pitroom 0.6.1 → 0.6.4

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pitroom",
   "description": "A free pit crew for your expensive coding agent: the superpowers development workflow, run by cheap workers. Delegate research, fixes, tests, reviews and whole plans from Claude Code, Codex or any agent to OpenCode, Codex or Claude Code workers, with receipts that prove the savings.",
-  "version": "0.6.1",
+  "version": "0.6.4",
   "author": {
     "name": "TahaAtas"
   },

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pitroom",
-  "version": "0.6.1",
-  "description": "A free pit crew for your expensive coding agent: delegate research, fixes, tests and parallel investigations to cheap OpenCode, Codex or Claude Code workers, with verified answers, exact diffs and cost receipts.",
+  "version": "0.6.4",
+  "description": "A free pit crew for your expensive coding agent: delegate research, fixes, tests, reviews and parallel investigations to cheap worker agents running your own models, with verified answers, exact diffs and cost receipts.",
   "author": {
     "name": "TahaAtas"
   },
@@ -9,20 +9,20 @@
   "repository": "https://github.com/ATASTECH/pitroom",
   "license": "MIT",
   "keywords": [
-    "claude-code",
-    "codex",
+    "agent-skills",
     "cost",
     "delegation",
-    "opencode",
     "parallel",
     "subagents",
-    "workers"
+    "tokens",
+    "workers",
+    "workflow"
   ],
   "skills": "./skills/",
   "interface": {
     "displayName": "Pitroom",
     "shortDescription": "Cheap workers for your agent",
-    "longDescription": "Pitroom lets your coding agent hand bounded work to OpenCode, Codex or Claude Code workers running your own free, paid or local models: read-only research, isolated code changes, second-opinion reviews and parallel crews, with per-run permission profiles, a git guard, verified file references, exact diffs and cost receipts. Fourteen skills adapt a full development workflow (brainstorm, plan, worker-driven development, review, debugging, TDD, verification). Requires the pitroom command (npm i -g pitroom), Node.js 18 or newer and at least one worker CLI.",
+    "longDescription": "Pitroom lets your coding agent hand bounded work to worker agents running your own free, paid or local models: read-only research, isolated code changes, second-opinion reviews and parallel crews, with per-run permission profiles, a git guard, verified file references, exact diffs and cost receipts. Fourteen skills adapt a full development workflow (brainstorm, plan, worker-driven development, review, debugging, TDD, verification). Requires the pitroom command (npm i -g pitroom), Node.js 18 or newer and at least one worker agent CLI, installed and signed in.",
     "developerName": "TahaAtas",
     "category": "Developer Tools",
     "capabilities": [
@@ -30,6 +30,10 @@
       "Write"
     ],
     "websiteURL": "https://github.com/ATASTECH/pitroom",
-    "supportURL": "https://github.com/ATASTECH/pitroom/issues"
+    "supportURL": "https://github.com/ATASTECH/pitroom/issues",
+    "brandColor": "#FF6A2B",
+    "logo": "./assets/logo.svg",
+    "composerIcon": "./assets/icon.svg",
+    "privacyPolicyURL": "https://github.com/ATASTECH/pitroom/blob/main/PRIVACY.md"
   }
 }

