PiClaw v3.3.0 — “Modern Times”

PiClaw v3.3.0 — “Modern Times”

The factory has been refitted while the workers were still arguing with the machinery. MCP servers get a management desk, provider login gets a private interview room, and the conversation timeline is required to contain the conversation. The GPU department has been issued meters. Previously it was allowed to describe its workload by making the rest of the building warm. Management called this telemetry. The fire brigade had another word.

The promised Earendil upgrade also happened. Then upstream kept moving, so the migration followed it through to Pi 1.0.4. The factory now checks the version stamped on the actual package, having learned that an upstream announcement is neither a delivery receipt nor a signed confession. This release concerns the tools you can use, the controls you can reach, and the long-standing arrangement whereby one SQLite writer could establish a five-second dictatorship while the interface stood respectfully silent.

Highlights

• Manage MCP servers in Settings. Classic and Visual can preview and apply adapter server overrides for transport, authentication references, tool exposure, lifecycle and timeouts, while preserving inherited and private configuration.
• Enable MCP codemode deliberately. Adapter scripting has Auto/On/Off controls and acknowledged Apply. Nested tool calls retain policy hooks; model execution inside scripts is disabled.
• Provider login keeps its secrets to itself. Owner-bound, transient dialogs handle sensitive instructions and inputs; successful login requires an explicit action before selecting a model.
• Return to a conversation without losing the middle. Cached timelines catch up through contiguous pages, restore their viewport and reading position, and offer a compose-divider handle to jump to latest.
• Inspect supported GPUs without hiring a subprocess per glance. Linux Intel i915 gets activity and memory details; NVIDIA VRAM uses a shared, cached NVML worker.
• Send and pin while the database is busy. Input admission yields during writer contention; pin and picker conflicts report a retryable failure instead of holding the web event loop hostage.
• Pickers stop hiding the matches they found. Model and session popup headings stay in normal flow during typeahead instead of covering the first result. Disabled meter rows also disappear; actual zero readings stay visible.

MCP acquires a personnel department

Both web skins now expose adapter server management through owner-only Settings. Preview shows the proposed effective configuration before Apply; edits invalidate old previews. Disabling a server leaves it inert. Removing a local override may reveal an inherited definition, and the preview warns about it. The office will accept a resignation, but it must first check whether someone downstairs still employs the same server.

Apply requires acknowledgement that active turns may be interrupted. Server changes drain current main and side sessions, await adapter shutdown acknowledgements, save privately and reload through a common startup barrier while retaining session identity and history. A failed activation reports saved but not activated. The old server must acknowledge its departure before a successor starts; a death certificate signed by the replacement is no longer considered sufficient evidence.

Adapter codemode can be switched on or off for current and new sessions. Auto leaves scripting inactive, On enables it, and Off blocks it even after explicit tool activation. Scripts can make nested tool calls under the existing policy hooks. Images and truncated output can be written to private temporary files with reported paths. Model execution inside scripts remains disabled: the accounts department has declined to approve a machine that can employ another machine without establishing who receives the invoice.

The standard MCP adapter remains the runtime owner. Native engine replacement is unavailable; unsupported Native configurations fail closed. Tool exclusions apply before discovery and calls, and keychain-backed server credentials stay scoped to their server and configuration generation. Moving an endpoint does not quietly transfer the old destination's credentials to its new landlord. An empty discovery result is not a licence to rummage through the credential cupboard.

Login, without an autobiography in the transcript

Provider authentication now binds each flow and one-use action to its initiating owner, chat, session generation and runtime. Sensitive URLs, device codes, prompts and submitted values stay in transient dialogs; persisted cards contain generic text and opaque action references. Provider error details are filtered from public streams and authentication diagnostics.

Closing or expiring a dialog clears its inputs and cancels the pending interaction. Replayed or replaced-session actions cannot complete it. Login refreshes model availability but never selects a model automatically, even when only one is available. One candidate is still a choice; the electorate has not been abolished for administrative convenience.

Custom provider keys are stored separately from model configuration and are not prefilled into forms. Credential files are replaced atomically. The Pi 1.0.4 runtime retains the refresh fix that preserves a rotated OAuth credential when a refresh has started but delivery of the requesting response is cancelled. Cancelling a conversation should not annul the provider's decision to retire the old token.

These flows have extensive synthetic device, browser, packaged-CLI and privacy coverage. That evidence does not certify every live provider account or authorise a production login, refresh or revocation experiment.

