jb/paseo
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Add durable Paseo Hub CLI login (#3022)

Browse Source 
* feat(cli): add durable Hub login

Keep organization-scoped human credentials separate from daemon relationship authority. Connect now exchanges explicit or stored CLI authority for a one-time enrollment token, while logout removes human access without implicitly disconnecting automation.

* fix(cli): require TLS for remote Hub credentials

Durable Hub credentials are bearer secrets, so remote origins must not receive them over cleartext HTTP. Keep literal loopback HTTP available for local Hub development.

* fix(cli): make Hub destinations explicit

Resolve optional Hub origins through one shared precedence policy so active logins remain the default context and credentials stay origin-bound. Report the selected destination before human-facing work, keep structured output auditable, and preserve login authority until requested daemon disconnection succeeds.
This commit is contained in:
Mohamed Boudra
2026-08-08 15:27:43 +02:00
committed by GitHub
parent e36842b234
commit b669dad221
40 changed files with 2369 additions and 1032 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public-docs/hub/quickstart.md
+7 -6
View File
@@ -25,10 +25,11 @@ The connection appears with a generated slug like `yourname-github`.
On the machine that will run agents:
```sh
paseo hub connect https://your-hub.example.com
paseo hub login https://your-hub.example.com
paseo hub connect
```
The CLI prints a verification code. In Hub, open **Daemons → Register a daemon**, enter the code, and choose a friendly slug. Hub normalizes `Build Studio` to `build-studio`. See [Daemons](/docs/hub/daemons).
Approve the CLI login in the browser. `connect` selects that active login's origin and enrolls the daemon using the stored organization credential. The CLI login and daemon relationship remain separate identities. See [Daemons](/docs/hub/daemons).
## 4. Create a project
@@ -79,15 +80,15 @@ Push to the default branch. Hub fetches the file at that commit, validates it, a
If the file is invalid, Hub records the failure and keeps the previous revision active.
To deploy the file directly instead, create an organization API key with the `configuration:install` scope, then run:
To inspect the authenticated organization's projects and deploy the file directly, run:
```sh
export PASEO_HUB_URL=https://your-hub.example.com
export PASEO_HUB_API_KEY=paseo_pk_...
paseo hub projects
paseo hub deploy --dry-run
paseo hub deploy
```
The command reads exactly `.paseo/hub.yml` from the current directory. It does not search parent directories. Use `paseo hub deploy path/to/config.yml` for another file. `-p, --project <slug>` overrides the file's `project` metadata. See [Hub configuration](/docs/hub/configuration#deploy-from-the-cli) for every deploy option and the current authentication limits.
The commands use the active stored login. Origin precedence is explicit command origin or `--hub`, `PASEO_HUB_URL`, active login, then `https://hub.paseo.sh`. `--dry-run` sends the same YAML, project, and partial bundle to Hub's authoritative validator without recording or activating a revision. The command reads exactly `.paseo/hub.yml` from the current directory. Use `paseo hub deploy path/to/config.yml` for another file, or `-p, --project <slug>` to override the file's project metadata. An explicit `--api-key` or `PASEO_HUB_API_KEY` overrides the stored credential without persisting the key.
## 7. Trigger it