Mohamed Boudra
7c04eed039
Updated peers negotiate Noise_NK_25519_ChaChaPoly_SHA256 inside the existing e2ee_hello / e2ee_ready exchange and send counter-nonced records framed with authenticated chunk metadata. Old peers on either side fall back to the legacy NaCl box channel while the daemon permits it. Daemon flag daemon.relay.requireProtectedSecurity (default false, reloadable) refuses legacy relay clients at hello time; pairing offers and relay URIs then carry minimumSecurityMode=protected. The daemon advertises server_info.features.relayProtectedSecurity, and a relay client that negotiated legacy with such a daemon closes 4002 before admission. The app pins the protected minimum per daemon public key. Covers getpaseo/paseo#359.
@getpaseo/client
TypeScript SDK for building integrations on top of a Paseo daemon.
npm install @getpaseo/client
import { createPaseoClient } from "@getpaseo/client";
const client = createPaseoClient({ url: "ws://127.0.0.1:6767/ws" });
await client.connect();
const agent = await client.agents.create({
config: { provider: "codex/gpt-5.5" },
cwd: "/Users/me/dev/storefront",
prompt: "Review the current diff and name the riskiest change.",
});
const result = await agent.waitForFinish();
console.log(result.lastMessage);
await client.close();
The public API is the package root. Imports under @getpaseo/client/internal/* are unsupported implementation details used by Paseo's own packages.
Read the SDK documentation for agents, workspaces, terminals, provider discovery, events, recipes, and the API reference. Runnable TypeScript patterns also live in examples/.
Runtime
The client needs a WebSocket implementation. Modern browsers and Node.js 22 provide one globally.
Use a WebSocket URL ending in /ws, such as ws://127.0.0.1:6767/ws. Pass password when the daemon requires authentication.
The client advertises its supported protocol capabilities by default. Optional capabilities
overrides extend or override that declaration; browser hosting must be supplied by the caller.
Connecting alone does not subscribe to agent timelines or catalog events. See the
event guide for subscription lifetimes and timeline replacements.
Stability
The high-level API exported from @getpaseo/client is the supported SDK surface. The SDK and daemon remain protocol-compatible across versions, but newly added capabilities can require a newer daemon.