean",
+		validate: (value: string) => value === "lean" || value === "verbose",
+	},
+	"notifications.daemon.idleTimeoutMs": {
+		type: "number",
+		default: 60000,
+		validate: (value: number) => Number.isFinite(value) && value > 0,
+	},
+
 	autoResume: {
 		type: "boolean",
 		default: false,
@@ -2970,6 +2986,38 @@ export const SETTINGS_SCHEMA = {
 	"thinkingBudgets.xhigh": { type: "number", default: 32768 },
 
 	"thinkingBudgets.max": { type: "number", default: 65536 },
+
+	// ────────────────────────────────────────────────────────────────────────
+	// Plugins — security scanner
+	// ────────────────────────────────────────────────────────────────────────
+
+	"plugins.security.scanMode": {
+		type: "enum",
+		values: ["warn", "off", "block"] as const,
+		default: "warn",
+		ui: {
+			tab: "interaction",
+			label: "Plugin Security Scan Mode",
+			description:
+				"warn: scan on install and log advisory findings (default); off: skip scan; block: deny install when score exceeds threshold",
+			options: [
+				{ value: "warn", label: "Warn", description: "Scan and log advisory findings (default)" },
+				{ value: "off", label: "Off", description: "Disable security scanning" },
+				{ value: "block", label: "Block", description: "Deny install when risk score exceeds threshold" },
+			],
+		},
+	},
+
+	"plugins.security.riskThreshold": {
+		type: "number",
+		default: 60,
+		validate: (value: number) => Number.isFinite(value) && value >= 0 && value <= 100,
+		ui: {
+			tab: "interaction",
+			label: "Plugin Security Risk Threshold",
+			description: "Score threshold (0–100) above which block mode denies install. Default 60.",
+		},
+	},
 } as const;
 
 // ═══════════════════════════════════════════════════════════════════════════
@@ -3177,6 +3225,18 @@ export interface ShellMinimizerSettings {
 	maxCaptureBytes: number;
 }
 
+export interface NotificationsSettings {
+	enabled: boolean;
+	telegram: {
+		botToken: string | undefined;
+		chatId: string | undefined;
+	};
+	redact: boolean;
+	daemon: {
+		idleTimeoutMs: number;
+	};
+}
+
 /** Map group prefix -> typed settings interface */
 export interface GroupTypeMap {
 	compaction: CompactionSettings;
@@ -3195,6 +3255,7 @@ export interface GroupTypeMap {
 	modelTags: ModelTagsSettings;
 	cycleOrder: string[];
 	shellMinimizer: ShellMinimizerSettings;
+	notifications: NotificationsSettings;
 }
 
 export type GroupPrefix = keyof GroupTypeMap;

package/src/coordinator/contract.ts

@@ -17,6 +17,9 @@ export const COORDINATOR_MCP_TOOL_NAMES = [
 	"skc_coordinator_read_turn",
 	"skc_coordinator_await_turn",
 	"skc_coordinator_report_status",
+	"skc_delegate_plan",
+	"skc_delegate_execute",
+	"skc_delegate_team",
 ] as const;
 
 export type CoordinatorToolName = (typeof COORDINATOR_MCP_TOOL_NAMES)[number];

package/src/coordinator-mcp/server.ts

@@ -184,7 +184,8 @@ type CoordinatorEventKind =
 	| "question.answered"
 	| "report.written"
 	| "tmux.delivery_succeeded"
-	| "tmux.delivery_failed";
+	| "tmux.delivery_failed"
+	| "delegation.started";
 
