chore(release): v3.17.1 — code-audit P1/P2 hardening (crash fixes + multi-tenant gates) (#107)

Co-authored-by: dtzp555 <dtzp555@gmail.com>

.github/PULL_REQUEST_TEMPLATE.md

@@ -4,22 +4,46 @@
 
 <!-- One or two sentences describing the change and why it is in scope for OCP. -->
 
+## Endpoint Class (REQUIRED)
+
+Per `ALIGNMENT.md` and ADR 0006, every PR that touches a network-facing endpoint must declare its class. Pick the most specific applicable class (Hybrid covers PRs that touch both A and B):
+
+- [ ] **Class A** — forwards a `cli.js` operation (e.g., `/v1/messages`, `/api/oauth/*`, or the Anthropic-side wire call inside `/usage`)
+- [ ] **Class B** — extends an OCP-owned compatibility endpoint (per ADR 0006). Sub-bucket:
+  - [ ] B.1 — OpenAI-compatibility surface (`/v1/chat/completions`, `/v1/models`)
+  - [ ] B.2 — OCP-administrative surface (`/health`, `/dashboard`, `/sessions`, `/logs`, `/status`, `/settings`, `/api/keys*`, `/api/usage`, `/cache*`)
+- [ ] **Hybrid** — touches both classes (e.g., `/usage` if the PR modifies both the Anthropic wire call AND the local synthesis layer). Both evidence sections below must be filled.
+- [ ] **Not endpoint-touching** — refactor / docs / tooling that does not modify any request handler. Skip both evidence sections; explain in Summary.
+
 ## Claude Code Alignment Evidence (REQUIRED)
 
-Per `ALIGNMENT.md`, every PR that touches `server.mjs` or any network-facing surface must fill out this section. PRs with this section blank or unchecked will receive a `request changes` review and cannot be merged.
+PRs with the relevant evidence section blank or unchecked will receive a `request changes` review and cannot be merged.
+
+### If Class A
 
 - [ ] **Corresponding `cli.js` reference.** I have identified the `cli.js` function and line range that performs the operation this PR forwards. Citation (format `cli.js:NNNN` or `cli.js vE4 <functionName>`):
   <!-- e.g. cli.js:18423-18467 (function: sendUserMessage)  -->
 
-- [ ] **If `cli.js` does not perform this operation**, I have stated this explicitly below and justified the scope under `ALIGNMENT.md` Rule 2. (Note: in almost all cases this means the PR should be closed, not merged. Proxy layers do not invent endpoints.)
+- [ ] **If `cli.js` does not perform this operation**, I have stated this explicitly below and justified the scope under `ALIGNMENT.md` Rule 2. (Note: in almost all cases this means the PR should be closed, not merged. Proxy layers do not invent endpoints. If the endpoint is in fact Class B, switch the class above and use the Class B section instead.)
   <!-- Justification, if applicable. Empty is fine when cli.js does perform the operation. -->
 
 - [ ] **Commit message citations.** Every "Claude Code uses X" or "cli.js uses X" assertion in every commit of this PR is immediately followed by a `cli.js:NNNN` or `cli.js vE4 <functionName>` citation. I have verified this by rereading each commit message.
 
+### If Class B
+
+- [ ] **Authorizing ADR.** Cite the ADR number that authorizes the endpoint this PR modifies (e.g., "ADR 0006 — OpenAI shim scope"). For B.1 endpoints (`/v1/chat/completions`, `/v1/models`), this is ADR 0006. For grandfathered B.2 endpoints, this is "ADR 0006 (grandfathered as of v3.16.4)." For new B.2 endpoints, cite the endpoint's own authorizing ADR; if none exists, the PR cannot proceed — the authorizing ADR must be drafted and merged first.
+  <!-- e.g., ADR 0006 -->
+
+- [ ] **Specification citation.** For B.1 endpoints, link to the relevant section of OpenAI's `/v1/chat/completions` specification (https://platform.openai.com/docs/api-reference/chat/create), including the specific field or behaviour being implemented. For B.2 endpoints with their own ADR, cite the ADR section that specifies the behaviour. For grandfathered B.2 endpoints, the PR must be a behaviour-preserving refactor — link the existing handler code being modified.
+  <!-- B.1 example: OpenAI chat/completions, `response_format` parameter, https://platform.openai.com/docs/api-reference/chat/create#chat-create-response_format -->
+  <!-- B.2 example: ADR 00NN § "Behaviour" -->
+
+- [ ] **No invention beyond the specification.** I confirm this PR does not introduce any field or behaviour not present in OpenAI's spec for the endpoint (B.1) or beyond the scope of the authorizing ADR (B.2). For grandfathered B.2 endpoints, I confirm the change is behaviour-preserving (no contract drift). If something the user actually wants is not in the spec, the right answer is to close this PR and propose an upstream spec change or a new ADR.
+
 ## Type of change
 
-- [ ] Bug fix (alignment with existing `cli.js` behavior)
+- [ ] Bug fix (alignment with existing `cli.js` behavior, or with the cited spec / ADR for Class B)
-- [ ] Feature (new `cli.js` behavior now surfaced through OCP)
+- [ ] Feature (new `cli.js` behavior now surfaced through OCP, or new field already in OpenAI's spec for Class B)
 - [ ] Refactor (no wire-level behavior change)
 - [ ] Deletion (unalignable feature removal per `ALIGNMENT.md` Unalignable Policy)
 - [ ] Documentation / governance
@@ -28,14 +52,16 @@ Per `ALIGNMENT.md`, every PR that touches `server.mjs` or any network-facing sur
 
 Reviewers: this section is for you, not the author. Do not approve until every box is checked.
 
-- [ ] I opened `cli.js` at the cited line range and confirmed the operation matches.
+- [ ] If Class A, I opened `cli.js` at the cited line range and confirmed the operation matches. If Class B, I opened the OpenAI spec at the cited section (B.1) or the authorizing ADR (B.2) and confirmed the behaviour described in this PR matches the cited reference.
 - [ ] I ran (or confirmed CI ran) `.github/workflows/alignment.yml` and it passed.
 - [ ] I am not the commit author of any commit in this PR (Iron Rule 10).
-- [ ] If the PR asserts scope without a `cli.js` citation, I confirmed the justification is sound per `ALIGNMENT.md` Rule 2.
+- [ ] If the PR asserts scope without a `cli.js` citation (Class A) or without an ADR (Class B), I confirmed the justification is sound per `ALIGNMENT.md` Rule 2 and ADR 0006.
+- [ ] If the PR is Class B and adds a new endpoint or new method, I confirmed the authorizing ADR lands in the same merge or before this PR.
 
 ## Related
 
-- `ALIGNMENT.md` Rule(s) invoked: <!-- e.g. Rule 3 -->
+- `ALIGNMENT.md` Rule(s) invoked: <!-- e.g. Rule 3, or Rule 3 (Class B mapping) -->
+- Authorizing ADR (Class B only): <!-- e.g. ADR 0006 -->
 - Related issue / prior PR: <!-- #NNN -->
 - Historical lesson reference (if relevant): <!-- e.g. 2026-04-11 drift, b87992f -->
 

.github/workflows/alignment.yml

@@ -4,6 +4,11 @@ on:
   pull_request:
     paths:
       - 'server.mjs'
+      - 'setup.mjs'
+      - 'scripts/**'
+      - 'lib/**'
+      - 'ocp'
+      - 'ocp-connect'
       - '.github/workflows/alignment.yml'
 
 jobs:
@@ -66,6 +71,80 @@ jobs:
 
           echo "Blacklist scan clean."
 
+  port-spot:
+    name: port literal SPOT (hard fail)
+    # Background: from 2026-05-08 (PR #71 dogfood accident) through 2026-05-13
+    # a hardcoded "3478" in scripts/upgrade.mjs + scripts/doctor.mjs cascaded
+    # into wrong baseUrl writes for the OpenClaw "claude-local" provider,
+    # taking out the "大内总管" Telegram agent.
+    #
+    # Rule: the only places allowed to write a literal port number in source
+    # are (a) lib/constants.mjs (the SPOT), (b) bash scripts ocp / ocp-connect
+    # (which can't import .mjs and must keep the literal in sync — flagged
+    # with a `// keep in sync with lib/constants.mjs` style comment), and
+    # (c) test-features.mjs (intentionally pins historical ports for plist /
+    # systemd parser tests). Everything else MUST import from lib/constants.mjs.
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Scan for hardcoded port literals outside SPOT
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          # Files/paths exempt from the SPOT requirement.
+          EXEMPT_REGEX='^(lib/constants\.mjs|test-features\.mjs|ocp|ocp-connect|CHANGELOG\.md|README\.md|docs/|\.github/workflows/alignment\.yml)'
+
+          # Hardcoded port literals to forbid in non-exempt source.
+          FORBIDDEN_PORTS=("3478" "3456")
+
+          FAIL=0
+          for port in "${FORBIDDEN_PORTS[@]}"; do
+            HITS="$(git ls-files | grep -E '\.(mjs|js|ts|json)$' \
+              | xargs grep -n -E "[^0-9]${port}[^0-9]" 2>/dev/null \
+              | grep -v -E "${EXEMPT_REGEX}" \
+              || true)"
+            if [ -n "$HITS" ]; then
+              echo "::error::Hardcoded port literal '${port}' found outside lib/constants.mjs:"
+              echo "$HITS"
+              FAIL=1
+            fi
+          done
+
+          if [ "$FAIL" -ne 0 ]; then
+            cat <<'EOF'
+
+          ============================================================
+          PORT LITERAL SPOT VIOLATION
+          ============================================================
+          A hardcoded TCP port literal was found in a source file
+          that should import from lib/constants.mjs instead.
+
+          Background: this rule exists because between 2026-05-08 and
+          2026-05-13 a stray hardcoded "3478" in scripts/upgrade.mjs
+          and scripts/doctor.mjs cascaded into downstream OpenClaw
+          config writes, taking out the OpenClaw Telegram agent.
+          See v3.16.3 CHANGELOG and lib/constants.mjs header comment.
+
+          Required action:
+            1. Import DEFAULT_PORT (or related constant) from
+               lib/constants.mjs instead of hardcoding the literal.
+            2. If the file genuinely cannot import .mjs (e.g. bash
+               script), add it to EXEMPT_REGEX in this workflow and
+               add a `keep in sync with lib/constants.mjs` comment
+               at the reference.
+            3. For test files that intentionally pin historical ports
+               (test-features.mjs), the regex already exempts them.
+
+          ============================================================
+          EOF
+            exit 1
+          fi
+
+          echo "Port SPOT scan clean."
+
   commit-citation:
     name: commit message citation (soft check)
     runs-on: ubuntu-latest

ALIGNMENT.md

@@ -8,10 +8,14 @@
 
 OCP (Open Claude Proxy) is a **proxy layer** for the Claude Code CLI. It forwards, observes, and multiplexes the traffic that `cli.js` already emits. It is **not** an extension layer. If `cli.js` does not perform a given operation, or performs it differently, OCP does not invent one.
 
+This Core Principle applies in full to **Class A** endpoints (the `cli.js`-mirror surface). A second class of endpoint — **Class B**, the OCP-owned compatibility surface — has its own scope discipline anchored to its own specification authority. See "Scope Clarification: OCP-Owned Compatibility Endpoints (Class B)" below and ADR 0006.
+
 ---
 
 ## Rules
 
+The following Rules apply to **Class A operations** (the `cli.js`-mirror surface — the inbound `/v1/messages` forwarding route, the outbound `/v1/messages` wire call used by `handleUsage()` for rate-limit-header extraction, the OAuth bearer machinery, and any future operations OCP forwards from `cli.js` to Anthropic). For the Class B mapping of each rule, see the Class B section below.
+
 1. **Rule 1 (Grep First).** Before adding, renaming, or changing any endpoint, header, parameter, or response shape, the author must `grep` the reference `cli.js` and record the exact line numbers in the commit message and PR body. An absent grep hit is itself a finding and must be declared.
 
 2. **Rule 2 (No Invention).** OCP must not introduce endpoints, headers, request fields, or response fields that are not present in `cli.js`. Speculative "Claude Code probably uses X" statements are prohibited. If the behavior is not observable in `cli.js`, the feature is out of scope.
@@ -68,20 +72,78 @@ On 2026-04-11, commit `b87992f` ("fix: use dedicated /api/oauth/usage endpoint f
 
 ## Unalignable Policy
 
-A feature is **unalignable** if, after a good-faith search, it cannot be mapped to a specific `cli.js` line range or function.
+A feature is **unalignable** if, after a good-faith search, it cannot be mapped to a specific `cli.js` line range or function (Class A) or to a specific OpenAI specification section AND an authorizing ADR (Class B).
 
 - Unalignable features are **deleted**, not disabled, not feature-flagged, not deprecated.
 - Deletion is the default outcome of an alignment audit finding. The burden of proof is on the feature, not on the auditor.
 - A deletion PR does not require user-facing deprecation notice, because the feature was never legitimately in scope.
-- If a user workflow depended on an unalignable feature, the correct remediation is to upstream the behavior into `cli.js` or to move it out of OCP into a separate tool. OCP does not retain it.
+- If a user workflow depended on an unalignable feature, the correct remediation is to upstream the behavior into `cli.js` (Class A) or into OpenAI's spec (Class B) or to move it out of OCP into a separate tool. OCP does not retain it.
+
+---
+
+## Scope Clarification: OCP-Owned Compatibility Endpoints (Class B)
+
+OCP has two classes of endpoint. Rules 1–5 above were drafted in the aftermath of the 2026-04-11 forwarding drift and are written in the language of a one-to-one proxy; they apply verbatim to **Class A** endpoints. **Class B** endpoints — the OCP-owned compatibility surface where `cli.js` is not the wire authority — have their own scope discipline, anchored to their own specification authority. The full rationale lives in **ADR 0006 (OpenAI Shim Scope)**.
+
+**Class A** — `cli.js`-mirror endpoints. The endpoint exists because `cli.js` performs the equivalent operation and OCP forwards, observes, or multiplexes that operation. Rules 1–5 above apply verbatim. Citation format: `cli.js:NNNN` or `cli.js vE4 <functionName>`.
+
+**Class B** — OCP-owned compatibility endpoints. The endpoint exists because OCP itself surfaces it, with no `cli.js` analogue. Two sub-buckets: **B.1** (OpenAI-compatibility surface — protocol authority is OpenAI's `/v1/chat/completions` specification) and **B.2** (OCP-administrative surface — authority is the ADR that authorized the endpoint's existence).
+
+### Grandfather provision for existing B.2 inventory
+
+ADR 0006 retroactively authorizes the B.2 endpoints listed in the inventory table below, **frozen at their current behaviour as of v3.16.4**. This is a one-time provision; it does not extend to new B.2 endpoints or to B.1 endpoints. Any change to the contract (request shape, response shape, semantics) of a grandfathered B.2 endpoint is treated as a new authorization request and requires either a behaviour-preserving refactor PR or its own ADR. Any new B.2 endpoint, or any new method on a grandfathered B.2 endpoint, requires its own ADR before merge.
+
+### Current Class B inventory
+
+| Endpoint | Method | Sub-bucket | Authorizing ADR |
+|---|---|---|---|
+| `/v1/chat/completions` | POST | B.1 (OpenAI-compat) | ADR 0006 |
+| `/v1/models` | GET | B.1 (OpenAI-compat) | ADR 0006; content sourced from `models.json` per ADR 0003 |
+| `/health` | GET | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/dashboard` | GET | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/sessions` | GET, DELETE | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/logs` | GET | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/status` | GET | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/settings` | GET, PATCH | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/api/keys` | GET, POST | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/api/keys/:id` | DELETE | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/api/keys/:id/quota` | GET, PATCH | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/api/usage` | GET | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/cache/stats` | GET | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/cache` | DELETE | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+
+**Hybrid note.** `/usage` is a hybrid endpoint: the underlying call to `api.anthropic.com/v1/messages` (used to extract `anthropic-ratelimit-unified-*` headers, per the in-file comment block at `server.mjs` line 845–849) is Class A and requires the standard `cli.js` citation; the local synthesis layer that adds `proxy:` stats and `models:` snapshot is Class B and is authorized by ADR 0006. A PR touching only the wire-call layer is Class A; a PR touching only the synthesis layer is Class B; a PR touching both must satisfy both citation requirements.
+
+### Class B citation requirement
+
+Class B PRs cite **the relevant specification section + the authorizing ADR**, in place of `cli.js:NNNN`. Examples:
+
+- B.1: "OpenAI `chat/completions` API, `response_format` parameter (https://platform.openai.com/docs/api-reference/chat/create), authorized by ADR 0006."
+- B.2 (grandfathered): "Authorized by ADR 0006 (grandfathered as of v3.16.4)."
+- B.2 (with its own ADR): "Authorized by ADR 00NN (the ADR that originally authorized the endpoint)."
+
+### Rule mapping for Class B
+
+| Class A rule | Class B mapping |
+|---|---|
+| Rule 1 (Grep First) | Read the cited OpenAI spec section (B.1) or the authorizing ADR (B.2) before writing code. Record the spec URL and ADR number in the PR body. |
+| Rule 2 (No Invention) | OCP must not introduce fields or behaviour not present in OpenAI's spec for the endpoint (B.1) or outside the scope of the authorizing ADR (B.2). For grandfathered B.2 endpoints, "scope" is the v3.16.4 behaviour snapshot. |
+| Rule 3 (Match the Implementation) | Match OpenAI's spec wire-format (B.1) or the ADR's specified behaviour (B.2). |
+| Rule 4 (Unalignable Features Are Deleted) | A Class B endpoint that maps to nothing in OpenAI's spec **and** lacks an authorizing ADR (including not being in the grandfather inventory) is unalignable and is deleted on the same terms as a Class A unalignable feature. |
+| Rule 5 (Cite Line Numbers in Commits) | Cite the OpenAI spec section URL + authorizing ADR number in the commit body (B.1) or the authorizing ADR number alone (B.2). |
+
+### New Class B endpoint procedure
+
+Any new Class B endpoint, or any new method on an existing Class B endpoint (including grandfathered ones), requires its own ADR before merge. An "ADR-less" new Class B endpoint is itself an alignment finding under Rule 4.
 
 ---
 
 ## Annual Alignment Audit
 
 - **Date:** 11 April each year (the anniversary of the `b87992f` drift).
-- **Scope:** Diff the current `cli.js` against the pinned SHA-256 in the Golden Reference section. For every network call in `server.mjs`, re-verify that the corresponding `cli.js` reference still exists at the cited line numbers (adjust citations if line numbers shifted across Claude Code versions).
+- **Scope (Class A):** Diff the current `cli.js` against the pinned SHA-256 in the Golden Reference section. For every network call in `server.mjs`, re-verify that the corresponding `cli.js` reference still exists at the cited line numbers (adjust citations if line numbers shifted across Claude Code versions).
-- **Output:** A signed audit note committed to `docs/alignment-audits/YYYY-04-11.md`, updating the pin.
+- **Scope (Class B):** Audit B.1 endpoints against OpenAI's current `/v1/chat/completions` specification snapshot. Audit B.2 endpoints against their authorizing ADR — for grandfathered endpoints, verify the endpoint behaviour still matches its v3.16.4 snapshot; for ADR-specific endpoints, verify behaviour still matches the ADR. The B.1 specification pin lives in `docs/openai-compat-pin.md` (created alongside the first B.1 audit; not required for ADR 0006 to land).
+- **Output:** A signed audit note committed to `docs/alignment-audits/YYYY-04-11.md`, updating the Class A pin and (once `docs/openai-compat-pin.md` exists) the B.1 pin.
 - **Failure mode:** Any audit finding that cannot be reconciled triggers an immediate deletion PR per the Unalignable Policy.
 
