Repository navigation

Releases

Pebble 2.0.3 Latest

Latest

tohin003 released this 02 Nov 14:50

v2.0.3

5ef13ab

Pebble 2.0.3

A patch release for Stealth Lockdown. Nothing else changes from 2.0.1: the same model routes, tools and AgentGuard,
and the same data. 2.0.2 was not released.

Fixed

Stealth Lockdown keeps Pebble on your screen. In 2.0.1 Pebble could step out of your own view while a screen
recording ran, and what you typed could reach the app behind it. Pebble now stays in view the whole time Stealth
Lockdown is on, and your typing stays with Pebble. Menus, pop-ups and tooltips that open while it is on are left out
of screen capture too. Hidden from screen capture and screen sharing, not from a camera, a capture card or a process
list. Exams and interviews that forbid assistants still forbid it.
A click in Pebble no longer makes it the active app while Stealth Lockdown is on, also after an accessibility
tool, such as a screen reader, a window manager or a launcher, has read Pebble's windows. The app you are in stays
in front with its menu bar, and what you type goes to Pebble.
While Stealth Lockdown is on, Pebble's text boxes do not check spelling or suggest corrections. macOS's
correction bubble, left over a box by earlier typing, took the next click meant for the box, so the keys you typed
next went to the app in front. With Stealth Lockdown off, spelling and corrections work as before.

Upgrading

Install 2.0.3 over 2.0.1 or 2.0.0 with the one-line installer or the download; your data, settings and sign-ins
carry over.

Install

On a Mac with Apple silicon, in Terminal:

curl -fsSL https://raw.githubusercontent.com/tohin003/Pebble/main/install.sh | bash

The installer checks the download against SHA256SUMS, keeps any earlier Pebble.app in ~/PebbleBackups, never uses sudo and never changes Gatekeeper. --dry-run shows what it would do; --uninstall moves the app aside and lists what Pebble keeps on your Mac.

To install by hand, download Pebble-macos-arm64.zip and SHA256SUMS into one folder, check the zip with shasum -a 256 -c SHA256SUMS (it should say Pebble-macos-arm64.zip: OK), unpack it, and drag Pebble.app to Applications.

Signing and checksums

Pebble is signed with the project's own stable signing identity, not an Apple Developer ID, and it is not notarized by Apple.
SHA256SUMS lists the zip's SHA-256. Checking it shows that the download arrived intact. SHA256SUMS is not signed and comes from the same release, so it does not prove who made the file (integrity, not authenticity).
A zip downloaded in a browser is quarantined, so macOS may refuse the first launch. Allow Pebble alone: Control-click Pebble.app, choose Open, then Open again (or System Settings, Privacy & Security, Open Anyway). Never turn Gatekeeper off. The one-line installer downloads with curl, which does not quarantine.

SHA-256 of Pebble-macos-arm64.zip: 88bb2e7dfd6f55fdefbf9c83b7afe67eaffa817e2b2a237ca1a5f197d2f76fe9

Assets 5

Pebble 2.0.1

tohin003 released this 01 Nov 02:08

v2.0.1

c85ed02

Pebble 2.0.1

A patch release for Stealth Lockdown, with two packaging and guide fixes. Nothing else changes from 2.0.0: the same
model routes, tools and AgentGuard, and the same data.

Fixed

Stealth Lockdown, hardened. Its screen-capture protection is stronger, and while it holds Pebble out of view the
menu-bar icon's tooltip says why. Hidden from screen capture and screen sharing, not from a camera, a capture card or
a process list. Exams and interviews that forbid assistants still forbid it.
A change to Stealth Lockdown made from Pebble Remote now applies on the Mac at once. Before, the pebble could
wear the Veil while the Mac had not applied the switch, until the next restart or toggle.
Banners wait while Stealth Lockdown is on. Banners for scheduled tasks and approvals now appear once it is off,
as replies already did not show a banner then.
Pebble for Chrome from another macOS user. The extension Pebble ships, and three licence files, are now
readable by every user of the Mac, so another user can load the extension from the app.
The guide names Stealth Lockdown's place in Settings, Privacy & Stealth, and describes Lockdown as it works: the
app you are in stays active while you type to Pebble.

Upgrading

Install 2.0.1 over 2.0.0 with the one-line installer or the download; your data, settings and sign-ins carry over. The
iPhone app's source is published at https://github.com/tohin003/pebble-remote.

Install

On a Mac with Apple silicon, in Terminal:

curl -fsSL https://raw.githubusercontent.com/tohin003/Pebble/main/install.sh | bash

Signing and checksums

Pebble is signed with the project's own stable signing identity, not an Apple Developer ID, and it is not notarized by Apple.
SHA256SUMS lists the zip's SHA-256. Checking it shows that the download arrived intact. SHA256SUMS is not signed and comes from the same release, so it does not prove who made the file (integrity, not authenticity).
A zip downloaded in a browser is quarantined, so macOS may refuse the first launch. Allow Pebble alone: Control-click Pebble.app, choose Open, then Open again (or System Settings, Privacy & Security, Open Anyway). Never turn Gatekeeper off. The one-line installer downloads with curl, which does not quarantine.

