@camerontaylor/paseo-cli 0.9.1-fork.1 → 0.10.2-fork.1

package/dist/commands/agent/run.d.ts

@@ -72,7 +72,16 @@ export interface RunWorkspaceLookupClient {
 }
 export declare function resolveExistingRunWorkspace(client: RunWorkspaceLookupClient, workspaceId: string): Promise<RunWorkspace>;
 export declare function runRunCommand(prompt: string, options: AgentRunOptions, _command: Command): Promise<SingleResult<AgentRunResult>>;
-export declare function resolveRunCallerAgentId(env?: {
+export interface RunCallerLookupClient {
+    fetchAgent(options: {
+        agentId: string;
+    }): Promise<{
+        agent: {
+            id: string;
+        };
+    } | null>;
+}
+export declare function resolveRunCallerAgentId(client: RunCallerLookupClient, env?: {
     PASEO_AGENT_ID?: string;
-}): string | undefined;
+}): Promise<string | undefined>;
 //# sourceMappingURL=run.d.ts.map

package/dist/commands/agent/run.js

@@ -1,5 +1,6 @@
 import { Option } from "commander";
 import { getStructuredAgentResponse, StructuredAgentResponseError, } from "@camerontaylor/paseo-server/agent-response";
+import { DaemonConnectionError } from "@camerontaylor/paseo-client/internal/daemon-client";
 import { connectToDaemon } from "../../utils/client.js";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
@@ -374,18 +375,18 @@ export async function resolveExistingRunWorkspace(client, workspaceId) {
 }
 // Workspace policy for `paseo run`. Precedence:
 //   1. --workspace <id>            -> run in that existing workspace
-//   2. $PASEO_AGENT_ID             -> daemon resolves the caller's workspace
+//   2. caller agent                -> daemon resolves the caller's workspace
 //   3. $PASEO_WORKSPACE_ID         -> exported by workspace terminals
 //   4. --new-workspace <kind>      -> mint a new workspace explicitly
 //   5. bare run                    -> mint a new local-backed workspace for cwd
-async function resolveRunWorkspace(client, options, cwd) {
+async function resolveRunWorkspace(client, options, cwd, callerAgentId) {
     const newWorkspace = resolveNewWorkspaceKind(options);
     const explicit = newWorkspace ? undefined : options.workspace?.trim();
     if (explicit) {
         console.error(`Using workspace ${explicit}`);
         return resolveExistingRunWorkspace(client, explicit);
     }
-    if (!newWorkspace && resolveRunCallerAgentId()) {
+    if (!newWorkspace && callerAgentId) {
         return { cwd };
     }
     const ambientWorkspaceId = newWorkspace ? undefined : process.env.PASEO_WORKSPACE_ID?.trim();
@@ -434,9 +435,9 @@ export async function runRunCommand(prompt, options, _command) {
         const labels = parseRunLabels(options.label);
         const env = parseRunEnv(options.env);
         const requestEnv = Object.keys(env).length > 0 ? env : undefined;
-        const workspace = await resolveRunWorkspace(client, options, cwd);
+        const callerAgentId = await resolveRunCallerAgentId(client);
+        const workspace = await resolveRunWorkspace(client, options, cwd, callerAgentId);
         const workspaceId = workspace.id;
-        const callerAgentId = resolveRunCallerAgentId();
         const runCwd = workspace.cwd;
         if (outputSchema) {
             let structuredAgent = null;
@@ -543,7 +544,22 @@ export async function runRunCommand(prompt, options, _command) {
         throw error;
     }
 }
-export function resolveRunCallerAgentId(env = process.env) {
-    return env.PASEO_AGENT_ID?.trim() || undefined;
+// PASEO_AGENT_ID names an agent on the daemon that launched this shell. A run
+// sent to another daemon (--host or --home) has no caller there, so it runs as
+// a top-level agent instead of failing on an unknown caller.
+export async function resolveRunCallerAgentId(client, env = process.env) {
+    const agentId = env.PASEO_AGENT_ID?.trim();
+    if (!agentId) {
+        return undefined;
+    }
+    const caller = await client.fetchAgent({ agentId }).catch((error) => {
+        // A daemon without this agent answers with an error. A lost or timed-out
+        // connection is not an answer, so it must not drop the caller.
+        if (error instanceof DaemonConnectionError) {
+            throw error;
+        }
+        return null;
+    });
+    return caller?.agent.id === agentId ? agentId : undefined;
 }
 //# sourceMappingURL=run.js.map

