pitroom 0.6.0 → 0.6.3

package/.claude-plugin/marketplace.json

@@ -8,8 +8,10 @@
     {
       "name": "pitroom",
       "description": "Delegate research, fixes, tests and parallel investigations to cheap OpenCode, Codex or Claude Code workers, with verified answers, exact diffs and cost receipts.",
-      "version": "0.6.0",
-      "source": "./",
+      "source": {
+        "source": "npm",
+        "package": "pitroom"
+      },
       "author": {
         "name": "TahaAtas"
       }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pitroom",
   "description": "A free pit crew for your expensive coding agent: the superpowers development workflow, run by cheap workers. Delegate research, fixes, tests, reviews and whole plans from Claude Code, Codex or any agent to OpenCode, Codex or Claude Code workers, with receipts that prove the savings.",
-  "version": "0.6.0",
+  "version": "0.6.3",
   "author": {
     "name": "TahaAtas"
   },

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pitroom",
-  "version": "0.6.0",
-  "description": "A free pit crew for your expensive coding agent: delegate research, fixes, tests and parallel investigations to cheap OpenCode, Codex or Claude Code workers, with verified answers, exact diffs and cost receipts.",
+  "version": "0.6.3",
+  "description": "A free pit crew for your expensive coding agent: delegate research, fixes, tests, reviews and parallel investigations to cheap worker agents running your own models, with verified answers, exact diffs and cost receipts.",
   "author": {
     "name": "TahaAtas"
   },
@@ -9,21 +9,31 @@
   "repository": "https://github.com/ATASTECH/pitroom",
   "license": "MIT",
   "keywords": [
-    "claude-code",
-    "codex",
+    "agent-skills",
     "cost",
     "delegation",
-    "opencode",
     "parallel",
     "subagents",
-    "workers"
+    "tokens",
+    "workers",
+    "workflow"
   ],
   "skills": "./skills/",
-  "hooks": {},
   "interface": {
     "displayName": "Pitroom",
-    "shortDescription": "Cheap OpenCode, Codex or Claude Code workers for research, fixes and parallel tasks",
-    "longDescription": "Pitroom lets the primary agent hand bounded work to OpenCode, Codex or Claude Code workers running the user's own free, paid or local models: read-only research, isolated code changes, second-opinion reviews and parallel crews, with per-run permission profiles, a git guard, verified file references, exact diffs and cost receipts.",
-    "category": "Developer Tools"
+    "shortDescription": "Cheap workers for your agent",
+    "longDescription": "Pitroom lets your coding agent hand bounded work to worker agents running your own free, paid or local models: read-only research, isolated code changes, second-opinion reviews and parallel crews, with per-run permission profiles, a git guard, verified file references, exact diffs and cost receipts. Fourteen skills adapt a full development workflow (brainstorm, plan, worker-driven development, review, debugging, TDD, verification). Requires the pitroom command (npm i -g pitroom), Node.js 18 or newer and at least one worker agent CLI, installed and signed in.",
+    "developerName": "TahaAtas",
+    "category": "Developer Tools",
+    "capabilities": [
+      "Read",
+      "Write"
+    ],
+    "websiteURL": "https://github.com/ATASTECH/pitroom",
+    "supportURL": "https://github.com/ATASTECH/pitroom/issues",
+    "brandColor": "#FF6A2B",
+    "logo": "./assets/logo.svg",
+    "composerIcon": "./assets/icon.svg",
+    "privacyPolicyURL": "https://github.com/ATASTECH/pitroom/blob/main/PRIVACY.md"
   }
 }

