`lembas login --token-stdin --server <url> [--ca file] [--json]` reads one lmb_ token from
stdin (never an argument or the environment), checks discovery's protocol and then
GET /api/v1/instance with the token, whose `scope` must include `link` (a 404 or no `scope`
is an older server), and stores the login through the same path as the device code:
the key file, the webui entry, lembas.json, an earlier login replaced with its token signed
out naming the new one. --json prints the device login's `done` / `error` line. For LLeMbas
Desktop, which gets the agent's token from the one approval.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The login asks the server for the memory scope in place of library (the
server accepts both; library is no longer offered for new tokens).
/v1/usage is read in the server's 2.0 shape: no plan, balance, credit
costs or windows. The status bar shows what the month has cost so far and
/usage the month's tokens and cost and this device's tokens, each
currency's amount on its own (month.cost_by_currency, else cost_money in
currency). The credit wording is gone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- LEMBAS_PROTOCOL, the device protocol and the protocols the CLI logs in to
and links with are 3 alone (harness/acp.md *Versions*). A server listing
only 1 and 2 is refused at login and at every dial — before anything is
dialled — with its version and protocols and "update the server, or use
LLeMbas CLI 1.x with it"; a newer one is told to update the CLI
(ProtocolError). A 4400 stops the link with the same advice. The old
downgrade to protocol 1 is gone.
- session/new's result says `instance`: whether the session's model is the
link's instance's.
- `lembas_model` is the model, full stop: a device not logged in to the link's
instance, a link with no instance (serve --stdio), or a model the instance
does not serve to this device is -32602 with the reason, never a session on
the device's own model. `_lembas/configure` naming such a model is refused
likewise and the session keeps its model.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
LLeMbas CLI 2.0 is LLeMbas-server-specific (CLI rule 2). Removed: the
anthropic, gemini, ollama and responses clients, context discovery and
llama-swap unloading (discover.ts), the Connection schema with its dialect,
auth, key_cmd, discover, unload_url and one_model_at_a_time, the model
`fallback` (it only ever moved to another server), effort_map and cache, and
the multi-connection refs. Kept: openai-chat, http, sse, think, effort,
tokens and all of src/lembas.
- connections.yaml holds the login (`type: webui`, as lembas login writes
it). A custom entry from 1.x is read past with a warning that says how to
log in, so an old file still starts; with several logins left, the latest
is used and the others named.
- A model's ref is the id the server serves it under; the older forms
(`<login>/<id>`, `<login>/<model>`) still resolve and config.yaml is
rewritten once. Without a login there is no model, and the error (and the
first-run screen, now the sign-in alone) says `lembas login <address>`.
- A login to another server signs this machine out of the previous one.
- The window is the server's word (no discovery); a capacity group comes
from the server's `capacity.group` alone; embeddings use the server's
/v1/embeddings.
- `lembas models` lists the server's models; install.sh's starter files, the
README and the JSON schemas say the same.
Tests: every fixture is a login now (the fake server lists models, answers
other GETs with 404, and can hand one model to another script, as a server
with several backends); the dialect suites and the cross-connection tests are
gone with their code.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A second `lembas login` to the same instance overwrote the old token without
signing it out, leaving an offline twin of the device holding its agent chats.
The old token is now signed out over the TLS that just worked, naming the new
one, so an instance that knows `replaced_by` moves the chats; a failed sign-out
is said.
`login --ca` kept the path as typed, so a service started in another directory
dialled with no CA. It is kept in full now, the link trusts what discovery got
through with (the system's bundle included), and "could not reach the instance"
says why: a CA file that is gone, or what discovery met.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The first public release of LLeMbas CLI: a terminal coding agent and project manager for any LLM
API, with permission modes, git snapshots, memory and skills, knowledge bases, MCP, voice, and a
link to a LLeMbas instance whose web UI can work its sessions too. Signed Linux binaries for x64
and arm64.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
HomerandClaude Opus 5.5