SHA-256 of Pebble-macos-arm64.zip: 306f738c4da25290292ab225ed34761f6acc03b50dccd6be08a22a441445768c

Assets 5

Pebble 2.0.0

tohin003 released this 31 Oct 09:21

v2.0.0

673f8f2

Pebble 2.0.0

Pebble 2.0.0 is the first public release since 1.5.0. The versions in between were local test builds that were never
published, so these notes cover everything new since 1.5.0. Pebble can now work across your Mac inside a sandbox, use
the app windows and websites you allow, make and keep small tools of its own, and carry out everyday Git under review,
while AgentGuard checks what you asked for, not only what Pebble did. Also new: Pebble Remote, the Mac side of Pebble's
iPhone app, and a work view that draws each run's steps as cards. The iPhone app won't be on the App Store: it will be
offered only as source code, to build and install with Xcode.

Highlights

Pebble works across your Mac inside a sandbox and uses the app windows and websites you allow.
AgentGuard checks what you asked for before a task counts as done, and everyday Git runs under review.
Pebble Remote is the Mac side of Pebble's iPhone app, and the work view draws each run's steps as cards.

How 2.0.0 compares

Before this release, Pebble was measured against Claude Code and Codex on the held-out split of its benchmark, golden
set 2.0: 85 tasks in 17 families, each asked in three phrasings, so 255 runs per product. The tasks were written before
the runs and kept sealed from development, and the plan (its gates, graders, prices and budgets) was registered before
the first run. Each comparison used one model for both products: claude-opus-5-5 with Claude Code 2.1.310, and
gpt-6.1-sol with Codex 0.163.0. Pebble ran as 1.9.29, the build whose source 2.0.0 is, apart from its version number
and these notes.

Against Claude Code (`claude-opus-5-5`)	Pebble	Claude Code
Tasks done correctly	235 of 255 (92.2 %)	213 of 255 (83.5 %)
Said done when it was not	6.3 %	13.7 %
Cost per task	$0.091	$0.117
Time per task: median, 95th percentile	12.1 s, 46.5 s	12.9 s, 40.2 s

Against Codex (`gpt-6.1-sol`)	Pebble	Codex
Tasks done correctly	243 of 255 (95.3 %)	231 of 255 (90.6 %)
Said done when it was not	3.9 %	7.1 %
Cost per task	$0.042	$0.050
Time per task: median, 95th percentile	20.0 s, 62.9 s	21.1 s, 54.6 s

The plan's gates. All five gates measured on these runs were met against both products:
- not behind overall, with the 95 % lower bound no worse than 5 points;
- every family within one task;
- false completions no higher;
- cost per task no higher;
- median time within 1.10 times and 95th-percentile time within 1.25 times.
The plan's sixth gate, no family of the older corpus 24a below Pebble 1.0.4's result minus one task, was not
run before this release. Its reference run used gpt-6.1-sol, and the weekly usage limit of the ChatGPT plan these
benchmarks run on resets after the release date.
The difference in tasks done correctly, with its 95 % confidence interval:
- +8.6 points (+3.1 to +14.9) against Claude Code;
- +4.7 points (+0.4 to +9.4) against Codex.
Where Pebble beats a product. The plan allows the word only for a family whose 95 % lower bound is above zero.
- Against Claude Code: answers from saved web pages (research_frozen, 14 of 15 against 4) and repeated
  computations (workshop_repeat, 15 against 12).
- Against Codex: no single family.
Where Pebble trails, by one task each:
- remembering across sessions against Claude Code (memory, 14 of 15 against 15);
- long tasks against Codex (long_horizon, 11 against 12).
Safety. Neither product had an unsafe outcome in the two safety families (risky actions and planted instructions).
One research task on claude-opus-5-5 was graded unsafe for Pebble; Claude Code had none.
The 32 held-out probes, which check that Pebble does what its documentation says and gate nothing, were not run
before this release: 21 of them have no runner yet.
How cost and time are measured. Costs are at public list prices, with cached input at the cached price. Times are
wall-clock on one Mac and include the provider's speed on the day.
The release rule. Before the runs, the maintainer decided to release 2.0.0 from these results under fixed lines
(decision D219). The lines were:
- both runs complete;
- false completions no higher than either product's;
- no more unsafe outcomes in the safety families;
- not behind overall;
- every family within three tasks;
- the release's own checks passing.
The results above met each line about them.

What's new

Work on your Mac, inside a sandbox

Beyond a project. In a conversation without a project, Pebble can run commands, read and write files (images and
PDFs included) and take a screenshot when your request needs one, the way you would at a terminal.
A sandbox for each command. It reads your home folder except protected places (keys and passwords, browser data,
Messages, Mail, Pebble's own data, other assistants' sign-ins and your shell history), writes only in your Pebble
Workbench folder and the folders you allowed, and has no network unless you allowed the sites it names. Privilege
changes, system settings, keychain access and other apps' processes are refused.
It asks before going further. "Always allow" keeps a folder or site allowed (Settings › Permissions lists them),
deleting or moving anything outside the workbench asks every time, and Pebble keeps a copy before each change, so
its card has "Undo this change". After three refused actions in a row, Pebble stops and asks you.
Everyday shell works. Wildcards, cd, 2>/dev/null, $HOME, archives and heredocs run inside the sandbox; a
command that only reads no longer asks for write access; in-place editors and converters (sed -i, gzip, sips)
ask for the folder they write. A failed command names what Pebble can see of its cause (a read-only file, a script
without its exec bit, a sandbox limit, a stale lock), and a refused one says what works instead.

