rebellm-bridge 0.1.0 → 0.1.3

package/README.md

@@ -21,7 +21,7 @@ npm install -g rebellm-bridge     # or run it once with: npx rebellm-bridge
 
 1. `rebellm-bridge` — the first start prints a token once and keeps it in
    `~/.rebellm-bridge/token` (`cat` it to see it again, delete it for a new one).
-2. In RebeLLM: Settings → Local bridge → paste the token, switch on, Save. The card reads
+2. In RebeLLM: Bridge (top of the page) → paste the token, Save, switch on. The sidebar reads
    "Connected to 127.0.0.1:7343". The model must be loaded in that tab.
 3. Check: `curl http://127.0.0.1:7343/health` → `{"tab":true,"state":"ready",...}`.
 
@@ -55,7 +55,7 @@ SDKs: OpenAI with `base_url="http://127.0.0.1:7343/v1"`, Anthropic with
 As Claude Code's model (its own config directory, your claude.ai login untouched):
 
 ```
-rebellm-claude                   # interactive
+npx rebellm-bridge claude        # nothing to install; rebellm-claude after npm install -g
 rebellm-claude -p "What is 2 + 3?"
 ```
 
@@ -63,7 +63,17 @@ It reuses a running bridge or starts one, waits for the tab, sets the tab's cont
 and a long request timeout, and passes every other argument to `claude`. Options:
 `--claude <path>`, `--shared-config` (use your normal Claude Code config), `--port <n>`.
 Claude Code's first request is ~11k tokens of system prompt and tools, so it needs a tab
-with a 32k context and patience on a slow GPU.
+with a 32k context and patience on a slow GPU: the launcher raises Claude Code's request
+and subagent timeouts to hours, so a subagent that shows nothing for twenty minutes is
+prefilling, not stuck (the Bridge log in the tab shows it).
+
+On a work machine Claude Code may be pinned to the company's endpoint or cloud provider.
+The launcher blanks `ANTHROPIC_API_KEY`, `ANTHROPIC_CUSTOM_HEADERS` and `CLAUDE_CODE_USE_*`
+from your shell and passes its own variables with `--settings`, which ranks above the
+project's `.claude/settings.json` and your user settings. Managed settings (MDM,
+`managed-settings.json`, the claude.ai admin console) rank above that and only your
+organisation can change them: the launcher names the file when it finds one, and `/status`
+inside `claude` lists the setting sources in force.
 
 As a tool inside your normal Claude Code (Claude keeps its own model, can ask yours):
 

package/dist/cli.d.ts

@@ -5,7 +5,7 @@ import { type BridgeServer } from './server.js';
 import type { Health } from './tab.js';
 export declare const VERSION: string;
 export declare const TOKEN_ENV = "REBELLM_BRIDGE_TOKEN";
-export declare const USAGE = "Usage: rebellm-bridge [options]\n\nLets Claude Code (MCP or rebellm-claude) and OpenAI-style clients use the model in your RebeLLM tab.\n\n  --port <n>      port for the tab and the HTTP API (default 7343)\n  --host <addr>   address to listen on (default 127.0.0.1; anything else exposes the model)\n  --token <t>     token the tab must present (default: REBELLM_BRIDGE_TOKEN, else ~/.rebellm-bridge/token)\n  --wait <s>      seconds a request waits for the tab and its model (default 120)\n  --mcp           serve MCP over stdio as well (Claude Code starts the bridge this way)\n  --version       print the version\n  --help          print this help";
+export declare const USAGE = "Usage: rebellm-bridge [options]\n       rebellm-bridge claude [launcher options] [claude arguments]\n\nLets Claude Code (MCP or rebellm-claude) and OpenAI-style clients use the model in your RebeLLM tab.\n\n  claude ...      run Claude Code on the tab's model, the same as rebellm-claude\n  --port <n>      port for the tab and the HTTP API (default 7343)\n  --host <addr>   address to listen on (default 127.0.0.1; anything else exposes the model)\n  --token <t>     token the tab must present (default: REBELLM_BRIDGE_TOKEN, else ~/.rebellm-bridge/token)\n  --wait <s>      seconds a request waits for the tab and its model (default 120)\n  --mcp           serve MCP over stdio as well (Claude Code starts the bridge this way)\n  --version       print the version\n  --help          print this help";
 export interface CliOptions {
     port: number;
     host: string;

package/dist/cli.js

@@ -11,9 +11,11 @@ import { DEFAULT_HOST, DEFAULT_PORT, isLoopback, startServer } from './server.js
 export const VERSION = createRequire(import.meta.url)('../package.json').version;
 export const TOKEN_ENV = 'REBELLM_BRIDGE_TOKEN';
 export const USAGE = `Usage: rebellm-bridge [options]
+       rebellm-bridge claude [launcher options] [claude arguments]
 
 Lets Claude Code (MCP or rebellm-claude) and OpenAI-style clients use the model in your RebeLLM tab.
 
