mirror of
https://github.com/getpaseo/paseo.git
synced 2026-07-29 12:01:31 +00:00
e22c85373c
* fix(server): keep the client port in X-Forwarded-Host The service proxy stripped the port when setting X-Forwarded-Host, so a workspace service that derives its public origin from forwarded headers emitted absolute URLs pointing at port 80. Opening a service at http://api--branch--repo.localhost:6767/ and letting it redirect gave back a Location without the port, which the browser followed to nothing. Host was already forwarded intact, so services reading Host were fine. Nothing rewrites Location on the way back, so the wrong URL reached the browser unchanged. The strip was not localhost-only: buildPublicServiceProxyUrl preserves an explicit port in publicBaseUrl, so a public alias on :8443 hit the same path. It was a no-op only on the default-port public case. Forward the authority verbatim instead, and add X-Forwarded-Port under a never-invent, never-clobber rule: report only a port observed in the Host header, and leave any value an upstream proxy already set alone. Deriving it from the scheme would overwrite nginx's port on a non-default listener, and the upgrade path's hardcoded "http" would turn a correct 443 into 80. An empty inbound value carries no port, so it does not count as a value to preserve; out-of-range ports are dropped rather than passed on, since the authority is client-supplied. The header block existed in four copies. Collapse them: the subsystem now delegates to createScriptProxyMiddleware and createScriptProxyUpgradeHandler (passing passthroughUnknown explicitly, since the factory defaults it to true), and both remaining call sites share one buildForwardedHeaders helper. Adds the first tests to cover any x-forwarded-* header on this path, driven over a real proxy with an upstream that echoes what it received. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(server): let the observed authority win over a forged port X-Forwarded-Port deferred to an inbound value, so a client connecting directly could send Host: svc.localhost:63735 with a forged X-Forwarded-Port: 443 and have services build URLs for 443. Frameworks apply X-Forwarded-Port after X-Forwarded-Host, so the forged value won. This was inconsistent with the line above it: X-Forwarded-Host is overwritten with the real authority unconditionally, and there is a test asserting that. Both headers carry the same trust, so both now follow the same rule. First-hand observation wins; an inbound value is a fallback, never an override. A port parsed from Host replaces any inbound X-Forwarded-Port. When Host carries no port there is nothing to observe, so a proxy's value survives untouched: the nginx-on-:8443 case, where $host drops the port and X-Forwarded-Port is the only source. The empty-inbound-value special case is gone; always overwriting when we have an observation covers it with one branch less. Reported by Greptile on #2288. Not a regression: before this branch an inbound X-Forwarded-Port passed through untouched, so the forged value already reached services. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(server): correct the forwarded-port comment and note the limit The comment claimed the parsed port was "the port the client really connected on". It is not: parseHostHeaderPort reads the Host header, which the client writes, and route lookup normalizes the port away before matching, so any value reaches the proxy. The only observed port would be req.socket.localPort, which this code does not use. Replaced it with the actual reason the Host port wins, which is keeping x-forwarded-host and x-forwarded-port from disagreeing: the former is set from Host, and frameworks apply the latter afterwards, so a mismatched inbound value would silently override the forwarded authority. Added a LIMITATION note recording that the forwarded authority is not authenticated, that inbound x-forwarded-port is not checked against trustedProxies, and that closing this needs that config threaded into the subsystem and the upgrade path, which has no Express trust context. Both predate this branch: Host has always carried a client-chosen port and an inbound x-forwarded-port has always passed straight through. Docs gain a matching section telling service authors to pin their public origin in configuration rather than derive it from request headers. No behavior change. Raised by Greptile on #2288. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Paseo
One interface for Claude Code, Codex, Copilot, OpenCode, and Pi agents.
Note
I'm a solo maintainer and don't always keep up with GitHub Issues daily. If something is urgent or blocking you, Discord is the fastest place to reach me.
Run agents in parallel on your own machines. Ship from your phone or your desk.
- Self-hosted: Agents run on your machine with your full dev environment. Use your tools, your configs, and your skills.
- Multi-provider: Claude Code, Codex, Copilot, OpenCode, and Pi through the same interface. Pick the right model for each job.
- Voice control: Dictate tasks or talk through problems in voice mode. Hands-free when you need it.
- Cross-device: iOS, Android, desktop, web, and CLI. Start work at your desk, check in from your phone, script it from the terminal.
- Privacy-first: Paseo doesn't have any telemetry, tracking, or forced log-ins.
Getting Started
Paseo runs a local server called the daemon that manages your coding agents. Clients like the desktop app, mobile app, web app, and CLI connect to it.
Prerequisites
You need at least one agent CLI installed and configured with your credentials:
Desktop app (recommended)
Download it from paseo.sh/download or the GitHub releases page. Open the app and the daemon starts automatically. Nothing else to install.
To connect from your phone, open Settings → your host → Connections → Pair a device.
CLI / headless
Install the CLI and start Paseo:
npm install -g @getpaseo/cli
paseo
This shows a QR code in the terminal. Connect from any client. This path is useful for servers and remote machines.
For full setup and configuration, see:
Docker
Run the Paseo daemon and self-hosted web UI in Docker:
docker run -d --name paseo \
-p 6767:6767 \
-e PASEO_PASSWORD=change-me \
-v "$PWD/paseo-home:/home/paseo" \
-v "$PWD:/workspace" \
ghcr.io/getpaseo/paseo:latest
Open http://localhost:6767 after it starts. Extend the base image with the agent CLIs you use, then provide credentials through environment variables or the persistent /home/paseo volume. See the Docker documentation for full setup details.
CLI
Everything you can do in the app, you can do from the terminal.
paseo run --provider claude/opus-4.6 "implement user authentication"
paseo run --provider codex/gpt-5.4 --worktree feature-x "implement feature X"
paseo ls # list running agents
paseo attach abc123 # stream live output
paseo send abc123 "also add tests" # follow-up task
# run on a remote daemon
paseo --host workstation.local:6767 run "run the full test suite"
See the full CLI reference for more.
Skills
Skills teach your agent to use Paseo to orchestrate other agents.
npx skills add getpaseo/paseo
Then use them in any agent conversation:
/paseo-handoff— hand off work between agents. I use this to plan with Claude and then handoff to Codex to implement./paseo-loop— loop an agent against clear acceptance criteria (aka Ralph loops), optionally with a verifier./paseo-advisor— spin up a single agent as an advisor for a second opinion, without delegating the work itself./paseo-committee— form a committee of two contrasting agents to step back, do root cause analysis, and produce a plan.
Development
Quick monorepo package map:
packages/server: Paseo daemon (agent process orchestration, WebSocket API, MCP server)packages/app: Expo client (iOS, Android, web)packages/cli:paseoCLI for daemon and agent workflowspackages/desktop: Electron desktop apppackages/relay: Relay package for remote connectivitypackages/website: Marketing site and documentation (paseo.sh)
Common commands:
# run all local dev services
npm run dev
# run individual surfaces
npm run dev:server
npm run dev:app
npm run dev:desktop
npm run dev:website
# build the server stack
npm run build:server
# repo-wide checks
npm run typecheck
Community
- paseo-relay — self-hosted relay in Go
- paseo-vscode — VS Code extension
License
AGPL-3.0