Simple answers about PonoLens.

PonoLens is a local-first privacy monitor for AI coding agents. It creates plain-language privacy receipts, detects configured sensitive information, and can stop supported prompts before submission.

Summary shows the 10 newest prompt receipts, general activity, and current monitoring status. Data Trail is the searchable history of retained events. Select an event in either place to open its human-readable privacy receipt, including what happened, detected categories, destination, decision, redacted details, and recommended next steps. Privacy Receipts is not a separate navigation screen.

Prompt History is a view of the existing local audit database, not a second prompt archive. It shows each retained prompt receipt with its timestamp, harness, destination, sent or blocked outcome, and a redacted preview. It never restores raw protected values. New receipts are grouped by project only when the harness supplied workspace information; otherwise they appear under Project not identified. Existing retention and Delete all local data controls apply.

Prompt History focuses on prompts. It groups them by project when possible and connects each prompt to related tools, redacted commands, and explicitly reported file changes from the same harness session. Data Trail is the complete audit history. It also includes standalone commands, tool and MCP activity, file and repository operations, network actions, test events, database-wide filters, risk summaries, and local PDF, CSV, or JSON reports. Detailed reports include the signed-in account and device plus plain-language command types and likely purposes. Google Antigravity currently appears only in Data Trail because its hooks expose tool activity without the user's prompt text.

Check the Download page for public availability; private testers can use the DMG they received. Choose Apple silicon for an M-series Mac or a separately available Intel build for an Intel Mac. Open the DMG, drag PonoLens.app into Applications, and open it there. The private Apple silicon v0.2.57 installer is Developer ID signed, Apple-notarized, stapled and Gatekeeper-accepted; this does not make it a public download or establish the status of every older Intel installer. If macOS rejects a download, check its source and contact Support rather than assuming the warning should be bypassed.

Select Scan agents, enable the installed harness, then fully quit and reopen it so its hook configuration reloads. Expand the harness, review its published coverage matrix, and use the Local verification controls. Verify compatibility verifies the installed adapter and collector response contract without contacting the AI provider. It does not prove every vendor workflow is covered. Test event adds one clearly labeled synthetic receipt made from fictional data. The test event does not contact the harness or a model provider and must not be treated as proof of real traffic coverage.

Verify compatibility checks whether the configured local adapter responds with the expected contract. It may not create a retained trail item. Test event deliberately creates one orange synthetic event through the normal detector, redaction, SQLite, Needs Review, and receipt-detail pipeline. It is always labeled as a demo and sends no prompt externally.

The welcome message normally appears only on the first visit. In the desktop app, open Support → Show welcome message to reopen it at any time. Loading sample data adds three clearly labeled fictional receipts; it never contacts an agent or AI provider.

Open Settings → Start at login and turn on Start PonoLens when I sign in. Confirm the change in the toast. The setting is off by default and takes effect the next time you sign in to macOS. Turn the same switch off to stop future automatic launches. Uninstalling PonoLens removes its start-at-login configuration.

Before uninstalling, remove or disable PonoLens hooks from connected agent harnesses so a leftover hook does not keep pointing to a service that no longer exists. For the packaged edition, quit PonoLens, disable Start at login, and move /Applications/PonoLens.app to the Trash. From a cloned repository, run ./uninstall.sh. For the script installation, run ~/.ponolens/application/uninstall.sh in Terminal. The uninstaller stops PonoLens and removes the installed application, launcher, and start-at-login LaunchAgent. It intentionally keeps ~/.ponolens/ponolens.db, policies, harness configurations, and macOS Keychain credentials. To remove audit records and policies, use Settings → Delete all local data before uninstalling.

PonoLens has eleven harness families with different coverage. Supported prompt paths include trusted synchronous local Codex desktop/CLI, Claude Code CLI, Cursor desktop, Windsurf/Devin, Grok typed CLI, Muse synchronous CLI, Oh My Pi interactive terminal, OpenClaw normal local-agent sessions and refreshed OpenCode CLI V1 chat.message hooks. OpenCode Desktop and V2 prompt enforcement remain unverified. The current app recognizes the official Claude Code Desktop local Code runtime and uses shared Claude hooks; regular Claude Chat, Cowork, cloud and SSH are excluded. Official Desktop-managed runtime tests passed; actual Desktop window dispatch remains pending. Tool blocking is separately verified for supported Antigravity desktop, OpenCode CLI V1 and Hermes CLI paths. Cursor CLI bypassed its prompt hook in a native test. Grok/Muse native failures can fail open; untested runners must not inherit coverage. macOS Harness is Report Only through supported parent events. Check the coverage matrix for your installed build and restart tools after integration refresh.