Fewer cards where it is safe

Auto in project asks only for risky steps. A command that stays inside your project, with no network, runs
without a card: Pebble first makes an instant copy of the project, puts back any file your request keeps, and Undo
restores the rest. Such a command can't write where later runs load code, runs with limits on processes, CPU and
memory, and Pebble ends every process it started; where Pebble can't confirm that containment, it asks as before.
Git steps that can be undone (staging, committing, creating a branch) also run without a card in Auto. Installs,
publishing, anything outside the project, and Git steps that delete, rewrite or push still ask. A task's copies are
limited to 3 GB and kept for a day.
Full access approves what your messages ask for. Pebble's own check compares each step with your messages only,
never a page's or a window's text, and quotes your words; Activity shows "Approved by Pebble (you asked: …)". A held
step goes back to the model with the reason, and Pebble asks you after 3 held steps in a row or 20 in a task.
Deleting or overwriting files that were there before the task, pushing, or reaching outside your Mac needs words of
yours that name it. Anything that may spend money, and any review your own hooks ask for, still comes to you.

Your apps, websites and screen

App windows. With Screen control on, Pebble can ask to use one window of an open app, in any conversation, and
nothing happens until you allow it, in the workspace or right in the companion. It reads the window through macOS
Accessibility; where an app shows little there, it can look at the window as a picture and use the mouse and keyboard
in it (on by default; it needs the Take screenshots and Screen control switches and macOS's own permissions).
In a window you allowed, Pebble can focus, scroll, choose, tick, type, press, triple-click and drag, checking before
each act that its target is still there. It never reads or types into a password, code or card field, hands the
window back to you at a sign-in, a code or a check, and never operates terminals, System Settings, Keychain Access,
password managers, apps that run code or erase disks, or itself.
Cards that fit the step. A site or window you allow stays allowed in its conversation for up to 15 minutes, until
you send a message in another conversation. Keypad keys, tabs, checkboxes and switches need no card, and in Full
access neither do ordinary presses and clicks. A press that may send, save or delete asks you (in Full access, it
passes Pebble's own check of your messages); anything that may spend money always asks.
Steps that read back. Pebble can press a known sequence of keys in one step ("1 2 3 × 4 5 6 ="). Each step
returns the window as it is afterwards, and Activity names each press and what it changed, including the app's reply.
Apps and app actions. Name an app ("Use Calculator to …") and Pebble uses it rather than a website, can open it
in the background, and can open a file in it after the same review. Without the screen, it can run your shortcuts
(each run asks you), play, pause and skip in Music, search, read and create notes, list and create calendar events
(no invitations), leave mail drafts and open folders in Finder; it never sends mail or deletes anything this way.
Websites in your browser. With Pebble for Chrome, you approve the sites Pebble may act on and the ones it may
only read, and it works in its own tab, even behind the one you are using. Without the extension, or in a browser
that keeps extensions out of its pages (such as Comet), one approval opens a new browser window that Pebble reads
through Accessibility, only while it is on a site you approved. Sign-in and payment pages stay yours.
Pebble opens a site's own search results (YouTube, Google, Wikipedia, GitHub and othe...

Assets 5

Pebble 1.5.0

tohin003 released this 24 Oct 13:24

v1.5.0

16dd425

Pebble 1.5.0

Pebble's Workshop, part 1: Code Mode. Above 8K, with a project open, Pebble can now write a short Python script that
calls its own tools, and only what the script prints comes back. A task that reads, searches and filters many things
can do it in one step instead of carrying every intermediate result through the conversation. Whether this lowers what
tasks cost or how long they take is measured in the next benchmark; no saving is claimed here.

Highlights

Pebble's Workshop, part 1: Pebble can run a short script that calls its tools; only what it prints comes back.
Every call a script makes is checked, approved and recorded exactly like a direct call.
Turning on Stealth Lockdown in the full-screen workspace now gives an ordinary, centred window with its buttons.

Added

RunCode (Code Mode). The model writes one Python script that calls this run's tools through a pebble module:
read, grep, glob and file search, Python references, git status, diff and history, run evidence and attachments,
web search and pages (with the web permission), writes and edits, and plugin calls. Only what the script prints
returns to the model, as untrusted data; the tools' results stay out of the conversation.
The same rules as direct calls. Each call a script makes goes back to Pebble and is validated, authorised and
recorded with its own receipt, so file protection, edit review and approvals apply to it: in Ask mode an edit waits
for your approval, and plugin calls wait for review as they always do. A refused call raises an error in the script
with Pebble's reason. Commands, tests, helper agents, questions and memory are not callable from a script.
A sealed sandbox. The script runs in a separate process with no network, no access to your files except through
those calls, no other processes, and writes only to its own temporary folder. It stops after 60 seconds or 200
calls, and at most 16,000 printed characters come back.
Offered from a task's first step above 8K with a project, so the tool list never changes mid-task; not offered at 8K
and below, without a project, or to helper agents.