package/dist/commands/daemon/pair.js

@@ -7,6 +7,8 @@ import { readPersistedConfig, editPersistedConfig, resolveConfigFromPersisted, }
 import { connectToDaemon } from "../../utils/client.js";
 import { addJsonAndDaemonHostOptions, withGlobalOptions } from "../../utils/command-options.js";
 import { formatPairingInstructions } from "../../output/pairing.js";
+import { parseConnectionOfferFromUrl } from "@camerontaylor/paseo-protocol/connection-offer";
+import { serializeRelayConnectionUri } from "@camerontaylor/paseo-protocol/daemon-endpoints";
 const PAIRING_DAEMON_RPC_TIMEOUT_MS = 1500;
 const RELAY_DOCS_URL = "https://paseo.sh/docs/security";
 function createProcessOutput() {
@@ -126,13 +128,16 @@ function outputPairingResult(pairing, options, output) {
         output.setExitCode(1);
         return;
     }
+    const offer = parseConnectionOfferFromUrl(pairing.url);
+    const connectionUri = offer ? serializeRelayConnectionUri({ offer }) : null;
     if (options.json) {
-        output.writeStdout(`${JSON.stringify({ relayEnabled: pairing.relayEnabled, url: pairing.url, qr: pairing.qr }, null, 2)}\n`);
+        output.writeStdout(`${JSON.stringify({ relayEnabled: pairing.relayEnabled, url: pairing.url, qr: pairing.qr, connectionUri }, null, 2)}\n`);
         return;
     }
     output.writeStdout(formatPairingInstructions({
         url: pairing.url,
         qr: pairing.qr,
+        connectionUri,
         columns: output.columns,
     }));
 }

package/dist/commands/daemon/set-password.js

@@ -27,6 +27,12 @@ const setPasswordResultSchema = {
 function createCommandError(code, message, details) {
     return { code, message, ...(details ? { details } : {}) };
 }
+function terminalPasswordPrompt() {
+    if (!process.stdin.isTTY) {
+        throw createCommandError("PASSWORD_TTY_REQUIRED", "paseo daemon set-password needs a terminal to read the password", "Run it in an interactive terminal, or set PASEO_PASSWORD in the daemon's environment instead.");
+    }
+    return (message) => passwordPrompt({ message });
+}
 async function promptForPassword(promptPassword) {
     const first = await promptPassword("New daemon password");
     if (isCancel(first)) {
@@ -69,7 +75,7 @@ export async function setDaemonPasswordInConfig(newPassword, options = {}) {
 export async function runSetPasswordCommand(options, _command) {
     const promptPassword = typeof options.promptPassword === "function"
         ? options.promptPassword
-        : (message) => passwordPrompt({ message });
+        : terminalPasswordPrompt();
     const newPassword = await promptForPassword(promptPassword);
     const result = await setDaemonPasswordInConfig(newPassword, {
         home: options.daemonTarget.kind === "instance" ? options.daemonTarget.home : undefined,

package/dist/commands/daemon/status.js

@@ -102,6 +102,7 @@ function localStatus(home, instance) {
         pid: instance?.pid ?? null,
         startedAt: instance?.startedAt ?? null,
         listen: instance?.listen ?? null,
+        serverId: instance?.serverId ?? undefined,
         hostname: instance?.hostname ?? null,
         configuredListen: config.listen,
         localDaemon,

