How can I disconnect connected clients in the gateway?

[CharlieDigital]

Use Case

I'd like to share my host workspaces with a peer so they can see and collaborate on the session. However, I also want to be able to:

1. Restrict them to specific workspaces

2. Be able to disconnect their paired device when done

Is this currently already possible (does not appear to be so)?

[XNinety9]

Not today, for either part.

Restricting to specific workspaces: daemon permissions are daemon-wide for now. docs/permissions.md lists workspace-scoped grants as future work. The blocker it gives is that file preview can still read any file the daemon can, so that has to be locked down first. Anyone paired with your daemon sees all its workspaces.

Disconnecting a paired device: relay pairing doesn't keep a per-device list you can revoke. The QR code/link carries the daemon's public key, and any device holding it can complete the handshake (security docs: "anyone with the pairing offer can connect to your daemon"). The only way to cut someone off is to rotate that key: stop the daemon, delete $PASEO_HOME/daemon-keypair.json, start it again (a new keypair is generated on startup), then re-pair your own devices with the new QR code. Old pairings stop working, including the peer's.

For sharing with a peer today, the safer setup is a separate daemon (its own PASEO_HOME, e.g. in the Docker image) containing only the projects you want to share. Pair them with that one and rotate its key, or just stop it, when you're done.

[CharlieDigital]

For sharing with a peer today, the safer setup is a separate daemon (its own PASEO_HOME, e.g. in the Docker image) containing only the projects you want to share. Pair them with that one and rotate its key, or just stop it, when you're done.

Interesting; appreciate the tip on this workaround.

But because this would be a separate daemon; it would not be able to "collaborate" on the same workspace sessions, right?

[CharlieDigital]

The addendum to this and feature-set:

• Per-connection/device issued key (one time consume)
• Ability to share specific project (per-project public key? or RBAC linked to the key?)
• Ability for an owner to see the active keys, devices, and connected state
• Ability for an owner to pause a connection or device (does not remove the key)
• Ability for an owner to remove a connection or device (also removing the key)

Use case is collaboration focused; two or more people prompting and monitoring the same agents across machines where I'm working on something locally, but I want to temporarily allow a collaborator to also see the status and interact with agents for a specific workspace.

[XNinety9]

Right, a second daemon has its own sessions, so you wouldn't be in the same agent sessions. You'd share the code (and git history) but not the live sessions. For real collaboration on your sessions, today it's all or nothing: pair them with your main daemon, knowing they get access to all its workspaces, and rotate the key afterwards.