rebellm-bridge 0.1.0 → 0.1.2

package/README.md

@@ -55,7 +55,7 @@ SDKs: OpenAI with `base_url="http://127.0.0.1:7343/v1"`, Anthropic with
 As Claude Code's model (its own config directory, your claude.ai login untouched):
 
 ```
-rebellm-claude                   # interactive
+npx rebellm-bridge claude        # nothing to install; rebellm-claude after npm install -g
 rebellm-claude -p "What is 2 + 3?"
 ```
 
@@ -65,6 +65,14 @@ and a long request timeout, and passes every other argument to `claude`. Options
 Claude Code's first request is ~11k tokens of system prompt and tools, so it needs a tab
 with a 32k context and patience on a slow GPU.
 
+On a work machine Claude Code may be pinned to the company's endpoint or cloud provider.
+The launcher blanks `ANTHROPIC_API_KEY`, `ANTHROPIC_CUSTOM_HEADERS` and `CLAUDE_CODE_USE_*`
+from your shell and passes its own variables with `--settings`, which ranks above the
+project's `.claude/settings.json` and your user settings. Managed settings (MDM,
+`managed-settings.json`, the claude.ai admin console) rank above that and only your
+organisation can change them: the launcher names the file when it finds one, and `/status`
+inside `claude` lists the setting sources in force.
+
 As a tool inside your normal Claude Code (Claude keeps its own model, can ask yours):
 
 ```

package/dist/cli.d.ts

@@ -5,7 +5,7 @@ import { type BridgeServer } from './server.js';
 import type { Health } from './tab.js';
 export declare const VERSION: string;
 export declare const TOKEN_ENV = "REBELLM_BRIDGE_TOKEN";
-export declare const USAGE = "Usage: rebellm-bridge [options]\n\nLets Claude Code (MCP or rebellm-claude) and OpenAI-style clients use the model in your RebeLLM tab.\n\n  --port <n>      port for the tab and the HTTP API (default 7343)\n  --host <addr>   address to listen on (default 127.0.0.1; anything else exposes the model)\n  --token <t>     token the tab must present (default: REBELLM_BRIDGE_TOKEN, else ~/.rebellm-bridge/token)\n  --wait <s>      seconds a request waits for the tab and its model (default 120)\n  --mcp           serve MCP over stdio as well (Claude Code starts the bridge this way)\n  --version       print the version\n  --help          print this help";
+export declare const USAGE = "Usage: rebellm-bridge [options]\n       rebellm-bridge claude [launcher options] [claude arguments]\n\nLets Claude Code (MCP or rebellm-claude) and OpenAI-style clients use the model in your RebeLLM tab.\n\n  claude ...      run Claude Code on the tab's model, the same as rebellm-claude\n  --port <n>      port for the tab and the HTTP API (default 7343)\n  --host <addr>   address to listen on (default 127.0.0.1; anything else exposes the model)\n  --token <t>     token the tab must present (default: REBELLM_BRIDGE_TOKEN, else ~/.rebellm-bridge/token)\n  --wait <s>      seconds a request waits for the tab and its model (default 120)\n  --mcp           serve MCP over stdio as well (Claude Code starts the bridge this way)\n  --version       print the version\n  --help          print this help";
 export interface CliOptions {
     port: number;
     host: string;

package/dist/cli.js

@@ -11,9 +11,11 @@ import { DEFAULT_HOST, DEFAULT_PORT, isLoopback, startServer } from './server.js
 export const VERSION = createRequire(import.meta.url)('../package.json').version;
 export const TOKEN_ENV = 'REBELLM_BRIDGE_TOKEN';
 export const USAGE = `Usage: rebellm-bridge [options]
+       rebellm-bridge claude [launcher options] [claude arguments]
 
 Lets Claude Code (MCP or rebellm-claude) and OpenAI-style clients use the model in your RebeLLM tab.
 
+  claude ...      run Claude Code on the tab's model, the same as rebellm-claude
   --port <n>      port for the tab and the HTTP API (default ${DEFAULT_PORT})
   --host <addr>   address to listen on (default ${DEFAULT_HOST}; anything else exposes the model)
   --token <t>     token the tab must present (default: ${TOKEN_ENV}, else ~/.rebellm-bridge/token)
@@ -161,6 +163,11 @@ export async function run(o, io) {
 }
 /** The command line; resolves with the exit code once the bridge has stopped. */
 export async function main(argv, io) {
+    if (argv[0] === 'claude') {
+        // Loaded here so the plain bridge never touches the launcher, and the two files can import each other.