The factory follows upstream through another turnstile

The source now pins the exact released Pi 1.0.4 package family. Tool-selection checks cover built-in-only lists, MCP server wildcards, exclusions and empty lists; packaged CLI checks verify that --no-mcp and the shipping --no-extensions path do not start a configured native MCP server. The test server remains unemployed, which is the requested result rather than a performance regression.

OAuth registration checks cover native loopback/custom-scheme redirects and web HTTPS redirects. Fresh private-login UI, retained-wrapper MCP/codemode and plain-subprocess Delegate CLI checks ran against 1.0.4 with synthetic responses. They establish those package paths, not a live-account blessing, a Native MCP cutover or permission to spend money. Production upgrade and rollback still need their own approval.

The timeline is required to contain time

Returning to a cached chat after many new messages now loads contiguous catch-up pages instead of stitching the newest handful onto an older conversation and hoping nobody notices the missing shift. Classic sizes its rendered row window to the viewport and reconciles on resize or foreground return. Both skins preserve the reader's position rather than dragging them to the newest message.

While away from latest, a small chevron appears on the compose divider; new arrivals accent it. Tap or keyboard activation jumps to latest. Classic retains drag-to-resize. Older-page failures offer an explicit retry rather than a self-perpetuating committee of requests.

Visual image previews now escape clipped or transformed thumbnail containers, so narrow windows no longer imprison the picture behind the furniture. Final answers and commentary also carry clearer server-owned classification, separate from whole-run termination. That classification does not turn an unmarked historical message into something safe to delete.

The machine room admits to having machines

On supported Linux Intel i915 devices, GPU and GMEM meters show observed engine activity, client-reported memory, sample age and coverage. Tap or use the keyboard on the meter for details. Missing or stale data displays as unknown; unsupported machines get no decorative GPU controls. Intel shared memory is not labelled dedicated VRAM, and observed clients are not presented as a whole-device census.

NVIDIA VRAM sampling uses optional NVML through one lazy Bun worker and a shared cache, replacing per-snapshot nvidia-smi launches. GPU collection is demand-driven; ordinary UI status polling does not keep it employed. Disabled or unavailable optional meter rows are hidden, while valid zero readings remain visible. GPU details use a smaller popup with independently available activity and memory fields; the factory no longer dedicates floor space to an instrument that has declined to exist. A worker keeps synchronous driver calls off the HTTP event loop, but it is not native crash isolation. A driver-library crash can still terminate the process.

SQLite has been relieved of its supervisory duties

Ordinary and queued single-user inputs now wait asynchronously for write admission. Durable commit still precedes acknowledgement, SSE and scheduling. Pin operations avoid synchronous lock waits, and picker reads avoid unnecessary writes; recognised contention produces an explicit retryable response. The interface gets to keep breathing while the database finishes its transaction.

Long-history context projection snapshots policy per request, batches deterministic work and yields between batches instead of repeatedly reading configuration through the history. Authentication reuses compiled SQL, expired sessions can be denied without obtaining a writer lock, and legacy-login repairs revalidate identity after waiting. An expired login no longer needs to queue for permission to be dead. Fresh schema creation and expired tool-output cleanup are batched. These are targeted fixes, not a promise that every response is faster or that the reported thirty-second delay has been fully explained.

Bun script output-finalisation errors now settle once with a warning that the script may already have made changes. The runner does not execute the script again merely because the filing cabinet objected to the report.

The token-cost resolver adds undiscounted native Mistral Large 4 pricing for its documented mistral route aliases. The launch discount stays out of cost estimates and comparison rankings; equal-token arithmetic is not a claim about task quality. The accounts department has learned to distinguish a tariff from a promotional leaflet.

Release resilience tests now use known context, controlled loopback responses and actual start/end assertions instead of waiting for an essay to probably finish. Incremental test progress survives an interrupted run. The compaction UI also invalidates its cached idle snapshot on a new compaction intent, so an old poll cannot quietly declare the working machine unemployed.

Bundled core add-ons

The catalog's core roster travels with a fresh installation. Existing workspaces keep their installed versions, upgrades and removals; the personnel office is still forbidden from rehiring an add-on you dismissed.

Add-on	Bundled version
Code Review	0.1.8
Delegate	0.2.18
Goal	0.1.48
Observability	0.1.17
Plan Sidebar	0.1.25
Restic	0.1.3
Session Dashboard	0.2.4

Delegate remains a plain subprocess and inherits the launching session's thinking level. The release snapshots the catalog and exact tarball checksums; later catalog edits cannot rewrite these artifacts.

