README and CHANGELOG for Desktop 1.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,62 @@ All notable changes to LLeMbas Desktop. The format follows
 
 ## [Unreleased]
 
+LLeMbas Desktop 1.0 becomes an app of its own: the agent on this computer by default, your
+server's chats, two explorers and a viewer -- no longer a window onto the web interface. It needs a
+LLeMbas 2.0 server.
+
+### Changed
+
+- **The app's own interface replaces the server's web pages.** The window shows the app's page
+  (`ui/`, plain HTML, CSS and JavaScript modules, no build step): the chats, the transcript with
+  its steps and tool calls, the reply as it is written, the questions and approvals that wait for
+  an answer, and a composer. It talks to the server's `/api/v2`.
+- **Agent chats first.** The sidebar opens on agent chats, those on this computer above those on
+  your other devices; a new agent chat is started on this computer, in one of the agent's
+  folders, with its mode and model. Chats on the server are the second tab.
+- **The app signs in on its own**, with the server's device login for one permission: to read and
+  write your chats, as the web interface does. The approval opens in your browser. Linking this
+  computer for the agent stays a separate step, and its approval opens in the browser too.
+- The look is still the server's: its design tokens, now copied from the 2.0 server, and its
+  CodeMirror build for code (`scripts/fetch-vendor.sh`, pinned in `vendor.lock.json`). The
+  window takes the account's theme.
+- One window with one page: the second webview, and the Linux workaround it needed, are gone. The
+  window still has the app's own title bar, and its edges resize it.
+- The page's words, old and new, are in all nine of the server's languages.
+
+### Added
+
+- **Two explorers, kept apart**: this computer's -- the open agent chat's folder, or one of the
+  agent's folders -- read only inside the agent's folders, and the server's files.
+- **A viewer** beside the chat: Markdown drawn, code highlighted (read-only CodeMirror), text,
+  and HTML in a sealed frame on its own address, with no access to the app, no network and no way
+  to navigate. A file the agent shows (`show`) opens in it.
+- **Native notifications** when a reply or an agent chat finishes while you are elsewhere (on by
+  default; Settings, Notifications).
+- **A server older than LLeMbas 2.0 is refused** with a message saying which side to update, and so
+  is a server whose app interface is newer than this app knows.
+- **Settings in the app**: the server and the sign-in, the agent and its folders, notifications
+  and updates. There are no admin pages.
+- When the app cannot start, it says why in `desktop.log` in its log directory, not only on a
+  terminal nobody sees. A missing tray no longer stops it from starting.
+- With NVIDIA's own driver, WebKitGTK's DMA-BUF renderer is turned off before the window opens
+  (unless you have set `WEBKIT_DISABLE_DMABUF_RENDERER`): that renderer leaves the window blank or
+  ends the app there, on Wayland most of all.
+
+### Removed
+
+- The server's web interface in the window, the microphone permission it needed, and the theme
+  report the window read from it. The web interface stays in the browser, and as an installable
+  web app.
+
+### Fixed
+
+- A release can no longer be quietly replaced under the same version: installing the same version
+  again does nothing, so people with the broken copy never got the fix. The release workflow now
+  refuses a tag that has a release already, unless it is run by hand to replace it.
+- A beta's `.deb` sorts below the release that follows it (`1.0.0~beta.1` before `1.0.0`), so apt
+  does not keep a beta over its release.
+
 ## [0.7.2] — 2026-10-25
 
 Linking this computer again leaves one device, and LLeMbas CLI 1.5.2 inside.

README.md

@@ -1,17 +1,24 @@
 # LLeMbas Desktop
 
-Your [LLeMbas](https://llembas.eu) server in a window of its own, with the agent on this computer.
+The [LLeMbas](https://llembas.eu) agent on this computer, and the chats on your LLeMbas server, in
+an app of its own.
 