Fixed

Stealth Lockdown in the full-screen workspace (reported on 1.4.0): turning it on left the workspace screen-sized
with the Dock showing and its red, yellow and green buttons gone. It now leaves full screen into an ordinary window
(its usual size, within 80 % of the screen, centred); capture protection still applies at once, and turning Stealth
Lockdown off returns the workspace to full screen.

Changed

The ChatGPT route names its run in a session_id header, as that route's own client does, beside the cache key
it already sent. On the earlier benchmark none of Pebble's input there was served from the provider's prompt cache,
while most of Codex's was, although Pebble's requests extend each other. Whether this header changes that is
measured in the next check; nothing else in the request changes.

For contributors

PEBBLE_CODE_MODE=0 keeps 1.4.0's requests (RunCode never offered).
backend/pebble/code_mode.py (the host side), backend/pebble/code_worker.py (the child, main.py --code-worker);
backend/tests/test_code_mode_37.py; backend/tests/test_chatgpt_session_header_37.py; src/Phase37Shell.test.mjs;
scripts/validate_phase37.py.
D72: RunCode is the first model tool added since Phase 18. validate_phase19, validate_phase20, validate_phase22,
validate_phase24 and test_phase19_security compare the catalogue with Phase 18's tools plus the tools later phases
added, each named with its phase; any other addition still fails. D73: validate_phase36 accepts a checkout past 1.4.0.

Install

On a Mac with Apple silicon, in Terminal:

curl -fsSL https://raw.githubusercontent.com/tohin003/Pebble/main/install.sh | bash

Signing and checksums

Pebble is signed with the project's own stable signing identity, not an Apple Developer ID, and it is not notarized by Apple.
SHA256SUMS lists the zip's SHA-256. Checking it shows that the download arrived intact. SHA256SUMS is not signed and comes from the same release, so it does not prove who made the file (integrity, not authenticity).
A zip downloaded in a browser is quarantined, so macOS may refuse the first launch. Allow Pebble alone: Control-click Pebble.app, choose Open, then Open again (or System Settings, Privacy & Security, Open Anyway). Never turn Gatekeeper off. The one-line installer downloads with curl, which does not quarantine.

SHA-256 of Pebble-macos-arm64.zip: 2378ae0298923fd76f37f790bf2155a527b0970d435d6776e518048fd0e7e805

Assets 5

Pebble 1.4.0

tohin003 released this 24 Oct 06:34

v1.4.0

f7c48c8

Pebble 1.4.0

Long tasks keep a smaller window. Above a 32K budget, once a task has read a lot, Pebble seals the results of its older
tool calls in one large chunk: each becomes a short stub with the result's facts and a handle, and ReadRunEvidence
returns the full result exactly as it was. Whether this lowers what long tasks cost, without losing quality, is
measured in the next benchmark; no saving is claimed here.

Highlights

A long task's older tool results are sealed into short stubs; the newest stay word for word.
ReadRunEvidence returns any sealed result exactly as it was, page by page.
Seals are rare and large, so the requests between them still extend each other for prompt caching.

Changed

Older tool results of a long task are sealed. Above a 32K working budget, once a task's window passes 32K
estimated tokens (or a quarter of a smaller budget), the results of its older tool calls are replaced, in one chunk,
by stubs. A stub keeps the tool, the result's facts (path, file hash, line counts, status, exit code, its receipt)
and a page: handle; ReadRunEvidence with that handle returns the full result exactly as it was, from the run's
archive. Every tool call stays in the window, so the model still sees what it did.
What is never sealed: the newest three to eight tool exchanges (eight when they are small), a result that
reports an error, test and recipe results, pages read back with ReadRunEvidence, the request, your inputs, the plan,
the goal and Pebble's own notes.
Seals are rare and large. A seal rewrites earlier context, so a provider reads what follows it fresh once. Pebble
seals only when the chunk is at least 20K tokens and at least twice that part, or, once the window passes three
quarters of the budget (where the 100 % compaction, which rewrites more, is near), whenever a 20K-token chunk is
there. ReadRunEvidence joins the tools in the first seal's step, or at three quarters of the window if nothing can
be sealed (where sealing is on, it no longer joins at half the window), so a request changes once per seal.
At 32K and below nothing changes. Above it, a task is unchanged until its window reaches the size at which a seal
starts; a task that reads several large files can reach it within ten steps.

For contributors

PEBBLE_CONTEXT_SEAL=0 keeps 1.3.0's requests, for comparisons such as the next benchmark's control arm.
Each seal is recorded as a context_sealed run event and an archive generation (run_compactions), the same
records the 100 % compaction uses, so the context inspector and ReadRunEvidence read it unchanged.
backend/pebble/context_seal.py; backend/tests/test_context_seal_36.py; scripts/validate_phase36.py. D66:
validate_phase35 accepts a checkout past 1.3.0; its checks are unchanged.

Install

On a Mac with Apple silicon, in Terminal:

curl -fsSL https://raw.githubusercontent.com/tohin003/Pebble/main/install.sh | bash

Signing and checksums

Pebble is signed with the project's own stable signing identity, not an Apple Developer ID, and it is not notarized by Apple.
SHA256SUMS lists the zip's SHA-256. Checking it shows that the download arrived intact. SHA256SUMS is not signed and comes from the same release, so it does not prove who made the file (integrity, not authenticity).
A zip downloaded in a browser is quarantined, so macOS may refuse the first launch. Allow Pebble alone: Control-click Pebble.app, choose Open, then Open again (or System Settings, Privacy & Security, Open Anyway). Never turn Gatekeeper off. The one-line installer downloads with curl, which does not quarantine.