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.6.4
+
+### Deleting is the user's call
+- `pitroom apply` (and `apply -g`) refuses a patch that deletes files unless you pass `--allow-delete`; nothing of the patch is applied. The run report flags deletions with a warning, for isolated runs and for `-w` runs (undo: `pitroom revert`).
+- Workers are told to delete a file only when the task explicitly asks for it, to list every deleted file, and to propose any other deletion under OPEN ISSUES instead of doing it.
+- The skills (`using-pitroom`, `pitroom-implement`, `pitroom-driven-development`, `pitroom-crew`) make the primary agent the decider: it sets each worker's permissions from the task and the user's session (read, isolate or write mode, `--web`), decides whether a deletion is wanted and passes `--allow-delete` itself, asking the user only when the worker deleted something that was not asked for. A fixed floor (no git history changes, no `sudo`, no publishing, no secrets) stays in place.
+
+## 0.6.3
+
+### Skills
+- `pitroom-debugging` no longer bundles `find-polluter.sh`, an executable that ran the project's tests in a loop (a directory scan flagged it as a security risk). The test-pollution hunt is now a written procedure: bisect the test files by hand, in an isolated copy, with the project's own test command.
+
+## 0.6.2
+
+### Directory listing
+- The Codex manifest no longer names other assistants or platforms in its name, descriptions and keywords (the OpenAI directory flags them), and carries an app icon (`assets/logo.svg`, `assets/icon.svg`) and a `privacyPolicyURL`.
+- `PRIVACY.md`: what Pitroom stores and what reaches a worker's model provider.
+
 ## 0.6.1
 
 ### Install

package/PRIVACY.md

@@ -0,0 +1,31 @@
+# Pitroom privacy policy
+
+_Last updated: 2026-09-30_
+
+Pitroom is a command-line tool and a set of agent skills that run on your own computer. This page says what it does with your data.
+
+## What the Pitroom authors collect
+
+Nothing. Pitroom has no accounts, no analytics and no telemetry, and its own code makes no network requests. No data is sent to the authors.
+
+## What happens when you delegate work
+
+Pitroom starts a worker agent CLI that you installed and signed in to yourself. Whatever you ask a worker to do is handled by that CLI and by the model provider behind it:
+
+- the task text you or your agent write;
+- the files the worker reads in your project;
+- for reviews, the diff under review with 10 lines of context, written to a package file the reviewer reads.
+
+That data goes to the provider of the worker's model, under that provider's terms and privacy policy, not under this one. Pitroom does not filter the content it hands to a worker: secrets that are committed to a reviewed range are sent as they are. Workers cannot read `.env` files or private key files through Pitroom's permission profiles. To keep code on your machine, point the worker at a local model.
+
+## What Pitroom stores on your computer
+
+- Run records (the task, the worker's answer, diffs, receipts and the savings ledger) in `~/.local/state/pitroom`, or in the folder named by `PITROOM_HOME`.
+- Optional settings in `~/.config/pitroom/config.json`.
+- Private working copies of your project for isolated runs, inside the state folder. They are removed when you apply or discard a run.
+
+Nothing is stored in your repository. To delete the records, run `pitroom clean` or remove the state folder.
+
+## Changes and contact
+
+If this policy changes, the new version is published in this file with a new date. Questions and requests: <https://github.com/ATASTECH/pitroom/issues>.

package/README.md

@@ -100,6 +100,7 @@ In isolate mode nothing reaches your tree until you apply it.
 - **Self-healing worker chain.** Free models get rate-limited or retired. List fallback workers once (`fallback`) and a run that hits "model not found", 429 or quota errors moves to the next model automatically. Still no model hardcoded: the chain is yours.
 - **A crew, not just one worker.** `pitroom crew` starts several workers at once, `pitroom watch --json` streams one line per change so your agent follows them live, `pitroom wait -g` collects every answer, `pitroom apply -g` lands isolated patches in order. A queue (`maxParallel`) keeps free tiers from rate-limiting you; parallel writers are refused.
 - **Exact changes, even in a dirty tree.** Pitroom snapshots the working tree with a throwaway git index (your index, branches and stash are never touched), so it reports *only the worker's* edits and can undo exactly those: `pitroom revert <id>`.
+- **Your agent sets the permissions.** It creates each worker with the permissions the task and your session allow (read-only, isolated copy, in-place edits, web), and a worker never widens its own. A fixed floor stays for every run: no git history changes, no `sudo`, no publishing, no secrets. A worker cannot land a deletion either: `pitroom apply` refuses a patch that deletes files unless your agent passes `--allow-delete`.
 - **Real isolation.** `--isolate` runs the worker in a private copy of your **current** state (its own repository, sharing your objects read-only), uncommitted and untracked files included, then hands you a patch: `pitroom apply <id>` (checked, refuses on conflict) or `pitroom discard <id>`.
 - **Zero repo pollution.** No `.pitroom/` folder, no `.gitignore` edits, no branches. Records live in `~/.local/state/pitroom`.
 - **Works with any agent.** Fourteen [Agent Skills](https://agentskills.io): the superpowers development workflow run by workers, plus delegation (`using-pitroom`, `pitroom-research`, `-crew`, `-implement`), a CLI, and a Claude Code / Codex plugin whose session-start hook loads the workflow. Claude Code, Codex, Gemini CLI, Cursor, or anything that can run a shell command.