 ---

CHANGELOG.md

@@ -1,5 +1,181 @@
 # Changelog
 
+## Unreleased
+
+## v3.17.1 — 2026-05-31
+
+### Fix — code-audit P1/P2 hardening
+
+Fixes from a multi-agent code audit (3 P1 + 5 P2, adversarially verified). The single-user default path (`AUTH_MODE=none`, no TUI) is behavior-identical.
+
+**Availability / correctness (P1):**
+- Guard `proc.stdin` against EPIPE — a fast-failing spawned `claude` (auth error, bad model, large prompt) no longer crashes the single-process daemon.
+- Add `unhandledRejection`/`uncaughtException`/`clientError` safety nets + wrap all request-body read loops — a client aborting mid-upload no longer crashes the daemon.
+- TUI transcript reader: only `turn_duration` is terminal (was also `tool_use`), which silently truncated any TUI turn that used a built-in tool.
+
+**Security gates / cache integrity (P2):**
+- `AUTH_MODE=multi`: the default spawn now passes `--disallowedTools` (Bash/Read/Write/Edit/…) so a guest prompt cannot drive operator-filesystem tools. Single-user path unchanged.
+- `/sessions` (DELETE), `/settings` (PATCH), `/logs`, `/usage`, `/status` are now admin-gated (were dispatched before the admin check).
+- Streaming path no longer caches an `is_error` response as success (cache-poisoning fix).
+- TUI fail-loud guard extended to `none`+`0.0.0.0` (unless `OCP_TUI_ALLOW_LAN=1`) and `+ PROXY_ANONYMOUS_KEY`.
+- TUI `send-keys` paste uses `-l` (literal) so a prompt equal to a tmux key token (e.g. `C-c`) is typed, not interpreted.
+
+---
+
+## v3.17.0 — 2026-05-31
+
+### Provider — default claude invocation ported to stream-json + `--system-prompt` (Phase 6c)
+
+OCP's default (non-TUI) claude spawn moves from `claude -p --output-format text` to `claude --output-format stream-json --verbose --no-session-persistence --system-prompt <wrapper>` (no `-p`). The NDJSON event stream is parsed into the assembled response. Benefits: ~64% per-request cost reduction and anti-hallucination via `--system-prompt` tool-use suppression. Clients see no API change — the OpenAI-compatible request/response shapes are identical. Faithful port of OLP's production-verified implementation; covered by 17 new stream-json parser tests.
+
+⚠️ **Billing note:** from 2026-06-15 this default path carries `cc_entrypoint=sdk-cli` and bills against the Agent SDK credit pool. Use the new opt-in `CLAUDE_TUI_MODE` (below) to keep traffic on the Pro/Max subscription pool.
+
+---
+
+### feat(tui): opt-in CLAUDE_TUI_MODE — serve via interactive claude (cc_entrypoint=cli / subscription pool), single-user only; default stream-json path unchanged
+
+From 2026-06-15 Anthropic routes `claude -p` / `--output-format` invocations to the Agent SDK credit pool (`cc_entrypoint=sdk-cli`). This feature adds an opt-in bridge: when `CLAUDE_TUI_MODE=true`, OCP serves each request via a real interactive `claude` session (no `-p`, no `--output-format`) so it carries `cc_entrypoint=cli` and bills against the Pro/Max subscription.
+
+The complete string response is read from claude's native JSONL session transcript and replayed to callers as a normal OpenAI completion or chunked SSE. Clients see no API change. The default stream-json path is byte-for-byte unchanged when `CLAUDE_TUI_MODE` is unset.
+
+**Security:** single-user / single-operator only. Never enable on a multi-user OCP. See ADR 0007 and README § "Subscription-pool (TUI) mode".
+
+New env vars: `CLAUDE_TUI_MODE`, `CLAUDE_TUI_WALLCLOCK_MS`, `OCP_TUI_CWD`, `OCP_TUI_HOME`.
+New ADR: `docs/adr/0007-tui-interactive-mode.md`.
+New modules: `lib/tui/transcript.mjs`, `lib/tui/session.mjs` (shipped in preceding commits on this branch).
+
+---
+
+### Model — add claude-opus-4-8
+
+Add `claude-opus-4-8` as the newest Opus to `models.json` (index 0, newest first). Repoint `aliases.opus` from `claude-opus-4-7` to `claude-opus-4-8`. `claude-opus-4-7` remains in the list callable by literal id. `legacyAliases.claude-opus-4` left pointing at `claude-opus-4-7` (no change — legacy alias tracks the prior generation). README Available Models table and model-count references updated accordingly.
+
+---
+
+## v3.16.4 — 2026-05-13
+
+### Refactor — port-literal SPOT + CI guardrail
+
+Closes the structural side of the port-drift cascade addressed by v3.16.2
+and v3.16.3. Those two releases reverted plist / plugin / scripts back to
+3456 line-by-line, but the underlying invitation to drift — a hardcoded
+port literal scattered across six source files — was still intact.
+
+Changes:
+
+- **New `lib/constants.mjs`** — single source of truth for shared literals.
+  Exports `DEFAULT_PORT = 3456`, `LOCAL_HOST = "127.0.0.1"`,
+  `OPENAI_API_BASE = "/v1"`, `LOCAL_PROXY_URL`.
+- **`server.mjs:127`, `setup.mjs:36`, `scripts/upgrade.mjs:137`,
+  `scripts/doctor.mjs:84` + `:205`, `scripts/sync-openclaw.mjs:73`** —
+  all replaced with imports from `lib/constants.mjs`. Behavior is
+  identical; the literal `3456` now exists in exactly one place per
+  language (`lib/constants.mjs` for `.mjs`, `ocp` + `ocp-connect` for
+  bash, `test-features.mjs` for pinned historical-port tests).
+- **`.github/workflows/alignment.yml`** — extended the path filter to
+  `setup.mjs`, `scripts/**`, `lib/**`, `ocp`, `ocp-connect`. Added a new
+  `port-spot` hard-fail job that greps for any hardcoded `3478` or `3456`
+  literal in `.mjs/.js/.ts/.json` outside the EXEMPT_REGEX (which lists
+  `lib/constants.mjs`, `test-features.mjs`, the bash CLIs, docs, and the
+  workflow itself). Any future PR re-introducing a hardcoded port
+  literal will be blocked at CI before it can cascade.
+- Doc comments in `server.mjs` env-var summary and `setup.mjs` usage
+  banner reworded so the literal `3456` no longer appears as
+  documentation text (CI grep is intentionally aggressive — it does not
+  parse comments — so doc strings reference `DEFAULT_PORT from
+  lib/constants.mjs` instead).
+
+No behavior change for any user. `CLAUDE_PROXY_PORT` env var remains
+the runtime override; the only difference is the unset-env fallback
+now flows through one shared constant.
+
+ALIGNMENT.md hard-requirements: this PR modifies `server.mjs` (one-line
+import + one literal swap, mechanical). No cli.js operation changed;
+the citation requirement does not apply. SPOT principle (Rule 2 spirit)
+is the entire motivation.
+
+## v3.16.3 — 2026-05-13
+
+### Fixes — completes v3.16.2 port-drift revert
+
+v3.16.2 reverted the plugin / `openclaw.plugin.json` / README / Mac mini
+plist back to `3456` (the historical source default since `593d0dc`), but
+missed three places in `scripts/` that still defaulted to `3478`. Those
+three lines were the residual cascade source: every time `ocp doctor` or
+`ocp upgrade` ran without `CLAUDE_PROXY_PORT` in the env, they probed
+`3478`, reported "OCP not responding" against a healthy 3456 instance,
+and (in the case of OpenClaw sync follow-ups on the maintainer's host)
+re-introduced 3478 into downstream config.
+
+Changes:
+
+- `scripts/upgrade.mjs:137` — default port `3478` → `3456`.
+- `scripts/doctor.mjs:84` — default port `3478` → `3456`.
+- `scripts/doctor.mjs:205` — default port `3478` → `3456`.
+
+No behavior change for users who set `CLAUDE_PROXY_PORT` explicitly; env
+still takes precedence. The fix only affects the unset-env fallback,
+which now matches `server.mjs:126` and the rest of the codebase.
+
+Test plan: existing `test-features.mjs` cases that pin
+`CLAUDE_PROXY_PORT=3478` continue to pass — they use the env path, not
+the default.
+
+## v3.16.2 — 2026-05-12
+
+### Fixes — corrects v3.16.1
+
+The v3.16.1 fix was directionally correct (plugin now reads env first, falls back to a hardcoded default) but **the narrative and the hardcoded default were both wrong**.
+
+What v3.16.1 said: "OCP server moved to 3478 default in v3.14+; plugin lagged at 3456."
+What is actually true:
+- **OCP server source default has been `3456` since `593d0dc` (initial release) and has never changed.** Every line in `server.mjs`, `setup.mjs`, and the `ocp` CLI still uses `3456` as the documented and code-level default.
+- The single OCP installation observed on `3478` is the maintainer's Mac mini, whose plist was rewritten with `--port 3478` during a PR #71 dogfood smoke-test accident on 2026-05-08 (see `~/.cc-rules/memory/learnings/subagent_setup_mjs_prod_host_collision.md`). The plist drift was never reconciled back to source default, and v3.16.1 incorrectly canonised the post-accident value as if it had been a release decision.
+
+This release:
+- Restores the plugin fallback to `http://127.0.0.1:3456` to match server source default.
+- Updates `openclaw.plugin.json` `configSchema.proxyUrl.default` back to `3456`.
+- Restores README §"Environment Variables" `CLAUDE_PROXY_PORT` default to `3456`.
+- Plugin reads `OCP_PROXY_URL` env (full URL) first, then `CLAUDE_PROXY_PORT` env (port only), then falls back to `3456`. Hosts whose OCP plist injects a non-default port must also inject the same `CLAUDE_PROXY_PORT` into the OpenClaw plist for the plugin to follow.
+- Maintainer's Mac mini plist was reverted from `3478` to `3456` as part of this release deploy (no source change reflects this; it was a one-host correction).
+
+### Governance
+
+- No `cli.js` citation needed (no `server.mjs` change). ALIGNMENT.md Rule 2 not engaged.
+
+## v3.16.1 — 2026-05-12 (superseded — narrative incorrect; see v3.16.2 erratum)
+
+### Fixes (as shipped — note erratum above)
+
+- **OCP plugin port lag** — `ocp-plugin/index.js` hard-coded `http://127.0.0.1:3456`. ~~While OCP server moved to 3478 in v3.14+,~~ **(corrected v3.16.2: no such move ever happened.)** The Mac mini's plist was on `3478` only as residue from a dogfood accident. Result: `/ocp` slash commands from the home Telegram bot returned "OCP error: fetch failed". v3.16.1 changed the plugin default to `3478` (wrong direction; v3.16.2 reverts to `3456`).
+
+### Governance
+
+- No `cli.js` citation needed (no `server.mjs` change). ALIGNMENT.md Rule 2 not engaged.
+
+## v3.16.0 — 2026-05-10
+
+### Features
+
+- **`ocp doctor --check oauth`** (PR #93) — fast path that runs only the OAuth check, skipping
+  version detection / from-version / git operations / models endpoint. ~50ms vs. full doctor's
+  ~200-500ms. Use cases: AI agent repair loops, post-`claude auth login` verify, quick health
+  gates. Help text in `cmd_doctor_help` now reflects working behaviour.
+- **`ocp update --rollback --gc`** — manually garbage-collect old upgrade snapshots.
+  Retention policy: keep last 5 snapshots OR snapshots newer than 30 days OR the single most
+  recent (always-keep safety net). `--dry-run` previews. Successful `ocp update` runs auto-GC
+  at the end of the full path; light path does not (no snapshot created there).
+
+### Behavior changes
+
+- After a successful cross-minor `ocp update`, the auto-GC emits `[gc] removed N old snapshots`
+  to stderr if any were collected. Safe to ignore; manual gc is `ocp update --rollback --gc`.
+
+### Governance
+
+- No `cli.js` citation needed (no `server.mjs` change). ALIGNMENT.md Rule 2 not engaged.
+- PR #93 (--check oauth) merged separately; this release bundles it with the GC feature.
+
 ## v3.15.1 — 2026-05-10
 
 ### Fixes

README.md

@@ -116,7 +116,7 @@ Please follow https://github.com/dtzp555-max/ocp/blob/main/README.md
    installed and logged in (`claude auth status`). Install missing pieces
    using my system's package manager.
 2. git clone the repo, cd in, and run `node setup.mjs`.
-3. Verify with `curl http://127.0.0.1:3456/v1/models` (should list 4 models).
+3. Verify with `curl http://127.0.0.1:3456/v1/models` (should list 5 models).
 4. Add `export OPENAI_BASE_URL=http://127.0.0.1:3456/v1` to my shell rc.
 5. Tell me to reload my shell and try a tool like Cline / Continue / Cursor.
 
@@ -142,7 +142,7 @@ Please follow https://github.com/dtzp555-max/ocp/blob/main/README.md
 5. Add OCP_ADMIN_KEY to my shell rc (~/.zshrc or ~/.bashrc).
 6. Run `ocp lan` to show me the LAN IP and connect command.
 7. Optionally create example keys: `ocp keys add laptop`, `ocp keys add tablet`.
-8. Verify: `curl http://127.0.0.1:3456/v1/models` returns 4 models.
+8. Verify: `curl http://127.0.0.1:3456/v1/models` returns 5 models.
 
 Tell me each step before running it. On error, diagnose before retrying.
 ```
@@ -165,7 +165,7 @@ Please follow https://github.com/dtzp555-max/ocp/blob/main/README.md
      chmod +x ocp-connect
 2. Run `./ocp-connect <SERVER_IP>` (add `--key <KEY>` if you have one).
 3. Follow any IDE-specific manual hints it prints.
-4. Verify: `curl http://<SERVER_IP>:3456/v1/models` returns 4 models.
+4. Verify: `curl http://<SERVER_IP>:3456/v1/models` returns 5 models.
 5. Tell me to reload my shell + restart any IDE that was already running.
 
 Don't auto-retry on error. Tell me the failure mode first.
@@ -235,7 +235,7 @@ Run `ocp lan` to see your IP and ready-to-share instructions.
 **Verify:**
 ```bash
 curl http://127.0.0.1:3456/v1/models
-# Returns: claude-opus-4-7, claude-opus-4-6, claude-sonnet-4-6, claude-haiku-4-5-20251001
+# Returns: claude-opus-4-8, claude-opus-4-7, claude-opus-4-6, claude-sonnet-4-6, claude-haiku-4-5-20251001
 ```
 
 #### Headless install notes
@@ -314,7 +314,7 @@ OCP Connect v1.3.0
     (set by admin via PROXY_ANONYMOUS_KEY; see issue #12 §14 Path A)
 
   Testing API access...
-  ✓ API accessible (4 models available)
+  ✓ API accessible (5 models available)
 
   Shell config:
     ✓ .bashrc
@@ -344,6 +344,7 @@ OCP Connect v1.3.0
   ✓ OpenClaw configured
     Provider: ocp
     Models:
+      • ocp/claude-opus-4-8
       • ocp/claude-opus-4-7
       • ocp/claude-opus-4-6
       • ocp/claude-sonnet-4-6
@@ -674,17 +675,18 @@ Cache is **disabled by default** (`CLAUDE_CACHE_TTL=0`). All data is stored loca
 ## How It Works
 
