You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
An adversarial review of the whole workspace, and the fixes it turned up.
Most of this is security and data-safety work in picocode-core, so it
applies to the TUI and the GUI alike.
Upgrading
A project picocode.toml now has to be trusted before it can run
commands.after_edit, [[mcp_servers]], [approval] allow_tools / allow_bash, [sandbox] and any base_url are held back on first use,
with a notice naming what was skipped. Read the file, then /trust to
allow them from the next start (/trust revoke takes it back). Everything
else in the file applies as before, and the global ~/.config/picocode/config.toml is never gated. If a project of yours
stops running its after_edit hook after upgrading, this is why.
web_fetch no longer reaches link-local or private addresses.
Loopback still works, so local dev servers are unaffected; a fetch aimed
at 169.254.169.254 or an internal 10.x service is refused.
In auto mode, an allow_bash rule no longer covers the always-ask
commands.allow_bash = ["git"] still auto-runs git status
everywhere, but git push reaches you when nobody else is answering.
Session stores are keyed by path and a digest of it. An existing store
is renamed into place the first time you open the project — nothing to do.
Fixed — escaping the project
File tools confined paths by collapsing .. and comparing prefixes, and
never looked at symlinks. A directory symlink inside the project — the
kind a cloned repository can carry — let edit_file write and read_file / grep / list_files read anywhere on disk, with no
approval prompt, since edit_file is auto-approved in edit mode.
An MCP server could register a tool named after a built-in. The approval
hook classifies by name, so a server tool called read_file or grep
replaced the built-in and ran with no prompt in any mode. Those names
are refused at connect time now.
The always-ask list that bounds auto mode was entirely POSIX, but the bash
tool runs cmd /C on Windows: del /s /q C:\…, format, runas, reg delete, Remove-Item -Recurse and iwr | iex all reach the user
now. Allow/deny rules also match case-insensitively there, since cmd.exe
does.
Fixed — losing data
/undo used the local filesystem directly, so on a remote workspace it
reverted nothing and reported success anyway. It goes through the
workspace backend now.
/undo also wrote the pre-turn contents back unconditionally, discarding
anything you had edited by hand since. Those files are left alone and
reported as skipped.
edit_file truncated the target before refilling it, so a crash or a
dropped connection mid-write left an empty or half-written file. Both
backends write a temp file and rename it over the target, carrying the
original's permissions.
Two projects whose paths differ only in punctuation (~/work/a-b and ~/work/a/b) shared one session store and saw each other's
conversations.
Fixed — everything else
web_fetch buffered whole responses before checking the size cap, and
followed redirects without re-checking where they led.
Switching search provider in /config kept the previous provider's base_url, sending BRAVE_API_KEY to a searxng host.
Fetched pages, search results and tool output are marked as data rather
than instructions, and the system prompt says so once for all of them.
GUI: dialogs are modal — clicking the dimmed backdrop no longer reaches
the sidebar behind it. A slow model-list reply from a provider you
switched away from no longer refills the menu. Deleting a session right
after a turn no longer loses the race with its own autosave.
TUI: /remote connects off the event loop, so the UI stays responsive
while ssh works (and gives up on an unreachable host after 10s). The
add-model form no longer panics when a second fetch returns a shorter
list.
list_files emitted mixed path separators on Windows.
Attachments are read with a size cap instead of being loaded whole, and
the clipboard scratch directory and ssh control socket use random,
owner-only temp paths that are cleaned up on exit.
Internal
CI ran 21 of 168 tests: bare cargo test follows default-members,
which is the TUI alone. It now covers the workspace on Linux and Windows,
with the GUI on macOS. 23 regression tests came with the fixes above.
picocode-gui 0.8.0
Install picocode-gui 0.8.0
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/uthree/picocode/releases/download/v0.8.0/picocode-gui-installer.sh | sh
Remote workspaces became usable without a restart or a hand-written config.
The host's own picocode.toml applies. A remote workspace merges the
host root's config and instruction files over your local one — approval
rules, after_edit, the system prompt and its presets, the timeouts and
output limits. [[models]], [[mcp_servers]], [sandbox] and [search]
always stay local, so opening a remote workspace never makes your machine
run something it was not already configured to run.
