- Pharo-dev - lists.pharo.org

"Building an MCP Server with Claude" â New blog post on all: objects all: theTime
by Koen De Hondt May 20, 2026

May 20, 2026

Dear Pharo users and developers, I posted the second article in a series about using AI in Pharo development. This article is a transcript of a large part of a pair programming session with Claude to build an MCP server for Pharo, called Iris. The transcript is very long. If it is too long, jump to the end of the article to read lessons learned and find links to the Iris project page and the code. https://all-objects-all-the-time.st/#/blog/posts/25 As always, all feedback is welcome. Happy reading! Ciao, Koen

1 0

need early testers for micro python 3 for freed
by Aaron Wohl May 19, 2026

May 19, 2026

I (pronounced claude.ai) have been working on a port of the current micropython to FreeDOS. It is fairly complete but untested by users. Manuals: https://avwohl.github.io/freedos_micro_python/ Sources: https://github.com/avwohl/freedos_micro_python To extend the tests, I implemented wget, scp, and sftp, which are working. It is supposed to work with mTCP and any NIC, but I have only tested NE2000 There was some recent talk about a good language for FreeDOS. This doesn't have an IDE. But it does have a modern higher network stack (SSH, SSL, HTTPS).

1 0

Fwd: claude.ai code review of pharo-v
by Aaron Wohl May 16, 2026

May 16, 2026

I regularly have Claude.AI review my code https://awohl.com, I pointed Claude at the Pharo-VM to see what it could see. A lot of the issues it found are things like strcpy without bounds checks with strings no one would ever make that big. However, it found some issues that are always triggered. Full list of issues https://github.com/avwohl/iospharo/blob/main/docs/pharo-vm-code-reivew-2026… I did not make an AI-generated patch list. stephane.ducasse(a)free.fr mentioned copyright concerns by guillermo.polito(a)inria.fr of accepting AI code. I assume this is due to the inability to copyright AI-generated work and to AI's tendency to steal others' work and lie about its origins. However, a lot of the fixes are so trivial, like off-by-one errors, that I don't know how much of an issue it is. If you want me to PR fixes and or tests that trigger for the full list, or always list, let me know. Many of the issues would only happen if someone were trying to break things (MAXLEN symlinks, damaged image files). If one were a mindset, it could be called AI slop. However, here is a short list of things that always cause issues in everyday operation: for example, every plugin loaded damages heap memory, or the nightly build of signed code disables SSL checks, so a simple DNS hack could get malicious code signed. Source: ~/pharo.md (review of /Users/wohl/esrc/pharo-vm @ pharo-10, 2026-05-11) Filter: only items that fire in normal benign operation, not edge cases requiring huge/crafted strings or attacker-chosen sizes. ================================================================ A. ALWAYS â MEMORY DAMAGE / UNDEFINED BEHAVIOR ================================================================ 1. sqNamedPrims.c:56-57 â calloc(sizeof(ModuleEntry)+strlen(name)) then strcpy writes strlen+1; 1-byte heap overflow on every plugin load. [#3.26] 2. ffi/callbacks/callbacks.c:14-32 â stack-allocated CallbackInvocation registered in runner->callbackStack/global queue; sig_longjmp exit leaves dangling stack pointer after every same-thread callback. [#2.8] 3. ffi/typesPrimitives.c:174-188 â setHandler(receiver, structType) stores pointer before failed()/ffi_get_struct_offsets checks; any error path frees memory while receiver still holds the dangling handle. [#2.6] 4. threadSafeQueue.c:113-137 â queue->first and node->element read outside the mutex; lock-holder's free(node) leaves the other consumer walking freed memory on every concurrent dequeue (hit by every FFI workload). [#3.21] 5. SocketPluginImpl.c:1109-1123 â sqSocketDestroy frees PSP(s) after sqSocketAbortConnection queues a closeHandler against pss; AIO dispatch fires on freed memory. [#3.22] 6. ffi/utils.c:43-50 â readString returns an un-pinned image-memory pointer; GC between strlen() and the caller's strcpy invalidates the length and the address. [#5.27] 7. ffi/callbacks/callbacks.c:24-29 â runner->callbackStack chain updated without any lock; reentrant callbacks from multiple threads on the same Runner corrupt the linked list. [#5.4] 8. pathUtilities.c:233-237 â strrchr(name,'.') result stored in fileExtension, but the NULL guard tests the unrelated `extension` variable; strcmp(NULL,...) crashes on any directory entry without a dot (e.g. "Makefile"). [#4.2] 9. pathUtilities.c:163 â first[strlen(first)-1] reads first[-1] (one byte before the buffer) whenever first is "", reachable from parameters.c:210-212 fallback. [#4.3] 10. externalPrimitives.c:57,66 â module path assembled in a file-static moduleNameBuffer with no lock; concurrent loads scribble each other's path and dlopen/LoadLibrary sees a torn string. [#5.3] 11. debugUnix.c:88-95,122-162 â SIGSEGV/SIGBUS/SIGFPE handler calls fopen/vfprintf/backtrace_symbols_fd/ctime_r/semaphore_wait (none async-signal-safe) and uses SA_NODEFER so the handler can re-enter itself on