Yes. The authorized source installation runs a standalone Node.js background collector on loopback port 43817. It requires Node.js 22.13 or later and valid account authorization for capture. Enable its Start at login service to run it after signing in. Use the authenticated browser dashboard for settings; the Electron app does not need to be open or running. Keep one collector active on the port. Updated hooks stop supported requests on unexpected inspection failure; explicit user pause allows continuation with a warning if the collector is unavailable. A source installation is a separate supported setup path and does not silently update an older packaged app.

Yes. The packaged beta is an Electron desktop application for macOS 13 or later. It bundles its runtime, manages the local collector, and opens the authenticated dashboard in a secured app window. It is not a native Swift application, and it is separate from the authorized standalone background collector installation. Previously verified Apple silicon test builds have passed Developer ID signing and Apple notarization; see the download page for the published artifact.

PonoLens™ Personal Edition is proprietary software owned by Holmgren Studio, LLC and is not open source. A valid trial, subscription, lifetime purchase, or written authorization grants limited use under the included license. Copying, modification, source disclosure, and redistribution are restricted.

PonoLens™ and the PonoLens logo are trademarks of Holmgren Studio, LLC. All rights reserved.

PonoLens Personal (Beta) supports macOS 13 or later. Apple silicon and Intel builds are distributed separately. Windows and Linux are roadmap items and are not supported by this beta.

The current beta supports macOS 13 or later. The private Apple silicon v0.2.57 test build is Developer ID signed, Apple notarized, and stapled. Public download metadata may point to an earlier published build. Near-term work includes automatic updates, clean-device testing, and repeated integration conformance checks as supported tools change. A beta JavaScript/Python reporting SDK and protocol are already documented; SDK reporting alone does not provide pre-submit enforcement. Planned later work includes broader supported post-action and MCP coverage, and an authenticated inbound evidence bridge. Its first version would use a versioned ponolens.network-evidence.v1 schema, scoped integration tokens, strict validation, redacted local receipts, read-only Data Trail and enterprise analytics events, and a conformance kit with fictitious DNS events. Customer-authorized DNS, EDR, or SIEM tools could post findings into PonoLens; PonoLens would not independently inspect all DNS traffic or prove attribution the source cannot provide. Outbound and vendor-specific connectors would follow later. Windows packaging is planned after the macOS lifecycle is proven, while Linux is a later research and validation effort. These items are not currently available and priorities may change.

• Installed: the application or CLI was found.
• Hook configured: PonoLens configuration exists for that harness.
• Currently reachable: PonoLens is actively receiving supported activity.
• Prompt coverage: the prompt/actions exposed by that integration.
• Capabilities: whether the integration supports Report, Redact, or Block when its hook runs.
• Known limitations: activity the integration cannot reliably see or stop.
• Last event received: the newest matching retained receipt.

Expand a harness accordion to see these details. Installed does not mean fully protected.

1. Open My Account on the PonoLens website and create the organization.
2. Purchase the exact number of active-user seats, then invite each user.
3. Have each user accept the invitation, install PonoLens, and sign in on their Mac.
4. Connect each supported AI tool under Agent status, review its coverage matrix, and run Verify compatibility with made-up data.
5. As an Owner or Admin, publish a versioned managed policy including Safe Destinations and retention.
6. Confirm each Mac shows the verified active policy and required governance sharing.
7. Review high-level warning, redaction, inspection-choice and local review totals in My Account. Filter company statistics by UTC dates, team, user and computer. Detailed receipts remain on the originating Mac.

A verified policy can manage the editable protection-format list and each format's action, experimental command-monitoring choice, trusted destinations, and audit-history retention. Each Mac checks the organization ID, expiration, and PonoLens signature before activation. Enterprise members cannot delete Prompt History or Data Trail records, change retention, or turn saved-prompt redaction off. Redact is the default for new policies, with Report where unsupported; Redact and Block remain experimental and require a supported before-send hook.

Managed company accounts report computer health, policy identifiers and daily aggregate totals. Company-wide statistics and health are shared only with organization Owners and Admins. Members can view their own computer statistics. Individual event references, prompts, commands, paths and notes are excluded from new cloud storage. Installed v0.2.67 may still transmit content-free references, which the updated service discards before storage. Protected values, command output, raw tool payloads, token maps, encrypted originals, and screenshots remain excluded. Failed deliveries remain in a durable local outbox and retry after connectivity returns. Missing evidence does not prove that no activity occurred, and a block is counted only when a supported adapter confirms enforcement.

The company dashboard and reports show daily totals only: detected warnings, saved redactions, confirmed stops, explicit uninspected choices and locally recorded review outcomes. Owners and Admins can filter by UTC dates, team, user and computer. Prompt text, commands and individual Data Trail receipts remain on the Mac. Missing totals are not treated as clean activity. Recording remediation cannot undo information already sent.

The company dashboard summarizes daily aggregate statistics, computer health and policy versions without an LLM. Owners and Admins can filter by UTC dates, team, user and computer, and compare warnings, saved redactions, confirmed stops, uninspected choices and available local review totals. Missing counters are labeled Not reported; offline devices are not assumed clean. Individual event timelines and event-based policy recommendations are unavailable in online reporting. Manage trusted destinations and protection rules through Policies. Nothing is published automatically: an authorized administrator must review, version and explicitly publish a policy. Users without an assigned team remain labeled Unassigned.