 interface CoordinatorEvent {
 	schema_version: 1;
@@ -411,9 +412,116 @@ function toolSchema(name: CoordinatorToolName): {
 			},
 		};
 	}
+	const delegateWorkflow = workflowForDelegateTool(name);
+	if (delegateWorkflow) {
+		return {
+			name,
+			description: delegateToolDescription(delegateWorkflow),
+			inputSchema: {
+				type: "object",
+				properties: {
+					cwd,
+					task: {
+						type: "string",
+						description: "Delegated task or objective to run through the selected SKC workflow.",
+					},
+					prompt: { type: "string", description: "Alias for task; accepted when task is absent." },
+					allow_mutation: allowMutation,
+					session_id: {
+						type: "string",
+						description:
+							"Optional existing SKC coordinator bridge session id to reuse; omitted starts a fresh session.",
+					},
+					queue: {
+						type: "boolean",
+						description: "When reusing a session with an active turn, queue instead of failing.",
+					},
+					force: {
+						type: "boolean",
+						description: "When reusing a session with an active turn, supersede it before sending.",
+					},
+					model: {
+						type: "string",
+						description: "Optional model hint passed in prompt metadata; no provider default is implied.",
+					},
+					await_completion: { type: "boolean", description: "If true, poll the turn until terminal or timeout." },
+					timeout_ms: {
+						type: "number",
+						description: "Bounded await timeout; same cap semantics as skc_coordinator_await_turn.",
+					},
+					poll_interval_ms: { type: "number", description: "Bounded await polling interval." },
+					lines: { type: "number", description: "Bounded advisory tail lines returned with await/read payloads." },
+				},
+				required: ["cwd", "allow_mutation"],
+			},
+		};
+	}
 	return { name, description: "List known scoped SKC coordinator bridge sessions.", inputSchema: common };
 }
 
+type DelegateWorkflow = "plan" | "execute" | "team";
+
+function workflowForDelegateTool(name: string): DelegateWorkflow | null {
+	switch (name) {
+		case "skc_delegate_plan":
+			return "plan";
+		case "skc_delegate_execute":
+			return "execute";
+		case "skc_delegate_team":
+			return "team";
+		default:
+			return null;
+	}
+}
+
+function workflowSkill(workflow: DelegateWorkflow): "ralplan" | "ultragoal" | "team" {
+	switch (workflow) {
+		case "plan":
+			return "ralplan";
+		case "execute":
+			return "ultragoal";
+		case "team":
+			return "team";
+	}
+}
+
+function delegateToolDescription(workflow: DelegateWorkflow): string {
+	switch (workflow) {
+		case "plan":
+			return "Delegate consensus planning to SKC: start a session and run /skill:ralplan to completion, returning durable turn status and artifact references.";
+		case "execute":
+			return "Delegate execution to SKC: start a session and run /skill:ultragoal to completion, returning durable turn status and artifact references.";
+		case "team":
+			return "Delegate parallel team execution to SKC: start a session and run /skill:team to completion, returning durable turn status and artifact references.";
+	}
+}
+
+function workflowPrompt(
+	workflow: DelegateWorkflow,
+	toolName: string,
+	canonicalCwd: string,
+	task: string,
+	options: { mutationRequested: boolean; model?: string | null },
+): string {
+	const skill = workflowSkill(workflow);
+	const model = options.model && options.model.trim().length > 0 ? options.model.trim() : "none";
+	const mutationIntent = options.mutationRequested ? "mutation requested" : "read-only";
+	return [
+		`/skill:${skill}`,
+		"",
+		`Delegated by coordinator MCP tool: ${toolName}`,
+		`Workflow: ${workflow}`,
+		`CWD: ${canonicalCwd}`,
+		`Mutation intent: ${mutationIntent}; coordinator startup policy remains authoritative.`,
+		`Optional model hint: ${model}`,
+		"",
+		"Task:",
+		task,
+		"",
+		"Return durable status and artifact references through SKC runtime/coordinator state. Do not expose host-facing tmux controls.",
+	].join("\n");
+}
+
 function normalizeSession(session: Record<string, unknown>): Record<string, unknown> {
 	return {
 		session_id: session.sessionId ?? session.session_id ?? session.name ?? "unknown",
@@ -424,6 +532,14 @@ function normalizeSession(session: Record<string, unknown>): Record<string, unkn
 	};
 }
 