 ```
-Your IDE → OCP (localhost:3456) → claude -p CLI → Anthropic (via subscription)
+Your IDE → OCP (localhost:3456) → claude --output-format stream-json CLI → Anthropic (via subscription)
 ```
 
-OCP translates OpenAI-compatible `/v1/chat/completions` requests into `claude -p` CLI calls. Anthropic sees normal Claude Code usage — no API billing, no separate key needed.
+OCP translates OpenAI-compatible `/v1/chat/completions` requests into `claude --output-format stream-json` CLI calls. Anthropic sees normal Claude Code usage — no API billing, no separate key needed.
 
 ## Available Models
 
 | Model ID | Notes |
 |----------|-------|
-| `claude-opus-4-7` | Most capable (default for `opus` alias) |
+| `claude-opus-4-8` | Most capable (default for `opus` alias) |
-| `claude-opus-4-6` | Previous Opus, retained for pinning |
+| `claude-opus-4-7` | Previous Opus, retained for pinning |
+| `claude-opus-4-6` | Older Opus, retained for pinning |
 | `claude-sonnet-4-6` | Good balance of speed/quality (default for `sonnet` alias) |
 | `claude-haiku-4-5-20251001` | Fastest, lightweight (default for `haiku` alias) |
 
@@ -855,7 +857,8 @@ Future `ocp update` invocations sync automatically.
 
 | Variable | Default | Description |
 |----------|---------|-------------|
-| `CLAUDE_PROXY_PORT` | `3456` | Listen port |
+| `CLAUDE_PROXY_PORT` | `3456` | Listen port (server-side). Also consumed by the OpenClaw `ocp-plugin` to dial the local proxy. |
+| `OCP_PROXY_URL` | *(unset)* | Plugin-side full URL override (e.g. `http://10.0.0.5:3456`). Wins over `CLAUDE_PROXY_PORT` when both are set. Read by `ocp-plugin/index.js` only — server ignores it. |
 | `CLAUDE_BIND` | `127.0.0.1` | Bind address (`0.0.0.0` for LAN access) |
 | `CLAUDE_AUTH_MODE` | `none` | Auth mode: `none`, `shared`, or `multi` |
 | `OCP_ADMIN_KEY` | *(unset)* | Admin key for key management (multi mode) |
@@ -871,6 +874,11 @@ Future `ocp update` invocations sync automatically.
 | `CLAUDE_NO_CONTEXT` | `false` | Suppress CLAUDE.md and auto-memory injection (pure API mode) |
 | `PROXY_API_KEY` | *(unset)* | Bearer token for shared-mode authentication |
 | `PROXY_ANONYMOUS_KEY` | *(unset)* | Well-known anonymous key allowlist (multi mode). When set, this exact string bypasses `validateKey()` and grants public access. Exposed via `/health.anonymousKey` so clients auto-discover. See [Anonymous Access](#anonymous-access-optional). |
+| `CLAUDE_TUI_MODE` | `false` | **Opt-in.** Set to `"true"` to serve requests via interactive `claude` (no `-p` / `--output-format` → `cc_entrypoint=cli`, subscription pool). **Single-user only** — see [Subscription-pool (TUI) mode](#subscription-pool-tui-mode) for the security constraint. |
+| `CLAUDE_TUI_WALLCLOCK_MS` | `120000` | (TUI-mode) Maximum time in ms to wait for the native transcript to signal turn completion. Increase for long Opus thinking turns. |
+| `OCP_TUI_CWD` | `$HOME/.ocp-tui/work` | (TUI-mode) Scratch working directory where interactive claude sessions run. Transcripts land under `<HOME>/.claude/projects/<encoded-cwd>/`. Created automatically. |
+| `OCP_TUI_HOME` | `$HOME` (real home) | (TUI-mode) `HOME` claude runs under. Default is the operator's real home (shared credentials, existing onboarding). Set to a separate path for scratch-home isolation — see ADR 0007 for the credential-fork caveat. |
+| `OCP_TUI_ENTRYPOINT` | `cli` | (TUI-mode) Billing-classifier labeling: `cli` (default) pins `cc_entrypoint=cli` deterministically; `auto` lets claude self-classify via TTY detection; `off` leaves the inherited env untouched. Honest only when the spawn is a genuine interactive PTY — see ADR 0007. |
 
 ### Streaming heartbeat
 
@@ -882,6 +890,73 @@ Heartbeats are inert SSE comment lines — conforming SSE clients ignore them. I
 
 OCP also sends `X-Accel-Buffering: no` on SSE responses so nginx-default proxy buffering does not hold heartbeats in an upstream buffer.
 
+## Subscription-pool (TUI) mode
+
+> **SECURITY — read before enabling.**  
+> TUI-mode is **single-user / single-operator only**. `claude` runs with the OCP process owner's filesystem access regardless of `HOME` setting. If OCP serves multiple users or guest API keys, a guest prompt could exfiltrate files or exhaust the subscription. **Never enable `CLAUDE_TUI_MODE=true` on a multi-user OCP.**
+
+### What it is and why
+
+From 2026-06-15 Anthropic routes `claude` invocations by `cc_entrypoint`:
+
+| Launch method | `cc_entrypoint` | Billing pool |
+|---------------|-----------------|-------------|
+| `claude -p` / `--output-format` (OCP default) | `sdk-cli` | Agent SDK credit pool (~$20/mo on Pro) |
+| Interactive `claude` (no flags) | `cli` | Pro/Max subscription pool |
+
+TUI-mode lets OCP serve requests via the interactive path so they bill against the subscription pool. The response is read from claude's native JSONL session transcript once the turn is complete, then replayed to the caller as a normal OpenAI completion or chunked SSE response.
+
+### Billing-classifier labeling (`OCP_TUI_ENTRYPOINT`)
+
+`OCP_TUI_ENTRYPOINT` (default `cli`) controls how `CLAUDE_CODE_ENTRYPOINT` is set on the spawn
+environment. The default (`cli`) pins the value deterministically — immune to a stray inherited
+env var or a future stdout-redirect bug silently flipping it to `sdk-cli`. This label is honest
+**only** when the spawn is a genuine interactive PTY (tmux pane, no `-p`, stdout not redirected,
+and `tmux new-session` verified to succeed). If you need to observe the raw TTY-derived value, set
+`OCP_TUI_ENTRYPOINT=auto`. See ADR 0007 for the full rationale and governing rule.
+
+### Enabling TUI-mode (opt-in)
+
+```bash
+# Prerequisites
+mkdir -p ~/.ocp-tui/work    # one-time scratch cwd setup
+# tmux must be installed: brew install tmux  /  apt install tmux
+
+# Enable
+export CLAUDE_TUI_MODE=true
+# Optionally tune:
+export CLAUDE_TUI_WALLCLOCK_MS=180000   # 3 min cap for long Opus turns
+export OCP_TUI_CWD=$HOME/.ocp-tui/work  # default; override if needed
+export OCP_TUI_ENTRYPOINT=cli           # default; use 'auto' to observe TTY-derived value
+```
+
+Then restart OCP. At boot you will see:
+
+```
+⚠️  TUI-mode ON — single-user only; do NOT enable on a multi-user OCP ...
+  TUI-mode: ON home=/home/user cwd=/home/user/.ocp-tui/work wallclock=120000ms
+```
+
+### What changes / what doesn't
+
+- **Callers see no API change.** The response is a normal OpenAI completion object or chunked SSE — identical wire format.
+- **No real token streaming.** TUI-mode buffers the full response then replays it as chunked SSE. You will see a delay then the complete response rather than real-time tokens.
+- **Cache and singleflight work normally.** TUI-mode writes the buffered response to the cache on success; cache-hits skip the interactive turn entirely.
+- **Default path unchanged.** Unset `CLAUDE_TUI_MODE` and restart → `callClaude` / `callClaudeStreaming` are used again, byte-for-byte identical to today.
+
+### Kill-switch
+
+```bash
+unset CLAUDE_TUI_MODE
+# restart OCP
+```
+
+The stream-json path is restored immediately. No other change is needed.
+
+### Architecture and design decisions
+
+See [`docs/adr/0007-tui-interactive-mode.md`](docs/adr/0007-tui-interactive-mode.md) for the full rationale, home-strategy options, MCP-disable mechanism, coexistence rules, and the B-path (multi-tenant isolation) roadmap.
+
 ## Repository Layout
 
 Top-level files a contributor or operator may need to know:

docs/adr/0006-openai-shim-scope.md

@@ -0,0 +1,132 @@
+# 0006 — OpenAI Shim Scope: Class A vs Class B Endpoints
+
+- **Date**: 2026-05-20
+- **Status**: Proposed — owner reviewing
+- **Authors**: project maintainer (with AI drafting assistance)
+- **Related**: `ALIGNMENT.md` (the constitution); ADR 0002 (Alignment Constitution provenance, PR #20, commit 2853088); PR #99 by external contributor (triggering incident — OpenAI `response_format` honoring on `/v1/chat/completions`)
+
+## Context
+
+`ALIGNMENT.md` was drafted in the aftermath of the 2026-04-11 drift (commit `b87992f` — fabricated `/api/oauth/usage` endpoint) and ratified in PR #20 / commit 2853088. Its five Rules are written in the language of a one-to-one proxy: Rule 1 (Grep First), Rule 2 (No Invention), Rule 3 (Match the Implementation), Rule 4 (Unalignable Features Are Deleted), Rule 5 (Cite Line Numbers in Commits). All five anchor explicitly on `cli.js` as the golden reference. This is correct and binding for the endpoints OCP was originally designed to forward — `/v1/messages`, `/api/oauth/*`, and the rate-limit-header extraction path that backs `/usage` — because for those, `cli.js` is the literal wire authority and any deviation is a drift risk.
+
+OCP also exposes a second class of endpoint that the constitution does not currently distinguish: **OpenAI-compatible surface** that exists so non-Claude-Code clients (Honcho, OpenWebUI, OpenAI SDK consumers, BYO scripts) can talk to claude via OCP. The flagship is `/v1/chat/completions`, which translates between OpenAI's request/response schema and `cli.js`'s native protocol. `cli.js` never speaks OpenAI's wire format — by construction it cannot, because OpenAI and Anthropic are different vendors with different protocols. There is no `cli.js:NNNN` to cite for OpenAI's `messages[].role` field handling, OpenAI's streaming `delta` shape, OpenAI's `stop` event names, or OpenAI's `response_format` parameter. The protocol authority for these is OpenAI's published specification, not `cli.js`.
+
+The structural gap surfaced when PR #99 (external contributor `jaekwon-park`) added support for the OpenAI `response_format` request field on `/v1/chat/completions`. A strict reading of Rule 2 ("OCP must not introduce request fields that are not present in `cli.js`") blocks the PR. But the same strict reading also blocks the existence of `/v1/chat/completions` itself — every OpenAI-shaped field on that endpoint is, by definition, not in `cli.js`. The endpoint has been in OCP since before the constitution was written and is used by real downstream consumers. The constitution and the endpoint cannot both be correct under the current reading.
+
+The 2026-04-11 drift remains the cautionary tale that drove the constitution and remains binding. The drift was not "OCP exposed an endpoint that wasn't in `cli.js`" — it was specifically "OCP claimed to forward `cli.js`'s `/api/oauth/usage` call when no such call exists in `cli.js`." That is a Class A failure mode: a forwarding endpoint that lied about what it was forwarding. The fix to that failure mode (Rules 1, 2, 3, 5; CI blacklist; reviewer gate) was correct then and is correct now. This ADR does not relitigate that decision and does not soften Rules 1–5 for the class of endpoint they were designed to discipline.
+
+What this ADR does is acknowledge that OCP has two classes of endpoint, and that the discipline that fits Class A does not fit Class B without distortion. Class B needs its own anchor (OpenAI's specification) and its own authorization gate (an ADR per endpoint), so contributors know exactly which rule set applies to their PR and so Class B never becomes a backdoor for "OCP can do anything OpenAI-shaped."
+
+## Decision
+
+Introduce an explicit two-class taxonomy of OCP endpoints:
+
+- **Class A — `cli.js`-mirror endpoints.** Endpoints that exist because `cli.js` performs the equivalent operation and OCP forwards, observes, or multiplexes that operation. Rules 1–5 of `ALIGNMENT.md` apply verbatim. The citation requirement is `cli.js:NNNN` (or `cli.js vE4 <functionName>`).
+
+- **Class B — OCP-owned compatibility endpoints.** Endpoints that exist because OCP itself surfaces them, with no `cli.js` analogue. They fall into two sub-buckets:
+  - **B.1 — OpenAI-compatibility surface.** Endpoints implementing OpenAI's published API contract so non-Anthropic clients can use OCP. The protocol authority is OpenAI's specification.
+  - **B.2 — OCP-administrative surface.** Endpoints that exist purely to operate the proxy itself (health, dashboard, key management, cache control). The authority for these is the ADR that authorized the endpoint's existence.
+
+For Class B endpoints, the citation requirement shifts from `cli.js:NNNN` to **(a)** the relevant specification section (OpenAI spec section for B.1, or the authorizing ADR for B.2) **and (b)** the ADR that authorized the endpoint's existence in the first place.
+
+### Grandfather provision for existing B.2 inventory
+
+ADR 0006 retroactively authorizes the existing B.2 endpoints listed in the inventory table below, **frozen at their current behaviour as of v3.16.4**. This is a one-time grandfather provision intended to avoid a 12-ADR back-fill burden for endpoints that have existed in OCP since before any constitutional governance was written.
+
+The grandfather provision is narrowly scoped:
+
+- It covers only the B.2 endpoints enumerated in the inventory table as of this ADR's merge date.
+- It freezes those endpoints at their **current behaviour**. Any change to the request shape, response shape, or semantics of a grandfathered B.2 endpoint is treated as a new authorization request and requires either (a) a behaviour-preserving refactor PR with no contract change, or (b) its own ADR.
+- It does **not** authorize new B.2 endpoints. Any new B.2 endpoint, or any new method on a grandfathered B.2 endpoint, requires its own ADR before merge.
+- It does **not** extend to B.1 (OpenAI-compat) endpoints. B.1 endpoints are bounded by OpenAI's published specification, not by a behaviour snapshot — there is no grandfather equivalent for them.
+
+The structural intent is: take the one-time hit of declaring "current B.2 surface is authorized" cleanly, then make every future addition pay the ADR-per-endpoint cost. This prevents Class B from becoming a backdoor for general OCP-owned-surface invention while not blocking the present ADR on twelve back-fill PRs.
+
+### Current Class B inventory (enumerated from `server.mjs`)
+
+The following endpoints exist today in `server.mjs` and are Class B (no `cli.js` analogue):
+
+| Endpoint | Method | Sub-bucket | Authorizing ADR |
+|---|---|---|---|
+| `/v1/chat/completions` | POST | B.1 (OpenAI-compat) | ADR 0006 |
+| `/v1/models` | GET | B.1 (OpenAI-compat) | ADR 0006; content sourced from `models.json` per ADR 0003 |
+| `/health` | GET | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/dashboard` | GET | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/sessions` | GET, DELETE | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/logs` | GET | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/status` | GET | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/settings` | GET, PATCH | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/api/keys` | GET, POST | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/api/keys/:id` | DELETE | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/api/keys/:id/quota` | GET, PATCH | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/api/usage` | GET | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/cache/stats` | GET | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+| `/cache` | DELETE | B.2 (administrative) | ADR 0006 (grandfathered as of v3.16.4) |
+
+For Class A reference, the current Class A inventory is `/v1/messages` (forwarded directly to `api.anthropic.com/v1/messages`) and the OAuth bearer / rate-limit-header machinery used by `handleUsage()` (which calls `https://api.anthropic.com/v1/messages` to extract `anthropic-ratelimit-unified-*` headers, per the in-file comment at line 845–849). The `GET /usage` endpoint surface itself is Class B (administrative augmentation: it adds `proxy:` and `models:` blocks not present in any upstream API), but the data fetch underlying it is Class A — see "Hybrid endpoints" below.
+
+### Hybrid endpoints
+
+`/usage` is a hybrid: the wire call out to `api.anthropic.com/v1/messages` is Class A and must continue to cite `cli.js`; the local synthesis on top (`proxy:` stats block, `models:` snapshot, response shape) is Class B and is authorized by this ADR. Any future change strictly to the wire-call layer is Class A; any change strictly to the synthesis layer is Class B. A PR touching both must satisfy both citation requirements.
+
+## What does NOT change
+
+The following continue to apply verbatim and are not weakened by this ADR:
+
+- **Rules 1, 2, 3, 4, 5 of `ALIGNMENT.md`** for all Class A endpoints. The 2026-04-11 drift discipline is unchanged. Class A PRs still require `cli.js:NNNN` citations, still must match `cli.js`'s wire format byte-for-byte, and still face the Unalignable Policy if the citation cannot be produced.
+- **CI blacklist** (`.github/workflows/alignment.yml`). The known-hallucinated token list (currently `api.anthropic.com/api/oauth/usage`) continues to be greppable-and-failable on every PR.
+- **Reviewer gate** (CLAUDE.md hard requirements + Iron Rule 10). Implementation author may not self-approve; a fresh-context reviewer opens `cli.js` at the cited lines for Class A PRs.
+- **Annual Alignment Audit** on 11 April. The Class A audit (re-verify each `server.mjs` Class A reference against the pinned `cli.js` SHA-256) continues unchanged.
+- **Unalignable Policy.** A Class A endpoint that cannot be traced to a `cli.js` reference is still deleted, not deprecated.
+- **Historical Lesson section in `ALIGNMENT.md`.** The 2026-04-11 drift remains the named cautionary incident, with commit SHAs intact.
+
+## What additionally applies to Class B
+
+The following are new and apply only to Class B endpoints:
+
+1. **OpenAI specification as protocol authority (B.1).** The OpenAI compatibility surface follows OpenAI's published `/v1/chat/completions` specification (https://platform.openai.com/docs/api-reference/chat/create) — not OCP imagination, not "OpenAI probably does X," not generalization from adjacent OpenAI endpoints. The same anti-invention discipline that Rule 2 imposes for `cli.js` applies, with OpenAI's spec substituted as the reference.
+
+2. **ADR-authorized endpoint existence.** Any new Class B endpoint, or any new Class B endpoint method, requires its own ADR before merge. The grandfather provision above covers existing B.2 inventory only. An "ADR-less" Class B endpoint added after this ADR merges is itself an alignment finding and is subject to deletion under a Class B equivalent of the Unalignable Policy (see Rule 4 mapping in `ALIGNMENT.md`'s new section).
+
+3. **Class B citation format.** Class B PRs cite (a) the relevant specification section and (b) the authorizing ADR. Example for B.1: "OpenAI `chat/completions` API, `response_format` parameter (https://platform.openai.com/docs/api-reference/chat/create), authorized by ADR 0006." Example for B.2: "Authorized by ADR 0006 (grandfathered)" for grandfathered endpoints, or "Authorized by ADR 00NN" for endpoints with their own ADR.
+
+4. **Class B audit cadence.** Class B endpoints are audited annually alongside the Class A audit. B.1 endpoints are audited against OpenAI's current `/v1/chat/completions` specification snapshot. B.2 endpoints (grandfathered or ADR-specific) are audited against their authorizing ADR — for grandfathered endpoints, the audit verifies the endpoint behaviour still matches its v3.16.4 snapshot; for ADR-specific endpoints, the audit verifies behaviour still matches the ADR. The B.1 specification pin lives in `docs/openai-compat-pin.md` (to be created alongside the first B.1 audit; not a prerequisite for this ADR to land).
+
+5. **Reviewer expectation.** The fresh-context reviewer for a Class B PR opens the cited OpenAI spec section (B.1) or the authorizing ADR (B.2) instead of opening `cli.js`. The "I am not the commit author" rule and the "explicit approval comment naming the verified reference" rule continue.
+
+## Consequences
+
+**Positive**
+
+- PR #99 becomes mergeable with a one-line scope declaration ("Class B — extends `/v1/chat/completions` per ADR 0006") plus the existing alignment-evidence section adapted to Class B citation format. The structural ambiguity that blocked it is removed.
+- Future Class B contributors have a clear template and a defensible scope: "extend `/v1/chat/completions` for an OpenAI-spec field that's already in OpenAI's spec" is a well-formed PR; "add a new OCP-invented field that looks OpenAI-shaped" is not, and the same anti-invention discipline that protects Class A protects Class B.
+- The Class A surface is structurally unchanged. Reviewers reading the new `ALIGNMENT.md` see a clean Class A regime with all five Rules intact, plus an enumerated and explicitly scoped Class B carve-out.
+- The administrative endpoint surface (B.2) is no longer in a "is this even allowed under the constitution?" limbo. The grandfather provision cleanly authorizes the current inventory; new B.2 endpoints must earn their ADR.
+
+**Negative**
+
+- OCP now maintains a second alignment surface. OpenAI's `/v1/chat/completions` specification is also a moving target (OpenAI ships changes more than once per year, including breaking ones), so the B.1 audit has real work attached.
+- The grandfather provision freezes the current B.2 behaviour. If a grandfathered B.2 endpoint has a latent bug or undesirable behaviour, "fixing" it is a contract change and now requires an ADR (or a behaviour-preserving refactor). This is intentional friction to prevent silent contract drift.
