Add llama.cpp backend, model gateway, URL relay and browser view

Four features, plus a latent bug fix.

llama.cpp backend. Claude Code only ever speaks the Anthropic Messages
API — confirmed empirically by pointing it at a logging server, which
received POST /v1/messages?beta=true. llama-server implements that
natively (verified in its README, alongside --port default 8080), so
this is a plain base-URL backend with no translation shim, the same
shape as Ollama. Its --api-key defaults to none, so the auth token is a
placeholder Claude Code requires and llama-server ignores.

Model alias fix. ANTHROPIC_DEFAULT_HAIKU_MODEL is documented as "also
used for background functionality", and Triple-C set none of the alias
vars. So on every custom-endpoint backend, Claude Code resolved `haiku`
to an Anthropic model id and sent it to a local server that does not
have it — background features failed silently. All four
ANTHROPIC_DEFAULT_{OPUS,SONNET,HAIKU,FABLE}_MODEL vars are now pinned to
the backend's configured model, with an optional Haiku override, and
blanked for Anthropic and Bedrock so those keep Claude Code's defaults.
The deprecated ANTHROPIC_SMALL_FAST_MODEL is never emitted. Existing
Ollama and OpenAI-Compatible containers are recreated once so the new
env reaches them; the snapshot is preserved.

Model gateway. Optional LiteLLM sibling container, off by default,
mirroring stt.rs — this is what makes real OpenAI usable, since
api.openai.com has no /v1/messages. Pinned to v1.96.0 by tag and digest:
the 1.82.7/1.82.8 malware was PyPI-only and never affected the official
images, which is precisely why this builds FROM the image rather than
pip-installing, but 1.84.0 is still the floor for proxy CVEs (API-key
SQLi, Host-header auth bypass, MCP auth bypass). Binds 0.0.0.0 because
project containers consume it, and therefore always sets a master_key —
LiteLLM without one accepts any key. The provider key lives in the OS
keychain and is uploaded into a volume, never an image layer or label.

URL relay. A container-side xdg-open/BROWSER shim opens URLs in the
host's browser. Uses an OSC sequence to /dev/tty rather than a printed
sentinel, because the shim usually runs as a grandchild of a process
capturing its children's output. Degrades to printing the URL when no
terminal is attached, so scheduled tasks do not hang. Only http/https,
with control characters rejected before new URL() — which strips
newlines, so java\nscript: would otherwise parse as javascript:. Nothing
auto-opens; the user confirms. The web terminal shows a tap-to-open
banner instead, since that browser may be a phone across a tunnel.

Browser view. A Project Home tab that watches and takes over the browser
Claude drives with Playwright, using Playwright's own dashboard. Zero
image cost — Playwright stays user-installed. It does not reuse the auth
bridge's PortForward, which binds an unauthenticated port: correct for a
throwaway OAuth listener, wrong for mouse and keyboard control of a
browser in a passwordless-sudo container. Instead a token-gated loopback
proxy checks Host, then token or a forbidden-header origin signal,
before a byte reaches the container. Host ports are confined to
47820..=47827 so CSP frame-src can enumerate them rather than widening
to a wildcard, with a test asserting the two agree.

188 frontend tests, 107 Rust tests, both builds clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