package/dist/commands/permit/allow.d.ts

@@ -1,4 +1,5 @@
 import type { Command } from "commander";
+import type { AgentPermissionRequest } from "@camerontaylor/paseo-protocol/agent-types";
 import type { CommandOptions, ListResult, OutputSchema } from "../../output/index.js";
 /** Permission response item for display */
 export interface PermissionResponseItem {
@@ -10,6 +11,8 @@ export interface PermissionResponseItem {
 }
 /** Schema for permit allow/deny output */
 export declare const permitResponseSchema: OutputSchema<PermissionResponseItem>;
+/** Transform a permission the agent answered to a response item */
+export declare function toPermissionResponseItem(agentId: string, permission: AgentPermissionRequest, result: "allowed" | "denied"): PermissionResponseItem;
 export type PermitAllowResult = ListResult<PermissionResponseItem>;
 export interface PermitAllowOptions extends CommandOptions {
     all?: boolean;

package/dist/commands/permit/allow.js

@@ -3,7 +3,7 @@ import { connectToDaemon } from "../../utils/client.js";
 export const permitResponseSchema = {
     idField: "requestId",
     columns: [
-        { header: "REQUEST ID", field: "requestId", width: 12 },
+        { header: "REQUEST ID", field: (item) => item.requestId.slice(0, 8), width: 12 },
         { header: "AGENT", field: "agentShortId", width: 10 },
         { header: "TOOL", field: "name", width: 20 },
         {
@@ -20,6 +20,16 @@ export const permitResponseSchema = {
         },
     ],
 };
+/** Transform a permission the agent answered to a response item */
+export function toPermissionResponseItem(agentId, permission, result) {
+    return {
+        requestId: permission.id,
+        agentId,
+        agentShortId: agentId.slice(0, 7),
+        name: permission.name,
+        result,
+    };
+}
 export async function runAllowCommand(agentIdOrPrefix, reqId, options, _command) {
     // No validation needed - if no reqId provided, allow all by default
     // Parse input JSON if provided
@@ -88,13 +98,7 @@ export async function runAllowCommand(agentIdOrPrefix, reqId, options, _command)
                 behavior: "allow",
                 ...(updatedInput ? { updatedInput } : {}),
             });
-            return {
-                requestId: permission.id.slice(0, 8),
-                agentId: resolvedAgentId,
-                agentShortId: resolvedAgentId.slice(0, 7),
-                name: permission.name,
-                result: "allowed",
-            };
+            return toPermissionResponseItem(resolvedAgentId, permission, "allowed");
         }));
         await client.close();
         return {

package/dist/commands/permit/deny.js

@@ -1,5 +1,5 @@
 import { connectToDaemon } from "../../utils/client.js";
-import { permitResponseSchema } from "./allow.js";
+import { permitResponseSchema, toPermissionResponseItem, } from "./allow.js";
 export async function runDenyCommand(agentIdOrPrefix, reqId, options, _command) {
     // Validate arguments
     if (!options.all && !reqId) {
@@ -60,13 +60,7 @@ export async function runDenyCommand(agentIdOrPrefix, reqId, options, _command)
                 ...(options.message ? { message: options.message } : {}),
                 ...(options.interrupt ? { interrupt: true } : {}),
             });
-            return {
-                requestId: permission.id.slice(0, 8),
-                agentId: resolvedAgentId,
-                agentShortId: resolvedAgentId.slice(0, 7),
-                name: permission.name,
-                result: "denied",
-            };
+            return toPermissionResponseItem(resolvedAgentId, permission, "denied");
         }));
         await client.close();
         return {