+- Contributors must now choose Class A or Class B on every PR. Some will misclassify. The PR template's required Class A/B radio (see PR template update) and the reviewer's spec-or-cli verification step are the structural counter-measures.
+
+**Mitigations**
+
+- The Class B inventory is small (currently 14 endpoints) and is enumerated explicitly in `ALIGNMENT.md`. New entries require an ADR per item 2 above, so the inventory cannot grow silently.
+- Anthropic-side change frequency (which drives Class A audit cost) is structurally higher than OpenAI's `chat/completions` shape, which has been stable across multiple OpenAI API versions. The marginal B.1 audit cost is low. The grandfathered B.2 audit cost is also low — most of those endpoints have not changed in months.
+- The B.1 specification pin in `docs/openai-compat-pin.md` lets the audit anchor on a specific OpenAI spec snapshot, the same way the Class A pin anchors on a specific `cli.js` SHA-256. Drift detection then works the same way for both classes.
+
+## Historical Lesson — explicit non-relitigation
+
+This ADR does not relitigate the 2026-04-11 drift. The drift commit `b87992f` was Class A — it claimed `cli.js` forwarded a call that `cli.js` did not in fact make. The fix (constitution + CI blacklist + reviewer gate) was correct and remains binding for Class A. This ADR carves out Class B because the discipline that fits Class A does not fit a class of endpoint where `cli.js` is not the wire authority — not because the discipline was wrong, and not because the drift lesson is any less load-bearing.
+
+A reviewer or future maintainer reading this ADR should not infer: "OCP relaxed its alignment rules." The Class A regime is structurally identical to the version that shipped in PR #20. What changed is that the constitution now names the scope of that regime precisely (the class of endpoint for which `cli.js` is the wire authority) instead of implicitly applying it to every endpoint, including ones the regime was never designed for.
+
+## Alternatives considered
+
+**(a) Refuse Class B as a category; close PR #99 and delete `/v1/chat/completions`.** This would resolve the structural ambiguity by enforcing Rule 2 maximally — if `cli.js` doesn't speak OpenAI's protocol, neither does OCP. Rejected: there is an existing user base on the OpenAI-compat surface, the surface is genuinely useful (it is OCP's bridge to non-Claude-Code agents), and deletion would be a load-bearing user-facing breakage in service of a doctrinal point that the constitution was never designed to make. The constitution was a response to the 2026-04-11 forwarding drift, not a charter against any OCP-owned surface.
+
+**(b) Soften Rule 2 to "OCP must not introduce surface area not present in `cli.js` OR not authorized by an ADR."** This is the obvious diff and would unblock PR #99 with the smallest possible textual change. Rejected because it loses the precision that Class A needs. A combined Rule 2 means a Class A reviewer has to read the PR description twice to figure out which authority applies. The Class A/B split makes the question explicit at the PR-template level (the author picks the class) and at the reviewer level (the reviewer opens the appropriate reference). The cost of the split is one new section in `ALIGNMENT.md`; the benefit is no ambiguity in either class.
+
+**(c) Move `/v1/chat/completions` and all OpenAI-compat surface out of OCP into a separate "ocp-openai-shim" repository.** This would cleanly resolve the scope question by moving Class B out of OCP entirely. Rejected as premature: the maintainer is one person, the OpenAI-compat surface today is a single endpoint plus its support, and the operational cost of two repositories (separate releases, separate CI, separate version coordination) exceeds the cost of one constitution with two named classes. If the OpenAI-compat surface ever grows to the size where a separate repo is justified, ADR 0006 is the natural pivot point — at that future date, the carve-out becomes a separation.
+
+**(d) Twelve-ADR back-fill for the existing B.2 inventory before this ADR can merge.** Considered and rejected on cost grounds. Each back-fill ADR would be a short paragraph explaining what an existing endpoint does and why it's allowed; the educational value is low and the merge friction is high (12 PRs through the reviewer gate). The grandfather provision above achieves the same authorization outcome in one paragraph, while still requiring an ADR for any future B.2 endpoint. The trade-off: grandfathered endpoints are not individually documented to ADR-depth. Mitigation: the inventory table in `ALIGNMENT.md` lists every grandfathered endpoint by path and method, so the audit surface remains explicit.

docs/adr/0007-tui-interactive-mode.md

@@ -0,0 +1,166 @@
+# ADR 0007 — TUI Interactive Mode (subscription-pool bridge)
+
+**Date:** 2026-05-31
+**Status:** Accepted — amended by PR-4 (entrypoint hardening)
+**Deciders:** project maintainer
+**Authority:** claude CLI v2.1.158 interactive mode — verified live on the test host that sessions launched without `-p` / `--output-format` carry `cc_entrypoint=cli` (subscription pool), not `cc_entrypoint=sdk-cli` (Agent SDK credit pool). Mechanism verified on cli.js v2.1.104; live-confirmed on v2.1.158.
+
+---
+
+## Context
+
+On 2026-05-14 Anthropic announced (effective 2026-06-15) a billing split that routes requests by `cc_entrypoint`:
+
+| `cc_entrypoint` value | Billing pool |
+|-----------------------|-------------|
+| `cli` | Pro/Max subscription pool |
+| `sdk-cli` | Agent SDK credit pool (~$20/mo on Pro = easily exhausted) |
+
+OCP's existing path (`claude --output-format stream-json -p`) sets `cc_entrypoint=sdk-cli`. After 2026-06-15 every OCP request will draw from the Agent SDK pool rather than the subscription.
+
+The structural response: add an opt-in mode that drives a real **interactive** `claude` session (no `-p`, no `--output-format`), which carries `cc_entrypoint=cli` and therefore bills against the subscription. The response text is read from claude's native JSONL transcript instead of from `stdout`.
+
+This is a personal-use A-path feature (single-user, single-subscription host). It is **not** a multi-tenant isolation layer.
+
+### Source-verified entrypoint mechanism (PR-4 amendment)
+
+Claude CLI's `main()` calls a startup function (`t$A` in the compiled bundle) that sets
+`process.env.CLAUDE_CODE_ENTRYPOINT` **only if unset** to:
+
+```
+(argv has -p/--print/--init-only/--sdk-url  OR  !process.stdout.isTTY) ? "sdk-cli" : "cli"
+```
+
+The billing header reads `cc_entrypoint = process.env.CLAUDE_CODE_ENTRYPOINT ?? "unknown"`.
+The `"unknown"` branch is dead code for any real `main()` spawn — the startup function always
+sets a value on unset env. The **real risk** is not `"unknown"`: it is a **lost TTY** (e.g. stdout
+redirected or a non-PTY spawn) silently flipping the self-classification to `"sdk-cli"` and
+drawing from the metered pool.
+
+`cc_entrypoint` is one of ~6 upstream run-mode signals. The **dominant discriminator** is the
+system-prompt identity block ("official CLI" vs "Claude Agent SDK"), which is driven by genuine
+interactivity (no `-p`, no `--output-format`, real PTY) and is overridable by no env var. This
+is the real reason the tmux/no-`-p` approach works: the spawn is genuinely interactive, not just
+labelled as such.
+
+---
+
+## Decision
+
+Add `CLAUDE_TUI_MODE=true` as an opt-in flag in `server.mjs`.
+
+### How it works
+
+1. Each request spawns a fresh tmux session running `claude --model <M> --session-id <UUID> --strict-mcp-config --disallowedTools 'mcp__*'` (no `-p`, no `--output-format`).
+2. The spawn result is checked immediately: if `tmux new-session` returns a non-zero exit status (or a falsy result), the request is aborted with `tui_spawn_failed: tmux session not created` **before** the boot sleep. This is the spawn/PTY gate — OCP must not issue a billing request without a verified interactive session.
+3. The serialized prompt (from `messagesToPrompt`) is pasted via `tmux send-keys … "$(cat file)"` + a separate `Enter` key event.
+4. The answer is read from claude's native JSONL transcript at `<HOME>/.claude/projects/<encoded-cwd>/<session-id>.jsonl`, polling until a `turn_duration` system event or the wall-clock cap (`CLAUDE_TUI_WALLCLOCK_MS`, default 120 s).
+5. The string answer is returned to OCP's existing downstream (singleflight → cache write-back → `completionResponse` / `streamStringAsSSE`) — **same contract as `callClaude`**.
+6. Streaming requests are buffered then replayed as chunked SSE (no real token streaming — deliberate; "don't build fragile features").
+
+### Billing-classifier labeling (`OCP_TUI_ENTRYPOINT`, PR-4)
+
+`CLAUDE_CODE_ENTRYPOINT` on the spawn env is managed by `resolveTuiEntrypointEnv(env, mode)`
+(exported from `lib/tui/session.mjs`, pure, testable). The function **always deletes any
+inherited value first** so a stray env var from OCP's own parent process can never leak in and
+mislabel the billing header. Then:
+
+| `OCP_TUI_ENTRYPOINT` | Behaviour |
+|----------------------|-----------|
+| `cli` (default) | Sets `CLAUDE_CODE_ENTRYPOINT=cli` deterministically — subscription-pool classification. **Honest only because the spawn is a genuine interactive PTY** (tmux pane, no `-p`, stdout not redirected, `new-session` verified). |
+| `auto` | Deletes the key → claude self-classifies via `t$A` (TTY → `cli`). Use to observe/diagnose the real TTY-derived value. |
+| `off` | Leaves the env exactly as inherited — diagnostics / honesty audit only. |
+
+**Governing rule (verbatim):** *OCP may make a true value deterministic; it may never assert a
+value the spawn's real state contradicts. When it cannot make the claim true (e.g. cannot
+guarantee a PTY), it fails/drops the request — it does not force the signal.*
+
+This is why the spawn/PTY gate (step 2 above) is load-bearing for `mode="cli"`: if `new-session`
+fails, there is no PTY, so asserting `cli` would be dishonest. Abort rather than lie.
+
+OCP never suppresses the billing header (anti-fingerprinting: we do not mask the spawn).
+
+### 2026-06-15 verification protocol
+
+Run one quiesced canary request in TUI-mode and watch the **Agent SDK credit balance** (not the
+request header). If the balance drops, the subscription pool is unreachable via spawn. Per the
+constitution (`ALIGNMENT.md`), the response is to **drop the Anthropic provider** rather than
+escalate spoofing.
+
+Version caveat: mechanism verified on cli.js v2.1.104 + live on v2.1.158. Re-verify after any
+major cli.js upgrade.
+
+### Default behaviour is unchanged
+
+When `CLAUDE_TUI_MODE` is unset (the default), no code path touches `callClaudeTui` or `runTuiTurn`. `upstreamCall === callClaude` and streaming uses `callClaudeStreaming` — byte-for-byte identical to the pre-TUI code path.
+
+### Kill-switch
+
+Unset `CLAUDE_TUI_MODE` (or set it to any value other than `"true"`) → stream-json path restored immediately on next restart.
+
+### Home strategy (real-home default)
+
+`TUI_HOME = OCP_TUI_HOME || HOME` (defaults to the operator's real home).
+
+- **Real-home (default, `OCP_TUI_HOME` unset):** claude runs with the operator's own `~/.claude/` — shared credentials, existing onboarding, no OAuth fork risk. `ensureTuiCwdTrusted` seeds the trust record for the scratch cwd in the real `~/.claude.json` (atomic write).
+- **Scratch-home opt-in (`OCP_TUI_HOME=<path>`):** a dedicated `HOME` that symlinks `~/.claude/.credentials.json` from the real home (token is never copied) and seeds a stripped `~/.claude.json` (no project history, trusts only the scratch cwd). **Caveat:** claude rewrites `.credentials.json` on OAuth token refresh, replacing the symlink with a regular file — this forks the credentials. Use scratch-home only with a dedicated OAuth or for ephemeral testing.
+
+### Working directory
+
+`TUI_CWD = OCP_TUI_CWD || $HOME/.ocp-tui/work` (dedicated scratch cwd). Transcripts land under `<HOME>/.claude/projects/<encoded-cwd>/` — a stable, single location separate from the operator's real project histories. The directory is created automatically on first request.
+
+### MCP hard-disable
+
+`--strict-mcp-config` (no `--mcp-config` argument) prevents account-attached managed MCP servers from connecting. Belt-and-braces: `--disallowedTools 'mcp__*'` blocks any MCP tool invocation even if a server were somehow loaded. Built-in tools (Bash, Read, etc.) are left enabled on the A-path (single-user, acceptable).
+
+### Session namespace
+
+All tmux sessions use the prefix `ocp-tui-`. The prefix-scoped reaper (`reapStaleTuiSessions`) kills only `ocp-tui-*` sessions, never `olp-tui-*` or any other prefix. A stale-session cleanup runs once at OCP boot when `TUI_MODE` is on.
+
+---
+
+## SECURITY — PROMINENT WARNING
+
+**TUI-mode is SINGLE-USER / SINGLE-OPERATOR ONLY.**
+
+`claude` runs as the OCP process owner with full filesystem access regardless of `HOME` setting. Home selection is **not** user isolation. If OCP is serving multiple users or guest API keys:
+
+- A guest prompt would run `claude` with the **operator's** filesystem access.
+- An adversarial prompt could exfiltrate files, run shell commands, or exhaust the subscription.
+
+**Never enable `CLAUDE_TUI_MODE=true` on an OCP instance that serves untrusted callers or multiple users.**
+
+The B-path (multi-tenant isolation) requires:
+1. `--tools ""` (no built-in tools)
+2. Per-key ephemeral `HOME` (isolated credentials + no cross-key project pollution)
+3. Sandbox runtime (e.g. `@anthropic-ai/sandbox-runtime`)
+
+B-path is **deferred** and is not implemented in this ADR. Until B-path lands, TUI-mode must only be enabled on a personal single-user OCP.
+
+---
+
+## Consequences
+
+### Positive
+
+- After 2026-06-15, requests in TUI-mode bill against the Pro/Max subscription pool (`cc_entrypoint=cli`) rather than the Agent SDK credit pool.
+- Kill-switch is immediate (unset env var + restart); zero code change required.
+- Default stream-json path is untouched — no regression risk for existing deployments.
+
+### Negative / trade-offs
+
+- **No token streaming:** responses are buffered then replayed as chunked SSE. Clients see a delay then the full response arrives; real-time token streaming is not available in TUI-mode.
+- **Billing unmeasurable until 2026-06-15:** the `cc_entrypoint=cli` signal is verified, but the credit deduction from the correct pool cannot be confirmed until the billing split activates.
+- **tmux dependency:** the host must have `tmux` installed. CI / Docker images that lack tmux cannot use TUI-mode (the default stream-json path is unaffected).
+- **Wall-clock cap:** long Opus thinking turns may hit the 120 s cap. Increase `CLAUDE_TUI_WALLCLOCK_MS` if needed (no quiescence heuristic — the reader polls until terminal marker or cap).
+- **Grey-area usage:** running an interactive `claude` session headlessly to serve HTTP requests is not an officially documented use case. If Anthropic policy changes to block this pattern, OCP must fall back to the stream-json path (unset `CLAUDE_TUI_MODE`).
+
+### Coexistence
+
+- tmux prefix `ocp-tui-` is registered. Any co-hosted OLP test instance must use `olp-tui-`. Never run two TUI proxies on the same OAuth concurrently — stop one instance during integration testing.
+
+---
+
+## Provenance
+
+TUI-mode originated in a prototype contributed via PR #101 (see the PR for author attribution). The productionization design is in `docs/superpowers/specs/2026-05-30-tui-mode-production-design.md`. Spikes S1–S6 / T1–T6 were validated live on the test host against `claude v2.1.158`.

docs/adr/README.md

@@ -22,6 +22,7 @@ New ADRs increment from the highest existing number. Filenames are
 | [0003](0003-models-json-spot.md) | `models.json` as SPOT | Why model IDs / aliases / context windows live in a single JSON file (not duplicated in `server.mjs` and `setup.mjs` arrays). v3.11.0 refactor. |
 | [0004](0004-openclaw-auto-sync.md) | OpenClaw Auto-Sync | Why `scripts/sync-openclaw.mjs` runs on `ocp update`, what its scope boundary is (writes only `models.providers["claude-local"].models` and `agents.defaults.models["claude-local/*"]`), and the idempotency contract. |
 | [0005](0005-no-multi-provider.md) | No Multi-Provider | Why OCP stays single-provider (Anthropic-via-cli.js) and does not extend to OpenAI / Gemini / OpenRouter. Cost estimate: ~7 weeks for a v1 that buys neither moat nor commercial readiness. Separate commercial work starts in a separate repo. |
+| [0006](0006-openai-shim-scope.md) | OpenAI Shim Scope | The Class A / Class B taxonomy. Class A endpoints (`cli.js`-mirror) keep Rules 1–5 verbatim; Class B endpoints (OCP-owned compatibility surface — `/v1/chat/completions`, `/v1/models`, admin endpoints) are anchored to OpenAI's spec (B.1) or to an authorizing ADR (B.2). Triggered by PR #99 (external `response_format` honoring). Grandfathers the existing B.2 inventory at v3.16.4. |
 
 ## When to write a new ADR
 

docs/openai-compat-pin.md

@@ -0,0 +1,11 @@
+# OpenAI Compatibility Pin (Class B.1)
+
+**Status:** Placeholder — populated at first B.1 audit per ADR 0006 §"Class B audit cadence".
+
+This file is the Class B.1 counterpart to the Class A `cli.js` audit pin in `ALIGNMENT.md` §"Golden Reference". When the first annual alignment audit covers Class B (per `ALIGNMENT.md` §"Annual Alignment Audit"), this file will be populated with:
+
+- The OpenAI `/v1/chat/completions` specification snapshot date being audited against (and the source URL the snapshot was taken from).
+- The list of B.1 endpoints (currently `/v1/chat/completions`, `/v1/models`) and, for each one, the specific OpenAI spec fields and behaviours it honors.
+- Drift detection notes for any OpenAI spec changes since the previous audit, and any OCP code changes required to track those changes.
+
+Until populated, this file's existence is only a forward reference so that the link in `ALIGNMENT.md` does not 404. The actual audit procedure is defined in `ALIGNMENT.md` §"Annual Alignment Audit" (Class B scope) and ADR 0006 §"Class B audit cadence".

docs/plans/anthropic-sandbox-strategy.md

@@ -0,0 +1,268 @@
+# OCP Anthropic-Only Sandbox Strategy — Handoff Document
+
+**Status:** Forward-looking planning doc (not yet a decision)
+**Date:** 2026-05-29
+**Audience:** future OCP maintainer / session picking up multi-tenant security work
+**Provenance:** authored during OLP Phase 7 PR-B re-evaluation; OLP's parallel analysis (multi-provider) lives at `dtzp555-max/olp` `docs/adr/0014-sandbox-runtime-integration.md` Amendment 1 (pending). This OCP-side doc strips the multi-LLM generalization and keeps only what applies to OCP's single-provider (anthropic) deployment.
+
+---
+
+## 1. Why this doc exists
+
+OCP is in maintenance mode (per OLP ADR 0001 supersession of OCP ADR 0005). It is not under active development for new features. However, two things may eventually drive sandbox work in OCP:
+
+1. **Multi-key OCP deployments.** `OCP_OWNER_TOKEN` + per-key cache namespace already shipped (OCP `lib/keys.mjs`). If multiple human users share an OCP instance, the same multi-tenant filesystem-isolation gap that motivated OLP Phase 7 also exists here.
+2. **Cloud or shared-host OCP deployments.** Any deployment beyond "single user on their own machine" inherits the threat surface.
+
+If/when that work starts, this doc is the prior-art capture so the maintainer doesn't repeat OLP's PR-B path (which has a documented dead-end — see § 3.2 below).
+
+This doc is anthropic-only by design — codex/mistral/etc. multi-LLM concerns are out of scope per OCP ADR 0005.
+
+---
+
+## 2. The multi-tenant gap (OCP-specific)
+
+OCP spawns `claude -p` as the OCP-process user. Every spawned claude instance runs with the OCP user's filesystem permissions. Consequences for a multi-key OCP deployment:
+
+1. **Cross-key lateral read.** A prompt-injected `cat ~/.ocp/keys/<other-key>.json` reads any other key's manifest (token hash, owner_tier, providers_enabled — not catastrophic since it's only the *hash*, but still identity-attribution surface).
+2. **OAuth credential exposure.** `~/.claude/.credentials.json` is the Anthropic OAuth refresh token. A prompt-injected read of this file = stealing the subscription that OCP exists to pool.
+3. **SSH identity exposure.** `~/.ssh/id_*` reachable for lateral movement to other hosts the OCP user can reach.
+4. **Other host secrets.** Anything else under the OCP user's home is reachable.
+
+OCP's `ALIGNMENT.md` Class A/B endpoint discipline does not address this — that discipline is wire-level honesty (`cli.js` mirror), not host-level isolation.
+
+The threat model assumes prompt-injection capability — any caller with a valid OCP key + ability to craft a prompt that elicits a tool call. Default `claude -p` mode includes Read/Bash/etc. tool descriptions in the system prompt; the model is **eager** to use them.
+
+---
+
+## 3. Why OLP Phase 7 PR-B is the wrong path to copy
+
+OLP attempted to wrap `claude -p` spawn in `@anthropic-ai/sandbox-runtime` (outer bubblewrap on Linux, sandbox-exec on macOS). This produced four binding problems documented during OLP's re-evaluation:
+
+### 3.1 Anthropic's design doesn't expect external sandboxing
+
+Per Anthropic's [engineering blog on Claude Code sandboxing](https://www.anthropic.com/engineering/claude-code-sandboxing), `sandbox-runtime` is designed to be invoked **by claude code itself** to sandbox **its own** Bash tool / MCP servers / spawn children. It is **not** designed to sandbox claude code as an externally-wrapped process.
