Roll up #42/#43, GHCR image workflow, and durable SQLite sessions with SDK resume

[brandonros]

Summary

This PR rolls up four streams of work into RichardAtCT:main:

1. gustavokch's contributions (equivalent to #42, minus the Gemini proxy — see below)
2. prodigy-sln's security audit (equivalent to #43)
3. operator ergonomics: env knobs, GHCR image workflow, and landing-page cleanup
4. durable sessions: SQLite-backed sessions with native Claude SDK resume

The branch is up to date with main, including #46 (live model list) and the ^0.2.159 SDK bump.

Conflicts between (1) and (2) were resolved by hand so both sets of fixes coexist (notes below). If #42 and #43 merge separately first, this PR still applies cleanly on top because it was built from the same merge bases.

What's included

From gustavokch (PR #42)

• Critical bug fixes: continue_session → continue_conversation (sessions now actually continue), max_thinking_tokens wiring, real SDK token counts, proper stop_reason → OpenAI finish_reason mapping
• Async session management: threading.Lock → asyncio.Lock; all SessionManager methods converted to async
• Concurrency: removed the os.environ mutex — auth passed via options.env so SDK calls run fully concurrent
• Perf: parallel CLI prewarming, MAX_CONCURRENT_PROCESSES semaphore
• SDK options: reasoning_effort, response_format, thinking, max_budget_usd, user field forwarded
• Streaming fixes: AssistantMessage / ContentBlockDelta handling, conversational fallbacks, timeout on query()
• Session/model-switch fixes, content-filter refinement
• Deps: poetry.lock + test suite updated for pydantic 2.13 / poetry 2.3

From prodigy-sln (PR #43)

• Redaction of sensitive info in logs and validation errors (redact_key, redact_request_body, [REDACTED] debug strings)
• Session limits: MAX_SESSIONS, MAX_SESSION_MESSAGES, SessionLimitExceeded, check_session_limit() pre-check for streaming paths
• Rate limiting: TRUSTED_PROXIES / X-Forwarded-For validation via slowapi
• CORS / endpoint hardening: CORS_ORIGINS, minimal /v1/auth/status (doesn't leak auth method), X-Claude-Model-Warning header for unrecognized models
• Filesystem sandboxing: CLAUDE_CWD_ALLOWED_BASE for the CWD escape guard
• Build: multi-stage Dockerfile + non-root user
• Deps: SDK pin tightened (superseded by upstream's ^0.2.159)

Operator ergonomics (new in this PR)

• CI: GitHub Actions workflow publishes container to ghcr.io/<owner>/claude-code-openai-wrapper on push-to-main / workflow_dispatch
• Model list: static fallback list updated to the Claude 5.5 generation: claude-opus-5-5, claude-sonnet-5-5, claude-haiku-5-5 first, then Fable 5.x, Claude 5, and still-served 4.x models. Drops the retired claude-opus-4-1-20250805 and the invalid claude-opus-4-5-20250929 id. Fallback DEFAULT_MODEL is now claude-sonnet-5-5 and FAST_MODEL is claude-haiku-5-5. Dated snapshots of a listed alias count as recognized (no X-Claude-Model-Warning). CLAUDE_MODELS_OVERRIDE and FAST_MODEL themselves landed upstream in feat: dynamically refresh Anthropic model list #46
• DISALLOWED_TOOLS env var — comma-separated tool slugs; default is [] so operators opt in explicitly
• .env loading fix: constants.py and rate_limiter.py read env vars at import time, but load_dotenv() ran later in main.py/auth.py, so .env values for those settings were ignored. .env now loads once in src/__init__.py
• Landing page: extracted the 591-line HTML f-string in src/main.py to src/templates/landing.html + string.Template-based substitution; main.py drops ~592 lines, JS/CSS braces no longer need {{ }} escaping

Durable sessions (new in this PR)

Sessions used to live in an in-memory dict, and every turn replayed the full history into a fresh SDK session.

• SQLite persistence: sessions are stored in SESSION_DB_PATH (default ~/.claude-wrapper/sessions.db; :memory: disables) and restored on startup
• Native SDK resume: each wrapper session records the SDK session that produced its last reply. When the next request's history extends it, the wrapper resumes that SDK session and sends only the new messages
• Transcript mirroring: SDK transcripts are mirrored into the same SQLite file through a SessionStore adapter keyed by SDK session ID, so resume works after a restart even with a fresh temp workspace
• Fallback: edited or regenerated history, a new system message, or a failed resume falls back to replaying the full history into a fresh SDK session
• Limits: one replica per database file (use sticky sessions if you run more than one); past MAX_SESSION_MESSAGES the stored history is trimmed and turns fall back to replay

Explicitly excluded

• Gemini CLI proxy: gustavokch's PR Fix proxy bugs, improve concurrency, and update SDK options #42 adds Gemini support; this PR deliberately removes it. Rationale: scope creep for a Claude wrapper. All Gemini-specific files (src/gemini_cli.py, tests, GEMINI_MODELS, GEMINI_API_KEY auth path, is_gemini message-adapter branches, the /v1/models Gemini listing, the Docker Node.js prewarm branch for Gemini) are gone. prodigy-sln's security fixes were re-verified intact after the removal.

