PiClaw v3.3.3 — “Batteries Not Included”

PiClaw v3.3.3 — “Batteries Not Included”

The maintenance department has repaired the phone’s Delete button, fitted the GPU gauges with better instruments, and clarified which doors an add-on may use. The desktop application has meanwhile left the building. Its historical releases remain available, but new releases will concentrate on the web interface, server, containers and portable command-line packages.

Dependency updates arrive together, with their browser and authentication compatibility repairs included. The committee responsible for moving one chair at a time has been replaced by a committee capable of checking whether anyone is still sitting in it.

Highlights

• Keychain controls work on narrow screens. Delete and confirmation controls remain reachable on phones, with touch targets and keyboard focus behaviour preserved.
• GPU meters show more useful telemetry. VRAM displays gain sparklines and alignment fixes; optional NVML data adds GPU activity history.
• Add-ons gain dictation and authenticated socket hooks. Lifecycle fixes and qualification cover the new extension surfaces.
• Provider waits and proxy handling improve. Bounded wait fixes address slow prompt startup, while trusted-proxy HTTPS handling controls secure cookies and HSTS correctly.
• Dependencies move forward together. Browser, passkey and consumer compatibility fixes accompany the upgrades. Native desktop applications are discontinued.

Controls within reach

Keychain action cells wrap correctly at narrow widths. Delete, Yes and No controls remain inside their action area, with usable touch targets and focus restoration after confirmation.

The fix was exercised in the real Settings interface in Chromium and WebKit at phone, tablet and desktop widths. The button is once again responsible for deleting the selected entry, rather than testing the user’s accuracy.

Better instruments

VRAM meters gain sparklines and consistent alignment. Optional NVML telemetry supplies GPU activity readings and history alongside memory usage.

These displays depend on available telemetry. Unsupported or unavailable measurements are not invented to keep the instruments looking busy.

Add-on connections

Core hooks support dictation providers and authenticated add-on sockets. Follow-up changes address dictation lifecycle, import and socket behaviour, public hook parity and keychain availability.

Tool-activation responses report the effective active tools. Session-command eviction protection and activation guidance improve recovery paths.

These are extension surfaces and supporting fixes; they do not install or activate a server-dictation service automatically.

Same-origin widgets can also load WebAssembly through the qualified widget capability path.

Providers and proxies

Provider-concurrency fixes bound waits associated with prompt startup and provider operations.

Trusted-proxy HTTPS handling determines secure-cookie and HSTS behaviour from the trusted request context. Operators should retain the intended proxy trust configuration; forwarding headers from arbitrary clients do not acquire authority by arriving confidently.

The strict reply-persistence adjustment is scoped to UI-only theme replies.

Dependencies and desktop retirement

The coordinated update includes:

• Preact 11.0.1, with browser and consumer compatibility fixes.
• SimpleWebAuthn 14.0.3, with coordinated ASN.1 dependency pins.
• OpenAI 7.31.0.
• Updated GitHub Actions pins.
• Pi 1.1.0, unchanged.

Native desktop application source, build commands and release-asset production are removed. Existing historical desktop assets are retained. Web, server, container and portable command-line installations remain supported.

Related piclaw-addons #201 coordinates Pi 1.1 compatibility and browser/consumer fixes. Add-ons retain their separate publication lifecycle.

Documentation

The provider-pricing audit under docs/finops/2026-10-11/ updates reference material. It does not change runtime routing or rewrite historical pricing dossiers.

Known limits

• Native MCP remains experimental; Adapter selection is unchanged.
• Local-lite remains opt-in and defaults to off.
• Dictation hooks require a provider implementation and configuration.
• NVML activity telemetry requires compatible hardware and tooling.
• No native desktop application assets accompany this release.
• The monthly release cadence and planned pi-durable transition remain unchanged.

Upgrade

Update using the repository installation instructions for v3.3.3. Preserve workspace data and configuration, then restart through the service manager appropriate to the installation.

Desktop users should use the web interface or a supported server/container/portable installation. Historical desktop downloads remain available, but will receive no new builds.

The instruments are fitted, the controls are reachable, and the maintenance department has stopped promising to supply a desktop with every set of batteries.

Complete core PR list

• #1623 — VRAM sparklines and alignment.
• #1625 — Dictation providers and authenticated add-on sockets.
• #1627 — Same-origin widget WebAssembly capabilities.
• #1628 — Provider concurrency and bounded prompt-startup waits.
• #1622 — Provider-pricing documentation audit.
• #1624 — NVML GPU activity meters and history.
• #1629 — Trusted-proxy HTTPS handling.
• #1630 — Dictation, hook, keychain and recovery fixes.
• #1631 — Remaining qualification and scoped persistence fixes.
• #1640 — Coordinated dependencies and native desktop retirement.
• #1641 — Phone Keychain Delete hit-testing.

Release machinery

Serial integration stages receive a twenty-minute allowance within the thirty-minute job limit, avoiding premature termination of the expanded runtime suite. Environment observations are refreshed for the workflow setting.

Global and container package installation preserves the root dependency overrides, keeping Pi and authentication dependencies on the qualified versions instead of resolving incompatible transitive versions.