every crash. [#5.1] 12. debugUnix.c:123,144,154 â sigaction.sa_mask never initialized via sigemptyset for term_handler_action and sigpipe_handler_action; kernel reads uninitialized stack to decide what to mask on every install. [#5.2] 13. debug.c:57-66 â glibc strerror_r returns a pointer that may not write to the supplied buffer; caller prints the buffer unconditionally, leaking uninitialized stack bytes on every error path. [#5.7] 14. SocketPluginImpl.c:2494-2496 â sqSocket lastError stored in a file-static, clobbered across sockets; every concurrent socket failure overwrites another socket's error state. [#5.17] 15. aioWin.c:457/465 â heap-interior alias into allHandles transiently equals a freshly malloc'd region; any early return between the two assignments leaves a free-of-interior or double-use hazard. [#1/Â§9 PARTIAL] ================================================================ B. ALWAYS â SECURITY / CORRECTNESS (NOT MEMORY DAMAGE) ================================================================ TLS / SqueakSSL --------------- 1. sqUnixSSL.c:89-143 â SSL_CTX_set_verify never called; SSL_get_verify_result returns X509_V_OK by default â no certificate validation on any TLS connection. [#2.9] 2. sqUnixSSL.c:102-107 â SSLv23_method with only SSLv2/v3 disabled; TLS 1.0 and 1.1 still accepted on every handshake. [#2.9 / #6.3] 3. sqUnixSSL.c:115 â cipher list "!ADH:HIGH:MEDIUM:@STRENGTH" permits MEDIUM ciphers. [#2.9] 4. sqUnixSSL.c:107 â no SSL_OP_NO_COMPRESSION (CRIME), no SSL_OP_NO_RENEGOTIATION, no SSL_OP_CIPHER_SERVER_PREFERENCE. [#6.3] 5. sqWin32SSL.c:269-275,215,349-353 â sqExtractPeerName copies serverName verbatim into peerName instead of extracting the cert subject; epp.pwszServerName=NULL disables SChannel's hostname check, so image-side peerName==serverName is meaningless on every connection. [#3.19] 6. sqMacSSL.c:154-201,262-272,363-383 â kSSLSessionOptionBreakOnServerAuth disables auto verification; manual SecTrustEvaluate runs with no SSL policy carrying the hostname, so hostname is never checked. [#3.20] 7. sqWin32SSL.c:216-218 â SP_PROT_TLS1_0/1_1/1_2 enabled for both client and server roles. [#6.1] 8. sqMacSSL.c:154-164 â SSLSetProtocolVersionMin(ctx, kTLSProtocol1) sets minimum to TLS 1.0. [#6.2] VM internals ------------ 9. memoryUnix.c:66-89,109-111 â JIT pages mmap'd PROT_READ|PROT_WRITE|PROT_EXEC permanently; sqMakeMemoryExecutableFromTo / NotExecutable hooks are commented out, so W^X is defeated on Linux/FreeBSD. [#5.24] 10. debug.c:45 â error(char*) forwards the argument as the format string into the vfprintf-style logger; exported API contract leaks a %n/%s primitive to any future caller-controlled string. [#4.10] 11. ffi/typesPrimitives.c:170-172 â getHandler() returns the first slot of any oop with no class tag check; libffi consumes attacker-shaped ffi_type fields on every struct cif build, giving a controlled-dispatch primitive to anyone who can register an FFI struct. [#2.5] Build / supply chain (every build / every CI run) ------------------------------------------------- 12. Jenkinsfile:84,249 â fetch-and-execute installer via `wget â¦ | bash` over plain HTTP. [#7] 13. scripts/runTests.sh:31 â `wget -O - https://get.pharo.org/64/80 | bash`, executed from PR workflows. [#7] 14. scripts/installCygwin.ps1:7-9 â Cygwin installer + mirror retrieved over plain HTTP. [#7] 15. cmake/importLibFFI.cmake / importLibGit2.cmake / importSDL2.cmake â dependencies pinned to mutable git tags, no commit-SHA. [#7] 16. macros.cmake:69-103 + every cmake/import*.cmake using files.pharo.org â DownloadProject calls omit URL_HASH for libgit2, libssh2, openssl, zlib, SDL2, cairo, pixman, libpng, freetype, fontconfig, harfbuzz, gcc-runtime. [#7] 17. cmake/importFreetype2.cmake:47-49 â direct savannah.gnu.org download with no URL_HASH. [#7] 18. docker/ubuntu-arm64/Dockerfile, docker/debian10-armv7/Dockerfile â base images unpinned (no @sha256 digest). [#7] 19. Jenkinsfile:97-403 â every upload uses `scp -o StrictHostKeyChecking=no` against files.pharo.org. [#7] 20. Jenkinsfile:138 + cmake/sign.cmake:8-11 â SIGN_CERT_PASSWORD passed through environment under a broad withCredentials() block. [#7] 21. .github/workflows/continuous-integration-workflow.yaml:2 â `on: [push, pull_request]` with no `permissions:` block; fork PRs can edit runTests.sh and execute with the workflow GITHUB_TOKEN scope. [#7] 22. .github/workflows/...:11,14,68 â EOL runners (ubuntu-18.04, windows-2016) and EOL actions (checkout@v1, upload-artifact@v1). [#7] 23. cmake/packaging.cmake:92 â CPACK_PACKAGE_CHECKSUM "SHA1". [#7] 24. scripts/installCygwin.ps1:35-48 â `cygwin -q` suppresses signature warnings during install. [#7] 25. CMakeLists.txt:206,266-296 + cmake/Linux.cmake:1 â no -D_FORTIFY_SOURCE=2, no -fstack-protector-strong, no -fPIE/-pie, no -Wformat-security, no -Wl,-z,relro / -z,now / -z,noexecstack on Linux release builds. [#7] 26. CMakeLists.txt:206,266-296 â -Wno-int-conversion and -Wno-pointer-sign actively silenced; both classes of warning catch real bugs. [#7] 27. cmake/Linux.cmake:1 â Linux rpath set to "." (relative to CWD) instead of "$ORIGIN". [#7] 28. CMakeLists.txt:206 â Windows/Cygwin builds lack /GS, /guard:cf, /DYNAMICBASE, /NXCOMPAT. [#7]

