mrkeyoor.com_
Fri 16 Oct 18:51 UTC
Dev Toolsevaluationupdated 11 Oct 2026

paseo review

Paseo lets you operate coding agents on your computer or server through desktop, phone, browser, and command-line clients. Its local daemon keeps the agents beside your development tools, so you can follow their work and send instructions from another device.

+494 / 4dstars / 7d
Verdict

Our Paseo install pulled 2,220 packages and used 3,410 MB, then its build failed and tests hit the 900-second cap with 12 failures, so this source checkout needs more investigation before I'd depend on it. Try a published client when following several agents from a phone solves a recurring problem and you can maintain the daemon host. Keep direct Git review available and investigate the 154 audit findings before adopting the measured source environment.

We ran it

Lab card: what happened when we ran paseoScreenshot of paseo (paseo.sh)
Install✓ · 89s2220 packages · 3410 MB
Build✗ · 624s
Tests✗ timed out · 900s6267 passed · 12 failed · 54 skipped of 6333 (vitest)
Known vulns15410 critical · 90 high · 45 moderate · 9 low (npm audit)
Repo5573 files~1,108,778 lines of source · 67.7 MB · 12 CI workflows

Answers from our run

Does paseo build from source?

Dependencies installed in 89 seconds (2220 packages), and the build failed. We cloned commit e81d5d0 into a clean Debian container with 3 CPUs and no project-specific setup.

Do paseo's tests pass?

Not all of them: 6267 of 6333 passed and 12 failed when we ran the project's own test command (vitest). Some failures need services or credentials a bare container does not have.

Does paseo have known vulnerabilities in its dependencies?

npm audit flagged 154 known advisories in the dependency tree, including 10 critical at the time of our run.

Who should not use paseo?

Developers expecting an agent to work without separate provider setup: the README requires an installed agent CLI configured with credentials.

What are the alternatives to paseo?

Happy, code-server. Our Paseo install pulled 2,220 packages and used 3,410 MB, then its build failed and tests hit the 900-second cap with 12 failures, so this source checkout needs more investigation before I'd depend on it.

Setup2/5Install passed; build failed and tests hit the 900-second cap
Docs4/5Provider prerequisites, connection routes, and plugin access are clear
Community4/5October 11 push and active issue and PR queue
Maturity2/5Active releases, but build failure, test timeout, and audit findings

Discussed on

  1. hnShow HN: Paseo – Beautiful open-source coding agent interface92 points
  2. hnShow HN: Paseo – Open-source coding agent interface (desktop, mobile, CLI)14 points
  3. hnShow HN: Paseo, an open source environment for coding agents6 points
  4. hnShow HN: Paseo – Run coding agents from your phone, desktop, or terminal (FOSS)5 points
  5. hnShow HN: Paseo – Open-source coding agent interface (desktop, mobile, CLI)5 points

Who it’s for

Developers who want to follow running Claude Code, Codex, or other supported agents from their phones.
Engineers coordinating agents in separate Git worktrees and reviewing their changes from a shared interface.
Server users willing to maintain a daemon, provider credentials, and a chosen remote connection route.

Who it’s NOT for

Developers expecting an agent to work without separate provider setup: the README requires an installed agent CLI configured with credentials.
Teams requiring a passing fresh-container build and test run: our build failed, tests timed out with 12 failures, and npm audit reported 154 known vulnerabilities.
Review systems relying exclusively on Paseo's diff APIs for unusual filenames: issue #6565 reports missing diffs for quoted filenames on macOS.
Organizations unable to trust plugins with development-machine access: the README states that plugins run on the daemon and inside connected clients.
Remote users expecting SSH transport to provision their server: the connectivity guide requires a daemon already running and working key authentication.

Setup reality

Our sandbox installed commit e81d5d0 in 89 seconds, adding 2,220 packages and occupying 3,410 MB. The build failed after 624 seconds in the desktop workspace. Tests timed out at 900 seconds: 6,267 passed, 12 failed, and 54 skipped out of 6,333. npm audit reported 154 vulnerabilities, including 10 critical and 90 high.

You need an agent CLI installed and configured with provider credentials on the daemon host. The desktop app starts the daemon automatically. Server users maintain it separately and choose encrypted relay pairing, a direct connection, or another supported transport. Plugins have access to the daemon machine and connected clients.

We used an unprivileged Debian lab-node:22 container with 3 CPUs and 8 GB of RAM. The failing build command chains server preparation, desktop compilation, and packaging, but its tail doesn't identify the underlying error. The test tail gives no failed assertions. Packaged desktop and Docker routes are documented separately and were not measured in this run.

Your agents stay on the daemon machine

Leave an agent running at your desk, then check its work from your phone: Paseo gives that workflow a shared interface. Its README describes a local daemon that manages agent processes while desktop, mobile, web, and command-line clients connect to it. You keep the development environment on the host where the daemon runs, rather than recreating it on each device.

That convenience comes from a sizeable application. Our source checkout occupied 67.7 MB across 5,573 files and roughly 1,108,778 source lines. The monorepo includes a daemon, Expo client, Electron desktop application, CLI, and relay components. I'd consider it when moving between devices repeatedly interrupts ongoing agent work. For someone who already does everything in a terminal on one computer, this adds another layer to maintain with less obvious benefit.