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.6.3
+
+### Skills
+- `pitroom-debugging` no longer bundles `find-polluter.sh`, an executable that ran the project's tests in a loop (a directory scan flagged it as a security risk). The test-pollution hunt is now a written procedure: bisect the test files by hand, in an isolated copy, with the project's own test command.
+
+## 0.6.2
+
+### Directory listing
+- The Codex manifest no longer names other assistants or platforms in its name, descriptions and keywords (the OpenAI directory flags them), and carries an app icon (`assets/logo.svg`, `assets/icon.svg`) and a `privacyPolicyURL`.
+- `PRIVACY.md`: what Pitroom stores and what reaches a worker's model provider.
+
+## 0.6.1
+
+### Install
+- The Claude Code and Codex marketplace now installs the published npm package (under 0.5 MB, no dependencies) instead of copying the whole repository: before, `claude plugin install` also copied `src/` and `test/` and ran `npm install` for the development tools (39 MB). One `.claude-plugin/marketplace.json` serves both agents.
+- The README has an install table per agent: Claude Code plugin, Codex plugin (skills only, no session-start hook, the `pitroom` command comes from npm) and npm with `pitroom install`.
+
+### Directory listing
+- The Codex manifest carries the listing fields the public plugin directory asks for (short description, developer, capabilities, links) and no longer declares `hooks`, which the directory does not accept.
+- `docs/releasing.md` lists the release steps and how to submit to the Anthropic and OpenAI directories.
+
 ## 0.6.0
 
 ### Workflow skills

package/PRIVACY.md

@@ -0,0 +1,31 @@
+# Pitroom privacy policy
+
+_Last updated: 2026-09-30_
+
+Pitroom is a command-line tool and a set of agent skills that run on your own computer. This page says what it does with your data.
+
+## What the Pitroom authors collect
+
+Nothing. Pitroom has no accounts, no analytics and no telemetry, and its own code makes no network requests. No data is sent to the authors.
+
+## What happens when you delegate work
+
+Pitroom starts a worker agent CLI that you installed and signed in to yourself. Whatever you ask a worker to do is handled by that CLI and by the model provider behind it:
+
+- the task text you or your agent write;
+- the files the worker reads in your project;
+- for reviews, the diff under review with 10 lines of context, written to a package file the reviewer reads.
+
+That data goes to the provider of the worker's model, under that provider's terms and privacy policy, not under this one. Pitroom does not filter the content it hands to a worker: secrets that are committed to a reviewed range are sent as they are. Workers cannot read `.env` files or private key files through Pitroom's permission profiles. To keep code on your machine, point the worker at a local model.
+
+## What Pitroom stores on your computer
+
+- Run records (the task, the worker's answer, diffs, receipts and the savings ledger) in `~/.local/state/pitroom`, or in the folder named by `PITROOM_HOME`.
+- Optional settings in `~/.config/pitroom/config.json`.
+- Private working copies of your project for isolated runs, inside the state folder. They are removed when you apply or discard a run.
+
+Nothing is stored in your repository. To delete the records, run `pitroom clean` or remove the state folder.
+
+## Changes and contact
+
+If this policy changes, the new version is published in this file with a new date. Questions and requests: <https://github.com/ATASTECH/pitroom/issues>.

package/README.md

@@ -12,6 +12,7 @@ Model-agnostic · Verified answers · Receipts, not vibes · OpenCode / Codex /
 
 [![Release](https://img.shields.io/github/v/release/ATASTECH/pitroom?label=release)](https://github.com/ATASTECH/pitroom/releases/latest)
 [![Downloads](https://img.shields.io/github/downloads/ATASTECH/pitroom/total?label=downloads)](https://github.com/ATASTECH/pitroom/releases)
+[![npm](https://img.shields.io/npm/v/pitroom?label=npm)](https://www.npmjs.com/package/pitroom)
 [![Stars](https://img.shields.io/github/stars/ATASTECH/pitroom?style=flat&label=stars)](https://github.com/ATASTECH/pitroom/stargazers)
 [![CI](https://github.com/ATASTECH/pitroom/actions/workflows/ci.yml/badge.svg)](https://github.com/ATASTECH/pitroom/actions/workflows/ci.yml)
 [![License](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
@@ -145,9 +146,9 @@ Every run prints a receipt, and `pitroom savings` adds them up:
 
 ### 01
 
-**Get it**
+**Install**
 
-Clone the repository
+Plugin or npm (below)
 
 </td>
 
@@ -155,9 +156,9 @@ Clone the repository
 
 ### 02
 
-**Link it**
+**Connect a worker**
 
-`pitroom install`
+OpenCode, Codex or Claude Code
 
 </td>
 
@@ -186,24 +187,34 @@ Ask your agent, or run `pitroom`
 
 Requires Node.js 18+ and at least one worker CLI: [OpenCode](https://opencode.ai) v2+ (the default worker), [Codex CLI](https://github.com/openai/codex) or [Claude Code](https://claude.com/claude-code).
 