+async function canonicalizePath(value: string): Promise<string> {
+	try {
+		return await fs.realpath(value);
+	} catch {
+		return path.resolve(value);
+	}
+}
+
 async function ensureDir(dir: string): Promise<void> {
 	await fs.mkdir(dir, { recursive: true });
 }
@@ -1587,6 +1703,159 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 					transport: { mcp: "long_poll", push_subscriptions: false },
 				};
 			}
+			const delegateWorkflow = workflowForDelegateTool(name);
+			if (delegateWorkflow) {
+				requireCoordinatorMutation(config, "sessions", args);
+				const canonicalCwd = await assertCoordinatorWorkdir(config, args.cwd);
+				const hasTask = typeof args.task === "string" && args.task.trim().length > 0;
+				const hasPrompt = typeof args.prompt === "string" && args.prompt.trim().length > 0;
+				const task = hasTask ? String(args.task) : hasPrompt ? String(args.prompt) : null;
+				if (!task) return { ok: false, reason: "task_required" };
+				const promptAliasIgnored = hasTask && hasPrompt;
+				const mutationRequested = args.allow_mutation === true;
+				const taggedPrompt = workflowPrompt(delegateWorkflow, name, canonicalCwd, task, {
+					mutationRequested,
+					model: typeof args.model === "string" ? args.model : null,
+				});
+
+				let session: Record<string, unknown>;
+				let reusedSession = false;
+				if (args.session_id != null) {
+					const sessionId = safeExternalId("session", args.session_id);
+					const existing = asRecord(await readJsonFile(sessionFile(sessionId)));
+					if (!existing) return { ok: false, reason: "unknown_session", session_id: sessionId };
+					const storedCwd = typeof existing.cwd === "string" ? existing.cwd : null;
+					const canonicalStored = storedCwd ? await canonicalizePath(storedCwd) : null;
+					const canonicalRequested = await canonicalizePath(canonicalCwd);
+					if (!canonicalStored || canonicalStored !== canonicalRequested) {
+						return { ok: false, reason: "session_cwd_mismatch", session_id: sessionId };
+					}
+					session = existing;
+					reusedSession = true;
+				} else {
+					const input = {
+						cwd: canonicalCwd,
+						prompt: undefined,
+						namespace: config.namespace,
+						worktree: true as const,
+					};
+					const started = services.startSession
+						? await services.startSession(input)
+						: await startTmuxSession(config, input, namespaceDir, commandRunner);
+					const startedRecord = asRecord(started);
+					if (!startedRecord) throw new Error("coordinator_session_command_required");
+					session = normalizeSession(startedRecord);
+					await writeJsonFile(sessionFile(session.session_id), session);
+					await appendCoordinatorEvent(namespaceDir, {
+						kind: "session.started",
+						sessionId: String(session.session_id),
+						summary: `Session ${String(session.session_id)} started by coordinator delegate`,
+						payloadRef: path.relative(namespaceDir, sessionFile(session.session_id)),
+						metadata: { delegate: true, workflow: delegateWorkflow },
+					});
+					const live = hasTmuxIdentity(session) ? await hasTmuxSession(session, commandRunner) : null;
+					await writeSessionState(namespaceDir, String(session.session_id), "ready_for_input", {
+						live,
+						reason: null,
+					});
+				}
+
+				const sessionId = String(session.session_id);
+				const activeTurn = reusedSession ? await readActiveTurn(namespaceDir, sessionId) : null;
+				if (activeTurn && args.force !== true && args.queue !== true) {
+					return {
+						ok: false,
+						reason: "active_turn_exists",
+						session_id: sessionId,
+						active_turn_id: activeTurn.turn_id,
+					};
+				}
+				if (activeTurn && args.force === true) {
+					const timestamp = new Date().toISOString();
+					const superseded = {
+						...activeTurn,
+						status: "superseded" as const,
+						updated_at: timestamp,
+						completed_at: timestamp,
+					};
+					await writeTurnRecord(namespaceDir, superseded);
+					await clearActiveTurn(namespaceDir, superseded);
+				}
+				const shouldQueue = args.queue === true && args.force !== true && !!activeTurn;
+				const turn = shouldQueue
+					? makeTurnRecord(config, sessionId, taggedPrompt, "queued")
+					: await activateTurn(session, makeTurnRecord(config, sessionId, taggedPrompt, "active"));
+				if (shouldQueue) await writeTurnRecord(namespaceDir, turn);
+				await appendCoordinatorEvent(namespaceDir, {
+					kind: "delegation.started",
+					sessionId,
+					turnId: turn.turn_id,
+					summary: `Delegated ${delegateWorkflow} via ${name} on session ${sessionId}`,
+					metadata: {
+						workflow: delegateWorkflow,
+						tool_name: name,
+						reused_session: reusedSession,
+						queued: shouldQueue,
+						allow_mutation: args.allow_mutation === true,
+					},
+				});
+				const sessionState = await readSessionState(namespaceDir, sessionId);
+				const base: Record<string, unknown> = {
+					ok: true,
+					workflow: delegateWorkflow,
+					tool_name: name,
+					session_id: sessionId,
+					turn_id: turn.turn_id,
+					active_turn_id: shouldQueue ? activeTurn?.turn_id : turn.turn_id,
+					status: turn.status,
+					queued: turn.delivery.queued,
+					delivered: turn.delivery.delivered,
+					delivery: turn.delivery,
+					session,
+					session_state: sessionState,
+					turn,
+					awaited: false,
+					artifacts: [],
+				};
+				if (promptAliasIgnored) base.prompt_alias_ignored = true;
+				if (args.await_completion === true && !shouldQueue) {
+					const timeoutMs = boundedTimeoutMs(args.timeout_ms);
+					const pollIntervalMs = boundedPollIntervalMs(args.poll_interval_ms);
+					const deadline = Date.now() + timeoutMs;
+					let payload = await readTurnPayload(turn.turn_id, sessionId, args.lines);
+					while (
+						payload.ok === true &&
+						!TERMINAL_TURN_STATUSES.has((payload.turn as TurnRecord).status) &&
+						Date.now() < deadline
+					) {
+						const remainingMs = deadline - Date.now();
+						await waitForTurnStateChange(
+							namespaceDir,
+							payload.turn as TurnRecord,
+							Math.min(pollIntervalMs, remainingMs),
+						);
+						payload = await readTurnPayload(turn.turn_id, sessionId, args.lines);
+					}
+					const awaitedTurn = (payload.ok === true ? payload.turn : turn) as TurnRecord;
+					base.awaited = true;
+					base.status = awaitedTurn.status;
+					base.turn = awaitedTurn;
+					base.final_response = (awaitedTurn as unknown as Record<string, unknown>).final_response ?? null;
+					base.evidence = (awaitedTurn as unknown as Record<string, unknown>).evidence ?? [];
+					if (payload.ok === true) {
+						base.session_state = payload.session_state;
+						base.advisory_status = payload.advisory_status;
+					}
+					// Mirror skc_coordinator_await_turn timeout semantics: a still-active
+					// turn at the deadline is a bounded timeout, not a completion.
+					if (!TERMINAL_TURN_STATUSES.has(awaitedTurn.status)) {
+						base.timed_out = true;
+						base.reason = "timeout";
+						base.ok = false;
+					}
+				}
+				return base;
+			}
 			if (name === "skc_coordinator_start_session") {
 				requireCoordinatorMutation(config, "sessions", args);
 				const cwd = await assertCoordinatorWorkdir(config, args.cwd);