Security updates

Exact overrides update proxy-addr to 2.0.8 for critical IP-spoofing advisory GHSA-jqcg-44mw-7w3h, basic-ftp to 6.2.2 for high-severity CPU denial of service GHSA-c475-qrg2-pj4r, and brace-expansion to 5.0.12 for GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p and GHSA-q2hr-2g5m-vwhr. hono moves to 4.13.13 for XSS advisory GHSA-hxh3-vqpv-xpqv; smol-toml moves to 1.9.0 for parser CPU denial of service GHSA-r4xh-jqrq-34v2. Further high-severity findings are addressed by @modelcontextprotocol/client 2.3.1 and @modelcontextprotocol/sdk 1.32.1 for OAuth credential-destination advisory GHSA-6qxp-vccf-f47h, and direct sharp 0.35.5 for its bundled librsvg advisory GHSA-wq5f-xc86-pv6w. The candidate's core production audit reports no vulnerabilities across 407 packages; this is not an audit of every optional add-on or external MCP server.

Upgrade and unfinished business

• The candidate uses Pi 1.0.4 with the retained MCP wrapper. It does not activate pi-durable, Harness/Pico3 or Native MCP replacement.
• The experimental parent-executed Delegate provider host and shared paid-request enforcement remain inactive. The shipping Delegate path stays a plain subprocess; an actual packaged Pi 1.0.4 CLI smoke checked synthetic responses and thinking-level propagation. Request-reservation foundations do not activate the experimental host: public raw authentication/provider settlement and account-generation contracts, plus final production qualification, are still missing. The bundled shipping version is 0.2.18.
• The built-in Azure provider ID changes to azure. Update provider keys in auth.json and models.json, and model-selection keys to azure/<model>. The API identifier azure-openai-responses, AZURE_OPENAI_* environment names and optional custom azure-openai/azure-foundry providers are unchanged. Retired explicit selections are refused rather than silently falling back to another model.
• Before deployment, take a verified snapshot of configuration, databases, sessions and credentials. Resolve old/new Azure-key conflicts explicitly. Rollback must account for rotated OAuth credentials; do not restore superseded refresh tokens blindly.
• Fresh-workspace bundled add-ons resolve declared host peers from the creating runtime without a startup package-manager or network call. Existing workspaces are not repaired or reseeded. Relocating or removing that runtime requires a separate peer-link migration.
• GPU coverage is device-specific: Intel xe and whole-device PMU monitoring are excluded; NVIDIA native arm64 and multi-GPU paths have synthetic coverage only. The seeded-peer Windows junction path lacks a new native execution receipt.
• Live account/server validation and deployment approval remain separate from the source and synthetic qualification recorded so far. Release gates are tracked separately from these feature claims.

The factory is open for inspection. Departments without completed authority, lifecycle and billing contracts remain behind their locked doors. A brass plaque saying Foundation is not an operating licence, however enthusiastically the committee polishes it.

Complete merged PR list

• Package and MCP foundations: #1459, #1460, #1461, #1462, #1463, #1464, #1465, #1467, #1468.
• Provider authentication and qualification: #1469, #1470, #1471, #1472, #1473, #1474, #1475, #1476, #1477, #1478, #1479, #1480, #1481, #1482, #1483, #1484, #1485, #1486, #1487, #1488, #1489.
• MCP controls, Pi 1.0 and web fixes: #1490, #1491, #1496, #1497, #1498, #1501, #1502, #1503, #1504, #1508, #1512, #1514, #1516, #1517.
• Settings, responsiveness and Pi 1.0.1: #1523, #1525, #1528, #1529, #1530, #1532, #1533, #1534, #1535, #1536, #1537, #1539, #1540, #1541, #1542, #1543.
• Inactive request foundations and Pi 1.0.2: #1544, #1546, #1547, #1548, #1549, #1550, #1552.
• GPU meters, timelines and historical Pi 1.0.3 qualification: #1555, #1557, #1558, #1560, #1561, #1562, #1563, #1564, #1565, #1566.
• Current Pi 1.0.4 and UI refinements: #1569, #1573, #1574.
• Release metadata, bundled add-on refresh and security pins: #1576.
• Pricing and release resilience: #1584, #1585.
• Private release-test configuration and final security pins: #1586, #1587.