-- **The whole web UI**: chats, agent chats, the library, reports, settings. Same account, models,
-  permissions and credits as in the browser; the app is a front end to the server you already run.
-- **The agent, built in.** LLeMbas Desktop carries the [LLeMbas CLI](https://github.com/LLeMbas/LLeMbas-CLI)
-  and runs it in the background as this computer's device, so agent chats started on the server
-  can work in your projects here, without a terminal.
-- **Its own window**: a LLeMbas title bar with the agent's state and a menu (start and stop the
-  agent, link the computer, reload, change server, quit). Close the window and the agent keeps
-  running in the tray, which has the same menu.
+- **The agent, built in, by default.** LLeMbas Desktop carries the
+  [LLeMbas CLI](https://github.com/LLeMbas/LLeMbas-CLI) and runs it in the background as this
+  computer's device. Agent chats work in your project folders here, without a terminal -- start
+  them, follow them and answer them in the app.
+- **Your server's chats** beside them: the same account, models and permissions as in the browser.
+- **Two explorers, kept apart**: the agent's working directory on this computer, and your files
+  on the server.
+- **A viewer** for what you open and for what the agent shows you: Markdown drawn, code
+  highlighted, text, and HTML in a sealed frame that can reach neither the app nor the network.
+- **Notifications** when a reply or an agent's work finishes while you are elsewhere.
+- **Its own window and tray**: close the window and the agent keeps running in the tray.
 
-> **Alpha.** Linux first (`.deb` and AppImage, x86-64). Windows and macOS later.
+There are no admin pages: an administrator uses the server's web interface for that.
+
+> **Beta (1.0).** Needs a **LLeMbas 2.0 server** or later; an older one is refused with a message
+> saying so. Linux first (`.deb` and AppImage, x86-64). Windows and macOS later.
 
 ## Install
 
@@ -20,10 +27,14 @@ Download the `.deb` or the AppImage from the
 `SHA256SUMS` in the same release.
 
 ```sh
-sudo apt install ./llembas-desktop_*_amd64.deb      # Debian, Ubuntu (replaces 0.1.0's l-le-mbas)
+sudo apt install ./llembas-desktop_*_amd64.deb      # Debian, Ubuntu
 chmod +x llembas-desktop_*.AppImage && ./llembas-desktop_*.AppImage
 ```
 
+Installing a `.deb` of the version you already have changes nothing (apt calls it "already the
+newest version"); `sudo apt reinstall ./llembas-desktop_*_amd64.deb` installs it again. If the app
+does not start, the reason is in `~/.local/share/eu.llembas.desktop/logs/desktop.log`.
+
 On GNOME the tray needs the *AppIndicator* extension; without it, the title bar's menu has
 everything, and starting the app again brings a hidden window back.
 
@@ -33,20 +44,36 @@ LLeMbas Desktop looks for a new release when it starts and every six hours. When
 **update** button appears in the title bar (and *Install LLeMbas x.y.z…* in its menu; *Check for
 updates…* otherwise). Installing asks for your password to update the `.deb` (an AppImage updates
 itself), then the app starts again. Every package is checked against the release signing key
-built into the app before anything is installed.
+built into the app before anything is installed. Betas are not offered as updates.
 
 ## Use
 
-1. Start LLeMbas and enter your server's address. Sign in there as you would in a browser.
-2. From the tray, **Link this computer**. The approval page opens in the window; approve it.
-3. The agent starts. Choose the folders it may work in (Settings…, *Add folder…*); a new
-   computer allows none until you do.
-4. In the server's Agents tab, start an agent chat on **Local** and pick one of those folders.
+1. Start LLeMbas and enter your server's address. **Sign in**: the approval page opens in your
+   browser, where you are signed in already; approve the code shown in the app. This sign-in lets
+   the app read and write your chats, as the web interface does.
+2. Under **Settings**, **Link this computer**: a second approval, which makes this computer a
+   device the agent runs on. The agent starts.
+3. Choose the folders the agent may work in (Settings, *Add folder…*); a new computer allows none
+   until you do.
+4. **New agent chat**: pick one of those folders, a mode and a model, and write.
 
