Add llama.cpp backend, model gateway, URL relay and browser view
Four features, plus a latent bug fix.
llama.cpp backend. Claude Code only ever speaks the Anthropic Messages
API — confirmed empirically by pointing it at a logging server, which
received POST /v1/messages?beta=true. llama-server implements that
natively (verified in its README, alongside --port default 8080), so
this is a plain base-URL backend with no translation shim, the same
shape as Ollama. Its --api-key defaults to none, so the auth token is a
placeholder Claude Code requires and llama-server ignores.
Model alias fix. ANTHROPIC_DEFAULT_HAIKU_MODEL is documented as "also
used for background functionality", and Triple-C set none of the alias
vars. So on every custom-endpoint backend, Claude Code resolved `haiku`
to an Anthropic model id and sent it to a local server that does not
have it — background features failed silently. All four
ANTHROPIC_DEFAULT_{OPUS,SONNET,HAIKU,FABLE}_MODEL vars are now pinned to
the backend's configured model, with an optional Haiku override, and
blanked for Anthropic and Bedrock so those keep Claude Code's defaults.
The deprecated ANTHROPIC_SMALL_FAST_MODEL is never emitted. Existing
Ollama and OpenAI-Compatible containers are recreated once so the new
env reaches them; the snapshot is preserved.
Model gateway. Optional LiteLLM sibling container, off by default,
mirroring stt.rs — this is what makes real OpenAI usable, since
api.openai.com has no /v1/messages. Pinned to v1.96.0 by tag and digest:
the 1.82.7/1.82.8 malware was PyPI-only and never affected the official
images, which is precisely why this builds FROM the image rather than
pip-installing, but 1.84.0 is still the floor for proxy CVEs (API-key
SQLi, Host-header auth bypass, MCP auth bypass). Binds 0.0.0.0 because
project containers consume it, and therefore always sets a master_key —
LiteLLM without one accepts any key. The provider key lives in the OS
keychain and is uploaded into a volume, never an image layer or label.
URL relay. A container-side xdg-open/BROWSER shim opens URLs in the
host's browser. Uses an OSC sequence to /dev/tty rather than a printed
sentinel, because the shim usually runs as a grandchild of a process
capturing its children's output. Degrades to printing the URL when no
terminal is attached, so scheduled tasks do not hang. Only http/https,
with control characters rejected before new URL() — which strips
newlines, so java\nscript: would otherwise parse as javascript:. Nothing
auto-opens; the user confirms. The web terminal shows a tap-to-open
banner instead, since that browser may be a phone across a tunnel.
Browser view. A Project Home tab that watches and takes over the browser
Claude drives with Playwright, using Playwright's own dashboard. Zero
image cost — Playwright stays user-installed. It does not reuse the auth
bridge's PortForward, which binds an unauthenticated port: correct for a
throwaway OAuth listener, wrong for mouse and keyboard control of a
browser in a passwordless-sudo container. Instead a token-gated loopback
proxy checks Host, then token or a forbidden-header origin signal,
before a byte reaches the container. Host ports are confined to
47820..=47827 so CSP frame-src can enumerate them rather than widening
to a wildcard, with a test asserting the two agree.
188 frontend tests, 107 Rust tests, both builds clean.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5
