v0.1.4

The agent can now show you images, on purpose: a built-in show_image tool lets the agent deliberately display images right in the conversation — only when you ask, or when a picture genuinely helps.

Highlights

• Agent-initiated image display (show_image) — reading an image with read shows it to the model, not to you. Now the agent can call the built-in show_image tool to display images inline in the chat, as a standalone message with a click-to-zoom lightbox. Discipline is baked into the tool description: it fires on explicit request or clear necessity, not for every image the agent reads
• Zero context cost — displayed images travel via the tool result's details channel (persisted to the session file for history replay) and never enter the model's context, so showing you a picture doesn't spend tokens. If the model needs to see the image itself, it uses read as before
• Image groups in one call — show_image({paths}) sends 1–9 images at once. Thumbnails auto-size by count (single image keeps its natural aspect ratio; groups render as one tidy row of squares that shrinks as the count grows)
• Forgiving paths — ~/... home paths, relative paths, and macOS screenshot names with narrow unicode spaces all resolve correctly on the first call
• Same trust level as read — the tool is read-only, allowed by default, and paths outside the project boundary escalate to an approval prompt

Download

Platform	File
macOS (Apple Silicon)	pi-desktop-mac-arm64.dmg
macOS (Intel)	pi-desktop-mac-x64.dmg
Windows	pi-desktop-windows-x64.exe (installer) or pi-desktop-windows-x64.zip

Builds are currently unsigned. On macOS, the first launch may show "Pi Desktop is damaged and can't be opened" — that's Gatekeeper blocking an unsigned download, not actual damage. Fix it by removing the quarantine flag: xattr -cr "/Applications/Pi Desktop.app", then open normally. On Windows, click "More info" → "Run anyway" when SmartScreen appears.

Full Changelog: v0.1.3...v0.1.4

v0.1.3

A security-hardening release for the built-in permission gate: dangerous commands can no longer hide inside chained or wrapped shell commands, and file tools now ask before touching anything outside your project.

Highlights

• Chained commands can't smuggle danger — bash approval used to only match the command string as a whole, so cd xx && ls && rm -rf xxx slipped through without a prompt. The gate now splits on &&, ||, ;, |, & and newlines, evaluates every segment, and applies the strictest verdict (deny > ask > allow). Splitting is quote-aware: echo "a && rm -rf x" stays a harmless string literal, and 2>&1 redirections aren't mistaken for separators
• No hiding in substitutions or wrappers — $( ) and backtick command substitutions (including nested ones and those inside double quotes) plus sh -c / bash -lc / eval wrappers are unwrapped layer by layer and evaluated too. echo $(rm -rf x) and bash -c 'rm -rf x' now prompt just like the bare command
• Project boundary for file tools — read/edit/write/ls with paths that resolve outside the session's project directory (including ../../ relative escapes) now escalate to an approval prompt instead of passing silently. Paths inside the project stay approval-free as before. Note: bash itself isn't path-constrained (a cd can go anywhere), so the boundary applies to file tools only
• "Always allow" remembers less — the session whitelist key for bash now includes flag-shaped second tokens, so approving rm -rf xxx remembers rm -rf* instead of rm*. Granting always-allow no longer whitelists every possible rm invocation for the rest of the session
• Approval dialogs for chained commands now title themselves with the actual dangerous segment, so you see at a glance which part of the chain triggered the prompt

Known limits of the pattern-based gate (unchanged): wrappers like xargs, find -exec, python -c, and symlink escapes can't be caught by string matching.

Download

Platform	File
macOS (Apple Silicon)	pi-desktop-mac-arm64.dmg
macOS (Intel)	pi-desktop-mac-x64.dmg
Windows	pi-desktop-windows-x64.exe (installer) or pi-desktop-windows-x64.zip

Builds are currently unsigned. On macOS, the first launch may show "Pi Desktop is damaged and can't be opened" — that's Gatekeeper blocking an unsigned download, not actual damage. Fix it by removing the quarantine flag: xattr -cr "/Applications/Pi Desktop.app", then open normally. On Windows, click "More info" → "Run anyway" when SmartScreen appears.

Full Changelog: v0.1.2...v0.1.3

v0.1.2

A features-and-polish release: branch any conversation into a new session, reference project files with @, and a calmer, theme-aware UI.