+### Choose how to install
+
+| You use | Install | What you get |
+|---|---|---|
+| **Claude Code** | `claude plugin marketplace add ATASTECH/pitroom`<br>`claude plugin install pitroom@pitroom`<br>(inside a session: `/plugin marketplace add ATASTECH/pitroom`, `/plugin install pitroom@pitroom`) | The 14 skills, the session-start hook that introduces Pitroom, and a card after each `pitroom` command. The plugin is the published npm package: under 0.5 MB, no dependencies. |
+| **Codex** | `codex plugin marketplace add ATASTECH/pitroom`<br>`codex plugin add pitroom@pitroom`<br>and `npm i -g pitroom` | The 14 skills. Codex plugins have no session-start hook, so Pitroom is not introduced on its own: the skills load when a task matches, or ask for one by name. The `pitroom` command itself comes from npm. |
+| **Any other agent, or only the CLI** | `npm i -g pitroom`<br>`pitroom install` | The CLI, and the skills linked into `~/.agents/skills` and `~/.claude/skills`. |
+
 ```bash
-git clone https://github.com/ATASTECH/pitroom && cd pitroom
-node dist/pitroom.mjs install   # skills → ~/.agents/skills + ~/.claude/skills, launcher → ~/.local/bin/pitroom
-pitroom doctor --probe          # worker CLI, models, permissions, skills, one live round trip
+pitroom doctor --probe   # worker CLI, models, permissions, skills, one live round trip
 ```
 
-Or, in Claude Code, install it as a plugin (skills plus the session-start hook), from a clone or the repository:
+Pick one path: `doctor` warns if the skills load twice. To run `pitroom` yourself in a terminal (`watch`, `savings`, the status line below), install it from npm as well; the plugins alone do not put it on your PATH.
 
-```text
-/plugin marketplace add /path/to/pitroom
-/plugin install pitroom@pitroom
-```
+### Your first run
 
-Use one or the other, not both (`doctor` warns if the skills load twice). Pitroom is a toolbox, not a procedure: your agent uses it when it helps, or you ask explicitly:
+Pitroom is a toolbox, not a procedure: your agent uses it when it helps, or you ask explicitly:
 
 > Use pitroom to map how sessions are created and invalidated, then propose a fix.
 > Split this into a pitroom crew: audit auth, billing and uploads for missing input validation.
 
+Or start a worker yourself and read its receipt:
+
+```bash
+pitroom "Which files read the session cookie? Cite file:line."
+pitroom savings          # what all your runs saved so far
+```
+
 ---
 
 ## Modes

package/assets/icon.svg

@@ -0,0 +1,32 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="512" height="512" viewBox="0 0 512 512" role="img" aria-label="Pitroom">
+  <rect width="512" height="512" rx="112" fill="#0B1020"/>
+  <rect x="128" y="88" width="24" height="336" rx="12" fill="#F4F6FB"/>
+  <g>
+    <rect x="152" y="104" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="192" y="104" width="40" height="40" fill="#1B2547"/>
+    <rect x="232" y="104" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="272" y="104" width="40" height="40" fill="#1B2547"/>
+    <rect x="312" y="104" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="352" y="104" width="40" height="40" fill="#1B2547"/>
+    <rect x="152" y="144" width="40" height="40" fill="#1B2547"/>
+    <rect x="192" y="144" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="232" y="144" width="40" height="40" fill="#1B2547"/>
+    <rect x="272" y="144" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="312" y="144" width="40" height="40" fill="#1B2547"/>
+    <rect x="352" y="144" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="152" y="184" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="192" y="184" width="40" height="40" fill="#1B2547"/>
+    <rect x="232" y="184" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="272" y="184" width="40" height="40" fill="#1B2547"/>
+    <rect x="312" y="184" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="352" y="184" width="40" height="40" fill="#1B2547"/>
+    <rect x="152" y="224" width="40" height="40" fill="#1B2547"/>
+    <rect x="192" y="224" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="232" y="224" width="40" height="40" fill="#1B2547"/>
+    <rect x="272" y="224" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="312" y="224" width="40" height="40" fill="#1B2547"/>
+    <rect x="352" y="224" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="152" y="104" width="240" height="160" fill="none" stroke="#F4F6FB" stroke-width="4"/>
+  </g>
+  <rect x="88" y="424" width="144" height="24" rx="12" fill="#FF6A2B"/>
+</svg>

