@camerontaylor/paseo-cli 0.8.0-fork.1

package/dist/commands/daemon/pair.js

@@ -0,0 +1,167 @@
+import { confirm, isCancel, log } from "@clack/prompts";
+import { Command } from "commander";
+import chalk from "chalk";
+import { generateLocalPairingOffer, getOrCreateServerId, loadConfig, resolvePaseoHome, } from "@camerontaylor/paseo-server";
+import { tryConnectToDaemon } from "../../utils/client.js";
+import { resolveLocalDaemonState } from "./local-daemon.js";
+import { addJsonOption } from "../../utils/command-options.js";
+import { formatPairingInstructions } from "../../output/pairing.js";
+const PAIRING_DAEMON_RPC_TIMEOUT_MS = 1500;
+const RELAY_DOCS_URL = "https://paseo.sh/docs/security";
+function createProcessOutput() {
+    return {
+        columns: process.stdout.columns,
+        writeStdout(message) {
+            process.stdout.write(message);
+        },
+        writeStderr(message) {
+            process.stderr.write(message);
+        },
+        setExitCode(code) {
+            process.exitCode = code;
+        },
+        success(message) {
+            log.success(message);
+        },
+    };
+}
+export function pairCommand() {
+    return addJsonOption(new Command("pair").description("Print the daemon pairing QR code and link"))
+        .option("--home <path>", "Paseo home directory (default: ~/.paseo)")
+        .option("--relay", "Enable relay without prompting")
+        .action(async (_options, command) => {
+        await runPairCommand(command.optsWithGlobals());
+    });
+}
+export async function resolveLocalPairingOffer(options) {
+    const state = resolveLocalDaemonState({ home: options.paseoHome });
+    const serverId = getOrCreateServerId(state.home);
+    const daemonOffer = await resolveDaemonPairingOffer(state.listen, serverId, options.enableRelay);
+    if (daemonOffer)
+        return daemonOffer;
+    if (state.running) {
+        throw new Error("The running daemon did not provide a pairing offer. Check daemon connectivity or update the daemon.");
+    }
+    const config = loadConfig(options.paseoHome);
+    if (options.enableRelay && !config.relayEnabled) {
+        throw new Error("Start the daemon before enabling relay for pairing.");
+    }
+    return generateLocalPairingOffer({
+        paseoHome: options.paseoHome,
+        relayEnabled: config.relayEnabled,
+        relayEndpoint: config.relayEndpoint,
+        relayPublicEndpoint: config.relayPublicEndpoint,
+        relayUseTls: config.relayUseTls,
+        relayPublicUseTls: config.relayPublicUseTls,
+        appBaseUrl: config.appBaseUrl,
+        includeQr: true,
+    });
+}
+async function resolveDaemonPairingOffer(listen, expectedServerId, enableRelay) {
+    const client = await tryConnectToDaemon({
+        host: listen,
+        timeout: PAIRING_DAEMON_RPC_TIMEOUT_MS,
+    });
+    if (!client)
+        return null;
+    try {
+        const serverInfo = client.getLastServerInfoMessage();
+        if (serverInfo?.serverId.trim() !== expectedServerId) {
+            throw new Error("The reachable daemon belongs to a different Paseo home. Check --home or the daemon listen configuration.");
+        }
+        if (serverInfo?.features?.daemonStatusRpc !== true) {
+            throw new Error("Update the Paseo daemon before pairing from this command.");
+        }
+        let offer = await client.getDaemonPairingOffer({
+            timeout: PAIRING_DAEMON_RPC_TIMEOUT_MS,
+        });
+        if (!offer.relayEnabled && enableRelay) {
+            if (serverInfo.features.relayConfig !== true) {
