heming

.dockerignore

@@ -0,0 +1,32 @@
+# Dependencies (rebuilt in container)
+node_modules
+
+# Git metadata
+.git
+.github
+.gitignore
+
+# Build output (rebuilt in container)
+dist
+
+# Env files — never bake secrets into the image
+.env
+.env.*
+
+# Logs and debug
+*.log
+npm-debug.log*
+bun-debug.log*
+
+# Test artifacts
+coverage
+.nyc_output
+
+# Editor / OS noise
+.DS_Store
+Thumbs.db
+.vscode
+.idea
+
+# Docker context itself
+docker

.env.example

@@ -0,0 +1,297 @@
+# =============================================================================
+# Claude Code CLI — Environment Variables
+# =============================================================================
+# Copy this file to .env and fill in the values you need.
+# All variables are optional unless noted otherwise.
+#
+# ─── HOW AUTHENTICATION WORKS ───────────────────────────────────────────────
+#
+# The CLI supports multiple authentication backends, resolved in this order:
+#
+# 1. PROVIDER SELECTION (src/utils/model/providers.ts — getAPIProvider()):
+#    Checks CLAUDE_CODE_USE_BEDROCK, CLAUDE_CODE_USE_VERTEX, or
+#    CLAUDE_CODE_USE_FOUNDRY. If set, routes to that 3rd-party provider.
+#    Otherwise uses Direct Anthropic API.
+#
+# 2. OAUTH vs API KEY DECISION (src/utils/auth.ts — isAnthropicAuthEnabled()):
+#    OAuth is DISABLED (API-key-only mode) when any of these are true:
+#      - --bare flag is used (sets CLAUDE_CODE_SIMPLE=1)
+#      - CLAUDE_CODE_USE_BEDROCK / VERTEX / FOUNDRY is set
+#      - ANTHROPIC_API_KEY env var is set (and not in managed OAuth context)
+#      - ANTHROPIC_AUTH_TOKEN env var is set
+#      - An apiKeyHelper is configured in settings
+#    If none of the above, OAuth is attempted via ~/.claude/.credentials.json.
+#
+# 3. API KEY RESOLUTION (src/utils/auth.ts — getAnthropicApiKey()):
+#    Priority order when OAuth is not active:
+#      a. CLAUDE_CODE_API_KEY_FILE_DESCRIPTOR (pipe-passed key)
+#      b. apiKeyHelper (configured external command in settings)
+#      c. ANTHROPIC_API_KEY env var
+#      d. System keychain
+#      e. ~/.claude/.credentials config
+#
+# 4. CLIENT CONSTRUCTION (src/services/api/client.ts — getAnthropicClient()):
+#    Creates the appropriate SDK client (Anthropic, Bedrock, Vertex, or
+#    Foundry) using the resolved auth credentials plus any custom headers
+#    from ANTHROPIC_CUSTOM_HEADERS.
+#
+# FOR DEVELOPMENT: The simplest path is to set ANTHROPIC_API_KEY below.
+# The auth system will detect the external key and skip OAuth entirely.
+# =============================================================================
+
+# ── Authentication ───────────────────────────────────────────────────────────
+# Your Anthropic API key (required for direct API access)
+ANTHROPIC_API_KEY=
+
+# Bearer auth token (alternative to API key — used by bridge/remote)
+# ANTHROPIC_AUTH_TOKEN=
+
+# Custom API base URL (default: https://api.anthropic.com)
+# ANTHROPIC_BASE_URL=
+
+# Custom headers sent with every API request (multiline, "Name: Value" per line)
+# ANTHROPIC_CUSTOM_HEADERS=
+
+# Add additional protection header to API requests
+# CLAUDE_CODE_ADDITIONAL_PROTECTION=true
+
+# Pipe-pass API key via file descriptor (advanced — for managed environments)
+# CLAUDE_CODE_API_KEY_FILE_DESCRIPTOR=
+
+# ── Model Selection ──────────────────────────────────────────────────────────
+# Override the default model
+# ANTHROPIC_MODEL=
+
+# Override the small/fast model used internally
+# ANTHROPIC_SMALL_FAST_MODEL=
+
+# Custom model overrides (name + description are optional display labels)
+# ANTHROPIC_DEFAULT_OPUS_MODEL=
+# ANTHROPIC_DEFAULT_OPUS_MODEL_NAME=
+# ANTHROPIC_DEFAULT_OPUS_MODEL_DESCRIPTION=
+# ANTHROPIC_DEFAULT_SONNET_MODEL=
+# ANTHROPIC_DEFAULT_SONNET_MODEL_NAME=
+# ANTHROPIC_DEFAULT_SONNET_MODEL_DESCRIPTION=
+# ANTHROPIC_DEFAULT_HAIKU_MODEL=