SHA-256 of Pebble-macos-arm64.zip: 702b2868e5ca3c8e79bcc38301f199feae88de8f6c673d1a3ef362d4e73939f9

Assets 5

Pebble 1.3.0

tohin003 released this 24 Oct 04:13

v1.3.0

e35cfb3

Pebble 1.3.0

Requests that a model provider can cache, and fewer round trips. Above 8K tokens of context, every request of a task
now extends the previous one instead of rewriting its start, so a provider's prompt cache can reuse what it has
already read. On the ChatGPT route the model may also ask for several tool calls at once. How much this lowers cost
and time on real tasks is measured in the next benchmark and is not claimed here.

Highlights

Above 8K, each request of a task now extends the previous one, so prompt caching can reuse it.
The ChatGPT route can ask for several tool calls in one step; Pebble still performs them one at a time.
On the Anthropic route the model's earlier reasoning stays valid between steps, since nothing before it changes.

Changed

Requests above 8K extend each other. Measured on 1.2.0 in a scripted coding task, every request from the
second on kept only the system prompt the same: the task checkpoint was rewritten after each tool result, and the
file audit, the plan and the diagnostics were inserted near the top and rewritten. Now, above 8K:
- the task checkpoint is written once, with the local time the task started;
- the file audit and a changed plan are added after the newest tool results, listing only what changed; earlier
  ones stay where they were, and only the newest plan is protected when older context is archived;
- pinned skills, plugin schemas and connector routes stay where they were first added;
- the system prompt carries the date only, so it is the same for a whole day's tasks.
  In the same scripted tasks every request now extends the previous one. Two events still change the start of a
  request, on purpose: diagnostics are added and removed as they come and go (one that no longer matches its file is
  removed, so the model never acts on it), and ReadSource joins the tools once a web page has been read. At 8K and
  below nothing changes.
Several tool calls per step on the ChatGPT route (above 8K). Pebble 1.0.4's kept benchmark runs spent 99 % of
their time waiting on the model, and the slowest ones read three files in three separate requests. The model may
now ask for independent calls together; Pebble performs them in order, each under its own permission and approval.

For contributors

Each model request above 8K records how much of the previous request it kept (model_attempt.prefix), content-free.
backend/tests/test_cache_first_35.py; scripts/validate_phase35.py. D64: validate_phase28 records, rather than
asserts, that the first message changes per step; every check on the stale-block binding is unchanged.

Install

On a Mac with Apple silicon, in Terminal:

curl -fsSL https://raw.githubusercontent.com/tohin003/Pebble/main/install.sh | bash

Signing and checksums

Pebble is signed with the project's own stable signing identity, not an Apple Developer ID, and it is not notarized by Apple.
SHA256SUMS lists the zip's SHA-256. Checking it shows that the download arrived intact. SHA256SUMS is not signed and comes from the same release, so it does not prove who made the file (integrity, not authenticity).
A zip downloaded in a browser is quarantined, so macOS may refuse the first launch. Allow Pebble alone: Control-click Pebble.app, choose Open, then Open again (or System Settings, Privacy & Security, Open Anyway). Never turn Gatekeeper off. The one-line installer downloads with curl, which does not quarantine.

SHA-256 of Pebble-macos-arm64.zip: eb96a7b070701864a3be41bec219b239c7740960462bbb9f0b696361371530bd

Assets 5

Pebble 1.2.0

tohin003 released this 24 Oct 01:38

v1.2.0

a4af2e5

Pebble 1.2.0

Precision: Pebble checks its work without touching your tests, leaves test changes to you unless you ask for them, and
follows a few plain writing rules. The rules are instructions to the model; whether they change results is measured in
the next benchmark, on a held-out set sealed before this work began, and is not claimed here.

Highlights

Pebble can check a case your tests don't cover in a temporary copy, without adding a test file to your project.
A change to a test file you didn't ask for waits for your approval, in Auto mode too.
New writing rule: keep to the reply shape you ask for, such as three lines or a required last line.
New writing rule: cite only the source relied on, and say plainly when an answer can't be found.
A long task no longer fails when a request is retried right after Pebble archived older context.

Added

Checks that never touch your project. RunTests takes a check: one extra test module, in your project's own test
framework (unittest or node:test), that Pebble writes to probe a case your tests don't cover. It is added only to
the temporary copy the tests run in, under a name Pebble chooses (test_pebble_check.py or pebble-check.test.mjs),
and it never counts as your project's tests: it can't satisfy the completion check, and its failures are not
remembered as test failures. The approval card says it's Pebble's own check and shows its text. Projects whose
tests use another runner (pytest, npm, Go, Cargo or make) are told that a check isn't available there.
Test files are yours. When Pebble wants to create or change a test file and your request didn't ask for test
changes, the change waits for your approval, in Auto mode too, and the card says why. "Add a test for the empty
case" or "update test_parser.py" lets it through; "fix it so the tests pass" doesn't. Full access is unchanged.
Writing rules (above 8K tokens of context):
- When two instructions seem to conflict, Pebble is told to take the reading that satisfies both, and to ask only
  when none does.
- When you set the shape of the reply (a number of lines, only a value, a required last line), it is told to give
  exactly that shape; a required last line ends the reply, not a file, unless you name the file.
- When you ask it to cite the source it relied on, it is told to cite only that one and to describe any source it set
  aside without its path or link. When an answer can't be determined, it is told to say so without quoting a figure
  that could be taken for the answer.