+  claude ...      run Claude Code on the tab's model, the same as rebellm-claude
   --port <n>      port for the tab and the HTTP API (default ${DEFAULT_PORT})
   --host <addr>   address to listen on (default ${DEFAULT_HOST}; anything else exposes the model)
   --token <t>     token the tab must present (default: ${TOKEN_ENV}, else ~/.rebellm-bridge/token)
@@ -115,7 +117,7 @@ export async function run(o, io) {
     });
     if (tok.created)
         say(`\nNew bridge token (stored in ${tok.file}):\n\n  ${tok.token}\n\n` +
-            'Paste it into RebeLLM → Settings → Local bridge and turn the switch on. It is printed only this once.\n');
+            'Paste it into RebeLLM → Bridge and turn the switch on. It is printed only this once.\n');
     const warning = hostWarning(o.host);
     if (warning)
         log(warning);
@@ -140,7 +142,7 @@ export async function run(o, io) {
     if (server) {
         const where = `${urlHost(o.host)}:${server.port}`;
         log(`${VERSION} listening on ${where}`);
-        say(`  tab:    ws://${where}  (RebeLLM → Settings → Local bridge)`);
+        say(`  tab:    ws://${where}  (RebeLLM → Bridge)`);
         say(`  OpenAI: http://${where}/v1`);
         say(`  Claude: http://${where}  (Anthropic API; rebellm-claude runs Claude Code on it)`);
         say(`  token:  ${tok.source === 'flag' ? 'from --token' : tok.source === 'env' ? `from ${TOKEN_ENV}` : `in ${tok.file}`}`);
@@ -161,6 +163,11 @@ export async function run(o, io) {
 }
 /** The command line; resolves with the exit code once the bridge has stopped. */
 export async function main(argv, io) {
+    if (argv[0] === 'claude') {
+        // Loaded here so the plain bridge never touches the launcher, and the two files can import each other.
+        const { launch } = await import('./launcher.js');
+        return launch(argv.slice(1), { stderr: io.stderr, env: io.env, ...(io.home ? { home: io.home } : {}) });
+    }
     const o = parseCli(argv);
     if ('error' in o) {
         io.stderr.write(`rebellm-bridge: ${o.error}\n\n${USAGE}\n`);

package/dist/launcher.d.ts

@@ -19,16 +19,29 @@ export declare function parseLauncher(argv: string[]): LauncherOptions | {
 export declare function findCommand(name: string, env: NodeJS.ProcessEnv, platform?: NodeJS.Platform): string | null;
 /** What sends every model request of claude to the bridge. */
 export declare function bridgeEnv(base: string, contextTokens?: number): Record<string, string>;
-/** The parent's environment with the bridge's on top; a real API key is removed, never sent to the bridge. */
+/** The parent's environment with the bridge's on top; a real key or provider never reaches claude. */
 export declare function childEnv(parent: NodeJS.ProcessEnv, ours: Record<string, string>, platform?: NodeJS.Platform): NodeJS.ProcessEnv;
 export declare const configDir: (home: string) => string;
 export declare const logFile: (home: string) => string;
-/** Puts `env` into the config dir's `settings.json`, keeping the rest; a warning when it cannot. */
-export declare function writeSettings(dir: string, env: Record<string, string>): string | null;
+/** Given to claude as `--settings`, which ranks above project, local and user settings. */
+export declare const launchSettingsFile: (home: string) => string;
+/** Claude Code's extra model calls, minutes each on a slow model: the recap on return, prompt suggestions, thinking summaries. */
+export declare const QUIET_SETTINGS: {
+    readonly awaySummaryEnabled: false;
+    readonly promptSuggestionEnabled: false;
+    readonly showThinkingSummaries: false;
+};
+export declare function writeLaunchSettings(file: string, env: Record<string, string>): void;
+/** Where an organisation's Claude Code settings live; they rank above everything the launcher can do. */
+export declare function managedSettingsFile(platform: NodeJS.Platform, env: NodeJS.ProcessEnv): string;
+/** The keys of a managed settings file that decide where claude sends requests; none without such a file. */
+export declare function managedOverrides(file: string): string[];
 export interface LaunchIo {
     stderr: Writable;
     env: NodeJS.ProcessEnv;
     home?: string;
+    /** The managed settings file to look at, for tests. */
+    managedFile?: string;
     /** How often to ask the bridge whether the tab is there. */
     pollMs?: number;
     platform?: NodeJS.Platform;

