fix(prompt): OCP_LOCAL_TOOLS wrapper no longer hard-codes a tool list (closes #185) (#191)

The positive local-tools wrapper (server.mjs) claimed the model has "full access
to the local filesystem, working directory, and shell through your available
tools (Bash, Read, Write, Edit, Glob, Grep, etc.)". That over-promises when an
operator narrows CLAUDE_ALLOWED_TOOLS (e.g. to Read,Grep): the model is told it
has Bash/Write/shell it doesn't hold, then attempts a non-granted tool and gets
denied. The default set matches the text, so the primary/OpenClaw path was fine —
but the enumeration was a prompt-honesty mismatch (flagged in the #182 fact-check).

Reworded to flip the POSTURE only ("you may use your available local tools … do
not assume access beyond the tool set provided to you in this session") without
enumerating specific tools or asserting shell/write capability. The model learns
its real tools from the tool definitions claude is given (--allowedTools), so the
enumeration was redundant as well as fragile — now honest under any allowed set.

No const reordering / no CONFIG_EPOCH change (still a constant; the epoch-fold
test confirms toggling still invalidates the cache with the new text). Test
markers updated (selectPromptWrapper unit + the boot-server integration assertion
that the positive wrapper reaches the -p spawn). Suite 449/0.

Rule 2: OCP-owned prompt composition, no wire change, no cli.js citation.

Closes #185

Co-authored-by: dtzp555 <dtzp555@gmail.com>
Co-authored-by: Claude <claude-opus-4-8> <noreply@anthropic.com>

docs/tui-mode.md

@@ -65,7 +65,7 @@ Then restart OCP. At boot you will see (with the env token set, isolated home au
 - **Callers see no API change.** The response is a normal OpenAI completion object or chunked SSE — identical wire format.
 - **Real streaming is opt-in (`OCP_TUI_STREAM=1`), and off by default.** By default TUI-mode buffers the full response and replays it as chunked SSE — you see a delay, then the complete response. Set `OCP_TUI_STREAM=1` and `stream:true` turns emit real SSE `delta.content` chunks as `claude` renders them, sourced from `claude`'s own `MessageDisplay` hook (byte-faithful raw markdown, on the subscription pool, no `-p`). Two honest caveats: granularity is **block-level** — the hook fires once per rendered block, so a handful of chunks per answer, scaling with length, not token-by-token; and it moves the **first** byte, not the last, so a consumer that must parse a complete reply gains nothing. The transcript stays authoritative: every streamed turn is asserted against it at the end, and a turn whose stream disagrees is **failed rather than served** (watch `tui.streamDivergences` on `/health`). Evidence: [`plans/2026-07-13-tui-latency/streaming-spike.md`](plans/2026-07-13-tui-latency/streaming-spike.md).
 - **Cache and singleflight work normally.** TUI-mode writes the buffered response to the cache on success; cache-hits skip the interactive turn entirely.
-- **The host's `CLAUDE.md` / auto-memory is never injected.** OCP is a proxy — the proxied client (OpenClaw / your IDE) owns its own context and memory. TUI-mode always runs `claude` with `CLAUDE_CODE_DISABLE_CLAUDE_MDS` + `CLAUDE_CODE_DISABLE_AUTO_MEMORY`, so a `CLAUDE.md` on the OCP host can never leak into proxied turns (verified live; see #4). Built-in tool schemas + the interactive system prompt remain (the inherent ~20–35K context floor of interactive mode); MCP is hard-disabled.
+- **The host's `CLAUDE.md` / auto-memory is never injected.** OCP is a proxy — the proxied client (OpenClaw / your IDE) owns its own context and memory. TUI-mode runs `claude` with `--safe-mode`, which disables all host customizations (CLAUDE.md, skills, plugins, hooks, MCP servers) while leaving auth, model selection, built-in tools, and permissions untouched — so a `CLAUDE.md` on the OCP host can never leak into a proxied turn and steer the answer, and the session still bills the subscription pool (`cc_entrypoint=cli`, unlike `--bare`). The `CLAUDE_CODE_DISABLE_CLAUDE_MDS` / `CLAUDE_CODE_DISABLE_AUTO_MEMORY` env vars are kept as a fallback (see #4). Built-in tool schemas + the interactive system prompt remain (the inherent ~20–35K context floor of interactive mode); MCP is hard-disabled. **Exception:** the two opt-in modes that deliberately need a customization `--safe-mode` would strip — real streaming (`OCP_TUI_STREAM`, which registers a `MessageDisplay` **hook** via `--settings`) and `OCP_TUI_FULL_TOOLS` (which grants an **MCP** / skills surface) — run without `--safe-mode` and rely on the env-var suppression alone.
 - **Authenticate via `CLAUDE_CODE_OAUTH_TOKEN` in a credential-isolated home (recommended).** tmux does not forward the parent process's env to the pane, so OCP sets the token explicitly on the spawned `claude` when `CLAUDE_CODE_OAUTH_TOKEN` is present. With the env token set and `OCP_TUI_HOME` unset, OCP runs claude in a **credential-isolated home** (`$HOME/.ocp-tui/home`) that has **no `credentials.json`** — so the env token is the only credential and is authoritative, and claude never runs the token-refresh path. This both stops a stale `credentials.json` from shadowing the token and ends the refresh-token corruption behind the permanent `Please run /login · API Error: 401` (full two-layer root cause, live proof, and fix in [Troubleshooting § the permanent TUI-mode 401](troubleshooting.md#tui-401)). Transcripts land under the same isolated home, so the answer-reader is unaffected. Without the env token, claude falls back to the real home's `credentials.json` (byte-for-byte the previous behaviour). (The token is visible in `ps` on the pane command — acceptable for the single-user A-path; the multi-user B-path is refused at boot.) See ADR 0007 PR-C / PR-D amendments.
 - **Stale tmux sessions are reaped.** The pane's `claude` is a child of the tmux server (not OCP), so OCP cannot reap it directly; `claude` zombies can otherwise accumulate as `<defunct>` over a long-running host. OCP reaps them at boot and on a 15-min idle sweep by issuing `tmux kill-server` — but **only when no foreign tmux session remains** (it never disrupts a co-hosted `olp-tui-*` instance). See ADR 0007 PR-C amendment.
 - **Default path unchanged.** Unset `CLAUDE_TUI_MODE` and restart → `callClaude` / `callClaudeStreaming` are used again, byte-for-byte identical to today.