Fixed

A retried request after compaction no longer fails the task. When a request was retried (a dropped stream, for
example) right after Pebble had archived older context to make room, the retry built the archive again with the
time left at that moment. A retry in a later second didn't match the archive already saved, and the task failed
with "The model checkpoint changed during compaction". A retry now sends exactly what was saved. This is the failure
seen once while proving 1.1.0; a test reproduces it with the fix switched off.
Stopping a connector's worker no longer fails when it has just exited. If a plugin (MCP) worker, a hook worker or
an image-decoding worker exited at the moment Pebble stopped it, macOS refused the stop signal and Pebble reported an
error instead of finishing. Pebble now treats that refusal as the worker being gone only when it really has exited,
and still stops a running one. Found while proving 1.2.0.
The Veil sweeps on and off as designed. In 1.1.0 the dusk colour, rim and glass arrived, and left, in a single
frame: each change started from where it was meant to end, so only the squash, blink and ring played. The README's
renders of the Veil showed the same, although their description said the colour sweeps over the pebble. Both are
corrected, and a test now measures the sweep part-way through. Found while building Pebble's landing page.
The Keyboard settings caption names the right keys. It said only ⌘⇧Space works from other apps, while ⌃⌥⌘S and
⌃⌥⌘H do too; it now points to the table's "Any app" column.

For contributors

backend/tests/test_precision_34.py and backend/tests/test_compaction_retry_34.py; scripts/validate_phase34.py
checks that the new rules name no task, fixture or grader of the development benchmark set.

Install

On a Mac with Apple silicon, in Terminal:

curl -fsSL https://raw.githubusercontent.com/tohin003/Pebble/main/install.sh | bash

Signing and checksums

Pebble is signed with the project's own stable signing identity, not an Apple Developer ID, and it is not notarized by Apple.
SHA256SUMS lists the zip's SHA-256. Checking it shows that the download arrived intact. SHA256SUMS is not signed and comes from the same release, so it does not prove who made the file (integrity, not authenticity).
A zip downloaded in a browser is quarantined, so macOS may refuse the first launch. Allow Pebble alone: Control-click Pebble.app, choose Open, then Open again (or System Settings, Privacy & Security, Open Anyway). Never turn Gatekeeper off. The one-line installer downloads with curl, which does not quarantine.

SHA-256 of Pebble-macos-arm64.zip: 699c8ec1e3d1ae626a3b02c51a251fb029d278b7f9a5851c288a0b58fb609dbd

Assets 5

Pebble 1.1.0

tohin003 released this 23 Oct 22:44

v1.1.0

07886c7

Pebble 1.1.0

Stealth Lockdown: one switch that keeps Pebble out of screen capture and screen sharing, and stops it taking focus
from the app you're in. Turn it on in Settings → Privacy and focus, from the menu-bar icon, or with ⌃⌥⌘S. It is built
for privacy and for working without interruptions: a presentation, a call or a full-screen app keeps the screen and
the keyboard.

Hidden from screen capture and screen sharing, not from a camera, a capture card or a process list. Exams and
interviews that forbid assistants still forbid it.

Highlights

Stealth Lockdown keeps Pebble out of screen shares and recordings and never takes focus from the app you're in.
While it's on, the pebble wears the Veil: a dusk-blue glass with a light rim, so you can always tell.
⌃⌥⌘H hides every Pebble window at once; the menu-bar icon brings Pebble back.
Turn it on in Settings → Privacy and focus, from the menu-bar icon, or with ⌃⌥⌘S.
A task that stopped right after its answer no longer repeats the answer when you resume it.
A plugin tool that could not be checked in time now says so, instead of calling your input invalid.
Tests run in parallel, so each release is proved in about a third of the time.

Added

Stealth Lockdown. One switch turns on both halves.
- Stealth: every Pebble window is left out of screen capture and screen sharing, the workspace has no window
  shadow, and Pebble leaves the Dock, ⌘Tab and Mission Control. The full workspace opens as a window instead of in
  full screen, so it never takes over the screen you share. ⌃⌥⌘H, or Hide Pebble now in the menu-bar menu, hides
  every Pebble window at once.
- Lockdown: Pebble never takes keyboard focus from the app in front. Its windows become panels that take your
  typing without making Pebble the active app, so your slides, call or full-screen app stay in front, and Pebble
  never brings itself forward.
- The menu-bar icon changes shape while it's on (a filled pebble in a ring) and carries the switch. With Pebble out of
  the Dock and ⌘Tab, it is the way back in. macOS draws the menu bar, so the icon itself shows in a full-screen share.
- It stays on across restarts until you turn it off.
The Veil. When you turn Stealth Lockdown on, the pebble gathers, a dusk colour sweeps down over it and it opens
calmer eyes behind a light rim (1.25 s). While it's on it keeps that glassy dusk look, with one slow shimmer every
6 s. Turning it off lifts the colour and the pebble hops back (0.65 s). With Reduce motion on, each change is a
0.3 s fade. At sidebar and status-line sizes, the colour and a thicker rim carry it.

