pitroom 0.6.3 → 0.6.4

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pitroom",
   "description": "A free pit crew for your expensive coding agent: the superpowers development workflow, run by cheap workers. Delegate research, fixes, tests, reviews and whole plans from Claude Code, Codex or any agent to OpenCode, Codex or Claude Code workers, with receipts that prove the savings.",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "author": {
     "name": "TahaAtas"
   },

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pitroom",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "description": "A free pit crew for your expensive coding agent: delegate research, fixes, tests, reviews and parallel investigations to cheap worker agents running your own models, with verified answers, exact diffs and cost receipts.",
   "author": {
     "name": "TahaAtas"

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.6.4
+
+### Deleting is the user's call
+- `pitroom apply` (and `apply -g`) refuses a patch that deletes files unless you pass `--allow-delete`; nothing of the patch is applied. The run report flags deletions with a warning, for isolated runs and for `-w` runs (undo: `pitroom revert`).
+- Workers are told to delete a file only when the task explicitly asks for it, to list every deleted file, and to propose any other deletion under OPEN ISSUES instead of doing it.
+- The skills (`using-pitroom`, `pitroom-implement`, `pitroom-driven-development`, `pitroom-crew`) make the primary agent the decider: it sets each worker's permissions from the task and the user's session (read, isolate or write mode, `--web`), decides whether a deletion is wanted and passes `--allow-delete` itself, asking the user only when the worker deleted something that was not asked for. A fixed floor (no git history changes, no `sudo`, no publishing, no secrets) stays in place.
+
 ## 0.6.3
 
 ### Skills

package/README.md

@@ -100,6 +100,7 @@ In isolate mode nothing reaches your tree until you apply it.
 - **Self-healing worker chain.** Free models get rate-limited or retired. List fallback workers once (`fallback`) and a run that hits "model not found", 429 or quota errors moves to the next model automatically. Still no model hardcoded: the chain is yours.
 - **A crew, not just one worker.** `pitroom crew` starts several workers at once, `pitroom watch --json` streams one line per change so your agent follows them live, `pitroom wait -g` collects every answer, `pitroom apply -g` lands isolated patches in order. A queue (`maxParallel`) keeps free tiers from rate-limiting you; parallel writers are refused.
 - **Exact changes, even in a dirty tree.** Pitroom snapshots the working tree with a throwaway git index (your index, branches and stash are never touched), so it reports *only the worker's* edits and can undo exactly those: `pitroom revert <id>`.
+- **Your agent sets the permissions.** It creates each worker with the permissions the task and your session allow (read-only, isolated copy, in-place edits, web), and a worker never widens its own. A fixed floor stays for every run: no git history changes, no `sudo`, no publishing, no secrets. A worker cannot land a deletion either: `pitroom apply` refuses a patch that deletes files unless your agent passes `--allow-delete`.
 - **Real isolation.** `--isolate` runs the worker in a private copy of your **current** state (its own repository, sharing your objects read-only), uncommitted and untracked files included, then hands you a patch: `pitroom apply <id>` (checked, refuses on conflict) or `pitroom discard <id>`.
 - **Zero repo pollution.** No `.pitroom/` folder, no `.gitignore` edits, no branches. Records live in `~/.local/state/pitroom`.
 - **Works with any agent.** Fourteen [Agent Skills](https://agentskills.io): the superpowers development workflow run by workers, plus delegation (`using-pitroom`, `pitroom-research`, `-crew`, `-implement`), a CLI, and a Claude Code / Codex plugin whose session-start hook loads the workflow. Claude Code, Codex, Gemini CLI, Cursor, or anything that can run a shell command.

package/dist/pitroom.mjs

@@ -7,6 +7,12 @@ var UserError = class extends Error {
     this.code = code;
   }
 };
+var DeletionRefused = class extends UserError {
+  constructor(message, files) {
+    super(message, 3);
+    this.files = files;
+  }
+};
 