package/src/daemon/builtin.ts

@@ -0,0 +1,46 @@
+/**
+ * Static built-in daemon controller map.
+ *
+ * Intentionally a static map keyed by daemon kind rather than a mutable plugin
+ * registry: there is exactly one kind today (`telegram`). Promote to a richer
+ * registry only when a second daemon kind exists.
+ */
+
+import type { Settings } from "../config/settings";
+import { type TelegramDaemonControlDeps, TelegramDaemonController } from "../notifications/telegram-daemon-control";
+import type { BuiltInDaemonController, DaemonKind } from "./control-types";
+
+export const BUILT_IN_DAEMON_KINDS = ["telegram"] as const satisfies readonly DaemonKind[];
+
+export interface BuiltInDaemonControllerDeps {
+	telegram?: TelegramDaemonControlDeps;
+}
+
+export function createBuiltInDaemonControllers(
+	settings: Settings,
+	deps: BuiltInDaemonControllerDeps = {},
+): Record<DaemonKind, BuiltInDaemonController> {
+	return {
+		telegram: new TelegramDaemonController(settings, deps.telegram),
+	};
+}
+
+/**
+ * Resolve the controllers a command should act on. `--all` selects every
+ * built-in kind; otherwise the explicit `kinds` (defaulting to `telegram`).
+ */
+export function selectDaemonControllers(
+	settings: Settings,
+	kinds: DaemonKind[] | undefined,
+	all: boolean,
+	deps: BuiltInDaemonControllerDeps = {},
+): BuiltInDaemonController[] {
+	const map = createBuiltInDaemonControllers(settings, deps);
+	if (all) return Object.values(map);
+	const selected = kinds && kinds.length > 0 ? kinds : (["telegram"] as DaemonKind[]);
+	return selected.map(kind => {
+		const controller = map[kind];
+		if (!controller) throw new Error(`unknown daemon kind: ${kind}`);
+		return controller;
+	});
+}