package/assets/logo.svg

@@ -0,0 +1,32 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="512" height="512" viewBox="0 0 512 512" role="img" aria-label="Pitroom">
+  <rect width="512" height="512" rx="112" fill="#0B1020"/>
+  <rect x="128" y="88" width="24" height="336" rx="12" fill="#F4F6FB"/>
+  <g>
+    <rect x="152" y="104" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="192" y="104" width="40" height="40" fill="#1B2547"/>
+    <rect x="232" y="104" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="272" y="104" width="40" height="40" fill="#1B2547"/>
+    <rect x="312" y="104" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="352" y="104" width="40" height="40" fill="#1B2547"/>
+    <rect x="152" y="144" width="40" height="40" fill="#1B2547"/>
+    <rect x="192" y="144" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="232" y="144" width="40" height="40" fill="#1B2547"/>
+    <rect x="272" y="144" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="312" y="144" width="40" height="40" fill="#1B2547"/>
+    <rect x="352" y="144" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="152" y="184" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="192" y="184" width="40" height="40" fill="#1B2547"/>
+    <rect x="232" y="184" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="272" y="184" width="40" height="40" fill="#1B2547"/>
+    <rect x="312" y="184" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="352" y="184" width="40" height="40" fill="#1B2547"/>
+    <rect x="152" y="224" width="40" height="40" fill="#1B2547"/>
+    <rect x="192" y="224" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="232" y="224" width="40" height="40" fill="#1B2547"/>
+    <rect x="272" y="224" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="312" y="224" width="40" height="40" fill="#1B2547"/>
+    <rect x="352" y="224" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="152" y="104" width="240" height="160" fill="none" stroke="#F4F6FB" stroke-width="4"/>
+  </g>
+  <rect x="88" y="424" width="144" height="24" rx="12" fill="#FF6A2B"/>
+</svg>

package/dist/pitroom.mjs

@@ -2720,7 +2720,7 @@ function inside(file, roots) {
 var escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 
 // src/core/run.ts
-var VERSION2 = true ? "0.6.0" : "0.0.0-dev";
+var VERSION2 = true ? "0.6.3" : "0.0.0-dev";
 function planWork(o) {
   if (!o.plan) return { task: o.task.trim(), tier: o.tier };
   if (o.continueFrom) throw new UserError("a follow-up continues its parent's task; drop --plan/--step");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pitroom",
-  "version": "0.6.0",
+  "version": "0.6.3",
   "description": "A free pit crew for your expensive coding agent: the superpowers development workflow, run by cheap workers. Delegate research, fixes, tests, reviews and whole plans from Claude Code, Codex or any agent to OpenCode, Codex or Claude Code workers, with receipts that prove the savings.",
   "type": "module",
   "author": "TahaAtas",
@@ -21,9 +21,11 @@
     "hooks",
     ".claude-plugin",
     ".codex-plugin",
+    "assets",
     "docs/backends.md",
     "README.md",
     "CHANGELOG.md",
+    "PRIVACY.md",
     "LICENSE"
   ],
   "engines": {

package/skills/pitroom-debugging/root-cause-tracing.md

@@ -98,13 +98,14 @@ npm test 2>&1 | grep 'DEBUG git init'
 