+        const { launch } = await import('./launcher.js');
+        return launch(argv.slice(1), { stderr: io.stderr, env: io.env, ...(io.home ? { home: io.home } : {}) });
+    }
     const o = parseCli(argv);
     if ('error' in o) {
         io.stderr.write(`rebellm-bridge: ${o.error}\n\n${USAGE}\n`);

package/dist/launcher.d.ts

@@ -19,16 +19,23 @@ export declare function parseLauncher(argv: string[]): LauncherOptions | {
 export declare function findCommand(name: string, env: NodeJS.ProcessEnv, platform?: NodeJS.Platform): string | null;
 /** What sends every model request of claude to the bridge. */
 export declare function bridgeEnv(base: string, contextTokens?: number): Record<string, string>;
-/** The parent's environment with the bridge's on top; a real API key is removed, never sent to the bridge. */
+/** The parent's environment with the bridge's on top; a real key or provider never reaches claude. */
 export declare function childEnv(parent: NodeJS.ProcessEnv, ours: Record<string, string>, platform?: NodeJS.Platform): NodeJS.ProcessEnv;
 export declare const configDir: (home: string) => string;
 export declare const logFile: (home: string) => string;
-/** Puts `env` into the config dir's `settings.json`, keeping the rest; a warning when it cannot. */
-export declare function writeSettings(dir: string, env: Record<string, string>): string | null;
+/** Given to claude as `--settings`, which ranks above project, local and user settings. */
+export declare const launchSettingsFile: (home: string) => string;
+export declare function writeLaunchSettings(file: string, env: Record<string, string>): void;
+/** Where an organisation's Claude Code settings live; they rank above everything the launcher can do. */
+export declare function managedSettingsFile(platform: NodeJS.Platform, env: NodeJS.ProcessEnv): string;
+/** The keys of a managed settings file that decide where claude sends requests; none without such a file. */
+export declare function managedOverrides(file: string): string[];
 export interface LaunchIo {
     stderr: Writable;
     env: NodeJS.ProcessEnv;
     home?: string;
+    /** The managed settings file to look at, for tests. */
+    managedFile?: string;
     /** How often to ask the bridge whether the tab is there. */
     pollMs?: number;
     platform?: NodeJS.Platform;

package/dist/launcher.js

@@ -87,9 +87,19 @@ export function findCommand(name, env, platform = process.platform) {
     }
     return null;
 }
+/** What Claude Code ranks above `ANTHROPIC_AUTH_TOKEN` and `ANTHROPIC_BASE_URL`, or would send along. */
+const OUTRANKING = [
+    'ANTHROPIC_API_KEY',
+    'ANTHROPIC_CUSTOM_HEADERS',
+    'CLAUDE_CODE_USE_BEDROCK',
+    'CLAUDE_CODE_USE_VERTEX',
+    'CLAUDE_CODE_USE_FOUNDRY',
+];
 /** What sends every model request of claude to the bridge. */
 export function bridgeEnv(base, contextTokens) {
     return {
+        // Empty counts as unset; a value from a shell profile or a settings file would outrank the bridge.
+        ...Object.fromEntries(OUTRANKING.map((k) => [k, ''])),
         ANTHROPIC_BASE_URL: base,
         // The bridge checks no key; a Bearer token needs no approval prompt in Claude Code.