+
+Concretely: claude CLI assumes it can freely read+write its own `$HOME`-derived paths (`~/.claude.json`, `~/.claude/.credentials.json`, `~/.config/claude/`, future state files). When wrapped in `bwrap --ro-bind / /`, those writes hit `EROFS` and claude silently exits with no stdout.
+
+### 3.2 `~/.claude.json` upstream status is "closed not planned"
+
+claude CLI writes `~/.claude.json` non-atomically at startup. Upstream issues #28842, #29162, #29217, #28837, #29051, #29250, #7243 all document this. **#29250 is closed as "not planned / duplicate"** — Anthropic is not going to make this file atomic-write because their mental model is that claude runs in an environment that can write its `$HOME`.
+
+For OCP, this means: any outer-sandbox approach that uses `--ro-bind` on `$HOME` will be a **permanent maintenance treadmill** — every new claude CLI version that adds a state file outside the patched mount paths breaks OCP. OLP's PR-B fold-in tried to patch this by promoting `~/.claude/` to rw, which was insufficient (the actual file is `~/.claude.json` at $HOME root, not inside `~/.claude/`).
+
+### 3.3 The threat model doesn't justify the cost
+
+OCP is, per ADR 0005, a personal-and-family-scale tool. The realistic threat surface is misbehaving prompts from family members or self-injected via dependent agents, not adversarial external attackers. The blast radius of a successful cross-key read is bounded (token *hash*, OAuth that's pooled-by-design across all OCP keys).
+
+A maintenance-mode project investing weeks into outer-sandboxing for a hypothetical threat is a poor cost/benefit. There are cheaper architectures (§ 4 below) that get most of the protection.
+
+### 3.4 OLP-specific reason that does NOT apply to OCP
+
+OLP also hit a multi-provider conflict: codex CLI has its own inner bubblewrap that breaks when wrapped in an outer bwrap (openai/codex#16018). **This is not an OCP concern** — OCP only spawns claude. So the multi-provider forcing function for OLP doesn't apply here. The other three reasons (§ 3.1–3.3) are sufficient on their own.
+
+---
+
+## 4. Three viable approaches for OCP
+
+Ranked by "engineering cost vs isolation strength" — pick by deployment context.
+
+### 4.1 Approach A — Ephemeral `$HOME` via env var (recommended starting point)
+
+Per-spawn setup:
+
+```
+ephemeralRoot=/tmp/ocp-spawn/<keyId>/<reqId>/home
+mkdir -p $ephemeralRoot/.claude
+ln -s ~/.claude/.credentials.json $ephemeralRoot/.claude/.credentials.json
+HOME=$ephemeralRoot claude -p --output-format stream-json ...
+```
+
+Mechanics:
+- claude CLI uses Node's `os.homedir()` which reads `$HOME` env first.
+- `~/.claude.json` written by claude on startup → lands in `/tmp/ocp-spawn/<keyId>/<reqId>/home/.claude.json` (tmpfs, discarded after spawn).
+- `~/.claude/.credentials.json` is the OAuth file claude needs — symlinked in read-only from the real one.
+- Any new state file claude CLI introduces in a future version → also lands in the ephemeral home, no patch needed.
+
+Threat coverage:
+- ✅ Solves EROFS upgrade tax permanently — any claude state-file location works because they all land in tmpfs.
+- ✅ Cross-key OAuth credential isolation — keyA's ephemeral home has only keyA's symlink, but here the symlink target is the SAME real file because OCP shares OAuth (this is fine: shared OAuth is OCP's design, the symlink just keeps the file inaccessible via `cat ~/.claude/.credentials.json` from a different keyId's ephemeral root).
+- ❌ Does NOT solve cross-key lateral filesystem read via absolute paths. A prompt-injected `cat /home/<ocp-user>/.ocp/keys/<otherKey>.json` still works — `os.homedir()` override doesn't affect absolute-path reads.
+
+5-minute spike before adopting:
+
+```bash
+HOME=/tmp/fake-home-spike claude --print "echo PONG" --no-session-persistence 2>&1
+ls -la /tmp/fake-home-spike  # expect: .claude.json + .claude/ created here
+find ~/.claude ~/.claude.json -newer /tmp/spike-marker 2>/dev/null  # expect: empty
+```
+
+If claude falls back to `os.userInfo().homedir` (uses getpwuid_r, ignores HOME env), this approach degrades — fall back to Approach B.
+
+**Engineering cost:** ~50 LOC in OCP's spawn pipeline (mkdir + symlink + env merge + cleanup-on-exit). No new dependencies.
+
+### 4.2 Approach B — Outer bubblewrap with `--tmpfs $HOME` + `--ro-bind` credentials
+
+```
+bwrap \
+  --ro-bind / / \
+  --tmpfs /home/<ocp-user> \
+  --ro-bind /home/<ocp-user>/.claude/.credentials.json /home/<ocp-user>/.claude/.credentials.json \
+  --ro-bind /home/<ocp-user>/.ocp/keys/<thisKeyId>.json /home/<ocp-user>/.ocp/keys/<thisKeyId>.json \
+  --dev /dev --proc /proc --tmpfs /tmp \
+  claude -p ...
+```
+
+This is the canonical bwrap pattern (Flatpak uses exactly this for every sandboxed app — see [Bubblewrap ArchWiki Examples](https://wiki.archlinux.org/title/Bubblewrap/Examples)).
+
+Threat coverage:
+- ✅ Solves EROFS upgrade tax (tmpfs accepts any write path).
+- ✅ Cross-key lateral read prevention — only the current key's manifest is bind-mounted in, others are simply absent from the sandbox view.
+- ✅ `~/.ssh` and similar identity material absent from sandbox.
+
+Trade-offs:
+- bwrap dependency: install `bubblewrap` apt package on host.
+- Bypasses `@anthropic-ai/sandbox-runtime` library — direct bwrap arg composition. Worth it because sandbox-runtime's outer-wrap design is for short-lived claude-internal subprocesses, not long-running claude CLI itself (per § 3.1).
+- macOS: not supported by bwrap (macOS would need separate `sandbox-exec` profile, ~50-100 LOC additional work). OCP cross-machine maintainer deploys mostly on Mac mini + Oracle ARM VM — both Linux on the cloud side, Mac mini side may remain unsandboxed if family-trust-zone.
+
+**Engineering cost:** ~150 LOC for the spawn wrapper + deployment doc updates to require `apt install bubblewrap`. macOS support is a separate ~100 LOC if/when needed.
+
+### 4.3 Approach C — OverlayFS lowerdir (read-only) + tmpfs upperdir (writable)
+
+```
+mount -t overlay overlay \
+  -o lowerdir=/home/<ocp-user>/.claude,upperdir=/tmp/ocp-spawn/<reqId>/upper,workdir=/tmp/ocp-spawn/<reqId>/work \
+  /tmp/ocp-spawn/<reqId>/merged-claude
+HOME=/tmp/ocp-spawn/<reqId>/home claude -p ...
+# After spawn: umount + rm -rf
+```
+
+Most elegant — claude sees a view identical to its real `~/.claude/`, all writes go to tmpfs upperdir, real `~/.claude/` is never touched.
+
+Trade-offs:
+- Requires `CAP_SYS_ADMIN` or rootless-overlayfs (kernel ≥5.11 + user-ns enabled). OCP currently runs as the maintainer's user — no SYS_ADMIN — so this would require either running OCP as root (bad) or rootless-overlayfs setup.
+- More moving parts (mount/umount per spawn, work-dir lifetime, cleanup-on-crash).
+
+Better fit if OCP ever moves to a dedicated `ocp` system user with `CAP_SYS_ADMIN` capability via systemd.
+
+**Engineering cost:** ~120 LOC + kernel/permission preflight check.
+
+---
+
+## 5. Cross-key isolation orthogonal layer
+
+The three approaches above all solve `~/.claude.json` EROFS + state-write isolation. None of them alone solve **cross-key lateral filesystem read via absolute paths** (e.g. prompt-injected `cat /home/<user>/.ocp/keys/<otherKey>.json`).
+
+For that, two options compose with any of A/B/C:
+
+### 5.1 Per-spawn `sandbox-runtime` customConfig with `denyRead`
+
+`@anthropic-ai/sandbox-runtime`'s `wrapWithSandbox(command, binShell?, customConfig?, abortSignal?)` accepts per-call override:
+
+```
+const otherKeysWorkspaces = listAllKeyManifestsExcept(thisKeyId)
+const wrapped = await SandboxManager.wrapWithSandbox(claudeCommand, undefined, {
+  filesystem: {
+    denyRead: [
+      ...otherKeysWorkspaces,          // all keys except current
+      '/home/<ocp-user>/.ssh',
+      '/home/<ocp-user>/.gnupg',
+      '/home/<ocp-user>/.aws',
+    ],
+    allowWrite: [ephemeralRoot, '/tmp'],
+  },
+})
+```
+
+This adds bwrap deny-paths per-spawn (after sandbox-runtime singleton init). Works in combination with Approach A (the `HOME` env-var override is independent of sandbox-runtime's restrictions).
+
+Caveat: this re-introduces the outer-bwrap concern from § 3.1 — claude CLI is now wrapped after all. Mitigation: use this only for **cross-key isolation**, not for `$HOME` restriction. The `denyRead` paths are all outside `$HOME`, so claude's `~/.claude.json` write is unaffected.
+
+### 5.2 Per-OS-user OCP spawning
+
+Each OCP key gets a dedicated Linux user (`ocp-<keyId>`). Spawn claude as that user via `runuser` or `sudo -u`. OAuth credential shared via Linux group permissions or bind-mount.
+
+True kernel-level uid isolation. Most robust answer for OCP-as-shared-host scenarios.
+
+Trade-offs:
+- Setup script complexity (one-time per key).
+- Linux-only.
+- Doesn't fit Mac mini deployment.
+
+Best fit for a cloud OCP deployment where per-tenant trust isolation matters.
+
+---
+
+## 6. Trust model framing
+
+OCP's authentication layer (`lib/keys.mjs`) provides **attribution** (per-key audit, per-key cache namespace). It does NOT, by itself, provide **isolation** (per-key trust boundary against prompt-injection lateral reads).
+
+This distinction is worth making explicit in OCP's README "Security" section (it currently isn't). The three tiers:
+
+| Tier | Trust Model | Sandbox requirement |
+|---|---|---|
+| **Single-user** | maintainer's own machine, single OCP token | None — system-user permissions are sufficient |
+| **Family-trust-zone** | maintainer + family members on shared OCP instance, all parties trusted not to attack each other | Optional — Approach A (ephemeral $HOME) gives cleanup hygiene without changing trust assumptions |
+| **Shared-host / cloud / external callers** | OCP keys handed to potentially-adversarial callers (CI runners, third-party agents, public demo) | Required — Approach B or C + § 5 cross-key isolation |
+
+The current OCP deployment fits tier 1 or 2. The work in this doc applies only when promoting to tier 3.
+
+---
+
+## 7. Recommendation if/when this work starts
+
+**Phase 1 — Approach A (ephemeral `$HOME`) only.**
+- ~50 LOC, no apt deps, works on Mac mini + Linux
+- Solves the EROFS upgrade tax structurally
+- Closes cross-key OAuth-credential-file lateral read
+- Cost-effective hygiene improvement
+
+**Phase 2 — Approach B (outer bwrap) gated by deployment config.**
+- Add `~/.ocp/config.json` field `security.sandbox: 'off' | 'tmpfs-home'`
+- Default off (preserves Mac mini family deployment)
+- Operator opts in on Linux cloud deployments
+- Apt prereq documented in deployment guide
+
+**Phase 3 — § 5 cross-key isolation (only if tier 3 deployment is planned).**
+- Layer per-spawn customConfig denyRead OR per-OS-user spawning
+- Treat as separate ADR amendment with its own threat-model evidence
+
+**Skip Approach C** unless a future requirement forces overlay (low likelihood for OCP scope).
+
+---
+
+## 8. Authority citations
+
+This doc claims findings about claude CLI / `@anthropic-ai/sandbox-runtime` behavior. Sources for verification:
+
+- [Anthropic engineering — Claude Code sandboxing](https://www.anthropic.com/engineering/claude-code-sandboxing) (sandbox-runtime design intent)
+- [Anthropic sandbox-runtime GitHub](https://github.com/anthropic-experimental/sandbox-runtime) (wrapWithSandbox API + customConfig per-call signature)
+- [claude-code#29250 — `.claude.json` non-atomic-write closed-not-planned](https://github.com/anthropics/claude-code/issues/29250)
+- [claude-code#29162 — read-only `~/.claude.json` startup hang](https://github.com/anthropics/claude-code/issues/29162)
+- [claude-code#29217 — concurrent-write corruption](https://github.com/anthropics/claude-code/issues/29217)
+- [claude-code#28842 — Windows startup race](https://github.com/anthropics/claude-code/issues/28842)
+- [claude-code#7243 — "the .claude.json elephant in the room"](https://github.com/anthropics/claude-code/issues/7243)
+- [Bubblewrap README](https://github.com/containers/bubblewrap)
+- [Bubblewrap ArchWiki — Examples section, --tmpfs HOME pattern](https://wiki.archlinux.org/title/Bubblewrap/Examples)
+- [Sandboxing CLI tools with Bubblewrap — botmonster](https://botmonster.com/self-hosting/sandbox-linux-apps-cli-tools-bubblewrap/)
+- [OverlayFS kernel documentation](https://docs.kernel.org/filesystems/overlayfs.html)
+- [OverlayFS ArchWiki](https://wiki.archlinux.org/title/Overlay_filesystem)
+
+OLP's parallel work (multi-provider generalization of this strategy, including the codex inner-bwrap conflict that does not apply to OCP):
+
+- `dtzp555-max/olp` `docs/adr/0014-sandbox-runtime-integration.md` (PR-B as-shipped) + Amendment 1 (pending — Solution 1 architecture)
+- `dtzp555-max/olp` `docs/plans/cloud-deployment-family.md` § 5 (deployment-side trust tier mapping)
+- archive branch `dtzp555-max/olp:phase-7-pr-b-outer-bwrap-snapshot` captures the outer-bwrap approach as snapshot if anyone wants to revisit it
+
+---
+
+## 9. What this doc is NOT
+
+- Not an ADR. ADRs are decisions; this is a forward-facing strategy doc that becomes an ADR only when work starts and a decision is made.
+- Not a binding spec. The three approaches are alternatives; the recommendation in § 7 is the maintainer's lean from prior-art analysis, not a constitution.
+- Not authority for any code change. OCP `ALIGNMENT.md` still requires citation per Class A/B; no sandbox code lands without proper authority pinning when the work eventually starts.
+- Not a security audit. The threat model is informal — based on prior-art search + incident memory from OLP's parallel session. A real cloud deployment should commission an independent threat model.
+
+---
+
+**Authors:** project maintainer (handoff prepared with AI drafting assistance during OLP Phase 7 PR-B re-evaluation, 2026-05-29).

docs/superpowers/plans/2026-05-30-tui-mode-ocp-implementation-plan.md

@@ -0,0 +1,737 @@
+# TUI-mode (OCP-first) Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add an opt-in `CLAUDE_TUI_MODE` to OCP that serves `/v1/chat/completions` by driving a *real interactive* `claude` session (no `-p`, no `--output-format`) so the request bills as `cc_entrypoint=cli` (subscription pool), reading the answer from claude's native JSONL transcript — while the default stream-json path stays byte-for-byte unchanged.
+
+**Architecture:** Two new pure-ish modules under `lib/tui/` — a transcript **reader** (`transcript.mjs`, provider-agnostic, the shareable core) and a tmux **session driver** (`session.mjs`, OCP-specific). `server.mjs` gains a `callClaudeTui()` that returns `Promise<string>` and is gated into the existing dispatch by a single env flag; because OCP's entire downstream (singleflight → `setCachedResponse` → `completionResponse` / chunked-SSE-replay → `recordUsage`) already consumes a string from `callClaude`, TUI-mode is a drop-in. Streaming is buffered then replayed as chunked SSE (no token streaming — deliberately, "don't build fragile features").
+
+**Tech Stack:** Node.js ESM (`.mjs`), `tmux` (interactive PTY host), `child_process` (`spawnSync`), `node:fs` polling (no `fs.watch`, no terminal-screen parsing). Test harness: `node test-features.mjs`.
+
+**Source of truth for the TUI mechanism:** the OLP design spec `docs/superpowers/specs/2026-05-30-tui-mode-production-design.md` (CLI-level, applies to both projects) + its 6 validation spikes (S1–S6, T1–T6) run on PI231 against `claude v2.1.158`. This plan is the OCP-grounded execution of that spec.
+
+---
+
+## Why OCP-first / scope decisions (read before coding)
+
+- **OCP-first** because OCP has the users and its compute path is `callClaude → Promise<string>`, a near-perfect impedance match for a reader that also returns a string. OLP would additionally need a string→IR-chunk-array adapter. OLP-sync is **deferred entirely until the post-2026-06-15 fork decision** — do not spend cycles keeping OLP's TUI in lockstep.
+- **A-path only.** Single-user / multi-device on one subscription. No per-key ephemeral isolation, no multi-tenant. (That is the OLP B-path, deferred.)
+- **A-path isolation = real `$HOME` + dedicated scratch cwd + `--strict-mcp-config`.** OCP has *no* ISOLATION contract and we do not build one. We run interactive `claude` in the operator's real home (OAuth + onboarding already valid) but in a **dedicated scratch working directory** (`OCP_TUI_CWD`, default `$HOME/.ocp-tui/work`) so transcripts land under one stable `projects/<cwd>` folder instead of polluting the operator's genuine project histories, and the trust-folder dialog is granted once.
+- **One `claude` session per request.** OCP is stateless (full conversation re-serialized each request via `messagesToPrompt`). TUI-mode mirrors this: per request, start a fresh interactive session with a fresh `--session-id`, submit one serialized prompt, await turn completion, read the transcript, extract the latest assistant text, tear the session down. Warm-pool / large-paste optimizations are explicitly out of v1 scope.
+- **Billing is unmeasurable until 2026-06-15.** Spike S1 proved the `cc_entrypoint=cli` *signal*, not the billed pool. The pre-6/15 deliverable is "a tested, working transport that emits `cli`"; 6/16 we flip the flag and measure with a documented kill-switch.
+- **Coexistence rule (PI231 runs an OLP test instance too).** All tmux sessions use the prefix `ocp-tui-`; the reaper kills **only** `ocp-tui-*`, never `olp-tui-*`. Never run two TUI proxies on the same OAuth concurrently — stop the OLP test instance during OCP integration.
+- **Provenance.** TUI-mode originated in OCP PR #101 (author courtesy: jaekwon-park <insainty21@gmail.com>). The PR #101 author should be credited + notified on the shipping PR.
+
+---
+
+## File Structure
+
+| File | Responsibility | New/Modified |
+|------|----------------|--------------|
+| `lib/tui/transcript.mjs` | Pure transcript parsing + the polling reader. Returns the latest assistant text once the turn is terminal or the wall-clock cap elapses. Provider-agnostic — the shareable core. | **Create** |
+| `lib/tui/session.mjs` | tmux session lifecycle: boot interactive `claude`, answer the trust dialog, submit the prompt (file → `"$(cat)"` paste → separate Enter), await the reader, tear down. Plus the prefix-scoped reaper. OCP-specific. | **Create** |
+| `lib/tui/fixtures/` | Real transcript JSONL harvested from PI231 + a few hand-crafted edge cases, for the reader's unit tests. | **Create** |
+| `server.mjs` | `callClaudeTui()` (`Promise<string>`); `streamStringAsSSE()` helper (DRY refactor of the cache-replay block); single-flag dispatch gates; reaper hook at boot; env consts. | **Modify** (`:258` env consts, `:1018`–`:1023` helpers, `:1467` dispatch, boot block) |
+| `test-features.mjs` | Suite for the reader (fixtures, runs in CI) + a live-only guarded suite for the driver (`OCP_TUI_LIVE=1`, skipped in CI). | **Modify** |
+| `docs/adr/0007-tui-interactive-mode.md` | OCP ADR 0007 (OCP's next number) — TUI mode rationale, billing-signal authority, scope, kill-switch. | **Create** |
+| `README.md` | New env vars (`CLAUDE_TUI_MODE`, `CLAUDE_TUI_WALLCLOCK_MS`, `OCP_TUI_CWD`), a "Subscription-pool (TUI) mode" section, troubleshooting + kill-switch. | **Modify** |
+| `CHANGELOG.md` | Unreleased entry. | **Modify** |
+
+---
+
+## PR-1 — Transcript reader (`lib/tui/transcript.mjs`)
+
+The shareable core. Pure functions + a polling reader. Fully unit-testable from committed fixtures; needs PI231 only once, to harvest realistic fixtures.
+
+### Task 0: Harvest real fixtures from PI231
+
+**Files:**
+- Create: `lib/tui/fixtures/complete-haiku.jsonl` (real, has `turn_duration`)
+- Create: `lib/tui/fixtures/complete-sonnet-multiblock.jsonl` (real, multi content-block answer)
+
+- [ ] **Step 1: Drive one real interactive turn on PI231 and copy its transcript**
+
+On PI231 (the only box with an authenticated interactive `claude`), run a single interactive turn in a scratch cwd, then locate its transcript:
+
+Run (on PI231):
+```bash
+SID=$(uuidgen)
+mkdir -p ~/.ocp-tui/work
+# drive one turn by hand in tmux OR reuse a transcript already produced by the S-spikes:
+ls -t ~/.claude/projects/-home-*-.ocp-tui-work/*.jsonl 2>/dev/null | head
+# pick one complete transcript (must contain a line with "subtype":"turn_duration")
+```
+Expected: at least one `.jsonl` file whose tail contains `{"type":"system","subtype":"turn_duration",...}`.
+
+- [ ] **Step 2: Copy 2 real transcripts into the repo as fixtures, scrubbed**
+
+Run (from the workstation):
+```bash
+scp pi231:'~/.claude/projects/<encoded-cwd>/<sid>.jsonl' lib/tui/fixtures/complete-haiku.jsonl
+# Scrub: the transcript may contain the prompt/answer text only (no OAuth token — tokens
+# live in ~/.claude/.credentials.json, NOT in projects/*.jsonl). Confirm no credential
+# material before committing:
+grep -iE "sk-ant|oat01|bearer|authorization" lib/tui/fixtures/*.jsonl && echo "STOP: scrub" || echo "clean"
+```
+Expected: `clean`. (Transcripts hold conversation content + metadata, never the bearer token. If a fixture's prompt text is sensitive, replace it with a benign hand-edited turn that keeps the JSON shape.)
+
+- [ ] **Step 3: Commit the fixtures**
+
+```bash
+git add lib/tui/fixtures/complete-haiku.jsonl lib/tui/fixtures/complete-sonnet-multiblock.jsonl
+git commit -m "test(tui): real claude transcript fixtures harvested from PI231 (v2.1.158)"
+```
+
+### Task 1: `encodeCwd` + `transcriptPath` (the path formula)