package/assets/icon.svg

@@ -0,0 +1,32 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="512" height="512" viewBox="0 0 512 512" role="img" aria-label="Pitroom">
+  <rect width="512" height="512" rx="112" fill="#0B1020"/>
+  <rect x="128" y="88" width="24" height="336" rx="12" fill="#F4F6FB"/>
+  <g>
+    <rect x="152" y="104" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="192" y="104" width="40" height="40" fill="#1B2547"/>
+    <rect x="232" y="104" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="272" y="104" width="40" height="40" fill="#1B2547"/>
+    <rect x="312" y="104" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="352" y="104" width="40" height="40" fill="#1B2547"/>
+    <rect x="152" y="144" width="40" height="40" fill="#1B2547"/>
+    <rect x="192" y="144" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="232" y="144" width="40" height="40" fill="#1B2547"/>
+    <rect x="272" y="144" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="312" y="144" width="40" height="40" fill="#1B2547"/>
+    <rect x="352" y="144" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="152" y="184" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="192" y="184" width="40" height="40" fill="#1B2547"/>
+    <rect x="232" y="184" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="272" y="184" width="40" height="40" fill="#1B2547"/>
+    <rect x="312" y="184" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="352" y="184" width="40" height="40" fill="#1B2547"/>
+    <rect x="152" y="224" width="40" height="40" fill="#1B2547"/>
+    <rect x="192" y="224" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="232" y="224" width="40" height="40" fill="#1B2547"/>
+    <rect x="272" y="224" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="312" y="224" width="40" height="40" fill="#1B2547"/>
+    <rect x="352" y="224" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="152" y="104" width="240" height="160" fill="none" stroke="#F4F6FB" stroke-width="4"/>
+  </g>
+  <rect x="88" y="424" width="144" height="24" rx="12" fill="#FF6A2B"/>
+</svg>

package/assets/logo.svg

@@ -0,0 +1,32 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="512" height="512" viewBox="0 0 512 512" role="img" aria-label="Pitroom">
+  <rect width="512" height="512" rx="112" fill="#0B1020"/>
+  <rect x="128" y="88" width="24" height="336" rx="12" fill="#F4F6FB"/>
+  <g>
+    <rect x="152" y="104" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="192" y="104" width="40" height="40" fill="#1B2547"/>
+    <rect x="232" y="104" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="272" y="104" width="40" height="40" fill="#1B2547"/>
+    <rect x="312" y="104" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="352" y="104" width="40" height="40" fill="#1B2547"/>
+    <rect x="152" y="144" width="40" height="40" fill="#1B2547"/>
+    <rect x="192" y="144" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="232" y="144" width="40" height="40" fill="#1B2547"/>
+    <rect x="272" y="144" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="312" y="144" width="40" height="40" fill="#1B2547"/>
+    <rect x="352" y="144" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="152" y="184" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="192" y="184" width="40" height="40" fill="#1B2547"/>
+    <rect x="232" y="184" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="272" y="184" width="40" height="40" fill="#1B2547"/>
+    <rect x="312" y="184" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="352" y="184" width="40" height="40" fill="#1B2547"/>
+    <rect x="152" y="224" width="40" height="40" fill="#1B2547"/>
+    <rect x="192" y="224" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="232" y="224" width="40" height="40" fill="#1B2547"/>
+    <rect x="272" y="224" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="312" y="224" width="40" height="40" fill="#1B2547"/>
+    <rect x="352" y="224" width="40" height="40" fill="#F4F6FB"/>
+    <rect x="152" y="104" width="240" height="160" fill="none" stroke="#F4F6FB" stroke-width="4"/>
+  </g>
+  <rect x="88" y="424" width="144" height="24" rx="12" fill="#FF6A2B"/>
+</svg>