 // src/backends/claude/index.ts
 import { spawnSync } from "node:child_process";
@@ -1174,6 +1180,7 @@ var BOOL_FLAGS = {
   "--probe": "probe",
   "--copy": "copy",
   "--force": "force",
+  "--allow-delete": "allow-delete",
   "--yes": "yes",
   "--any": "any",
   "--brief": "brief",
@@ -1514,6 +1521,12 @@ function formatReport(meta, finalText = readSummary(meta), maxLines = 400) {
     );
     for (const c of meta.changes.slice(0, 50)) out.push(`   ${c.status} ${c.path}`);
     if (meta.changes.length > 50) out.push(`   \u2026 ${meta.changes.length - 50} more`);
+    const deleted = meta.changes.filter((c) => c.status === "D").length;
+    if (deleted && !meta.applied && !meta.reverted && !meta.discarded) {
+      out.push(
+        meta.mode === "isolate" ? `   \u26A0 deletes ${deleted} file${deleted === 1 ? "" : "s"}: check they are wanted before applying (apply refuses without --allow-delete)` : `   \u26A0 deleted ${deleted} file${deleted === 1 ? "" : "s"} in your tree: check they are wanted (undo: pitroom revert ${meta.id})`
+      );
+    }
     if (meta.changes.length) {
       out.push(`   diff:    pitroom show ${meta.id} --patch`);
       out.push(`   review:  pitroom review ${meta.id}`);
@@ -2598,6 +2611,7 @@ Rules:
 - Stay inside the task scope and the project directory.
 - Never commit, push, reset, checkout, restore, stash, clean, rebase or merge, and never discard or overwrite uncommitted work you did not create.
 - Never read or reveal secrets (.env files, keys, tokens).
+- Delete a file only when the task explicitly asks for it, and name every file you delete under FILES CHANGED. Whether anything else should be deleted or overwritten is the primary agent's decision: propose it under OPEN ISSUES and leave the file alone.
 - Do not ask questions. If something is ambiguous, choose the safest reasonable interpretation and state the assumption.
 - Be economical: open only what you need.
 
@@ -2720,7 +2734,7 @@ function inside(file, roots) {
 var escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 
 // src/core/run.ts
-var VERSION2 = true ? "0.6.3" : "0.0.0-dev";
+var VERSION2 = true ? "0.6.4" : "0.0.0-dev";
 function planWork(o) {
   if (!o.plan) return { task: o.task.trim(), tier: o.tier };
   if (o.continueFrom) throw new UserError("a follow-up continues its parent's task; drop --plan/--step");
@@ -3020,10 +3034,21 @@ function runVerify(meta) {
   fs21.writeFileSync(runFile(meta.id, "verify.log"), output);
   return { ok: r.status === 0, code: r.status, tail: output.trimEnd().split("\n").slice(-25).join("\n") };
 }
-function applyRun(meta) {
+function applyRun(meta, allowDelete = false) {
   if (meta.mode !== "isolate") throw new UserError(`run ${meta.id} edited your tree directly (${meta.mode}); nothing to apply`);
   if (meta.applied) throw new UserError(`run ${meta.id} was already applied`);
   if (!meta.changes?.length) throw new UserError(`run ${meta.id} has no changes`);
+  const deleted = meta.changes.filter((c) => c.status === "D").map((c) => c.path);
+  if (deleted.length && !allowDelete) {
+    const list2 = deleted.slice(0, 10).map((f) => `  ${f}`).join("\n") + (deleted.length > 10 ? `
+  \u2026 ${deleted.length - 10} more` : "");
+    throw new DeletionRefused(
+      `run ${meta.id} deletes ${deleted.length} file${deleted.length === 1 ? "" : "s"}; nothing was applied:
+${list2}
+Check that the deletion is what the user asked for: if so apply with --allow-delete, otherwise ask the user or discard the run.`,
+      deleted
+    );
+  }
   const res = applyPatch(meta.repoRoot, runFile(meta.id, "changes.patch"), false);
   if (!res.ok) throw new UserError(`patch does not apply cleanly (your tree changed since the snapshot):
 ${res.message}`, 1);
@@ -3229,19 +3254,21 @@ function cmdLs(p) {
 function cmdApply(p) {
   const group = flag(p, "group");
   if (!group) {
-    console.log(applyRun(freshMeta(resolveRun(p.positional[0]))));
+    console.log(applyRun(freshMeta(resolveRun(p.positional[0])), has(p, "allow-delete")));
     return 0;
   }
   const pending = groupIds(group).map((id) => freshMeta(id)).filter((m) => m.mode === "isolate" && m.state === "done" && m.changes?.length && !m.applied && !m.discarded);
   if (!pending.length) throw new UserError(`group "${group}" has no finished isolate patches to apply`);
   for (const [i, m] of pending.entries()) {
     try {
-      console.log(applyRun(m));
+      console.log(applyRun(m, has(p, "allow-delete")));
     } catch (e) {
       const rest = pending.slice(i + 1).map((r) => r.id);
       console.log(`\u2718 ${m.id}: ${e.message}`);
       if (rest.length) console.log(`   not applied yet: ${rest.join(" ")}`);
-      console.log(`   resolve it (e.g. pitroom run --continue ${m.id} "rebase your change on the current tree"), then apply the rest`);
+      if (!(e instanceof DeletionRefused)) {
+        console.log(`   resolve it (e.g. pitroom run --continue ${m.id} "rebase your change on the current tree"), then apply the rest`);
+      }
       return 1;
     }
   }
@@ -3588,7 +3615,9 @@ Usage
                                         live table (TTY) or one JSON line per change, until done
   pitroom show [run] [--patch|--events|--full|--json]
   pitroom ls [--running] [-g NAME]      recent runs
-  pitroom apply [run | -g NAME]         apply --isolate patch(es) to your tree (checked first)
+  pitroom apply [run | -g NAME] [--allow-delete]
+                                        apply --isolate patch(es) to your tree (checked first); a patch
+                                        that deletes files is refused unless --allow-delete
   pitroom discard [run]                 drop an --isolate run's copy (the patch is kept)
   pitroom revert [run]                  undo the changes of a --write run (checked first)
   pitroom stop [run | -g NAME]          stop running or queued workers

