DietrichGebert/ponytail：让你的 AI Agent 像最“偷懒”的资深工程师一样思考，代码立减 53%

他一言不发。只写了一行代码。程序跑通了。

Ponytail 5：从头全新重构。
-53% 代码 · -41% 耗时 · -26% 成本 · -45% Tokens
不仅如此：98% 的风险逻辑均自带测试交付。 未启用 Ponytail 时：仅 68%。
在 Claude Code 中进行的基准测试，同一 Agent 在开启/关闭该技能下的对比：包含一个真实 FastAPI + React 仓库在内的 39 项任务，使用 Opus 5.5，每项测试各运行 5 次。详情参阅下文。

Español · 한국어 · 简体中文 · 日本語

---

已基于 Ponytail 构建的产品

---

你一定见过这种人：留着长马尾，戴着椭圆眼镜，在公司呆的时间比版本控制系统还要长。你拿给他 50 行代码看；他扫了一眼，一句话也不说，直接用 1 行代码取而代之。

Ponytail 把这样一位工程师装进了你的 AI Agent 里。

图表中未展示的两点细节是：在盲测对比中，Ponytail 5 的回答以 110 比 67 完胜上一代 Ponytail。在 6 项安全任务（SQL 注入、路径遍历、伪造 Token、速率限制、畸形 CSV 行、缓存）中，它在全部 30 次运行中均顺利通过：代码更少，但安全性丝毫不减。评测方法、逐项任务表格及限制说明见：benchmarks/results/2026-10-07-agentic.md。

我们的准则从来不是“消耗最少的 Token”。 而是：只写任务真正需要的代码，并且绝不在校验、错误处理、安全性和无障碍访问上偷工减料。代码之所以简短，是因为只保留了必要部分，而不是为了代码高尔夫（code golf）而刻意压榨。成本和延迟的降低只是随之而来的副产品。

当你要求添加一个日期选择器时：没有 Ponytail，Agent 会安装一个庞大的日期选择器库，或者从零手写一整个日历组件，耗费 335 行代码。Ponytail 5 则会先去观察项目中已有资源：仓库里已经有一个 Input 组件，而每个现代浏览器都原生支持日期选择器。它将两者结合起来，仅用 10 行代码搞定。

更多实际案例参见 examples/。

以往的 /ponytail-review 只会寻找可以删减的代码。现在，它的审查风格就像是系统崩溃时被寻呼机叫醒的值班资深开发：它会阅读本次变更触及的上下文代码，而不只是孤立的 diff，全面检查缺陷、安全隐患、真实负载、缺失测试、运行速度以及冗余代码。每条审查意见都会详细说明代码的作用、潜在问题、修复方案以及如果不修复会引发什么后果。

/ponytail-audit 在整个代码库上执行同样的全面检查。它会先为代码建立全景映射：入口点、数据流转路径以及项目预期的负载规模。随后对发现的问题进行优先级排序，并明确告知你应该优先修复哪一项。而在旧版本中，审计只会机械地列出可删除的文件。

在 Claude Code 中，ponytail 现在会在提示输入框上方常驻一条状态栏（band）：实时显示当前任务的开销、消耗的 Token 数量、Agent 耗时、复用既有代码而非编写新代码的频率，以及最后一次修改后测试是否通过。状态栏自带按钮，可随时切换强度等级、运行 /ponytail-review 或 /ponytail-audit、以 Markdown 格式复制任务内容，或折叠为单行模式。如果不想要它，输入 /ponytail band 即可隐藏，再次输入即可恢复。该功能需 Claude Code 2.1.290 或更高版本，支持终端或桌面应用模式；暂不支持 VS Code 对话面板、云端 Session 或 claude -p。

Board（看板） 支持在本地打开一个可视化页面，汇总跨项目的所有任务：随时间变化的成本、Agent 耗时和 Token 消耗，每次会话及其对应的测试状态，以及你的活跃工作天数。默认情况下，所有数据均保留在本地计算机的 ~/.config/ponytail/band/ 路径下。运行 /ponytail band import 还可以将历史 Claude Code 会话数据一键导入，包含其花费、耗时和 Token。

