PicoClaw
PicoClaw finds configuration that the runtime does not honor
PicoClaw operators report that custom shell allow patterns can still fail at execution, configured models can disappear from the list command, and model-specific token limits need a consistent configuration key. The cluster is about control surfaces disagreeing with the runtime they claim to govern.
sipeed/picoclaw PR #3314 is the inspected primary source: “Fix: agent not able to execute shell command added to customAllowPatterns.” The related records below were inspected as supporting context rather than independent confirmation.
The facts
- sipeed/picoclaw PR #3314 was created 2026-08-03T01:22:20Z and was open at inspection; its title is “Fix: agent not able to execute shell command added to customAllowPatterns.” - sipeed/picoclaw PR #2132 was created 2026-03-28T15:44:57Z and was closed at inspection; its title is “feat(config): support model-specific max_tokens and fix config key co….” - sipeed/picoclaw PR #3327 was created 2026-08-09T13:38:42Z and was closed at inspection; its title is “feat(telegram): render tables with native rich messages.” - The repository reported 29844 stars, 49 open issues, default branch main, and last push 2026-08-07T18:18:20Z. - The latest tagged-release baseline checked was nightly published 2026-07-02T01:26:53Z.
What changed
sipeed/picoclaw PR #3314 reports: Description Bug: My agent was not able to execute 'git push' despite adding it to the exec allow list. According to the tests it should have worked. Fixed customAllowPatterns not working: default deny patterns always took precedence in guardCommand, so a command like git push could never be permitted via a custom allow pattern. Separated user-specified CustomDenyPatterns from the built-in defaults so security-critical custom deny rules (e.g. jq env-access checks) still always apply, while built-in deny patterns can be exempted by a matching custom allow pattern. Also fixed TestShellTool_CustomAllowPatterns, which previously passed vacuously: it never set an internal channel context, so the channel-restriction check blocked the command before the guard ran. The test now reaches guardCommand and genuinely asserts the allow/deny behavior (allowed with pattern, blocked without, blocked for non-matching remote). Type of Change [x] Bug fix (non-breaking change which fixes an issue) [ ] New feature (non-breaking change which adds functionality) [ ] Documentation update [ ] Code refactoring (no functional changes, no api changes) AI Code
sipeed/picoclaw PR #2132 reports: Description This PR ensures configuration integrity and introduces granular model-level parameter overrides. 1. **Decoupling Lookup Key from Runtime ID**: Previously, gateway.go would overwrite Defaults.ModelName with the provider's technical modelID. This caused GetModelConfig() to fail because it couldn't find the configuration using the technical ID. I've introduced OriginalModelName in AgentDefaults to preserve the lookup key. 2. **Model-level MaxTokens Support**: Added a MaxTokens field to the ModelConfig struct. The system now prioritizes model-specific max_tokens over global defaults, allowing for more granular control over different model constraints. Type of Change [x] Bug fix (non-breaking change which fixes an issue) [x] New feature (non-breaking change which adds functionality) AI Code Generation [x] Mostly Human-written (Human lead, AI assisted or none) Related Issue Fixes configuration loss and metadata retrieval failures after provider initialization. Technical Context **Reasoning:** Technical model IDs (returned by providers) often differ from the user-defined configuration names. Preserving the original name is essential for consistent metadata (like max_tokens) retrieval throughout the agent's lifecycle. Test Environment **Hardware:** PC (Mac mini
sipeed/picoclaw PR #3327 reports: Description Render genuinely tabular Telegram replies with Bot API rich messages instead of reducing every table to a monospaced code block. This change: detects GFM tables and supported HTML blocks outside inline/fenced code examples; delivers matching send, reply/topic, edit, and streaming-finalization paths through sendRichMessage / InputRichMessage.Markdown; falls back to a readable preformatted table and then aligned plain text when rich formatting is rejected; adds Telegram-only output guidance so model responses use compact GFM tables for comparisons and repeated-field data; upgrades telego to v1.11.1 for Bot API 10.2 rich-message support; and adds parser, payload, fallback, edit, streaming, and prompt-scoping tests. Normal non-table Telegram messages keep the existing HTML/MarkdownV2 delivery path. The unrelated broken-lockfile cleanup discovered during the Android build is already covered by #3318 and is not included here. Type of Change [ ] Bug fix (non-breaking change which fixes an issue) [x] New feature (non-breaking change which adds functionality) [ ] Documentation update [ ] Code refactoring (no functional changes, no api changes) AI Code Generation [x]
Why it matters
An allowlist or model setting is worse than absent when the UI accepts it and execution silently follows another path. Operators need one resolved configuration view, not three plausible interpretations. The operator test is whether visible output, retained state and authority still describe the same event after retries, background work or restart.
Current
The primary record was open when captured on 2026-08-11. The tagged-release baseline was nightly published 2026-07-02T01:26:53Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/sipeed/picoclaw/pull/3314. Supporting records are https://github.com/sipeed/picoclaw/pull/2132 and https://github.com/sipeed/picoclaw/pull/3327. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Resolve policy and model settings once, expose the effective values, and test the same configuration through list, validation and final execution paths. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.