+
+**Files:**
+- Create: `lib/tui/transcript.mjs`
+- Test: `test-features.mjs` (new Suite "TUI transcript")
+
+- [ ] **Step 1: Write the failing test**
+
+Add to `test-features.mjs`:
+```js
+// ── Suite: TUI transcript reader ────────────────────────────────────────
+import { encodeCwd, transcriptPath } from "./lib/tui/transcript.mjs";
+
+test("encodeCwd replaces every slash incl. leading", () => {
+  assertEqual(encodeCwd("/home/u/.ocp-tui/work"), "-home-u-.ocp-tui-work");
+});
+test("transcriptPath composes EHOME/.claude/projects/<enc>/<sid>.jsonl", () => {
+  assertEqual(
+    transcriptPath("/home/u", "/home/u/.ocp-tui/work", "abc-123"),
+    "/home/u/.claude/projects/-home-u-.ocp-tui-work/abc-123.jsonl"
+  );
+});
+```
+
+- [ ] **Step 2: Run to verify it fails**
+
+Run: `node test-features.mjs 2>&1 | grep -i "tui transcript\|Cannot find module"`
+Expected: FAIL — `Cannot find module './lib/tui/transcript.mjs'`.
+
+- [ ] **Step 3: Minimal implementation**
+
+Create `lib/tui/transcript.mjs`:
+```js
+// Transcript reader for TUI-mode. Reads claude's native JSONL session transcript
+// and returns the latest assistant turn's text once the turn is terminal.
+//
+// Authority: claude CLI v2.1.158 — interactive session transcript at
+//   <HOME>/.claude/projects/<CWD with every "/" -> "-">/<--session-id>.jsonl
+// Completion marker: a line {"type":"system","subtype":"turn_duration",...}.
+// See docs/superpowers/specs/2026-05-30-tui-mode-production-design.md §4.
+import { readFileSync, existsSync } from "node:fs";
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// Project-dir encoding: every "/" -> "-" (including the leading slash).
+export function encodeCwd(cwd) {
+  return cwd.replace(/\//g, "-");
+}
+
+export function transcriptPath(home, cwd, sessionId) {
+  return `${home}/.claude/projects/${encodeCwd(cwd)}/${sessionId}.jsonl`;
+}
+```
+
+- [ ] **Step 4: Run to verify it passes**
+
+Run: `node test-features.mjs 2>&1 | grep -i "tui transcript"`
+Expected: PASS for both cases.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add lib/tui/transcript.mjs test-features.mjs
+git commit -m "feat(tui): transcript path formula (encodeCwd + transcriptPath)"
+```
+
+### Task 2: `parseTranscriptLines` + `isTerminalLine` + `extractLatestAssistantText`
+
+**Files:**
+- Modify: `lib/tui/transcript.mjs`
+- Test: `test-features.mjs`
+
+- [ ] **Step 1: Write the failing tests**
+
+```js
+import { parseTranscriptLines, isTerminalLine, extractLatestAssistantText } from "./lib/tui/transcript.mjs";
+import { readFileSync } from "node:fs";
+
+test("parseTranscriptLines skips blank + malformed/partial lines", () => {
+  const evs = parseTranscriptLines('{"a":1}\n\n{bad json\n{"b":2}\n');
+  assertEqual(evs.length, 2);
+  assertEqual(evs[1].b, 2);
+});
+test("isTerminalLine true on turn_duration", () => {
+  assertEqual(isTerminalLine({ type: "system", subtype: "turn_duration" }), true);
+});
+test("isTerminalLine true on stop_reason tool_use (message-wrapped + flat)", () => {
+  assertEqual(isTerminalLine({ type: "assistant", message: { stop_reason: "tool_use" } }), true);
+  assertEqual(isTerminalLine({ stop_reason: "tool_use" }), true);
+});
+test("isTerminalLine false on ordinary assistant/text lines", () => {
+  assertEqual(isTerminalLine({ type: "assistant", message: { content: [{ type: "text", text: "hi" }] } }), false);
+});
+test("extractLatestAssistantText concatenates text blocks of the LAST assistant turn", () => {
+  const evs = [
+    { type: "assistant", message: { content: [{ type: "text", text: "first" }] } },
+    { type: "user", message: { content: "..." } },
+    { type: "assistant", message: { content: [{ type: "text", text: "A" }, { type: "thinking", thinking: "x" }, { type: "text", text: "B" }] } },
+  ];
+  assertEqual(extractLatestAssistantText(evs), "AB");
+});
+test("real complete fixture yields non-empty text and is terminal", () => {
+  const evs = parseTranscriptLines(readFileSync("./lib/tui/fixtures/complete-haiku.jsonl", "utf8"));
+  assert(evs.some(isTerminalLine), "fixture must contain a terminal line");
+  assert(extractLatestAssistantText(evs).length > 0, "fixture must yield assistant text");
+});
+```
+
+- [ ] **Step 2: Run to verify it fails**
+
+Run: `node test-features.mjs 2>&1 | grep -i "parseTranscript\|isTerminal\|extractLatest\|real complete fixture"`
+Expected: FAIL — exports not defined.
+
+- [ ] **Step 3: Minimal implementation** (append to `lib/tui/transcript.mjs`)
+
+```js
+// Parse NDJSON text into objects; skip blank lines and partial/forming lines
+// (the live transcript is read mid-write, so the last line may be incomplete).
+export function parseTranscriptLines(text) {
+  const out = [];
+  for (const line of text.split("\n")) {
+    const t = line.trim();
+    if (!t) continue;
+    try { out.push(JSON.parse(t)); } catch { /* partial line being written */ }
+  }
+  return out;
+}
+
+// A line marks the assistant turn complete when it is the turn_duration system
+// event, or an assistant message that stopped to hand off to a tool.
+export function isTerminalLine(obj) {
+  if (!obj || typeof obj !== "object") return false;
+  if (obj.type === "system" && obj.subtype === "turn_duration") return true;
+  const sr = (obj.message && obj.message.stop_reason) || obj.stop_reason;
+  return sr === "tool_use";
+}
+
+// Text of the LAST assistant turn: concatenate its text content blocks
+// (ignore thinking/tool_use blocks). Later assistant entries overwrite earlier.
+export function extractLatestAssistantText(events) {
+  let text = "";
+  for (const ev of events) {
+    if (!ev || ev.type !== "assistant") continue;
+    const content = ev.message && ev.message.content;
+    if (!Array.isArray(content)) continue;
+    const parts = content
+      .filter((b) => b && b.type === "text" && typeof b.text === "string")
+      .map((b) => b.text);
+    if (parts.length) text = parts.join("");
+  }
+  return text;
+}
+```
+
+- [ ] **Step 4: Run to verify it passes**
+
+Run: `node test-features.mjs 2>&1 | grep -iE "parseTranscript|isTerminal|extractLatest|real complete fixture"`
+Expected: all PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add lib/tui/transcript.mjs test-features.mjs
+git commit -m "feat(tui): transcript parsing + terminal detection + assistant-text extraction"
+```
+
+### Task 3: `readTuiTranscript` (the polling reader with wall-clock cap)
+
+**Files:**
+- Modify: `lib/tui/transcript.mjs`
+- Test: `test-features.mjs`
+
+- [ ] **Step 1: Write the failing tests**
+
+```js
+import { readTuiTranscript } from "./lib/tui/transcript.mjs";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+
+test("readTuiTranscript returns assistant text when terminal marker present", async () => {
+  const dir = mkdtempSync(`${tmpdir()}/tui-`);
+  const p = `${dir}/s.jsonl`;
+  writeFileSync(p, [
+    JSON.stringify({ type: "assistant", message: { content: [{ type: "text", text: "hello world" }] } }),
+    JSON.stringify({ type: "system", subtype: "turn_duration", durationMs: 1200 }),
+  ].join("\n") + "\n");
+  const out = await readTuiTranscript({ transcriptPath: p, wallclockMs: 2000, pollMs: 50 });
+  assertEqual(out, "hello world");
+});
+test("readTuiTranscript honours wall-clock cap and returns partial text", async () => {
+  const dir = mkdtempSync(`${tmpdir()}/tui-`);
+  const p = `${dir}/s.jsonl`;
+  writeFileSync(p, JSON.stringify({ type: "assistant", message: { content: [{ type: "text", text: "partial" }] } }) + "\n");
+  const out = await readTuiTranscript({ transcriptPath: p, wallclockMs: 300, pollMs: 50 }); // never terminal
+  assertEqual(out, "partial");
+});
+test("readTuiTranscript throws when no text and cap elapses", async () => {
+  const dir = mkdtempSync(`${tmpdir()}/tui-`);
+  const p = `${dir}/missing.jsonl`; // file never appears
+  let threw = false;
+  try { await readTuiTranscript({ transcriptPath: p, wallclockMs: 200, pollMs: 50 }); }
+  catch { threw = true; }
+  assert(threw, "must throw on empty timeout");
+});
+```
+
+- [ ] **Step 2: Run to verify it fails**
+
+Run: `node test-features.mjs 2>&1 | grep -i "readTuiTranscript"`
+Expected: FAIL — export not defined.
+
+- [ ] **Step 3: Minimal implementation** (append)
+
+```js
+// Block until the session transcript is terminal (turn_duration / tool_use) or
+// the wall-clock cap elapses, polling the file (no fs.watch — robust over NFS /
+// editors). Returns the latest assistant text. On cap with text, returns the
+// partial text; on cap with no text at all, throws.
+//
+// No quiescence heuristic by design: a long Opus thinking turn stalls transcript
+// growth and a "file stable for N s" rule would false-abort it (spec §4.3).
+export async function readTuiTranscript({ transcriptPath: p, wallclockMs = 120000, pollMs = 250 }) {
+  const deadline = Date.now() + wallclockMs;
+  let lastText = "";
+  while (Date.now() < deadline) {
+    if (existsSync(p)) {
+      const events = parseTranscriptLines(readFileSync(p, "utf8"));
+      lastText = extractLatestAssistantText(events) || lastText;
+      if (events.some(isTerminalLine)) return lastText;
+    }
+    await sleep(pollMs);
+  }
+  if (lastText) return lastText;
+  throw new Error("tui_transcript_timeout: no assistant text within wallclock cap");
+}
+```
+
+- [ ] **Step 4: Run to verify it passes**
+
+Run: `node test-features.mjs 2>&1 | grep -i "readTuiTranscript"`
+Expected: all 3 PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add lib/tui/transcript.mjs test-features.mjs
+git commit -m "feat(tui): polling transcript reader with wall-clock cap (no quiescence)"
+```
+
+---
+
+## PR-2 — Session driver (`lib/tui/session.mjs`)
+
+tmux lifecycle + the validated submission recipe. Cannot be unit-tested without a live authenticated `claude`; tested by a live-only guarded suite that runs on PI231.
+
+### Task 4: `reapStaleTuiSessions` (prefix-scoped reaper)
+
+**Files:**
+- Create: `lib/tui/session.mjs`
+- Test: `test-features.mjs`
+
+- [ ] **Step 1: Write the failing test** (pure — no live claude; inject a fake tmux runner)
+
+```js
+import { reapStaleTuiSessions, SESSION_PREFIX } from "./lib/tui/session.mjs";
+
+test("reaper kills ONLY ocp-tui- sessions, never olp-tui-", () => {
+  const killed = [];
+  const fakeTmux = (args) => {
+    if (args[0] === "list-sessions") return { status: 0, stdout: "ocp-tui-aaaa\nolp-tui-bbbb\nmisc\nocp-tui-cccc\n" };
+    if (args[0] === "kill-session") { killed.push(args[args.indexOf("-t") + 1]); return { status: 0 }; }
+    return { status: 0, stdout: "" };
+  };
+  const n = reapStaleTuiSessions({ tmux: fakeTmux });
+  assertEqual(SESSION_PREFIX, "ocp-tui-");
+  assertEqual(n, 2);
+  assertEqual(killed.join(","), "ocp-tui-aaaa,ocp-tui-cccc");
+});
+```
+
+- [ ] **Step 2: Run to verify it fails**
+
+Run: `node test-features.mjs 2>&1 | grep -i "reaper kills"`
+Expected: FAIL — module/export missing.
+
+- [ ] **Step 3: Minimal implementation**
+
+Create `lib/tui/session.mjs`:
+```js
+// TUI-mode session driver: hosts an interactive `claude` in tmux, submits one
+// serialized prompt, awaits the transcript reader, tears down. OCP-specific.
+//
+// Authority: claude CLI v2.1.158 interactive mode (no -p / no --output-format
+// => cc_entrypoint=cli). Submission recipe + dialog handling validated by spikes
+// T3/T6 on PI231. See docs/superpowers/specs/2026-05-30-tui-mode-production-design.md.
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, writeFileSync, mkdirSync, existsSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { randomUUID } from "node:crypto";
+import { transcriptPath, readTuiTranscript } from "./transcript.mjs";
+
+export const SESSION_PREFIX = "ocp-tui-"; // per-proxy namespace (coexistence rule)
+const TMUX = process.env.OCP_TUI_TMUX_BIN || "tmux";
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const defaultTmux = (args, opts = {}) => spawnSync(TMUX, args, { encoding: "utf8", ...opts });
+
+// Kill ONLY our own stale sessions. Scoped to SESSION_PREFIX so a co-hosted
+// OLP test instance's `olp-tui-*` sessions are never touched.
+export function reapStaleTuiSessions({ tmux = defaultTmux } = {}) {
+  const r = tmux(["list-sessions", "-F", "#{session_name}"]);
+  if (!r || r.status !== 0) return 0; // no tmux server / no sessions
+  let killed = 0;
+  for (const name of String(r.stdout || "").split("\n").map((s) => s.trim()).filter(Boolean)) {
+    if (name.startsWith(SESSION_PREFIX)) { tmux(["kill-session", "-t", name]); killed++; }
+  }
+  return killed;
+}
+```
+
+- [ ] **Step 4: Run to verify it passes**
+
+Run: `node test-features.mjs 2>&1 | grep -i "reaper kills"`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add lib/tui/session.mjs test-features.mjs
+git commit -m "feat(tui): prefix-scoped session reaper (ocp-tui-* only)"
+```
+
+### Task 5: `runTuiTurn` (boot → trust dialog → paste → Enter → read → teardown)
+
+**Files:**
+- Modify: `lib/tui/session.mjs`
+- Test: `test-features.mjs` (live-only, guarded by `OCP_TUI_LIVE=1`)
+
+- [ ] **Step 1: Write the live-only guarded test** (skipped in CI; run on PI231)
+
+```js
+// Live-only: requires an authenticated interactive `claude`. Skipped unless OCP_TUI_LIVE=1.
+if (process.env.OCP_TUI_LIVE === "1") {
+  test("runTuiTurn drives a real interactive turn and returns text", async () => {
+    const { runTuiTurn } = await import("./lib/tui/session.mjs");
+    const out = await runTuiTurn({
+      prompt: "Reply with exactly the word PONG and nothing else.",
+      model: "claude-haiku-4-5-20251001",
+      claudeBin: process.env.OCP_TUI_CLAUDE_BIN || "claude",
+      home: process.env.HOME,
+      cwd: `${process.env.HOME}/.ocp-tui/work`,
+      wallclockMs: 120000,
+    });
+    assert(/PONG/i.test(out), `expected PONG, got: ${out.slice(0, 200)}`);
+  });
+} else {
+  test("runTuiTurn (live) — SKIPPED (set OCP_TUI_LIVE=1 on PI231 to run)", () => { assert(true); });
+}
+```
+
+- [ ] **Step 2: Run to verify it fails** (on a box, with the flag)
+
+Run (PI231): `OCP_TUI_LIVE=1 node test-features.mjs 2>&1 | grep -i "runTuiTurn"`
+Expected: FAIL — `runTuiTurn` not exported yet.
+
+- [ ] **Step 3: Implementation** (append to `lib/tui/session.mjs`)
+
+```js
+// Boot wait + dialog timing. Conservative defaults validated on PI231; env-tunable.
+const BOOT_MS   = parseInt(process.env.OCP_TUI_BOOT_MS   || "3500", 10);
+const DIALOG_MS = parseInt(process.env.OCP_TUI_DIALOG_MS || "1200", 10);
+const PASTE_SETTLE_MS = parseInt(process.env.OCP_TUI_PASTE_MS || "1800", 10);
+
+const shq = (s) => `'${String(s).replace(/'/g, "'\\''")}'`; // single-quote for sh -c
+
+// Build interactive claude argv: NO -p, NO --output-format (=> cc_entrypoint=cli).
+// MCP hard-disabled: --strict-mcp-config (no --mcp-config) is the only mechanism
+// that stops account-attached managed MCP from connecting (spec §5.2 / T6),
+// belt-and-braces with --disallowedTools "mcp__*".
+function buildTuiCmd(claudeBin, model, sessionId) {
+  return [
+    shq(claudeBin),
+    "--model", shq(model),
+    "--session-id", sessionId,
+    "--strict-mcp-config",
+    "--disallowedTools", shq("mcp__*"),
+  ].join(" ");
+}
+
+export async function runTuiTurn({
+  prompt, model, claudeBin, home, cwd,
+  wallclockMs = 120000, tmux = defaultTmux,
+}) {
+  const sessionId = randomUUID();
+  const tmuxName = SESSION_PREFIX + sessionId.slice(0, 8);
+  if (!existsSync(cwd)) mkdirSync(cwd, { recursive: true });
+
+  const tmpDir = mkdtempSync(`${tmpdir()}/ocp-tui-`);
+  const promptFile = `${tmpDir}/prompt.txt`;
+  writeFileSync(promptFile, prompt, { mode: 0o600 });
+
+  const env = { ...process.env, CLAUDE_CODE_DISABLE_OFFICIAL_MARKETPLACE_AUTOINSTALL: "1" };
+  delete env.CLAUDECODE; delete env.ANTHROPIC_API_KEY; delete env.ANTHROPIC_BASE_URL; delete env.ANTHROPIC_AUTH_TOKEN;
+  if (home) env.HOME = home;
+
+  try {
+    // 1. Boot the interactive session inside tmux, in the dedicated scratch cwd.
+    tmux(["new-session", "-d", "-s", tmuxName, "-x", "220", "-y", "50", "-c", cwd,
+          buildTuiCmd(claudeBin, model, sessionId)], { env });
+    await sleep(BOOT_MS);
+
+    // 2. Answer the trust-folder dialog defensively. The seeded bypass flag (if any)
+    //    suppresses the *bypass-permissions* dialog but NOT the trust-folder dialog;
+    //    "1" = "Yes, proceed". Harmless if the dialog is absent (cwd already trusted).
+    tmux(["send-keys", "-t", tmuxName, "1"]);
+    tmux(["send-keys", "-t", tmuxName, "Enter"]);
+    await sleep(DIALOG_MS);
+
+    // 3. Submit the prompt. Body is pasted via `"$(cat file)"` so the content never
+    //    touches the command line (no shell injection from prompt text), then a
+    //    SEPARATE Enter key event submits it (Ink #15553: literal "\n" in a paste
+    //    does not submit; the Enter key event does).
+    spawnSync("sh", ["-c",
+      `${shq(TMUX)} send-keys -t ${shq(tmuxName)} -- "$(cat ${shq(promptFile)})"`],
+      { env, encoding: "utf8" });
+    await sleep(PASTE_SETTLE_MS);
+    tmux(["send-keys", "-t", tmuxName, "Enter"]);
+
+    // 4. Read the answer from the native transcript.
+    const tpath = transcriptPath(home || process.env.HOME, cwd, sessionId);
+    return await readTuiTranscript({ transcriptPath: tpath, wallclockMs });
+  } finally {
+    // 5. Teardown — always. Kill the session, remove the temp prompt dir.
+    try { tmux(["kill-session", "-t", tmuxName]); } catch { /* already gone */ }
+    try { rmSync(tmpDir, { recursive: true, force: true }); } catch { /* best effort */ }
+  }
+}
+```
+
+- [ ] **Step 4: Run to verify it passes** (PI231, live)
+
+Run (PI231): `OCP_TUI_LIVE=1 node test-features.mjs 2>&1 | grep -i "runTuiTurn"`
+Expected: PASS — output contains `PONG`. Also confirm no orphan sessions: `tmux ls 2>/dev/null | grep ocp-tui- || echo "clean"` → `clean`.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add lib/tui/session.mjs test-features.mjs
+git commit -m "feat(tui): runTuiTurn — interactive session driver (boot/trust/paste/Enter/read/teardown)"
+```
+
+---
+
+## PR-3 — Wiring into `server.mjs`
+
+Gate TUI-mode behind one env flag. Default path (`CLAUDE_TUI_MODE` unset) stays byte-for-byte identical.
+
+### Task 6: env consts + `streamStringAsSSE` DRY refactor
+
+**Files:**
+- Modify: `server.mjs` (env consts near `:275`; refactor cache-replay block `:1524`–`:1539` into a helper near `:1023`)
+
+- [ ] **Step 1: Add TUI env consts + import** (near the other `const ... = process.env...` at `server.mjs:258`–`:275`)
+
+```js
+import { runTuiTurn, reapStaleTuiSessions } from "./lib/tui/session.mjs";
+
+// TUI-mode (subscription-pool bridge). Opt-in; default OFF keeps stream-json path.
+// Authority: docs/adr/0007-tui-interactive-mode.md.
+const TUI_MODE = process.env.CLAUDE_TUI_MODE === "true";
+const TUI_WALLCLOCK_MS = parseInt(process.env.CLAUDE_TUI_WALLCLOCK_MS || "120000", 10);
+const TUI_CWD = process.env.OCP_TUI_CWD || `${process.env.HOME}/.ocp-tui/work`;
+```
+
+- [ ] **Step 2: Extract the chunked-SSE-replay into a reusable helper** (near `completionResponse` at `:1023`)
+
+```js
+// Replay a complete string as a chunked SSE stream (80 codepoints/chunk).
+// Extracted from the cache-hit replay block so TUI-mode streaming reuses it.
+function streamStringAsSSE(res, id, model, content) {
+  const created = Math.floor(Date.now() / 1000);
+  res.writeHead(200, { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", "Connection": "keep-alive", "X-Accel-Buffering": "no" });
+  sendSSE(res, { id, object: "chat.completion.chunk", created, model, choices: [{ index: 0, delta: { role: "assistant" }, finish_reason: null }] });
+  const CHUNK = 80;
+  const codepoints = Array.from(content);
+  for (let i = 0; i < codepoints.length; i += CHUNK) {
+    sendSSE(res, { id, object: "chat.completion.chunk", created, model, choices: [{ index: 0, delta: { content: codepoints.slice(i, i + CHUNK).join("") }, finish_reason: null }] });
+  }
+  sendSSE(res, { id, object: "chat.completion.chunk", created, model, choices: [{ index: 0, delta: {}, finish_reason: "stop" }] });
+  res.write("data: [DONE]\n\n");
+  res.end();
+}
+```
+
+- [ ] **Step 3: Point the cache-hit streaming replay (`:1524`–`:1539`) at the helper** (DRY — behavior identical)
+
+Replace the inline block inside `if (stream) { ... }` of the cache hit with:
+```js
+          if (stream) {
+            const id = `chatcmpl-${randomUUID()}`;
+            streamStringAsSSE(res, id, model, cached.response);
+            return;
+          } else {
+```
+
+- [ ] **Step 4: Run the full suite to verify no regression**
+
+Run: `node test-features.mjs 2>&1 | tail -3`
+Expected: all existing tests PASS (the refactor is behavior-preserving; cache-replay covered by existing D3 tests).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add server.mjs
+git commit -m "refactor(server): extract streamStringAsSSE helper + add TUI env consts"
+```
+
+### Task 7: `callClaudeTui` + dispatch gates
+
+**Files:**
+- Modify: `server.mjs` (new `callClaudeTui` near `callClaude:735`; gates at the buffered dispatch `:1563`/`:1594` and streaming dispatch `:1551`)
+
+- [ ] **Step 1: Add `callClaudeTui`** (near `callClaude`, after `:800`)
+
+```js
+// TUI-mode upstream: drive an interactive claude session, return the assistant
+// text as a string — same contract as callClaude(), so all downstream
+// (singleflight, cache write-back, completionResponse) is unchanged.
+// System messages are rendered inline as [System] blocks by messagesToPrompt;
