Merge pull request 'Re-add claude-subscription LiteLLM route — confirmed working for the real CLI' (#13) from feat/litellm-claude-subscription-route into main

Reviewed-on: #13

docker-compose.yml

@@ -78,15 +78,20 @@ services:
       MATRIX_ALLOWED_USERS: ${MATRIX_HUMAN_USER_ID}
       MATRIX_REQUIRE_MENTION: "true"
       OPENROUTER_API_KEY: ${OPENROUTER_API_KEY}
-      # Exposed on the internal network only (see claude-agent's LITELLM_BASE_URL-style
+      # Left disabled: Hermes itself warns that a network-reachable API server combined
-      # usage pattern) — nothing publishes this port externally.
+      # with the default unsandboxed ('local') terminal backend gives any caller full
-      API_SERVER_ENABLED: "true"
+      # terminal/file access within the container. Matrix is the actual interface in use;
-      API_SERVER_HOST: 0.0.0.0
+      # re-enable (API_SERVER_HOST: 0.0.0.0) only alongside terminal.backend: docker if
-      API_SERVER_KEY: ${HERMES_API_SERVER_KEY}
+      # claude-agent ever needs to call Hermes programmatically.
+      API_SERVER_ENABLED: "false"
     volumes:
       - /home/william/hermes-data:/opt/data
     networks:
       - web
+    # Without this the image's default command launches the interactive CLI, which
+    # immediately exits ("Input is not a terminal") since a detached container has no
+    # stdin — the container then just sits there having done nothing, every restart.
+    command: ["gateway", "run"]
 
   claude-agent:
     image: ${GITEA_REGISTRY_IMAGE}

litellm-config.yaml

@@ -11,13 +11,19 @@ model_list:
       model: openrouter/openai/gpt-4o-mini
       api_key: os.environ/OPENROUTER_API_KEY
 
-  # NOT included: a "claude-subscription" route forwarding the Claude Pro/Max OAuth token
+  # Routes to Anthropic using the CALLER's forwarded Authorization header (the Claude
-  # (from `claude setup-token`) through to Anthropic's raw API. Tested and confirmed
+  # Pro/Max subscription OAuth token) instead of a LiteLLM-held API key — billed against
-  # non-functional — Anthropic returns a generic rate_limit_error for ANY direct API call
+  # the subscription, not per-token. CONFIRMED WORKING, but only for the real `claude`
-  # using this token type outside the real Claude Code CLI client (reproduced with plain
+  # CLI binary as caller (tested: `claude -p` with ANTHROPIC_BASE_URL pointed here
-  # curl straight to api.anthropic.com, bypassing LiteLLM entirely, same result). The
+  # returned a real completion). An earlier test with plain curl replicating the same
-  # subscription token only works through the actual Claude Code CLI, which is what
+  # request shape failed — Anthropic apparently requires header/fingerprint details only
-  # claude-agent already uses directly for code tasks — it was never routed through here.
+  # the real CLI sends, which LiteLLM faithfully relays but a hand-built request won't
+  # have. Do NOT expect this to work for other callers (Hermes, generic HTTP clients) —
+  # they aren't the real CLI and can't reproduce that fingerprint.
+  - model_name: anthropic-claude
+    litellm_params:
+      model: anthropic/claude-sonnet-5
 
 general_settings:
+  forward_client_headers_to_llm_api: true
   master_key: os.environ/LITELLM_MASTER_KEY