mirror of
https://github.com/dtzp555-max/ocp.git
synced 2026-07-26 23:45:08 +00:00
Compare commits
3
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
  taodengandClaude <claude-opus-4-8> <noreply@anthropic.com>
|
9df622c7f8 | ||
|
taodeng
|
2ad8a5245d | ||
|
taodengandClaude <claude-opus-4-8> <noreply@anthropic.com>
|
4143993e3b |
@@ -30,7 +30,6 @@ Runtime: Node.js (ESM, `.mjs` throughout). No build step. No bundler. `server.mj
|
||||
|
||||
- `server.mjs` — the proxy itself; every request path lives here. Governed by `ALIGNMENT.md`.
|
||||
- `models.json` — single source of truth for model IDs, aliases, and context windows. See ADR 0003.
|
||||
- `models.schema.json` — the schema `models.json` declares in its `$schema`. CI validates the SPOT against it (`test-features.mjs`) using the repo's own `validateJsonSchema`, so a malformed entry fails the build instead of surfacing downstream in OpenClaw.
|
||||
- `setup.mjs` — first-time installer; reads `models.json` to derive bootstrap config.
|
||||
- `scripts/sync-openclaw.mjs` — idempotent OpenClaw registry sync invoked by `ocp update`. See ADR 0004.
|
||||
- `ocp` — user-facing CLI (install, update, start, stop, status, logs, etc.).
|
||||
|
||||
@@ -1,48 +1,5 @@
|
||||
# Changelog
|
||||
|
||||
## v3.25.0 — 2026-07-27
|
||||
|
||||
Minor release. Headline: **Claude Opus 5** joins the model list and the `opus` alias now resolves to it. Alongside it, two `server.mjs` correctness fixes found by review rather than by users — a monotonic in-flight-counter leak, and cache keys that were hashing the alias string instead of the model it resolves to. The three TUI/prompt fixes that landed after v3.24.0 are included here too.
|
||||
|
||||
Every code PR carried an independent fresh-context reviewer (Iron Rule 10); #192 additionally went through the external codex gate, which is what surfaced the cache-key defect. No new endpoint, no new env var, no new `cli.js` wire behavior.
|
||||
|
||||
### Added
|
||||
|
||||
- **Claude Opus 5 (`claude-opus-5`) (#192).** New `models.json` entry — `/v1/models` goes 6 → 7 and OpenClaw picks it up on the next `ocp update` (via `scripts/sync-openclaw.mjs`). Verified against the installed CLI rather than assumed: the compiled `claude` 2.1.220 bundle carries `latest_per_family:{fable:"claude-fable-5",opus:"claude-opus-5",sonnet:"claude-sonnet-5",haiku:"claude-haiku-4-5"}`. Availability confirmed with a live `claude -p --model claude-opus-5` completion on the subscription pool. `claude-opus-4-8` is retained for pinning.
|
||||
- `contextWindow` is deliberately **200000**, not Opus 5's native 1M. Two reasons, both verified: (1) `MAX_PROMPT_CHARS` is a **single global** budget — `derivePromptCharBudget` takes `max(contextWindow) × 3` across *all* entries (`lib/prompt.mjs`), so a 1M entry would raise the truncation ceiling to 3,000,000 chars for `claude-haiku-4-5` too, which is genuinely 200k native, converting clean OCP-side truncation into an upstream API rejection; (2) OpenClaw scales its history budget linearly off this value (`contextWindow × maxHistoryShare × SAFETY_MARGIN` = `× 0.6`, plus an oversized-message threshold at `× 0.5`, per `compaction-planning` in OpenClaw 2026.7.1), and its own bundled registry hardcodes 200000 for Claude — the upstream request to raise it to 1M ([openclaw#22979](https://github.com/openclaw/openclaw/issues/22979)) was closed *not planned*. A new regression test pins the invariant so a future 1M entry has to be a deliberate, reviewed change. Raising it for real needs per-model budgets — tracked separately, ADR-level.
|
||||
|
||||
### Changed
|
||||
|
||||
- **The `opus` alias now resolves to `claude-opus-5` instead of `claude-opus-4-8` (#192).** Every request that names `opus` — and OpenClaw's opus entry — moves to Opus 5 on upgrade. This mirrors what the CLI itself defaults to (`latest_per_family.opus` above), the same reasoning as #168's `sonnet` → `claude-sonnet-5` repoint in v3.23.0. **Pricing is unchanged** ($5/$25 per MTok; CLI registry `pricing:"tier_5_25"` for both Opus 4.8 and Opus 5), so this carries no cost change. Pin `claude-opus-4-8` explicitly to stay on the previous model.
|
||||
|
||||
### Fixed
|
||||
|
||||
- **Cache keys hashed the alias, not the model it resolves to (#194).** `model` enters `cacheHash` exactly as the client sent it, so a request for `"opus"` was cached under the literal `"opus"` — and since `models.json` is read once at boot while the SQLite `response_cache` outlives a restart, repointing an alias kept serving the **old model's** answers under it until TTL expiry. That would have silently defeated this release's own `opus` repoint for anyone running with the cache on. All three call sites now hash `Object.hasOwn(MODEL_MAP, model) ? MODEL_MAP[model] : model`, which fixes the normal, structured **and** single-flight keys at once and covers `legacyAliases` for free, with precise invalidation (only the repointed alias's entries change key) rather than a whole-cache flush. (`hasOwn` rather than a bare lookup: `MODEL_MAP` is a plain object, so `MODEL_MAP["__proto__"]` would return a truthy *object* and not even fall through to the `|| model` guard.) **Also closes a latent gap from #177:** the structured and dedup keys never passed `configEpoch` at all, so a `CLAUDE_SYSTEM_PROMPT` change — the original #176 scenario — kept serving structured answers composed under the old config, live since #153. Found by the external codex review of #192.
|
||||
- **In-flight request counter leaked permanently on a pre-spawn throw (#193, reported by @konceptnet in #180).** `stats.activeRequests` was incremented ~40 lines before the child spawn, while its only decrement is reached through that process's events — so any synchronous throw in between (`buildCliArgs`, env assembly, the spawn decision, or `spawn()` itself) leaked `+1` forever, and `/health` and `/status` over-reported in-flight work monotonically. The increment now sits immediately after `activeProcesses.add(proc)`, structurally pairing it with the decrement; no reconciliation pass and no try/catch. Observability-only field, so no admission decision changes.
|
||||
- **TUI: the host `CLAUDE.md` could leak into proxied turns (#187, contributed by @sumlin).** The TUI pane now spawns with `--safe-mode`.
|
||||
- **TUI: `shift+tab to cycle` is accepted as an input-ready marker (#188, contributed by @sumlin).** Claude renders one of two ready-state footers depending on the build — the classic `? for shortcuts` hint, or `shift+tab to cycle` (as part of `⏵⏵ bypass permissions on (shift+tab to cycle)`) on newer 2.1.x. The matcher only knew the classic string, so on those builds it silently reported "never ready": every boot timed out with `tui_pane_not_ready`, and with the warm pool on, every pre-boot failed.
|
||||
- **`OCP_LOCAL_TOOLS` no longer hard-codes a tool list in its wrapper (#191, closes #185).** The positive wrapper claimed a fixed set of tools regardless of `CLAUDE_ALLOWED_TOOLS`, so a narrowed tool surface was described inaccurately to the model.
|
||||
|
||||
### Testing
|
||||
|
||||
- The response-cache and counter fixes ship with **mutation-proven integration tests** built on the existing `ltBoot` child-process fixture (real `server.mjs`, fake `claude` binary, so no quota cost). The counter test reaches a synchronous fault *inside* `spawnClaudeProcess` from environment alone — no production fault hook — by running the child under `--stack-size=200` to lower the spread-throw threshold enough to fit Linux's `MAX_ARG_STRLEN`. Suite: **447 → 457** across this release (per PR: #188 +1, #187 +1, #191 +0, #194 +4, #192 +3, #193 +1).
|
||||
|
||||
## v3.24.0 — 2026-07-21
|
||||
|
||||
Minor release. Headline: two long-requested **OpenAI-compat features** land — **multimodal vision** (`image_url` parts) and **structured outputs** (`response_format` / JSON schema). Also: the prompt-char budget now derives from the model SPOT instead of a hand-set constant, an agentic-turn bug that dropped the model's final answer is fixed, and `OCP_LOCAL_TOOLS` supports the OpenClaw-backend use case. Four of the six landed from external contributors (@vvlasy-openclaw). Every code PR carried a fresh-context reviewer (Iron Rule 10); no new endpoint, no new `cli.js` wire behavior.
|
||||
|
||||
### Added
|
||||
|
||||
- **Multimodal vision — OpenAI `image_url` parts (#154, contributed by @vvlasy-openclaw).** `/v1/chat/completions` forwards OpenAI `image_url` content parts to `claude` as native Anthropic image blocks via `--input-format stream-json` (the CLI's own contract — no invented wire shape, verified live). Base64 `data:` URIs by default; remote `http(s)` URLs are off unless `CLAUDE_IMAGE_ALLOW_URL=1` (and even then OCP never fetches them — no SSRF surface). Byte/count caps (`CLAUDE_MAX_IMAGE_BYTES`, `CLAUDE_MAX_IMAGES`, `CLAUDE_MAX_IMAGE_TOTAL_BYTES`), all fail-closed on a misconfigured value. TUI mode returns `400 images_unsupported_in_tui_mode` (it can't carry image blocks) and an image present only in a `system` message returns `400` rather than being silently dropped. README § "Images / Multimodal".
|
||||
- **Structured outputs — OpenAI `response_format` (#153, contributed by @vvlasy-openclaw).** `/v1/chat/completions` honors `response_format: { type: "json_schema" | "json_object" }` so OpenAI-SDK clients (Home Assistant AI Tasks, Honcho, scripts) get machine-parseable JSON in `content`. Validates against the schema (incl. `$ref`/`$defs` + `allOf`/`anyOf`/`oneOf` — the shapes the OpenAI SDK emits), retries with a stronger instruction up to `OCP_STRUCTURED_MAX_ATTEMPTS` (default 3, fail-closed), and on exhaustion returns OpenAI's own `refusal` field (200/`content:null`) rather than an invented error. Cyclic-`$ref` schemas fail closed (no stack overflow); a pathologically deep model reply returns a refusal, not a 500 (#181). Single-flight dedup + structured-keyed cache bound the cost. Class B.1 (ADR 0006). README § "Structured Outputs".
|
||||
- **SPOT-derived prompt-char budget (#179, ADR 0009).** `MAX_PROMPT_CHARS` default now derives from `max(models.json contextWindow) × 3 chars/token` (600,000 today) instead of the hand-set 150,000 (~37.5k tokens) that silently under-delivered the advertised window ~5×. `CLAUDE_MAX_PROMPT_CHARS` and the settings API remain absolute overrides; a garbage value fails closed to the derived default.
|
||||
- **`OCP_LOCAL_TOOLS` — positive local-tools system-prompt wrapper (single-user, loopback only; default off) (#182, contributed by @vvlasy-openclaw).** The `-p` path prepends a wrapper telling the model it has no local filesystem/shell access — correct for a shared gateway, but it makes a personal instance's model (e.g. an OpenClaw agent on its own local OCP) refuse to use the server-side `claude` tools it legitimately has. `=1` swaps in a positive wrapper. Changes **only the prompt**, never the tool surface (`--allowedTools`/`--disallowedTools` untouched; multi-tenant still disallows the FS surface); it does **not** enable client-side `tool_calls` (still unsupported by design). Fail-closed boot gate mirroring `OCP_TUI_FULL_TOOLS` (ADR 0007): refuses to start under `CLAUDE_AUTH_MODE=multi`, a non-loopback bind, or `PROXY_ANONYMOUS_KEY`. Inert (and logged as such) in TUI mode. The active wrapper is folded into the config epoch so toggling it invalidates the standard response cache. No new `cli.js` wire behavior (reuses the already-cited `--system-prompt` flag).
|
||||
|
||||
### Fixed
|
||||
|
||||
- **Agentic turns dropped the model's final answer (#183, contributed by @vvlasy-openclaw).** On a tool-using turn, `/v1/chat/completions` returned only the opening preamble ("I'll find the repo…") and silently discarded the post-tool-use final answer: aggregate-`assistant` extraction was gated on `isFirstDelta` (which flips false after the first text), and OCP runs pure-aggregate mode (no `--include-partial-messages`), so each of an agentic turn's several assistant messages after the first was lost. Now guards on `sawTextDelta` and accumulates every assistant message (streaming and buffered paths assemble byte-identically).
|
||||
- **Deep structured reply returned a 500 instead of a refusal (#181 / #184).** `validateJsonSchema` recurses on the model reply's nesting depth; a ~2000-level-deep reply overflowed the stack → caught `RangeError` → generic 500. A crash-safe façade converts that (only) into a validation miss → refusal; any other throw still surfaces.
|
||||
|
||||
## v3.23.0 — 2026-07-17
|
||||
|
||||
Minor release. Headline: **the default `sonnet` alias now resolves to Claude Sonnet 5** — a behavior change for every request that omits `model` (pin `claude-sonnet-4-6` by full ID to keep the previous default). Also: Windows-safe upgrade snapshots, two upgrade-system reliability fixes from a live fleet update, the `CLAUDE_SYSTEM_PROMPT` env var made functional, cache-key honesty for config changes, a billing-policy status correction (the 2026-06-15 `-p` split is PAUSED by Anthropic), and a major README restructure. No new endpoint; no new `cli.js` wire behavior. Every code PR carried a fresh-context reviewer (Iron Rule 10).
|
||||
|
||||
@@ -113,11 +113,11 @@ node setup.mjs
|
||||
|
||||
`setup.mjs` verifies the Claude CLI, starts the proxy on port 3456, and installs auto-start (launchd on macOS, systemd on Linux). The `ocp` CLI lands at `~/ocp/ocp` — symlink it onto your PATH (`sudo ln -sf ~/ocp/ocp /usr/local/bin/ocp`, or `ln -sf ~/ocp/ocp ~/.local/bin/ocp`) or alias it (`alias ocp=~/ocp/ocp`); the rest of the docs assume `ocp` is on your PATH.