What happened when we ran it

Our run installed 2,220 npm packages in 89 seconds and occupied 3,410 MB after installation. We cloned commit e81d5d0 on October 10, 2026, into an unprivileged Debian sandbox using lab-node:22, with 3 CPUs, 8 GB of RAM, and no secrets. Installation completed, but the build failed with exit code 1 after 624 seconds. Those are source-workflow results, not a measurement of the downloaded desktop app's startup or responsiveness.

The build tail names the desktop workspace, @getpaseo/desktop@0.11.2, and a command chaining a clean server build, the desktop main build, and electron-builder. It also shows the CLI's TypeScript command afterward. The excerpt doesn't identify the underlying error. We cannot say whether a missing system package, packaging requirement, or source problem caused the failure, nor whether the server could have worked independently. The measured repository-wide build did not finish successfully.

Tests timed out after 900 seconds. Vitest reported 6,267 passed, 12 failed, and 54 skipped out of 6,333. The final excerpt lists CLI test files, announces a server-stack build, and reports test concurrency, without showing the failed assertions. That gives us substantial passing coverage alongside failures and an unfinished command. It doesn't justify calling the whole suite green or attributing its failures to the desktop build.

The npm audit reported 154 known vulnerabilities: 10 critical, 90 high, 45 moderate, and 9 low. The measurement doesn't identify affected packages or their exposure in the shipped application, so the totals cannot establish an exploitable production path. They do warrant inspecting the dependency tree before adopting this checkout. Our scan also found 12 CI workflow files, workspace configuration, no Dockerfile, and no dedicated tests directory, despite the test output.

An installed provider and its credentials are prerequisites

The README requires an agent CLI already installed and configured with your credentials. Paseo doesn't supply a model subscription or turn an unauthenticated machine into a coding agent. The desktop route starts its daemon automatically, while the server route uses the CLI. Get your provider working on the daemon host first, then connect a client.

The 3,410 MB footprint we measured belongs to the source install, not necessarily the packaged desktop download. The README separately documents a published Docker image, even though our checkout scan found no Dockerfile. Its Docker instructions require adding the agent CLIs and supplying credentials through environment variables or persistent storage. Treat the client, daemon, and provider configuration as separate pieces when diagnosing an apparently connected app that cannot perform useful work.

Remote access still needs a running host

The connectivity guide offers an encrypted relay for phone pairing, direct connections through Tailscale, and SSH transport for desktop and CLI clients. Relay access is disabled until you enable it. SSH transport requires an existing remote daemon and working non-interactive key authentication. It doesn't install or start that daemon for you. Your phone can reach a development host, but the host still has to be available.

Our 900-second test cap didn't measure relay reliability, phone reconnection, or provider authentication. Before relying on remote approvals, exercise those behaviors with the connection route you will actually use. The plugin system deserves the same scrutiny: plugins run on the daemon and inside connected clients, and the README explicitly warns that they have machine access. Install a plugin as code you trust to operate in your development environment.

Diff review has a documented filename edge case

Open issue #6565 reports missing checkout and commit diffs for filenames containing quotation marks, with related failures for backslashes and tabs. The reproduction concerns the daemon's diff APIs on macOS and the current source, while ordinary names and names containing spaces work. It does not establish the same behavior across every platform or client screen. Still, a diff API returning empty hunks for changed files matters to review tooling.

That report is independent of the 12 failed tests in our run. It gives a competent developer a specific reason to keep direct Git inspection available before approving edits involving unusual filenames. Separate worktrees help agents avoid overlapping working copies, but they don't validate the resulting changes. I'd use Paseo to organize sessions while retaining the repository's own checks and a reliable way to inspect the complete diff.

October maintenance doesn't erase the sandbox failures

The last push was October 11, 2026, and the issue and PR queue had activity that day. GitHub listed 1,172 open issues and PRs. Release v0.11.2, published October 9, fixes text clipping in iOS chats and Markdown previews. That shows active maintenance and a fix mobile users will see. It doesn't resolve the build or audit findings from our source revision.

Happy is another choice for carrying agent sessions onto a phone. Pick code-server when a browser-accessible editor is enough and agent orchestration isn't the requirement. Paseo earns a trial if remote access to several running agents saves you repeated trips back to the workstation. Start with a published application and a noncritical repository, then check pairing, permission prompts, and complete diffs before letting a phone approval release consequential changes.

Alternatives

ProjectWhat it isPick it when
Happy gh↗Mobile and web clients with a CLI and relay for continuing coding-agent sessions.pick this instead when carrying a Claude Code or Codex terminal session onto your phone is the main requirement.
code-server gh↗VS Code running on a remote machine and accessed through a browser.pick this instead when a remote editor and terminal meet your needs without a separate interface for coordinating agents.

What people are saying

  1. [velocity-scout] getpaseo/paseo

Sources

  1. Paseo README
  2. Paseo connectivity guide
  3. Quoted-filename diff report
  4. Paseo v0.11.2 release
  5. Paseo repository activity
  6. Happy README
  7. code-server README

More dev tools reviews

compose-samples · librepods · sqlmap · coucou · world-execute-me-dsh-pv · mcp-extensions · the whole board →