The server kept voice and images on /v1 (models scope, which the app's token
already asks for); /me's services and scopes decide what is offered. Rust
sends the recording to /v1/audio/transcriptions, reads /v1/audio/speech back
as a data: URL (CSP media-src data:), and for /v1/images/generations takes
only the id of each of the person's own files from the answer and fetches
/v1/files/<id>/content from the app's own server. The microphone is allowed
only within seconds of the page's own Dictate (voice_arm); WebKitGTK's
media stream is switched on through its settings getter.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Terminal panel opens a shell on the device an agent chat works on, in its
folder: for a new agent chat as soon as the device and folder are chosen (the
server's /api/v2/devices/{device}/terminal/ws?directory=, which the chat's first
message takes over -- the same socket carries on), and for an open agent chat
from the header (/api/v2/chats/{chat}/terminal/ws, the web page's shell).
Offered where GET /devices says the device opens a terminal.
The socket is Rust's (src-tauri/src/terminal.rs, tungstenite on the rustls
ureq already brings): the bearer token goes in the handshake and never reaches
the page, which gets the frames as `terminal` events and sends keys, sizes and
close through commands. 4401 signs the app out as a 401 does.
xterm and its fit addon are the server's vendored build, pinned through
fetch-vendor.sh like CodeMirror and loaded on the first open. Send to chat puts
the selection, the last marked command and its output, or the screen into the
composer, never sent. The terminal and the activity panel take turns in the
panel column. Continue in a terminal stays in the chat's menu.
tests/ui: seven B3 cases with a mocked socket, at 1280 and 390 px.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The editor's vendored modules come from server v2.0.0-beta.4 with the
process stub @lezer/lr needs, so languages load and code is highlighted
again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The two webviews (local title bar, remote web UI) become one WebviewWindow on
ui/index.html. The window refuses every navigation but the app's page and its
sealed frames; the capability still names only main and no remote URL.
- server.rs: discovery refuses a server older than 2.0 (protocol 3 and major
version 2) and an app API newer than this app knows; the app's own device
login for the app scope, the token kept in account.json (0600) and never
given to the page; a proxy limited to /api/v2 paths; the SSE stream.
- files.rs: list and read the agent's working directory, resolved (links and
.. included) and refused outside the agent's folders.
- sealed.rs: HTML for the viewer on its own scheme under the server's sealed
policy: no bridge, no network, no navigation.
- watch.rs + tauri-plugin-notification: a notification when a reply or an
agent chat finishes out of sight.
- A failed start and panics go to desktop.log; a missing tray no longer stops
the app; the DMA-BUF renderer is off under NVIDIA's driver.
- The unstable multiwebview feature, the gtk dependency and the theme report
are gone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Linking this computer again leaves one device, and the agent's status says why
it cannot connect.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The first 0.7.1 aborted on Linux before its window appeared (it read
WebKitWebView's write-only 'settings' property). The owner asked for the
patch to be released again rather than followed by a 0.7.2: this commit is
0.7.1 as it should have been, and tag v0.7.1 moves here. The release
workflow now replaces the release of a tag that is pushed again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
0.7.1 read WebKitWebView's 'settings' property through GLib; it is write-only,
GLib panicked, and the app aborted before its window appeared. The read is
gone; the microphone permission handler stays.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The microphone: WebKitGTK refuses a permission request its app does not
answer, and has no prompt of its own, so dictation on the server's page was
always blocked. The content view now allows the microphone -- only that, and
only there -- and media capture is switched on explicitly for the older
WebKitGTK the AppImage carries.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Settings… lists the folders the agent may work in, with the system's
folder dialog, remove, max mode and terminal, all through
'lembas remote … --json' (CLI 1.2.0). Turning the agent on with no
folder opens it; the title bar says 'agent: no folders' instead of green.
- The content webview's User-Agent carries LLeMbasDesktop/<v> (host=…),
so the server can show this computer's device as Local.
- The title bar menu pops up at the button (popup_menu_at): Wayland gave
the pointer-less popup the middle of the window.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Linux: Tauri packs a window's webviews into one GTK box with equal
shares and ignores their bounds, so the title bar took half the window.
The title bar webview now has a fixed height and no share; the box's
border is the resize frame (none when maximized).
- tauri-plugin-updater: checks llembas.eu/desktop/latest.json at start
and every 6 h, an update button in the title bar and menu entries,
.deb via pkexec, AppImage in place, then restart. Packages signed with
the updater's minisign key; requireSignedVersion on.
scripts/publish-update.sh signs a GitHub release and writes the manifest.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- The window has no system decoration: a local title bar webview (agent
state, a native menu with the tray's items, window buttons) above the
content webview, which stays remote with no IPC. Laid out on resize,
with a frame to resize by unless maximized.
- Icons from the transparent pixel leaf, not the server's tiled icon.
- productName llembas-desktop: package, .desktop file and the window's
app id now match (KWin showed a generic icon); the visible name stays
LLeMbas through a desktop template. Replaces the 0.1.0 package l-le-mbas.
- The bundled CLI is a resource in the app's own directory, not
/usr/bin/lembas.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Tauri 2, no Node. A first-run page chooses the server; then the window is
the server's web UI, whose pages get no IPC. The bundled LLeMbas CLI
(fetched and signature-checked by scripts/fetch-cli.sh) links the computer
with 'lembas login --json' and runs as 'lembas service' while the app runs.
A tray menu starts and stops it. Linux packages from GitHub Actions on a tag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
HomerandClaude Opus 5.5