|
||||
|
||||
**Verify** — should list 7 models:
|
||||
**Verify** — should list 6 models:
|
||||
|
||||
```bash
|
||||
curl http://127.0.0.1:3456/v1/models
|
||||
# claude-opus-5, claude-opus-4-8, claude-opus-4-7, claude-opus-4-6, claude-sonnet-5, claude-sonnet-4-6, claude-haiku-4-5-20251001
|
||||
# claude-opus-4-8, claude-opus-4-7, claude-opus-4-6, claude-sonnet-5, claude-sonnet-4-6, claude-haiku-4-5-20251001
|
||||
```
|
||||
|
||||
**Connect one IDE** — point any OpenAI-compatible tool at the proxy, then reload your shell and start a tool (Cline / Continue / Cursor / OpenCode):
|
||||
@@ -159,7 +159,7 @@ OCP translates OpenAI-compatible `/v1/chat/completions` requests into `claude --
|
||||
|
||||
OCP is a **text-prompt bridge** to the official `claude` CLI. It does **not** pass through OpenAI `tools`/`functions` payloads or Anthropic `tool_use` blocks to the client. Clients (Cline, Cursor, OpenClaw, etc.) pointed at OCP receive **assistant TEXT only** — they never get `tool_calls` to execute locally.
|
||||
|
||||
Any tool use happens server-side, under the `--allowedTools` set configured on the OCP host. In default mode (no `CLAUDE_NO_CONTEXT`), the `claude` CLI's own built-in tools are available to the model; in TUI mode, the operator controls the tool surface via `OCP_TUI_FULL_TOOLS`. Either way, the tools run under the operator's credentials on the server, and the client sees only the final text output. Note that on the `-p` path OCP prepends a system-prompt wrapper telling the model it has **no** local access (right for a shared gateway) — a single-user loopback instance whose model *should* use its tools can flip this with `OCP_LOCAL_TOOLS=1` (see Environment Variables).
|
||||
Any tool use happens server-side, under the `--allowedTools` set configured on the OCP host. In default mode (no `CLAUDE_NO_CONTEXT`), the `claude` CLI's own built-in tools are available to the model; in TUI mode, the operator controls the tool surface via `OCP_TUI_FULL_TOOLS`. Either way, the tools run under the operator's credentials on the server, and the client sees only the final text output.
|
||||
|
||||
**Client-local tool execution is not supported by design.** Supporting it would require bypassing the `claude` CLI to call the raw Anthropic API directly — that is a different product, and is out of scope per `ALIGNMENT.md` (every OCP endpoint must correspond to something `cli.js` actually does).
|
||||
|
||||
@@ -169,15 +169,14 @@ Any tool use happens server-side, under the `--allowedTools` set configured on t
|
||||
|
||||
| Model ID | Notes |
|
||||
|----------|-------|
|
||||
| `claude-opus-5` | Most capable (default for `opus` alias) |
|
||||
| `claude-opus-4-8` | Previous Opus, retained for pinning |
|
||||
| `claude-opus-4-7` | Older Opus, retained for pinning |
|
||||
| `claude-opus-4-8` | Most capable (default for `opus` alias) |
|
||||
| `claude-opus-4-7` | Previous Opus, retained for pinning |
|
||||
| `claude-opus-4-6` | Older Opus, retained for pinning |
|
||||
| `claude-sonnet-5` | Latest Sonnet (default for `sonnet` alias) |
|
||||
| `claude-sonnet-4-6` | Previous Sonnet, retained for pinning |
|
||||
| `claude-haiku-4-5-20251001` | Fastest, lightweight (default for `haiku` alias) |
|
||||
|
||||
The canonical list lives in [`models.json`](./models.json) — the single source of truth as of v3.11.0, validated in CI against [`models.schema.json`](./models.schema.json). Both `server.mjs` (the `/v1/models` endpoint) and `setup.mjs` (the OpenClaw registration) derive from it. Adding a new model is now a one-file edit:
|
||||
The canonical list lives in [`models.json`](./models.json) — the single source of truth as of v3.11.0. Both `server.mjs` (the `/v1/models` endpoint) and `setup.mjs` (the OpenClaw registration) derive from it. Adding a new model is now a one-file edit:
|
||||
|
||||
```bash
|
||||
# 1. Edit models.json — add an entry
|
||||
@@ -236,7 +235,6 @@ The canonical list lives in [`models.json`](./models.json) — the single source
|
||||
| `CLAUDE_MAX_IMAGES` | `20` | Max image parts per request. Over-cap gets `HTTP 413`. |
|
||||
| `CLAUDE_MAX_IMAGE_TOTAL_BYTES` | `20971520` | Aggregate decoded-byte cap across all images in a request (default 20 MB). Over-cap gets `HTTP 413`. |
|
||||
| `CLAUDE_SYSTEM_PROMPT` | *(unset)* | Operator-wide system-prompt text appended (last) to every request's composed system prompt on the default `-p` path. TUI-mode panes are unaffected (they keep the interactive CLI's own system prompt). Echoed truncated on `/health.systemPrompt`. Note: changing this value and restarting auto-invalidates the response cache (the key carries a boot-config epoch, #177). |
|
||||
| `OCP_LOCAL_TOOLS` | *(unset)* | **Single-user, loopback only.** `=1` swaps the default *"you have no local filesystem/shell access"* system-prompt wrapper for a positive one telling the model it **may** use its tools. These are the **server-side `claude` tools** OCP spawns via `-p` (`--allowedTools`) — which, on a loopback instance, run on the operator's own machine, i.e. *local* tools. For a personal instance (e.g. an **OpenClaw** agent on its own local OCP) the default wrapper otherwise makes the model refuse to use tools it legitimately has. Changes **only the prompt**, never the tool surface (governed by `--allowedTools`/`--disallowedTools`; multi-tenant still `--disallowedTools` the whole FS surface). **Does not** enable client-side `tool_calls` for OpenClaw/Cline/etc. — that remains unsupported by design (see § How tools work). Fail-closed: OCP **refuses to boot** if `=1` is combined with `CLAUDE_AUTH_MODE=multi`, a non-loopback bind, or `PROXY_ANONYMOUS_KEY` (mirrors `OCP_TUI_FULL_TOOLS`, ADR 0007). **Inert in TUI mode** (the `-p` wrapper is unused there; the TUI tool surface is `OCP_TUI_FULL_TOOLS`) — a warning is logged. Off by default → the default path is byte-for-byte unchanged. Toggling it auto-invalidates the standard response cache (boot-config epoch, #177). |
|
||||
| `CLAUDE_NO_CONTEXT` | `false` | Suppress CLAUDE.md and auto-memory injection (pure API mode) |
|
||||
| `PROXY_API_KEY` | *(unset)* | Bearer token for shared-mode authentication |
|
||||
| `PROXY_ANONYMOUS_KEY` | *(unset)* | Well-known anonymous key (multi mode) — this exact string bypasses `validateKey()` and grants public access. Exposed via `/health.anonymousKey` only to localhost, or to all callers when `PROXY_ADVERTISE_ANON_KEY=1`. Full setup + security notes: [docs/lan-mode.md § Anonymous Access](docs/lan-mode.md#anonymous-access-optional). |
|
||||
@@ -388,7 +386,7 @@ curl -X DELETE http://127.0.0.1:3456/cache # clear all cached responses
|
||||
ocp settings cacheTTL 0 # disable at runtime
|
||||
```
|
||||
|
||||
Cache is **disabled by default** (`CLAUDE_CACHE_TTL=0`). All data is stored locally in `~/.ocp/ocp.db`. **Cache keys resolve model aliases as of v3.25.0:** a request for an alias (`opus`, `sonnet`, `haiku`, or a legacy alias like `claude-haiku-4-5`) is now keyed on the canonical model it resolves to, not on the string the client sent. Two consequences, both one-time and self-healing: rows written before the upgrade don't match the new lookups, so they orphan and are reaped by the TTL cleanup interval within one window — no migration script required; and an alias now correctly shares a cache slot with its canonical id, since both produce an identical spawn. Scope: for the **normal** cache only alias-addressed rows rekey — rows keyed on a literal model id keep matching, *unless* you run `OCP_LOCAL_TOOLS=1`, in which case the whole normal cache rekeys once because v3.25.0 also reworded that wrapper and the wrapper text feeds the config epoch. **Every structured-output row rekeys regardless**, since the same change folds the config epoch into the structured key, which it previously omitted. This is what makes an alias repoint (such as v3.25.0's `opus` → `claude-opus-5`) take effect immediately instead of being masked by the cache until TTL expiry. **Hash format upgrade in v3.13.0:** legacy `v1` cache rows don't match new `v2`-format lookups; they orphan and are reaped by the TTL cleanup interval within one window — no migration script required.
|
||||
Cache is **disabled by default** (`CLAUDE_CACHE_TTL=0`). All data is stored locally in `~/.ocp/ocp.db`. **Hash format upgrade in v3.13.0:** legacy `v1` cache rows don't match new `v2`-format lookups; they orphan and are reaped by the TTL cleanup interval within one window — no migration script required.
|
||||
|
||||
## Structured Outputs (OpenAI `response_format`)
|
||||
|
||||
@@ -541,7 +539,6 @@ The simplest path: ask your AI — paste `Run `ocp doctor` and follow its `next_
|
||||
|
||||
- **A TUI session vanished right after upgrading OCP** — if a pre-3.21.1 and a post-3.21.1 instance ran on the same host at the same time during an upgrade, the new instance's one-time boot reap can, once, kill an old-format (`ocp-tui-<8hex>`) live TUI session belonging to the still-running old instance. Restart the affected session (`ocp restart` or re-run your TUI turn) and it returns under the new instance's port-scoped naming.
|
||||
- **OpenClaw shows old models after `ocp update` (v3.10→v3.11 only)** — the running shell had the old `cmd_update` cached, so the sync hook doesn't fire on that single jump. Run once: `node ~/ocp/scripts/sync-openclaw.mjs && openclaw gateway restart`. Every future update syncs automatically.
|
||||
- **Response-cache hit rate drops once after upgrading to v3.25.0** — only if you run with the cache on (`CLAUDE_CACHE_TTL > 0`; it is off by default). v3.25.0 keys the cache on the resolved model instead of the string the client sent, so alias-addressed rows (and *all* structured-output rows) orphan and are reaped by the TTL cleanup within one window. **No action required.** Details: [docs/troubleshooting.md#cache-rekey-v3250](docs/troubleshooting.md#cache-rekey-v3250).
|
||||
|
||||
Full manual — setup failures, env-var-not-taking-effect-after-restart (launchd bootout+bootstrap vs `kickstart -k`), stuck sessions, "OpenClaw registry out of sync", and the two-layer TUI-mode 401 root cause + fix: **[docs/troubleshooting.md](docs/troubleshooting.md)**.
|
||||
|
||||
|
||||
+5
-6
@@ -78,7 +78,7 @@ Run `ocp lan` to see your IP and ready-to-share instructions.
|
||||
**Verify:**
|
||||
```bash
|
||||
curl http://127.0.0.1:3456/v1/models
|
||||
# Returns: claude-opus-5, claude-opus-4-8, claude-opus-4-7, claude-opus-4-6, claude-sonnet-5, claude-sonnet-4-6, claude-haiku-4-5-20251001
|
||||
# Returns: claude-opus-4-8, claude-opus-4-7, claude-opus-4-6, claude-sonnet-5, claude-sonnet-4-6, claude-haiku-4-5-20251001
|
||||
```
|
||||
|
||||
### Headless install notes
|
||||
@@ -114,7 +114,7 @@ Please follow https://github.com/dtzp555-max/ocp/blob/main/README.md
|
||||
installed and logged in (`claude auth status`). Install missing pieces
|
||||
using my system's package manager.
|
||||
2. git clone the repo, cd in, and run `node setup.mjs`.
|
||||
3. Verify with `curl http://127.0.0.1:3456/v1/models` (should list 7 models).
|
||||
3. Verify with `curl http://127.0.0.1:3456/v1/models` (should list 6 models).
|
||||
4. Add `export OPENAI_BASE_URL=http://127.0.0.1:3456/v1` to my shell rc.
|
||||
5. Tell me to reload my shell and try a tool like Cline / Continue / Cursor.
|
||||
|
||||
@@ -141,7 +141,7 @@ Please follow https://github.com/dtzp555-max/ocp/blob/main/docs/lan-mode.md
|
||||
5. Add OCP_ADMIN_KEY to my shell rc (~/.zshrc or ~/.bashrc).
|
||||
6. Run `ocp lan` to show me the LAN IP and connect command.
|
||||
7. Optionally create example keys: `ocp keys add laptop`, `ocp keys add tablet`.
|
||||
8. Verify: `curl http://127.0.0.1:3456/v1/models` returns 7 models.
|
||||
8. Verify: `curl http://127.0.0.1:3456/v1/models` returns 6 models.
|
||||
|
||||
Tell me each step before running it. On error, diagnose before retrying.
|
||||
```
|
||||
@@ -163,7 +163,7 @@ Please follow https://github.com/dtzp555-max/ocp/blob/main/docs/lan-mode.md
|
||||
chmod +x ocp-connect
|
||||
2. Run `./ocp-connect <SERVER_IP>` (add `--key <KEY>` if you have one).
|
||||
3. Follow any IDE-specific manual hints it prints.
|
||||
4. Verify: `curl http://<SERVER_IP>:3456/v1/models` returns 7 models.
|
||||
4. Verify: `curl http://<SERVER_IP>:3456/v1/models` returns 6 models.
|
||||
5. Tell me to reload my shell + restart any IDE that was already running.
|
||||
|
||||
Don't auto-retry on error. Tell me the failure mode first.
|
||||
@@ -216,7 +216,7 @@ OCP Connect v1.3.0
|
||||
(set by admin via PROXY_ANONYMOUS_KEY; see issue #12 §14 Path A)
|
||||
|
||||
Testing API access...
