+ What I've learned from using Paseo daily. Not rules, just patterns + that have worked for me. +
++ Your role has changed. You're no longer the one writing code line by + line. You're the one making decisions: what to build, how it should + work, what the architecture looks like. The agent executes, but you + direct. +
++ You can't just say "implement feature X" and walk away. You still + have to do the hard part: deciding what to build, how it fits into + the system, what trade-offs to make. Thinking is not optional. At + least for now, agents replace the typing, not the thinking. +
++ The agent needs a way to verify its work. TDD is one implementation of + this pattern: get the agent to write a failing test, verify it fails + for the right reasons, then tell it to make the test pass. The agent + can loop on its own because it knows what "done" means. +
++ It's not just test runners. For web apps, something like Playwright + MCP lets the agent take screenshots and verify UI changes. For a SaaS + app I built a CLI that wraps all the business logic so the agent could + launch jobs, check statuses, and scrape data without going through the + UI. +
++ Code is cheap with coding agents. I would have never written that CLI + before because it felt like wasted effort. Now I bootstrap tooling + first. It pays off exponentially. +
++ Don't be shy about running multiple agents. Paseo lets you launch + agents in isolated worktrees. Kick one off with voice while walking, + then kick off another. They work independently. You get a notification + when they're done. +
++ It's much more natural to use voice to communicate ideas and pull them + out of your brain. The agent will parse and organize your thoughts + better than if you try to write the perfect prompt. You don't need to + organize anything. Just talk. +
++ Current speech-to-text models are really good. They catch accents, + acronyms, technical terms. And even when they don't, the LLM will + infer what you meant. +
++ Sometimes you need to plan: design a spec, verify it, get the agent to + follow through. Maybe it takes a couple of agents to work through it. + Other times it's conversational: kick off a single agent and start + talking, asking questions. Match your approach to the task. +
++ Don't expect perfect. Expect working. Make it work, make it correct, + make it beautiful. Each iteration gets you closer. With tests, + refactoring is cheap. +
++ I don't let myself add too many features before stopping to refactor. + Sometimes I kick off an agent and have it trace code paths, explain + dependencies, show me how modules connect. I make mental notes during + code review and circle back. +
++ If an agent implements something and you ask it to review its own + work, it will never find issues. Launch a separate agent with a fresh + context to review the first agent's code. It will catch things the + first agent missed or glossed over. An agent might say it's done when + it's not. Another agent can detect that. +
++ People argue about which model is better. That's the wrong question. + Each model has strengths and weaknesses. Knowing them is more useful + than chasing benchmarks. Benchmarks don't mean anything. You need to + try the models yourself to form an opinion. +
++ I use Claude Code as my main driver because it's quick and uses tools + well. But sometimes it jumps to conclusions and gives up too easily. + Codex is frustratingly slow but goes deep, doesn't stop, and is + methodical. It's also stubborn and too serious. These aren't good or + bad traits, just differences you learn to work around. Use the right + model for the job. +
++ Paseo loads configuration from a single JSON file in your Paseo home directory, with optional + environment variable and CLI overrides. +
+
+ By default, Paseo uses ~/.paseo as its home directory.
+ The configuration file is:
+
+ You can change the home directory by setting PASEO_HOME{' '}
+ or passing --home to paseo daemon start.
+
+ Paseo merges configuration in this order: +
+config.json
+ Lists append across sources (for example, allowedHosts and
+ cors.allowedOrigins).