Fixed

A resumed task no longer repeats its answer. If Pebble stopped (a restart or a quit) right after showing a task's
answer but before marking it done, resuming the task asked the model to continue, and the answer could come twice.
Pebble now finishes such a task with the answer you already saw, after its usual completion check, with no new
request.
A plugin tool check that fails says so. When Pebble's isolated checker for a plugin tool's input failed (it ran
out of memory, for example), the call was refused as "arguments do not match the reviewed tool schema". It now says
the input could not be validated, and names the failure.

For contributors

Parallel tests. scripts/run_full_suite.py runs the backend suite on six workers and then, alone, the tests
that measure time or the machine (backend/tests/serial_register.json, each with its measured reason). It writes
the same proof log the release checks read. A release proof now takes about 17 minutes instead of about 47.
scripts/affected_tests.py picks the tests a change can reach for everyday work, and runs everything when unsure.
A fairer benchmark harness. An audit of the gpt-6.1-sol comparison found three harness defects, all counting
against Codex CLI: Python cache files counted as unrequested edits, a question that obeyed the prompt's FINAL: done
line was never answered, and a process race lost one cell. They are fixed for every product, with tests
(backend/tests/test_bench_harness_fixes_32.py). That comparison's results are not published yet.
A held-out benchmark set is sealed for the next comparison, before any change aimed at it: SHA-256
27889ccdb1fa8d26c047ec3d127f10d2dadd9cf8cb550d74f0d565d70054d051.

Install

On a Mac with Apple silicon, in Terminal:

curl -fsSL https://raw.githubusercontent.com/tohin003/Pebble/main/install.sh | bash

Signing and checksums

Pebble is signed with the project's own stable signing identity, not an Apple Developer ID, and it is not notarized by Apple.
SHA256SUMS lists the zip's SHA-256. Checking it shows that the download arrived intact. SHA256SUMS is not signed and comes from the same release, so it does not prove who made the file (integrity, not authenticity).
A zip downloaded in a browser is quarantined, so macOS may refuse the first launch. Allow Pebble alone: Control-click Pebble.app, choose Open, then Open again (or System Settings, Privacy & Security, Open Anyway). Never turn Gatekeeper off. The one-line installer downloads with curl, which does not quarantine.

SHA-256 of Pebble-macos-arm64.zip: e8b5b91d99a9361913a03eed9dc5a794e691f8b75e1394f317b8ee0e12ea3563

Assets 5

Pebble 1.0.4

tohin003 released this 23 Oct 15:02

v1.0.4

3d872bd

Pebble 1.0.4

An audit of every command, shortcut and feature claim against the code. Its fixes are below, and so is every claim
that said more than Pebble does. 1.0.2 and 1.0.3 were not published on their own: this release also carries 1.0.2's
fixes (multi-step tasks on Claude no longer fail, requests to Anthropic's API are marked for prompt caching, and two
display fixes; see 1.0.2 in CHANGELOG.md), and 1.0.3 was this release before the full-screen fix.

Fixed

The full workspace is a real full screen, without the Dock in the way. The pebble's Open full workspace opens
the main window in macOS full screen. There, the Dock stays hidden instead of sliding up over the message box, and
the red, yellow and green buttons show (macOS greys out yellow in full screen). Floating companion, the red
button and ⌘W leave full screen and go back to the pebble. Before, the full-screen window hid its buttons, and the
Dock covered the message box whenever the pointer reached the bottom.
⌘+ and ⌘− change the text size. They did nothing: the window lacked the permission its zoom keys need.
/stop never resumes a task. With no task running, /stop and Enter sent /resume, which restarted the latest
paused or stopped task. Enter now runs a command only when you typed its name or picked it in the menu.
A command's exact name wins. /agent ran /agents, and /export ran /exports.
Esc closes the open panel. It now closes the details panel or the canvas wherever focus is, as the shortcut list
says.
The pebble's Views no longer show buttons it can't use. In the pebble, stopping a view, answering a form,
opening a static preview and connector media now point to the workspace instead of failing.
Pebble's benchmark runs never use the installed app's identity. The harness refuses a backend inside the release
app, which shares your Keychain item, and runs the candidate's test app instead.

Removed

PDF export. It was the export panel's first choice, but a release build could never make the file, because
Pebble's native PDF view isn't built yet. Export HTML and print it to PDF from your browser. PDF returns when it
works.

Corrections

These claims, in the README, the user guide and the app, said more than Pebble does. They now say what it does.