@@ -162,6 +162,57 @@ RUN chmod +x /usr/local/bin/audio-shim \
|
||||
&& ln -sf /usr/local/bin/audio-shim /usr/local/bin/rec \
|
||||
&& ln -sf /usr/local/bin/audio-shim /usr/local/bin/arecord
|
||||
|
||||
# ── URL relay shim (host browser) ───────────────────────────────────────────
|
||||
# Container-side stand-in for a browser. Emits an OSC 7777 escape sequence that
|
||||
# Triple-C's terminal front-end intercepts and turns into a host-browser open.
|
||||
# Installed under every name a CLI conventionally consults, plus $BROWSER.
|
||||
#
|
||||
# What Ubuntu 24.04's base actually ships (verified, not assumed):
|
||||
# sensible-browser PRESENT (/usr/bin/sensible-browser, from sensible-utils)
|
||||
# xdg-open absent (xdg-utils is not installed)
|
||||
# www-browser absent (no update-alternatives entry)
|
||||
# x-www-browser absent (no update-alternatives entry)
|
||||
# gnome-open / gvfs-open / kde-open / open absent
|
||||
#
|
||||
# So the three names that need real handling, not just a symlink:
|
||||
# * sensible-browser is a dpkg-owned file. A /usr/local/bin symlink would
|
||||
# only shadow it for PATH lookups, leaving absolute-path callers on the
|
||||
# stock script — so it is dpkg-diverted and replaced. (The stock script
|
||||
# does defer to $BROWSER, but only when $BROWSER is set; diverting makes
|
||||
# the behaviour unconditional and survives package upgrades.)
|
||||
# * www-browser / x-www-browser are update-alternatives names, so they are
|
||||
# registered as alternatives rather than hand-symlinked. This matters:
|
||||
# sensible-browser probes /usr/bin/x-www-browser by absolute path, which
|
||||
# only exists if something registered the alternative. `--set` pins them
|
||||
# to manual mode so a later `apt install firefox` cannot steal them and
|
||||
# point the container at a browser it has no display to run.
|
||||
# * xdg-open is diverted pre-emptively so that if someone later installs
|
||||
# xdg-utils inside the container, dpkg unpacks to xdg-open.distrib and
|
||||
# our relay keeps /usr/bin/xdg-open.
|
||||
COPY triple-c-open /usr/local/bin/triple-c-open
|
||||
RUN chmod +x /usr/local/bin/triple-c-open \
|
||||
&& for name in xdg-open sensible-browser gnome-open gvfs-open kde-open open; do \
|
||||
ln -sf /usr/local/bin/triple-c-open "/usr/local/bin/$name"; \
|
||||
done \
|
||||
&& dpkg-divert --local --rename --divert /usr/bin/sensible-browser.distrib \
|
||||
--add /usr/bin/sensible-browser \
|
||||
&& ln -sf /usr/local/bin/triple-c-open /usr/bin/sensible-browser \
|
||||
&& dpkg-divert --local --rename --divert /usr/bin/xdg-open.distrib \
|
||||
--add /usr/bin/xdg-open \
|
||||
&& ln -sf /usr/local/bin/triple-c-open /usr/bin/xdg-open \
|
||||
&& update-alternatives --install /usr/bin/x-www-browser x-www-browser \
|
||||
/usr/local/bin/triple-c-open 200 \
|
||||
&& update-alternatives --set x-www-browser /usr/local/bin/triple-c-open \
|
||||
&& update-alternatives --install /usr/bin/www-browser www-browser \
|
||||
/usr/local/bin/triple-c-open 200 \
|
||||
&& update-alternatives --set www-browser /usr/local/bin/triple-c-open
|
||||
|
||||
# $BROWSER must be an image-level ENV, not just an entrypoint export: terminal
|
||||
# sessions are separate `docker exec`s, which inherit the container's config
|
||||
# env and see nothing the entrypoint exported into its own process. The
|
||||
# entrypoint additionally forwards it into the cron environment file.
|
||||
ENV BROWSER=/usr/local/bin/triple-c-open
|
||||
|
||||
COPY triple-c-sso-refresh /usr/local/bin/triple-c-sso-refresh
|
||||
RUN chmod +x /usr/local/bin/triple-c-sso-refresh
|
||||
|
||||
|
||||
+13
-1
@@ -242,6 +242,18 @@ if [ -n "${TZ:-}" ]; then
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── Browser / URL relay ──────────────────────────────────────────────────────