 If something appears during tests but you don't know which test:
 
-Use the bisection script `find-polluter.sh` in this directory:
+Bisect the test files by hand, in an isolated copy so a polluting test cannot touch the real tree (`pitroom run -i`, or a scratch clone):
 
-```bash
-./find-polluter.sh '.git' 'src/**/*.test.ts'
-```
+1. List the test files that could be responsible (for example the ones matching `src/**/*.test.ts`), in a fixed order.
+2. Before the first run, confirm the unwanted file or directory (for example `.git`) does not exist yet. If it does, remove it from the copy first.
+3. Run one test file at a time with your project's own test command, and after each run check whether the unwanted file has appeared.
+4. The first file after which it appears is the polluter. Stop there, then read that test and trace how it gets there (the stack-trace technique above).
 
-Runs tests one-by-one, stops at first polluter. See script for usage.
+If the list is long, halve it: run the first half together, check, and continue in the half that polluted. Only run test commands you would run anyway, and never pass unchecked file names to a shell.
 
 ## Real Example: Empty projectDir
 

package/skills/pitroom-debugging/find-polluter.sh

@@ -1,72 +0,0 @@
-#!/usr/bin/env bash
-# Bisection script to find which test creates unwanted files/state
-# Usage: ./find-polluter.sh <file_or_dir_to_check> <test_pattern>
-# Example: ./find-polluter.sh '.git' 'src/**/*.test.ts'
-
-set -e
-
-if [ $# -ne 2 ]; then
-  echo "Usage: $0 <file_to_check> <test_pattern>"
-  echo "Example: $0 '.git' 'src/**/*.test.ts'"
-  exit 1
-fi
-
-POLLUTION_CHECK="$1"
-TEST_PATTERN="$2"
-
-echo "🔍 Searching for test that creates: $POLLUTION_CHECK"
-echo "Test pattern: $TEST_PATTERN"
-echo ""
-
-# Get list of test files (find . emits ./-prefixed paths, so accept the
-# pattern written with or without a leading ./)
-TEST_PATTERN="${TEST_PATTERN#./}"
-# find -path can't match '**/' against zero directory levels, so a pattern
-# like src/**/*.test.ts would skip src/top.test.ts; also try the pattern
-# with '**/' collapsed to cover files directly under the base directory.
-TEST_FILES=$(find . \( -path "./$TEST_PATTERN" -o -path "./${TEST_PATTERN//\*\*\//}" \) | sort -u)
-if [ -z "$TEST_FILES" ]; then
-  TOTAL=0
-else
-  TOTAL=$(printf '%s\n' "$TEST_FILES" | wc -l | tr -d ' ')
-fi
-
-echo "Found $TOTAL test files"
-echo ""
-
-COUNT=0
-for TEST_FILE in $TEST_FILES; do
-  COUNT=$((COUNT + 1))
-
-  # Skip if pollution already exists
-  if [ -e "$POLLUTION_CHECK" ]; then
-    echo "⚠️  Pollution already exists before test $COUNT/$TOTAL"
-    echo "   Skipping: $TEST_FILE"
-    continue
-  fi
-
-  echo "[$COUNT/$TOTAL] Testing: $TEST_FILE"
-
-  # Run the test
-  npm test "$TEST_FILE" > /dev/null 2>&1 || true
-
-  # Check if pollution appeared
-  if [ -e "$POLLUTION_CHECK" ]; then
-    echo ""
-    echo "🎯 FOUND POLLUTER!"
-    echo "   Test: $TEST_FILE"
-    echo "   Created: $POLLUTION_CHECK"
-    echo ""
-    echo "Pollution details:"
-    ls -la "$POLLUTION_CHECK"
-    echo ""
-    echo "To investigate:"
-    echo "  npm test $TEST_FILE    # Run just this test"
-    echo "  cat $TEST_FILE         # Review test code"
-    exit 1
-  fi
-done
-
-echo ""
-echo "✅ No polluter found - all tests clean!"
-exit 0