package/dist/launcher.js

@@ -87,26 +87,39 @@ export function findCommand(name, env, platform = process.platform) {
     }
     return null;
 }
+/** What Claude Code ranks above `ANTHROPIC_AUTH_TOKEN` and `ANTHROPIC_BASE_URL`, or would send along. */
+const OUTRANKING = [
+    'ANTHROPIC_API_KEY',
+    'ANTHROPIC_CUSTOM_HEADERS',
+    'CLAUDE_CODE_USE_BEDROCK',
+    'CLAUDE_CODE_USE_VERTEX',
+    'CLAUDE_CODE_USE_FOUNDRY',
+];
 /** What sends every model request of claude to the bridge. */
 export function bridgeEnv(base, contextTokens) {
     return {
+        // Empty counts as unset; a value from a shell profile or a settings file would outrank the bridge.
+        ...Object.fromEntries(OUTRANKING.map((k) => [k, ''])),
         ANTHROPIC_BASE_URL: base,
         // The bridge checks no key; a Bearer token needs no approval prompt in Claude Code.
         ANTHROPIC_AUTH_TOKEN: 'rebellm-bridge-needs-no-key',
         ANTHROPIC_MODEL: MODEL,
         ANTHROPIC_SMALL_FAST_MODEL: MODEL,
         ANTHROPIC_DEFAULT_HAIKU_MODEL: MODEL,
-        // A local model can take minutes before its first token.
-        API_TIMEOUT_MS: '600000',
+        // A 32k prefill at 26 tok/s is 21 minutes and a long answer at 1.5 tok/s hours; the
+        // bridge's pings keep the idle watchdogs quiet, these keep the request and subagent alive.
+        API_TIMEOUT_MS: '21600000',
+        CLAUDE_ASYNC_AGENT_STALL_TIMEOUT_MS: '21600000',
+        CLAUDE_STREAM_IDLE_TIMEOUT_MS: '1800000',
         CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1',
         // Claude Code assumes 200k for a model it does not know; it should compact within the tab's.
         ...(contextTokens ? { CLAUDE_CODE_MAX_CONTEXT_TOKENS: String(contextTokens) } : {}),
     };
 }
-/** The parent's environment with the bridge's on top; a real API key is removed, never sent to the bridge. */
+/** The parent's environment with the bridge's on top; a real key or provider never reaches claude. */
 export function childEnv(parent, ours, platform = process.platform) {
     const win = platform === 'win32';
-    const drop = new Set(['ANTHROPIC_API_KEY', ...Object.keys(ours)]);
+    const drop = new Set(Object.keys(ours));
     const env = {};
     for (const [k, v] of Object.entries(parent))
         if (!drop.has(win ? k.toUpperCase() : k))
@@ -115,25 +128,44 @@ export function childEnv(parent, ours, platform = process.platform) {
 }
 export const configDir = (home) => join(home, '.rebellm-bridge', 'claude');
 export const logFile = (home) => join(home, '.rebellm-bridge', 'bridge.log');
+/** Given to claude as `--settings`, which ranks above project, local and user settings. */
+export const launchSettingsFile = (home) => join(home, '.rebellm-bridge', 'claude-settings.json');
 const isObj = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
-/** Puts `env` into the config dir's `settings.json`, keeping the rest; a warning when it cannot. */
-export function writeSettings(dir, env) {
-    const file = join(dir, 'settings.json');
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
-    let settings = {};
+/** Claude Code's extra model calls, minutes each on a slow model: the recap on return, prompt suggestions, thinking summaries. */
+export const QUIET_SETTINGS = {
+    awaySummaryEnabled: false,
+    promptSuggestionEnabled: false,
+    showThinkingSummaries: false,
+};
+export function writeLaunchSettings(file, env) {
+    mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+    writeFileSync(file, `${JSON.stringify({ ...QUIET_SETTINGS, env }, null, 2)}\n`, { mode: 0o600 });
+}
+/** Where an organisation's Claude Code settings live; they rank above everything the launcher can do. */
+export function managedSettingsFile(platform, env) {
+    if (platform === 'darwin')
+        return '/Library/Application Support/ClaudeCode/managed-settings.json';
+    if (platform === 'win32')
+        return join(env[envKey(env, 'PROGRAMFILES', true)] ?? 'C:\\Program Files', 'ClaudeCode', 'managed-settings.json');
+    return '/etc/claude-code/managed-settings.json';
+}