+                throw new Error("Update the Paseo daemon before enabling relay from this command.");
+            }
+            await client.patchDaemonConfig({ relay: { enabled: true } });
+            offer = await client.getDaemonPairingOffer({
+                timeout: PAIRING_DAEMON_RPC_TIMEOUT_MS,
+            });
+        }
+        return {
+            relayEnabled: offer.relayEnabled,
+            url: offer.url || null,
+            qr: offer.qr ?? null,
+        };
+    }
+    finally {
+        await client.close().catch(() => undefined);
+    }
+}
+export async function confirmRelayPairing() {
+    log.message("Your connection is end-to-end encrypted. Paseo cannot read your code or messages.");
+    log.message(`Learn how it works: ${RELAY_DOCS_URL}`);
+    const answer = await confirm({
+        message: "Enable relay to pair a device?",
+        initialValue: false,
+    });
+    return !isCancel(answer) && answer;
+}
+export function printDirectConnectionGuidance() {
+    console.log("Daemon is running with relay off.");
+    console.log("To connect another device directly, use the daemon's TCP address over your LAN, Tailscale, or another VPN.");
+    console.log(`Learn more: ${RELAY_DOCS_URL}#direct-connections`);
+}
+export async function runPairCommand(options, dependencyOverrides = {}) {
+    if (options.home)
+        process.env.PASEO_HOME = options.home;
+    const dependencies = {
+        resolveOffer: resolveLocalPairingOffer,
+        confirmRelay: confirmRelayPairing,
+        printDirectGuidance: printDirectConnectionGuidance,
+        isInteractive: () => Boolean(process.stdin.isTTY && process.stdout.isTTY),
+        output: createProcessOutput(),
+        ...dependencyOverrides,
+    };
+    const paseoHome = resolvePaseoHome();
+    let pairing = await dependencies.resolveOffer({
+        paseoHome,
+        enableRelay: options.relay === true,
+    });
+    const canPrompt = dependencies.isInteractive() && options.json !== true;
+    if (!pairing.relayEnabled && canPrompt) {
+        const shouldEnable = await dependencies.confirmRelay();
+        if (!shouldEnable) {
+            dependencies.printDirectGuidance();
+            dependencies.output.writeStderr(`${chalk.yellow("No pairing QR was created.")}\n`);
+            dependencies.output.setExitCode(1);
+            return;
+        }
+        pairing = await dependencies.resolveOffer({ paseoHome, enableRelay: true });
+        dependencies.output.success("Relay enabled");
+    }
+    outputPairingResult(pairing, options, dependencies.output);
+}
+function outputPairingResult(pairing, options, output) {
+    if (!pairing.relayEnabled || !pairing.url) {
+        if (options.json) {
+            output.writeStderr(`${JSON.stringify({
+                code: "RELAY_DISABLED",
+                message: "Relay pairing is disabled for this daemon.",
+                action: "Run paseo daemon pair --relay --json to enable it explicitly.",
+            })}\n`);
+        }
+        else {
+            output.writeStderr(`${chalk.red("Relay pairing is disabled for this daemon.")}\n`);
+            output.writeStderr(`${chalk.yellow("Run paseo daemon pair --relay to enable it.")}\n`);
+        }
+        output.setExitCode(1);
+        return;
+    }
+    if (options.json) {
+        output.writeStdout(`${JSON.stringify({ relayEnabled: pairing.relayEnabled, url: pairing.url, qr: pairing.qr }, null, 2)}\n`);
+        return;
+    }
+    output.writeStdout(formatPairingInstructions({
+        url: pairing.url,
+        qr: pairing.qr,
+        columns: output.columns,
+    }));
+}
+//# sourceMappingURL=pair.js.map