|
||||
✓ API accessible (7 models available)
|
||||
✓ API accessible (6 models available)
|
||||
|
||||
Shell config:
|
||||
✓ .bashrc
|
||||
@@ -246,7 +246,6 @@ OCP Connect v1.3.0
|
||||
✓ OpenClaw configured
|
||||
Provider: ocp
|
||||
Models:
|
||||
• ocp/claude-opus-5
|
||||
• ocp/claude-opus-4-8
|
||||
• ocp/claude-opus-4-7
|
||||
• ocp/claude-opus-4-6
|
||||
|
||||
@@ -116,22 +116,6 @@ openclaw gateway restart # so OpenClaw re-reads the config
|
||||
|
||||
Future `ocp update` invocations sync automatically.
|
||||
|
||||
<a id="cache-rekey-v3250"></a>
|
||||
### Response-cache hit rate drops once after upgrading to v3.25.0
|
||||
|
||||
Only affects instances running with the response cache **on** (`CLAUDE_CACHE_TTL > 0`); it is off by default, so most installs see nothing.
|
||||
|
||||
v3.25.0 keys the cache on the **resolved** model rather than on the string the client sent, so rows written for an alias (`opus`, `sonnet`, `haiku`, or a legacy alias like `claude-haiku-4-5`) no longer match. Those rows orphan and are reaped by the TTL cleanup interval within one window — **no migration script, no action required**; expect one window of extra misses and then normal hit rates.
|
||||
|
||||
Two different scopes, worth being precise about:
|
||||
|
||||
- **Normal cache** — only *alias-addressed* rows rekey. Rows written under a literal model id (`claude-sonnet-5`) keep matching — **unless the instance runs `OCP_LOCAL_TOOLS=1`**, in which case the entire normal cache rekeys once. That is a separate mechanism: v3.25.0 also reworded the local-tools wrapper, and the wrapper text is one of the four inputs to `CONFIG_EPOCH`, which every normal cache key folds in (established behavior since v3.23.0, not new here).
|
||||
- **Structured-output cache** — **every** row rekeys, alias or literal. The same change also folds the config epoch into the structured key, which it had never included; that gap meant a `CLAUDE_SYSTEM_PROMPT` change did not invalidate structured answers either. Structured caching only exists from v3.24.0, so there is at most one release worth of rows to orphan.
|
||||
|
||||
This is deliberate, and it is what makes an alias repoint take effect. Before v3.25.0, changing where an alias pointed (v3.25.0 itself repoints `opus` → `claude-opus-5`) left the cache serving the **old** model's answers under that alias until TTL expiry, because `models.json` is read once at boot while the SQLite cache survives the restart. If you were running with the cache on and repointed an alias in an earlier version, that is why it appeared not to take.
|
||||
|
||||
A side effect worth knowing: an alias and its canonical id now **share** a cache slot, since both produce an identical spawn. That is a small hit-rate improvement in steady state.
|
||||
|
||||
<a id="tui-401"></a>
|
||||
### TUI-mode returns a permanent `Please run /login` 401 (re-login doesn't stick)
|
||||
|
||||
|
||||
+1
-1
@@ -65,7 +65,7 @@ Then restart OCP. At boot you will see (with the env token set, isolated home au
|
||||
- **Callers see no API change.** The response is a normal OpenAI completion object or chunked SSE — identical wire format.
|
||||
- **Real streaming is opt-in (`OCP_TUI_STREAM=1`), and off by default.** By default TUI-mode buffers the full response and replays it as chunked SSE — you see a delay, then the complete response. Set `OCP_TUI_STREAM=1` and `stream:true` turns emit real SSE `delta.content` chunks as `claude` renders them, sourced from `claude`'s own `MessageDisplay` hook (byte-faithful raw markdown, on the subscription pool, no `-p`). Two honest caveats: granularity is **block-level** — the hook fires once per rendered block, so a handful of chunks per answer, scaling with length, not token-by-token; and it moves the **first** byte, not the last, so a consumer that must parse a complete reply gains nothing. The transcript stays authoritative: every streamed turn is asserted against it at the end, and a turn whose stream disagrees is **failed rather than served** (watch `tui.streamDivergences` on `/health`). Evidence: [`plans/2026-07-13-tui-latency/streaming-spike.md`](plans/2026-07-13-tui-latency/streaming-spike.md).
|
||||
- **Cache and singleflight work normally.** TUI-mode writes the buffered response to the cache on success; cache-hits skip the interactive turn entirely.
|
||||
- **The host's `CLAUDE.md` / auto-memory is never injected.** OCP is a proxy — the proxied client (OpenClaw / your IDE) owns its own context and memory. TUI-mode runs `claude` with `--safe-mode`, which disables all host customizations (CLAUDE.md, skills, plugins, hooks, MCP servers) while leaving auth, model selection, built-in tools, and permissions untouched — so a `CLAUDE.md` on the OCP host can never leak into a proxied turn and steer the answer, and the session still bills the subscription pool (`cc_entrypoint=cli`, unlike `--bare`). The `CLAUDE_CODE_DISABLE_CLAUDE_MDS` / `CLAUDE_CODE_DISABLE_AUTO_MEMORY` env vars are kept as a fallback (see #4). Built-in tool schemas + the interactive system prompt remain (the inherent ~20–35K context floor of interactive mode); MCP is hard-disabled. **Exception:** the two opt-in modes that deliberately need a customization `--safe-mode` would strip — real streaming (`OCP_TUI_STREAM`, which registers a `MessageDisplay` **hook** via `--settings`) and `OCP_TUI_FULL_TOOLS` (which grants an **MCP** / skills surface) — run without `--safe-mode` and rely on the env-var suppression alone.
|
||||
- **The host's `CLAUDE.md` / auto-memory is never injected.** OCP is a proxy — the proxied client (OpenClaw / your IDE) owns its own context and memory. TUI-mode always runs `claude` with `CLAUDE_CODE_DISABLE_CLAUDE_MDS` + `CLAUDE_CODE_DISABLE_AUTO_MEMORY`, so a `CLAUDE.md` on the OCP host can never leak into proxied turns (verified live; see #4). Built-in tool schemas + the interactive system prompt remain (the inherent ~20–35K context floor of interactive mode); MCP is hard-disabled.
|
||||
- **Authenticate via `CLAUDE_CODE_OAUTH_TOKEN` in a credential-isolated home (recommended).** tmux does not forward the parent process's env to the pane, so OCP sets the token explicitly on the spawned `claude` when `CLAUDE_CODE_OAUTH_TOKEN` is present. With the env token set and `OCP_TUI_HOME` unset, OCP runs claude in a **credential-isolated home** (`$HOME/.ocp-tui/home`) that has **no `credentials.json`** — so the env token is the only credential and is authoritative, and claude never runs the token-refresh path. This both stops a stale `credentials.json` from shadowing the token and ends the refresh-token corruption behind the permanent `Please run /login · API Error: 401` (full two-layer root cause, live proof, and fix in [Troubleshooting § the permanent TUI-mode 401](troubleshooting.md#tui-401)). Transcripts land under the same isolated home, so the answer-reader is unaffected. Without the env token, claude falls back to the real home's `credentials.json` (byte-for-byte the previous behaviour). (The token is visible in `ps` on the pane command — acceptable for the single-user A-path; the multi-user B-path is refused at boot.) See ADR 0007 PR-C / PR-D amendments.
|
||||
- **Stale tmux sessions are reaped.** The pane's `claude` is a child of the tmux server (not OCP), so OCP cannot reap it directly; `claude` zombies can otherwise accumulate as `<defunct>` over a long-running host. OCP reaps them at boot and on a 15-min idle sweep by issuing `tmux kill-server` — but **only when no foreign tmux session remains** (it never disrupts a co-hosted `olp-tui-*` instance). See ADR 0007 PR-C amendment.
|
||||
- **Default path unchanged.** Unset `CLAUDE_TUI_MODE` and restart → `callClaude` / `callClaudeStreaming` are used again, byte-for-byte identical to today.
|
||||
|
||||
@@ -52,38 +52,3 @@ export function derivePromptCharBudget(models, { charsPerToken = 3, floor = 1500
|
||||
export function resolvePromptCharBudget(rawEnv, models, opts) {
|
||||
return rawEnv ? parseInt(rawEnv, 10) : derivePromptCharBudget(models, opts);
|
||||
}
|
||||
|
||||
// OCP_LOCAL_TOOLS system-prompt wrapper selection (pure).
|
||||
//
|
||||
// OCP's `-p` path prepends a fixed wrapper to every request's system prompt. The DEFAULT wrapper
|
||||
// tells the model it has NO local filesystem/shell/env access — the right posture for a shared or
|
||||
// multi-tenant gateway. But a single-user, loopback-bound instance (e.g. an OpenClaw agent talking
|
||||
// to its own local OCP) DOES legitimately have tools — the `-p` path already passes `--allowedTools`
|
||||
// and the CLI's built-in tools are available — so the default wrapper actively gaslights the model
|
||||
// into refusing to use tools it holds. `OCP_LOCAL_TOOLS=1` swaps in a positive wrapper for that case.
|
||||
//
|
||||
// This does NOT expand the tool surface: tools are governed solely by `--allowedTools` /
|
||||
// `--disallowedTools` (multi-tenant mode `--disallowedTools` the whole FS surface regardless of the
|
||||
// wrapper). It only changes the PROMPT the operator's own model reads. Pure so it is unit-testable.
|
||||
export function selectPromptWrapper(localToolsEnabled, negativeWrapper, positiveWrapper) {
|
||||
return localToolsEnabled ? positiveWrapper : negativeWrapper;
|
||||
}
|
||||
|
||||
// Boot-time safety gate for OCP_LOCAL_TOOLS, mirroring the OCP_TUI_FULL_TOOLS model (ADR 0007): a
|
||||
// positive "you may use local tools" wrapper must never reach an untrusted caller. Returns a fatal
|
||||
// message string when the flag is enabled in an unsafe deployment, or null when it is safe/disabled.
|
||||
// Fail-closed: any of multi-tenant auth, a non-loopback bind, or an anonymous key is refused. Pure —
|
||||
// the caller does the process.exit so this stays testable.
|
||||
export function localToolsSafetyError({ enabled, authMode, loopbackBind, anonymousKey }) {
|
||||
if (!enabled) return null;
|
||||
if (authMode === "multi") {
|
||||
return "OCP_LOCAL_TOOLS=1 is incompatible with CLAUDE_AUTH_MODE=multi — a guest/anonymous prompt would be told it may drive the operator's filesystem/shell. Single-user only.";
|
||||
}
|
||||
if (!loopbackBind) {
|
||||
return "OCP_LOCAL_TOOLS=1 requires a loopback bind (127.0.0.1/::1) — a network-exposed positive-tools wrapper could reach an untrusted peer. Bind to loopback, or leave OCP_LOCAL_TOOLS off.";
|
||||
}
|
||||
if (anonymousKey) {
|
||||
return "OCP_LOCAL_TOOLS=1 is unsafe with PROXY_ANONYMOUS_KEY set — anonymous callers could reach the local-tools-enabled model without a named key. Remove PROXY_ANONYMOUS_KEY, or leave OCP_LOCAL_TOOLS off.";
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
+6
-41
@@ -182,13 +182,8 @@ function tuiCapturePane(tmux, tmuxName) {
|
||||
}
|
||||
|
||||
// True once claude's input bar is rendered and ready for keystrokes.
|
||||
// Two known ready-state footers across claude versions: the classic `? for shortcuts`
|
||||
// hint, and the `shift+tab to cycle` hint (part of "⏵⏵ bypass permissions on (shift+tab
|
||||
// to cycle)") that newer claude 2.1.x renders in its place. Match EITHER — a matcher that
|
||||
// only knew the classic string silently reported "never ready" on those builds, timing out
|
||||
// every boot (tui_pane_not_ready) and, with the warm pool on, failing every pre-boot.
|
||||
function tuiInputReady(pane) {
|
||||
return /\? for shortcuts|shift\+tab to cycle/.test(pane);
|
||||
return /\? for shortcuts/.test(pane);
|
||||
}
|
||||
|
||||
// True once the pasted prompt has POSITIVELY landed in the input box. We only trust
|
||||
@@ -389,15 +384,9 @@ export function buildTuiCmd(claudeBin, model, sessionId, ehome, entrypointMode,
|
||||
// CLAUDE.md and auto-memory must NEVER leak into the agent OCP runs on the user's behalf.
|
||||
// Without these, claude loads the host's project/user CLAUDE.md + memory into every proxied
|
||||
// turn — verified live 2026-06-02: a cwd CLAUDE.md ("end every reply with QUACKMARKER_42") was
|
||||
// obeyed by the proxied turn until these flags were set, after which it was not. Mirrors the
|
||||
// -p path's CLAUDE_NO_CONTEXT vars. Harmless on hosts with no CLAUDE.md (they suppress nothing).
|
||||
//
|
||||
// These env vars stopped being sufficient on newer claude: they are present in the pane's
|
||||
// environment yet the host CLAUDE.md is still injected into the turn's context, so a proxied
|
||||
// turn again obeys the operator's private CLAUDE.md instead of the caller's prompt — a leak of
|
||||
// the operator's private context into API responses. The robust suppression is the --safe-mode
|
||||
// flag added to the argv below; these env vars are kept as belt-and-braces for the two argv
|
||||
// paths that cannot take --safe-mode (see the safeModeArgs note near the return).
|
||||
// obeyed by the proxied turn until these flags were set, after which it was not. Unconditional
|
||||
// by design (not gated): proxy purity is not an opt-in. Harmless on hosts with no CLAUDE.md
|
||||
// (the common case — they suppress nothing). Mirrors the -p path's CLAUDE_NO_CONTEXT vars.
|
||||
const sets = [
|
||||
`HOME=${shq(ehome)}`,
|
||||
"DISABLE_AUTOUPDATER=1",
|
||||
@@ -488,32 +477,9 @@ export function buildTuiCmd(claudeBin, model, sessionId, ehome, entrypointMode,
|
||||
// so the OFF argv is byte-for-byte the pre-streaming argv.