Native third-party governance connectors are not currently available. The planned first connector is one-way: a customer-authorized HTTPS webhook would send a signed, versioned record containing restricted governance evidence without prompt text, commands, tool inputs, file paths, protected values, private review notes, screenshots, or output. PonoLens is designed for a later controlled inbound-policy phase, but it will not silently obey arbitrary external instructions. Any future inbound change must come from an authenticated authorized source, pass strict schema and organization checks, reject unsupported fields, create an auditable PonoLens policy version, be signed by PonoLens, and be verified by the endpoint before activation. Native vendor connectors and two-way synchronization remain roadmap capabilities until individually implemented and tested.

The current private Apple silicon app bundles Knowledgator GLiNER PII Small v1.0 as the upstream 8-bit QUInt8 ONNX model, with ONNX Runtime 1.23.2, NumPy, Tokenizers and a private Python runtime. No separate Python, pip, model download or ONNX installation is required. The lightweight worker does not load PyTorch, Transformers or the GLiNER Python package. Inference stays on this Mac; prompts are not sent to Knowledgator, Hugging Face or Microsoft by this model. It supplements Rust name/address checks on supported asynchronous live inspections; browser WASM and history cleanup do not use it. Detection can miss private values or flag harmless text. The next-build default is On when no GLiNER preference has been saved. An explicit saved Off or On choice is preserved. Advanced Guard lets you review and confirm changes. Enabling adds model startup time, processing time and memory use. This source change does not update an already-built or installed app; v0.2.102 was built with the previous Off default. Third-party licenses and notices accompany the model/runtime. Their presence does not certify legal or regulatory compliance.

Each rule in Pono Guard has its own Report, Redact or Block action. Supported hooks honor that choice; an older saved default does not turn an explicit Redact or Block choice into Report. Report is used when you select it or when the integration cannot enforce protection. New rules default to Redact · Experimental, with Report where unsupported; existing saved choices are preserved. When matching rules overlap, Block takes precedence over Redact, then Report.

Most supported prompt hooks stop the original and offer a protected copy for you to paste and submit. Oh My Pi interactive input and OpenCode CLI V1 can apply Use redacted version to waiting text after a logged choice. Supported tool hooks stop sensitive requests rather than rewriting tool arguments or files. Observation-only paths report findings without claiming to stop an action. Saved-history redaction is separate: commands, paths, tool inputs and auxiliary fields are sanitized before storage; readable saved prompt text requires an explicit warned setting change.

Detection stays on your Mac. Built-in matching uses the local Rust engine and browser WASM; built-in expressions are hidden in Pono Guard and exports, while on/off choices and custom rules remain available. The app verifies signed bundles before loading them. Signing keys stay in the build service, and rules are separate from the history database. Settings → Detection rule updates checks signed announcements; finding an update does not install it. Compatible independent updates use encrypted catalog/WASM packages and license activation, with content keys in macOS Keychain. Install rule update and Restore previous rules provide verified installation and rollback; replay protection rejects old update announcements. A valid installed scanner can work offline. Encryption and compilation discourage casual copying, but local code remains reverse-engineerable. Cloud reporting contains statistics only; prompts and commands stay on each Mac.

Check the PonoLens menu-bar collector status. Use Start Collector if stopped or Restart Collector if unresponsive, then retry the dashboard and the stopped AI action. Settings → System service also offers Restart service while connected. Keep the configured port and the chosen standalone/app-managed mode; do not start a second collector. If a recognized older standalone collector is busy during an upgrade, the app retries within its startup budget and requires matching authenticated health before replacing it. If it never responds, restart it and retry. Unexpected outages/timeouts stop supported synchronous submissions; an explicit Pause inspection, Stop Collector or Quit Collector permits continuation with a warning and inspection/recording is unavailable. Closing only the dashboard does not pause the collector. Quit Collector asks for confirmation. History stays on the Mac; do not delete local data or Keychain items to fix startup. Unsupported or bypassed vendor hooks cannot guarantee inspection or recording.

The private Apple silicon v0.2.102 app fixes per-rule action precedence on supported hooks and file gates. It is Developer ID signed and strictly verified, but not notarized. The focused source checks, rolling app checks and packaged policy checks passed; complete source qualification and native vendor dispatch verification remain pending. Building it did not install it. The older v0.2.101 DMG does not contain this repair. Documentation and website changes do not update an installed app. Harmless file-request metadata false positives remain unresolved.