+# ANTHROPIC_DEFAULT_HAIKU_MODEL_NAME=
+# ANTHROPIC_DEFAULT_HAIKU_MODEL_DESCRIPTION=
+
+# Custom model option (shown alongside built-in models)
+# ANTHROPIC_CUSTOM_MODEL_OPTION=
+# ANTHROPIC_CUSTOM_MODEL_OPTION_NAME=
+# ANTHROPIC_CUSTOM_MODEL_OPTION_DESCRIPTION=
+
+# Model for sub-agents / teammates
+# CLAUDE_CODE_SUBAGENT_MODEL=
+
+# ── AWS Bedrock ──────────────────────────────────────────────────────────────
+# Enable Bedrock backend (uses AWS SDK default credentials: IAM, profile, env)
+# CLAUDE_CODE_USE_BEDROCK=true
+
+# Custom Bedrock endpoint URL
+# ANTHROPIC_BEDROCK_BASE_URL=
+
+# AWS region for Bedrock (default: us-east-1)
+# AWS_REGION=us-east-1
+# AWS_DEFAULT_REGION=us-east-1
+
+# Override AWS region specifically for the small fast model (Haiku)
+# ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION=
+
+# Bearer token auth for Bedrock (alternative to IAM)
+# AWS_BEARER_TOKEN_BEDROCK=
+
+# Skip Bedrock auth (for testing without real AWS credentials)
+# CLAUDE_CODE_SKIP_BEDROCK_AUTH=false
+
+# ── Google Vertex AI ─────────────────────────────────────────────────────────
+# Enable Vertex AI backend
+# CLAUDE_CODE_USE_VERTEX=true
+
+# Required: Your GCP project ID
+# ANTHROPIC_VERTEX_PROJECT_ID=
+
+# Default GCP region for all models
+# CLOUD_ML_REGION=us-east5
+
+# Model-specific region overrides (highest priority)
+# VERTEX_REGION_CLAUDE_3_5_HAIKU=
+# VERTEX_REGION_CLAUDE_HAIKU_4_5=
+# VERTEX_REGION_CLAUDE_3_5_SONNET=
+# VERTEX_REGION_CLAUDE_3_7_SONNET=
+
+# Custom Vertex base URL
+# ANTHROPIC_VERTEX_BASE_URL=
+
+# GCP service account credentials JSON file
+# GOOGLE_APPLICATION_CREDENTIALS=
+
+# Skip Vertex auth (for testing without real GCP credentials)
+# CLAUDE_CODE_SKIP_VERTEX_AUTH=false
+
+# ── Azure Foundry ────────────────────────────────────────────────────────────
+# Enable Azure Foundry backend
+# CLAUDE_CODE_USE_FOUNDRY=true
+
+# Azure resource name (creates URL: https://{resource}.services.ai.azure.com/...)
+# ANTHROPIC_FOUNDRY_RESOURCE=
+
+# Alternative: provide full base URL directly instead of resource name
+# ANTHROPIC_FOUNDRY_BASE_URL=
+
+# Foundry API key (if not set, uses Azure AD / DefaultAzureCredential)
+# ANTHROPIC_FOUNDRY_API_KEY=
+
+# Skip Foundry auth (for testing without real Azure credentials)
+# CLAUDE_CODE_SKIP_FOUNDRY_AUTH=false
+
+# ── Shell & Environment ─────────────────────────────────────────────────────
+# Override shell used for BashTool (default: auto-detected)
+# CLAUDE_CODE_SHELL=/bin/bash
+
+# Prefix prepended to every shell command
+# CLAUDE_CODE_SHELL_PREFIX=
+
+# Override temp directory
+# CLAUDE_CODE_TMPDIR=
+
+# ── Performance & Limits ─────────────────────────────────────────────────────
+# Maximum output tokens per response
+# CLAUDE_CODE_MAX_OUTPUT_TOKENS=
+
+# Maximum tokens when reading files
+# CLAUDE_CODE_FILE_READ_MAX_OUTPUT_TOKENS=
+
+# Idle timeout (minutes) before session ends (default: 75)
+# CLAUDE_CODE_IDLE_THRESHOLD_MINUTES=75
+
+# Idle token threshold (default: 100000)
+# CLAUDE_CODE_IDLE_TOKEN_THRESHOLD=100000
+
+# Node.js options (e.g. heap size)
+# NODE_OPTIONS=--max-old-space-size=8192
+
+# ── Features & Modes ────────────────────────────────────────────────────────
+# Enable simplified/worker mode (also set by --bare flag)
+# CLAUDE_CODE_SIMPLE=true
+
+# Enable coordinator (multi-agent) mode
+# CLAUDE_CODE_COORDINATOR_MODE=true
+
+# Enable proactive mode
+# CLAUDE_CODE_PROACTIVE=true
+
+# Enable experimental agent teams
+# CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=true
+
+# Enable task management
+# CLAUDE_CODE_ENABLE_TASKS=true
+
+# Enable prompt suggestions
+# CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=true
+
+# ── Accessibility & UX ──────────────────────────────────────────────────────
+# Enable accessibility mode
+# CLAUDE_CODE_ACCESSIBILITY=true
+
+# Disable terminal title updates