Notable conflict resolutions

• src/session_manager.py: took gustavokch's async rewrite, then ported prodigy's check_session_limit() to async and kept the max_messages field on Session. All callers of check_session_limit now await.
• src/constants.py: kept CLAUDE_MODELS_OVERRIDE env mechanism and put claude-opus-4-7 at the head of the list; merged prodigy's fuller 4.x family + "Claude 4+ only" note.
• src/main.py: kept prodigy's security hardenings (redacted debug logging, redact_request_body() on validation errors, minimal /v1/auth/status, model-warning header) while adopting gustavokch's real-metadata usage / stop_reason extraction.
• Merge with upstream main (feat: dynamically refresh Anthropic model list #46, aaad0b9): took upstream's live model discovery and ^0.2.159 SDK pin; regenerated poetry.lock for python = "^3.12".

Test plan

• Test suite passes locally: 553 passed, 30 skipped (includes 20 new tests in tests/test_session_persistence.py)
• Live: resume from SQLite after deleting the local transcript and starting in a new temp workspace (model recalled context from the earlier turn)
• Live: resuming a nonexistent SDK session falls back to a full-history replay and answers correctly
• Live: claude-opus-5-5, claude-sonnet-5-5, claude-haiku-5-5 work through the SDK, with and without max_thinking_tokens
• .env values for SESSION_DB_PATH, MAX_SESSIONS, FAST_MODEL now take effect
• Manual: /v1/chat/completions non-streaming returns real token counts from SDK metadata
• Manual: /v1/chat/completions streaming — no echo, proper finish_reason
• Manual: /v1/messages (Anthropic shape) returns correct stop_reason + usage
• Manual: session reuse across requests through the HTTP endpoints, including after a server restart
• Manual: SessionLimitExceeded returns HTTP 429 on new session beyond MAX_SESSIONS (prodigy)
• Manual: /v1/auth/status does not leak auth method to unauthenticated callers (prodigy FR-7.2)
• Manual: CLAUDE_MODELS_OVERRIDE=foo,bar overrides /v1/models
• Manual: landing page renders; JSON endpoints render in expandable accordions
• Docker image builds on GHCR workflow

[brandonros]

Updated this branch:

• Merged current main (feat: dynamically refresh Anthropic model list #46 and the ^0.2.159 SDK bump) and resolved the conflicts. CLAUDE_MODELS_OVERRIDE and FAST_MODEL now come from upstream.
• Durable sessions: sessions are stored in SQLite and each one is backed by a native Claude SDK session. Follow-up turns resume it and send only the new messages instead of replaying the whole history, and this works across restarts.
• .env loading fix: settings read at import time (MAX_SESSIONS, FAST_MODEL, etc.) were ignoring .env.

Tests: 553 passed, 30 skipped. The description is updated with details.

[brandonros]

Closing this PR. After using it as the backend for Open WebUI and for a Temporal workflow, I don't think the approach is the right one, and I'd rather explain why than leave it open.

What the project tries to do: make Claude Code look like an OpenAI Chat Completions model, so any OpenAI client can use it.

Why that doesn't hold up:

1. For plain chat, it isn't needed. Anthropic's API already serves Claude to OpenAI-style clients (https://api.anthropic.com/v1), and Open WebUI connects to Anthropic natively. If you want a model behind a chat box, call the model.
2. For agent use, the Chat Completions format can't carry what matters. Claude Code's value is the agent: tool calls and their results, thinking, subagents, permission prompts, interruption, and a session with real tool context. Chat Completions has room for one final text answer. Everything that makes an agent understandable and controllable gets dropped, and the client is left guessing.
3. Session state ends up in two places. The client holds a message history and the server holds a Claude session. Neither is complete, and keeping them in sync is guesswork. Small bugs come out of that, such as system prompts silently dropped, errors returned as successful replies, and a "tools off" mode that isn't. But they're symptoms. The mismatch is in the design.
4. The Agent SDK is already the integration point. It's a library meant to be embedded. Wrapping it in a lossy chat API and then re-encoding agent behaviour through headers and extension fields adds a layer without adding capability.

What I'd do instead:

• A chat UI with plain Claude: connect it to Anthropic's API directly.
• A chat UI driving Claude Code: run the Agent SDK in a small service that streams its own events. Then give the UI a thin adapter (for Open WebUI, a pipe) that renders tool calls, results and approvals with the UI's built-in components.
• Background workflows: embed the Agent SDK in the workflow's activity, or call that same event-streaming service. Not a chat endpoint.
• Or let Anthropic host it: Managed Agents provides the agent loop, sandbox, sessions and an event stream.

Thanks for the project. It was a useful way to discover all of this.