- The app's device login asks for `app models` and, where discovery says
login.device.agent_scope, `agent_scope=models memory link` in the same
approval. The agent's token goes to the bundled CLI on stdin
(`lembas login --token-stdin --server <url> --json`) and is never kept
here; if the CLI does not take it, it is given up on the server. A
computer linked already keeps its link; a server without agent_scope
gets the old two steps.
- The server pane reads GET /api/v2/files and /files/content (mounts open
like folders; `withheld` shown in the server's words). The "not offered
yet" state is gone.
- A show card's file comes from GET /api/v2/chats/{chat}/show?node=&version=
or ?shown= as plain text (new `api_text` command, 1 MB cap); args.path is
read only for agent chats on this computer, locally.
- The gate is link protocol 3 plus app_api 2 (APP_API = 2), not the
server's version number, which says 1.7.2 on dev until its first beta.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ci.yml runs on dev too, adds the hygiene check, check-ui.sh (the modules parsed
as modules; nothing sets HTML) and the vendor pin, and a start job: a debug
build with the bundled page, started under Xvfb and under a headless Weston with
GTK's Wayland backend, which must still be running after 25 seconds.
release.yml refuses a tag that already has a release unless run by hand with
replace, marks betas as pre-releases, and gives a beta's .deb a ~beta version
so it sorts below its release.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Plain HTML, CSS and ES modules in ui/, no build step. The sidebar opens on agent
chats (this computer first), with chats on the server as the second tab; the
transcript draws the /api/v2 steps, follows a reply as it is written, answers
cards, and starts agent chats in one of the agent's folders. Two explorers kept
apart (this computer's, the server's) and a viewer: Markdown drawn by a safe
renderer that never parses HTML, code in read-only CodeMirror with the server's
token colours, HTML in the sealed frame, show calls opened in it. Settings for
the sign-in, the agent and its folders, notifications and updates; no admin
pages. Layout on fixed and shared tracks; the sidebar is a drawer below 48rem,
the viewer goes over the chat below 64rem. All 124 sentences in the server's
nine languages.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The two webviews (local title bar, remote web UI) become one WebviewWindow on
ui/index.html. The window refuses every navigation but the app's page and its
sealed frames; the capability still names only main and no remote URL.
- server.rs: discovery refuses a server older than 2.0 (protocol 3 and major
version 2) and an app API newer than this app knows; the app's own device
login for the app scope, the token kept in account.json (0600) and never
given to the page; a proxy limited to /api/v2 paths; the SSE stream.
- files.rs: list and read the agent's working directory, resolved (links and
.. included) and refused outside the agent's folders.
- sealed.rs: HTML for the viewer on its own scheme under the server's sealed
policy: no bridge, no network, no navigation.
- watch.rs + tauri-plugin-notification: a notification when a reply or an
agent chat finishes out of sight.
- A failed start and panics go to desktop.log; a missing tray no longer stops
the app; the DMA-BUF renderer is off under NVIDIA's driver.
- The unstable multiwebview feature, the gtk dependency and the theme report
are gone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ui/tokens.css from the server's dev (tokens.lock.json; repin to the beta tag
at release). scripts/fetch-vendor.sh copies the server's vendored CodeMirror and
Lezer modules into ui/vendor/, each checked against the server's own pin first,
with the bare module names rewritten to sibling files (the page has no import
map); vendor.lock.json records both hashes, and the script with no argument
verifies the copy.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Linking this computer again leaves one device, and the agent's status says why
it cannot connect.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The first 0.7.1 aborted on Linux before its window appeared (it read
WebKitWebView's write-only 'settings' property). The owner asked for the
patch to be released again rather than followed by a 0.7.2: this commit is
0.7.1 as it should have been, and tag v0.7.1 moves here. The release
workflow now replaces the release of a tag that is pushed again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
0.7.1 read WebKitWebView's 'settings' property through GLib; it is write-only,
GLib panicked, and the app aborted before its window appeared. The read is
gone; the microphone permission handler stays.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The microphone: WebKitGTK refuses a permission request its app does not
answer, and has no prompt of its own, so dictation on the server's page was
always blocked. The content view now allows the microphone -- only that, and
only there -- and media capture is switched on explicitly for the older
WebKitGTK the AppImage carries.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
scripts/gen-i18n.py writes ui/i18n.js from the server's catalogues where the
same sentence exists and from its own table otherwise; the pages pick the
language from the browser and fall back to English.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
ui/tokens.css is no longer a hand copy that drifts: scripts/fetch-tokens.sh
takes the server's tokens.css at a git ref and tokens.lock.json pins it, as
fetch-cli.sh does for the CLI. build.rs reads the two themes' --bg and --border
out of it, so no colour is written in Rust. The content view reports the page's
theme by a navigation the app refuses (llembas-theme:<name>), and the window,
the title bar and the first-run page are painted in it and remember it.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
- Settings… lists the folders the agent may work in, with the system's
folder dialog, remove, max mode and terminal, all through
'lembas remote … --json' (CLI 1.2.0). Turning the agent on with no
folder opens it; the title bar says 'agent: no folders' instead of green.
- The content webview's User-Agent carries LLeMbasDesktop/<v> (host=…),
so the server can show this computer's device as Local.
- The title bar menu pops up at the button (popup_menu_at): Wayland gave
the pointer-less popup the middle of the window.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Linux: Tauri packs a window's webviews into one GTK box with equal
shares and ignores their bounds, so the title bar took half the window.
The title bar webview now has a fixed height and no share; the box's
border is the resize frame (none when maximized).
- tauri-plugin-updater: checks llembas.eu/desktop/latest.json at start
and every 6 h, an update button in the title bar and menu entries,
.deb via pkexec, AppImage in place, then restart. Packages signed with
the updater's minisign key; requireSignedVersion on.
scripts/publish-update.sh signs a GitHub release and writes the manifest.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- The window has no system decoration: a local title bar webview (agent
state, a native menu with the tray's items, window buttons) above the
content webview, which stays remote with no IPC. Laid out on resize,
with a frame to resize by unless maximized.
- Icons from the transparent pixel leaf, not the server's tiled icon.
- productName llembas-desktop: package, .desktop file and the window's
app id now match (KWin showed a generic icon); the visible name stays
LLeMbas through a desktop template. Replaces the 0.1.0 package l-le-mbas.
- The bundled CLI is a resource in the app's own directory, not
/usr/bin/lembas.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Tauri 2, no Node. A first-run page chooses the server; then the window is
the server's web UI, whose pages get no IPC. The bundled LLeMbas CLI
(fetched and signature-checked by scripts/fetch-cli.sh) links the computer
with 'lembas login --json' and runs as 'lembas service' while the app runs.
A tray menu starts and stops it. Linux packages from GitHub Actions on a tag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
HomerandClaude Opus 5.5