package/src/daemon/control-types.ts

@@ -0,0 +1,65 @@
+/**
+ * Public types for the `skc daemon` control plane.
+ *
+ * Deliberately compact: a small result/status surface plus a built-in
+ * controller contract. There is exactly one daemon kind today (`telegram`);
+ * a richer registry is intentionally deferred until a second kind exists.
+ */
+
+export type DaemonKind = "telegram";
+
+export type DaemonAction = "list" | "status" | "stop" | "reload";
+
+export type DaemonHealth = "not_configured" | "stopped" | "running" | "stale" | "stopping" | "error";
+
+export interface DaemonRuntimeInfo {
+	/** `source` when respawn goes through bun/node + the entry script; `compiled` for a single-file binary. */
+	mode: "source" | "compiled";
+	execPath: string;
+	/** True only in source/dev mode, where a respawn loads amended TypeScript directly. */
+	reloadPicksUpSourceEdits: boolean;
+	/** Present when the runtime mode constrains what reload can achieve (e.g. compiled binary). */
+	warning?: string;
+}
+
+export interface DaemonStatus {
+	kind: DaemonKind;
+	configured: boolean;
+	health: DaemonHealth;
+	pid?: number;
+	ownerId?: string;
+	startedAt?: number;
+	heartbeatAt?: number;
+	roots?: string[];
+	rootCount?: number;
+	runtime: DaemonRuntimeInfo;
+	detail?: string;
+}
+
+export interface DaemonOperationOptions {
+	/** How long to wait for cooperative release before escalating. */
+	gracefulTimeoutMs?: number;
+	/** How long to wait for the old pid to die after SIGKILL. */
+	killTimeoutMs?: number;
+	/** Allow hard-kill escalation / acting on a still-live owner. */
+	force?: boolean;
+	/** For reload: spawn a fresh owner even when none is currently running. */
+	spawnIfStopped?: boolean;
+}
+
+export interface DaemonOperationResult {
+	kind: DaemonKind;
+	action: Exclude<DaemonAction, "list">;
+	ok: boolean;
+	before?: DaemonStatus;
+	after?: DaemonStatus;
+	warnings: string[];
+	message: string;
+}
+
+export interface BuiltInDaemonController {
+	readonly kind: DaemonKind;
+	status(): Promise<DaemonStatus>;
+	stop(opts?: DaemonOperationOptions): Promise<DaemonOperationResult>;
+	reload(opts?: DaemonOperationOptions): Promise<DaemonOperationResult>;
+}

package/src/daemon/runtime.ts

@@ -0,0 +1,51 @@
+/**
+ * Shared source-vs-compiled runtime detection for daemon spawning.
+ *
+ * Centralizes the logic previously embedded in `ensureTelegramDaemonRunning`
+ * so session autostart, reload, and status reporting agree on how a daemon
+ * process is launched and whether a reload can pick up amended source.
+ */
+
+import * as path from "node:path";
+
+export interface SkcRuntimeSpawnInfo {
+	execPath: string;
+	mode: "source" | "compiled";
+	/** Prefix prepended before the skc subcommand args; `[Bun.main]` in source mode, otherwise `[]`. */
+	argsPrefix: string[];
+	/** True only when respawn loads edited TypeScript directly (source/dev mode). */
+	reloadPicksUpSourceEdits: boolean;
+	/** Set in compiled mode to explain that a rebuild is required before reload picks up source edits. */
+	warning?: string;
+}
+
+const COMPILED_RELOAD_WARNING =
+	"Compiled binary: reload respawns the same binary. Rebuild the binary first for amended source to take effect.";
+
+/**
+ * Resolve how to spawn a detached skc subcommand for the current runtime.
+ *
+ * Source/dev mode (bun/node) prepends the entry script (`Bun.main`) so the
+ * respawn loads edited source. A compiled single-file binary self-spawns its
+ * own subcommand directly and cannot pick up workspace source edits.
+ */
+export function resolveSkcRuntimeSpawnInfo(execPath: string = process.execPath): SkcRuntimeSpawnInfo {
+	const base = path.basename(execPath).toLowerCase();
+	const fromSource = base === "bun" || base === "node" || base.startsWith("bun") || base.startsWith("node");
+	const mainScript = fromSource && typeof Bun !== "undefined" ? (Bun as unknown as { main?: string }).main : undefined;
+	if (fromSource) {
+		return {
+			execPath,
+			mode: "source",
+			argsPrefix: mainScript ? [mainScript] : [],
+			reloadPicksUpSourceEdits: true,
+		};
+	}
+	return {
+		execPath,
+		mode: "compiled",
+		argsPrefix: [],
+		reloadPicksUpSourceEdits: false,
+		warning: COMPILED_RELOAD_WARNING,
+	};
+}