+const MANAGED_KEYS = ['apiKeyHelper', 'forceLoginMethod', 'forceLoginGatewayUrl'];
+/** The keys of a managed settings file that decide where claude sends requests; none without such a file. */
+export function managedOverrides(file) {
+    let settings;
     try {
-        const parsed = JSON.parse(readFileSync(file, 'utf8'));
-        if (!isObj(parsed))
-            return `${file} is not a JSON object; left it as it is`;
-        settings = parsed;
+        settings = JSON.parse(readFileSync(file, 'utf8'));
     }
-    catch (e) {
-        if (e.code !== 'ENOENT')
-            return `could not read ${file}; left it as it is`;
+    catch {
+        return [];
     }
-    settings.env = { ...(isObj(settings.env) ? settings.env : {}), ...env };
-    writeFileSync(file, `${JSON.stringify(settings, null, 2)}\n`);
-    return null;
+    if (!isObj(settings))
+        return [];
+    const env = isObj(settings.env) ? Object.keys(settings.env) : [];
+    return [
+        ...env.filter((k) => /^(ANTHROPIC_|CLAUDE_CODE_USE_)/.test(k)),
+        ...MANAGED_KEYS.filter((k) => settings[k] !== undefined),
+    ];
 }
 const sleep = (ms, signal) => new Promise((resolve) => {
     const t = setTimeout(resolve, ms);
@@ -199,7 +231,7 @@ export async function launch(argv, io) {
             }
         }
         if (!health?.tab) {
-            say(`waiting for the RebeLLM tab. In RebeLLM → Settings → Local bridge, connect to ` +
+            say(`waiting for the RebeLLM tab. In RebeLLM → Bridge, connect to ` +
                 `${base.replace('http:', 'ws:')} with ${token}\nCtrl+C quits.`);
             while (!health?.tab) {
                 if (quit.signal.aborted)
@@ -212,14 +244,17 @@ export async function launch(argv, io) {
         say(`the RebeLLM tab is connected${model}`);
         const dir = o.sharedConfig ? null : configDir(home);
         const ours = bridgeEnv(base, health.contextTokens);
-        if (dir) {
-            const warning = writeSettings(dir, ours);
-            if (warning)
-                say(warning);
-        }
+        const settings = launchSettingsFile(home);
+        writeLaunchSettings(settings, ours);
+        const managed = io.managedFile ?? managedSettingsFile(platform, io.env);
+        const overrides = managedOverrides(managed);
+        if (overrides.length)
+            say(`your organisation's Claude Code settings in ${managed} set ${overrides.join(', ')}; they rank above ` +
+                `rebellm-claude, so claude may still go to your organisation's endpoint (/status in claude lists the sources)`);
         say(`starting ${claude} with ${dir ? `the config in ${dir}` : 'your own Claude Code config'}`);
         const env = childEnv(io.env, { ...ours, ...(dir ? { CLAUDE_CONFIG_DIR: dir } : {}) }, platform);
-        const child = spawn(claude, o.args, { stdio: 'inherit', env });
+        // Ours first: a --settings the user passes comes later and wins, as asked.
+        const child = spawn(claude, ['--settings', settings, ...o.args], { stdio: 'inherit', env });
         return await new Promise((resolve) => {
             child.on('error', (e) => {
                 say(`could not start ${claude}: ${e.message}`);

package/dist/mcp.js

@@ -92,7 +92,7 @@ export function httpBackend(base) {
 /** The `status` tool's text; never the token, which would end up in the client's context. */
 export function describeHealth(h) {
     if (!h.tab)
-        return ('No RebeLLM tab is connected. In RebeLLM → Settings → Local bridge, paste the bridge token ' +
+        return ('No RebeLLM tab is connected. In RebeLLM → Bridge, paste the bridge token ' +
             '(printed at its first start, stored in ~/.rebellm-bridge/token) and turn the switch on.');
     const tab = `A RebeLLM tab is connected${h.app ? ` (app ${h.app})` : ''}.`;
     const model = h.model ? `The model ${h.model}` : 'The model';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rebellm-bridge",
-  "version": "0.1.0",
+  "version": "0.1.3",
   "description": "Use the model in your RebeLLM browser tab from the command line, OpenAI/Anthropic clients and Claude Code",
   "keywords": [
     "rebellm",