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pitroom",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "description": "A free pit crew for your expensive coding agent: the superpowers development workflow, run by cheap workers. Delegate research, fixes, tests, reviews and whole plans from Claude Code, Codex or any agent to OpenCode, Codex or Claude Code workers, with receipts that prove the savings.",
   "type": "module",
   "author": "TahaAtas",

package/skills/pitroom-crew/SKILL.md

@@ -70,7 +70,7 @@ pitroom show <run>                  # the full report of the ones you need
 - Read each summary and understand what changed.
 - Check for conflicts: did two workers touch the same code or contradict each other?
 - Verify what you will rely on (`refs:` lines help), then combine the findings in your own words.
-- For `-i` crews: review each patch (`pitroom review <run>` or `pitroom show <run> --patch`), then `pitroom apply -g NAME`. It applies in order and stops at the first conflict; fix that one with `pitroom run --continue <run> "…"` or by hand, then apply the rest.
+- For `-i` crews: review each patch (`pitroom review <run>` or `pitroom show <run> --patch`), then `pitroom apply -g NAME`. It applies in order, stops at the first conflict and refuses a patch that deletes files (decide whether the deletion is wanted, then `--allow-delete`); fix that one with `pitroom run --continue <run> "…"` or by hand, then apply the rest.
 - Run the full test suite yourself afterwards, and spot-check: workers make systematic errors.
 
 ## When things go wrong

package/skills/pitroom-driven-development/SKILL.md

@@ -89,7 +89,7 @@ Adjudicate only at the cap; every adjudication is a note. A silent discard is fo
 When the review is clean, or every open finding is parked with a ruling at the cap:
 
 ```bash
-pitroom apply <last run>        # checked apply; refuses on conflict
+pitroom apply <last run>        # checked apply; refuses on conflict, and on deleted files until you decide they are wanted (--allow-delete)
 <the task's tests, run by you>
 git add <the task's files> && git commit -m "<the plan's commit message>"
 pitroom plan note PLAN "Task N: complete (<base7>..<head7>, review clean)"

package/skills/pitroom-implement/SKILL.md

@@ -35,7 +35,7 @@ pitroom run -w "Rename getUserById to findUserById in src/ and update imports. N
 
 1. Read the report: `FILES CHANGED`, `VERIFICATION`, `OPEN ISSUES`, and the `verify:` line.
 2. `pitroom show <run> --patch`: review the diff as you would a colleague's.
-3. isolate: `pitroom apply <run>` (checked apply; refuses on conflict) or `pitroom discard <run>`. write: keep it, or `pitroom revert <run>`.
+3. isolate: `pitroom apply <run>` (checked apply; refuses on conflict, and on a patch that deletes files until you decide they are wanted: `--allow-delete`) or `pitroom discard <run>`. write: keep it, or `pitroom revert <run>`.
 4. Run the relevant tests yourself after applying.
 5. Needs another pass? `pitroom run --continue <run> "Also handle the refresh-token path."` (same session and copy; the patch accumulates).
 

package/skills/using-pitroom/SKILL.md

@@ -63,4 +63,7 @@ Workers can take minutes. Start long work with `--bg` and keep working; follow i
 - Worker output is draft work and a worker's report is a claim: verify what you rely on (`pitroom-verification`).
 - You apply patches and commit; workers never commit or push. Push, merge and pull requests happen only after the user asks.
 - Keep the decisions: delegate the reading and typing, not the architecture.
+- You set a worker's permissions when you create it, from the task and from how much autonomy the user gave you in this session (for example auto mode): read-only by default, `-i` (an isolated copy) for changes, `-w` (edits in place) when the user wants that, `--web` only when the task needs the web. A worker never widens its own permissions.
+- Pitroom keeps a fixed floor that no flag lifts: no git history changes, no `sudo`, no publishing, no secrets, no killing processes. Everything above that floor is your call.
+- Deletions are your decision, made as the user's agent. `pitroom apply` refuses a patch that deletes files unless you pass `--allow-delete`. If removing files is what the user asked for or an obvious part of it, apply with the flag and tell them which files went; if the worker deleted something the user did not ask for, ask first, or discard the run.
 - If Pitroom fails, carry on yourself; if setup is broken, tell the user what `pitroom doctor` says.