+# CLAUDE_CODE_DISABLE_TERMINAL_TITLE=true
+
+# Disable virtual scrolling
+# CLAUDE_CODE_DISABLE_VIRTUAL_SCROLL=true
+
+# Streamlined output (less verbose)
+# CLAUDE_CODE_STREAMLINED_OUTPUT=true
+
+# Disable syntax highlighting
+# CLAUDE_CODE_SYNTAX_HIGHLIGHT=false
+
+# ── Remote / Bridge ─────────────────────────────────────────────────────────
+# Enable remote execution mode
+# CLAUDE_CODE_REMOTE=true
+
+# Remote session ID
+# CLAUDE_CODE_REMOTE_SESSION_ID=
+
+# Environment kind (e.g. bridge)
+# CLAUDE_CODE_ENVIRONMENT_KIND=
+
+# OAuth token injected by bridge/CCR
+# CLAUDE_CODE_OAUTH_TOKEN=
+
+# OAuth refresh token for bridge
+# CLAUDE_CODE_OAUTH_REFRESH_TOKEN=
+
+# OAuth scopes
+# CLAUDE_CODE_OAUTH_SCOPES=
+
+# Session access token for remote
+# CLAUDE_CODE_SESSION_ACCESS_TOKEN=
+
+# Unix socket for SSH remote auth
+# ANTHROPIC_UNIX_SOCKET=
+
+# Entrypoint identifier (cli, mcp, remote, sdk-*, etc.)
+# CLAUDE_CODE_ENTRYPOINT=cli
+
+# ── Debugging ────────────────────────────────────────────────────────────────
+# Debug log level (error, warn, info, debug, trace)
+# CLAUDE_CODE_DEBUG_LOG_LEVEL=info
+
+# Debug logs directory
+# CLAUDE_CODE_DEBUG_LOGS_DIR=
+
+# Enable startup profiling
+# CLAUDE_CODE_PROFILE_STARTUP=true
+
+# General debug flag
+# DEBUG=true
+
+# ── Privacy & Telemetry ─────────────────────────────────────────────────────
+# Disable telemetry
+# DISABLE_TELEMETRY=true
+
+# Disable non-essential network traffic
+# CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=true
+
+# ── Proxy & Network ─────────────────────────────────────────────────────────
+# HTTPS proxy
+# HTTPS_PROXY=
+
+# Custom SSL certificate
+# SSL_CERT_FILE=
+
+# =============================================================================
+# ─── OAUTH STUB NOTES (Part D) ─────────────────────────────────────────────
+# =============================================================================
+#
+# The OAuth flow (src/services/oauth/) requires a browser and Anthropic's
+# OAuth endpoints. For development, you do NOT need to stub anything —
+# just set ANTHROPIC_API_KEY and the auth system will skip OAuth automatically.
+#
+# How it works:
+#   src/utils/auth.ts — isAnthropicAuthEnabled() checks whether OAuth should
+#   be attempted. When it detects ANTHROPIC_API_KEY in the environment (and
+#   the context is not a "managed OAuth" context like Claude Desktop), it
+#   returns false, which causes the entire OAuth path to be bypassed.
+#
+# Decision chain:
+#   1. isAnthropicAuthEnabled() in src/utils/auth.ts (line ~111)
+#      → returns false if external API key is detected
+#   2. isClaudeAISubscriber() in src/utils/auth.ts (line ~1715)
+#      → checks OAuth tokens for user:inference scope (never reached if #1 is false)
+#   3. getAnthropicApiKey() in src/utils/auth.ts (line ~201)
+#      → resolves API key from env/keychain/config
+#
+# If you needed to FORCE bypass OAuth in all cases (e.g. for testing the
+# OAuth code paths themselves), you could:
+#   - Use --bare flag (sets CLAUDE_CODE_SIMPLE=1, disables OAuth in isBareMode())
+#   - Set CLAUDE_CODE_USE_BEDROCK=true + CLAUDE_CODE_SKIP_BEDROCK_AUTH=true
+#     (routes around OAuth entirely but creates a Bedrock-shaped client)
+#   - Directly modify isAnthropicAuthEnabled() to return false (not recommended
+#     for production)
+#
+# Bottom line: export ANTHROPIC_API_KEY="sk-ant-..." is sufficient for dev.
+# =============================================================================
+
+

.github/CODEOWNERS

@@ -0,0 +1,16 @@
+# Global fallback — any unmatched file requires review from a core maintainer
+* @nirholas
+
+# Web frontend
+/web/ @nirholas
+
+# MCP server
+/mcp-server/ @nirholas
+
+# CI/CD infrastructure — changes need extra scrutiny
+/.github/ @nirholas
+/docker/ @nirholas
+/scripts/ @nirholas
+
+# Core CLI source
+/src/ @nirholas