Proton Lumo AI backend with U2L (User-to-LLM) encryption.
Implements the full Proton Lumo wire protocol: per-request AES-256-GCM encryption of message turns, PGP-encrypted session key delivery, and SSE streaming with per-chunk decryption.
Authentication
Requires a Proton session. Set these environment variables:
PROTON_UID=... # Session UID (from browser or lumo-tamer)
PROTON_ACCESS_TOKEN=... # Bearer tokenOptional:
PROTON_REFRESH_TOKEN=... # For automatic token refresh
LUMO_NO_ENCRYPT=true # Skip U2L encryption (for testing)Fallback
If LUMO_TAMER_URL is set (e.g. http://localhost:3000), routes through
lumo-tamer's OpenAI-compatible proxy instead of the direct Lumo API.
This avoids the need for gpg and Proton session tokens.
Requirements
Direct mode requires gpg (GnuPG) for PGP encryption of the request key.