决策阶梯是在充分理解问题之后运行的，而不是用来取代对业务的理解：它会通读本次修改涉及的代码，追踪真实的业务流程，然后再选择落在哪一个台阶上。在设计方案上极尽“偷懒”，但在阅读理解代码上绝不偷懒。

是偷懒，而不是渎职：信任边界校验、数据丢失防护、系统安全与无障碍访问永远不可被裁剪。

只要包含分支、循环、解析器、涉及资金或安全相关的逻辑，就必须留存一个微型测试。每次回答结尾都会明确说明跳过了哪些部分、未检查哪些细节，以及你需要了解的任何潜在风险。

Ponytail 本质上是一个 Prompt：skills/ponytail/SKILL.md。针对那些通过规则文件驱动的 Agent，提供了精简版 AGENTS.md。本仓库中的所有其他配置，都是为了将这个核心 Prompt 加载到不同的 Agent 环境中。

Claude Code 安装方式（作为两条独立的 prompt 执行）：

/plugin marketplace add DietrichGebert/ponytail



/plugin install ponytail@ponytail

Codex：

codex plugin marketplace add DietrichGebert/ponytail
codex plugin add ponytail@ponytail

随后在 Codex 中打开 /hooks，信任其两个生命周期钩子（lifecycle hooks），并开启一个新线程。

其他任何 Agent： 将 AGENTS.md 复制到你的项目中，或者要求你的 Agent 将 skills/ponytail/SKILL.md 作为技能加载。针对 Copilot、Cursor、OpenCode、Gemini 等环境的分步安装指南参见：INSTALL.md。

大功告成。那位老程序员会感到欣慰的，尽管他肯定什么都不会说。

每个会话默认激活，提供一组简洁的指令（见下文指令表）。/ponytail ultra 模式专门为你觉得代码库得罪了你个人的时刻准备。启动和模式切换文本会清晰显示当前的运作模式。

请务必仅从 GitHub 上的 DietrichGebert/ponytail 或 npm 上的 @dietrichgebert/ponytail 安装 Ponytail。本项目绝不包含任何 .exe 或 .dll 文件；凡是带有这些文件的副本均非官方发布。

命令	功能说明
`/ponytail [lite	full
`/ponytail band [on	off]`

He says nothing. He writes one line. It works.

Ponytail 5: rebuilt from the ground up.
-53% code · -41% time · -26% cost · -45% tokens
And yet: 98% of risky logic ships with a test. Without Ponytail: 68%.
Benchmarked in Claude Code, the same agent with and without the skill: 39 tasks including a real FastAPI + React repo, Opus 5.5, 5 runs each. Details.

Español · 한국어 · 简体中文 · 日本語

---

Already built with Ponytail

---

You know him. Long ponytail. Oval glasses. Has been at the company longer than the version control. You show him fifty lines; he looks at them, says nothing, and replaces them with one.

Ponytail puts him inside your AI agent.

Two things the chart does not show: in a blind comparison, Ponytail 5's replies beat the previous Ponytail's 110 to 67. And on the six security tasks (SQL injection, path traversal, forged tokens, rate limiting, malformed CSV rows, caching) it passed all 30 runs: less code, no less safe. Method, per-task tables and limits: benchmarks/results/2026-10-07-agentic.md.

The rule was never "fewest tokens." It is: write only what the task needs, and never cut validation, error handling, security, or accessibility. The code ends up small because it is necessary, not golfed. Lower cost and latency are a side effect.

You ask for a date picker. Without Ponytail, the agent installs a date picker library or builds a whole calendar by hand: 335 lines. Ponytail 5 first looks at what is already there: the repo has an Input component, and every browser has a date picker. It puts the two together. 10 lines.

More survivors in examples/.

/ponytail-review used to look only for code to cut. Now it reviews like the senior dev who gets paged when it breaks: it reads the code your change touches, not just the diff, and checks bugs, security, real load, missing tests, speed, and what to cut. Each finding says what the code does, what goes wrong, how to fix it, and what happens if you don't.

/ponytail-audit runs the same checks on the whole repo. It maps the code first: entry points, how data moves, what load the project expects. Then it ranks what it finds and tells you what to fix first. The old audit only listed what to delete.

