One question wide
No project picker, no setup wizard, no tour — just a composer and Ponpoko. You type, and the app grows from there.
01 — The zero state
Start as nothing.
Become anything.
There is no project to pick and no setup wizard. The window opens on a conversation, and the composer is the whole front door. You say what you want in your own words — Ponpoko answers with the model you chose.
It can act
Nine tools, and nothing else: list, read, scaffold, install, call and remove surfaces, read and set palettes, and see which screen you are looking at. Bounded at eight tool rounds a message and 16 KiB a result.
What it did is on the record
Every tool call becomes a tool row: its name, whether it worked,
one line about what happened, and the answer. A transcript is plain rows you
can search, export and delete.
02 — Forms
Ponpoko takes forms.
A surface is a screen inside Ponpoko. It is a folder with a
surface.json at its root, a page, and — if it needs one — its own
backend process. The host draws the tab; the surface never holds authority.
Editor
A real programming editor, not a preview: explorer, tabs with scroll memory, highlighting, quick open, a command palette, search and replace, per-language formatting, previews, and go-to-definition over a static index.
- Its own stdio backend and its own command line
- Files come through the picker you drive, not a scan of your disk
- Not a language server: no autocomplete, heuristic navigation
Terminal
A real terminal whose tabs are shell child processes on real PTYs, started and stopped by its own backend. It has its own command line too, for the same methods without an app in between.
- Thai handled at the cell level, with the macOS font fallback
- Option+←/→ for words, Cmd+←/→ for line ends
- Tabs do not survive a restart; output is polled with a bounded buffer
Make your own
The manifest is parsed closed-world: an unknown field, permission, nav
slot or icon fails the whole install. The permission vocabulary is exactly
two verbs — tool.file and backend.call — and the
bridge a surface may speak is the same two. There is no third.
{
"id": "editor",
"name": "Editor",
"version": "1.0.0",
"entry": "index.html",
"permissions": ["tool.file", "backend.call"],
"methods": ["fs.read", "fs.write", "workspace.search"]
}Trust, plainly. An installed surface is code you chose to install. It runs as you, with your rights. There is no sandbox — Ponpoko cannot see inside a surface and does not mediate what it does. The install screen says this before you install.
03 — Local-first
Your words stay
on this machine.
Conversations, prompts, palettes and installed surfaces live in one SQLite database under your app data folder. Installed surfaces are copied into the app's own folder, never into a project you are working in.
-
Your key stays out of the page
Chat calls go from Rust straight to the provider you configured; the webview never holds the key. Credentials are one plaintext file per provider (
0600) inside the app data folder. That is not the OS keychain, and the settings window says exactly that. -
The transcript is a file you own
Threads, prompts and palettes are plain rows in one SQLite database: searchable, renameable, exportable to Markdown, deletable. A text file you attach is read once, capped at 256 KiB, and stored with the turn.
-
Nothing of yours is deleted
A database this build does not recognise — corrupt, empty, or written by a newer version — is renamed aside and kept, never removed; a fresh one opens in its place. Upgrades run in a transaction. An existing installation is moved once, on first launch, with its transcripts and keys together.
-
Two places, nothing else
Ponpoko itself talks to two places: the provider you chose, when you send a message, and the signed update check at
ponpoko.app. There is no account and no analytics SDK in the app.
04 — Limits
What it is not.
The awkward parts, in the same voice as the rest. A short page is only honest if it says them too.
- Apple Silicon only
- This build is arm64. There is no Intel, Windows or Linux version shipped, and the page will not pretend otherwise.
- Not notarized yet
- The build is not notarized by Apple. The installer copies
Ponpoko.appinto/Applicationsand clears the quarantine flag; in-app updates are verified with minisign. - Not sandboxed
- A surface runs as you, with your rights. Ponpoko cannot see inside it or mediate what it does, so install only bundles you trust.
- No undo for tools
- A tool call that edited something did edit it, and a removed surface is gone. The transcript records what happened; it cannot reverse it.
- No shell from chat
- The nine tools cannot run a shell command or read a path outside an installed bundle. The Terminal surface exists, but you are the one driving it.
- Bring your own model
- There is no Ponpoko-hosted model and no bundled key. You add a provider key or point it at a local server.
05 — Changelog
What shipped.
Generated from the repository's commits at release time. If it is not committed, it cannot appear here.
v0.19.4 Latest
- Ponpoko: a chat client and a surface host, with every surface living in its own public repository
06 — Install
Put Ponpoko
on your Mac.
Apple Silicon, macOS. Use the button or the script — both fetch the same release from ponpoko.app.
$
curl -fsSL https://ponpoko.app/install.sh | bash
The script reads latest.json, downloads the arm64 disk image, copies Ponpoko.app into /Applications, clears the quarantine flag, and opens it.