/remote switches workspaces at runtime. It opens a picker listing the
local project and the configured [[remotes]]; /remote <name|host:/path>
and /remote local switch directly. The worker respawns on the new backend
and the new workspace starts a fresh conversation and session log.
"+ add a remote…" dialog in both front ends: an ssh destination and a
path on it, with the Host aliases from ~/.ssh/config listed to pick.
It connects (and checks the path is a directory) before switching, then
prints a paste-ready [[remotes]] snippet for picocode.toml.
GUI workspace menu. The workdir line opens a menu — local project,
configured remotes, add a remote, choose a folder — and shows host:path
while a remote workspace is open. Picking a local folder while remote no
longer keeps the SSH backend (fixed).
Authentication remains entirely your own ssh setup (keys, agent, ~/.ssh/config, ProxyJump); picocode never handles credentials.
picocode-gui 0.5.0
Install picocode-gui 0.5.0
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/uthree/picocode/releases/download/v0.5.0/picocode-gui-installer.sh | sh
Remote workspaces over SSH — picocode --remote host:/path (or a [[remotes]] name) opens a project on another machine: every tool
operates on the host (read/edit/list/grep over the connection, bash on
the host). Authentication is entirely your ssh setup (~/.ssh/config,
keys, agent, ProxyJump) — picocode never handles credentials. The
conversation log stays on your local machine. Unix hosts only.
Edit the system prompt at runtime — /prompt opens an editor
seeded with the current prompt (a dialog in the GUI, the input box in
the TUI); applies for the session and prints a picocode.toml snippet
to persist it. /prompt reset restores the built-in.
Named prompt presets — [[prompts]] in picocode.toml, switched
with /prompt <name> (Tab-completed; unique substrings resolve).
Opt-in MCP — connect Model Context Protocol servers (stdio or
streamable HTTP) via [[mcp_servers]]; their tools go through the same
approval flow as the built-ins. Off by default.
Opt-in OS sandbox — [sandbox] runs model-initiated bash inside the
OS sandbox (macOS sandbox-exec, Linux Landlock): writes confined to the
project root and temp, network optionally blocked — a guard rail for
bypass mode.
Generation speed — the token counter shows tok/s (rolling window)
while the model streams; the counter now shows only the active phase.
picocode-gui 0.4.0
Install picocode-gui 0.4.0
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/uthree/picocode/releases/download/v0.4.0/picocode-gui-installer.sh | sh
The native GUI ships prebuilt for macOS (Apple Silicon / Intel) with its
own installer — no Rust toolchain needed:
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/uthree/picocode/releases/download/v0.3.1/picocode-gui-installer.sh | sh
Launch it with picocode-gui. It is a bare binary (no .app bundle yet);
installed via curl it carries no quarantine attribute, so Gatekeeper does
not object. Feature changes are the same as v0.3.0.
picocode-gui 0.3.1
Install picocode-gui 0.3.1
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/uthree/picocode/releases/download/v0.3.1/picocode-gui-installer.sh | sh
Clipboard paste of files and images — Ctrl+V in the TUI and ⌘V in the
GUI stage copied files (Finder/Explorer) and clipboard images (screenshots)
as attachments; plain text pastes as usual.
Color-coded context breakdown — /status (alias /usage) now shows a
segmented colored bar + legend of what fills the context window: system
prompt, project instructions, user/assistant messages, tool activity,
attachments, and provider-side overhead.
Unified slash commands — one shared parser for both front ends: same
aliases (/q, /settings, /usage, /exit), same completions, and typo'd
commands error instead of being sent to the model. The GUI gained /attach <path> and /jobs kill <id>.
Background-job management — /jobs lists long-running shell commands
moved to the background; kill one with /jobs kill <id> (TUI) or the kill
button in the GUI's background menu.
Model picker improvements — search filter in the dialog, an
"+ add a provider / model…" form for ad-hoc endpoints, and /model <partial>
auto-resolves unique matches.
Tab completion for command arguments — model names, session ids, file
paths for /attach, and job ids for /jobs kill.
Install picocode-tui 0.3.0
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/uthree/picocode/releases/download/v0.3.0/picocode-tui-installer.sh | sh