Local Claude Code Desktop Code-tab sessions can use the shared Claude Code prompt/tool hooks for reporting, experimental stop-and-copy redaction and supported file inspection, including enabled Binary files scanning. PonoLens discovers the official local Code runtime separately; installing Claude.app alone is not proof of Code support. The Desktop-managed runtime 2.1.260 passed isolated reporting, protected-copy, sensitive file-read denial and collector-failure tests using temporary settings and a local mock model. Actual Desktop window dispatch remains pending. Regular Claude Desktop Chat and Cowork are unsupported; cloud and SSH sessions are excluded. Redact stops the original and provides a protected draft for manual paste/submission. Verify your installed integration; not every Desktop conversation is inspected.

Pono Guard → Local prompt handling → Auto redact on this Mac is off by default and experimental. With it off, high-confidence secrets are protected immediately, while other matches can remain visible in an unfinished Keep/Remove review draft. Review and apply the choices before copying; that preview is not the final protected copy. With Auto redact on, detected matches configured to Redact or Block are removed without that review. Detection can be wrong, so check the result. When enabled, all detected matches configured to Redact or Block are removed without Keep/Remove confirmation. Report-only or disabled rules remain respected. Automatic copying cannot rewrite or submit the composer: the original stays stopped and you paste and submit the protected draft yourself. Updated supported hooks also offer a separate prompt choice; see Skip and Use redacted version. After a prompt choice, successful automatic copying itself does not require a confirmation modal; hook feedback and a nonmodal dashboard notice describe clipboard replacement and removed categories/counts. Copy failure, a busy clipboard queue or a draft above the automatic-copy limit retains manual recovery rather than claiming success. Tool arguments are denied where supported, not rewritten. Auto redact can remove useful text when detection is wrong.

With Scan files and its Binary files child enabled, supported local reads receive bounded PDF, DOCX, PPTX and XLSX extraction. Legacy XLS/XLSB cells and PowerPoint text are also inspected; older Word .doc conversion on macOS is partial. Pages, Keynote and Numbers have partial text coverage, with supported Numbers cell values included. Supported PDF attachments, Office embedded documents and images receive additional bounded inspection. Local Apple Vision OCR can inspect supported images and selected PDF pages; it is best effort, currently English, and may misread or miss values. OCR is limited to four frames/pages per document, four million pixels each and a 2.4-second helper timeout. The v0.2.58 app gives supported local file reads up to 30 seconds including queue time, with a 35-second transport. Prompt inspection remains five seconds. Larger files show a longer-scan notice. Install v0.2.58 and refresh/restart integrations to receive these file limits. Larger documents may be sampled. Password-protected, damaged, unsupported, unrendered or over-budget content remains incomplete. No macro or formula is executed, links are not fetched, and files are not rewritten. An incomplete-scan warning means some contents remain unchecked, not that the file is safe.

Pono Guard → Local prompt handling → Scan files defaults to on, below Auto redact. Supported pre-tool hooks inspect bounded local file reads and resolved symlink targets. Known sensitive filenames such as .env, credential stores and private keys remain protected by configured rules. The Binary files child switch also defaults on and enables supported document and image extraction; it keeps its saved choice when Scan files is off. Turning either switch off skips the corresponding contents and records a coverage warning; filename/target and prompt/tool-input rules remain active. Incomplete ordinary file reads warn and may continue; configured sensitive targets or detected content can stop a supported action. An unexpected scanner failure or timeout stops a supported synchronous action and is not a secret-detection result. Remote files, unresolved dynamic xargs reads, changing files and paths that bypass hooks are not guaranteed. Open the receipt for scanned, sampled and unchecked portions; an incomplete scan never means clean contents.

With Auto redact off, supported local reviews offer Keep, Remove and Replace with sample data for eligible matches. Sample replacements keep the supported value format and repeat consistently within the identified conversation. They are fictitious replacements, not reversible model-side tokens. High-confidence secrets are protected automatically; Keep can be unavailable under managed policy or without an identified conversation. Apply choices and copy closes the review after a successful copy; paste and submit the result yourself. Review the draft because format matching and sample generation can still be wrong. Auto redact removes configured matches without this review; it does not silently choose sample data.

Updated supported synchronous prompt hooks can hold the original for up to 30 seconds after inspection. Skip and proceed continues that same original after warning consent is saved locally; no resubmission is needed. Personal users can choose Skip. Company owners/admins must first enable Allow Force/Skip with recording in Policies; it defaults Off. Off keeps protected-version choices available. Oh My Pi interactive input and OpenCode CLI V1 can apply Use redacted version to the waiting text through their native hook contracts. Other supported hooks offer Copy redacted version and keep the original stopped for you to paste and submit. Every explicit choice is recorded locally; the receipt does not confirm provider delivery. Cancel, no answer, changed context or failed logging keeps the original stopped. These source capabilities require an updated app/collector and refreshed integrations; native vendor GUI dispatch remains unverified.