lib/tui/session.mjs

@@ -182,8 +182,13 @@ function tuiCapturePane(tmux, tmuxName) {
 }
 
 // True once claude's input bar is rendered and ready for keystrokes.
+// Two known ready-state footers across claude versions: the classic `? for shortcuts`
+// hint, and the `shift+tab to cycle` hint (part of "⏵⏵ bypass permissions on (shift+tab
+// to cycle)") that newer claude 2.1.x renders in its place. Match EITHER — a matcher that
+// only knew the classic string silently reported "never ready" on those builds, timing out
+// every boot (tui_pane_not_ready) and, with the warm pool on, failing every pre-boot.
 function tuiInputReady(pane) {
-  return /\? for shortcuts/.test(pane);
+  return /\? for shortcuts|shift\+tab to cycle/.test(pane);
 }
 
 // True once the pasted prompt has POSITIVELY landed in the input box. We only trust
@@ -384,9 +389,15 @@ export function buildTuiCmd(claudeBin, model, sessionId, ehome, entrypointMode,
   // CLAUDE.md and auto-memory must NEVER leak into the agent OCP runs on the user's behalf.
   // Without these, claude loads the host's project/user CLAUDE.md + memory into every proxied
   // turn — verified live 2026-06-02: a cwd CLAUDE.md ("end every reply with QUACKMARKER_42") was
-  // obeyed by the proxied turn until these flags were set, after which it was not. Unconditional
+  // obeyed by the proxied turn until these flags were set, after which it was not. Mirrors the
-  // by design (not gated): proxy purity is not an opt-in. Harmless on hosts with no CLAUDE.md
+  // -p path's CLAUDE_NO_CONTEXT vars. Harmless on hosts with no CLAUDE.md (they suppress nothing).
-  // (the common case — they suppress nothing). Mirrors the -p path's CLAUDE_NO_CONTEXT vars.
+  //
+  // These env vars stopped being sufficient on newer claude: they are present in the pane's
+  // environment yet the host CLAUDE.md is still injected into the turn's context, so a proxied
+  // turn again obeys the operator's private CLAUDE.md instead of the caller's prompt — a leak of
+  // the operator's private context into API responses. The robust suppression is the --safe-mode
+  // flag added to the argv below; these env vars are kept as belt-and-braces for the two argv
+  // paths that cannot take --safe-mode (see the safeModeArgs note near the return).
   const sets = [
     `HOME=${shq(ehome)}`,
     "DISABLE_AUTOUPDATER=1",
@@ -477,9 +488,32 @@ export function buildTuiCmd(claudeBin, model, sessionId, ehome, entrypointMode,
   // so the OFF argv is byte-for-byte the pre-streaming argv.
   const settingsArgs = stream && stream.settings ? ["--settings", shq(stream.settings)] : [];
 
