fix(mtmharness): harden alpha5 coding runtime

packages/mtmharness/README.md

@@ -7,7 +7,7 @@
 
 The DSH plugin is assembled from coding and secondary frontend domains under one Host/Client lifecycle. Codebase Memory keeps its `codebase_memory` server namespace and `mcp__codebase_memory__*` tool names; Ponytail exposes six externally installed skills through DSH's native skill surface. The `/ponytail` command controls per-agent automatic prompt intensity; `off` suppresses that section while explicit native skill invocation remains available. The five companion names are not duplicated as host commands. The `mtm-coding` settings namespace contains the runtime extension toggles.
 
-Modern Go Guidelines is enabled by default as the externally installed `use-modern-go` skill. Its trusted manifest pins the JetBrains `v0.1.1` source and SHA-256; the first enable downloads it into `$DSH_HOME/mtmharness/skills/modern-go`, and `modernGoEnabled` removes the skill from the DSH catalog. Existing files are user-owned and are never overwritten automatically.
+Modern Go Guidelines is enabled by default as the externally installed `use-modern-go` skill. Its trusted manifest pins the JetBrains `v0.1.1` source and SHA-256; the first enable downloads it into `$DSH_HOME/mtmharness/skills/modern-go`, and `modernGoEnabled` removes the skill from the DSH catalog. Existing files are user-owned and are never overwritten automatically. In the default DSH `workspace-write` sandbox, follow the mounted Modern Go cache prompt and set `HOME`, `XDG_CACHE_HOME`, `GOPATH`, `GOMODCACHE`, and `GOCACHE` beneath the current workspace before the first wrapper call.
 
 RTK is an optional coding feature in the same `mtm-coding` settings namespace. `rtkMode` defaults to `auto` and provides guidance for explicitly invoking an RTK command when the executable is available. The current DSH ToolRuntime has no supported pre-dispatch input-rewrite seam, so the plugin does not register a speculative hook; `rewrite` reports `unavailable` and leaves frozen tool arguments unchanged. The pinned RTK `v0.45.0` runtime helpers remain checksum-verified for explicit integrations; there is no separate RTK skill document. RTK telemetry, tracking, and tee output are disabled for plugin-managed runs.
 

packages/mtmharness/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtmharness",
-  "version": "0.9.3",
+  "version": "0.9.4",
   "description": "Unified DeepSeek Harness Web plugin with Connect, Codebase Memory, Modern Go, Ponytail, and independent static/embed clients.",
   "type": "module",
   "engines": { "node": ">=22.19.0", "pnpm": ">=11.7.0" },

packages/mtmharness/src/features/coding/packages.json

@@ -12,6 +12,10 @@
     "description": "Version-specific guidance for modern Go code.",
     "icon": "code",
     "kind": "data-only",
+    "prompt": {
+      "order": 89,
+      "text": "Modern Go cache policy for DSH workspace-write shells: /home/code may be read-only. Before invoking the pinned wrapper, keep every write inside the current workspace. Linux/macOS: `cache=\"$PWD/.mtmharness-cache\"; mkdir -p \"$cache\"; env HOME=\"$cache/home\" XDG_CACHE_HOME=\"$cache/cache\" GOPATH=\"$cache/gopath\" GOMODCACHE=\"$cache/gopath/pkg/mod\" GOCACHE=\"$cache/go-build\" GOTOOLCHAIN=local sh \"<skill-dir>/scripts/run-tool.sh\" ...`. PowerShell: `$cache = Join-Path (Get-Location) \".mtmharness-cache\"; New-Item -ItemType Directory -Force $cache | Out-Null; $env:HOME = Join-Path $cache \"home\"; $env:XDG_CACHE_HOME = Join-Path $cache \"cache\"; $env:GOPATH = Join-Path $cache \"gopath\"; $env:GOMODCACHE = Join-Path $env:GOPATH \"pkg/mod\"; $env:GOCACHE = Join-Path $cache \"go-build\"; $env:LOCALAPPDATA = Join-Path $cache \"localappdata\"; $env:GOTOOLCHAIN = \"local\"; & \"<skill-dir>\\scripts\\run-tool.ps1\" ...`. Do not use the default HOME or request elevated sandbox access just for Go caches."
+    },
     "skills": {
       "repository": "https://github.com/JetBrains/go-modern-guidelines",
       "revision": "937827b86eeff98f45150ce00236bc34a30ed20f",

packages/mtmharness/src/features/coding/ponytail.ts

@@ -100,7 +100,10 @@ export async function apply(ctx: Context, config: {
     input: { hint: "[lite|full|ultra|off]" },
     handler: (invocation): CommandResult => {
       const raw = invocation.rawInput.trim();
-      if (raw === "") return result("Ponytail mode: " + modeForAgent(states, invocation.agent, defaultMode));
+      if (raw === "") {
+        states.set(invocation.agent, "full");
+        return result("Ponytail mode: full");
+      }
       if (!MODE_NAMES.has(raw as PonytailMode)) {
         return { kind: "error", text: "Use /ponytail lite, /ponytail full, /ponytail ultra, or /ponytail off." };
       }

packages/mtmharness/tests/coding-plugin.test.mjs

@@ -496,6 +496,9 @@ test("Ponytail exposes skills without duplicating companion commands", async ()
   assert.match(section.text({ agent }), /PONYTAIL MODE ACTIVE - level: full/);
   const modeCommand = fake.commands.find((command) => command.name === "ponytail");
   assert.ok(modeCommand);
+  assert.equal(modeCommand.handler({ rawInput: "off", agent }).text, "Ponytail mode: off");
+  assert.equal(modeCommand.handler({ rawInput: "", agent }).text, "Ponytail mode: full");
+  assert.match(section.text({ agent }), /PONYTAIL MODE ACTIVE - level: full/);
   assert.equal(modeCommand.handler({ rawInput: "ultra", agent }).text, "Ponytail mode: ultra");
   assert.match(section.text({ agent }), /PONYTAIL MODE ACTIVE - level: ultra/);
   await fake.dispose();

packages/mtmharness/tests/packed-install.test.mjs

@@ -155,6 +155,7 @@ test("packed mtmharness discovers skills from its editable DSH home", async () =
       "plugin/skills/use-modern-go/scripts/run-tool.ps1",
       "plugin/skills/use-modern-go/scripts/run-tool.sh",
     ]);
+    assert.match(installed.MTM_CODING_PACKAGES.modernGo.prompt.text, /HOME=.*XDG_CACHE_HOME=.*GOPATH=.*GOMODCACHE=.*GOCACHE/s);
 
     const fake = createContext();
     await installed.applyCoding(fake.context, {