Make Review Tutor installable from Claude Code, Codex, and Pi (public package)

[ElbertePlinio]

Goal

Make Review Tutor installable and launchable from Claude Code, Codex, and Pi (and any shell), and shareable publicly — one codebase in this repo, published as @pickforge/review-tutor.

Today it is a Pi extension only (pi -e <checkout>), private at 0.0.0. The runtime under src/ is already host-independent; only extensions/review-tutor.ts touches Pi.

Design (frozen)

• Core CLI review-tutor [source] [--no-open] [--detach] — starts the loopback server, prints the URL, opens the browser; --detach returns immediately and the server exits after 30 min without a browser client. Pi models are discovered via pi --list-models when no host injects them (same discovery seam as Codex).
• Pi: existing extension unchanged (in-process), installed with pi install npm:@pickforge/review-tutor (or a checkout).
• Claude Code: plugin in packages/review-tutor/claude-plugin/ with a /review-tutor skill that runs npx @pickforge/review-tutor --detach via allowed-tools; marketplace .claude-plugin/marketplace.json at the repo root (git-subdir source). Install: claude plugin marketplace add pickforge/pickforge-platform → claude plugin install review-tutor@pickforge.
• Codex: skill folder packages/review-tutor/codex-skill/review-tutor/SKILL.md (copied to ~/.codex/skills/), same CLI.
• Distribution: package goes public at the lockstep version (0.12.0 → next tag), built bin via tsup, TS sources shipped for Pi; existing publish.yml (npm provenance) handles it on the next v* tag.

Security model unchanged: loopback + bearer token, isolated read-only children, no credentials to the browser.

PR plan

• PR A — host-independent CLI (src/cli.ts, bin, Pi discovery via pi --list-models, detach mode). Depends on: none. Validation: vitest + local node dist/cli.js proof.
• PR B — package goes public: private:false, version 0.12.0, files, build in root chain, README install per harness, pi install npm: proof after publish. Depends on: A.
• PR C — Claude Code plugin + root marketplace + Codex skill, with local install proofs (claude plugin marketplace add ./ , claude plugin install, Codex skill copy). Depends on: A (B for the npm name in commands; can point at npx before publish).
• Release: tag v0.13.0 (lockstep) → npm publish → verify npx @pickforge/review-tutor and pi install npm:@pickforge/review-tutor on a clean machine/dir.
• Docs: landing/site mention only if Elberte wants it (not in scope).

Traceability

Criterion	PR	Validation	Status
CLI starts server, prints URL, opens browser, detaches	A	cli tests + local proof	pending
Pi models discovered without a host	A	fixture tests + local pi --list-models proof	pending
Pi extension behaviour unchanged	A	existing extension tests byte-identical	pending
Public npm package with bin	B	publish dry-run, npm pack contents	pending
Claude Code plugin installable from marketplace	C	local marketplace install proof	pending
Codex skill installable	C	copy + codex exec recognises skill (manual)	pending
Pi installable via npm	B/Release	pi install npm:@pickforge/review-tutor after publish	pending

Current status: In progress
Next action: PR A opened for review

[ElbertePlinio]

Progress: PR A #83 opened (host-independent CLI, f10dc37; local proof: no-host discovery Pi 434 / Claude Code 3 / Codex 7, foreground + detach). Review panel running; PR B and PR C building on top.

[ElbertePlinio]

Progress: PR A #83 review-clean at f2b0f86 (panel: Sol correctness 3×P2 fixed + mutation-verified, Grok security clean, test-integrity P2 pi.exec fixed; P1 installed-bin bug caught by the packaging lane and fixed; CLI now refuses sources outside [A-Za-z0-9._/:@#~^-]). PR C #84 review-clean at 5be3066 (skill injection path removed). PR B (public package) building on the fixed base. CI pending on the new heads.

[ElbertePlinio]

Progress update:

• feat(review-tutor): host-independent review-tutor CLI #83 CLI — review-clean, CI green
• feat(review-tutor): publish public package #85 public package — review-clean, CI green
• feat(review-tutor): add harness adapters #84 harness adapters — review-clean, CI green
• merge feat(review-tutor): host-independent review-tutor CLI #83 → feat(review-tutor): publish public package #85 → feat(review-tutor): add harness adapters #84 (retarget children to main before each base merge)
• bump to 0.13.0 and push v0.13.0 (publishes to npm — needs Elberte's go)
• clean-dir install proofs (npx / pi install / claude plugin), drop README caveat

Blocked: none. Next: merge order above — awaiting Elberte.

[ElbertePlinio]

Progress update:

• feat(review-tutor): host-independent review-tutor CLI #83, feat(review-tutor): publish public package #85, feat(review-tutor): add harness adapters #84 merged to main
• release PR chore(release): 0.13.0 #86 merged, tag v0.13.0 pushed (7be2498)
• published: auth, billing, brand, edge-shared, flags @0.13.0
• blocked: @pickforge/review-tutor is a new package — npm OIDC trusted publishing cannot create packages (E401 on first PUT), so the workflow aborted before sync, tauri-release, tauri-updater
• first manual publish of review-tutor + remaining three, then add a trusted publisher for review-tutor on npmjs.com
• clean-dir install proofs (npx / pi install npm:)

Blocked: needs Elberte's npm login. Next: manual publish from the v0.13.0 tag.

[ElbertePlinio]

Progress update:

• v0.13.0 published: all 9 packages at 0.13.0; @pickforge/review-tutor first publish done manually, trusted publisher configured
• E2E from clean dirs: npx -y @pickforge/review-tutor worktree --detach serves state/diff; pi install npm:@pickforge/review-tutor installs extension+skills; claude plugin marketplace add pickforge/pickforge-platform + claude plugin install review-tutor@pickforge → 0.13.0 enabled
• Codex skill folder verified in the package
  Done.

[ElbertePlinio]

Shipped in v0.13.0.