|
||||
const settingsArgs = stream && stream.settings ? ["--settings", shq(stream.settings)] : [];
|
||||
|
||||
// --safe-mode: disable ALL customizations (host CLAUDE.md, skills, plugins, hooks, MCP
|
||||
// servers, custom commands/agents, output styles, ...) while leaving auth, model selection,
|
||||
// built-in tools, and permissions untouched (claude 2.1.216 --help). This is the robust
|
||||
// replacement for the CLAUDE_CODE_DISABLE_CLAUDE_MDS / _AUTO_MEMORY env vars above, which no
|
||||
// longer suppress the host CLAUDE.md on newer claude — so the operator's private CLAUDE.md
|
||||
// could otherwise leak into a proxied API response. Unlike --bare, --safe-mode does NOT drop
|
||||
// the interactive session off the subscription pool (it keeps auth + model selection), so the
|
||||
// billing classifier stays cc_entrypoint=cli.
|
||||
//
|
||||
// NOT applied when the pane deliberately relies on a customization --safe-mode would strip,
|
||||
// because those would break SILENTLY:
|
||||
// - streaming (settingsArgs present): the MessageDisplay hook is a HOOK, which --safe-mode
|
||||
// disables — every streamed turn would then fire zero deltas (tui.streamZeroDeltaTurns)
|
||||
// and fall back to buffered, defeating OCP_TUI_STREAM.
|
||||
// - OCP_TUI_FULL_TOOLS=1: grants an MCP / skills / agent surface (--mcp-config, ...) that
|
||||
// --safe-mode disables wholesale.
|
||||
// Those two opt-in paths keep the env-var suppression above as their best-effort fallback.
|
||||
const safeModeArgs =
|
||||
settingsArgs.length === 0 && process.env.OCP_TUI_FULL_TOOLS !== "1"
|
||||
? ["--safe-mode"]
|
||||
: [];
|
||||
|
||||
return [
|
||||
envPrefix,
|
||||
shq(claudeBin),
|
||||
...safeModeArgs,
|
||||
"--model", shq(model),
|
||||
"--session-id", sessionId,
|
||||
...toolArgs,
|
||||
@@ -649,9 +615,8 @@ export async function bootTuiPane({
|
||||
// A pooled pane is SINGLE-USE: it already carries its own fresh --session-id, it
|
||||
// serves this one turn, and it is killed in the finally like any other pane.
|
||||
// 2. On a MISS: pre-trust the scratch cwd, boot an interactive `claude` in a fresh tmux
|
||||
// session in the scratch cwd, poll capture-pane until the input bar appears — see
|
||||
// tuiInputReady for the ready-state footers matched (bootTuiPane). BOOT_MS is the max
|
||||
// wait, not a fixed delay.
|
||||
// session in the scratch cwd, poll capture-pane until the `? for shortcuts` input bar
|
||||
// appears (bootTuiPane). BOOT_MS is the max wait, not a fixed delay.
|
||||
// 3. Write prompt to a 0600 temp file (no shell injection from prompt content).
|
||||
// 4. Paste the prompt via tmux load-buffer + paste-buffer -p (bracketed paste) —
|
||||
// reliable for large multi-line prompts where send-keys -l is not (issue #130).
|
||||
|
||||
+1
-9
@@ -2,14 +2,6 @@
|
||||
"$schema": "./models.schema.json",
|
||||
"version": 1,
|
||||
"models": [
|
||||
{
|
||||
"id": "claude-opus-5",
|
||||
"displayName": "Claude Opus 5",
|
||||
"openclawName": "Claude Opus 5 (via CLI)",
|
||||
"reasoning": true,
|
||||
"contextWindow": 200000,
|
||||
"maxTokens": 16384
|
||||
},
|
||||
{
|
||||
"id": "claude-opus-4-8",
|
||||
"displayName": "Claude Opus 4.8",
|
||||
@@ -60,7 +52,7 @@
|
||||
}
|
||||
],
|
||||
"aliases": {
|
||||
"opus": "claude-opus-5",
|
||||
"opus": "claude-opus-4-8",
|
||||
"sonnet": "claude-sonnet-5",
|
||||
"haiku": "claude-haiku-4-5-20251001"
|
||||
},
|
||||
|
||||
@@ -1,65 +0,0 @@
|
||||
{
|
||||
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
||||
"$id": "https://github.com/dtzp555-max/ocp/blob/main/models.schema.json",
|
||||
"title": "OCP models.json",
|
||||
"description": "Schema for models.json, the single source of truth for model metadata (ADR 0003). Enforced in CI by test-features.mjs, which validates models.json against this file using the repo's own validateJsonSchema (lib/structured-output.mjs) — no new dependency. ⚠ ONLY A SUBSET OF DRAFT 2020-12 IS ENFORCED: type, required, const, enum, additionalProperties (boolean and schema forms), items, minItems, maxItems, anyOf/allOf/oneOf, $ref, nullable. Anything else — minimum, maxLength, pattern, uniqueItems, propertyNames, not — is SILENTLY IGNORED by that validator, so adding one here buys nothing and misleads the next reader. Add such a constraint as a test in test-features.mjs instead. NOTE: referential integrity (every aliases/legacyAliases target must exist as a models[].id) is likewise not expressible here and is covered by separate tests.",
|
||||
"type": "object",
|
||||
"required": ["version", "models", "aliases", "legacyAliases"],
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"$schema": {
|
||||
"type": "string",
|
||||
"description": "Relative path to this file. Editors use it for completion; CI does not read it."
|
||||
},
|
||||
"version": {
|
||||
"const": 1,
|
||||
"description": "Schema version of this document. Bump only alongside a shape change and an ADR."
|
||||
},
|
||||
"models": {
|
||||
"type": "array",
|
||||
"minItems": 1,
|
||||
"description": "Every model OCP advertises on /v1/models, newest first. Order is load-bearing: ocp-connect uses model_ids[0] as a primary fallback.",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"required": ["id", "displayName", "openclawName", "reasoning", "contextWindow", "maxTokens"],
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"id": {
|
||||
"type": "string",
|
||||
"description": "Canonical CLI model id, passed verbatim to `claude --model`. Must match the id in the compiled CLI registry."
|
||||
},
|
||||
"displayName": {
|
||||
"type": "string",
|
||||
"description": "Human label. Also used as the OpenClaw agent alias by scripts/sync-openclaw.mjs."
|
||||
},
|
||||
"openclawName": {
|
||||
"type": "string",
|
||||
"description": "Label written into OpenClaw's model registry."
|
||||
},
|
||||
"reasoning": {
|
||||
"type": "boolean",
|
||||
"description": "Whether OpenClaw should treat the model as reasoning-capable."
|
||||
},
|
||||
"contextWindow": {
|
||||
"type": "integer",
|
||||
"description": "Advertised context window. GLOBAL side effect: MAX_PROMPT_CHARS derives from max(contextWindow) x 3 across ALL entries (lib/prompt.mjs derivePromptCharBudget), so raising this on ONE model raises the truncation ceiling for EVERY model. See ADR 0009. Also feeds OpenClaw's compaction budget."
|
||||
},
|
||||
"maxTokens": {
|
||||
"type": "integer",
|
||||
"description": "Advertised output cap. OCP does not enforce it; it is propagated to OpenClaw (via setup.mjs / scripts/sync-openclaw.mjs) where it bounds request and compaction budgets."
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"aliases": {
|
||||
"type": "object",
|
||||
"description": "Short name -> canonical models[].id. Client-addressable, so a repoint changes routing for every request using the alias. Cache keys resolve these before hashing (server.mjs cacheModel).",
|
||||
"additionalProperties": { "type": "string" }
|
||||
},
|
||||
"legacyAliases": {
|
||||
"type": "object",
|
||||
"description": "Retired ids kept resolvable for backward compatibility -> canonical models[].id. Also client-addressable and also resolved in cache keys.",
|
||||
"additionalProperties": { "type": "string" }
|
||||
}
|
||||
}
|
||||
}
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "open-claude-proxy",
|
||||
"version": "3.25.0",
|
||||
"version": "3.23.0",
|
||||
"description": "OCP (Open Claude Proxy) — use your Claude Pro/Max subscription as an OpenAI-compatible API for any IDE. Works with Cline, OpenCode, Aider, Continue.dev, OpenClaw, and more.",
|
||||
"type": "module",
|
||||
"bin": {
|
||||
|
||||
+9
-70
@@ -52,7 +52,7 @@ import { TuiDeltaAssembler, DEFAULT_HOLDBACK_CHARS, resolveStreamHoldback } from
|
||||
import { createSerialMutex, createTtlCache, isTokenExpiring, orderLabelsLastGoodFirst } from "./lib/spawn-auth.mjs";
|
||||
import { hasImageContent, buildImageBlocks, buildStreamJsonInput, MultimodalError } from "./lib/multimodal.mjs";
|
||||
import { parsePositiveInt } from "./lib/env.mjs";
|
||||
import { appendOperatorPrompt, derivePromptCharBudget, selectPromptWrapper, localToolsSafetyError } from "./lib/prompt.mjs";
|
||||
import { appendOperatorPrompt, derivePromptCharBudget } from "./lib/prompt.mjs";
|
||||
|
||||
const __dirname = dirname(fileURLToPath(import.meta.url));
|
||||
const _pkg = JSON.parse(readFileSync(join(__dirname, "package.json"), "utf8"));
|
||||
@@ -198,27 +198,7 @@ function resolveClaude() {
|
||||
// Reference: https://github.com/dtzp555-max/olp commit 97e7d16 (Phase 6c)
|
||||
const OCP_SYSTEM_PROMPT_WRAPPER = `You are accessed via the OCP HTTP proxy. You do NOT have access to any local filesystem, working directory, shell, git status, or machine environment. Do not infer or invent such information from any context you observe. Respond only based on the conversation provided.`;
|
||||
|
||||
// Positive counterpart used only when OCP_LOCAL_TOOLS=1 — a single-user, loopback-bound instance
|
||||
// where the operator's own model legitimately has tools (the `-p` path passes --allowedTools). Tells
|
||||
// the model it MAY use them instead of disclaiming access it actually holds. Off by default; the
|
||||
// default wrapper above is byte-for-byte unchanged. Selecting the positive wrapper does NOT expand
|
||||
// the tool surface (governed independently by --allowedTools/--disallowedTools) — it only changes the
|
||||
// prompt — and is boot-gated below (multi/non-loopback/anon → refuse) mirroring OCP_TUI_FULL_TOOLS.
|
||||
const OCP_LOCAL_TOOLS_WRAPPER = `You are accessed via the OCP HTTP proxy running on the operator's own machine. Unlike the shared-gateway posture, you may use your available local tools to act on the operator's machine as the task requires. Use only the tools you actually have — do not assume filesystem, shell, or other access beyond the tool set provided to you in this session.`;
|
||||
|
||||
// OCP_LOCAL_TOOLS is inert in TUI mode: the interactive (non-`-p`) path composes its own prompt via
|
||||
// callClaudeTui/messagesToPrompt and never calls extractSystemPrompt, so the wrapper is only ever
|
||||
// applied on the `-p` path. LOCAL_TOOLS_ACTIVE is the single source of truth (hoisted once, house
|
||||
// style) used by the wrapper selection, the boot gate, and the startup notice — so the flag is
|
||||
// enabled/announced/gated in exactly the mode where it has an effect. (TUI tool surface is governed
|
||||
// by OCP_TUI_FULL_TOOLS instead.)
|
||||
const LOCAL_TOOLS = process.env.OCP_LOCAL_TOOLS === "1";
|
||||
const LOCAL_TOOLS_ACTIVE = LOCAL_TOOLS && process.env.CLAUDE_TUI_MODE !== "true";
|
||||
|
||||
// The wrapper actually prepended to each request's system prompt, chosen once at startup.
|
||||
const SYSTEM_PROMPT_WRAPPER = selectPromptWrapper(LOCAL_TOOLS_ACTIVE, OCP_SYSTEM_PROMPT_WRAPPER, OCP_LOCAL_TOOLS_WRAPPER);
|
||||
|
||||
// Build the full system-prompt string: SYSTEM_PROMPT_WRAPPER prepended,
|
||||
// Build the full system-prompt string: OCP_SYSTEM_PROMPT_WRAPPER prepended,
|
||||
// then any system-role messages from the request appended (separated by blank line),
|
||||
// then the operator-wide CLAUDE_SYSTEM_PROMPT appended LAST (lib/prompt.mjs — a
|
||||
// no-op returning the same string when the var is unset, so the default path is
|
||||
@@ -226,12 +206,12 @@ const SYSTEM_PROMPT_WRAPPER = selectPromptWrapper(LOCAL_TOOLS_ACTIVE, OCP_SYSTEM
|
||||
function extractSystemPrompt(messages) {
|
||||
const systemMessages = (messages ?? []).filter(m => m.role === "system");
|
||||
if (systemMessages.length === 0) {
|
||||
return appendOperatorPrompt(SYSTEM_PROMPT_WRAPPER, SYSTEM_PROMPT);
|
||||
return appendOperatorPrompt(OCP_SYSTEM_PROMPT_WRAPPER, SYSTEM_PROMPT);
|
||||
}
|
||||
const clientContent = systemMessages.map(m =>
|
||||
contentToText(m.content)
|
||||
).join("\n\n");
|
||||
return appendOperatorPrompt(`${SYSTEM_PROMPT_WRAPPER}\n\n${clientContent}`, SYSTEM_PROMPT);
|
||||
return appendOperatorPrompt(`${OCP_SYSTEM_PROMPT_WRAPPER}\n\n${clientContent}`, SYSTEM_PROMPT);
|
||||
}
|
||||
|
||||
// ── NDJSON line buffer parser (Phase 6c port) ─────────────────────────────
|
||||
@@ -394,7 +374,7 @@ const NO_CONTEXT = process.env.CLAUDE_NO_CONTEXT === "true";
|
||||
// API) are excluded because a const epoch cannot track them; truncation also only drops
|
||||
// context rather than changing the instruction set.