The automatic-copy threshold is 5 MiB of UTF-8 text. Larger protected drafts require explicit large-copy consent or manual copying. This is a clipboard safeguard, separate from file-inspection limits and the current 20-second ordinary-input inspection budget and the separate 30-second budget for inputs of at least 1 MiB (older installed builds may retain earlier limits). Smaller requests containing literal non-ASCII text receive a twenty-second inspection budget; large inputs, including Unicode, receive thirty seconds. Hardware, policy, file structure and load affect timing; an unsupported or timed-out inspection is never a successful scan. Protected drafts expire after five minutes. Automatic copying replaces the clipboard. Failed or busy copies retain manual recovery and do not claim success.

New formats start with Redact selected. Review the choices, then confirm the policy preview before they apply; choosing an option alone is not a saved change. A successful save clears the waiting message. Action-only changes do not trigger historical cleanup. The current app preserves an explicitly confirmed Solo choice when an older online catalog omits that new format’s action or review marker, including after restart. Changed online definitions/actions can require a fresh review, and company policy remains administrator-controlled. A repeated unchanged review after confirmation is an error: check the save result, version and connection, then report it without resetting or deleting your history.

No. Redact · Experimental is the default for new policies and formats, with Report where unsupported; existing choices are preserved. Redact and Block depend on a configured, trusted, supported before-send hook. They stop the original prompt and provide a protected copy; paste and submit it yourself. They do not rewrite a third-party composer. Report-only and observation-only paths cannot prevent submission. Auto redact changes local review and copying, not the AI tool’s submission contract.

Block attempts to stop matching prompts at supported pre-submit hooks for . Coverage depends on the harness and hook. An event is red only when the integration actually stopped it; never treat the experimental setting as a universal prevention guarantee.

Pono Guard → Local prompt handling → Auto redact on this Mac is off by default and experimental. With it off, high-confidence secrets are protected immediately, while other matches can remain visible in an unfinished Keep/Remove review draft. Review and apply the choices before copying; that preview is not the final protected copy. With Auto redact on, detected matches configured to Redact or Block are removed without that review. Detection can be wrong, so check the result. When enabled, all detected matches configured to Redact or Block are removed without Keep/Remove confirmation. Report-only or disabled rules remain respected. Automatic copying cannot rewrite or submit the composer: the original stays stopped and you paste and submit the protected draft yourself. Updated supported hooks also offer a separate prompt choice; see Skip and Use redacted version. After a prompt choice, successful automatic copying itself does not require a confirmation modal; hook feedback and a nonmodal dashboard notice describe clipboard replacement and removed categories/counts. Copy failure, a busy clipboard queue or a draft above the automatic-copy limit retains manual recovery rather than claiming success. Tool arguments are denied where supported, not rewritten. Auto redact can remove useful text when detection is wrong.

Agent harnesses expose different hooks, and those contracts can change. Experimental protection may miss activity or interrupt a supported workflow. Check each harness accordion for current prompt coverage, capabilities, known limitations, and the last event received. When pre-submission interception is unavailable, treat the harness as observation-only and do not submit sensitive information.

It creates report-only receipts for ordinary commands exposed by supported agent hooks and is off by default. Higher-impact commands exposed by any supported harness are retained under Needs Review even when the ordinary-command switch is off. These include system and permission changes, software installation or removal, file uploads and downloads, remote administration, and script execution with stronger risk signals. PonoLens redacts detected private values before SQLite storage. It does not block commands, store command output, or monitor unrelated Terminal windows. Command completion is reported only when a supported integration provides a completion result; a recorded command alone does not prove success.

Yes, when the calling application uses the PonoLens Ollama Gateway shown in Settings. Report Only forwards and records a redacted receipt. Block rejects matching requests before Ollama receives them. Redact removes configured protected values and forwards only non-streaming requests.

• Direct calls to Ollama on port 11434 bypass PonoLens.
• The MVP supports only /api/chat, /api/generate, and /api/tags, not Ollama's OpenAI-compatible, embeddings, model-management, or other APIs.
• Report Only supports transparent streaming. A sensitive Redact request must use stream:false; streaming response re-identification is not supported.
• The scanner covers textual chat content and generate prompt/system/suffix fields. It does not inspect images or every nested tool payload.
• If PonoLens is stopped, applications configured only for its gateway cannot reach Ollama.

The private v0.2.57 Apple silicon test app supports experimental Block and Redact through trusted synchronous local Codex desktop and CLI prompt hooks. Cloud-orchestrated chats and session observation remain observation-only. Redact stops the original and provides a cleaned copy for manual review and resubmission. Review and trust the PonoLens hooks after installation or changes; disabled, untrusted, and background hooks cannot enforce protection.

• Green: no configured sensitive information or unusual movement was detected.
• Orange: sensitive information was detected and needs review.
• Red: a supported adapter actually stopped the action.

The counts and review panels query the complete retained SQLite history. They do not filter only the 20 events shown in the home-page preview. Risks explained includes retained high- and critical-severity events; Unsafe actions includes events whose recorded decision is Blocked.