5 8

new vm implementation results
by xphu＠awohl.com April 20, 2026

April 20, 2026

PharoSmalltalk with a new VM is now in the Apple App Store for iPad (primary), iPhone, and Mac as https://apps.apple.com/us/app/pharosmalltalk/id6759073615. It runs the latest Pharo 13 image. Source https://github.com/avwohl/iospharo During development, 10 issues came up that seem to be best handled with image changes, see https://github.com/avwohl/iospharo/blob/main/docs/upstream-proposals.md I could use advice or review on how to proceed with these issues. This started when, on a cruise, I sat down on a beach chair with LEARN PHARO and an iPad and found there wasnât a Pharo. I have a background in compiler construction, but am newish to Smalltalk.

5 4

"Example of Describing Spec Application Behaviour with Hera" â New blog post on all: objects all: theTime
by Koen De Hondt April 13, 2026

April 13, 2026

Dear Pharo users and developers, I posted the fourth and final article in the series about describing Spec application behaviour with Hera. The first post explained how Hera manages open Spec windows. The second post explained how Hera identifies presenters so they can be referenced in Gherkin scenarios. The third post explained how Hera expresses steps to interact with Spec presenters. This final post includes an example that ties everything together. https://all-objects-all-the-time.st/#/blog/posts/23 As always, all feedback is welcome. Happy reading! Ciao, Koen

1 0

Intelligent Code Assistant for Pharo
by omar abedelkader April 7, 2026

April 7, 2026

Hello, Iâm currently experimenting with a new approach to code completion in Pharo. Unlike the existing token-based completion (which suggests one token at a time), this approach uses an LLM to generate larger, meaningful code segmentsâalso known as Fill-in-the-Middle (FIM) code completion. This message is simply to gauge interest in this topic. Once the system is ready, we will reach out to interested users. There is nothing specific expected from youâjust using the plugin as you normally code. The plugin will handle the evaluation process and, with your consent, send us a report summarizing usage. This report will only include aggregated metrics (such as acceptance and rejection rates). We will not collect any information about your code (e.g., class names, method names, or content). The plugin itself is lightweight and runs entirely on your machine. The LLM is also designed to run locally, with our largest model requiring approximately 5 GB of RAM. If you are interested in this new approach to code completion, feel free to reply to this email. Best regards, Omar AbedelKader

1 0

Re: ESUG 2026: Call for Presentation and reminder for early rate registration
by stephane ducasse April 3, 2026