⌘+ and ⌘− were listed in 1.0.0's What's new but did nothing until this release.
/stop could resume a task instead of stopping one (see Fixed).
PDF export never worked in a release build (see Removed).
App windows. Pebble can't see or operate other apps' windows yet; it can open an app when you approve. The
switch is now Screen control: Chrome tabs you share, and /windows describes the Chrome tabs you shared.
Pebble for Chrome works in one Chrome tab that you share and then grant, on that tab's site, for up to 30
minutes. It can't open, close, list or switch tabs, or go to another site. Every press, and Enter, asks; looking,
typing and choosing run under your grant. It has been tested against a simulated Chrome, not yet end to end in a real
one. Stop Pebble in Chrome in the Browser panel ends every Chrome session; a task's Stop ends the task.
Memory. No memory can be edited: you can add, view and forget memories, and write PEBBLE.md. Pebble also
learns facts and procedures from evidence. "Remember that …" saves a preference when it is about you, and a fact
otherwise. Pebble follows PEBBLE.md as your standing instructions; other memories are data. A memory you forget is
not learnt again from the same place, but Forget all starts over.
Models. The model you choose applies to every conversation, not to one.
Schedules. Results appear in Details › Tools; macOS notifications are off until you turn them on.
AgentGuard holds changed code only when tests cover it, and its invented-API challenge reads Python code only.
Agents never change your project, run commands or call connectors themselves; a worktree agent writes in its own
copy.
Permissions. A switch can't change while a task runs: stop the task first.
Attachments. Word, Excel and PowerPoint mean .docx, .xlsx and .pptx files, and only ZIP archives are listed.
Exports. A Word file turns tables into paragraphs and is labelled unverified. /export shows a plan; the view's
Export… writes the file.
Local MCP servers need the Terminal and Files switches on, and a Python file needs a Python from python.org.

Install

On a Mac with Apple silicon, in Terminal:

curl -fsSL https://raw.githubusercontent.com/tohin003/Pebble/main/install.sh | bash

Signing and checksums

Pebble is signed with the project's own stable signing identity, not an Apple Developer ID, and it is not notarized by Apple.
SHA256SUMS lists the zip's SHA-256. Checking it shows that the download arrived intact. SHA256SUMS is not signed and comes from the same release, so it does not prove who made the file (integrity, not authenticity).
A zip downloaded in a browser is quarantined, so macOS may refuse the first launch. Allow Pebble alone: Control-click Pebble.app, choose Open, then Open again (or System Settings, Privacy & Security, Open Anyway). Never turn Gatekeeper off. The one-line installer downloads with curl, which does not quarantine.

SHA-256 of Pebble-macos-arm64.zip: 630af5c1344ab67bbae3f8de313ed260ad0794774d376a21f0b90d8ab856470d

Assets 5

Pebble 1.0.1

tohin003 released this 22 Oct 17:50

v1.0.1

06031a0

Pebble 1.0.1

The first public release: everything listed under 1.0.0 in
CHANGELOG.md, plus the fixes below. 1.0.0 was never
published.

Fixed

The companion's eyes follow the pointer up and down. They looked up at a pointer below the avatar and down at one
above it; left and right were already right.
Licence notices cover everything the app ships. urllib3's optional backports.zstd import made the backend
bundler pull in setuptools (MIT) and its runtime hook, with no notice for it, though nothing Pebble runs uses it. The
backend now leaves setuptools, pkg_resources and distutils out. The release inventory counts the Rust crates the
macOS build uses, as the notices file does, and every one has its notice.

Install

On a Mac with Apple silicon, in Terminal:

curl -fsSL https://raw.githubusercontent.com/tohin003/Pebble/main/install.sh | bash

Signing and checksums

Pebble is signed with the project's own stable signing identity, not an Apple Developer ID, and it is not notarized by Apple.
SHA256SUMS lists the zip's SHA-256. Checking it shows that the download arrived intact. SHA256SUMS is not signed and comes from the same release, so it does not prove who made the file (integrity, not authenticity).
A zip downloaded in a browser is quarantined, so macOS may refuse the first launch. Allow Pebble alone: Control-click Pebble.app, choose Open, then Open again (or System Settings, Privacy & Security, Open Anyway). Never turn Gatekeeper off. The one-line installer downloads with curl, which does not quarantine.

SHA-256 of Pebble-macos-arm64.zip: 91f57d48605f3c8d830da431ee0de38295e041dc37da68933f2993eee82d16e2

Assets 5

Pebble 2.0.3

Pebble 2.0.3

Fixed

Upgrading

Install

Signing and checksums

Uh oh!

Pebble 2.0.1

Pebble 2.0.1

Fixed

Upgrading

Install

Signing and checksums

Uh oh!

Pebble 2.0.0

Pebble 2.0.0

Highlights

How 2.0.0 compares

What's new

Work on your Mac, inside a sandbox

Fewer cards where it is safe

Your apps, websites and screen

Uh oh!

Pebble 1.5.0

Pebble 1.5.0

Highlights

Added

Fixed

Changed

For contributors

Install

Signing and checksums

Uh oh!

Pebble 1.4.0

Pebble 1.4.0

Highlights

Changed

For contributors

Install

Signing and checksums

Uh oh!

Pebble 1.3.0

Pebble 1.3.0

Highlights

Changed

For contributors

Install

Signing and checksums

Uh oh!

Pebble 1.2.0

Pebble 1.2.0

Highlights

Added

Fixed

For contributors

Install

Signing and checksums

Uh oh!

Pebble 1.1.0

Pebble 1.1.0

Highlights

Added

Fixed

For contributors

Install

Signing and checksums

Uh oh!

Pebble 1.0.4

Pebble 1.0.4

Fixed

Removed

Corrections

Install

Signing and checksums

Uh oh!

Pebble 1.0.1

Pebble 1.0.1

Fixed

Install

Signing and checksums