|
||||
# Tools that open a browser (gh, aws sso login, gcloud, python webbrowser, ...)
|
||||
# consult $BROWSER first. Point it at the relay shim, which forwards the URL to
|
||||
# the host's browser over the terminal. The image already sets this as an ENV —
|
||||
# that is what `docker exec` terminal sessions inherit — but exporting it here
|
||||
# means the entrypoint's own children see it too, and (below) that it is
|
||||
# captured into the cron environment file for scheduled tasks. Under cron there
|
||||
# is no terminal, so the shim degrades to printing the URL into the task log.
|
||||
if [ -x /usr/local/bin/triple-c-open ]; then
|
||||
export BROWSER=/usr/local/bin/triple-c-open
|
||||
fi
|
||||
|
||||
# ── Scheduler setup ─────────────────────────────────────────────────────────
|
||||
SCHEDULER_DIR="/home/claude/.claude/scheduler"
|
||||
mkdir -p "$SCHEDULER_DIR/tasks" "$SCHEDULER_DIR/logs" "$SCHEDULER_DIR/notifications"
|
||||
@@ -255,7 +267,7 @@ ENV_FILE="$SCHEDULER_DIR/.env"
|
||||
: > "$ENV_FILE"
|
||||
env | while IFS='=' read -r key value; do
|
||||
case "$key" in
|
||||
ANTHROPIC_*|AWS_*|CLAUDE_CODE_*|TRIPLE_C_PERMISSION_MODE|PATH|HOME|LANG|TZ|COLORTERM)
|
||||
ANTHROPIC_*|AWS_*|CLAUDE_CODE_*|TRIPLE_C_PERMISSION_MODE|PATH|HOME|LANG|TZ|COLORTERM|BROWSER)
|
||||
# Escape single quotes in value and write as KEY='VALUE'
|
||||
escaped_value=$(printf '%s' "$value" | sed "s/'/'\\\\''/g")
|
||||
printf "%s='%s'\n" "$key" "$escaped_value" >> "$ENV_FILE"
|
||||
|
||||
Executable
+136
@@ -0,0 +1,136 @@
|
||||
#!/bin/bash
|
||||
# triple-c-open — URL relay shim.
|
||||
#
|
||||
# Programs inside the container have no browser and no display. When one wants
|
||||
# to open a URL (`gh auth login`, `aws sso login`, `gcloud auth login`, any
|
||||
# tool that shells out to xdg-open or honours $BROWSER), this shim relays the
|
||||
# URL to the *Triple-C host*, where the user's real browser lives. Nothing is
|
||||
# rendered in the container — this is a message, not display forwarding.
|
||||
#
|
||||
# Transport: an OSC escape sequence written to the controlling terminal, the
|
||||
# same trick /usr/local/bin/osc52-clipboard uses for the clipboard.
|
||||
#
|
||||
# ESC ] 7777 ; open ; <base64(url)> BEL
|
||||
#
|
||||
# It goes to /dev/tty, not stdout, so it still reaches the terminal when this
|
||||
# shim is a grandchild of something that captures its children's output (e.g.
|
||||
# Claude Code running `gh auth login` as a tool call). Triple-C's terminal
|
||||
# front-end registers an OSC 7777 handler, validates the URL and offers to open
|
||||
# it on the host. Terminals that don't know OSC 7777 silently discard it.
|
||||
#
|
||||
# Installed as: xdg-open, sensible-browser, www-browser, x-www-browser,
|
||||
# gnome-open, gvfs-open, kde-open, open — and as $BROWSER.
|
||||
#
|
||||
# NO-TERMINAL FALLBACK: cron-driven scheduled tasks (triple-c-task-runner) run
|
||||
# with no controlling terminal at all, and a container can be exec'd into from
|
||||
# a plain `docker exec` with no Triple-C front-end listening. There is no
|
||||
# handshake and nothing to wait for, so this shim never blocks: it prints the
|
||||
# URL in plain text on its own line and exits. A human reading the scheduler
|
||||
# log, or the operator at a foreign terminal, can still act on it.
|
||||
|
||||
set -u
|
||||
|
||||
PROGRAM_NAME="triple-c-open"
|
||||
MAX_URL_LENGTH=8192 # refuse absurd payloads rather than base64 them
|
||||
MAX_TARGETS=8 # refuse to fan out into a burst of relays
|
||||
|
||||
usage() {
|
||||
cat <<EOF
|
||||
Usage: $PROGRAM_NAME <url> [url ...]
|
||||
|
||||
Relays http/https URLs to the Triple-C host's browser via the terminal.
|
||||
With no Triple-C terminal attached, prints the URL instead of opening it.
