What causes "LastPass CLI is not installed" in basecamp/kamal?

Install the official LastPass CLI: `brew install lastpass-cli` (macOS) or `apt install lastpass-cli` (Debian/Ubuntu), then confirm `lpass --version`.

basecamp/kamal · error · RuntimeError

LastPass CLI is not installed

Error message

LastPass CLI is not installed

What it means

Raised by check_dependencies! in Kamal::Secrets::Adapters::LastPass when `lpass --version 2> /dev/null` exits non-zero. Base#fetch invokes this probe before login, so on machines without the LastPass CLI any `kamal secrets pull` using this adapter fails here first. stderr is suppressed, so both 'binary missing' and 'binary broken' render identically.

Source

Thrown at lib/kamal/secrets/adapters/last_pass.rb:33

      secrets = prefixed_secrets(secrets, from: from)
      items = `lpass show #{secrets.map(&:shellescape).join(" ")} --json`
      raise RuntimeError, "Could not read #{secrets} from LastPass" unless $?.success?

      items = JSON.parse(items)

      {}.tap do |results|
        items.each do |item|
          results[item["fullname"]] = item["password"]
        end

        if (missing_items = secrets - results.keys).any?
          raise RuntimeError, "Could not find #{missing_items.join(", ")} in LastPass"
        end
      end
    end

    def check_dependencies!
      raise RuntimeError, "LastPass CLI is not installed" unless cli_installed?
    end

    def cli_installed?
      `lpass --version 2> /dev/null`
      $?.success?
    end
end

View on GitHub (pinned to eee0083b38)

Solutions

Install the official LastPass CLI: `brew install lastpass-cli` (macOS) or `apt install lastpass-cli` (Debian/Ubuntu), then confirm `lpass --version`.
If installed but not found, fix PATH in the environment running kamal (Dockerfile ENV, CI step).
Add the install to your CI/provisioning pipeline before any `kamal secrets pull`.

Defensive patterns

Strategy: validation

Validate before calling

require "open3"

def lpass_installed?
  Open3.capture3("lpass", "--version")[2].success?
end

abort "Install lastpass-cli (brew install lastpass-cli / apt install lastpass-cli)" unless lpass_installed?

Prevention

Install lastpass-cli in CI/containers; the browser extension does not provide lpass.
Assert `which lpass` in deploy preflight for environments with restricted PATH.
Keep the CLI version current — old builds fail auth against LastPass servers.

When it happens

Trigger: adapter.fetch(...) on a host where `lpass` is not on PATH: lpass never installed (it is a separate package from the browser extension/app), installed via a package manager path not in the kamal process's PATH, or an incompatible/incomplete build.

Common situations: Assuming the LastPass browser plugin or desktop app provides lpass (it does not); CI images without the lpass package; installing lpass from source into /usr/local/bin that is later dropped from PATH in minimal container shells.

Related errors

AI-assisted analysis of basecamp/kamal@eee0083b38 (2026-08-21). Data as JSON: /api/errors/8a321c077a4efedf. Report an issue: GitHub.