Open Pono Guard → Protect your values to manage built-in protection labels, on/off switches and actions, plus your custom rules. Built-in matching runs in the local Rust engine, with local browser WASM using the same core. Built-in expressions are hidden from the editor and CSV exports; they are product code, not rows in your history database. Your custom rules remain editable and exportable. The format builder supports made-up examples, exact local values and constrained advanced regex; samples are not saved or sent. Online Solo/company policies contain formats only; exact protected values and private dictionaries stay on the Mac. Redact · Experimental is the default for new formats, with Report where unsupported; saved choices are preserved. Redact and Block need supported before-send hooks. Reset to default requires confirmation, removes added entries and retains audit history. Solo users manage their own online policies; Owners and Admins manage company policies. Both desktop and website confirm policy changes and cleanup scope before publishing. Action-only changes do not trigger historical cleanup. Online format cleanup and each Mac’s local cleanup/sync have separate completion states; offline Macs remain pending.

No. Deterministic detection can produce false positives or miss unusual formats. Validation and contextual patterns reduce noise, but important decisions still require human review.

Name detection is contextual because treating every capitalized phrase as a person would create many false positives. An unlabelled name such as Joe Doe may not be recognized. Add a role or label—for example, Patient: Joe Doe, Client: Joe Doe, or Employee: Joe Doe—then review the safe draft to confirm it was replaced. If a particular name must always be detected, add the exact name under Pono Guard → Protect your values. No automated detector can guarantee that every name will be found.

Safe Prompt is intentionally hidden in this beta while its next workflow is designed and tested. The current product does not present it as an available protection path.

Safe Prompt is disabled in the current beta. Its retained design scans locally, replaces identifiers with tokens, lets you review the protected draft, and sends or copies only the tokenized version. PonoLens can restore the original values locally after the response returns.

When Web App is the default AI model, select the primary Copy button. PonoLens copies only the tokenized prompt and shows a confirmation with Launch [app name]. The launch opens the selected site in a new tab without placing prompt text in its URL. Return to PonoLens and close the confirmation to reveal Next, then paste the provider's reply for local restoration. Copy remains available if you need it again.

The initial scan and token map stay local. Only the reviewed tokenized prompt is sent or copied. Always inspect the remaining narrative because context can identify someone even after obvious identifiers are removed.

Yes. Use Pono Guard → Protect your values to add an exact value or build a format. The Add form and Edit modal include a nontechnical format builder and local sample testing. Regex is available under Advanced. Users can edit or remove entries, import or export CSV, and reset to defaults with confirmation. Organization Owners and Admins publish the managed list through the website dashboard.

Your audit database is ~/.ponolens/ponolens.db. Detection runs locally and saved prompts are redacted by default. Solo and company cloud reporting in the statistics-only source candidate uploads daily aggregate totals for 365 days. Prompt and command text, paths, destinations, session text, notes and originals stay on the Mac. The updated cloud service stores daily aggregates only and discards older clients’ individual references. A future app update removes transmission of those references. Earlier archives can still contain previously shared redacted text and are not purged by this update. Manage archiving in My Account or desktop Settings. Expired subscriptions pause new uploads. Managed company accounts share high-level statistics with authorized Owners and Admins. See what’s stored, where, and what’s uploaded →

Yes, but saved-prompt redaction is on by default and recommended. With redaction on, the packaged Mac app saves the redacted receipt used by Prompt History, Search, and reports. For false-positive review, a complete prompt original may be kept separately encrypted only on the Mac that created it. Revealing it in the Mac app requires macOS authentication. Encrypted originals are never included in cloud uploads. There is no separate originals-retention toggle; turning off saved-prompt redaction instead stores future prompt text in readable form. Turning redaction off requires accepting a warning because future prompt text is then stored in readable form. Commands, file paths, tool inputs, and other receipt fields remain redacted. Turning redaction back on sanitizes previously readable prompt text.

The default is 60 days. Change it in Settings to match your organization's approved retention and legal-hold policies.

It exports a reusable policy template while excluding user-authored labels, exact protected values, dictionary entries, and custom regular-expression patterns. It is intentionally not a raw backup of sensitive local policy data.

After typed confirmation, PonoLens deletes local audit events, policies, protected values, dictionaries, regex rules, and local settings. It does not remove harness hook configuration or macOS Keychain credentials. This action is permanent.

Select Generate Report below Support. Choose dates and filters, then choose PDF, CSV, or JSON. PDF is easy to read and share, CSV works well in a spreadsheet, and JSON works with technical tools. Open Sessions below Data Trail to review each coding session and its detailed timeline. Use Search above Generate Report to ask friendly questions about activity saved on this Mac and open matching records. Search does not send history to an AI provider. Generate Report shows rolling daily and weekly digests. Summary reports show totals. Detailed reports show the signed-in email, user ID, device ID, plain-language command type, and likely purpose. You can also choose whether to include saved prompts, redacted commands, and file or folder locations. Each included prompt states whether it was redacted before storage. PonoLens creates the report on this Mac and does not email or upload it. Review it before sharing it yourself with a manager or client.

