Pinokio https://twitter.com/cocktailpeanut
winget install --id=pinokiocomputer.pinokio -e
Pinokio is a browser that lets you install, run, and programmatically control ANY application, automatically.
winget install --id=pinokiocomputer.pinokio -e
Pinokio is a browser that lets you install, run, and programmatically control ANY application, automatically.
Launch Anything.
Pinokio is a 1-click launcher for any open-source project. Think of it as a terminal application with a user-friendly interface that can programmatically interact with scripts.
This means:
By default all Pinokio scripts are stored run under an isolated location (at ~/pinokio/api
). Additionally, all binaries installed through the built-in package managers in Pinokio are installed within ~/pinokio/bin
. Basically, everything you do is stored inside ~/pinokio
. The risk factor is when a script intentionally tries to deviatte away from this.
The script verification process checks to make sure this doesn't happen.
Th Pinokio script syntax was designed to make this process simpler, both by human and machines.
All scripts must be downloaded from public git repositories. The scripts are both human readable and machine readable (written in JSON syntax), so you can always check the source code before running it.
Here's an example install screen, with an alert letting you know the downloaded 3rd party script is about to be run, as well as the URL to the original script repository where it was downloaded from.
Verified scripts are scripts that are explicitly reviewed and approved by the Pinokio admin. Because the scripts are designed to run isolated by default, and the syntax makes it easy to detect when a command intentionally tries to run things outside of the isolated environment, it is easy to detect any script that does things out of the ordinary. Here are some of the checks done by the Pinokio admin to make sure each script file is secure:
path
attribute, which declares the folder path from which to run a command, and by default the execution path is each app's path)venv
. This process is again made easy with the script syntax (with the venv
attribute, which automatically activates a virtual environment and installs all dependencies there, inside each app's folder)~/pinokio
) by default. Since everything runs isolated by default, verifying this is simple (by checking that there are no explicit declaration of additional code that tries to go outside of the isolated environment)Here's an example execution script that installs python dependencies:
{
"method": "shell.run",
"params": {
"message": "uv pip install -r requirements.txt",
"path": "server",
"venv": "venv"
}
}
~/pinokio/api/myapp
)path
is declared as server
, the code will be run inside the server
folder ofr the app (in this case ~/pinokio/api/myapp/server
)venv
attribute is included, so the python dependencies are also installed in an app-isolated manner. If the app is located at ~/pinokio/api/myapp
, the The depenencies will be stored at ~/pinokio/api/myapp/venv
The script verification check makes sure that all these components are run locally within the constraints of each app.
Of course, there are also additional checks such as:
No scripts are approved until rigorously tested.