diff --git a/200 projects/Tools Software WebUI/Paseo Pi GUI Tool.md b/200 projects/Tools Software WebUI/Paseo Pi GUI Tool.md index 188fa1e..d4a1625 100644 --- a/200 projects/Tools Software WebUI/Paseo Pi GUI Tool.md +++ b/200 projects/Tools Software WebUI/Paseo Pi GUI Tool.md @@ -17,8 +17,8 @@ aliases: # Paseo Pi GUI Tool -**Paseo 0.7.2 — multi-agent orchestration GUI**, self-hosted in **Docker on .13**, driving real -**pi agents (0.82.1)** through **OmniRoute**. Built 2026-09-09/10. +**Paseo 0.7.2 — multi-agent orchestration GUI**, running **natively on .13** (no Docker), driving the host's +**pi (0.82.1)** with full filesystem access, LLM through **OmniRoute**. Native migration 2026-09-16. **Interactive map:** [maps.lab → Paseo](https://maps.lab.audasmedia.com.au/paseo/docs/system-map.html) · **Repo:** [sam/paseo](https://gitea.lab.audasmedia.com.au/sam/paseo) (public, README + diagram) @@ -26,10 +26,11 @@ aliases: ## What it is A client-server **orchestration layer for AI coding agents**: -- **Daemon** (Node.js) runs on .13, spawns and manages agent processes, streams output over WebSocket. -- **Clients** — CLI (`paseo` on .27/.51), web UI (:6767), mobile — attach locally or over LAN/Tailscale. -- **Pi is a first-class provider**: the daemon spawns `pi --mode rpc` (pi 0.82.1 baked into the image — no Nix changes to any host pi). -- **Local-first**: agents run in our environment; no telemetry. +- **Daemon** runs natively on .13 (systemd user service), spawns and manages agent processes, streams output over WebSocket. +- **Clients** — CLI (`paseo` on .27/.51), web UI (:6767), mobile — attach over LAN/Tailscale. +- **Pi is a first-class provider**: the daemon spawns the **host's own pi 0.82.1** via `pi --mode rpc` (Nix-managed, no image bake-in). +- **No sandbox — full control**: the daemon runs as user `sam`, so agents reach the real filesystem directly (projects, vault, photos). This is the autonomy model: pi's own guardrails (filechanges, approvals) protect the work, not a container boundary. +- **Local-first**: no telemetry. ```mermaid flowchart LR @@ -38,7 +39,7 @@ flowchart LR D51[".51 laptop
paseo CLI"] M["Mobile / web UI
browser"] end - subgraph S13["Paseo daemon (.13 — Docker, always-on)"] + subgraph S13["Paseo daemon (.13 — native, always-on)"] D["Paseo daemon 0.7.2
:6767 · auth"] PI["pi agent 0.82.1
pi --mode rpc"] CFG["pi config
/home/paseo/.pi"] @@ -64,7 +65,7 @@ flowchart LR # client (on .27/.51 once) npm install -g @getpaseo/cli@0.7.2 export PASEO_HOST=192.168.20.13:6767 -export PASEO_PASSWORD= +export PASEO_PASSWORD= paseo status # daemon reachable paseo ls # running agents @@ -80,24 +81,25 @@ Web UI: `http://192.168.20.13:6767` (password) · mobile: browser over LAN/Tails | Area | Location | |---|---| -| Compose + config + secrets | `.13` `/home/sam/Docker/Containers/paseo/` (`docker-compose.yml`, `Dockerfile`, `.env` chmod 600) | -| pi config (persisted) | `.13` `…/paseo/paseo-home/.pi/` (settings.json, models.json, auth.json) | -| Demo workspace | `.13` `…/paseo/workspace/demo/` | +| Native daemon | `.13` systemd user service `paseo.service` (enabled) — `0.0.0.0:6767` | +| pi (host Nix 0.82.1) | `.13` `/etc/profiles/per-user/sam/bin/pi` — used directly | +| Paseo config | `.13` `~/.paseo/` | +| **Real projects** | `.13` **`~/paseo/projects//`** — direct FS access, no mounts | +| Obsidian vault / photos | directly accessible (agent runs as `sam`) | | Docs + diagram + map | Gitea `sam/paseo` → `docs/` → maps.lab (`/paseo/docs/`) | -| Client CLI | `.27` `~/.local/share/npm-global` (`paseo` 0.7.2) | +| Client CLIs | `.27`/`.51` `~/.local/share/npm-global` (`paseo` 0.7.2) | +| Legacy Docker backup | `.13` `~/paseo/docker-legacy-backup-20260916104024/` (delete when confident) | ## Config notes (no secrets) -- **Image**: `ghcr.io/getpaseo/paseo:latest` base + `USER root` stage installing - `@earendil-works/pi-coding-agent@0.82.1` + `omniroute-pi-ext-integration`, drops to `USER paseo`. - Reason: base image runs as `paseo` (uid 1000); `/usr/local` is root-owned → npm -g must run at build time. -- **LLM**: container pi → `omni` provider → `http://192.168.20.13:20129/v1` (OmniRoute, LAN IP reachable - from the bridge net; `host.docker.internal` also mapped). Default model set to the fixed combo: - `default-opencode-go-ds-flash` (OpenRouter → DeepSeek → OpenCode-Go). -- **Secrets** live only in `.env` (600) — `PASEO_PASSWORD`, `OMNIROUTE_API_KEY`; never in docs/repos. - Also mirrored into `~/.config/environment.d/10-secrets.conf` on .27 (and .51 later) as `PASEO_HOST` + `PASEO_PASSWORD` for zero-config CLI. -- **Access** is LAN/Tailscale-only; password auth enforced. No public Caddy subdomain yet. -- **Restart/rebuild**: `cd /home/sam/Docker/Containers/paseo && docker compose up -d --build`. +- **Daemon**: native, `systemctl --user {start,stop,status} paseo`; logs `journalctl --user -u paseo`. Start cmd: + `paseo start --listen 0.0.0.0:6767 --web-ui` (daemonized; `--foreground` is buggy with PID lock). +- **pi**: host Nix pi 0.82.1 with the host `~/.pi/` + `~/.agents` (Gitea `pi-config` clone) — full skill set, per-project `.pi/settings.json` selects which load. +- **LLM**: pi → `omni` provider → `http://192.168.20.13:20129/v1` (OmniRoute). Default model = combo + `default-opencode-go-ds-flash` (OpenRouter → DeepSeek → OpenCode-Go) — models.json reordered so it's first. +- **Secrets**: `PASEO_PASSWORD`/`PASEO_HOST` in `.13` `~/.config/environment.d/10-secrets.conf` (600); mirrored to .27/.51 secrets. Never in docs/repos. +- **Firewall**: port 6767 added to `networking.firewall.allowedTCPPorts` in `.13` `/etc/nixos/configuration.nix` (backup `configuration.nix.bak-paseo-…`). +- **Access** is LAN/Tailscale-only; password auth enforced. No public Caddy subdomain (use Paseo relay only if internet access ever needed). --- @@ -157,7 +159,7 @@ all agents. ### Passwords — what to do -- One password protects the web UI + CLI: `PASEO_PASSWORD` in `.13` `/home/sam/Docker/Containers/paseo/.env`. +- One password protects the web UI + CLI: `PASEO_PASSWORD` in `.13` `~/.config/environment.d/10-secrets.conf`. - Mirrored to `~/.config/environment.d/10-secrets.conf` on .27 (and .51) so the CLI just works after login. - **Rule:** never paste into chat, git-committed files, or public docs. It's a secret. - You don't type it day-to-day — it's wired up. Just don't share it or put it in code. @@ -186,15 +188,14 @@ Requirements: the machine must be on **Tailscale** or the home LAN to reach .13. do not install/update it; it's part of the image. - **Your normal pi** on each machine (.27/.13/.51) — Nix-managed, used in a terminal. Untouched. -### Skills & extensions (IMPORTANT) +### Skills & extensions (native = full toolbox) -- Paseo's container pi starts with a **minimal config** (~/.pi in the paseo-home volume): providers + - omni extension only. -- It does **NOT** automatically get your `~/.agents` skills/extensions (nixos-workflow, - system-architect, obsidian-cli, tavily-search, etc.) from Gitea `pi-config`. -- To give Paseo agents those, we add them to the container (bake into image or mount `~/.agents`). - **Follow-up task — not done yet.** Until then: Paseo agents handle general coding tasks with the - base config; for your specialized skills, use your normal terminal pi. +- Native daemon uses the **host pi** (`~/.pi` + `~/.agents` on .13, Gitea `pi-config` clone) — so Paseo + agents have the **same skills as your terminal pi** (nixos-workflow, system-architect, project-ops, + obsidian-cli, etc.). No bake-in needed. +- Per-project `.pi/settings.json` **selects** which skills load (project settings replace global). +- To give a specific project skills: create `/.pi/settings.json` with a package entry + `{ "source": "/home/sam/.agents", "skills": ["skills/"...] }`. ### Mobile