container/triple-c-open

@@ -0,0 +1,136 @@
+#!/bin/bash
+# triple-c-open — URL relay shim.
+#
+# Programs inside the container have no browser and no display. When one wants
+# to open a URL (`gh auth login`, `aws sso login`, `gcloud auth login`, any
+# tool that shells out to xdg-open or honours $BROWSER), this shim relays the
+# URL to the *Triple-C host*, where the user's real browser lives. Nothing is
+# rendered in the container — this is a message, not display forwarding.
+#
+# Transport: an OSC escape sequence written to the controlling terminal, the
+# same trick /usr/local/bin/osc52-clipboard uses for the clipboard.
+#
+#     ESC ] 7777 ; open ; <base64(url)> BEL
+#
+# It goes to /dev/tty, not stdout, so it still reaches the terminal when this
+# shim is a grandchild of something that captures its children's output (e.g.
+# Claude Code running `gh auth login` as a tool call). Triple-C's terminal
+# front-end registers an OSC 7777 handler, validates the URL and offers to open
+# it on the host. Terminals that don't know OSC 7777 silently discard it.
+#
+# Installed as: xdg-open, sensible-browser, www-browser, x-www-browser,
+# gnome-open, gvfs-open, kde-open, open — and as $BROWSER.
+#
+# NO-TERMINAL FALLBACK: cron-driven scheduled tasks (triple-c-task-runner) run
+# with no controlling terminal at all, and a container can be exec'd into from
+# a plain `docker exec` with no Triple-C front-end listening. There is no
+# handshake and nothing to wait for, so this shim never blocks: it prints the
+# URL in plain text on its own line and exits. A human reading the scheduler
+# log, or the operator at a foreign terminal, can still act on it.
+
+set -u
+
+PROGRAM_NAME="triple-c-open"
+MAX_URL_LENGTH=8192   # refuse absurd payloads rather than base64 them
+MAX_TARGETS=8         # refuse to fan out into a burst of relays
+
+usage() {
+    cat <<EOF
+Usage: $PROGRAM_NAME <url> [url ...]
+
+Relays http/https URLs to the Triple-C host's browser via the terminal.
+With no Triple-C terminal attached, prints the URL instead of opening it.
+
+Options:
+  -h, --help     Show this help
+  -v, --version  Show version
+EOF
+}
+
+# stderr, so we never pollute a caller that parses our stdout.
+note() {
+    printf '%s\n' "$*" >&2
+}
+
+# Scheme allow-list. The host validates independently — this is defence in
+# depth and, more usefully, an immediate error message for the caller.
+# Rejects file:, javascript:, data:, and every custom handler.
+is_relayable_url() {
+    local url="$1"
+    case "$url" in
+        http://*|https://*|HTTP://*|HTTPS://*|Http://*|Https://*) ;;
+        *) return 1 ;;
+    esac
+    # Reject control characters and whitespace: a bare CR/LF or ESC in the URL
+    # would let the container inject its own escape sequences into the relay.
+    case "$url" in
+        *[[:space:][:cntrl:]]*) return 1 ;;
+    esac
+    [ "${#url}" -le "$MAX_URL_LENGTH" ]
+}
+
+# Write the OSC sequence to the controlling terminal. Returns non-zero when
+# there is no controlling terminal (cron, detached exec) — bash fails the
+# redirection itself, which is exactly the signal we want.
+emit_osc() {
+    local encoded
+    encoded=$(printf '%s' "$1" | base64 | tr -d '\n') || return 1
+    # The braces matter: with no controlling terminal bash reports the failed
+    # redirection on stderr, and only a group-level 2>/dev/null (applied before
+    # the inner > /dev/tty) suppresses that noise. Trailing `2>/dev/null` on
+    # the printf itself would be applied *after* the failing redirection.
+    { printf '\033]7777;open;%s\a' "$encoded" > /dev/tty; } 2>/dev/null
+}
+
+relay() {
+    local url="$1"
+
+    if ! is_relayable_url "$url"; then
+        note "$PROGRAM_NAME: refusing to relay non-http(s) target: $url"
+        note "$PROGRAM_NAME: only http:// and https:// URLs can be opened on the host."
+        # xdg-open convention: 4 = the action failed.
+        return 4
+    fi
+
+    if emit_osc "$url"; then
+        note "$PROGRAM_NAME: sent to the Triple-C host browser:"
+        note "$url"
+        return 0
+    fi
+
+    # No controlling terminal. Do not wait for a host that isn't listening.
+    note "$PROGRAM_NAME: no Triple-C terminal attached — cannot reach the host browser."
+    note "$PROGRAM_NAME: open this URL manually:"
+    note "$url"
+    return 0
+}
+
+targets=()
+for arg in "$@"; do
+    case "$arg" in
+        -h|--help)    usage; exit 0 ;;
+        -v|--version) printf 'triple-c-open 1.0\n'; exit 0 ;;
+        --)           continue ;;
+        # Swallow unknown flags (xdg-open accepts --manual etc.) rather than
+        # mistaking them for targets.
+        -*)           continue ;;
+        *)            targets+=("$arg") ;;
+    esac
+done
+
+if [ "${#targets[@]}" -eq 0 ]; then
+    note "$PROGRAM_NAME: no URL given"
+    usage
+    exit 1   # xdg-open convention: 1 = error in command line syntax
+fi
+
+if [ "${#targets[@]}" -gt "$MAX_TARGETS" ]; then
+    note "$PROGRAM_NAME: refusing to relay ${#targets[@]} URLs at once (max $MAX_TARGETS)"
+    exit 4
+fi
+
+status=0
+for target in "${targets[@]}"; do
+    relay "$target" || status=$?
+done
+exit "$status"