package/dist/commands/daemon/reload.d.ts

@@ -0,0 +1,10 @@
+import type { Command } from "commander";
+import type { CommandOptions, OutputSchema, SingleResult } from "../../output/index.js";
+export interface DaemonReloadResult {
+    appliedPaths: string[];
+    restartRequiredPaths: string[];
+    overrideControlledPaths: string[];
+}
+export declare const daemonReloadSchema: OutputSchema<DaemonReloadResult>;
+export declare function runDaemonReloadCommand(options: CommandOptions, _command: Command): Promise<SingleResult<DaemonReloadResult>>;
+//# sourceMappingURL=reload.d.ts.map

package/dist/commands/daemon/reload.js

@@ -0,0 +1,36 @@
+import { connectToDaemon } from "../../utils/client.js";
+export const daemonReloadSchema = {
+    idField: () => "daemon-config",
+    columns: [],
+    renderHuman(result) {
+        if (result.type !== "single")
+            return "";
+        const lines = ["Configuration reloaded."];
+        if (result.data.restartRequiredPaths.length > 0) {
+            lines.push("", "Warning: These changes require a daemon restart:", ...result.data.restartRequiredPaths.map((path) => `  ${path}`), "", "Run: paseo daemon restart");
+        }
+        if (result.data.overrideControlledPaths.length > 0) {
+            lines.push("", "Warning: These settings are controlled by daemon launch overrides:", ...result.data.overrideControlledPaths.map((path) => `  ${path}`));
+        }
+        return lines.join("\n");
+    },
+};
+export async function runDaemonReloadCommand(options, _command) {
+    const client = await connectToDaemon({ host: options.host });
+    try {
+        const payload = await client.reloadDaemonConfig();
+        return {
+            type: "single",
+            data: {
+                appliedPaths: payload.appliedPaths,
+                restartRequiredPaths: payload.restartRequiredPaths,
+                overrideControlledPaths: payload.overrideControlledPaths,
+            },
+            schema: daemonReloadSchema,
+        };
+    }
+    finally {
+        await client.close();
+    }
+}
+//# sourceMappingURL=reload.js.map

package/dist/commands/daemon/restart.d.ts

@@ -0,0 +1,12 @@
+import type { Command } from "commander";
+import type { CommandOptions, SingleResult } from "../../output/index.js";
+interface RestartResult {
+    action: "restarted";
+    home: string;
+    pid: string;
+    message: string;
+}
+export type RestartCommandResult = SingleResult<RestartResult>;
+export declare function runRestartCommand(options: CommandOptions, _command: Command): Promise<RestartCommandResult>;
+export {};
+//# sourceMappingURL=restart.d.ts.map

package/dist/commands/daemon/restart.js

@@ -0,0 +1,99 @@
+import { startLocalDaemonDetached, stopLocalDaemon, DEFAULT_STOP_TIMEOUT_MS, } from "./local-daemon.js";
+const restartResultSchema = {
+    idField: "action",
+    columns: [
+        {
+            header: "STATUS",
+            field: "action",
+            color: () => "green",
+        },
+        { header: "HOME", field: "home" },
+        { header: "PID", field: "pid" },
+        { header: "MESSAGE", field: "message" },
+    ],
+};
+function parseTimeoutMs(raw) {
+    if (typeof raw !== "string" || raw.trim().length === 0) {
+        return DEFAULT_STOP_TIMEOUT_MS;
+    }
+    const seconds = Number(raw);
+    if (!Number.isFinite(seconds) || seconds <= 0) {
+        const error = {
+            code: "INVALID_TIMEOUT",
+            message: `Invalid timeout value: ${raw}`,
+            details: "Timeout must be a positive number of seconds",
+        };
+        throw error;
+    }
+    return Math.ceil(seconds * 1000);
+}
+function toStartOptions(options) {
+    const startOptions = {
+        home: typeof options.home === "string" ? options.home : undefined,
+        listen: typeof options.listen === "string" ? options.listen : undefined,
+        port: typeof options.port === "string" ? options.port : undefined,
+        relay: typeof options.relay === "boolean" ? options.relay : undefined,
+        mcp: typeof options.mcp === "boolean" ? options.mcp : undefined,
+        injectMcp: typeof options.injectMcp === "boolean" ? options.injectMcp : undefined,
+        webUi: typeof options.webUi === "boolean" ? options.webUi : undefined,
+        hostnames: typeof options.hostnames === "string" ? options.hostnames : undefined,
+    };
+    if (startOptions.listen && startOptions.port) {
+        const error = {
+            code: "INVALID_OPTIONS",
+            message: "Cannot use --listen and --port together",
+        };
+        throw error;
+    }
+    return startOptions;
+}
+export async function runRestartCommand(options, _command) {
+    const timeoutMs = parseTimeoutMs(options.timeout);
+    const force = options.force === true;
+    const startOptions = toStartOptions(options);
+    try {
+        let stopResult;
+        try {
+            stopResult = await stopLocalDaemon({
+                home: startOptions.home,
+                timeoutMs,
+                force,
+            });
+        }
+        catch (err) {
+            const isTimeout = err instanceof Error && err.message.includes("Timed out waiting for daemon PID");
+            if (!force && isTimeout) {
+                stopResult = await stopLocalDaemon({
+                    home: startOptions.home,
+                    timeoutMs,
+                    force: true,
+                });
+            }
+            else {
+                throw err;
+            }
+        }
+        const startup = await startLocalDaemonDetached(startOptions);
+        const before = stopResult.pid === null ? "not running" : `PID ${stopResult.pid}`;
+        const after = startup.pid === null ? "unknown PID" : `PID ${startup.pid}`;
+        return {
+            type: "single",
+            data: {
+                action: "restarted",
+                home: stopResult.home,
+                pid: startup.pid === null ? "-" : String(startup.pid),
+                message: `Local daemon restarted (${before} -> ${after})`,
+            },
+            schema: restartResultSchema,
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const error = {
+            code: "RESTART_FAILED",
+            message: `Failed to restart local daemon: ${message}`,
+        };
+        throw error;
+    }
+}
+//# sourceMappingURL=restart.js.map

