
Security News
pnpm 12’s Rust Rewrite Cuts Install Times by Up to 90%
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.
@developerz.ai/aitm
Advanced tools
Autonomous task orchestrator. Goal in, merged PRs out.
Give aitm a sentence, walk away, come back to a stack of merged pull requests.
It runs a Planner → Worker → Reviewer loop against a real repo using the
Vercel AI SDK and OpenRouter, and
ships the work as PR-sized commits with CI gating and review-comment handling
baked in.
💡 Spiritual successor to the (deprecated)
developerz-ai/claude-task-master— same idea, rebuilt on the AI SDK + OpenRouter: provider-agnostic, concurrent PR groups, MCP client support, smaller surface area.
npm install -g @developerz.ai/aitm
bun install -g @developerz.ai/aitm
deno install -A npm:@developerz.ai/aitm
The package is scoped; the installed command is just aitm.
export OPENROUTER_API_KEY=sk-or-...
cd path/to/your/repo
aitm start "add JWT auth to /login" --max-prs 3
aitm plans the goal into up to 3 PR-sized groups, opens a branch per group,
works through them in parallel, opens each PR, watches CI, addresses review
comments, and auto-merges. Want a human gate?
aitm start "migrate Mongo → Postgres" --no-automerge
# ... review the PR in your browser ...
aitm merge-pr
| Role | Responsibility |
|---|---|
| Orchestrator | Top-level agent; drives the run group-by-group |
| Planner | Goal in → ordered PR groups (each a list of tasks) out |
| Worker | One PR group in → commits + an opened PR out |
| Reviewer | Review comments in → follow-up commits out |
Subagents are wired with the subagents-as-tools
pattern (isolated context windows, focused prompts, natural parallelism), built
on @developerz.ai/ai-claude-compat.
| What you type | What aitm does |
|---|---|
aitm start "add password reset flow" | Splits into schema + endpoint + email + tests, one PR per slice |
aitm start "rename Logger to Tracer everywhere" --max-prs 1 | Single sweeping PR, full test pass before merge |
aitm start "add tests for src/billing/* until 90% coverage" | Iterates until the coverage target hits, or the session cap |
aitm start "bump zod to v4 and fix all type errors" | Bumps, fixes, runs tests, opens PR; conflicts surface as blocked |
User config lives at ~/.aitm.json; per-project overrides at
.ai-task-master/config.json:
aitm config set models.smart anthropic/claude-opus-4.7
aitm config set models.coding anthropic/claude-sonnet-4.6
aitm config set models.fast openai/gpt-5-mini
aitm config set autoMerge true --project
aitm config list
Provider: any OpenAI-compatible endpoint via one credential — OpenRouter by
default, or set baseURL to run on z.ai GLM, a self-hosted gateway, etc. No
Anthropic SDK. Profiles switch the whole provider in one command:
aitm profile add z.ai --preset zai --api-key "<your z.ai key>"
aitm profile use z.ai # ✅ verified end-to-end on z.ai GLM (glm-5.2 / glm-5-turbo)
aitm profile use openrouter
See providers
and aitm profile.
Coding style: aitm reads your repo's CLAUDE.md / AGENTS.md and feeds
it to subagents as a style signal (the provider stays OpenRouter).
MCP: aitm is an MCP client — declare mcpServers in config and their
tools mount into the subagent tool surfaces.
OPENROUTER_API_KEY in the environment.gh CLI, authenticated (PRs, CI status, reviews).MIT · source & full docs
FAQs
Autonomous task orchestrator. Goal in, merged PRs out.
The npm package @developerz.ai/aitm receives a total of 32 weekly downloads. As such, @developerz.ai/aitm popularity was classified as not popular.
We found that @developerz.ai/aitm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.

Security News
Socket CTO Ahmad Nassri joins AppSec leaders at Black Hat to discuss active malware, package manager risks, and software supply chain defense.

Research
/Security News
Thirteen malicious Packagist themes expose visitors on unpatched iPhones to a WebKit-to-kernel exploit chain that steals device data and wallet seeds.