jb/paseo
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Add durable Paseo Hub CLI login (#3022)

Browse Source 
* feat(cli): add durable Hub login

Keep organization-scoped human credentials separate from daemon relationship authority. Connect now exchanges explicit or stored CLI authority for a one-time enrollment token, while logout removes human access without implicitly disconnecting automation.

* fix(cli): require TLS for remote Hub credentials

Durable Hub credentials are bearer secrets, so remote origins must not receive them over cleartext HTTP. Keep literal loopback HTTP available for local Hub development.

* fix(cli): make Hub destinations explicit

Resolve optional Hub origins through one shared precedence policy so active logins remain the default context and credentials stay origin-bound. Report the selected destination before human-facing work, keep structured output auditable, and preserve login authority until requested daemon disconnection succeeds.
This commit is contained in:
Mohamed Boudra
2026-08-08 15:27:43 +02:00
committed by GitHub
parent e36842b234
commit b669dad221
40 changed files with 2369 additions and 1032 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public-docs/hub/faq.md
+4
View File
@@ -42,6 +42,10 @@ Only the users listed in a trigger's `from_users`. It is required and cannot be
Dispatch fails and the event is recorded as failed. Nothing is queued, so trigger it again once the daemon is back.
## Does logging out disconnect my daemon?
No. The stored CLI login is a human organization credential; the enrolled daemon has its own relationship credential. Interactive `paseo hub logout` offers to disconnect a daemon related to the same Hub. Declining is normal, and JSON or noninteractive logout never disconnects unless you pass `--disconnect-daemon`.
## Can an agent reply back to Slack or Discord?
Yes, with `allow_outputs`. See the [`hub.yml` output capability reference](/docs/hub/configuration/hub-yml#output-capabilities) for reply limits and required outputs. On GitHub, agents reply through the scoped `GH_TOKEN` they already have, so `gh issue comment` works.