+  // --safe-mode: disable ALL customizations (host CLAUDE.md, skills, plugins, hooks, MCP
+  // servers, custom commands/agents, output styles, ...) while leaving auth, model selection,
+  // built-in tools, and permissions untouched (claude 2.1.216 --help). This is the robust
+  // replacement for the CLAUDE_CODE_DISABLE_CLAUDE_MDS / _AUTO_MEMORY env vars above, which no
+  // longer suppress the host CLAUDE.md on newer claude — so the operator's private CLAUDE.md
+  // could otherwise leak into a proxied API response. Unlike --bare, --safe-mode does NOT drop
+  // the interactive session off the subscription pool (it keeps auth + model selection), so the
+  // billing classifier stays cc_entrypoint=cli.
+  //
+  // NOT applied when the pane deliberately relies on a customization --safe-mode would strip,
+  // because those would break SILENTLY:
+  //   - streaming (settingsArgs present): the MessageDisplay hook is a HOOK, which --safe-mode
+  //     disables — every streamed turn would then fire zero deltas (tui.streamZeroDeltaTurns)
+  //     and fall back to buffered, defeating OCP_TUI_STREAM.
+  //   - OCP_TUI_FULL_TOOLS=1: grants an MCP / skills / agent surface (--mcp-config, ...) that
+  //     --safe-mode disables wholesale.
+  // Those two opt-in paths keep the env-var suppression above as their best-effort fallback.
+  const safeModeArgs =
+    settingsArgs.length === 0 && process.env.OCP_TUI_FULL_TOOLS !== "1"
+      ? ["--safe-mode"]
+      : [];
+
   return [
     envPrefix,
     shq(claudeBin),
+    ...safeModeArgs,
     "--model",          shq(model),
     "--session-id",     sessionId,
     ...toolArgs,
@@ -615,8 +649,9 @@ export async function bootTuiPane({
 //      A pooled pane is SINGLE-USE: it already carries its own fresh --session-id, it
 //      serves this one turn, and it is killed in the finally like any other pane.
 //   2. On a MISS: pre-trust the scratch cwd, boot an interactive `claude` in a fresh tmux
-//      session in the scratch cwd, poll capture-pane until the `? for shortcuts` input bar
+//      session in the scratch cwd, poll capture-pane until the input bar appears — see
-//      appears (bootTuiPane). BOOT_MS is the max wait, not a fixed delay.
+//      tuiInputReady for the ready-state footers matched (bootTuiPane). BOOT_MS is the max
+//      wait, not a fixed delay.
 //   3. Write prompt to a 0600 temp file (no shell injection from prompt content).
 //   4. Paste the prompt via tmux load-buffer + paste-buffer -p (bracketed paste) —
 //      reliable for large multi-line prompts where send-keys -l is not (issue #130).

server.mjs

@@ -204,7 +204,7 @@ const OCP_SYSTEM_PROMPT_WRAPPER = `You are accessed via the OCP HTTP proxy. You
 // default wrapper above is byte-for-byte unchanged. Selecting the positive wrapper does NOT expand
 // the tool surface (governed independently by --allowedTools/--disallowedTools) — it only changes the
 // prompt — and is boot-gated below (multi/non-loopback/anon → refuse) mirroring OCP_TUI_FULL_TOOLS.
-const OCP_LOCAL_TOOLS_WRAPPER = `You are accessed via the OCP HTTP proxy running on the operator's own machine. You have full access to the local filesystem, working directory, and shell through your available tools (Bash, Read, Write, Edit, Glob, Grep, etc.). Use them as needed to complete the operator's requests.`;
+const OCP_LOCAL_TOOLS_WRAPPER = `You are accessed via the OCP HTTP proxy running on the operator's own machine. Unlike the shared-gateway posture, you may use your available local tools to act on the operator's machine as the task requires. Use only the tools you actually have — do not assume filesystem, shell, or other access beyond the tool set provided to you in this session.`;
 