package/dist/commands/daemon/runtime-toolchain.d.ts

@@ -0,0 +1,6 @@
+export interface NodePathFromPidResult {
+    nodePath: string | null;
+    error?: string;
+}
+export declare function resolveNodePathFromPid(pid: number): Promise<NodePathFromPidResult>;
+//# sourceMappingURL=runtime-toolchain.d.ts.map

package/dist/commands/daemon/runtime-toolchain.js

@@ -0,0 +1,87 @@
+import { platform } from "node:os";
+import { execCommand } from "@camerontaylor/paseo-server";
+function normalizeError(error) {
+    if (error instanceof Error) {
+        return error.message;
+    }
+    return String(error);
+}
+async function resolveNodePathFromPidUnix(pid) {
+    try {
+        const { stdout } = await execCommand("ps", ["-o", "comm=", "-p", String(pid)]);
+        const resolved = stdout.trim();
+        return resolved
+            ? { nodePath: resolved }
+            : { nodePath: null, error: "ps returned an empty command path" };
+    }
+    catch (error) {
+        return { nodePath: null, error: `ps failed: ${normalizeError(error)}` };
+    }
+}
+async function runProcessProbe(command, args, options) {
+    try {
+        const { stdout } = await execCommand(command, args, { shell: options?.shell });
+        const resolved = stdout.trim();
+        return resolved
+            ? { resolved }
+            : { resolved: null, error: `${command} returned no executable path` };
+    }
+    catch (error) {
+        return { resolved: null, error: `${command} failed: ${normalizeError(error)}` };
+    }
+}
+async function resolveNodePathFromPidWindows(pid) {
+    const probes = [
+        {
+            label: "powershell-cim",
+            command: "powershell.exe",
+            args: [
+                "-NoProfile",
+                "-Command",
+                `(Get-CimInstance Win32_Process -Filter "ProcessId = ${pid}").ExecutablePath`,
+            ],
+        },
+        {
+            label: "powershell-process",
+            command: "powershell.exe",
+            args: ["-NoProfile", "-Command", `(Get-Process -Id ${pid}).Path`],
+        },
+        {
+            label: "wmic",
+            command: "wmic",
+            args: ["process", "where", `ProcessId=${pid}`, "get", "ExecutablePath", "/VALUE"],
+            parseValue: (stdout) => {
+                const match = stdout.match(/ExecutablePath=(.+)/);
+                return match?.[1]?.trim() ?? null;
+            },
+        },
+    ];
+    const errors = [];
+    async function tryProbe(index) {
+        if (index >= probes.length) {
+            return {
+                nodePath: null,
+                error: errors.join("; ") || "could not resolve executable path from PID",
+            };
+        }
+        const probe = probes[index];
+        const result = await runProcessProbe(probe.command, probe.args, { shell: false });
+        if (result.resolved) {
+            const resolved = probe.parseValue ? probe.parseValue(result.resolved) : result.resolved;
+            if (resolved)
+                return { nodePath: resolved };
+            errors.push(`${probe.label} returned no executable path`);
+        }
+        else if (result.error) {
+            errors.push(`${probe.label}: ${result.error}`);
+        }
+        return tryProbe(index + 1);
+    }
+    return tryProbe(0);
+}
+export async function resolveNodePathFromPid(pid) {
+    return platform() === "win32"
+        ? await resolveNodePathFromPidWindows(pid)
+        : await resolveNodePathFromPidUnix(pid);
+}
+//# sourceMappingURL=runtime-toolchain.js.map

