Stream-first CLI.
A full-black terminal stream that keeps your shell at the center of the workflow.
Product / CLI
The coding agent that lives in your terminal.
Picasso reads the repo, plans safely, retrieves memory, edits files, runs commands, fixes failures, writes tests, and keeps the whole canvas visible.
›tell me what changed in the auth module since main
memory3 facts injected · auth module structure, vitest layout, argon2id decision72 tokens
I'll scan src/auth/ and diff against main. Three lookups, one diff.
▾greppattern "auth" · path src/auth/
src/auth/session.ts:42 · verify(token: string)
src/auth/middleware/verify_2fa.ts:1 · new
src/auth/hash.ts:8 · argon2id replacing bcrypt
src/auth/middleware/verify_2fa.ts:1 · new
src/auth/hash.ts:8 · argon2id replacing bcrypt
▾git diffmain -- src/auth
@src/auth/session.ts @@ -42,7 +42,7 @@42 if (!token) {43 throw new InvalidTokenError("missing token");44 }45−const decoded = jwt.verify(token, SECRET);45+const decoded = jwt.verify(token, SECRET, { maxAge: "1h" });46 if (!decoded.sub) {
read_filesrc/auth/middleware/verify_2fa.ts
1 import { totp } from "otplib";
2 import { Request, Response, NextFunction } from "express";
3
4 export async function verify_2fa(req
2 import { Request, Response, NextFunction } from "express";
3
4 export async function verify_2fa(req
Three meaningful changes since main:
1. Session timeout reduced from 24h to 1h.
2. New verify_2fa middleware in src/auth/middleware/.
3. Password hash migrated bcrypt to argon2id.
2. New verify_2fa middleware in src/auth/middleware/.
3. Password hash migrated bcrypt to argon2id.
∠auth/argon2tools3ctx12.4K / 1Mcost$0.0214modesafethinking
picasso for the full canvas. pic for the short path.
Open the full-black stream-first TUI when you want 1M context window state, approvals, 1-step /model and /provider switching, budget, tools, memory, goal progress, subagents, replay, and session history in view. Use the short command when the task is direct.
terminalpicasso / repo
›
picasso plan "repair failing auth tests"readsrc/auth/session.ts84 lines
editsrc/auth/hash.ts+18 / -9
testpnpm test auth7 passed
mode safetools 3tokens 12.4Kbudget visible
picassopic "write a plan for the auth refactor"picasso run "explain the failing test" --jsonVisible state.
1M context window usage, active model, tool calls, memory retrieval, permission mode, goal state, and budget state stay on screen.
1-step model switching.
Switch routes with /model and /provider, or run interactive and non-interactive work from the same harness.
Built for the work between idea and ship.
Picasso handles real repository work: feature edits, refactors, test repair, debugging, migrations, dependency issues, and local branch review.
Auto-diagnostics on edits.
create_file and str_replace attach syntax and typecheck feedback in TypeScript, JavaScript, Python, JSON, and Swift.
Branch and diff review.
Run /diff main and /review-branch alongside the repo's tests, lint, typecheck, and build scripts.
Reads failures.
Compiler, typecheck, and test errors become immediate evidence for the next edit.
Explains work.
The final report and Reasoning | Changes inspector show what changed and what remains.
Plan mode before serious changes.
When risk rises, Picasso enters a read-only architecture pass. It can inspect files, configs, dependencies, entry points, and data flow, then writes a reviewable plan.md you can approve, edit, or reject before implementation starts.
Files.
The plan names files to inspect, create, modify, or leave untouched.
Risks.
Assumptions, edge cases, permissions, and open questions are called out early.
Verification.
Checks are part of the composition, not an afterthought.
Permissioned by design.
Picasso supports workspace containment, approval gates, shell allowlists and denylists, network controls, secret detection, and audit logs.
trust boundaryoutside the agent loop
generated codeclean
model outputclean
tool resultsclean
plan documentsclean
routingnot influenced
memoryretrieval only
Approval gates.
Sensitive shell commands and writes ask first.
Sandboxing.
Work stays inside the workspace boundary you choose.
Audit logs.
Important actions leave a record.
Sessions that keep their shape.
Every session is a canvas. Persist it, resume it, fork it, replay it, sync it to the Studio, or open the same state from the native Mac app.
Studiomemory / plans / goals / replay
memorysketchescanvasesgoals
memoryauth module uses argon2id
plan3 files, 2 risks, 4 checks
goal62 percent complete
replay48 strokes recorded
Resume.
Pick up where the agent left off.
Fork.
Try another path without losing the original.
Replay.
Inspect plans, provider calls, commands, approvals, edits, memory writes, and results.
Extend.
Use hooks, slash commands, and MCP to fit your repo.
The studio around the agent.
The agent is the brush. Everything around it is the studio — and it ships in the box.
Worktree isolation.
/worktree and the Mac worktree toggle run parallel threads in isolated git worktrees and merge cleanly back to your branch.
Skills.
/skills keeps a local registry of the moves your team repeats — create, validate, and toggle them without leaving the terminal.
Voice.
On the Mac, speak the prompt. /voice turns dictation into the same composer text, with microphone permission honored end to end.
Three-zone Mac workspace.
A multi-thread sidebar with unread completion dots and native notifications, live stream with inline syntax-highlighted diffs, and the Reasoning | Changes inspector.