jb/paseo
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Add durable Paseo Hub CLI login (#3022)

Browse Source 
* feat(cli): add durable Hub login

Keep organization-scoped human credentials separate from daemon relationship authority. Connect now exchanges explicit or stored CLI authority for a one-time enrollment token, while logout removes human access without implicitly disconnecting automation.

* fix(cli): require TLS for remote Hub credentials

Durable Hub credentials are bearer secrets, so remote origins must not receive them over cleartext HTTP. Keep literal loopback HTTP available for local Hub development.

* fix(cli): make Hub destinations explicit

Resolve optional Hub origins through one shared precedence policy so active logins remain the default context and credentials stay origin-bound. Report the selected destination before human-facing work, keep structured output auditable, and preserve login authority until requested daemon disconnection succeeds.
This commit is contained in:
Mohamed Boudra
2026-08-08 15:27:43 +02:00
committed by GitHub
parent e36842b234
commit b669dad221
40 changed files with 2369 additions and 1032 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public-docs/hub/daemons.md
+15 -5
View File
@@ -12,24 +12,32 @@ A daemon is one of your machines running the Paseo daemon. Enroll it once with y
## Connect
On the machine:
Log in from the machine first:
```sh
paseo hub connect https://hub.example.com
paseo hub login https://hub.example.com
```
The CLI prints a URL and a verification code, and opens your browser if it can. In Hub, open **Daemons → Register a daemon**, enter the code, choose a friendly slug, and approve it.
The CLI prints a URL and verification code, opens your browser when the terminal is interactive, and stores the approved organization-scoped CLI credential under `PASEO_HOME`. Then enroll the daemon:
```sh
paseo hub connect
```
`connect` resolves the active login's Hub origin and uses its credential to request a short-lived, single-use enrollment token. The daemon exchanges that token and retains its own independently generated relationship credential. The human CLI credential is never stored as daemon authority.
Each daemon has two identifiers: an immutable generated ID and a friendly slug. Hub normalizes the slug you enter with lowercase words joined by hyphens, so `Build Studio` becomes `build-studio`. The slug is what the dashboard shows and what configuration references.
You can rename the slug later without changing the daemon ID. Renaming after a configuration is active means updating that configuration.
For unattended setup, skip the browser with an enrollment token:
For unattended setup, pass an organization API key without storing it:
```sh
paseo hub connect https://hub.example.com --token <token>
PASEO_HUB_URL=https://hub.example.com PASEO_HUB_API_KEY=paseo_pk_... paseo hub connect
```
Origin precedence is explicit `[origin]`, `PASEO_HUB_URL`, active stored login, then `https://hub.paseo.sh`. An explicit `--api-key <secret>` takes precedence over the environment and an exact-origin stored login.
Check and undo:
```sh
@@ -40,6 +48,8 @@ paseo hub disconnect --force # drop local authority when Hub is unreachable
One daemon has one Hub relationship. Connecting a daemon that already has one is refused.
`paseo hub logout` removes only the active human CLI credential. In an interactive terminal, it checks the relationship and offers to disconnect when the daemon uses the same Hub. It performs an accepted disconnect before deleting the login, so a failed disconnection preserves the human credential. Declining leaves the daemon connected and removes only the login. JSON and noninteractive logout never disconnect implicitly; use `paseo hub logout --disconnect-daemon` when automation intends to remove both identities. Add `--force` only when that daemon disconnection should remove local authority while Hub is unreachable.
## Reference it from configuration
```yaml