package/dist/commands/permit/ls.d.ts

@@ -1,4 +1,5 @@
 import type { Command } from "commander";
+import type { AgentSnapshotPayload } from "@camerontaylor/paseo-protocol/messages";
 import type { CommandOptions, ListResult, OutputSchema } from "../../output/index.js";
 /** Permission list item for display */
 export interface PermissionListItem {
@@ -11,6 +12,8 @@ export interface PermissionListItem {
 /** Schema for permit ls output */
 export declare const permitLsSchema: OutputSchema<PermissionListItem>;
 export type PermitLsResult = ListResult<PermissionListItem>;
+/** Collect the pending permissions of every agent */
+export declare function listPendingPermissions(agents: AgentSnapshotPayload[]): PermitLsResult;
 export interface PermitLsOptions extends CommandOptions {
     host?: string;
 }

package/dist/commands/permit/ls.js

@@ -4,7 +4,7 @@ export const permitLsSchema = {
     idField: "id",
     columns: [
         { header: "AGENT", field: "agentShortId", width: 12 },
-        { header: "REQ_ID", field: "id", width: 12 },
+        { header: "REQ_ID", field: (item) => item.id.slice(0, 8), width: 12 },
         { header: "TOOL", field: "name", width: 20 },
         { header: "DESCRIPTION", field: "description", width: 50 },
     ],
@@ -12,33 +12,34 @@ export const permitLsSchema = {
 /** Transform agent snapshot + permission to list item */
 function toListItem(agent, permission) {
     return {
-        id: permission.id.slice(0, 8),
+        id: permission.id,
         agentId: agent.id,
         agentShortId: agent.id.slice(0, 7),
         name: permission.name,
         description: permission.description ?? "-",
     };
 }
+/** Collect the pending permissions of every agent */
+export function listPendingPermissions(agents) {
+    const items = [];
+    for (const agent of agents) {
+        for (const permission of agent.pendingPermissions ?? []) {
+            items.push(toListItem(agent, permission));
+        }
+    }
+    return {
+        type: "list",
+        data: items,
+        schema: permitLsSchema,
+    };
+}
 export async function runLsCommand(options, _command) {
     const client = await connectToDaemon({ target: options.daemonTarget });
     try {
         const agentsPayload = await client.fetchAgents({ filter: { includeArchived: true } });
         const agents = agentsPayload.entries.map((entry) => entry.agent);
         await client.close();
-        // Collect all pending permissions from all agents
-        const items = [];
-        for (const agent of agents) {
-            if (agent.pendingPermissions && agent.pendingPermissions.length > 0) {
-                for (const permission of agent.pendingPermissions) {
-                    items.push(toListItem(agent, permission));
-                }
-            }
-        }
-        return {
-            type: "list",
-            data: items,
-            schema: permitLsSchema,
-        };
+        return listPendingPermissions(agents);
     }
     catch (err) {
         await client.close().catch(() => { });

package/dist/output/pairing.d.ts

@@ -1,8 +1,9 @@
 interface PairingInstructions {
     url: string;
     qr: string | null;
+    connectionUri?: string | null;
     columns?: number;
 }
-export declare function formatPairingInstructions({ url, qr, columns }: PairingInstructions): string;
+export declare function formatPairingInstructions({ url, qr, columns, connectionUri, }: PairingInstructions): string;
 export {};
 //# sourceMappingURL=pairing.d.ts.map

package/dist/output/pairing.js

@@ -18,7 +18,19 @@ function formatQr(qr, columns) {
     }
     return qr;
 }
-export function formatPairingInstructions({ url, qr, columns }) {
-    return `\nScan to pair:\n${formatQr(qr, columns)}\n\nPairing link:\n${url}\n\nTreat this pairing link like a password. Anyone with it can access this daemon.\n`;
+function redactConnectionUri(uri) {
+    try {
+        const parsed = new URL(uri);
+        if (parsed.searchParams.has("password")) {
+            parsed.searchParams.set("password", "[redacted]");
+        }
+        return parsed.toString();
+    }
+    catch {
+        return "Invalid connection URI";
+    }
+}
+export function formatPairingInstructions({ url, qr, columns, connectionUri, }) {
+    return `\nScan to pair:\n${formatQr(qr, columns)}\n\nPairing link:\n${url}${connectionUri ? `\n\nConnection URI:\n${redactConnectionUri(connectionUri)}` : ""}\n\nTreat this pairing link like a password. Anyone with it can access this daemon.\n`;
 }
 //# sourceMappingURL=pairing.js.map