+// we deliberately do NOT pass --system-prompt in interactive mode to avoid any
+// flag that could perturb cc_entrypoint classification.
+function callClaudeTui(model, messages, conversationId, keyName) {
+  const cliModel = MODEL_MAP[model] || model;
+  const prompt = messagesToPrompt(messages); // includes system as [System] inline
+  recordModelRequest(cliModel, prompt.length);
+  return runTuiTurn({
+    prompt, model: cliModel, claudeBin: CLAUDE,
+    home: process.env.HOME, cwd: TUI_CWD, wallclockMs: TUI_WALLCLOCK_MS,
+  }).then((text) => {
+    recordModelSuccess(cliModel, 0);
+    return text;
+  }).catch((err) => {
+    recordModelError(cliModel, false);
+    throw err;
+  });
+}
+```
+
+- [ ] **Step 2: Gate the buffered dispatch** — at `server.mjs:1563`–`:1597`, replace the two `callClaude(...)` call sites (inside the singleflight closure and the cache-disabled fallback) with a selected upstream:
+
+Add once, just before the `if (CACHE_TTL > 0 && req._cacheHash)` block (~`:1563`):
+```js
+  const upstreamCall = TUI_MODE ? callClaudeTui : callClaude;
+```
+Then change `await callClaude(model, messages, conversationId, req._authKeyName)` → `await upstreamCall(model, messages, conversationId, req._authKeyName)` at **both** sites (`:1572` and `:1594`).
+
+- [ ] **Step 3: Gate the streaming dispatch** — at `server.mjs:1551`–`:1553`, branch TUI streaming to buffer-then-replay:
+
+```js
+  if (stream) {
+    if (TUI_MODE) {
+      // TUI has no token stream; buffer the turn, write-back to cache, replay as chunked SSE.
+      const t0Usage = Date.now();
+      try {
+        const content = await callClaudeTui(model, messages, conversationId, req._authKeyName);
+        if (CACHE_TTL > 0 && req._cacheHash) {
+          try { setCachedResponse(req._cacheHash, model, content); } catch (e) { logEvent("error", "cache_write_failed", { error: e.message }); }
+        }
+        const id = `chatcmpl-${randomUUID()}`;
+        streamStringAsSSE(res, id, model, content);
+        try { recordUsage({ keyId: req._authKeyId, keyName: req._authKeyName, model, promptChars: messages.reduce((a, m) => a + (typeof m.content === "string" ? m.content.length : JSON.stringify(m.content).length), 0), responseChars: content.length, elapsedMs: Date.now() - t0Usage, success: true }); } catch {}
+        return;
+      } catch (err) {
+        if (res.headersSent || res.writableEnded || res.destroyed) { try { res.end(); } catch {}; return; }
+        const safeMessage = (err.message || "Internal error").replace(/\/[\w/.\-]+/g, "[path]");
+        return jsonResponse(res, 500, { error: { message: safeMessage, type: "proxy_error" } });
+      }
+    }
+    // Default: real stream-json streaming, unchanged.
+    return callClaudeStreaming(model, messages, conversationId, res, { keyId: req._authKeyId, keyName: req._authKeyName, cacheHash: req._cacheHash });
+  }
+```
+
+- [ ] **Step 4: Verify default path is untouched + TUI path selected only by flag**
+
+Run: `CLAUDE_TUI_MODE=  node -e "process.env.CLAUDE_TUI_MODE; import('./server.mjs')" 2>&1 | head -1 || true`
+Then the regression suite: `node test-features.mjs 2>&1 | tail -3`
+Expected: all PASS (no test sets `CLAUDE_TUI_MODE`, so `upstreamCall === callClaude` and streaming uses `callClaudeStreaming` — identical to today).
+
+Live end-to-end (PI231, after Task 8 setup): with `CLAUDE_TUI_MODE=true` start OCP and `curl` both `stream:false` and `stream:true`:
+```bash
+curl -s localhost:3456/v1/chat/completions -H "Authorization: Bearer <key>" \
+  -d '{"model":"claude-haiku-4-5-20251001","messages":[{"role":"user","content":"say PONG"}]}' | head
+```
+Expected: a normal OpenAI completion whose content contains `PONG`. Cross-check on PI231 that the spawned `claude` had no `-p`/`--output-format` (`ps -ef | grep claude`).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add server.mjs
+git commit -m "feat(tui): gate interactive TUI upstream behind CLAUDE_TUI_MODE (buffered + streaming)"
+```
+
+### Task 8: reaper hook at boot + ADR + README + CHANGELOG
+
+**Files:**
+- Modify: `server.mjs` (boot block — call `reapStaleTuiSessions()` once on startup when `TUI_MODE`)
+- Create: `docs/adr/0007-tui-interactive-mode.md`
+- Modify: `README.md`, `CHANGELOG.md`
+
+- [ ] **Step 1: Reaper on boot** (in the server start/`listen` block)
+
+```js
+  if (TUI_MODE) {
+    try { const n = reapStaleTuiSessions(); if (n) logEvent("info", "tui_reaped_stale_sessions", { count: n }); } catch {}
+    console.log(`  TUI-mode: ON (interactive claude → cc_entrypoint=cli). cwd=${TUI_CWD} wallclock=${TUI_WALLCLOCK_MS}ms`);
+  }
+```
+
+- [ ] **Step 2: Write ADR 0007** — `docs/adr/0007-tui-interactive-mode.md`
+
+Context: 2026-06-15 billing split routes by `cc_entrypoint`; `-p`/`--output-format` ⇒ `sdk-cli` (Agent SDK credit pool, ~$20 on Pro = unusable). Decision: opt-in interactive driver ⇒ `cli` (subscription pool). Authority: spec §1/§4, claude v2.1.158. Scope: A-path single-user; MCP hard-disabled via `--strict-mcp-config`. Kill-switch: unset `CLAUDE_TUI_MODE` → stream-json path restored. Consequences: no token streaming (buffered+replayed); grey-area, billing unmeasurable until 6/15; reaper + tmux-prefix coexistence rules.
+
+- [ ] **Step 3: README** — add `CLAUDE_TUI_MODE`, `CLAUDE_TUI_WALLCLOCK_MS`, `OCP_TUI_CWD` to the env-var table; add a "Subscription-pool (TUI) mode" section (what it is, opt-in, the 6/15 rationale, no-streaming caveat, the one-time `mkdir -p ~/.ocp-tui/work` + tmux dependency, and the `CLAUDE_TUI_MODE` unset kill-switch).
+
+- [ ] **Step 4: CHANGELOG** — Unreleased: `feat(tui): opt-in CLAUDE_TUI_MODE — serve via interactive claude (cc_entrypoint=cli / subscription pool); default stream-json path unchanged.`
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add server.mjs docs/adr/0007-tui-interactive-mode.md README.md CHANGELOG.md
+git commit -m "feat(tui): boot reaper + ADR 0007 + README + CHANGELOG (TUI-mode docs)"
+```
+
+---
+
+## Integration & canary (post-implementation, on PI231)
+
+1. Stop the OLP test instance (`:4567`) — clean shared OAuth + no tmux collision.
+2. `git clone`/checkout this branch on PI231, `mkdir -p ~/.ocp-tui/work`, start OCP on `:3456` with `CLAUDE_TUI_MODE=true`.
+3. Run the live driver suite: `OCP_TUI_LIVE=1 node test-features.mjs`.
+4. End-to-end `curl` (buffered + streaming) through OCP; confirm spawned `claude` carries no `-p`/`--output-format`.
+5. **Pre-6/15 deliverable = here.** Billing measurement waits for 6/15; document the kill-switch (unset `CLAUDE_TUI_MODE`).
+
+---
+
+## Self-Review (against spec + the OCP-first execution review)
+
+- **Spec coverage:** transcript path formula (§4 → Task 1), parsing/terminal/extract (§4 → Task 2), polling reader + wall-clock cap + no-quiescence (§4.3 → Task 3), submission recipe file→paste→Enter (§5/T3 → Task 5), trust-dialog handling (§5.2 → Task 5), MCP disable `--strict-mcp-config` (§5.2/T6 → Tasks 5 & buildTuiCmd), string-contract drop-in (→ Tasks 6–7), kill-switch + default-path-sacred (→ Task 7 Step 4), coexistence prefix + reaper (→ Tasks 4 & 8). ✅
+- **Review findings folded:** OCP-first string match (Task 7); no ephemeral-home, real-home + scratch cwd (scope §); reader-only sharing, driver forked (file table); tmux prefix + scoped reaper + never-both-on-OAuth (Task 4, Integration §1); `TIMEOUT=600000 > 120s` cap verified (no SIGKILL-mid-turn); `--strict-mcp-config` added (Task 5); provenance jaekwon-park (Why §). OLP-sync deferred. ✅
+- **Placeholder scan:** none — every code step carries real code; every run step an exact command + expected output. ✅
+- **Type consistency:** `runTuiTurn`/`reapStaleTuiSessions`/`SESSION_PREFIX` exported in Task 4–5 match imports in Task 6–8; `streamStringAsSSE(res, id, model, content)` defined Task 6, used Tasks 6–7; `callClaudeTui(model, messages, conversationId, keyName)` mirrors `callClaude`'s signature. ✅
+- **Open item for integration:** confirm on PI231 that the seeded `~/.claude.json` is unnecessary for real-home A (onboarding already complete); if a bypass-permissions dialog *does* appear in real home, add a one-line seed step (`bypassPermissionsModeAccepted:true`) — but the driver already answers the trust dialog defensively, so the turn still completes.

lib/constants.mjs

@@ -0,0 +1,33 @@
+/**
+ * OCP shared constants — single source of truth.
+ *
+ * Any literal that appears in more than one place across server.mjs, setup.mjs,
+ * scripts/* belongs here so port-drift / URL-drift cascades cannot recur.
+ *
+ * Background: from 2026-05-08 (PR #71 dogfood accident) through 2026-05-13
+ * (v3.16.3) a single hardcoded "3478" in scripts/upgrade.mjs + scripts/doctor.mjs
+ * cascaded into every downstream config write, ultimately taking out the
+ * OpenClaw "大内总管" Telegram agent. See CHANGELOG v3.16.2 and v3.16.3.
+ *
+ * Adding a new constant: prefer ALL_CAPS_SNAKE_CASE. Document the consumers.
+ * If a literal is referenced from a shell script (ocp, ocp-connect, setup.sh)
+ * that can't import .mjs, add a `// keep in sync with lib/constants.mjs` note
+ * at the shell-script reference; CI grep prevents drift.
+ */
+
+// Default TCP port the OCP HTTP proxy listens on. Set by env CLAUDE_PROXY_PORT
+// at runtime; this is the fallback when env is unset.
+// Consumers: server.mjs, setup.mjs, scripts/upgrade.mjs, scripts/doctor.mjs,
+// scripts/sync-openclaw.mjs. Shell scripts ocp / ocp-connect keep the literal
+// "3456" in sync with this value (see CI gate in .github/workflows/alignment.yml).
+export const DEFAULT_PORT = 3456;
+
+// Localhost bind for client-side fetches (curl, health checks).
+export const LOCAL_HOST = "127.0.0.1";
+
+// OpenAI-compatible API base path appended to the proxy URL.
+export const OPENAI_API_BASE = "/v1";
+
+// Convenience: full local URL the OCP proxy listens on by default.
+// scripts that want to probe locally can use this directly.
+export const LOCAL_PROXY_URL = `http://${LOCAL_HOST}:${DEFAULT_PORT}`;

lib/tui/session.mjs

@@ -0,0 +1,247 @@
+// TUI-mode session driver: hosts an interactive `claude` in tmux, submits one
+// serialized prompt, awaits the transcript reader, tears down. OCP-specific.
+//
+// Authority: claude CLI v2.1.158 interactive mode (no -p / no --output-format
+// => cc_entrypoint=cli). Submission recipe validated by spikes T3/T6 on PI231.
+// See docs/superpowers/specs/2026-05-30-tui-mode-production-design.md.
+//
+// Trust handling: rather than answer the trust-folder dialog interactively (which
+// only appears on a cwd's FIRST encounter — sending a defensive "1" to an already
+// trusted cwd would inject a stray prompt turn), we PRE-TRUST the scratch cwd by
+// seeding <home>/.claude.json. Every turn then boots dialog-free and identical.
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, writeFileSync, readFileSync, mkdirSync, existsSync, rmSync, statSync, renameSync, symlinkSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { randomUUID } from "node:crypto";
+import { readTuiTranscript } from "./transcript.mjs";
+
+export const SESSION_PREFIX = "ocp-tui-"; // per-proxy namespace (coexistence rule)
+const TMUX = process.env.OCP_TUI_TMUX_BIN || "tmux";
+
+const defaultTmux = (args, opts = {}) =>
+  spawnSync(TMUX, args, { encoding: "utf8", ...opts });
+
+// Kill ONLY our own stale sessions. Scoped to SESSION_PREFIX so a co-hosted
+// OLP test instance's `olp-tui-*` sessions are never touched.
+export function reapStaleTuiSessions({ tmux = defaultTmux } = {}) {
+  const r = tmux(["list-sessions", "-F", "#{session_name}"]);
+  if (!r || r.status !== 0) return 0; // no tmux server / no sessions
+  let killed = 0;
+  for (const name of String(r.stdout || "").split("\n").map((s) => s.trim()).filter(Boolean)) {
+    if (name.startsWith(SESSION_PREFIX)) {
+      tmux(["kill-session", "-t", name]);
+      killed++;
+    }
+  }
+  return killed;
+}
+
+// ── Task 5: runTuiTurn ───────────────────────────────────────────────────
+
+// Boot + paste-settle timing. Conservative defaults validated on PI231; env-tunable.
+const BOOT_MS         = parseInt(process.env.OCP_TUI_BOOT_MS  || "4000", 10);
+const PASTE_SETTLE_MS = parseInt(process.env.OCP_TUI_PASTE_MS || "1800", 10);
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// Single-quote escaper for sh -c arguments.
+function shq(s) {
+  return `'${String(s).replace(/'/g, "'\\''")}'`;
+}
+
+// Pre-trust the scratch cwd by seeding the trust record in <home>/.claude.json so
+// the trust-folder dialog never appears. Verified-live trust shape:
+//   projects["<cwd>"] = { hasTrustDialogAccepted: true, allowedTools: [], ... }
+// Idempotent + best-effort: a missing/unreadable .claude.json must not abort a
+// turn (a fresh cwd would then show the dialog once; the boot wait tolerates it).
+// Must run BEFORE the session boots so claude reads the trusted record at startup.
+export function ensureTuiCwdTrusted(home, cwd) {
+  if (!home || !cwd) return;
+  const path = `${home}/.claude.json`;
+  let j, mode;
+  try {
+    j = JSON.parse(readFileSync(path, "utf8"));
+    mode = statSync(path).mode & 0o777;
+  } catch { return; }
+  j.projects = j.projects || {};
+  const entry = j.projects[cwd] || {};
+  if (entry.hasTrustDialogAccepted === true) return; // already trusted, no rewrite
+  entry.hasTrustDialogAccepted = true;
+  if (!Array.isArray(entry.allowedTools)) entry.allowedTools = [];
+  j.projects[cwd] = entry;
+  // Atomic write (temp + rename on the same fs), preserving mode, so a crash
+  // mid-write can never truncate the user's real ~/.claude.json. We seed ONLY the
+  // per-project trust flag — NOT bypassPermissionsModeAccepted: the driver never
+  // passes --dangerously-skip-permissions, so the bypass dialog cannot appear, and
+  // onboarding completion is an A-path precondition (the host already runs claude).
+  // NOTE: when the A-path moves to a dedicated scratch HOME (task #26), this writes
+  // a file we fully own, removing the real-config-mutation concern entirely.
+  try {
+    const tmp = `${path}.ocp-tui.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(j, null, 2), { mode });
+    renameSync(tmp, path);
+  } catch { /* best effort */ }
+}
+
+// Prepare the HOME claude runs under. Two modes:
+//   - real-home (tuiHome === realHome OR falsy): no isolation; just trust the cwd
+//     in the real ~/.claude.json. Opt in by setting OCP_TUI_HOME=$HOME.
+//   - scratch-home: a dedicated HOME that reuses the real OAuth via a SYMLINKED
+//     .credentials.json, with a seeded .claude.json (onboarded real config minus
+//     the user's project history; trusts only the scratch cwd) and its own
+//     projects/ dir — so the real ~/.claude is never mutated or polluted.
+//
+// ⚠️ CREDENTIAL CAVEAT (verified live): claude rewrites .credentials.json on token
+// refresh, REPLACING the symlink with a regular-file copy → the scratch home then
+// FORKS the OAuth credentials. Because OAuth refresh tokens rotate (single-use), a
+// refresh in the scratch home can invalidate the token the user's real-home claude
+// relies on. Therefore scratch-home is safe only with a DEDICATED OAuth or for
+// ephemeral use; for a shared subscription prefer real-home (tuiHome===realHome),
+// which shares one .credentials.json — identical to how OCP already spawns claude.
+// Idempotent + best-effort: any failure degrades toward the dialog/cap, never
+// corrupts. Run BEFORE the session boots.
+export function prepareTuiHome(realHome, tuiHome, cwd) {
+  if (!tuiHome || tuiHome === realHome) { ensureTuiCwdTrusted(realHome, cwd); return; }
+  try {
+    const claudeDir = `${tuiHome}/.claude`;
+    mkdirSync(`${claudeDir}/projects`, { recursive: true });
+    // Symlink the real credentials (never copy the OAuth token); refresh if missing.
+    const link = `${claudeDir}/.credentials.json`;
+    if (!existsSync(link)) {
+      try { symlinkSync(`${realHome}/.claude/.credentials.json`, link); } catch { /* best effort */ }
+    }
+    // Seed .claude.json ONCE (if absent): start from the onboarded real config,
+    // drop the user's project history, trust only the scratch cwd. mode 0600.
+    const seedPath = `${tuiHome}/.claude.json`;
+    if (!existsSync(seedPath)) {
+      let base = {};
+      try { base = JSON.parse(readFileSync(`${realHome}/.claude.json`, "utf8")); } catch { /* fresh */ }
+      base.hasCompletedOnboarding = true;
+      base.projects = { [cwd]: { hasTrustDialogAccepted: true, allowedTools: [] } };
+      writeFileSync(seedPath, JSON.stringify(base, null, 2), { mode: 0o600 });
+    }
+  } catch { /* best effort */ }
+  // Ensure the cwd is trusted in the scratch config (idempotent; atomic).
+  ensureTuiCwdTrusted(tuiHome, cwd);
+}
+
+// ── Billing-classifier labeling ─────────────────────────────────────────
+// Resolve CLAUDE_CODE_ENTRYPOINT on the spawn env per mode. ALWAYS deletes any
+// inherited value first (so a stray entrypoint from OCP's own parent env can never
+// leak into / mislabel the billing header). Then:
+//   "cli"  (default) → set "cli": deterministic subscription-pool classification.
+//          HONEST ONLY because OCP's spawn is a genuine interactive PTY (tmux pane,
+//          no -p, stdout not redirected). Never set "cli" on a non-interactive spawn.
+//   "auto" → leave unset → claude self-classifies via its t$A (TTY → cli). Use to
+//          observe/diagnose the real TTY-derived value.
+//   "off"  → leave the env exactly as inherited (diagnostics / honesty audit).
+export function resolveTuiEntrypointEnv(env, mode = "cli") {
+  if (mode === "off") return env;
+  delete env.CLAUDE_CODE_ENTRYPOINT;
+  if (mode === "cli") env.CLAUDE_CODE_ENTRYPOINT = "cli";
+  return env;
+}
+
+// Build interactive claude argv: NO -p, NO --output-format (=> cc_entrypoint=cli).
+// MCP hard-disabled: --strict-mcp-config (no --mcp-config) is the only mechanism
+// that stops account-attached managed MCP from connecting (spec §5.2 / T6),
+// belt-and-braces with --disallowedTools "mcp__*".
+// A-PATH ONLY: built-in tools are left enabled (acceptable single-user). Deployment B
+// (guest keys) MUST additionally pass --tools "" per spec §5.2(2) as the credential
+// wall before this argv is reachable for owner_tier=guest — guard that in PR-3 wiring.
+function buildTuiCmd(claudeBin, model, sessionId) {
+  return [
+    shq(claudeBin),
+    "--model",          shq(model),
+    "--session-id",     sessionId,
+    "--strict-mcp-config",
+    "--disallowedTools", shq("mcp__*"),
+  ].join(" ");
+}
+
+// Full per-request TUI lifecycle:
+//   1. Pre-trust the scratch cwd (no trust dialog will appear).
+//   2. Write prompt to a 0600 temp file (no shell injection from prompt content).
+//   3. Boot an interactive `claude` in a fresh tmux session in the scratch cwd.
+//   4. Submit the prompt via `send-keys -- "$(cat file)"` + a SEPARATE Enter key
+//      event (spec §5 / T3: literal "\n" in paste does NOT submit; Enter token does).
+//   5. Block on the native JSONL transcript (located by session-id) until terminal
+//      marker or wall-clock cap.
+//   6. Always teardown: kill session + rm temp dir (even on throw).
+export async function runTuiTurn({
+  prompt,
+  model,
+  claudeBin,
+  home,
+  realHome,
+  cwd,
+  wallclockMs = 120000,
+  entrypointMode = "cli",
+  tmux = defaultTmux,
+}) {
+  const sessionId = randomUUID();
+  const tmuxName  = SESSION_PREFIX + sessionId.slice(0, 8);
+  const ehome     = home || process.env.HOME;       // HOME claude runs under (scratch or real)
+  const rhome     = realHome || process.env.HOME;   // real home (OAuth + onboarded config source)
+
+  // Ensure scratch cwd exists, then prepare the (scratch or real) HOME + trust the
+  // cwd — before claude boots.
+  if (!existsSync(cwd)) mkdirSync(cwd, { recursive: true });
+  prepareTuiHome(rhome, ehome, cwd);
+
+  // Write prompt to a temp file (mode 0600) so the content never touches argv.
+  const tmpDir     = mkdtempSync(`${tmpdir()}/ocp-tui-`);
+  const promptFile = `${tmpDir}/prompt.txt`;
+  writeFileSync(promptFile, prompt, { mode: 0o600 });
+
+  // Build the env: disable marketplace auto-install, strip any Anthropic / CC
+  // env vars that might interfere with interactive-mode classification.
+  const env = { ...process.env, CLAUDE_CODE_DISABLE_OFFICIAL_MARKETPLACE_AUTOINSTALL: "1" };
+  delete env.CLAUDECODE;
+  delete env.ANTHROPIC_API_KEY;
+  delete env.ANTHROPIC_BASE_URL;
+  delete env.ANTHROPIC_AUTH_TOKEN;
+  env.HOME = ehome; // claude reads credentials + writes the transcript under this HOME
+  resolveTuiEntrypointEnv(env, entrypointMode);
+
+  try {
+    // 1. Boot the interactive session inside tmux, rooted at the scratch cwd.
+    //    Capture the result: if tmux new-session fails (status !== 0) there is no
+    //    PTY, no interactive spawn — abort BEFORE the boot sleep rather than paste
+    //    into a non-existent session or issue a billing request without a verified
+    //    interactive context. The finally teardown is still harmless (kill-session
+    //    is a no-op when the session never existed).
+    const spawnResult = tmux(
+      ["new-session", "-d", "-s", tmuxName, "-x", "220", "-y", "50", "-c", cwd,
+       buildTuiCmd(claudeBin, model, sessionId)],
+      { env },
+    );
+    if (!spawnResult || spawnResult.status !== 0) {
+      throw new Error("tui_spawn_failed: tmux session not created");
+    }
+    await sleep(BOOT_MS);
+
+    // 2. Submit prompt body via `"$(cat file)"` — byte-safe for any content —