package/dist/commands/daemon/set-password.d.ts

@@ -0,0 +1,17 @@
+import type { Command } from "commander";
+import type { CommandOptions, SingleResult } from "../../output/index.js";
+interface SetPasswordResult {
+    action: "password_set";
+    configPath: string;
+    restartCommand: string;
+    message: string;
+}
+export type PromptPassword = (message: string) => Promise<string | symbol>;
+export interface SetPasswordOptions {
+    home?: string;
+    promptPassword?: PromptPassword;
+}
+export declare function setDaemonPasswordInConfig(newPassword: string, options?: SetPasswordOptions): Promise<SetPasswordResult>;
+export declare function runSetPasswordCommand(options: CommandOptions, _command: Command): Promise<SingleResult<SetPasswordResult>>;
+export {};
+//# sourceMappingURL=set-password.d.ts.map

package/dist/commands/daemon/set-password.js

@@ -0,0 +1,82 @@
+import path from "node:path";
+import { isCancel, password as passwordPrompt } from "@clack/prompts";
+import { hashDaemonPassword, loadPersistedConfig, savePersistedConfig, } from "@camerontaylor/paseo-server";
+import { resolveLocalPaseoHome } from "./local-daemon.js";
+const CONFIG_FILENAME = "config.json";
+const setPasswordResultSchema = {
+    idField: "action",
+    columns: [
+        { header: "STATUS", field: "action", color: () => "green" },
+        { header: "CONFIG", field: "configPath" },
+        { header: "RESTART", field: "restartCommand" },
+    ],
+    renderHuman: (result, options) => {
+        const data = result.data;
+        const rows = [
+            `Password written to ${data.configPath}`,
+            "Restart the daemon for the change to take effect.",
+            `Run: ${data.restartCommand}`,
+        ];
+        if (options.format === "table") {
+            return rows.join("\n");
+        }
+        return data.message;
+    },
+};
+function createCommandError(code, message, details) {
+    return { code, message, ...(details ? { details } : {}) };
+}
+async function promptForPassword(promptPassword) {
+    const first = await promptPassword("New daemon password");
+    if (isCancel(first)) {
+        throw createCommandError("PASSWORD_CANCELLED", "Password update cancelled");
+    }
+    if (typeof first !== "string" || first.length === 0) {
+        throw createCommandError("PASSWORD_REQUIRED", "Password cannot be empty");
+    }
+    const second = await promptPassword("Confirm daemon password");
+    if (isCancel(second)) {
+        throw createCommandError("PASSWORD_CANCELLED", "Password update cancelled");
+    }
+    if (first !== second) {
+        throw createCommandError("PASSWORD_MISMATCH", "Passwords do not match");
+    }
+    return first;
+}
+export async function setDaemonPasswordInConfig(newPassword, options = {}) {
+    const paseoHome = resolveLocalPaseoHome(options.home);
+    const configPath = path.join(paseoHome, CONFIG_FILENAME);
+    const persisted = loadPersistedConfig(paseoHome);
+    const nextConfig = {
+        ...persisted,
+        daemon: {
+            ...persisted.daemon,
+            auth: {
+                ...persisted.daemon?.auth,
+                password: hashDaemonPassword(newPassword),
+            },
+        },
+    };
+    savePersistedConfig(paseoHome, nextConfig);
+    return {
+        action: "password_set",
+        configPath,
+        restartCommand: "paseo daemon restart",
+        message: `Password written to ${configPath}\nRestart the daemon for the change to take effect.\nRun: paseo daemon restart`,
+    };
+}
+export async function runSetPasswordCommand(options, _command) {
+    const promptPassword = typeof options.promptPassword === "function"
+        ? options.promptPassword
+        : (message) => passwordPrompt({ message });
+    const newPassword = await promptForPassword(promptPassword);
+    const result = await setDaemonPasswordInConfig(newPassword, {
+        home: typeof options.home === "string" ? options.home : undefined,
+    });
+    return {
+        type: "single",
+        data: result,
+        schema: setPasswordResultSchema,
+    };
+}
+//# sourceMappingURL=set-password.js.map

