Plan.
Understand the request, inspect the files, retrieve useful memory, and write the path before touching code.
›tell me what changed in the auth module since main
memory3 facts injected · auth module structure, vitest layout, argon2id decision72 tokens
I'll scan src/auth/ and diff against main. Three lookups, one diff.
▾greppattern "auth" · path src/auth/
src/auth/session.ts:42 · verify(token: string)
src/auth/middleware/verify_2fa.ts:1 · new
src/auth/hash.ts:8 · argon2id replacing bcrypt
src/auth/middleware/verify_2fa.ts:1 · new
src/auth/hash.ts:8 · argon2id replacing bcrypt
▾git diffmain -- src/auth
@src/auth/session.ts @@ -42,7 +42,7 @@42 if (!token) {43 throw new InvalidTokenError("missing token");44 }45−const decoded = jwt.verify(token, SECRET);45+const decoded = jwt.verify(token, SECRET, { maxAge: "1h" });46 if (!decoded.sub) {
read_filesrc/auth/middleware/verify_2fa.ts
1 import { totp } from "otplib";
2 import { Request, Response, NextFunction } from "express";
3
4 export async function verify_2fa(req
2 import { Request, Response, NextFunction } from "express";
3
4 export async function verify_2fa(req
Three meaningful changes since main:
1. Session timeout reduced from 24h to 1h.
2. New verify_2fa middleware in src/auth/middleware/.
3. Password hash migrated bcrypt to argon2id.
2. New verify_2fa middleware in src/auth/middleware/.
3. Password hash migrated bcrypt to argon2id.
∠auth/argon2tools3ctx12.4K / 1Mcost$0.0214modesafethinking
Four moves.
A Picasso session is not a single answer. It is a traceable loop across a 1M context window: read the repository, draft a path, act through tools with edit-loop auto-diagnostics, study the result, and continue only when the next step is justified.
agent loopplan / act / observe / reflect
01Planread repo, draft plan
02Actedit files, run tools
03Observetests, logs, diffs
04Reflectcontinue or stop
completion criteria
Act.
Use create_file and str_replace with auto-diagnostics, shell commands, git worktrees (/worktree), MCP tools, and subagents inside the mode you chose.
Observe.
Read inline syntax-highlighted diffs, auto-diagnostics, tests, /diff main, /review-branch, logs, and failures in the CLI or Reasoning | Changes inspector.
Reflect.
Decide whether to continue, switch routes with /model or /provider, re-plan, ask for approval, write memory, or stop.
Tools, composed.
Search. Read. Edit with auto-diagnostics. Isolate in a git worktree. Review a branch. Ask an MCP server. Dispatch a subagent. Picasso can run independent work in parallel, then bring the result back to one visible decision.
Shell.
Commands run under explicit sandbox and approval policy, with output folded back into the session.
Files with auto-diagnostics.
create_file and str_replace stay scoped to the workspace and attach syntax and typecheck diagnostics in TypeScript, JavaScript, Python, JSON, and Swift.
Worktrees and branch review.
/worktree create|apply|remove and Mac Worktree mode isolate parallel threads, while /diff main and /review-branch review changes before a PR.
MCP.
External tools use declared capability profiles and appear in the same audit trail.
State carried forward.
| Signal | Used for |
|---|---|
| Plan. | Next action and user approval. |
| Observations. | Errors, output, screenshots, and diffs. |
| Memory. | Relevant facts, style, and prior decisions. |
| Goal contract. | Completion criteria, budget, and stop conditions. |
Drilldowns.
Plan mode.
Review before writes.
Subagents.
Parallel work with isolated contexts.
Memory.
Persistent retrieval across sessions.
/goal.
Run the loop against a completion contract.
A real trace.
Ask Picasso to repair a failing auth test. It reads the test, opens the module, drafts a plan, patches the validation path, runs the targeted suite, reads the next failure, updates the regression case, reruns the check, and reports the changed files. The point is not the first answer. The point is the visible path to a verified result.