 // OCP_LOCAL_TOOLS is inert in TUI mode: the interactive (non-`-p`) path composes its own prompt via
 // callClaudeTui/messagesToPrompt and never calls extractSystemPrompt, so the wrapper is only ever

test-features.mjs

@@ -910,7 +910,7 @@ test("appendOperatorPrompt: operator value is trimmed before appending", () => {
 console.log("\nOCP_LOCAL_TOOLS wrapper + safety gate:");
 
 const NEG = "You do NOT have access to any local filesystem";
-const POS = "You have full access to the local filesystem";
+const POS = "you may use your available local tools";
 
 test("selectPromptWrapper: default (disabled) returns the negative wrapper BYTE-IDENTICAL", () => {
   // Mutation-proof: flip the ternary and the default path leaks the positive wrapper.
@@ -967,7 +967,7 @@ import { fileURLToPath as _ltF2P } from "node:url";
 const LT_SERVER = _ltF2P(new URL("./server.mjs", import.meta.url));
 const LT_POSIX = process.platform !== "win32"; // fake is a /bin/sh script; CI is POSIX
 const LT_NEG_MARK = "You do NOT have access to any local filesystem";
-const LT_POS_MARK = "You have full access to the local filesystem";
+const LT_POS_MARK = "you may use your available local tools";
 // Fake claude: record the --system-prompt it was spawned with, bump an optional spawn counter,
 // then emit a minimal valid stream-json response so the request completes (and caches).
 const LT_FAKE = `#!/bin/sh
@@ -2209,10 +2209,32 @@ console.log("\nTUI command construction (proxy-purity / #4):");
 test("buildTuiCmd suppresses host CLAUDE.md + auto-memory (proxy purity, #4)", () => {
   const cmd = buildTuiCmd("/usr/bin/claude", "claude-haiku", "sid-1", "/home/u", "cli");
   // OCP is a proxy: the host's CLAUDE.md / auto-memory must never leak into the proxied turn.
+  // Primary mechanism is --safe-mode (env vars alone stopped suppressing on newer claude);
+  // the env vars remain as belt-and-braces.
+  assert.ok(/(^| )--safe-mode( |$)/.test(cmd), "default pane must pass --safe-mode (disables host CLAUDE.md/skills/plugins/hooks)");
   assert.ok(/(^| )CLAUDE_CODE_DISABLE_CLAUDE_MDS=1( |$)/.test(cmd), "must disable CLAUDE.md injection");
   assert.ok(/(^| )CLAUDE_CODE_DISABLE_AUTO_MEMORY=1( |$)/.test(cmd), "must disable auto-memory injection");
 });
 
+test("buildTuiCmd omits --safe-mode when a customization it would strip is in use", () => {
+  const save = process.env.OCP_TUI_FULL_TOOLS;
+  try {
+    delete process.env.OCP_TUI_FULL_TOOLS;
+    // streaming registers a MessageDisplay HOOK via --settings; --safe-mode would kill the hook
+    // (zero deltas), so it must be omitted on the streaming pane.
+    const streaming = buildTuiCmd("/usr/bin/claude", "m", "sid-s", "/home/u", "cli", { file: "/d/sid-s.jsonl", settings: "/d/s.json" });
+    assert.ok(!/--safe-mode/.test(streaming), "streaming pane must NOT pass --safe-mode (would disable the MessageDisplay hook)");
+    assert.ok(streaming.includes("--settings '/d/s.json'"), "streaming pane keeps its --settings hook");
+
+    // OCP_TUI_FULL_TOOLS grants an MCP/skills surface --safe-mode disables wholesale.
+    process.env.OCP_TUI_FULL_TOOLS = "1";
+    const full = buildTuiCmd("/usr/bin/claude", "m", "sid-f", "/home/u", "cli");
+    assert.ok(!/--safe-mode/.test(full), "full-tools pane must NOT pass --safe-mode (would disable MCP/skills)");
+  } finally {
+    if (save === undefined) delete process.env.OCP_TUI_FULL_TOOLS; else process.env.OCP_TUI_FULL_TOOLS = save;
+  }
+});
+
 test("buildTuiCmd keeps version pin + entrypoint label + MCP wall", () => {
   const cli = buildTuiCmd("/usr/bin/claude", "m", "sid-2", "/home/u", "cli");
   assert.ok(cli.includes("DISABLE_AUTOUPDATER=1"), "version pin retained");
@@ -3504,7 +3526,7 @@ if (process.env.OCP_TUI_LIVE === "1") {
 // Replicates tuiInputReady, tuiPromptLanded verbatim from lib/tui/session.mjs.
 // Keep in sync with the definitions there.
 function _tuiInputReady(pane) {
-  return /\? for shortcuts/.test(pane);
+  return /\? for shortcuts|shift\+tab to cycle/.test(pane);
 }
 function _tuiPromptLanded(pane, prompt) {
   const flatPane = pane.replace(/\s+/g, " ");
@@ -3522,7 +3544,12 @@ const TUI_READY_PANE = `❯ Try "how does <filepath> work?"
 const TUI_LANDED_PANE = `❯ Reply with exactly: PONG_TEST
   ? for shortcuts · ← for agents`;
 