|
||||
const CONFIG_EPOCH = cryptoCreateHash("sha256")
|
||||
.update(JSON.stringify([SYSTEM_PROMPT, SYSTEM_PROMPT_WRAPPER, ALLOWED_TOOLS, NO_CONTEXT]))
|
||||
.update(JSON.stringify([SYSTEM_PROMPT, OCP_SYSTEM_PROMPT_WRAPPER, ALLOWED_TOOLS, NO_CONTEXT]))
|
||||
.digest("hex").slice(0, 16);
|
||||
// Kill-switch for the FIX-③ default-path spawn-home isolation (see resolveSpawnHome /
|
||||
// spawnHomeMode below). When "1", the -p/stream-json spawn always runs in the operator's
|
||||
@@ -832,21 +812,6 @@ if (TUI_MODE && PROXY_ANONYMOUS_KEY) {
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
// OCP_LOCAL_TOOLS safety gate (mirrors the OCP_TUI_FULL_TOOLS model, ADR 0007): the positive
|
||||
// "you may use local tools" system-prompt wrapper is single-user only, so refuse to boot if it
|
||||
// could reach an untrusted caller. Fail-closed on multi-tenant auth, a non-loopback bind, or an
|
||||
// anonymous key. The pure predicate lives in lib/prompt.mjs (unit-tested); the exit stays here.
|
||||
const _localToolsBootError = localToolsSafetyError({
|
||||
enabled: LOCAL_TOOLS_ACTIVE,
|
||||
authMode: AUTH_MODE,
|
||||
loopbackBind: isLoopbackBind(BIND_ADDRESS),
|
||||
anonymousKey: !!PROXY_ANONYMOUS_KEY,
|
||||
});
|
||||
if (_localToolsBootError) {
|
||||
console.error(`FATAL: ${_localToolsBootError}\n See README § "Environment Variables" (OCP_LOCAL_TOOLS) and docs/adr/0007-tui-interactive-mode.md. Refusing to start.`);
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
if (PROXY_ANONYMOUS_KEY && AUTH_MODE !== "multi") {
|
||||
console.warn("WARNING: PROXY_ANONYMOUS_KEY is set but AUTH_MODE is not 'multi' — anonymous key will be ignored");
|
||||
}
|
||||
@@ -1371,6 +1336,7 @@ function spawnClaudeProcess(model, messages, conversationId, keyName, releaseSlo
|
||||
promptChars = stdinPayload.length;
|
||||
}
|
||||
|
||||
stats.activeRequests++;
|
||||
stats.totalRequests++;
|
||||
stats.oneOffRequests++;
|
||||
if (conversationId) {
|
||||
@@ -1413,17 +1379,6 @@ function spawnClaudeProcess(model, messages, conversationId, keyName, releaseSlo
|
||||
|
||||
const proc = spawn(CLAUDE, cliArgs, spawnOpts);
|
||||
activeProcesses.add(proc);
|
||||
// Counter drift (#180, reported by @konceptnet): increment ONLY after the spawn has
|
||||
// succeeded and the process is registered. Incrementing before the spawn (as this did) leaked
|
||||
// +1 permanently on any synchronous throw in between — buildCliArgs, env assembly, the spawn
|
||||
// decision, or spawn() itself — because nothing was yet attached that could undo it.
|
||||
//
|
||||
// cleanup() is the SOLE decrement site, but note how it is reached: only 'exit' is wired HERE
|
||||
// (below); 'close' and 'error' are wired by each CALLER (callClaude / callClaudeStreaming).
|
||||
// That caller wiring is REQUIRED, not belt-and-braces — a FAILED spawn emits 'error' and
|
||||
// 'close' but never 'exit', so without it a spawn failure would never decrement. A future
|
||||
// third caller of spawnClaudeProcess must wire them too.
|
||||
stats.activeRequests++;
|
||||
|
||||
const t0 = Date.now();
|
||||
let gotFirstByte = false;
|
||||
@@ -2814,20 +2769,6 @@ async function handleChatCompletions(req, res) {
|
||||
|
||||
const messages = parsed.messages || parsed.input || [{ role: "user", content: parsed.prompt || "" }];
|
||||
const model = parsed.model || modelsConfig.aliases.sonnet;
|
||||
// Cache keys must hash the RESOLVED model, never the string the client happened to use.
|
||||
// `model` is whatever was sent — a canonical id, an alias ("opus"), or a legacyAlias
|
||||
// ("claude-opus-4"). MODEL_MAP carries all three, and models.json is read once at boot, so
|
||||
// repointing an alias only takes effect on restart — while the SQLite response_cache outlives
|
||||
// it. Hashing the raw string would therefore keep serving the OLD model's answers under that
|
||||
// alias until TTL expiry, silently defeating the repoint (the #176 hazard, for aliases).
|
||||
// Resolving first also means "opus" and "claude-opus-5" correctly share one slot: identical
|
||||
// spawn, identical answer. Only the cache KEY is resolved — `model` is still echoed back to
|
||||
// the client verbatim, so the wire response is unchanged.
|
||||
// hasOwn, not a bare lookup: MODEL_MAP is a plain object, so `MODEL_MAP["constructor"]`
|
||||
// would return an inherited FUNCTION. Unreachable today (the VALID_MODELS gate below 400s
|
||||
// first, and it is built from Object.keys so it holds only own keys), but a bare lookup
|
||||
// would hand cacheHash a function the day anyone widens that gate or moves this binding.
|
||||
const cacheModel = Object.hasOwn(MODEL_MAP, model) ? MODEL_MAP[model] : model;
|
||||
const stream = parsed.stream;
|
||||
|
||||
// Validate model against known models
|
||||
@@ -2924,7 +2865,7 @@ async function handleChatCompletions(req, res) {
|
||||
const promptCharsS = messages.reduce((a, m) => a + contentToText(m.content).length, 0);
|
||||
let structuredHash = null;
|
||||
if (CACHE_TTL > 0 && !conversationId && !hasCacheControl(messages)) {
|
||||
structuredHash = cacheHash(cacheModel, messages, { keyId: req._authKeyId, temperature: parsed.temperature, max_tokens: parsed.max_tokens, top_p: parsed.top_p, structured, configEpoch: CONFIG_EPOCH });
|
||||
structuredHash = cacheHash(model, messages, { keyId: req._authKeyId, temperature: parsed.temperature, max_tokens: parsed.max_tokens, top_p: parsed.top_p, structured });
|
||||
try {
|
||||
const cached = getCachedResponse(structuredHash, CACHE_TTL);
|
||||
if (cached) {
|
||||
@@ -2943,7 +2884,7 @@ async function handleChatCompletions(req, res) {
|
||||
// one-off structured request (not stateful sessions / client-side prompt caching), independent of
|
||||
// whether OCP response caching is enabled; when caching IS on, the same key gates cache read/write.
|
||||
const dedupKey = (!conversationId && !hasCacheControl(messages))
|
||||
? cacheHash(cacheModel, messages, { keyId: req._authKeyId, temperature: parsed.temperature, max_tokens: parsed.max_tokens, top_p: parsed.top_p, structured, configEpoch: CONFIG_EPOCH })
|
||||
? cacheHash(model, messages, { keyId: req._authKeyId, temperature: parsed.temperature, max_tokens: parsed.max_tokens, top_p: parsed.top_p, structured })
|
||||
: null;
|
||||
const runStructured = async () => {
|
||||
const c = await runStructuredCompletion(upstreamCall, model, messages, conversationId, req._authKeyName, res, structured);
|
||||
@@ -2992,7 +2933,7 @@ async function handleChatCompletions(req, res) {
|
||||
} else {
|
||||
// D1: include keyId in hash to isolate per-key cache pools (v2 format).
|
||||
// configEpoch (#176): any boot-config change that shapes answers invalidates the cache.
|
||||
const hash = cacheHash(cacheModel, messages, { keyId: req._authKeyId, temperature: parsed.temperature, max_tokens: parsed.max_tokens, top_p: parsed.top_p, configEpoch: CONFIG_EPOCH });
|
||||
const hash = cacheHash(model, messages, { keyId: req._authKeyId, temperature: parsed.temperature, max_tokens: parsed.max_tokens, top_p: parsed.top_p, configEpoch: CONFIG_EPOCH });
|
||||
req._cacheHash = hash; // store for later write-back
|
||||
try {
|
||||
const cached = getCachedResponse(hash, CACHE_TTL);
|
||||
@@ -3637,8 +3578,6 @@ server.listen(PORT, BIND_ADDRESS, () => {
|
||||
console.log(`Auth: ${PROXY_API_KEY ? "enabled (PROXY_API_KEY set)" : "disabled (no PROXY_API_KEY)"}`);
|
||||
console.log(`Auth mode: ${AUTH_MODE}${AUTH_MODE === "shared" ? " (PROXY_API_KEY)" : AUTH_MODE === "multi" ? " (per-user keys)" : " (open)"}`);
|
||||
console.log(`Bind: ${BIND_ADDRESS}${BIND_ADDRESS === "0.0.0.0" ? " ⚠ LAN-accessible" : ""}`);
|
||||
if (LOCAL_TOOLS_ACTIVE) console.log(`Local tools: ON (OCP_LOCAL_TOOLS=1) — model told it may use local tools; single-user/loopback only`);
|
||||
else if (LOCAL_TOOLS) console.warn(`⚠ OCP_LOCAL_TOOLS=1 is ignored in TUI mode (the -p system-prompt wrapper is not used). The TUI tool surface is governed by OCP_TUI_FULL_TOOLS.`);
|
||||
if (NO_CONTEXT) console.log(`Context: suppressed (CLAUDE_NO_CONTEXT=true — no CLAUDE.md, no auto-memory)`);
|
||||
if (CACHE_TTL > 0) console.log(`Cache: enabled (TTL=${CACHE_TTL / 1000}s)`);
|
||||
else console.log(`Cache: disabled (set CLAUDE_CACHE_TTL to enable)`);
|
||||
|
||||
+4
-510
@@ -844,7 +844,7 @@ test("doctor falls back to currentVersion when origin/main unreachable (no stale
|
||||
// contract lives in lib/prompt.mjs. Mutation-proof: make appendOperatorPrompt
|
||||
// return `base` unconditionally and the first test fails; make it stop trimming
|
||||
// and the whitespace test fails.
|
||||
import { appendOperatorPrompt, derivePromptCharBudget, resolvePromptCharBudget, selectPromptWrapper, localToolsSafetyError } from "./lib/prompt.mjs";
|
||||
import { appendOperatorPrompt, derivePromptCharBudget, resolvePromptCharBudget } from "./lib/prompt.mjs";
|
||||
|
||||
console.log("\nPrompt-char budget (ADR 0009 — SPOT-derived):");
|
||||
|
||||
@@ -906,394 +906,6 @@ test("appendOperatorPrompt: operator value is trimmed before appending", () => {
|
||||
assert.equal(appendOperatorPrompt("W", " hi "), "W\n\nhi");
|
||||
});
|
||||
|
||||
// ── OCP_LOCAL_TOOLS wrapper selection + safety gate (lib/prompt.mjs) ──────────
|
||||
console.log("\nOCP_LOCAL_TOOLS wrapper + safety gate:");
|
||||
|
||||
const NEG = "You do NOT have access to any local filesystem";
|
||||
const POS = "you may use your available local tools";
|
||||
|
||||
test("selectPromptWrapper: default (disabled) returns the negative wrapper BYTE-IDENTICAL", () => {
|
||||
// Mutation-proof: flip the ternary and the default path leaks the positive wrapper.
|
||||
assert.equal(selectPromptWrapper(false, NEG, POS), NEG);
|
||||
});
|
||||
|
||||
test("selectPromptWrapper: enabled returns the positive (local-tools) wrapper", () => {
|
||||
assert.equal(selectPromptWrapper(true, NEG, POS), POS);
|
||||
});
|
||||
|
||||
test("localToolsSafetyError: disabled → null regardless of an otherwise-unsafe deploy", () => {
|
||||
// The gate must not fire when the flag is off — the default path is never blocked.
|
||||
assert.equal(localToolsSafetyError({ enabled: false, authMode: "multi", loopbackBind: false, anonymousKey: true }), null);
|
||||
});
|
||||
|
||||
test("localToolsSafetyError: enabled on a safe single-user loopback instance → null (boots)", () => {
|
||||
assert.equal(localToolsSafetyError({ enabled: true, authMode: "none", loopbackBind: true, anonymousKey: false }), null);
|
||||
assert.equal(localToolsSafetyError({ enabled: true, authMode: "shared", loopbackBind: true, anonymousKey: false }), null);
|
||||
});
|
||||
|
||||
test("localToolsSafetyError: enabled + AUTH_MODE=multi → fatal (guest could be told it has FS)", () => {
|
||||
const e = localToolsSafetyError({ enabled: true, authMode: "multi", loopbackBind: true, anonymousKey: false });
|
||||
assert.ok(e && /multi/.test(e), `expected a multi-tenant fatal, got: ${e}`);
|
||||
});
|
||||
|
||||
test("localToolsSafetyError: enabled + non-loopback bind → fatal (network-exposed)", () => {
|
||||
const e = localToolsSafetyError({ enabled: true, authMode: "none", loopbackBind: false, anonymousKey: false });
|
||||
assert.ok(e && /loopback/.test(e), `expected a loopback fatal, got: ${e}`);
|
||||
});
|
||||
|
||||
test("localToolsSafetyError: enabled + anonymous key → fatal (unnamed callers)", () => {
|
||||
const e = localToolsSafetyError({ enabled: true, authMode: "none", loopbackBind: true, anonymousKey: true });
|
||||
assert.ok(e && /ANONYMOUS/i.test(e), `expected an anonymous-key fatal, got: ${e}`);
|
||||
});
|
||||
|
||||
test("localToolsSafetyError: multi is checked before loopback/anon (most severe first)", () => {
|
||||
// A deploy that trips several conditions reports the multi-tenant one — the strongest signal.
|
||||
const e = localToolsSafetyError({ enabled: true, authMode: "multi", loopbackBind: false, anonymousKey: true });
|
||||
assert.ok(/multi/.test(e));
|
||||
});
|
||||
|
||||
// ── OCP_LOCAL_TOOLS INTEGRATION: boot real server.mjs, observe the -p spawn ──────────
|
||||
// The unit tests above prove the pure helpers. These close the INTEGRATION SEAM the suite
|
||||
// otherwise can't reach (server.mjs boots a listener on import): a fake `claude` captures the
|
||||
// exact --system-prompt OCP spawns it with, so we assert the SELECTED wrapper actually reaches
|
||||
// a request — and boot-gate refusals are asserted by the process exit code. Without these, the
|
||||
// wiring (extractSystemPrompt using SYSTEM_PROMPT_WRAPPER, the boot gate, the epoch fold) can be
|
||||
// silently reverted with the unit suite still green — the maintainer's #1 rejection pattern.