|
||||
|
||||
Options:
|
||||
-h, --help Show this help
|
||||
-v, --version Show version
|
||||
EOF
|
||||
}
|
||||
|
||||
# stderr, so we never pollute a caller that parses our stdout.
|
||||
note() {
|
||||
printf '%s\n' "$*" >&2
|
||||
}
|
||||
|
||||
# Scheme allow-list. The host validates independently — this is defence in
|
||||
# depth and, more usefully, an immediate error message for the caller.
|
||||
# Rejects file:, javascript:, data:, and every custom handler.
|
||||
is_relayable_url() {
|
||||
local url="$1"
|
||||
case "$url" in
|
||||
http://*|https://*|HTTP://*|HTTPS://*|Http://*|Https://*) ;;
|
||||
*) return 1 ;;
|
||||
esac
|
||||
# Reject control characters and whitespace: a bare CR/LF or ESC in the URL
|
||||
# would let the container inject its own escape sequences into the relay.
|
||||
case "$url" in
|
||||
*[[:space:][:cntrl:]]*) return 1 ;;
|
||||
esac
|
||||
[ "${#url}" -le "$MAX_URL_LENGTH" ]
|
||||
}
|
||||
|
||||
# Write the OSC sequence to the controlling terminal. Returns non-zero when
|
||||
# there is no controlling terminal (cron, detached exec) — bash fails the
|
||||
# redirection itself, which is exactly the signal we want.
|
||||
emit_osc() {
|
||||
local encoded
|
||||
encoded=$(printf '%s' "$1" | base64 | tr -d '\n') || return 1
|
||||
# The braces matter: with no controlling terminal bash reports the failed
|
||||
# redirection on stderr, and only a group-level 2>/dev/null (applied before
|
||||
# the inner > /dev/tty) suppresses that noise. Trailing `2>/dev/null` on
|
||||
# the printf itself would be applied *after* the failing redirection.
|
||||
{ printf '\033]7777;open;%s\a' "$encoded" > /dev/tty; } 2>/dev/null
|
||||
}
|
||||
|
||||
relay() {
|
||||
local url="$1"
|
||||
|
||||
if ! is_relayable_url "$url"; then
|
||||
note "$PROGRAM_NAME: refusing to relay non-http(s) target: $url"
|
||||
note "$PROGRAM_NAME: only http:// and https:// URLs can be opened on the host."
|
||||
# xdg-open convention: 4 = the action failed.
|
||||
return 4
|
||||
fi
|
||||
|
||||
if emit_osc "$url"; then
|
||||
note "$PROGRAM_NAME: sent to the Triple-C host browser:"
|
||||
note "$url"
|
||||
return 0
|
||||
fi
|
||||
|
||||
# No controlling terminal. Do not wait for a host that isn't listening.
|
||||
note "$PROGRAM_NAME: no Triple-C terminal attached — cannot reach the host browser."
|
||||
note "$PROGRAM_NAME: open this URL manually:"
|
||||
note "$url"
|
||||
return 0
|
||||
}
|
||||
|
||||
targets=()
|
||||
for arg in "$@"; do
|
||||
case "$arg" in
|
||||
-h|--help) usage; exit 0 ;;
|
||||
-v|--version) printf 'triple-c-open 1.0\n'; exit 0 ;;
|
||||
--) continue ;;
|
||||
# Swallow unknown flags (xdg-open accepts --manual etc.) rather than
|
||||
# mistaking them for targets.
|
||||
-*) continue ;;
|
||||
*) targets+=("$arg") ;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [ "${#targets[@]}" -eq 0 ]; then
|
||||
note "$PROGRAM_NAME: no URL given"
|
||||
usage
|
||||
exit 1 # xdg-open convention: 1 = error in command line syntax
|
||||
fi
|
||||
|
||||
if [ "${#targets[@]}" -gt "$MAX_TARGETS" ]; then
|
||||
note "$PROGRAM_NAME: refusing to relay ${#targets[@]} URLs at once (max $MAX_TARGETS)"
|
||||
exit 4
|
||||
fi
|
||||
|
||||
status=0
|
||||
for target in "${targets[@]}"; do
|
||||
relay "$target" || status=$?
|
||||
done
|
||||
exit "$status"
|
||||
Reference in New Issue
Block a user