From 914474953f9bd235e4719618bd676d57fb4b3882 Mon Sep 17 00:00:00 2001
From: tiennm99 <tiennm99@outlook.com>
Date: Wed, 16 Sep 2026 16:35:49 +0700
Subject: [PATCH] feat(paseo): select the terminal shell through SHELL

Paseo spawns terminals with process.env.SHELL and falls back to /bin/sh,
which is dash. It never consults the login shell, so chsh has no effect --
and would be reverted by the next rebuild regardless.
---
 paseo/.env.example | 5 +++++
 paseo/README.md    | 4 +++-
 paseo/compose.yml  | 1 +
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/paseo/.env.example b/paseo/.env.example
index e771961..2f3591c 100644
--- a/paseo/.env.example
+++ b/paseo/.env.example
@@ -23,3 +23,8 @@ PASEO_LABEL=paseo
 
 # Timezone for logs and agent shells.
 TZ=Asia/Ho_Chi_Minh
+
+# Shell for Paseo's terminals. Paseo reads $SHELL and falls back to /bin/sh
+# (dash), ignoring the user's login shell, so set it here rather than running
+# chsh -- which would be reverted by the next rebuild anyway.
+SHELL=/bin/zsh
diff --git a/paseo/README.md b/paseo/README.md
index 49d3a2c..50e58b9 100644
--- a/paseo/README.md
+++ b/paseo/README.md
@@ -36,6 +36,7 @@ the old entry is cached in `localStorage`.
 | `PASEO_TRUSTED_PROXIES` | Set to `uniquelocal`, or the UI loads but never connects. |
 | `PASEO_LABEL` | Container hostname. Paseo shows it as the host label in the UI; without it you get a random container ID. |
 | `TZ` | Timezone for logs and agent shells. |
+| `SHELL` | Shell for Paseo's terminals. Paseo reads `$SHELL` and falls back to `/bin/sh`, ignoring the login shell, so `chsh` has no effect. |
 
 `PASEO_TRUSTED_PROXIES` matches the *source IP* of the proxy, so hostnames are
 rejected. By default the daemon believes `X-Forwarded-Proto` only from
@@ -59,7 +60,8 @@ Listens on `6767`, published nowhere — the platform maps the domain to it, so
 | `paseo-workspace` | `/workspace` | Code the agents work on |
 
 Claude Code and `gh` keep their config in `/home/paseo`, so both logins survive
-a redeploy.
+a redeploy. Dotfiles live there too — a `.zshrc` or oh-my-zsh install persists,
+but anything written outside `$HOME` (`chsh`, `apt install`) is lost on rebuild.
 
 ## Image
 
diff --git a/paseo/compose.yml b/paseo/compose.yml
index e577a4f..a4f0d13 100644
--- a/paseo/compose.yml
+++ b/paseo/compose.yml
@@ -4,6 +4,7 @@ services:
     hostname: ${PASEO_LABEL}
     environment:
       - TZ=${TZ}
+      - SHELL=${SHELL}
       - PASEO_PASSWORD=${PASEO_PASSWORD}
       - PASEO_HOSTNAMES=${PASEO_HOSTNAMES}
       - PASEO_TRUSTED_PROXIES=${PASEO_TRUSTED_PROXIES}