Skip to content

PinDeck 3.0 beta 2: security fix, Linux, the whole deck

Pre-release
Pre-release

Choose a tag to compare

View all tags
@ehabets ehabets released this 22 Oct 10:00
· 79 commits to main since this release
v3.0.0-beta.2
574e230

The second preview of PinDeck 3. It has everything from 2.9 and 2.10, including a security fix, so update from beta.1. It is on npm's beta channel; npx pindeck still installs 2.9.

Security

In 3.0.0-beta.1 the editor page contained the server's token, and the deck needed no token, so another user of the same machine could read both. Now PinDeck prints a one-time login link at start (pindeck login prints a new one), the browser keeps the token in an HttpOnly cookie, and no token appears in any page or on a command line.

What's new since beta.1

  • Everything from 2.9 and 2.10: Linux as a beta (a headless server used through an SSH tunnel), safe saving, Undo/Redo that refuses to overwrite outside changes, decks with their own file names (pindeck talk.html), --asset-root for shared files, @imports in the deck's CLAUDE.md and AGENTS.md, and recognising other slide frameworks.
  • Both assistants work on the whole deck: Claude and Codex may edit and create other files of the deck, never brand.css, vendor/, .git/ or other decks in the folder. One Undo takes back a whole turn.
  • Codex creates files with a new pindeck_write tool and saves through PinDeck's safe saving. It can read asset roots but not write them.
  • Claude may run only PinDeck's own commands (layout, shot, slides, pdf, pdf-figure), each named separately.
  • Fixes: --provider codex without a saved model now picks Codex's default model, also while model lists are still loading. Stopping PinDeck waits for every backend process.

Try it

npx pindeck@beta path/to/deck

Or from the v3-beta branch. Requires macOS, or Linux (beta), Node 20 or later, and Claude Code (claude auth login) or Codex (codex login). Then open the login link PinDeck prints. Settings, chats and backups stay in ~/.pindeck-v3, apart from v2.

Known limits

  • The Codex integration uses OpenAI's experimental dynamicTools app-server extension, so a future Codex update may need a PinDeck update.
  • Try the beta on a copy of your deck.

Please report problems as issues and mention "v3 beta".

Assets 2
Loading