package/src/defaults/skc/rules/ponytail.md

@@ -0,0 +1,68 @@
+---
+name: ponytail
+description: "Lazy senior dev mode — always pick the simplest, shortest solution that works (YAGNI, reuse, stdlib/native first), never cutting validation, error handling, security, or accessibility."
+alwaysApply: true
+license: MIT
+source: https://github.com/DietrichGebert/ponytail
+---
+
+# Ponytail — lazy senior dev mode
+
+You write code like the laziest senior dev in the room. Lazy means efficient,
+not careless. The best code is the code you never wrote. This rule governs
+*what* you build, not how you talk.
+
+## The ladder
+
+After you understand the problem, stop at the first rung that holds:
+
+1. **Does this need to exist at all?** Speculative need → skip it, say so in one line (YAGNI).
+2. **Already in this codebase?** A helper, util, type, or pattern that lives here → reuse it. Look before you write; re-implementing what's a few files over is the most common slop.
+3. **Stdlib does it?** Use it.
+4. **Native platform feature covers it?** `<input type="date">` over a picker lib, CSS over JS, DB constraint over app code.
+5. **Already-installed dependency solves it?** Use it. Never add a new dependency for what a few lines can do.
+6. **Can it be one line?** One line.
+7. **Only then:** the minimum code that works.
+
+The ladder runs *after* comprehension, not instead of it. Read the task and the
+code it touches, trace the real flow end to end, then climb. Two rungs work →
+take the higher one and move on.
+
+**Bug fix = root cause, not symptom.** Grep every caller of the function you are
+about to touch. One guard in the shared function is a smaller diff than a guard
+in every caller — and patching only the path the ticket names leaves every
+sibling caller broken.
+
+## Rules
+
+- No unrequested abstractions: no interface with one implementation, no factory for one product, no config for a value that never changes.
+- No boilerplate or scaffolding "for later" — later can scaffold for itself.
+- Deletion over addition. Boring over clever; clever is what someone decodes at 3am.
+- Fewest files possible. Shortest working diff wins — but only once you understand the problem. The smallest change in the wrong place is a second bug, not laziness.
+- Two stdlib options the same size? Take the one that is correct on edge cases.
+- Mark deliberate simplifications with a `ponytail:` comment that names the ceiling and the upgrade path (e.g. `// ponytail: global lock, per-account locks if throughput matters`).
+
+## Output
+
+Code first. Then at most three short lines: what was skipped, when to add it.
+No essays defending a simplification — every paragraph of defense is complexity
+smuggled back in as prose. Explanation the user explicitly asked for (a report,
+a walkthrough) is not debt; give it in full.
+
+Pattern: `[code] → skipped: [X], add when [Y].`
+
+## When NOT to be lazy
+
+Never simplify away: input validation at trust boundaries, error handling that
+prevents data loss, security measures, accessibility basics, or anything
+explicitly requested. Never be lazy about *understanding* the problem — the
+ladder shortens the solution, never the reading. A confident small diff in the
+wrong place is the dangerous kind of lazy.
+
+Non-trivial logic (a branch, loop, parser, money/security path) leaves ONE
+runnable check behind — the smallest thing that fails if the logic breaks. No
+frameworks or fixtures unless asked. Trivial one-liners need no test.
+
+---
+
+Adapted from [ponytail](https://github.com/DietrichGebert/ponytail) (MIT) by DietrichGebert.