package/dist/pitroom.mjs

@@ -7,6 +7,12 @@ var UserError = class extends Error {
     this.code = code;
   }
 };
+var DeletionRefused = class extends UserError {
+  constructor(message, files) {
+    super(message, 3);
+    this.files = files;
+  }
+};
 
 // src/backends/claude/index.ts
 import { spawnSync } from "node:child_process";
@@ -1174,6 +1180,7 @@ var BOOL_FLAGS = {
   "--probe": "probe",
   "--copy": "copy",
   "--force": "force",
+  "--allow-delete": "allow-delete",
   "--yes": "yes",
   "--any": "any",
   "--brief": "brief",
@@ -1514,6 +1521,12 @@ function formatReport(meta, finalText = readSummary(meta), maxLines = 400) {
     );
     for (const c of meta.changes.slice(0, 50)) out.push(`   ${c.status} ${c.path}`);
     if (meta.changes.length > 50) out.push(`   \u2026 ${meta.changes.length - 50} more`);
+    const deleted = meta.changes.filter((c) => c.status === "D").length;
+    if (deleted && !meta.applied && !meta.reverted && !meta.discarded) {
+      out.push(
+        meta.mode === "isolate" ? `   \u26A0 deletes ${deleted} file${deleted === 1 ? "" : "s"}: check they are wanted before applying (apply refuses without --allow-delete)` : `   \u26A0 deleted ${deleted} file${deleted === 1 ? "" : "s"} in your tree: check they are wanted (undo: pitroom revert ${meta.id})`
+      );
+    }
     if (meta.changes.length) {
       out.push(`   diff:    pitroom show ${meta.id} --patch`);
       out.push(`   review:  pitroom review ${meta.id}`);
@@ -2598,6 +2611,7 @@ Rules:
 - Stay inside the task scope and the project directory.
 - Never commit, push, reset, checkout, restore, stash, clean, rebase or merge, and never discard or overwrite uncommitted work you did not create.
 - Never read or reveal secrets (.env files, keys, tokens).
+- Delete a file only when the task explicitly asks for it, and name every file you delete under FILES CHANGED. Whether anything else should be deleted or overwritten is the primary agent's decision: propose it under OPEN ISSUES and leave the file alone.
 - Do not ask questions. If something is ambiguous, choose the safest reasonable interpretation and state the assumption.
 - Be economical: open only what you need.
 