+
+ Minimal example that configures listening address, host allowlist, provider keys, and MCP: +
+
+{`{
+ "$schema": "https://paseo.dev/schemas/paseo.config.v1.json",
+ "version": 1,
+ "providers": {
+ "openai": { "apiKey": "..." },
+ "openrouter": { "apiKey": "..." }
+ },
+ "daemon": {
+ "listen": "127.0.0.1:6767",
+ "allowedHosts": ["localhost", ".localhost"],
+ "mcp": { "enabled": true }
+ }
+}`}
+
+ PASEO_HOME — set Paseo home directoryPASEO_LISTEN — override daemon.listenPASEO_ALLOWED_HOSTS — override/extend daemon.allowedHostsOPENAI_API_KEY and OPENROUTER_API_KEY — override provider keys
+ For editor autocomplete/validation, set $schema to:
+
+ Paseo connects to your local development environment and lets you manage your coding agents from anywhere. +
++ Install the server globally and run it on your machine: +
++ Open Paseo on your phone and scan the QR code displayed in your terminal, or enter the server address manually. +
++ Paseo wraps CLI tools like Claude Code and Codex. You'll need to have them installed and configured with your own credentials before Paseo can manage them. +
++ Voice features currently require an OpenAI API key. Set it as an environment variable before running the server: +
++ Local voice support is coming soon. +
++ Paseo follows a client-server architecture, similar to Docker. The daemon runs on your + machine and manages your coding agents. Clients (the mobile app, CLI, or web interface) + connect to the daemon to monitor and control those agents. +
++ Your code never leaves your machine. Paseo is a local-first tool that connects directly to + your development environment. +
++ The Paseo daemon can run anywhere you want to execute agents: your laptop, a Mac Mini, a + VPS, or a Docker container. The daemon listens for connections and manages agent + lifecycles. +
++ Clients connect to the daemon over WebSocket. There are two ways to establish this + connection: +
++ The relay is the simplest way to connect from your phone. It requires no VPN setup, no + port forwarding, and no firewall configuration. The daemon can stay bound to localhost or + a socket file — it connects outbound to the relay, and your phone meets it there. +
+ +$PASEO_HOME/daemon-keypair.json
+ + The relay sees only: IP addresses, timing, message sizes, and session IDs. It cannot read + message contents, forge messages, or derive encryption keys from observing the handshake. +
+ ++ The daemon requires a valid cryptographic handshake before processing any commands. A + compromised relay cannot: +
++ The QR code or pairing link is the trust anchor. It contains the daemon's public key, + which is required to establish the encrypted connection. Treat it like a password — don't + share it publicly. +
++ If you believe a pairing offer has been compromised, restart the daemon to generate a new + session ID and rotate the relay pairing. +
+
+ By default, the daemon listens on 127.0.0.1:6767{' '}
+ (localhost only). This is safe for local CLI usage but not reachable from your phone or
+ other devices.
+
+ For maximum isolation, you can configure the daemon to listen on a Unix socket file + instead of a TCP port. This prevents any network access entirely — only processes on the + same machine can connect. The CLI supports this mode, but the mobile app and web interface + require a network connection. +
+ ++ If you prefer direct connections over the relay, you can use a VPN like{' '} + + Tailscale + + . Tailscale creates a private network between your devices, so you can access your daemon + without exposing it to the public internet. +
+To set this up:
+100.x.y.z:6767)
+ allowedHosts and{' '}
+ cors.allowedOrigins
+ 0.0.0.0 makes the
+ daemon reachable on all network interfaces, including public Wi-Fi and local networks.
+ This can expose your daemon to unauthorized access. If you must bind to all interfaces,
+ ensure you have proper firewall rules and review your{' '}
+ allowedHosts configuration.
+ + CORS is not a complete security boundary. It + controls which browser origins can make requests, but does not prevent a malicious website + from resolving its domain to your local machine (DNS rebinding). +
+
+ Paseo uses a host allowlist to validate the Host header
+ on incoming requests. Requests with unrecognized hosts are rejected.
+
+ Configure via daemon.allowedHosts in{' '}
+ config.json:
+
[]): allow{' '}
+ localhost,{' '}
+ *.localhost, and all IP addresses
+ ['.example.com']: allow{' '}
+ example.com and any subdomain, plus defaults
+ true: allow any host (not recommended)
+ + Paseo wraps agent CLIs (Claude Code, Codex, OpenCode) but does not manage their + authentication. Each agent provider handles its own credentials: +
+~/.claude/
+ + Paseo never stores or transmits provider API keys. Agents run in your user context with + your existing credentials. +
+