-// Welcome splash shown before input bar is rendered — no `? for shortcuts`.
+// Newer claude 2.1.x renders the input bar with a `shift+tab to cycle` footer instead of
+// `? for shortcuts` — the matcher must accept it too, or the pane reads as never-ready.
+const TUI_READY_PANE_SHIFT_TAB = `❯ Try "how does <filepath> work?"
+  ⏵⏵ bypass permissions on (shift+tab to cycle)`;
+
+// Welcome splash shown before input bar is rendered — neither ready-state footer.
 const TUI_BOOT_PANE = `╭─ Claude Code v2.1.114 ─ Welcome back Tao! ─╮\n│ Tips for getting started │`;
 
 console.log("\nTUI readiness + paste-verify predicates (issue #130):");
@@ -3533,6 +3560,9 @@ test("tuiInputReady(READY_PANE) === true  (input bar rendered)", () => {
 test("tuiInputReady(LANDED_PANE) === true  (input bar still present after paste)", () => {
   assert.equal(_tuiInputReady(TUI_LANDED_PANE), true);
 });
+test("tuiInputReady(READY_PANE_SHIFT_TAB) === true  (newer claude `shift+tab to cycle` footer)", () => {
+  assert.equal(_tuiInputReady(TUI_READY_PANE_SHIFT_TAB), true);
+});
 test("tuiInputReady(BOOT_PANE) === false  (welcome splash, no input bar yet)", () => {
   assert.equal(_tuiInputReady(TUI_BOOT_PANE), false);
 });
@@ -4523,13 +4553,17 @@ test("stream: sink path is keyed by session_id (concurrent panes cannot interlea
   assert.ok(A.endsWith("/aaaa-1111.jsonl"));
 });
 
-test("stream: buildTuiCmd — OFF is byte-for-byte the pre-streaming argv; ON adds only env + --settings", () => {
+test("stream: buildTuiCmd — streaming ON adds env + --settings and drops --safe-mode (hook survives)", () => {
   const off = buildTuiCmd("/bin/claude", "m", "SID", "/h", "cli");
   assert.ok(!off.includes("--settings"), "no --settings when streaming is off");
   assert.ok(!off.includes("OCP_TUI_STREAM_FILE"), "no sink env when streaming is off");
+  assert.ok(off.includes("--safe-mode"), "the non-streaming pane carries --safe-mode");
   const on = buildTuiCmd("/bin/claude", "m", "SID", "/h", "cli", { file: "/d/SID.jsonl", settings: "/d/s.json" });
   assert.ok(on.includes("OCP_TUI_STREAM_FILE='/d/SID.jsonl'"), "sink delivered via the pane env");
   assert.ok(on.includes("--settings '/d/s.json'"));
+  // --safe-mode would disable the MessageDisplay hook registered by --settings, so the
+  // streaming pane must NOT carry it (it keeps the env-var suppression instead).
+  assert.ok(!on.includes("--safe-mode"), "streaming pane omits --safe-mode so the hook fires");
   // must not regress the MCP wall or the pinned effort (#156)
   assert.ok(on.includes("--strict-mcp-config") && on.includes("--disallowedTools 'mcp__*'"), "MCP wall intact");
   assert.ok(on.includes("--effort low"), "OCP_TUI_EFFORT default intact");