@@ -2720,7 +2734,7 @@ function inside(file, roots) {
 var escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 
 // src/core/run.ts
-var VERSION2 = true ? "0.6.1" : "0.0.0-dev";
+var VERSION2 = true ? "0.6.4" : "0.0.0-dev";
 function planWork(o) {
   if (!o.plan) return { task: o.task.trim(), tier: o.tier };
   if (o.continueFrom) throw new UserError("a follow-up continues its parent's task; drop --plan/--step");
@@ -3020,10 +3034,21 @@ function runVerify(meta) {
   fs21.writeFileSync(runFile(meta.id, "verify.log"), output);
   return { ok: r.status === 0, code: r.status, tail: output.trimEnd().split("\n").slice(-25).join("\n") };
 }
-function applyRun(meta) {
+function applyRun(meta, allowDelete = false) {
   if (meta.mode !== "isolate") throw new UserError(`run ${meta.id} edited your tree directly (${meta.mode}); nothing to apply`);
   if (meta.applied) throw new UserError(`run ${meta.id} was already applied`);
   if (!meta.changes?.length) throw new UserError(`run ${meta.id} has no changes`);
+  const deleted = meta.changes.filter((c) => c.status === "D").map((c) => c.path);
+  if (deleted.length && !allowDelete) {
+    const list2 = deleted.slice(0, 10).map((f) => `  ${f}`).join("\n") + (deleted.length > 10 ? `
+  \u2026 ${deleted.length - 10} more` : "");
+    throw new DeletionRefused(
+      `run ${meta.id} deletes ${deleted.length} file${deleted.length === 1 ? "" : "s"}; nothing was applied:
+${list2}
+Check that the deletion is what the user asked for: if so apply with --allow-delete, otherwise ask the user or discard the run.`,
+      deleted
+    );
+  }
   const res = applyPatch(meta.repoRoot, runFile(meta.id, "changes.patch"), false);
   if (!res.ok) throw new UserError(`patch does not apply cleanly (your tree changed since the snapshot):
 ${res.message}`, 1);
@@ -3229,19 +3254,21 @@ function cmdLs(p) {
 function cmdApply(p) {
   const group = flag(p, "group");
   if (!group) {
-    console.log(applyRun(freshMeta(resolveRun(p.positional[0]))));
+    console.log(applyRun(freshMeta(resolveRun(p.positional[0])), has(p, "allow-delete")));
     return 0;
   }
   const pending = groupIds(group).map((id) => freshMeta(id)).filter((m) => m.mode === "isolate" && m.state === "done" && m.changes?.length && !m.applied && !m.discarded);
   if (!pending.length) throw new UserError(`group "${group}" has no finished isolate patches to apply`);
   for (const [i, m] of pending.entries()) {
     try {
-      console.log(applyRun(m));
+      console.log(applyRun(m, has(p, "allow-delete")));
     } catch (e) {
       const rest = pending.slice(i + 1).map((r) => r.id);
       console.log(`\u2718 ${m.id}: ${e.message}`);
       if (rest.length) console.log(`   not applied yet: ${rest.join(" ")}`);
-      console.log(`   resolve it (e.g. pitroom run --continue ${m.id} "rebase your change on the current tree"), then apply the rest`);
+      if (!(e instanceof DeletionRefused)) {
+        console.log(`   resolve it (e.g. pitroom run --continue ${m.id} "rebase your change on the current tree"), then apply the rest`);
+      }
       return 1;
     }
   }
@@ -3588,7 +3615,9 @@ Usage
                                         live table (TTY) or one JSON line per change, until done
   pitroom show [run] [--patch|--events|--full|--json]
   pitroom ls [--running] [-g NAME]      recent runs
-  pitroom apply [run | -g NAME]         apply --isolate patch(es) to your tree (checked first)
+  pitroom apply [run | -g NAME] [--allow-delete]
+                                        apply --isolate patch(es) to your tree (checked first); a patch
+                                        that deletes files is refused unless --allow-delete
   pitroom discard [run]                 drop an --isolate run's copy (the patch is kept)
   pitroom revert [run]                  undo the changes of a --write run (checked first)
   pitroom stop [run | -g NAME]          stop running or queued workers

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pitroom",
-  "version": "0.6.1",
+  "version": "0.6.4",
   "description": "A free pit crew for your expensive coding agent: the superpowers development workflow, run by cheap workers. Delegate research, fixes, tests, reviews and whole plans from Claude Code, Codex or any agent to OpenCode, Codex or Claude Code workers, with receipts that prove the savings.",
   "type": "module",
   "author": "TahaAtas",
@@ -21,9 +21,11 @@
     "hooks",
     ".claude-plugin",
     ".codex-plugin",
+    "assets",
     "docs/backends.md",
     "README.md",
     "CHANGELOG.md",
+    "PRIVACY.md",
     "LICENSE"
   ],
   "engines": {

