feat(paseo): bump pinned Paseo CLI to 0.15.0 - #560

🤖: AI agent (First Mate), AI-assisted change (OpenCode). Human review required before merge.

Summary

Bumps the pinned @getpaseo/cli version in the Paseo acq-kit from 0.13.0 (current main) to 0.15.0 (npm latest, published 2026-11-03). The PR began as a 0.12.0 -> 0.14.0 bump; it was brought up to date with main (plain git merge origin/main, no rebase/force-push) and retargeted to 0.15.0.

Content Type

• Skill
• Prompt
• Workflow
• Agent instructions
• Lesson learned
• Kit / integration change (not a pattern)

What changed

Per the kit's documented upgrade procedure (integrations/isolation/acq-kits/paseo/docs/decisions/install-at-startup.md: "bump both together"):

• integrations/isolation/acq-kits/paseo/spec.yaml - PASEO_CLI_VERSION="0.15.0"
• integrations/isolation/acq-kits/paseo/files/home/paseo-start.sh - header comment and ${PASEO_CLI_VERSION:-0.15.0} fallback default (exec bit preserved, mode 100755)
• integrations/isolation/acq-kits/paseo/tests/paseo-cli-path.test.mjs, tests/paseo-timing.test.mjs - the stubbed paseo --version output tracks the pin so the version-match (no-reinstall) paths are still exercised

git diff origin/main touches exactly these 4 files (5 lines +/-).

Left alone on purpose: PLAYBOOK_REF="v0.14.0" (playbook kits, unrelated), CHANGELOG.md (release-please), historical ADR text, and TROUBLESHOOTING.md lines 338-346, which mention an old "pinned 0.3.1" (stale before this PR; not part of the pin procedure).

Upstream changes 0.13.0 -> 0.15.0 (from the getpaseo/paseo GitHub release notes)

Nothing breaking for the kit was found, and the kit's interfaces behaved identically in the live run below. 0.13.1/0.13.2 are mobile/UI fixes. 0.14.0 and 0.15.0 are mostly plugin, chat and mobile UI work. Items worth a reviewer's eye:

• 0.15.0 adds daemon-wide HTTP_PROXY / HTTPS_PROXY / NO_PROXY support. The kit's daemon runs in sandboxes that set proxy variables, so outbound daemon traffic may now go through the proxy. Not exercised here (the isolated run had no proxy).
• 0.15.0 keeps terminal programs running across daemon restarts, and adds an opt-in "resume agents after restart" setting. It also reuses running OpenCode v2 services. None of these were exercised.
• 0.14.0 voice mode now defaults to off.
• Upstream notes that downgrading from 0.14.0/0.15.0 needs a backed-up config.json (new keys: speech/idle-cleanup, agent-resume, usage-check). A rollback of this PR on an existing sandbox should therefore remove or restore ~/.paseo/config.json. The kit only writes daemon.listen, daemon.relay.enabled, features.webUi.enabled, worktrees.root.
• The package layout the kit depends on is unchanged: bin/paseo, dist/utils/client.js (connectToDaemon, addProject), and the nested @getpaseo/server/dist/server/web-ui bundle.

Verification (what was actually run)

Isolated environment: separate HOME, XDG_*, PASEO_HOME and npm prefix under the worktree tmp/, a spare port (127.0.0.1:16767), a PID namespace (unshare --user --pid), no proxy, and no credentials. The live Paseo daemon was not touched.

1. Install: npm install -g --ignore-scripts --prefix <tmp>/npm-global @getpaseo/[email protected] -> added 312 packages; paseo --version -> 0.15.0.

2. Version-match logic, the exact expression from paseo-start.sh line 255 (POSIX basic sed with escaped groups):

   paseo --version 2>/dev/null | sed -n 's/^v//; s/.*\([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\).*/\1/p; q'
   # -> 0.15.0   (equals the pin, so no reinstall)

3. Live run of the real paseo-start.sh (copied unmodified into the isolated HOME), with PASEO_KIT_TIMING=1:

   • Cold start (no CLI installed): install_begin -> install_end (npm install of 0.15.0 by the script itself), then config_end -> supervisor_spawn.
   • GET /api/health -> {"status":"ok",...}; GET / (web UI) -> HTTP 200 (3481 bytes).
   • paseo daemon status: localDaemon: running, daemonVersion: 0.15.0, listen: 127.0.0.1:16767, relay enabled:false. The persisted config.json held the kit's expected values (daemon.listen, daemon.relay.enabled=false, features.webUi.enabled=true).
   • Project registration: paseo-register-mounts.mjs ran after health and logged registered prj_... for 6 project directories from the sandbox's real virtiofs mount, through 0.15.0's dist/utils/client.js connectToDaemon and addProject. A direct addProject plus listProjects call also succeeded.
   • Warm restart (second run, CLI already installed): no install_begin event, so no reinstall.
   • Shutdown: paseo daemon stop -> stopped, then the supervisor loop was killed; the port closed and no daemon processes were left.

4. node --test integrations/isolation/acq-kits/paseo/tests/*.mjs -> 87 pass, 0 fail (re-run after the final commit).

5. Python tooling in a venv outside the repo (tmp/venv, pip install -e '.[dev]'):

   • make validate in a clean checkout of this branch: all validators passed. (In the working tree it also scanned my gitignored tmp/ npm install and failed on third-party SKILL.md files; that is an artifact of the scratch dir, not of this change.)
   • make validate-kits: all 11 acq-kits and 2 templates valid. make validate-provider-input-contract: OK. make scan-shell: 0 errors, 0 warnings. make generate-check: INDEX.yaml and CATALOG.md up to date.
   • make test-kits: opencode 62/62, usai-provider 18/18, paseo 87/87, providers/usai 153/153.
   • pytest -q: 779 passed.
   • ruff check . reports 6 errors and ruff format --check . reports 9 files to reformat. These are identical on origin/main (checked on a clean origin/main checkout, same ruff 0.17.3) and none are in files touched by this PR (they are in oci-engine/scripts/verify_resources.py, .agents/skills/secure-code-review/tests/fixtures/sample-code.py, and others).

Not run: anything with a proxy (the daemon-wide proxy support above), a real acq/microsandbox sandbox boot, agent sessions against a provider, terminal persistence across restart, and the 0.14.0 -> 0.15.0 in-place upgrade of an existing sandbox. The live check used the sandbox's own Linux environment, not a PID-1 acq create.

Safety Checklist

• No secrets, tokens, credentials, or private keys
• No PII, CUI, customer data, or sensitive info
• No internal URLs or system details
• Examples use placeholders
• make validate passes (clean checkout)

Quality Checklist

• Change is limited to the version pin and its test stubs
• Kit unit tests pass (87/87)
• Live install, daemon readiness, UI, project registration and clean shutdown verified against 0.15.0
• Status unchanged (kit change, not a new pattern)

Rollback

Revert this PR (pin returns to 0.13.0). On a sandbox that already ran 0.15.0, restore or remove ~/.paseo/config.json first, since upstream says newer config keys are not read by older versions.

Security Impact

None to authentication, authorization or data handling in the kit. The install still runs with --ignore-scripts from the npm registry, with a pinned exact version; there are no new dependencies of our own. The 0.15.0 package adds no new direct dependencies compared with 0.14.0.

Approval

• Ready for community review (First Mate decides ready/draft)

Co-authored-by: OpenCode Agent [email protected]