 The agent is the LLeMbas CLI's `lembas service`, using the CLI's own configuration
 (`~/.config/lembas`). The app's copy of the CLI lives in its own directory
-(`/usr/lib/llembas-desktop/`), not on your `PATH`. If you also installed the CLI and run `lembas service` yourself, the app sees
-it and does not start a second one: they are the same device.
+(`/usr/lib/llembas-desktop/`), not on your `PATH`. If you also installed the CLI and run
+`lembas service` yourself, the app sees it and does not start a second one: they are the same
+device.
+
+### What can reach what
+
+- The app's page is its own (`ui/`), and it is the only content with access to the app. No page
+  of the server is ever loaded into the window, and the window goes nowhere else.
+- The app's sign-in token stays in the app's Rust half (`account.json` in the app's config
+  directory, readable by you only); the page asks for the server's `/api/v2` through it and never
+  holds the token.
+- The explorer reads only inside the agent's folders.
+- HTML is shown in a sealed frame on an address of its own: scripts in it run, but it has no
+  access to the app, no network and no way to navigate anywhere.
+- Links in a reply open in your browser, and only web and mail links.
 
 ## Build
 
@@ -56,21 +83,31 @@ Needs Rust (stable) and, on Linux, WebKitGTK 4.1 and an AppIndicator library:
 sudo apt install libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev libxdo-dev
 scripts/fetch-cli.sh                 # the bundled CLI, checked against its release signature
 scripts/fetch-tokens.sh              # verifies ui/tokens.css against tokens.lock.json
+scripts/fetch-vendor.sh              # verifies ui/vendor/ against vendor.lock.json
 cargo install tauri-cli --version "^2" --locked
 cargo tauri dev                      # or: cargo tauri build
 ```
 
-There is no Node and no bundler: the app's one local page is plain HTML, CSS and JavaScript in
-`ui/`. Everything else on screen is the server's own web UI. The version of the CLI it carries is
-in `lembas-cli.version`.
+There is no Node and no bundler: the app's page is plain HTML, CSS and JavaScript modules in
+`ui/`. The version of the CLI it carries is in `lembas-cli.version`.
 
-Two files in `ui/` are generated and committed. `ui/tokens.css` is the server's design tokens,
-copied by `scripts/fetch-tokens.sh <server tag>` from a checkout of the server beside this
-repository (`../LLeMbas`, or `LEMBAS_SERVER`) and pinned in `tokens.lock.json`; run it with a
-new tag when the server's look changes. `ui/i18n.js` is the pages' words in the server's
-languages, written by `scripts/gen-i18n.py` from the server's catalogues and the script's own
-table; run it when a string on the page changes.
+Three things in `ui/` are copied from the LLeMbas server and committed, each pinned:
+
+- `ui/tokens.css`, the server's design tokens: `scripts/fetch-tokens.sh <server ref>` from a
+  checkout of the server beside this repository (`../LLeMbas`, or `LEMBAS_SERVER`), pinned in
+  `tokens.lock.json`.
+- `ui/vendor/`, the server's vendored CodeMirror build: `scripts/fetch-vendor.sh <server ref>`
+  checks every module against the server's own pin before copying it, and records both hashes in
+  `vendor.lock.json`. The one change: the modules import each other by file name, since the page
+  has no import map.
+- `ui/i18n.js`, the page's words in the server's languages: `scripts/gen-i18n.py`, from the
+  server's catalogues and the script's own table. Run it when a sentence on the page changes.
+
+`scripts/check-ui.sh` parses the page's scripts and refuses any that sets HTML from a string;
+`scripts/hygiene.sh` keeps private names out of this public repository. CI runs both, and starts
+the built app under X11 and under Wayland (`scripts/ci-start.sh`).
 
 ## Licence
 
 MIT; see [LICENSE](LICENSE). The bundled LLeMbas CLI is MIT too, with its own third-party notices.
+CodeMirror and Lezer (in `ui/vendor/`) are MIT.