|
||||
import { spawn as _ltSpawn, execFileSync as _ltExecFile } from "node:child_process";
|
||||
import { createServer as _ltNetServer } from "node:net";
|
||||
import { writeFileSync as _ltWrite, chmodSync as _ltChmod, readFileSync as _ltRead, existsSync as _ltExists, rmSync as _ltRm, mkdtempSync as _ltMkdtemp } from "node:fs";
|
||||
import { tmpdir as _ltTmp } from "node:os";
|
||||
import { fileURLToPath as _ltF2P } from "node:url";
|
||||
|
||||
const LT_SERVER = _ltF2P(new URL("./server.mjs", import.meta.url));
|
||||
const LT_POSIX = process.platform !== "win32"; // fake is a /bin/sh script; CI is POSIX
|
||||
const LT_NEG_MARK = "You do NOT have access to any local filesystem";
|
||||
const LT_POS_MARK = "you may use your available local tools";
|
||||
// Fake claude: record the --system-prompt it was spawned with, bump an optional spawn counter,
|
||||
// then emit a minimal valid stream-json response so the request completes (and caches).
|
||||
const LT_FAKE = `#!/bin/sh
|
||||
prev=""
|
||||
for a in "$@"; do
|
||||
if [ "$prev" = "--system-prompt" ]; then printf '%s' "$a" > "$SP_CAPTURE"; fi
|
||||
prev="$a"
|
||||
done
|
||||
if [ -n "$SP_COUNTER" ]; then c=$(cat "$SP_COUNTER" 2>/dev/null || echo 0); echo $((c+1)) > "$SP_COUNTER"; fi
|
||||
printf '%s\\n' '{"type":"assistant","message":{"content":[{"type":"text","text":"OK"}]}}'
|
||||
printf '%s\\n' '{"type":"result"}'
|
||||
exit 0
|
||||
`;
|
||||
|
||||
function ltMkdir() { return _ltMkdtemp(join(_ltTmp(), "ocp-lt-")); }
|
||||
function ltFake(dir) { const p = join(dir, "claude"); _ltWrite(p, LT_FAKE); _ltChmod(p, 0o755); return p; }
|
||||
function ltBoot(env, dir, nodeArgs = []) {
|
||||
const child = _ltSpawn(process.execPath, [...nodeArgs, LT_SERVER], {
|
||||
env: { ...process.env, NODE_ENV: "test", OCP_DIR_OVERRIDE: dir, OCP_SKIP_AUTH_TEST: "1",
|
||||
CLAUDE_BIND: "127.0.0.1", CLAUDE_AUTH_MODE: "none", CLAUDE_CACHE_TTL: "0", CLAUDE_TIMEOUT: "4000", ...env },
|
||||
stdio: ["ignore", "pipe", "pipe"],
|
||||
});
|
||||
const buf = { out: "", err: "", exit: undefined };
|
||||
child.stdout.on("data", d => { buf.out += d; });
|
||||
child.stderr.on("data", d => { buf.err += d; });
|
||||
child.on("exit", code => { buf.exit = code; });
|
||||
return { child, buf };
|
||||
}
|
||||
async function ltWait(cond, ms = 9000) {
|
||||
const start = Date.now();
|
||||
while (Date.now() - start < ms) { if (cond()) return true; await new Promise(r => setTimeout(r, 40)); }
|
||||
return false;
|
||||
}
|
||||
async function ltPost(port, body) {
|
||||
try {
|
||||
await fetch(`http://127.0.0.1:${port}/v1/chat/completions`, {
|
||||
method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body),
|
||||
});
|
||||
} catch { /* the fake may close the socket; the spawn (and capture) already happened */ }
|
||||
}
|
||||
|
||||
console.log("\nOCP_LOCAL_TOOLS integration (boot server.mjs):");
|
||||
|
||||
test("integration: OCP_LOCAL_TOOLS=1 → the -p spawn receives the POSITIVE wrapper (kills the no-op mutation)", async () => {
|
||||
if (!LT_POSIX) return; // sh fake — skip on Windows CI
|
||||
const dir = ltMkdir(); const cap = join(dir, "sp.txt"); const fake = ltFake(dir);
|
||||
const { child, buf } = ltBoot({ OCP_LOCAL_TOOLS: "1", CLAUDE_BIN: fake, CLAUDE_PROXY_PORT: "39321", SP_CAPTURE: cap }, dir);
|
||||
try {
|
||||
assert.ok(await ltWait(() => buf.out.includes("listening on") || buf.exit != null), `server did not start: ${buf.err.slice(0,200)}`);
|
||||
await ltPost(39321, { model: "sonnet", messages: [{ role: "user", content: "hi" }] });
|
||||
assert.ok(await ltWait(() => _ltExists(cap)), "fake claude was spawned and captured --system-prompt");
|
||||
const sp = _ltRead(cap, "utf8");
|
||||
assert.ok(sp.includes(LT_POS_MARK), `expected POSITIVE wrapper in --system-prompt, got: ${sp.slice(0,90)}`);
|
||||
assert.ok(!sp.includes(LT_NEG_MARK), "positive wrapper must REPLACE the negative one, not append");
|
||||
} finally { child.kill("SIGKILL"); _ltRm(dir, { recursive: true, force: true }); }
|
||||
});
|
||||
|
||||
test("integration: flag OFF → the -p spawn receives the EXACT negative wrapper (default path byte-for-byte)", async () => {
|
||||
if (!LT_POSIX) return;
|
||||
const dir = ltMkdir(); const cap = join(dir, "sp.txt"); const fake = ltFake(dir);
|
||||
const { child, buf } = ltBoot({ CLAUDE_BIN: fake, CLAUDE_PROXY_PORT: "39322", SP_CAPTURE: cap }, dir); // OCP_LOCAL_TOOLS unset
|
||||
try {
|
||||
assert.ok(await ltWait(() => buf.out.includes("listening on") || buf.exit != null), `server did not start: ${buf.err.slice(0,200)}`);
|
||||
await ltPost(39322, { model: "sonnet", messages: [{ role: "user", content: "hi" }] });
|
||||
assert.ok(await ltWait(() => _ltExists(cap)), "fake claude captured --system-prompt");
|
||||
const sp = _ltRead(cap, "utf8");
|
||||
// No system messages + no CLAUDE_SYSTEM_PROMPT → the wrapper is passed verbatim.
|
||||
assert.equal(sp, `You are accessed via the OCP HTTP proxy. You do NOT have access to any local filesystem, working directory, shell, git status, or machine environment. Do not infer or invent such information from any context you observe. Respond only based on the conversation provided.`);
|
||||
} finally { child.kill("SIGKILL"); _ltRm(dir, { recursive: true, force: true }); }
|
||||
});
|
||||
|
||||
test("integration: boot gate REFUSES each unsafe config (multi / non-loopback / anon key)", async () => {
|
||||
if (!LT_POSIX) return;
|
||||
const dir = ltMkdir(); const fake = ltFake(dir);
|
||||
const cases = [
|
||||
{ label: "multi", env: { CLAUDE_AUTH_MODE: "multi" } },
|
||||
{ label: "non-loopback", env: { CLAUDE_BIND: "0.0.0.0" } },
|
||||
{ label: "anon", env: { PROXY_ANONYMOUS_KEY: "pub" } },
|
||||
];
|
||||
try {
|
||||
for (const [i, c] of cases.entries()) {
|
||||
const { child, buf } = ltBoot({ OCP_LOCAL_TOOLS: "1", CLAUDE_BIN: fake, CLAUDE_PROXY_PORT: String(39330 + i), ...c.env }, dir);
|
||||
try {
|
||||
assert.ok(await ltWait(() => buf.exit != null), `[${c.label}] expected the process to exit`);
|
||||
assert.notEqual(buf.exit, 0, `[${c.label}] must exit non-zero`);
|
||||
assert.ok(/FATAL[\s\S]*OCP_LOCAL_TOOLS/.test(buf.err), `[${c.label}] expected a local-tools FATAL, got: ${buf.err.slice(0,160)}`);
|
||||
} finally { child.kill("SIGKILL"); }
|
||||
}
|
||||
} finally { _ltRm(dir, { recursive: true, force: true }); }
|
||||
});
|
||||
|
||||
test("integration: safe single-user config BOOTS past the gate and announces local tools", async () => {
|
||||
if (!LT_POSIX) return;
|
||||
const dir = ltMkdir(); const fake = ltFake(dir);
|
||||
const { child, buf } = ltBoot({ OCP_LOCAL_TOOLS: "1", CLAUDE_BIN: fake, CLAUDE_PROXY_PORT: "39340" }, dir); // loopback + none
|
||||
try {
|
||||
assert.ok(await ltWait(() => buf.out.includes("listening on")), `safe config must boot, got: ${buf.err.slice(0,200)}`);
|
||||
assert.ok(buf.out.includes("Local tools: ON"), "startup must announce local tools when active");
|
||||
} finally { child.kill("SIGKILL"); _ltRm(dir, { recursive: true, force: true }); }
|
||||
});
|
||||
|
||||
test("integration: TUI mode → flag is announced INERT (not 'ON'), boot not refused", async () => {
|
||||
if (!LT_POSIX) return;
|
||||
const dir = ltMkdir(); const fake = ltFake(dir);
|
||||
// Non-loopback would normally trip the local-tools gate; under TUI the flag is inert so the
|
||||
// gate must NOT fire on its behalf. Use loopback here to isolate TUI's own guards from ours.
|
||||
const { child, buf } = ltBoot({ OCP_LOCAL_TOOLS: "1", CLAUDE_TUI_MODE: "true", CLAUDE_BIN: fake, CLAUDE_PROXY_PORT: "39341" }, dir);
|
||||
try {
|
||||
assert.ok(await ltWait(() => buf.out.includes("listening on") || buf.exit != null), `did not start: ${buf.err.slice(0,200)}`);
|
||||
assert.ok(!buf.out.includes("Local tools: ON"), "must NOT claim local tools are ON in TUI mode (the wrapper is unused there)");
|
||||
assert.ok(/ignored in TUI mode/.test(buf.out + buf.err), "must warn that OCP_LOCAL_TOOLS is inert under TUI");
|
||||
} finally { child.kill("SIGKILL"); _ltRm(dir, { recursive: true, force: true }); }
|
||||
});
|
||||
|
||||
test("integration: toggling OCP_LOCAL_TOOLS invalidates the standard response cache (epoch fold)", async () => {
|
||||
if (!LT_POSIX) return;
|
||||
const dir = ltMkdir(); const fake = ltFake(dir); const counter = join(dir, "spawns.txt");
|
||||
const req = { model: "sonnet", messages: [{ role: "user", content: "epoch-probe" }] };
|
||||
const bootOnce = async (env, port) => {
|
||||
const { child, buf } = ltBoot({ CLAUDE_BIN: fake, CLAUDE_PROXY_PORT: String(port), CLAUDE_CACHE_TTL: "60000", SP_COUNTER: counter, ...env }, dir);
|
||||
try {
|
||||
assert.ok(await ltWait(() => buf.out.includes("listening on")), `did not start: ${buf.err.slice(0,160)}`);
|
||||
_ltWrite(counter, "0"); // reset AFTER boot so boot-time spawns (if any) don't count
|
||||
await ltPost(port, req);
|
||||
await ltWait(() => (Number(_ltRead(counter, "utf8")) || 0) >= 1, 3000); // give the spawn a beat
|
||||
return Number(_ltRead(counter, "utf8")) || 0;
|
||||
} finally { child.kill("SIGKILL"); }
|
||||
};
|
||||
try {
|
||||
const off = await bootOnce({}, 39350); // caches "OK" under epoch(negative)
|
||||
const on = await bootOnce({ OCP_LOCAL_TOOLS: "1" }, 39351); // same DB, epoch(positive) → must MISS → re-spawn
|
||||
assert.equal(off, 1, "first request (cache empty) must spawn claude");
|
||||
assert.equal(on, 1, "after toggling the flag the identical request must NOT be served from the old cache (epoch differs → re-spawn)");
|
||||
} finally { _ltRm(dir, { recursive: true, force: true }); }
|
||||
});
|
||||
|
||||
// ── active-request counter is paired to the process lifecycle (#180 / #193) ──
|
||||
// The counter used to be incremented ~40 lines before the spawn, while its only decrement
|
||||
// (cleanup()) is wired to that proc's events — so any SYNCHRONOUS throw in between leaked +1
|
||||
// permanently. Driving that fault needs no production hook and no test double: buildCliArgs
|
||||
// does `args.push("--allowedTools", ...ALLOWED_TOOLS)`, and a spread of enough elements throws
|
||||
// RangeError synchronously, right inside the window.
|
||||
//
|
||||
// Getting there on Linux needs one more turn of the screw. The spread's cost is per ELEMENT,
|
||||
// so the naive form needs ~124k elements ≈ 250KB in one env var — and Linux caps a single env
|
||||
// string at MAX_ARG_STRLEN (32 * PAGE_SIZE = 131072 on x86-64), so execve rejects it (E2BIG).
|
||||
// Encoding around it fails too: empty items are 1 byte each, but `.filter(Boolean)`
|
||||
// (server.mjs:355) strips them, so ALLOWED_TOOLS ends up empty and the spread branch is never
|
||||
// entered at all.
|
||||
//
|
||||
// The lever is the stack: the throw threshold scales with it, and ltBoot spawns the server, so
|
||||
// the test owns its argv. Running the child under --stack-size=200 drops the threshold ~5x
|
||||
// (~24k elements ≈ 48KB), which fits Linux's limit with room to spare.
|
||||
//
|
||||
// The threshold is DISCOVERED, in a child under the SAME --stack-size (measuring it in this
|
||||
// process would report the parent's stack, which is not the one that matters), then taken with
|
||||
// 1.5x margin and hard-asserted under MAX_ARG_STRLEN. A hard-coded count would silently stop
|
||||
// triggering on another machine and the test would pass vacuously.