         ANTHROPIC_AUTH_TOKEN: 'rebellm-bridge-needs-no-key',
@@ -103,10 +113,10 @@ export function bridgeEnv(base, contextTokens) {
         ...(contextTokens ? { CLAUDE_CODE_MAX_CONTEXT_TOKENS: String(contextTokens) } : {}),
     };
 }
-/** The parent's environment with the bridge's on top; a real API key is removed, never sent to the bridge. */
+/** The parent's environment with the bridge's on top; a real key or provider never reaches claude. */
 export function childEnv(parent, ours, platform = process.platform) {
     const win = platform === 'win32';
-    const drop = new Set(['ANTHROPIC_API_KEY', ...Object.keys(ours)]);
+    const drop = new Set(Object.keys(ours));
     const env = {};
     for (const [k, v] of Object.entries(parent))
         if (!drop.has(win ? k.toUpperCase() : k))
@@ -115,25 +125,38 @@ export function childEnv(parent, ours, platform = process.platform) {
 }
 export const configDir = (home) => join(home, '.rebellm-bridge', 'claude');
 export const logFile = (home) => join(home, '.rebellm-bridge', 'bridge.log');
+/** Given to claude as `--settings`, which ranks above project, local and user settings. */
+export const launchSettingsFile = (home) => join(home, '.rebellm-bridge', 'claude-settings.json');
 const isObj = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
-/** Puts `env` into the config dir's `settings.json`, keeping the rest; a warning when it cannot. */
-export function writeSettings(dir, env) {
-    const file = join(dir, 'settings.json');
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
-    let settings = {};
+export function writeLaunchSettings(file, env) {
+    mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+    writeFileSync(file, `${JSON.stringify({ env }, null, 2)}\n`, { mode: 0o600 });
+}
+/** Where an organisation's Claude Code settings live; they rank above everything the launcher can do. */
+export function managedSettingsFile(platform, env) {
+    if (platform === 'darwin')
+        return '/Library/Application Support/ClaudeCode/managed-settings.json';
+    if (platform === 'win32')
+        return join(env[envKey(env, 'PROGRAMFILES', true)] ?? 'C:\\Program Files', 'ClaudeCode', 'managed-settings.json');
+    return '/etc/claude-code/managed-settings.json';
+}
+const MANAGED_KEYS = ['apiKeyHelper', 'forceLoginMethod', 'forceLoginGatewayUrl'];
+/** The keys of a managed settings file that decide where claude sends requests; none without such a file. */
+export function managedOverrides(file) {
+    let settings;
     try {
-        const parsed = JSON.parse(readFileSync(file, 'utf8'));
-        if (!isObj(parsed))
-            return `${file} is not a JSON object; left it as it is`;
-        settings = parsed;
+        settings = JSON.parse(readFileSync(file, 'utf8'));
     }
-    catch (e) {
-        if (e.code !== 'ENOENT')
-            return `could not read ${file}; left it as it is`;
+    catch {
+        return [];
     }
-    settings.env = { ...(isObj(settings.env) ? settings.env : {}), ...env };
-    writeFileSync(file, `${JSON.stringify(settings, null, 2)}\n`);
-    return null;
+    if (!isObj(settings))
+        return [];
+    const env = isObj(settings.env) ? Object.keys(settings.env) : [];
+    return [
+        ...env.filter((k) => /^(ANTHROPIC_|CLAUDE_CODE_USE_)/.test(k)),
+        ...MANAGED_KEYS.filter((k) => settings[k] !== undefined),
+    ];
 }
 const sleep = (ms, signal) => new Promise((resolve) => {
     const t = setTimeout(resolve, ms);
@@ -212,14 +235,17 @@ export async function launch(argv, io) {
         say(`the RebeLLM tab is connected${model}`);
         const dir = o.sharedConfig ? null : configDir(home);
         const ours = bridgeEnv(base, health.contextTokens);
-        if (dir) {
-            const warning = writeSettings(dir, ours);
-            if (warning)
-                say(warning);
-        }
+        const settings = launchSettingsFile(home);
+        writeLaunchSettings(settings, ours);
+        const managed = io.managedFile ?? managedSettingsFile(platform, io.env);
+        const overrides = managedOverrides(managed);
+        if (overrides.length)
+            say(`your organisation's Claude Code settings in ${managed} set ${overrides.join(', ')}; they rank above ` +
+                `rebellm-claude, so claude may still go to your organisation's endpoint (/status in claude lists the sources)`);
         say(`starting ${claude} with ${dir ? `the config in ${dir}` : 'your own Claude Code config'}`);
         const env = childEnv(io.env, { ...ours, ...(dir ? { CLAUDE_CONFIG_DIR: dir } : {}) }, platform);
-        const child = spawn(claude, o.args, { stdio: 'inherit', env });
+        // Ours first: a --settings the user passes comes later and wins, as asked.
+        const child = spawn(claude, ['--settings', settings, ...o.args], { stdio: 'inherit', env });
         return await new Promise((resolve) => {
             child.on('error', (e) => {
                 say(`could not start ${claude}: ${e.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rebellm-bridge",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Use the model in your RebeLLM browser tab from the command line, OpenAI/Anthropic clients and Claude Code",
   "keywords": [
     "rebellm",