[duathron]

The band writes one CSV per project to ~/.config/ponytail/band/, and /ponytail band import fills it from every transcript. Together these files are a running log of all projects: names, task names, cost and tokens. Right now they're created with the default umask, so on a typical system (umask 022) other local users can read them.

This PR limits them to the user who owns them:

• hooks/ponytail-band-import.js: the ledger directory is created with mode 0o700 and the CSVs with 0o600.
• hooks/band/register.tsx: $.fs.write takes no mode, so record() checks whether the directory already exists before the first write. If the write has just created it, it runs chmod 700 on it once. This is skipped on Windows, using the same check as openBoard, and a failure is ignored. No chmod runs on later turns.
• tests/band-import.test.js: checks that a fresh import creates the directory as 0700 and the CSV as 0600 (POSIX only). It also pins the fresh-directory check and the chmod line in register.tsx, so these run in npm test.

Notes:

• The modes only apply when the files or the directory are created. An existing ~/.config/ponytail/band keeps its mode. chmod 700 ~/.config/ponytail/band fixes it once.
• mkdirSync({ recursive: true, mode }) gives the same mode to any parent directory it creates, for example ~/.config on a fresh machine. 0700 is what the XDG spec recommends for it.
• The ledger option still defaults to true. Would you consider defaulting it to false, so the log only exists for people who use the board? That's a question, not part of this PR.

Tests: node --test tests/*.test.js gives 143 of 144 passing. The one failure is csv: correct pandas one-liner passes, which also fails on main in my environment (no pandas). npm test --prefix pi-extension passes 30 of 30. claude plugin test . gives 30 passing and 2 failing, and the two failing layout tests fail on main too.

🤖 Generated with Claude Code

https://claude.ai/code/session_01J9HLRpQYgqTqGkrBigkfaS