|
||||
const LT_STACK = 200; // child V8 stack (KB); lowers the spread-throw threshold
|
||||
const LT_MAX_ARG_STRLEN = 131072; // Linux, x86-64: 32 * 4096
|
||||
function ltSpreadThrowCount(stackKb) {
|
||||
// Binary-search the smallest element count whose spread throws, inside a child running with
|
||||
// the stack the server will actually use.
|
||||
const src = `const t=n=>{try{const a=[];a.push("--allowedTools",...Array(n).fill("x"));return false}catch{return true}};` +
|
||||
`let lo=500,hi=400000;if(!t(hi)){console.log(0)}else{while(lo<hi){const m=(lo+hi)>>1;t(m)?hi=m:lo=m+1}console.log(lo)}`;
|
||||
try {
|
||||
return Number(String(_ltExecFile(process.execPath, [`--stack-size=${stackKb}`, "-e", src], { encoding: "utf8" })).trim()) || 0;
|
||||
} catch { return 0; }
|
||||
}
|
||||
async function ltFreePort() {
|
||||
const srv = _ltNetServer();
|
||||
await new Promise(r => srv.listen(0, "127.0.0.1", r));
|
||||
const p = srv.address().port;
|
||||
await new Promise(r => srv.close(r));
|
||||
return p;
|
||||
}
|
||||
async function ltPostStatus(port, body) {
|
||||
try {
|
||||
const r = await fetch(`http://127.0.0.1:${port}/v1/chat/completions`, {
|
||||
method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body),
|
||||
});
|
||||
return { status: r.status, text: await r.text() };
|
||||
} catch { return { status: 0, text: "" }; }
|
||||
}
|
||||
|
||||
console.log("\nactive-request counter pairing (#180 / #193):");
|
||||
|
||||
test("integration: a synchronous pre-spawn throw must not leak stats.activeRequests", async () => {
|
||||
if (!LT_POSIX) return;
|
||||
const thr = ltSpreadThrowCount(LT_STACK);
|
||||
assert.ok(thr > 0, `no spread-throw threshold found under --stack-size=${LT_STACK}`);
|
||||
const n = Math.ceil(thr * 1.5); // margin over the measured threshold
|
||||
const entry = Array(n).fill("x").join(",");
|
||||
const bytes = Buffer.byteLength(entry);
|
||||
// Hard gate: if this ever stops fitting, fail loudly rather than regress to an E2BIG skip.
|
||||
assert.ok(bytes <= LT_MAX_ARG_STRLEN,
|
||||
`env entry ${bytes}B exceeds MAX_ARG_STRLEN ${LT_MAX_ARG_STRLEN}B — lower LT_STACK`);
|
||||
const port = await ltFreePort();
|
||||
const dir = ltMkdir(); const fake = ltFake(dir);
|
||||
const { child, buf } = ltBoot({
|
||||
CLAUDE_BIN: fake, CLAUDE_PROXY_PORT: String(port), CLAUDE_ALLOWED_TOOLS: entry,
|
||||
}, dir, [`--stack-size=${LT_STACK}`]);
|
||||
let spawnErr = null;
|
||||
child.on("error", e => { spawnErr = e; });
|
||||
try {
|
||||
const up = await ltWait(() => buf.out.includes("listening on") || spawnErr, 20000);
|
||||
assert.ok(up && !spawnErr, `did not start: ${spawnErr ? spawnErr.message : buf.err.slice(0, 300)}`);
|
||||
const req = { model: "haiku", messages: [{ role: "user", content: "leak-probe" }] };
|
||||
const res = [];
|
||||
for (let i = 0; i < 3; i++) res.push(await ltPostStatus(port, req));
|
||||
// Non-vacuous on two axes: the requests must actually fail, AND the failure must be the
|
||||
// stack overflow from the --allowedTools spread — not some unrelated 500 that a small
|
||||
// stack happened to produce. Without the second check a different fault would still leave
|
||||
// the counter at 0 and the test would "pass" for the wrong reason.
|
||||
assert.deepEqual(res.map(r => r.status), [500, 500, 500],
|
||||
`expected the pre-spawn throw to surface as 500s, got ${res.map(r => r.status)}`);
|
||||
assert.ok(res.every(r => /call stack size exceeded/i.test(r.text)),
|
||||
`500s must come from the spread's RangeError; got: ${res[0].text.slice(0, 200)}`);
|
||||
const r = await fetch(`http://127.0.0.1:${port}/status`);
|
||||
const active = (await r.json()).requests.active;
|
||||
assert.equal(active, 0,
|
||||
`3 requests threw before their spawn; the counter must be back to 0, got ${active} (this is the #180 leak)`);
|
||||
} finally { child.kill("SIGKILL"); _ltRm(dir, { recursive: true, force: true }); }
|
||||
});
|
||||
|
||||
// ── Cache keys hash the RESOLVED model, not the alias string (#194) ──────────
|
||||
// models.json is read once at boot, so repointing an alias only takes effect on restart —
|
||||
// while the SQLite response_cache outlives it. Hashing the raw string would keep serving the
|
||||
// OLD model's answers under that alias until TTL expiry. Rather than mutate models.json
|
||||
// mid-suite, these assert the equivalent observable: an alias and its canonical target must
|
||||
// land on the SAME cache slot, which is true only if the key is resolved before hashing.
|
||||
// Mutation: change `cacheModel` back to `model` at the three cacheHash call sites in
|
||||
// server.mjs and both tests go red (2 spawns instead of 1).
|
||||
|
||||
// Fake that emits schema-valid JSON, so the structured path caches a VALIDATED result
|
||||
// (the stock LT_FAKE returns "OK", which fails validation → refusal → never cached).
|
||||
const LT_FAKE_JSON = `#!/bin/sh
|
||||
if [ -n "$SP_COUNTER" ]; then c=$(cat "$SP_COUNTER" 2>/dev/null || echo 0); echo $((c+1)) > "$SP_COUNTER"; fi
|
||||
printf '%s\\n' '{"type":"assistant","message":{"content":[{"type":"text","text":"{\\"ok\\":true}"}]}}'
|
||||
printf '%s\\n' '{"type":"result"}'
|
||||
exit 0
|
||||
`;
|
||||
function ltFakeJson(dir) { const p = join(dir, "claude-json"); _ltWrite(p, LT_FAKE_JSON); _ltChmod(p, 0o755); return p; }
|
||||
const LT_SCHEMA = { type: "object", properties: { ok: { type: "boolean" } }, required: ["ok"], additionalProperties: false };
|
||||
|
||||
console.log("\nCache key resolves the model alias (#194):");
|
||||
|
||||
test("integration: an alias and its canonical target share ONE cache slot (normal path)", async () => {
|
||||
if (!LT_POSIX) return;
|
||||
const dir = ltMkdir(); const fake = ltFake(dir); const counter = join(dir, "spawns.txt");
|
||||
const { child, buf } = ltBoot({ CLAUDE_BIN: fake, CLAUDE_PROXY_PORT: "39360", CLAUDE_CACHE_TTL: "60000", SP_COUNTER: counter }, dir);
|
||||
try {
|
||||
assert.ok(await ltWait(() => buf.out.includes("listening on")), `did not start: ${buf.err.slice(0, 200)}`);
|
||||
_ltWrite(counter, "0");
|
||||
const msgs = [{ role: "user", content: "alias-resolution-probe" }];
|
||||
await ltPost(39360, { model: "sonnet", messages: msgs }); // miss → spawn
|
||||
await ltWait(() => (Number(_ltRead(counter, "utf8")) || 0) >= 1, 3000);
|
||||
await ltPost(39360, { model: "claude-sonnet-5", messages: msgs }); // same resolved model → HIT
|
||||
await new Promise(r => setTimeout(r, 600));
|
||||
assert.equal(Number(_ltRead(counter, "utf8")) || 0, 1,
|
||||
"the canonical id must hit the slot the alias populated — a 2nd spawn means the key still hashes the raw alias");
|
||||
} finally { child.kill("SIGKILL"); _ltRm(dir, { recursive: true, force: true }); }
|
||||
});
|
||||
|
||||
test("integration: an alias and its canonical target share ONE cache slot (STRUCTURED path)", async () => {
|
||||
if (!LT_POSIX) return;
|
||||
const dir = ltMkdir(); const fake = ltFakeJson(dir); const counter = join(dir, "spawns.txt");
|
||||
const { child, buf } = ltBoot({ CLAUDE_BIN: fake, CLAUDE_PROXY_PORT: "39361", CLAUDE_CACHE_TTL: "60000", SP_COUNTER: counter }, dir);
|
||||
try {
|
||||
assert.ok(await ltWait(() => buf.out.includes("listening on")), `did not start: ${buf.err.slice(0, 200)}`);
|
||||
_ltWrite(counter, "0");
|
||||
const rf = { type: "json_schema", json_schema: { name: "probe", schema: LT_SCHEMA } };
|
||||
const msgs = [{ role: "user", content: "structured-alias-probe" }];
|
||||
await ltPost(39361, { model: "sonnet", messages: msgs, response_format: rf });
|
||||
await ltWait(() => (Number(_ltRead(counter, "utf8")) || 0) >= 1, 4000);
|
||||
await ltPost(39361, { model: "claude-sonnet-5", messages: msgs, response_format: rf });
|
||||
await new Promise(r => setTimeout(r, 600));
|
||||
assert.equal(Number(_ltRead(counter, "utf8")) || 0, 1,
|
||||
"structured cache key must resolve the alias too — this is the path the epoch-only fix missed");
|
||||
} finally { child.kill("SIGKILL"); _ltRm(dir, { recursive: true, force: true }); }
|
||||
});
|
||||
|
||||
// MODEL_MAP is models[] + aliases + legacyAliases, so resolving covers legacyAliases for free.
|
||||
// The three tests above all use `sonnet` (a plain alias); this pins the legacyAlias leg explicitly
|
||||
// rather than leaving it covered only by construction.
|
||||
test("integration: a legacyAlias shares ONE cache slot with its canonical target", async () => {
|
||||
if (!LT_POSIX) return;
|
||||
const dir = ltMkdir(); const fake = ltFake(dir); const counter = join(dir, "spawns.txt");
|
||||
const { child, buf } = ltBoot({ CLAUDE_BIN: fake, CLAUDE_PROXY_PORT: "39364", CLAUDE_CACHE_TTL: "60000", SP_COUNTER: counter }, dir);
|
||||
try {
|
||||
assert.ok(await ltWait(() => buf.out.includes("listening on")), `did not start: ${buf.err.slice(0, 200)}`);
|
||||
_ltWrite(counter, "0");
|
||||
const msgs = [{ role: "user", content: "legacy-alias-probe" }];
|
||||
await ltPost(39364, { model: "claude-haiku-4-5", messages: msgs }); // legacyAlias
|
||||
await ltWait(() => (Number(_ltRead(counter, "utf8")) || 0) >= 1, 3000);
|
||||
await ltPost(39364, { model: "claude-haiku-4-5-20251001", messages: msgs }); // canonical
|
||||
await new Promise(r => setTimeout(r, 600));
|
||||
assert.equal(Number(_ltRead(counter, "utf8")) || 0, 1,
|
||||
"legacyAliases live in MODEL_MAP too — resolving must collapse them onto the canonical slot");
|
||||
} finally { child.kill("SIGKILL"); _ltRm(dir, { recursive: true, force: true }); }
|
||||
});
|
||||
|
||||
test("integration: a config change invalidates the STRUCTURED cache too (closes the #177 gap)", async () => {
|
||||
if (!LT_POSIX) return;
|
||||
const dir = ltMkdir(); const fake = ltFakeJson(dir); const counter = join(dir, "spawns.txt");
|
||||
const rf = { type: "json_schema", json_schema: { name: "probe", schema: LT_SCHEMA } };
|
||||
const req = { model: "sonnet", messages: [{ role: "user", content: "structured-epoch-probe" }], response_format: rf };
|
||||
const bootOnce = async (env, port) => {
|
||||
const { child, buf } = ltBoot({ CLAUDE_BIN: fake, CLAUDE_PROXY_PORT: String(port), CLAUDE_CACHE_TTL: "60000", SP_COUNTER: counter, ...env }, dir);
|
||||
try {
|
||||
assert.ok(await ltWait(() => buf.out.includes("listening on")), `did not start: ${buf.err.slice(0, 200)}`);
|
||||
_ltWrite(counter, "0");
|
||||
await ltPost(port, req);
|
||||
await ltWait(() => (Number(_ltRead(counter, "utf8")) || 0) >= 1, 4000);
|
||||
return Number(_ltRead(counter, "utf8")) || 0;
|
||||
} finally { child.kill("SIGKILL"); }
|
||||
};
|
||||
try {
|
||||
const off = await bootOnce({}, 39362); // caches under epoch(negative wrapper)
|
||||
const on = await bootOnce({ OCP_LOCAL_TOOLS: "1" }, 39363); // same DB, epoch differs → must re-spawn
|
||||
assert.equal(off, 1, "first structured request (cache empty) must spawn claude");
|
||||
assert.equal(on, 1, "structured cache must honor CONFIG_EPOCH — before #194 it omitted the epoch entirely and served the stale answer");
|
||||
} finally { _ltRm(dir, { recursive: true, force: true }); }
|
||||
});
|
||||
|
||||
// ── Upgrade Tests ──
|
||||
import { runUpgrade, postFlightOk } from "./scripts/upgrade.mjs";
|
||||
|
||||
@@ -2399,32 +2011,10 @@ console.log("\nTUI command construction (proxy-purity / #4):");
|
||||
test("buildTuiCmd suppresses host CLAUDE.md + auto-memory (proxy purity, #4)", () => {
|
||||
const cmd = buildTuiCmd("/usr/bin/claude", "claude-haiku", "sid-1", "/home/u", "cli");
|
||||
// OCP is a proxy: the host's CLAUDE.md / auto-memory must never leak into the proxied turn.
|
||||
// Primary mechanism is --safe-mode (env vars alone stopped suppressing on newer claude);
|
||||
// the env vars remain as belt-and-braces.