package/dist/utils/client.d.ts

@@ -7,6 +7,7 @@ export interface ConnectOptions {
     timeout?: number;
     instance?: DaemonInstance;
 }
+export declare function resolveClientPaseoHome(target: DaemonTarget, env?: Readonly<Record<string, string | undefined>>): string;
 type TransportTarget = {
     type: "tcp";
     url: string;
@@ -26,6 +27,13 @@ export declare function buildDaemonConnectionCommandError(options: ConnectOption
 export declare function normalizeDaemonHost(raw: string): string | null;
 export declare function resolveDaemonTarget(host: string): TransportTarget;
 export declare function resolveDaemonPassword(host: string): string | undefined;
+export declare function resolveDaemonCredential(host: string, home: string): {
+    kind: "password";
+    password: string;
+} | {
+    kind: "localCredential";
+    token: string;
+} | null;
 export declare function connectToDaemon(options: ConnectOptions): Promise<DaemonClient>;
 /**
  * Try to connect to the daemon, returns null if connection fails

package/dist/utils/client.js

@@ -1,4 +1,4 @@
-import { waitForDaemonReady, resolvePaseoHome, } from "@camerontaylor/paseo-server/daemon-control";
+import { waitForDaemonReady, resolvePaseoHome, readLocalCredentialForTarget, } from "@camerontaylor/paseo-server/daemon-control";
 import { describeDaemonTarget } from "./daemon-target.js";
 import { buildDaemonWebSocketUrl, buildRelayWebSocketUrl, normalizeHostPort, parseConnectionUri, shouldUseTlsForDefaultHostedRelay, } from "@camerontaylor/paseo-protocol/daemon-endpoints";
 import { parseConnectionOfferFromUrl, } from "@camerontaylor/paseo-protocol/connection-offer";
@@ -8,6 +8,9 @@ import { WebSocket } from "ws";
 import { getOrCreateCliClientId } from "./client-id.js";
 import { resolveCliVersion } from "../version.js";
 import { createSshTunnel } from "../ssh/ssh-tunnel.js";
+export function resolveClientPaseoHome(target, env = process.env) {
+    return target.kind === "instance" ? target.home : resolvePaseoHome(env);
+}
 const DEFAULT_TIMEOUT = 15000;
 export function getDaemonHost(options) {
     return describeDaemonTarget(options.target);
@@ -31,11 +34,18 @@ export function buildDaemonConnectionCommandError(options) {
     return {
         code,
         message: `Cannot connect to daemon at ${describeDaemonTarget(options.target)}: ${message}`,
-        details: options.target.kind === "instance"
-            ? `Start with: paseo daemon start --home ${JSON.stringify(options.target.home)}`
-            : "Check the selected endpoint and credentials. SSH transport does not install or start the daemon.",
+        details: describeConnectionRemedy(code, options.target),
     };
 }
+function describeConnectionRemedy(code, target) {
+    if (code === "AUTH_REQUIRED")
+        return "The daemon requires a password. Set PASEO_PASSWORD and retry.";
+    if (code === "AUTH_FAILED")
+        return "The daemon rejected the password. Check PASEO_PASSWORD and retry.";
+    if (target.kind === "instance")
+        return `Start with: paseo daemon start --home ${JSON.stringify(target.home)}`;
+    return "Check the selected endpoint and credentials. SSH transport does not install or start the daemon.";
+}
 export function normalizeDaemonHost(raw) {
     const trimmed = raw.trim();
     if (!trimmed) {
@@ -126,6 +136,13 @@ export function resolveDaemonPassword(host) {
     const fromEnv = process.env.PASEO_PASSWORD;
     return fromEnv && fromEnv.length > 0 ? fromEnv : undefined;
 }
+export function resolveDaemonCredential(host, home) {
+    const password = resolveDaemonPassword(host);
+    if (password)
+        return { kind: "password", password };