PonoLens offers annual Solo and Small Business plans. Current prices are shown on the Pricing page and loaded from Stripe. Small Business supports 2–100 employees at the current annual per-seat price shown on Pricing and includes organization-wide policy rollout, company governance, and priority support. Priority support has no guaranteed response time unless separately agreed. For 101 or more seats, contact us using the Enterprise information form at Enterprise information form. Pending invitations are free, and each active account can use up to three Macs. Each installation has one 30-day free trial. Lifetime purchases are not currently offered. Small Business includes a fixed 365-day retention period for shared cloud evidence, measured from the event time. Older evidence is excluded from the dashboard and deleted by scheduled cleanup. This is separate from local Mac history. Solo includes an optional 365-day cloud archive: the setting defaults to on, with explicit upload confirmation before syncing. Manage it in website My Account or desktop Settings. Expired subscriptions pause sync; existing archives continue aging out. Solo can view and export cloud reports from its three registered Macs in My Account. Solo supports its own format policies and cleanup across its registered Macs. Team analytics and organization administration require Small Business. Group-specific policy rollout remains planned.

No. PonoLens supports privacy and compliance workflows but does not itself establish compliance, preserve privilege, satisfy SEC obligations, or provide certification. Those outcomes require organizational, contractual, and technical safeguards beyond this tool.

No. Deletion does not prove that transmitted data was never processed, retained, backed up, or logged. Treat it as cleanup, not reversal of disclosure.

A trusted hostname lowers the untrusted-destination risk score. It never disables sensitive-data detection or per-category Pono Guard actions.

The harness reported an outbound action but did not provide its final address. When an HTTP or HTTPS URL is available, PonoLens shows its safe origin, such as https://api.example.com. It removes credentials, query parameters, fragments, and path details because those parts can contain secrets or personal information. PonoLens does not guess a destination that the available evidence cannot prove.

The minimum tested versions for this PonoLens build are Codex 0.155.1, Claude Code 2.1.280, Cursor 3.19.19, Devin Desktop 3.10.35 for the Windsurf/Devin integration, Grok Build 1.0.25, Muse Code 1.4.10-R6427.1, Google Antigravity 2.22.0, OpenCode 1.18.30, Oh My Pi 18.1.18, OpenClaw 2026.9.6, and Hermes Agent 0.21.5+3084.gca16be5. These are the oldest versions verified on the current test Mac. Older versions may work but have not been tested. macOS Harness is not installed on the test Mac, so its minimum tested version has not yet been established.

In Agent status, expand an AI tool to see what PonoLens can receive for prompts, tools, files, commands, and MCP calls, plus its minimum tested version and Report, Redact, and Block capabilities. The matrix describes supported paths, not universal visibility. A compatibility pass becomes stale after 30 days or a detected tool-version change; stale or failed configured integrations degrade company fleet health until they pass again. Commands are experimental, MCP gateway coverage is limited to explicitly routed calls; tool hooks expose only their documented fields, and Redact or Block works only with listed before-send hooks.

Hermes reports tokens for the complete model request, not only the words typed in the visible prompt. Input can include Hermes system instructions, tool definitions, plugin context, and relevant conversation history. Cached input is shown separately. Reasoning tokens are normally included within output rather than added to the total again. PonoLens displays the counts Hermes reports and does not estimate missing usage, so a short question can legitimately have a large reported input count.

PonoLens covers MCP calls explicitly routed through its gateway or exposed through a supported harness hook. It does not claim visibility into every MCP server or encrypted network request.

• Codex: commands found in covered task hooks and observable local session tool calls; unrelated Terminal commands are invisible.
• Claude Code: command tools exposed through PreToolUse; Regular Claude Desktop Chat and Cowork are unsupported; the private v0.2.57 local Code runtime is separate, with native window verification pending.
• Cursor: command details exposed through its tool hooks; coverage and payload detail can vary by Cursor version and tool.
• Windsurf/Devin: native pre-command events and compatible pre-tool activity.
• Grok Build: Experimental prompt Block/Redact and supported tool blocking in typed CLI sessions. Native hook crashes and timeouts can allow continuation.
• Muse Code: Experimental prompt Block/Redact and tool blocking through trusted synchronous CLI hooks. Native failures and invalid output can allow continuation; tool output is never stored.
• Google Antigravity: Experimental desktop tool blocking through PreToolUse. Current hooks do not supply the original prompt; prompt Block/Redact is unsupported.
• OpenCode: Experimental CLI V1 prompt stop/replacement, logged Skip and tool blocking require a rebuilt app and refreshed plugin. Desktop and V2 prompt enforcement are unverified; V2 tools remain Report Only.
• Oh My Pi (OMP): Experimental Block/Redact for typed interactive terminal input and supported tool blocking. RPC, print and ACP prompt enforcement are excluded.
• macOS Harness: invocations and submitted Python exposed by a configured Codex or Claude Code parent session. This integration is Report Only. PonoLens does not receive an independent prompt stream, command output, screenshots, or unrelated Terminal use.