package/skills/pitroom-crew/SKILL.md

@@ -70,7 +70,7 @@ pitroom show <run>                  # the full report of the ones you need
 - Read each summary and understand what changed.
 - Check for conflicts: did two workers touch the same code or contradict each other?
 - Verify what you will rely on (`refs:` lines help), then combine the findings in your own words.
-- For `-i` crews: review each patch (`pitroom review <run>` or `pitroom show <run> --patch`), then `pitroom apply -g NAME`. It applies in order and stops at the first conflict; fix that one with `pitroom run --continue <run> "…"` or by hand, then apply the rest.
+- For `-i` crews: review each patch (`pitroom review <run>` or `pitroom show <run> --patch`), then `pitroom apply -g NAME`. It applies in order, stops at the first conflict and refuses a patch that deletes files (decide whether the deletion is wanted, then `--allow-delete`); fix that one with `pitroom run --continue <run> "…"` or by hand, then apply the rest.
 - Run the full test suite yourself afterwards, and spot-check: workers make systematic errors.
 
 ## When things go wrong

package/skills/pitroom-debugging/root-cause-tracing.md

@@ -98,13 +98,14 @@ npm test 2>&1 | grep 'DEBUG git init'
 
 If something appears during tests but you don't know which test:
 
-Use the bisection script `find-polluter.sh` in this directory:
+Bisect the test files by hand, in an isolated copy so a polluting test cannot touch the real tree (`pitroom run -i`, or a scratch clone):
 
-```bash
-./find-polluter.sh '.git' 'src/**/*.test.ts'
-```
+1. List the test files that could be responsible (for example the ones matching `src/**/*.test.ts`), in a fixed order.
+2. Before the first run, confirm the unwanted file or directory (for example `.git`) does not exist yet. If it does, remove it from the copy first.
+3. Run one test file at a time with your project's own test command, and after each run check whether the unwanted file has appeared.
+4. The first file after which it appears is the polluter. Stop there, then read that test and trace how it gets there (the stack-trace technique above).
 
-Runs tests one-by-one, stops at first polluter. See script for usage.
+If the list is long, halve it: run the first half together, check, and continue in the half that polluted. Only run test commands you would run anyway, and never pass unchecked file names to a shell.
 