|
||||
assert.ok(/(^| )--safe-mode( |$)/.test(cmd), "default pane must pass --safe-mode (disables host CLAUDE.md/skills/plugins/hooks)");
|
||||
assert.ok(/(^| )CLAUDE_CODE_DISABLE_CLAUDE_MDS=1( |$)/.test(cmd), "must disable CLAUDE.md injection");
|
||||
assert.ok(/(^| )CLAUDE_CODE_DISABLE_AUTO_MEMORY=1( |$)/.test(cmd), "must disable auto-memory injection");
|
||||
});
|
||||
|
||||
test("buildTuiCmd omits --safe-mode when a customization it would strip is in use", () => {
|
||||
const save = process.env.OCP_TUI_FULL_TOOLS;
|
||||
try {
|
||||
delete process.env.OCP_TUI_FULL_TOOLS;
|
||||
// streaming registers a MessageDisplay HOOK via --settings; --safe-mode would kill the hook
|
||||
// (zero deltas), so it must be omitted on the streaming pane.
|
||||
const streaming = buildTuiCmd("/usr/bin/claude", "m", "sid-s", "/home/u", "cli", { file: "/d/sid-s.jsonl", settings: "/d/s.json" });
|
||||
assert.ok(!/--safe-mode/.test(streaming), "streaming pane must NOT pass --safe-mode (would disable the MessageDisplay hook)");
|
||||
assert.ok(streaming.includes("--settings '/d/s.json'"), "streaming pane keeps its --settings hook");
|
||||
|
||||
// OCP_TUI_FULL_TOOLS grants an MCP/skills surface --safe-mode disables wholesale.
|
||||
process.env.OCP_TUI_FULL_TOOLS = "1";
|
||||
const full = buildTuiCmd("/usr/bin/claude", "m", "sid-f", "/home/u", "cli");
|
||||
assert.ok(!/--safe-mode/.test(full), "full-tools pane must NOT pass --safe-mode (would disable MCP/skills)");
|
||||
} finally {
|
||||
if (save === undefined) delete process.env.OCP_TUI_FULL_TOOLS; else process.env.OCP_TUI_FULL_TOOLS = save;
|
||||
}
|
||||
});
|
||||
|
||||
test("buildTuiCmd keeps version pin + entrypoint label + MCP wall", () => {
|
||||
const cli = buildTuiCmd("/usr/bin/claude", "m", "sid-2", "/home/u", "cli");
|
||||
assert.ok(cli.includes("DISABLE_AUTOUPDATER=1"), "version pin retained");
|
||||
@@ -3716,7 +3306,7 @@ if (process.env.OCP_TUI_LIVE === "1") {
|
||||
// Replicates tuiInputReady, tuiPromptLanded verbatim from lib/tui/session.mjs.
|
||||
// Keep in sync with the definitions there.
|
||||
function _tuiInputReady(pane) {
|
||||
return /\? for shortcuts|shift\+tab to cycle/.test(pane);
|
||||
return /\? for shortcuts/.test(pane);
|
||||
}
|
||||
function _tuiPromptLanded(pane, prompt) {
|
||||
const flatPane = pane.replace(/\s+/g, " ");
|
||||
@@ -3734,12 +3324,7 @@ const TUI_READY_PANE = `❯ Try "how does <filepath> work?"
|
||||
const TUI_LANDED_PANE = `❯ Reply with exactly: PONG_TEST
|
||||
? for shortcuts · ← for agents`;
|
||||
|
||||
// Newer claude 2.1.x renders the input bar with a `shift+tab to cycle` footer instead of
|
||||
// `? for shortcuts` — the matcher must accept it too, or the pane reads as never-ready.
|
||||
const TUI_READY_PANE_SHIFT_TAB = `❯ Try "how does <filepath> work?"
|
||||
⏵⏵ bypass permissions on (shift+tab to cycle)`;
|
||||
|
||||
// Welcome splash shown before input bar is rendered — neither ready-state footer.
|
||||
// Welcome splash shown before input bar is rendered — no `? for shortcuts`.
|
||||
const TUI_BOOT_PANE = `╭─ Claude Code v2.1.114 ─ Welcome back Tao! ─╮\n│ Tips for getting started │`;
|
||||
|
||||
console.log("\nTUI readiness + paste-verify predicates (issue #130):");
|
||||
@@ -3750,9 +3335,6 @@ test("tuiInputReady(READY_PANE) === true (input bar rendered)", () => {
|
||||
test("tuiInputReady(LANDED_PANE) === true (input bar still present after paste)", () => {
|
||||
assert.equal(_tuiInputReady(TUI_LANDED_PANE), true);
|
||||
});
|
||||
test("tuiInputReady(READY_PANE_SHIFT_TAB) === true (newer claude `shift+tab to cycle` footer)", () => {
|
||||
assert.equal(_tuiInputReady(TUI_READY_PANE_SHIFT_TAB), true);
|
||||
});
|
||||
test("tuiInputReady(BOOT_PANE) === false (welcome splash, no input bar yet)", () => {
|
||||
assert.equal(_tuiInputReady(TUI_BOOT_PANE), false);
|
||||
});
|
||||
@@ -4257,10 +3839,6 @@ test("models.json aliases.sonnet === 'claude-sonnet-5' (default-request-model SP
|
||||
assert.equal(_spotModels.aliases.sonnet, "claude-sonnet-5");
|
||||
});
|
||||
|
||||
test("models.json aliases.opus === 'claude-opus-5' (opus-alias SPOT)", () => {
|
||||
assert.equal(_spotModels.aliases.opus, "claude-opus-5");
|
||||
});
|
||||
|
||||
// ── Referential integrity (PR #152 review) ──────────────────────────────────
|
||||
// The value-mirror assertions above only prove the alias equals a string literal —
|
||||
// they pass even if that literal points at a model that does not exist in
|
||||
@@ -4274,25 +3852,6 @@ test("models.json: claude-sonnet-5 is present in models[] (the entry this PR add
|
||||
assert.ok(_spotModelIds.has("claude-sonnet-5"), "claude-sonnet-5 must exist as a models[].id");
|
||||
});
|
||||
|
||||
test("models.json: claude-opus-5 is present in models[] (the entry this PR adds)", () => {
|
||||
assert.ok(_spotModelIds.has("claude-opus-5"), "claude-opus-5 must exist as a models[].id");
|
||||
});
|
||||
|
||||
// The prompt-char budget is GLOBAL (max across every entry × 3 chars/token), not
|
||||
// per-model — see lib/prompt.mjs derivePromptCharBudget. An entry declaring a native 1M
|
||||
// window would therefore raise the truncation ceiling for claude-haiku-4-5 too (genuinely
|
||||
// 200k), turning OCP-side truncation into an upstream API rejection.
|
||||
//
|
||||
// Asserts the MAX, deliberately, not every entry: ADR 0009 states the budget "scales
|
||||
// automatically — no code change", so a future entry with a SMALLER window (say a 128k
|
||||
// model) must stay legal and must not fail this suite. Only raising the ceiling is the
|
||||
// hazard, and that is an ADR-level decision requiring per-model budgets first.
|
||||
test("models.json: max contextWindow is 200000 (global prompt-budget ceiling)", () => {
|
||||
const windows = _spotModels.models.map(m => m.contextWindow);
|
||||
assert.equal(Math.max(...windows), 200000,
|
||||
`max contextWindow re-scales MAX_PROMPT_CHARS for ALL models incl. the 200k-native haiku (see lib/prompt.mjs + ADR 0009)`);
|
||||
});
|
||||
|
||||
test("models.json: every aliases value resolves to a real models[].id (referential integrity)", () => {
|
||||
for (const [name, target] of Object.entries(_spotModels.aliases)) {
|
||||
assert.ok(_spotModelIds.has(target), `aliases.${name} -> '${target}' is a dangling alias (no matching models[].id)`);
|
||||
@@ -4305,67 +3864,6 @@ test("models.json: every legacyAliases value resolves to a real models[].id (ref
|
||||
}
|
||||
});
|
||||
|
||||
// ── models.json validates against models.schema.json (#196) ─────────────────
|
||||
// models.json carried `"$schema": "./models.schema.json"` while that file had never been
|
||||
// committed, so the SPOT that ADR 0003 makes canonical had no structural validation at all —
|
||||
// a missing contextWindow or a typo'd openclawName would only surface downstream, in OpenClaw
|
||||
// or in a truncation budget. Validated with the repo's OWN validator (lib/structured-output.mjs,
|
||||
// shipped for #153) rather than a new dependency: zero deps added, and it exercises that
|
||||
// validator on a second real input.
|
||||
//
|
||||
// The schema deliberately does NOT try to express referential integrity (alias -> models[].id);
|
||||
// that is not a JSON Schema concept and is covered by the two tests directly above.
|
||||
import { validateJsonSchema as _spotValidate } from "./lib/structured-output.mjs";
|
||||
|
||||
const _spotSchema = JSON.parse(spotReadFileSync(spotJoin(_spotDir, "models.schema.json"), "utf8"));
|
||||
|
||||
test("models.json: the $schema reference resolves to a committed file", () => {
|
||||
assert.equal(_spotModels.$schema, "./models.schema.json", "models.json must point at the schema");
|
||||
assert.ok(_ltExists(spotJoin(_spotDir, "models.schema.json")),
|
||||
"models.schema.json must exist — a dangling $schema is what #196 was filed for");
|
||||
});
|
||||
|
||||
test("models.json validates against models.schema.json (strict)", () => {
|
||||
const errors = _spotValidate(_spotModels, _spotSchema, "$", true);
|
||||
assert.deepEqual(errors, [], `models.json violates its own schema:\n ${errors.join("\n ")}`);
|
||||
});
|
||||
|
||||
// Three corruptions the SCHEMA structurally cannot catch, asserted directly instead of pretending
|
||||
// the schema covers them: the validator has no uniqueItems, no minLength, and no minimum. Adding
|
||||
// those keywords to the schema would be silently ignored (see its description), so they live here.
|
||||
test("models.json: ids are unique, non-empty, and windows are positive (not schema-expressible)", () => {
|
||||
const ids = _spotModels.models.map(m => m.id);
|
||||
assert.equal(new Set(ids).size, ids.length, `duplicate models[].id: ${ids.filter((v, i) => ids.indexOf(v) !== i)}`);
|
||||
for (const m of _spotModels.models) {
|
||||
for (const f of ["id", "displayName", "openclawName"]) {
|
||||
assert.ok(typeof m[f] === "string" && m[f].trim().length > 0, `${m.id}: ${f} must be a non-empty string`);
|
||||
}
|
||||
assert.ok(m.contextWindow > 0, `${m.id}: contextWindow must be positive`);
|
||||
assert.ok(m.maxTokens > 0, `${m.id}: maxTokens must be positive`);
|
||||
}
|
||||
});
|
||||
|
||||
// Guards the guard: if the schema were vacuous (e.g. `{}` or a typo'd `properties`), the test
|
||||
// above would pass on anything. Each corruption below must be caught.
|
||||
test("models.schema.json actually rejects malformed entries (guard is not vacuous)", () => {
|
||||
const clone = () => JSON.parse(JSON.stringify(_spotModels));
|
||||
const cases = [
|
||||
["missing required field", m => { delete m.models[0].contextWindow; }],
|
||||
["wrong scalar type", m => { m.models[0].reasoning = "yes"; }],
|
||||
["non-integer window", m => { m.models[0].contextWindow = 200000.5; }],
|
||||
["unknown extra field", m => { m.models[0].tokensPerSecond = 42; }],
|
||||
["alias mapped to non-string", m => { m.aliases.opus = { id: "x" }; }],
|
||||
["empty models array", m => { m.models = []; }],
|
||||
["wrong document version", m => { m.version = 2; }],
|
||||
["unknown top-level key", m => { m.providers = {}; }],
|
||||
];
|
||||
for (const [label, corrupt] of cases) {
|
||||
const bad = clone(); corrupt(bad);
|
||||
const errs = _spotValidate(bad, _spotSchema, "$", true);
|
||||
assert.ok(errs.length > 0, `schema failed to reject: ${label}`);
|
||||
}
|
||||
});
|
||||
|
||||
// ── escapeHtml + key-name validator (issue #114) ────────────────────────────
|
||||
// Replicated verbatim from dashboard.html so tests run without a browser.
|
||||
function escapeHtml(s) {
|
||||
@@ -4827,17 +4325,13 @@ test("stream: sink path is keyed by session_id (concurrent panes cannot interlea
|
||||
assert.ok(A.endsWith("/aaaa-1111.jsonl"));
|
||||
});
|
||||
|
||||
test("stream: buildTuiCmd — streaming ON adds env + --settings and drops --safe-mode (hook survives)", () => {
|
||||
test("stream: buildTuiCmd — OFF is byte-for-byte the pre-streaming argv; ON adds only env + --settings", () => {
|
||||
const off = buildTuiCmd("/bin/claude", "m", "SID", "/h", "cli");
|
||||
assert.ok(!off.includes("--settings"), "no --settings when streaming is off");
|
||||
assert.ok(!off.includes("OCP_TUI_STREAM_FILE"), "no sink env when streaming is off");
|
||||
assert.ok(off.includes("--safe-mode"), "the non-streaming pane carries --safe-mode");
|
||||
const on = buildTuiCmd("/bin/claude", "m", "SID", "/h", "cli", { file: "/d/SID.jsonl", settings: "/d/s.json" });
|
||||
assert.ok(on.includes("OCP_TUI_STREAM_FILE='/d/SID.jsonl'"), "sink delivered via the pane env");
|
||||
assert.ok(on.includes("--settings '/d/s.json'"));
|
||||
// --safe-mode would disable the MessageDisplay hook registered by --settings, so the
|
||||
// streaming pane must NOT carry it (it keeps the env-var suppression instead).
|
||||
assert.ok(!on.includes("--safe-mode"), "streaming pane omits --safe-mode so the hook fires");
|
||||
// must not regress the MCP wall or the pinned effort (#156)
|
||||
assert.ok(on.includes("--strict-mcp-config") && on.includes("--disallowedTools 'mcp__*'"), "MCP wall intact");
|
||||
assert.ok(on.includes("--effort low"), "OCP_TUI_EFFORT default intact");
|
||||
|
||||
Reference in New Issue
Block a user