April 3, 2026

Hello Just a reminder for the Call For Presentation for ESUG. We extended the early bird registration to the 15 of April. S. > On 19 Mar 2026, at 14:01, stephane.ducasse(a)free.fr wrote: > > Hello Happy Smalltalkers > > > Please note that the early rate registration ends 1st of April : > https://registration.esug.org/ESUG > > > Here is the call for presentation for ESUG 2026. > > The ESUG board is pleased to announce Call for presentations at the 31th ESUG conference to be held in > Plovdiv, Bulgaria 7 - 10 July 2026. > > We are looking for YOUR experience on using Smalltalk. > You will have 30 min for presentations and 45-60 min for hand-ons tutorial. > > The list of topics for the normal talks and tutorials includes, but is not limited to the following: > > - Micro Services, Container, Cloud, Big Data, > - XP practices, Development tools, Experience reports > - Model driven development, Web development, Team management > - Meta-Modeling, Security, New libraries and frameworks > - Educational material, Embedded systems and robotics > - SOA and Web services, Interaction with other programming languages > - Teaching Pearls > - Show us Your Business > - Show your business 10 min session (Get prepared!!) > > ## How to submit? > > - Submission deadline is 1st of May 2026 > - Notification of acceptance will be on done on the fly. > > Pay attention: the places are limited so do not wait till the last minute to apply. > > Prospective presenters should submit a Pull Request on *https://github.com/ESUG/esug.github.io/tree/source/2026-Conference/talks>https://github.com/ESUG/esug.github.io/tree/source/2026-Conference/talks* > > If you do not succeed to do a PR you can send an email to <omar.abedelkader(a)inria.fr <mailto:omar.abedelkader@inria.fr>> and <stephane.ducasse(a)inria.fr <mailto:stephane.ducasse@inria.fr>> with [ESUG2026] in the title > > = Title: Please follow the template below the email will be automatically processed! > = Name: > = Email: > = Abstract: > = Bio: > > Any presentation not respecting this form will be discarded automatically.

1 0

[IWST'26] Call for Presentations
by Guillermo Polito March 20, 2026

March 20, 2026

Dear all, Submissions are now invited for the International Workshop on Smalltalk Technologies (IWST 2026), to be held in conjunction with ESUG. IWST serves as a forum for the presentation and discussion of work related to Smalltalk and closely related technologies, covering both research contributions and practical experiences. The workshop emphasizes interaction and is particularly well suited for presenting work in progress, emerging ideas, and experience reports. Topics of interest include, but are not limited to: * code analysis, testing, and debugging * compilers, virtual machines, and language implementation * tools, frameworks, and libraries * meta-programming, refactoring, and design patterns * industrial experience and case studies * integration with other languages and ecosystems Submissions for presentation take the form of extended abstracts (up to 2 pages). This allows authors to present ongoing or preliminary work without requiring a full paper at this stage. In addition, presentations of relevant work published within the past two years are welcome. Authors of accepted contributions will be invited to submit an extended version (short or full paper) for inclusion in the post-workshop proceedings. **Important dates:** * Extended abstract submission deadline: March 20, 2026 (AoE) Submissions should be made via EasyChair: https://easychair.org/conferences/?conf=iwst2026 Further details are available in the full call for submissions: https://conf.researchr.org/track/iwst-2026/iwst-2026-papers#Call-for-Submis… Kind regards, Guille, Gordana and Nahuel

1 1

[COLA Special ISSUE] Call for Papers
by Guillermo Polito March 20, 2026

March 20, 2026

Dear all, Submissions are now invited for the Special Issue on *Smalltalk Technologies*, to be published by Elsevier on ScienceDirect. This special issue aims to collect high-quality contributions related to the design, implementation, and use of Smalltalk and closely related technologies. It provides an opportunity to present mature research results, as well as consolidated extensions of previously published or presented work in this area. Relevant topics include, but are not limited to: * programming languages and language design * virtual machines, compilers, and runtime systems * software analysis, testing, and debugging * development tools and environments * meta-programming and reflective systems * software evolution and maintenance * industrial applications and experience reports * interoperability with other languages and ecosystems Submissions are expected to present original and unpublished work, or substantially extended versions of prior publications, in line with standard journal requirements for special issues. In particular, extended submissions should include significant new material beyond any previously published version. All submissions will undergo a peer-review process in accordance with the journalâs standards. Further details regarding submission guidelines, important dates, and the review process can be found here: https://www.sciencedirect.com/special-issue/331473/smalltalk-technologies Kind regards, Guille, Gordana, Nahuel

1 0

"Steps for Interaction with Spec Presenters in Hera â New blog post on all: objects all: theTime
by Koen De Hondt March 14, 2026

March 14, 2026

Dear Pharo users and developers, I posted a third article in the series about describing Spec application behaviour with Hera. The first post explained how Hera manages open Spec windows. The second post explained how Hera identifies presenters so they can be referenced in Gherkin scenarios. This post explains how Hera expresses steps to interact with Spec presenters. https://all-objects-all-the-time.st/#/blog/posts/22 As always, all feedback is welcome. Happy reading! Ciao, Koen

1 0