package/dist/commands/daemon/start.d.ts

@@ -0,0 +1,6 @@
+import { Command } from "commander";
+import { type DaemonStartOptions as StartOptions } from "./local-daemon.js";
+export type { DaemonStartOptions as StartOptions } from "./local-daemon.js";
+export declare function startCommand(): Command;
+export declare function runStart(options: StartOptions): Promise<void>;
+//# sourceMappingURL=start.d.ts.map

package/dist/commands/daemon/start.js

@@ -0,0 +1,57 @@
+import { Command, Option } from "commander";
+import chalk from "chalk";
+import { startLocalDaemonForeground, startLocalDaemonDetached, } from "./local-daemon.js";
+import { getErrorMessage } from "../../utils/errors.js";
+export function startCommand() {
+    return new Command("start")
+        .description("Start the local Paseo daemon")
+        .option("--listen <listen>", "Listen target (host:port, port, or unix socket path)")
+        .option("--port <port>", "Port to listen on (default: 6767)")
+        .option("--home <path>", "Paseo home directory (default: ~/.paseo)")
+        .option("--foreground", "Run in foreground (don't daemonize)")
+        .option("--relay", "Enable relay connection")
+        .option("--no-relay", "Disable relay connection")
+        .option("--relay-use-tls", "Use wss:// for the relay connection and pairing offers")
+        .option("--no-mcp", "Disable the Agent MCP HTTP endpoint")
+        .option("--no-inject-mcp", "Disable auto-injecting the Paseo MCP into created agents")
+        .option("--web-ui", "Enable the bundled daemon web UI")
+        .option("--no-web-ui", "Disable the bundled daemon web UI")
+        .option("--hostnames <hosts>", 'Daemon hostnames (comma-separated, e.g. "myhost,.example.com" or "true" for any)')
+        .addOption(new Option("--allowed-hosts <hosts>").hideHelp())
+        .action(async (options) => {
+        await runStart({
+            ...options,
+            hostnames: options.hostnames ?? options.allowedHosts,
+        });
+    });
+}
+export async function runStart(options) {
+    if (options.listen && options.port) {
+        console.error(chalk.red("Cannot use --listen and --port together"));
+        process.exit(1);
+    }
+    if (!options.foreground) {
+        try {
+            const startup = await startLocalDaemonDetached(options);
+            console.log(chalk.green(`Daemon starting in background (PID ${startup.pid ?? "unknown"}).`));
+            console.log(chalk.dim(`Logs: ${startup.logPath}`));
+        }
+        catch (err) {
+            exitWithError(getErrorMessage(err));
+        }
+        return;
+    }
+    try {
+        const status = startLocalDaemonForeground(options);
+        process.exit(status);
+    }
+    catch (err) {
+        const message = getErrorMessage(err);
+        exitWithError(`Failed to start daemon: ${message}`);
+    }
+}
+function exitWithError(message) {
+    console.error(chalk.red(message));
+    process.exit(1);
+}
+//# sourceMappingURL=start.js.map

package/dist/commands/daemon/status.d.ts

@@ -0,0 +1,21 @@
+import type { Command } from "commander";
+import type { CommandOptions, ListResult } from "../../output/index.js";
+interface StatusRow {
+    key: string;
+    value: string;
+}
+interface RelayStatusConfig {
+    enabled: boolean;
+    endpoint: string;
+    publicEndpoint: string;
+    useTls: boolean;
+    publicUseTls: boolean;
+}
+export declare function selectRelayStatus(input: {
+    persisted: RelayStatusConfig;
+    live?: RelayStatusConfig;
+}): string;
+export type StatusResult = ListResult<StatusRow>;
+export declare function runStatusCommand(options: CommandOptions, _command: Command): Promise<StatusResult>;
+export {};
+//# sourceMappingURL=status.d.ts.map