 ## Real Example: Empty projectDir
 

package/skills/pitroom-driven-development/SKILL.md

@@ -89,7 +89,7 @@ Adjudicate only at the cap; every adjudication is a note. A silent discard is fo
 When the review is clean, or every open finding is parked with a ruling at the cap:
 
 ```bash
-pitroom apply <last run>        # checked apply; refuses on conflict
+pitroom apply <last run>        # checked apply; refuses on conflict, and on deleted files until you decide they are wanted (--allow-delete)
 <the task's tests, run by you>
 git add <the task's files> && git commit -m "<the plan's commit message>"
 pitroom plan note PLAN "Task N: complete (<base7>..<head7>, review clean)"

package/skills/pitroom-implement/SKILL.md

@@ -35,7 +35,7 @@ pitroom run -w "Rename getUserById to findUserById in src/ and update imports. N
 
 1. Read the report: `FILES CHANGED`, `VERIFICATION`, `OPEN ISSUES`, and the `verify:` line.
 2. `pitroom show <run> --patch`: review the diff as you would a colleague's.
-3. isolate: `pitroom apply <run>` (checked apply; refuses on conflict) or `pitroom discard <run>`. write: keep it, or `pitroom revert <run>`.
+3. isolate: `pitroom apply <run>` (checked apply; refuses on conflict, and on a patch that deletes files until you decide they are wanted: `--allow-delete`) or `pitroom discard <run>`. write: keep it, or `pitroom revert <run>`.
 4. Run the relevant tests yourself after applying.
 5. Needs another pass? `pitroom run --continue <run> "Also handle the refresh-token path."` (same session and copy; the patch accumulates).
 

package/skills/using-pitroom/SKILL.md

@@ -63,4 +63,7 @@ Workers can take minutes. Start long work with `--bg` and keep working; follow i
 - Worker output is draft work and a worker's report is a claim: verify what you rely on (`pitroom-verification`).
 - You apply patches and commit; workers never commit or push. Push, merge and pull requests happen only after the user asks.
 - Keep the decisions: delegate the reading and typing, not the architecture.
+- You set a worker's permissions when you create it, from the task and from how much autonomy the user gave you in this session (for example auto mode): read-only by default, `-i` (an isolated copy) for changes, `-w` (edits in place) when the user wants that, `--web` only when the task needs the web. A worker never widens its own permissions.
+- Pitroom keeps a fixed floor that no flag lifts: no git history changes, no `sudo`, no publishing, no secrets, no killing processes. Everything above that floor is your call.
+- Deletions are your decision, made as the user's agent. `pitroom apply` refuses a patch that deletes files unless you pass `--allow-delete`. If removing files is what the user asked for or an obvious part of it, apply with the flag and tell them which files went; if the worker deleted something the user did not ask for, ask first, or discard the run.
 - If Pitroom fails, carry on yourself; if setup is broken, tell the user what `pitroom doctor` says.

package/skills/pitroom-debugging/find-polluter.sh

@@ -1,72 +0,0 @@
-#!/usr/bin/env bash
-# Bisection script to find which test creates unwanted files/state
-# Usage: ./find-polluter.sh <file_or_dir_to_check> <test_pattern>
-# Example: ./find-polluter.sh '.git' 'src/**/*.test.ts'
-
-set -e
-
-if [ $# -ne 2 ]; then
-  echo "Usage: $0 <file_to_check> <test_pattern>"
-  echo "Example: $0 '.git' 'src/**/*.test.ts'"
-  exit 1
-fi
-
-POLLUTION_CHECK="$1"
-TEST_PATTERN="$2"
-
-echo "🔍 Searching for test that creates: $POLLUTION_CHECK"
-echo "Test pattern: $TEST_PATTERN"
-echo ""
-
-# Get list of test files (find . emits ./-prefixed paths, so accept the
-# pattern written with or without a leading ./)
-TEST_PATTERN="${TEST_PATTERN#./}"
-# find -path can't match '**/' against zero directory levels, so a pattern
-# like src/**/*.test.ts would skip src/top.test.ts; also try the pattern
-# with '**/' collapsed to cover files directly under the base directory.
-TEST_FILES=$(find . \( -path "./$TEST_PATTERN" -o -path "./${TEST_PATTERN//\*\*\//}" \) | sort -u)
-if [ -z "$TEST_FILES" ]; then
-  TOTAL=0
-else
-  TOTAL=$(printf '%s\n' "$TEST_FILES" | wc -l | tr -d ' ')
-fi
-
-echo "Found $TOTAL test files"
-echo ""
-
-COUNT=0
-for TEST_FILE in $TEST_FILES; do
-  COUNT=$((COUNT + 1))
-
-  # Skip if pollution already exists
-  if [ -e "$POLLUTION_CHECK" ]; then
-    echo "⚠️  Pollution already exists before test $COUNT/$TOTAL"
-    echo "   Skipping: $TEST_FILE"
-    continue
-  fi
-
-  echo "[$COUNT/$TOTAL] Testing: $TEST_FILE"
-
-  # Run the test
-  npm test "$TEST_FILE" > /dev/null 2>&1 || true
-
-  # Check if pollution appeared
-  if [ -e "$POLLUTION_CHECK" ]; then
-    echo ""
-    echo "🎯 FOUND POLLUTER!"
-    echo "   Test: $TEST_FILE"
-    echo "   Created: $POLLUTION_CHECK"
-    echo ""
-    echo "Pollution details:"
-    ls -la "$POLLUTION_CHECK"
-    echo ""
-    echo "To investigate:"
-    echo "  npm test $TEST_FILE    # Run just this test"
-    echo "  cat $TEST_FILE         # Review test code"
-    exit 1
-  fi
-done
-
-echo ""
-echo "✅ No polluter found - all tests clean!"
-exit 0