Aliases, nested scripts, shell expansion, subprocesses, encrypted traffic, and commands that bypass the configured hook may hide the final operation or destination. Command output is not captured.

Python, Perl, Ruby, Node, and shell execution is flagged when the visible command shows a stronger signal, such as a downloaded or temporary script, an installer, deployment, update, or removal script, risky inline code, a download piped into an interpreter, or a file made executable and immediately run. Routine interpreter commands remain ordinary activity.

Risk/activity, harness, date range, and redacted-metadata search can be combined. Filtering happens in SQLite before 100-event pagination, so it searches retained history rather than only the visible page. Daily summaries use the computer's local calendar day, and repeated-risk grouping uses matching retained results.

Updated adapters stop supported synchronous submissions on unexpected collector outages, timeouts, authorization failures or invalid inspection, including in experimental Redact and Block modes. Resume inspection before retrying. Only an explicit user Pause inspection or Stop Collector permits continuation with a warning; closing the dashboard is not a pause. The current source prompt inspection limit is six seconds; older installed builds may retain five seconds. Receiving the new limit requires an app rebuild and upgrade plus refreshed integrations. The unpackaged large-file update adds a separate 30-second file scan allowance and longer file-hook transport; it requires a rebuilt app and refreshed integrations. Inspection and recording are not confirmed when a request fails. Native hook execution, warning visibility and observation-only paths vary: a harness that bypasses or ignores hooks cannot guarantee inspection, stopping or recording. Cursor CLI bypassed the prompt hook in the native test; Grok/Muse native hook failures can fail open. The standalone background collector can run on port 43817 without Electron or an open dashboard. Upgrade and refresh older hooks, restart the AI tool and verify compatibility with fictitious data.

Open Settings → System service and choose Restart service. Monitoring pauses briefly while the dashboard waits and reconnects automatically. If the collector is already completely offline and Settings cannot reach it, open the PonoLens launcher from your user Applications folder. It starts the local service when necessary and opens an authenticated dashboard.

The Mac pauses PonoLens while it sleeps. The packaged app reconnects or restarts the local collector after wake and refreshes this dashboard's local authentication. PonoLens cannot observe agent activity while the Mac itself is asleep. For the desktop installation, keep the app running. For a standalone installation, keep its background service enabled. Enable Start at login for automatic recovery after signing in or restarting the Mac.

The application or CLI may not be visible to the environment that started PonoLens. Restart that terminal or desktop app, confirm the executable is on PATH, and scan again.

Yes, for an installed supported harness. Open Support → Harness Troubleshooter, choose one harness and one problem, and select Check connection. This experimental, local-only tool uses fixed checks rather than an AI model.

If configuration and compatibility checks pass, it reports Connection looks good, makes no changes, and does not offer a repair. When a supported problem is found, selecting Approve and repair can recreate missing PonoLens hooks or plugins, refresh outdated PonoLens-owned entries and local credentials, preserve unrelated settings, and run a harmless local compatibility check. Fully quit and reopen the harness afterward. Repair is refused for unsafe or redirected paths and cannot add information the harness does not expose or recover earlier activity.

Detection only proves the application or command exists. Confirm the integration is enabled, fully restart the harness, begin a new session, keep PonoLens running on the configured collector port, and submit a harmless test prompt.

PonoLens avoids opening Safe Storage during an ordinary launch when its existing prompt-vault files are present. macOS may still ask when the vault is first created, when application signing or Keychain access control changes, or when an encrypted original is opened.

Original reveal uses macOS Local Authentication. macOS may use Touch ID, an eligible Apple Watch, or the Mac login password. PonoLens receives only approval or denial and never receives or stores the Mac password.

Local Claude Code Desktop Code-tab sessions can use the shared Claude Code prompt/tool hooks for reporting, experimental stop-and-copy redaction and supported file inspection, including enabled Binary files scanning. PonoLens discovers the official local Code runtime separately; installing Claude.app alone is not proof of Code support. The Desktop-managed runtime 2.1.260 passed isolated reporting, protected-copy, sensitive file-read denial and collector-failure tests using temporary settings and a local mock model. Actual Desktop window dispatch remains pending. Regular Claude Desktop Chat and Cowork are unsupported; cloud and SSH sessions are excluded. Redact stops the original and provides a protected draft for manual paste/submission. Verify your installed integration; not every Desktop conversation is inspected.

Use clearly fictitious names, emails, patient IDs, account numbers, and keys. Begin with stable Report Only, then test Experimental Redact and Block separately on a supported harness. Never use real regulated or authentication data merely to validate detection.