Plan → share → build

Copy page

Plan Desk collaboration keeps authoring local while the hosted portal exposes a read-only, allow-listed view. Organizations, members, roles, and cross-organization isolation are enforced by the hosted server.

The collaboration loop

Promote the local project to its hosted organization:
Terminal window
```
plandesk push --to <org-id>
```

Create a share link:

plandesk share create --audience "Acme" --public --allow-submit

Participants open the link. The portal computes the read-only view live from the hosted project and polls for updates. Internal data and edit access are not exposed.
Participants file feedback into the moderated submission inbox. Submissions do not change the source plan.
Pull submissions into the local triage inbox:
Terminal window
```
plandesk pull
```
Review and run triage_submission to accept, reject, or connect a submission to a task. Accepted feedback enters the normal task workflow, where the agent can build it.

What participants can see

The shared projection is an explicit allow-list of the hosted project’s shared graph, board, and documents. It is read-only. A public or invite-scoped link can permit named participants to submit issues, but submission is always moderated before it becomes a task.

Authentication and tenancy

Hosted auth is better-auth, two-actor for the CLI:

Human signs into the dashboard (GitHub social when configured) and Generate CLI token (org-wide owner API key).
Human runs plandesk login (or plandesk login --server <url>) and pastes that key into ~/.plandesk/config.json.
Agent (or human) runs plandesk connect --to <org> to mint a project-scoped agent key into .plandesk/token.

Agents never log in. Each hosted organization is isolated (organization / member in better-auth); an object belonging to another organization returns 404.