Highlights

• Fork from any AI reply — hover an assistant message and hit the fork icon to branch the session at that exact point into a new tab. The original conversation stays untouched in your history, so you can explore a different direction and come back anytime. The same hover row also has a one-click copy for the reply text
• @ file references — type @ in the composer to fuzzy-search project files, drill into directories, and pin picks as light-blue chips above the input. Long paths truncate from the front so the file name stays visible; Backspace on an empty input restores the chip to editable full-path text. References are kept per draft and travel with the message
• Slash commands, trimmed — the panel now only lists what actually works on desktop: /compact (now with an optional [focus] to steer the summary), /name, /export, /settings. Templates, skills, and extension commands still run natively
• Theme-aware shadows — all elevation shadows are now semantic tokens: dark projections in light mode, a soft white glow in dark mode, so floating elements (menus, tooltips, dialogs, the composer) stay visible in both themes. Tooltips also got a cleaner borderless solid-card look
• Chat polish — the Working shimmer sweep is visible again in dark mode; the live preview row no longer makes the conversation bounce while tools start and stop; streaming tool calls show clean summaries as they type (Bash ls -la instead of raw JSON)

Download

Platform	File
macOS (Apple Silicon)	pi-desktop-mac-arm64.dmg
macOS (Intel)	pi-desktop-mac-x64.dmg
Windows	pi-desktop-windows-x64.exe (installer) or pi-desktop-windows-x64.zip

Builds are currently unsigned. On macOS, the first launch may show "Pi Desktop is damaged and can't be opened" — that's Gatekeeper blocking an unsigned download, not actual damage. Fix it by removing the quarantine flag: xattr -cr "/Applications/Pi Desktop.app", then open normally. On Windows, click "More info" → "Run anyway" when SmartScreen appears.

Full Changelog: v0.1.1...v0.1.2

v0.1.1

A polish release: built-in web fetching for the agent, at-a-glance session status in the tab bar, and a round of minimalist UI cleanup.

Highlights

• Built-in webfetch tool — the agent can fetch web pages directly, with SSRF guards (blocks private/loopback targets) and boilerplate stripping for cleaner page text
• Session status at a glance — every tab now shows its own state on the avatar: a slow breathing dot while the agent is working, amber when waiting for your approval, and a small green badge when a background session finishes — cleared when you look at it
• Instant session titles — tabs get a meaningful title from your first message right away, instead of waiting for the whole first task to finish
• Monochrome icon system — tab and project icons unified to black-and-white (was a mix of violet/blue/green), keeping amber and green as the only semantic accents
• Custom tooltip — a small gray pill with a steady 300ms hover delay replaces native OS tooltips that lagged, followed the cursor, and looked out of place
• Icon-only provider actions — test, set key, and remove credentials in Settings are now clean icon buttons with tooltips

Download

Platform	File
macOS (Apple Silicon)	pi-desktop-mac-arm64.dmg
macOS (Intel)	pi-desktop-mac-x64.dmg
Windows	pi-desktop-windows-x64.exe (installer) or pi-desktop-windows-x64.zip

Builds are currently unsigned. On macOS, the first launch may show "pi-desktop is damaged and can't be opened" — that's Gatekeeper blocking an unsigned download, not actual damage. Fix it by removing the quarantine flag: xattr -cr /Applications/pi-desktop.app, then open normally. On Windows, click "More info" → "Run anyway" when SmartScreen appears.

Full Changelog: v0.1.0...v0.1.1

v0.1.0

The first public release of pi-desktop — a desktop GUI for the Pi coding agent. The official Pi SDK runs in the Electron main process: same engine as the CLI, same ~/.pi/agent/ configuration — with a clean visual interface for those who prefer a GUI.

Highlights

• Multi-session chat — project sidebar, per-session composer drafts, and a follow-up queue with undo
• Visual permission gates — approve or deny each tool call from a dock, backed by a per-tool rule engine
• Project trust gate — prompt before loading project-local extensions, skills, and prompt templates
• Streaming markdown rendering — with image previews and one-click message copy
• Settings — manage providers & models, skills, MCP plugins, and extensions from the UI
• Minimalist by design — a clean, uncluttered interface that stays true to Pi's aesthetic

Inherits from Pi

• TypeScript extensions, skills, and prompt templates installed for the Pi CLI work here too
• Subscriptions (Claude Pro/Max, ChatGPT Plus/Pro Codex, GitHub Copilot) and API keys for Anthropic, OpenAI, Gemini, DeepSeek, Bedrock, and more
• Sessions and auth are shared with the CLI — start in the terminal, continue in the GUI

Download

Platform	File
macOS (Apple Silicon)	pi-desktop-mac-arm64.dmg
macOS (Intel)	pi-desktop-mac-x64.dmg
Windows	pi-desktop-windows-x64.exe (installer) or pi-desktop-windows-x64.zip

Builds are currently unsigned. On macOS, the first launch may show "pi-desktop is damaged and can't be opened" — that's Gatekeeper blocking an unsigned download, not actual damage. Fix it by removing the quarantine flag: xattr -cr /Applications/pi-desktop.app, then open normally. On Windows, click "More info" → "Run anyway" when SmartScreen appears.

Full Changelog: https://github.com/Jaxton07/pi-desktop/commits/v0.1.0