+    const token = readLocalCredentialForTarget(home, host);
+    return token ? { kind: "localCredential", token } : null;
+}
 /**
  * Create a WebSocket factory that works in Node.js
  */
@@ -141,14 +158,17 @@ function createNodeWebSocketFactory() {
  * Create and connect a daemon client
  * Returns the connected client or throws if connection fails
  */
-async function tryConnectHost(host, password, clientId, timeout, nodeWebSocketFactory) {
+async function tryConnectHost(host, credential, home, clientId, timeout, nodeWebSocketFactory) {
     const target = resolveDaemonTarget(host);
     const client = new DaemonClient({
         url: target.url,
         clientId,
         clientType: "cli",
         appVersion: resolveCliVersion(),
-        password,
+        ...(credential?.kind === "password" ? { password: credential.password } : {}),
+        ...(credential?.kind === "localCredential"
+            ? { localCredential: () => readLocalCredentialForTarget(home, host) ?? undefined }
+            : {}),
         connectTimeoutMs: timeout,
         webSocketFactory: (url, config) => nodeWebSocketFactory(url, {
             headers: config?.headers,
@@ -214,13 +234,14 @@ async function connectSelectedDaemon(options) {
             timeoutMs: timeout,
             instance: options.instance,
         })).listen;
-    const clientId = await getOrCreateCliClientId(resolvePaseoHome({}));
+    const home = resolveClientPaseoHome(options.target);
+    const clientId = await getOrCreateCliClientId(home);
     const nodeWebSocketFactory = createNodeWebSocketFactory();
     if (explicitHost?.trim().startsWith("ssh://")) {
         const target = parseSshTransportUri(explicitHost.trim());
         const tunnel = await createSshTunnel(target);
         const password = resolveDaemonPassword(explicitHost);
-        const result = await tryConnectHost(tunnel.endpoint, password, clientId, Math.max(1, deadline - Date.now()), nodeWebSocketFactory);
+        const result = await tryConnectHost(tunnel.endpoint, password ? { kind: "password", password } : null, home, clientId, Math.max(1, deadline - Date.now()), nodeWebSocketFactory);
         if ("client" in result) {
             const close = result.client.close.bind(result.client);
             result.client.close = async () => {
@@ -243,7 +264,7 @@ async function connectSelectedDaemon(options) {
     if (offer) {
         return connectViaRelayOffer(offer, clientId, Math.max(1, deadline - Date.now()), nodeWebSocketFactory);
     }
-    const result = await tryConnectHost(explicitHost, resolveDaemonPassword(explicitHost), clientId, Math.max(1, deadline - Date.now()), nodeWebSocketFactory);
+    const result = await tryConnectHost(explicitHost, resolveDaemonCredential(explicitHost, home), home, clientId, Math.max(1, deadline - Date.now()), nodeWebSocketFactory);
     if ("client" in result)
         return result.client;
     throw result.error;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camerontaylor/paseo-cli",
-  "version": "0.9.1-fork.1",
+  "version": "0.10.2-fork.1",
   "description": "Paseo CLI - control your AI coding agents from the command line",
   "bin": {
     "paseo": "bin/paseo"
@@ -28,9 +28,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.0.0",
-    "@camerontaylor/paseo-client": "0.9.1-fork.1",
-    "@camerontaylor/paseo-protocol": "0.9.1-fork.1",
-    "@camerontaylor/paseo-server": "0.9.1-fork.1",
+    "@camerontaylor/paseo-client": "0.10.2-fork.1",
+    "@camerontaylor/paseo-protocol": "0.10.2-fork.1",
+    "@camerontaylor/paseo-server": "0.10.2-fork.1",
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
     "mime-types": "^2.1.35",