In Claude Code, ponytail now shows a band above the prompt: what the current task costs, how many tokens and how much agent time it used, how often it reused existing code instead of writing new code, and whether the tests passed after the last change. Its buttons switch the level, run /ponytail-review or /ponytail-audit, copy the task as Markdown, and fold the band into one line. Don't want it? /ponytail band hides it, the same command brings it back. Needs Claude Code 2.1.290 or later, in the terminal or the desktop app. It does not show in the VS Code chat panel, cloud sessions or claude -p.

Board opens a local page with every task across your projects: cost, agent time and tokens over time, every session with its tests, and the days you worked. By default, everything stays on your machine, in ~/.config/ponytail/band/. /ponytail band import adds your past Claude Code sessions to it, with their cost, agent time and tokens.

The ladder runs after it understands the problem, not instead of it: it reads the code the change touches and traces the real flow before picking a rung. Lazy about the solution, never about reading.

Lazy, not negligent: trust-boundary validation, data-loss handling, security, and accessibility are never on the chopping block.

Logic with a branch, a loop, a parser, money or security leaves one small test behind. Every reply ends with what was skipped or not checked and any risk you should know.

Ponytail is one prompt: skills/ponytail/SKILL.md. The compact version, for agents that read a rules file, is AGENTS.md. Everything else in this repo loads that prompt into different agents.

Claude Code , as two separate prompts:

/plugin marketplace add DietrichGebert/ponytail



/plugin install ponytail@ponytail

Codex:

codex plugin marketplace add DietrichGebert/ponytail
codex plugin add ponytail@ponytail

Then open /hooks in Codex, trust its two lifecycle hooks, and start a new thread.

Any other agent: copy AGENTS.md into your project, or ask your agent to install skills/ponytail/SKILL.md as a skill. Step by step for Copilot, Cursor, OpenCode, Gemini and the rest: INSTALL.md.

That was it. He'd be proud. He won't say it.

Active every session, with a handful of commands (see Commands). /ponytail ultra exists for when the codebase has wronged you personally. Startup and mode-change text shows the current mode.

Only install ponytail from DietrichGebert/ponytail on GitHub or @dietrichgebert/ponytail on npm. It never ships .exe or .dll files; a copy that does is not mine.

Command	What it does
`/ponytail [lite	full
`/ponytail band [on	off]`
/ponytail band import	Claude Code only: add your past Claude Code sessions to the board, with their cost, agent time and tokens.
/ponytail-review	Review the current diff like the senior dev who gets paged when it breaks: bugs, security, real load, risky code without a test, slow paths, and what to cut. Each finding says what the code does, what goes wrong, how to fix it, and what happens if you don't. Name a target in plain words to narrow or widen it: uncommitted, staged, branch, or a PR link.
/ponytail-audit	The same check for the whole repo, most important first.
/ponytail-debt	Harvest the shortcut: comments you've deferred into a ledger, so "later" doesn't become "never".
/ponytail-gain	Show the measured impact scoreboard (less code, less cost, more speed) from the benchmark.
/ponytail-help	Quick reference for the commands above.

Commands need a skill-capable host (Claude Code, Codex, Devin CLI, OpenCode, Gemini, Antigravity CLI, pi, Hermes Agent, Qoder, Grok Build). In Codex CLI and the IDE extension they're skills under the plugin's namespace; invoke with $ponytail:ponytail-review. Cursor with the hooks gets /ponytail level switching only, typed as a plain message. The instruction-only adapters (Cursor's rule file, Windsurf, Cline, Copilot, Kiro, Antigravity's AGENTS.md fallback) load the always-on ruleset without the commands.

Does it need a config file? No. An optional ~/.config/ponytail/config.json or PONYTAIL_DEFAULT_MODE env var can set the default level, but nothing is required.

Why does it writeshortcut: comments? They mark a deliberate shortcut and when to revisit it, and /ponytail-debt collects them into a ledger. Want another word, or none? Say so in your project's CLAUDE.md or AGENTS.md, then run /ponytail-debt <your word>.

What if I really need the 120-line cache class? You don't. Insist anyway and he'll build it. Slowly. Correctly. While looking at you.

Does it scale? The code you never wrote scales infinitely. Zero bugs, zero CVEs, 100% uptime since forever.

Why "ponytail"? You know exactly why.

Sponsors

MIT. The shortest license that works.