+    //    then settle, then send a SEPARATE Enter key event to submit the line.
+    //
+    //    The `-l` (literal) flag is required on the paste send-keys call so that
+    //    a prompt that happens to equal a tmux key token (e.g. "C-c", "Escape")
+    //    is typed literally as text rather than being interpreted as a key binding.
+    //    The SEPARATE Enter event below deliberately omits -l so that tmux sends a
+    //    real keypress (carriage return) to submit the prompt line.
+    spawnSync(
+      "sh",
+      ["-c", `${shq(TMUX)} send-keys -t ${shq(tmuxName)} -l -- "$(cat ${shq(promptFile)})"`],
+      { env, encoding: "utf8" },
+    );
+    await sleep(PASTE_SETTLE_MS);
+    tmux(["send-keys", "-t", tmuxName, "Enter"]);
+
+    // 3. Block on the native transcript (resolved by session-id) until terminal.
+    return await readTuiTranscript({ home: ehome, sessionId, wallclockMs });
+  } finally {
+    // 4. Teardown — always, even on throw.
+    try { tmux(["kill-session", "-t", tmuxName]); } catch { /* already gone */ }
+    try { rmSync(tmpDir, { recursive: true, force: true }); } catch { /* best effort */ }
+  }
+}

lib/tui/transcript.mjs

@@ -0,0 +1,129 @@
+// Transcript reader for TUI-mode. Reads claude's native JSONL session transcript
+// and returns the latest assistant turn's text once the turn is terminal.
+//
+// Authority: claude CLI v2.1.157 — interactive session transcript at
+//   <HOME>/.claude/projects/<CWD with every "/" -> "-">/<--session-id>.jsonl
+// Completion marker: a line {"type":"system","subtype":"turn_duration",...}.
+// See docs/superpowers/specs/2026-05-30-tui-mode-production-design.md §4.
+import { readFileSync, existsSync, readdirSync } from "node:fs";
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// Project-dir encoding: claude replaces every "/" AND every "." with "-".
+// Verified live (claude v2.1.158): cwd /home/u/.ocp-tui/work is stored under
+// projects/-home-u--ocp-tui-work/ (the "." in ".ocp-tui" becomes "-", yielding
+// the double dash). The earlier "/"-only rule was wrong for dotted paths; the
+// fixture cwd /tmp/tui-test happened to have no dots so it never surfaced.
+// NOTE: prefer findTranscriptPath() (glob by session-id) for resolution — it is
+// immune to the exact encoding rule. This helper is kept for the known-path case.
+export function encodeCwd(cwd) {
+  return cwd.replace(/[/.]/g, "-");
+}
+
+export function transcriptPath(home, cwd, sessionId) {
+  return `${home}/.claude/projects/${encodeCwd(cwd)}/${sessionId}.jsonl`;
+}
+
+// Locate a session's transcript by its UUID across every projects subdir, without
+// reconstructing the encoded cwd. Robust to whatever encoding claude applies.
+// Returns the path, or null if not present yet (it appears once the turn starts).
+export function findTranscriptPath(home, sessionId) {
+  if (!home || !sessionId) return null;
+  const root = `${home}/.claude/projects`;
+  let dirs;
+  try { dirs = readdirSync(root); } catch { return null; }
+  for (const d of dirs) {
+    const candidate = `${root}/${d}/${sessionId}.jsonl`;
+    if (existsSync(candidate)) return candidate;
+  }
+  return null;
+}
+
+// Parse NDJSON text into objects; skip blank lines and partial/forming lines
+// (the live transcript is read mid-write, so the last line may be incomplete).
+export function parseTranscriptLines(text) {
+  const out = [];
+  for (const line of text.split("\n")) {
+    const t = line.trim();
+    if (!t) continue;
+    try { out.push(JSON.parse(t)); } catch { /* partial line being written */ }
+  }
+  return out;
+}
+
+// A line marks the assistant turn complete when it is the turn_duration system
+// event. That is the ONLY reliable terminal marker in interactive TUI mode.
+//
+// Why tool_use is NOT a terminal marker:
+//   In interactive claude, when the model decides to call a tool (stop_reason=
+//   "tool_use"), claude handles the tool call internally and then continues
+//   generating — the turn is NOT complete. The transcript advances to another
+//   assistant entry after the tool result. Only {type:"system",
+//   subtype:"turn_duration"} signals that claude has fully finished the turn.
+//   Treating tool_use as terminal would truncate tool-using turns mid-flight.
+export function isTerminalLine(obj) {
+  if (!obj || typeof obj !== "object") return false;
+  return obj.type === "system" && obj.subtype === "turn_duration";
+}
+
+// Text of the LAST assistant turn: concatenate its text content blocks
+// (ignore thinking/tool_use blocks). Later assistant entries overwrite earlier.
+// Fixture-confirmed shape: top-level type:"assistant", message.content[] array.
+//
+// Scoping: this returns the FINAL text-bearing assistant entry in the whole file,
+// not "text since the matching user line" (spec §4.2). Those are equivalent ONLY
+// under OCP's one-session-per-request model (a fresh --session-id => a fresh
+// transcript holding one logical exchange). If a future warm-pool ever reuses a
+// session WITHOUT a fresh session-id / clear, earlier-turn text could leak — that
+// author must add user-line scoping here. See spec §7.2.
+export function extractLatestAssistantText(events) {
+  let text = "";
+  for (const ev of events) {
+    if (!ev || ev.type !== "assistant") continue;
+    const content = ev.message && ev.message.content;
+    if (!Array.isArray(content)) continue;
+    const parts = content
+      .filter((b) => b && b.type === "text" && typeof b.text === "string")
+      .map((b) => b.text);
+    if (parts.length) text = parts.join("");
+  }
+  return text;
+}
+
+// Returns the entrypoint string from the turn_duration line (e.g. "cli"),
+// or null if absent. Lets callers assert the subscription-classified path.
+// Fixture-confirmed: entrypoint field lives directly on the turn_duration line.
+export function verifyEntrypoint(events) {
+  for (const ev of events) {
+    if (ev && ev.type === "system" && ev.subtype === "turn_duration") {
+      return ev.entrypoint != null ? ev.entrypoint : null;
+    }
+  }
+  return null;
+}
+
+// Block until the session transcript is terminal (turn_duration) or
+// the wall-clock cap elapses, polling the file (no fs.watch — robust over NFS /
+// editors). Returns the latest assistant text. On cap with text, returns the
+// partial text; on cap with no text at all, throws.
+//
+// No quiescence heuristic by design: a long Opus thinking turn stalls transcript
+// growth and a "file stable for N s" rule would false-abort it (spec §4.3).
+// Resolution: pass an explicit `transcriptPath` (used by unit tests), OR pass
+// `home` + `sessionId` to resolve by glob each poll (production) — the transcript
+// file does not exist until the turn starts, so resolution happens inside the loop.
+export async function readTuiTranscript({ transcriptPath: p, home, sessionId, wallclockMs = 120000, pollMs = 250 }) {
+  const deadline = Date.now() + wallclockMs;
+  let lastText = "";
+  while (Date.now() < deadline) {
+    const resolved = p || findTranscriptPath(home, sessionId);
+    if (resolved && existsSync(resolved)) {
+      const events = parseTranscriptLines(readFileSync(resolved, "utf8"));
+      lastText = extractLatestAssistantText(events) || lastText;
+      if (events.some(isTerminalLine)) return lastText;
+    }
+    await sleep(pollMs);
+  }
+  if (lastText) return lastText;
+  throw new Error("tui_transcript_timeout: no assistant text within wallclock cap");
+}

models.json

@@ -2,6 +2,14 @@
   "$schema": "./models.schema.json",
   "version": 1,
   "models": [
+    {
+      "id": "claude-opus-4-8",
+      "displayName": "Claude Opus 4.8",
+      "openclawName": "Claude Opus 4.8 (via CLI)",
+      "reasoning": true,
+      "contextWindow": 200000,
+      "maxTokens": 16384
+    },
     {
       "id": "claude-opus-4-7",
       "displayName": "Claude Opus 4.7",
@@ -36,7 +44,7 @@
     }
   ],
   "aliases": {
-    "opus": "claude-opus-4-7",
+    "opus": "claude-opus-4-8",
     "sonnet": "claude-sonnet-4-6",
     "haiku": "claude-haiku-4-5-20251001"
   },

ocp

@@ -709,6 +709,8 @@ Usage:
   ocp update --rollback --list        List available snapshots
   ocp update --rollback <path>        Restore a specific snapshot
   ocp update --rollback --dry-run     Preview rollback plan
+  ocp update --rollback --gc          Delete old snapshots (keep last 5, or <30 days)
+  ocp update --rollback --gc --dry-run    Preview what would be deleted
 EOF
 }
 

ocp-plugin/index.js

@@ -1,9 +1,19 @@
 /**
  * OCP Plugin — registers /ocp as a native slash command in OpenClaw gateway.
- * Calls the local claude-proxy at http://127.0.0.1:3456 and formats the response.
+ * Calls the local claude-proxy and formats the response.
+ *
+ * Port resolution (in priority order):
+ *   1. OCP_PROXY_URL env (full URL, e.g. http://10.0.0.5:3456)
+ *   2. CLAUDE_PROXY_PORT env (port only; localhost assumed)
+ *   3. Fallback: http://127.0.0.1:3456 (OCP server source default since v1.0)
+ *
+ * If a particular host's OCP plist injects a non-default CLAUDE_PROXY_PORT,
+ * the OpenClaw launchd plist for that host must also inject the same
+ * CLAUDE_PROXY_PORT into the plugin's env, or the plugin will fall back to
+ * 3456 and miss the server.
  */
-
+const PROXY = process.env.OCP_PROXY_URL
-const PROXY = "http://127.0.0.1:3456";
+  || (process.env.CLAUDE_PROXY_PORT ? `http://127.0.0.1:${process.env.CLAUDE_PROXY_PORT}` : "http://127.0.0.1:3456");
 
 // Wrap output in monospace code block for Telegram/Discord alignment
 function mono(text) { return "```\n" + text + "\n```"; }

ocp-plugin/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "ocp",
   "name": "OCP Commands",
   "description": "Slash commands for the OpenClaw Proxy — /ocp usage, /ocp settings, /ocp health, etc.",
-  "version": "3.12.0",
+  "version": "3.16.2",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,
@@ -10,7 +10,7 @@
       "proxyUrl": {
         "type": "string",
         "default": "http://127.0.0.1:3456",
-        "description": "URL of the Claude proxy"
+        "description": "URL of the Claude proxy. Overridable via OCP_PROXY_URL or CLAUDE_PROXY_PORT env."
       }
     }
   }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-claude-proxy",
-  "version": "3.15.1",
+  "version": "3.17.1",
   "description": "OCP (Open Claude Proxy) — use your Claude Pro/Max subscription as an OpenAI-compatible API for any IDE. Works with Cline, OpenCode, Aider, Continue.dev, OpenClaw, and more.",
   "type": "module",
   "bin": {

scripts/doctor.mjs

@@ -15,6 +15,7 @@ import { readFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { execSync } from "node:child_process";
+import { DEFAULT_PORT } from "../lib/constants.mjs";
 
 const SCHEMA_VERSION = "1";
 
@@ -37,6 +38,11 @@ export async function runDoctor(opts = {}) {
   const push = (id, level, message, extra = {}) =>
     checks.push({ id, level, message, ...extra });
 
+  // --- fast path: --check oauth ---
+  if (opts.checkOnly === "oauth") {
+    return runOauthOnly(opts, checks, push);
+  }
+
   // --- version detection ---
   const ocpDir = opts.ocpDir || join(homedir(), "ocp");
   let currentVersion = opts.mockVersion;
@@ -76,7 +82,7 @@ export async function runDoctor(opts = {}) {
       health = opts.mockHealth;
     } else {
       try {
-        const port = process.env.CLAUDE_PROXY_PORT || "3478";
+        const port = process.env.CLAUDE_PROXY_PORT || String(DEFAULT_PORT);
         const out = execSync(`curl -sf --max-time 3 http://127.0.0.1:${port}/health`, { stdio: ["pipe", "pipe", "pipe"] }).toString();
         health = { status: 200, body: JSON.parse(out) };
       } catch (e) {
@@ -190,6 +196,84 @@ export async function runDoctor(opts = {}) {
   };
 }
 
+function runOauthOnly(opts, checks, push) {
+  let healthOk = true, oauthOk = true;
+  let health;
+  if (opts.mockHealth !== undefined) {
+    health = opts.mockHealth;
+  } else {
+    try {
+      const port = process.env.CLAUDE_PROXY_PORT || String(DEFAULT_PORT);
+      const out = execSync(`curl -sf --max-time 3 http://127.0.0.1:${port}/health`, { stdio: ["pipe", "pipe", "pipe"] }).toString();
+      health = { status: 200, body: JSON.parse(out) };
+    } catch (e) {
+      health = { error: String(e.message || e) };
+    }
+  }
+
+  if (health.error || health.status !== 200) {
+    healthOk = false;
+    push("oauth_ok", "FAIL", `service unreachable: ${health.error || `status ${health.status}`}`);
+  } else if (!health.body || typeof health.body !== "object") {
+    healthOk = false;
+    push("oauth_ok", "FAIL", "service /health returned 200 but empty/non-JSON body");
+  } else if (!health.body?.auth?.ok) {
+    oauthOk = false;
+    push("oauth_ok", "FAIL", `auth.ok=false: ${health.body?.auth?.message || "unknown"}`);
+  } else {
+    push("oauth_ok", "PASS", "OAuth token valid");
+  }
+
+  const kind = !healthOk ? "fix_service" : !oauthOk ? "fix_oauth" : "noop";
+
+  let next_action;
+  const ocpDir = opts.ocpDir || join(homedir(), "ocp");
+  if (kind === "noop") {
+    next_action = { kind, human_required: [], ai_executable: [], verify: "OAuth healthy" };
+  } else if (kind === "fix_oauth") {
+    next_action = {
+      kind,
+      human_required: [],
+      ai_executable: [
+        `cd "$(npm root -g)/@anthropic-ai/claude-code" && node install.cjs`,
+        `launchctl bootout gui/$(id -u)/dev.ocp.proxy 2>/dev/null || true`,
+        `launchctl bootstrap gui/$(id -u) ${join(homedir(), "Library", "LaunchAgents", "dev.ocp.proxy.plist")}`,
+        `${ocpDir}/ocp doctor --check oauth`
+      ],
+      verify: "ocp doctor --check oauth expects PASS",
+      reference: "~/.cc-rules/memory/learnings/ocp_claude_native_binary_postinstall.md"
+    };
+  } else {
+    next_action = {
+      kind,
+      human_required: [],
+      ai_executable: [
+        `launchctl bootout gui/$(id -u)/dev.ocp.proxy 2>/dev/null || true`,
+        `launchctl bootstrap gui/$(id -u) ${join(homedir(), "Library", "LaunchAgents", "dev.ocp.proxy.plist")}`,
+        `${ocpDir}/ocp doctor --check oauth`
+      ],
+      verify: "ocp doctor --check oauth expects service_running=PASS"
+    };
+  }
+
+  const fail_count = checks.filter(c => c.level === "FAIL").length;
+  // "skipped" = --check oauth fast path intentionally omits version detection.
+  // AI agents should NOT semver-compare against current_version/latest_version when
+  // either equals "skipped"; the full path provides those fields when needed.
+  return {
+    schema_version: SCHEMA_VERSION,
+    timestamp: new Date().toISOString(),
+    ready_to_upgrade: fail_count === 0,
+    current_version: opts.mockVersion || "skipped",
+    latest_version: opts.mockLatest || "skipped",
+    from_version_supported: true,
+    fail_count,
+    warn_count: 0,
+    checks,
+    next_action
+  };
+}
+
 // CLI entrypoint — use fileURLToPath + realpath to handle symlinked install paths
 // (e.g. /tmp/ → /private/tmp/ on macOS would otherwise miss the guard).
 import { fileURLToPath } from "node:url";
@@ -202,7 +286,9 @@ function _isMain() {
 }
 if (_isMain()) {
   const wantJson = process.argv.includes("--json");
-  const result = await runDoctor();
+  const checkIdx = process.argv.indexOf("--check");
+  const checkOnly = checkIdx !== -1 ? process.argv[checkIdx + 1] : undefined;
+  const result = await runDoctor({ checkOnly });
   if (wantJson) {
     console.log(JSON.stringify(result, null, 2));
   } else {

scripts/lib/snapshot.mjs

@@ -1,4 +1,4 @@
-import { mkdirSync, writeFileSync, readFileSync, copyFileSync, existsSync, readdirSync, statSync } from "node:fs";
+import { mkdirSync, writeFileSync, readFileSync, copyFileSync, existsSync, readdirSync, statSync, rmSync } from "node:fs";
 import { join } from "node:path";
 
 export function writeSnapshot({ homeDir, fromCommit, fromVersion, toVersion, extraFiles = [] }) {
@@ -50,3 +50,66 @@ export function listSnapshots(homeDir) {
     .map(name => ({ name, path: join(root, name), mtime: statSync(join(root, name)).mtimeMs }))
     .sort((a, b) => a.name.localeCompare(b.name));
 }
+
+/**
+ * Garbage-collect old upgrade snapshots.
+ *
+ * Retention rule (a snapshot is KEPT if any of these is true):
+ *   - It is among the last `keepCount` snapshots (sorted oldest→newest)
+ *   - Its timestamp is within `keepDays` of `now`
+ *   - It is the single most-recent snapshot (always-keep safety net)
+ *
+ * @param {string} homeDir - Root containing ~/.ocp/
+ * @param {object} opts
+ * @param {number} [opts.keepCount=5] - Minimum count to keep
+ * @param {number} [opts.keepDays=30] - Keep snapshots newer than N days
+ * @param {boolean} [opts.dryRun=false] - If true, report plan but don't delete
+ * @param {Date} [opts.now=new Date()] - Override clock for testing
+ * @returns {{kept: Array, removed: Array, dryRun: boolean}}
+ */
+export function gcSnapshots(homeDir, opts = {}) {
+  const keepCount = opts.keepCount ?? 5;
+  const keepDays = opts.keepDays ?? 30;
+  const dryRun = !!opts.dryRun;
+  const now = opts.now || new Date();
+
+  const all = listSnapshots(homeDir);  // sorted oldest→newest
+  if (all.length === 0) return { kept: [], removed: [], dryRun };
+  if (all.length === 1) return { kept: all, removed: [], dryRun };  // always keep most recent
+
+  const cutoffMs = now.getTime() - keepDays * 24 * 60 * 60 * 1000;
+  const lastN = new Set(all.slice(-keepCount).map(s => s.path));
+
+  const kept = [], removed = [];
+  for (let i = 0; i < all.length; i++) {
+    const s = all[i];
+    const isMostRecent = i === all.length - 1;
+    const isInLastN = lastN.has(s.path);
+    const isWithinDays = parseSnapshotTimestamp(s.name) >= cutoffMs;
+    if (isMostRecent || isInLastN || isWithinDays) {
+      kept.push(s);
+    } else {
+      removed.push(s);
+    }
+  }
+
+  if (!dryRun) {
+    for (const s of removed) {
+      try {
+        rmSync(s.path, { recursive: true, force: true });
+      } catch (err) {
+        console.error(`[snapshot] warn: could not remove ${s.path} (${err.code || err.message})`);
+      }
+    }
+  }
+
+  return { kept, removed, dryRun };
+}
+
+function parseSnapshotTimestamp(name) {
+  // upgrade-snapshot-2026-05-11T08:30:00Z → epoch ms
+  const m = name.match(/upgrade-snapshot-(.+)$/);
+  if (!m) return 0;
+  const t = Date.parse(m[1]);
+  return Number.isFinite(t) ? t : 0;
+}

scripts/sync-openclaw.mjs

@@ -9,6 +9,7 @@ import { readFileSync, writeFileSync, existsSync, copyFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
+import { DEFAULT_PORT, LOCAL_HOST, OPENAI_API_BASE } from "../lib/constants.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = join(__dirname, "..");
@@ -70,7 +71,7 @@ if (!config.models.providers) config.models.providers = {};
 if (!config.models.providers[PROVIDER_NAME]) {
   // First-time registration
   config.models.providers[PROVIDER_NAME] = {
-    baseUrl: "http://127.0.0.1:3456/v1",
+    baseUrl: `http://${LOCAL_HOST}:${DEFAULT_PORT}${OPENAI_API_BASE}`,
     api: "openai-completions",
     authHeader: false,
     models: desiredModels,

scripts/upgrade.mjs

@@ -14,7 +14,8 @@ import { execSync } from "node:child_process";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { existsSync, copyFileSync } from "node:fs";
-import { writeSnapshot, listSnapshots, readSnapshot } from "./lib/snapshot.mjs";
+import { writeSnapshot, listSnapshots, readSnapshot, gcSnapshots } from "./lib/snapshot.mjs";
+import { DEFAULT_PORT } from "../lib/constants.mjs";
 
 export async function runUpgrade(opts = {}) {
   const dryRun = !!opts.dryRun;
@@ -134,7 +135,7 @@ async function runFullUpgrade({ doctor, opts }) {
 
     // phase 6: post-flight (10s budget; skipped under mockExec)
     if (!opts.mockExec) {
-      const port = process.env.CLAUDE_PROXY_PORT || "3478";
+      const port = process.env.CLAUDE_PROXY_PORT || String(DEFAULT_PORT);
       let ok = false;
       for (let i = 0; i < 10; i++) {
         try {
@@ -154,6 +155,16 @@ async function runFullUpgrade({ doctor, opts }) {
       phases.push({ name: "post-flight", status: "skipped-mock" });
     }
 
+    // Auto-GC old snapshots after successful upgrade (best-effort, never throws).
+    try {
+      const gc = gcSnapshots(homedir(), { keepCount: 5, keepDays: 30 });
+      if (gc.removed.length > 0) {
+        console.error(`[gc] removed ${gc.removed.length} old snapshots; kept ${gc.kept.length}`);
+      }
+    } catch (e) {
+      console.error(`[gc] warn: snapshot GC failed: ${e.message}`);
+    }
+
     return { path: "upgrade", executed: true, changed: true, snapshotPath, phases };
   } catch (err) {
     if (snapshotPath && !err.snapshotPath) {
@@ -193,6 +204,11 @@ async function runRollback(opts) {
   const homeDir = opts.homeDir || homedir();
   const snapshots = opts.mockSnapshots ?? listSnapshots(homeDir);
 
+  if (opts.gc) {
+    const result = gcSnapshots(homeDir, { dryRun: opts.dryRun });
+    return { path: opts.dryRun ? "rollback-gc-dry-run" : "rollback-gc", ...result };
+  }
+
   if (opts.list) {
     return { path: "rollback-list", snapshots };
   }
@@ -295,6 +311,7 @@ if (_isMain()) {
   const yes = args.includes("--yes");
   const rollback = args.includes("--rollback");
   const list = args.includes("--list");
+  const gc = args.includes("--gc");
   const targetIdx = args.indexOf("--target");
   const target = targetIdx !== -1 ? args[targetIdx + 1] : undefined;
   // First non-flag positional after --rollback is the snapshot path
@@ -305,7 +322,7 @@ if (_isMain()) {
     if (cand && !cand.startsWith("--")) snapshotPath = cand;
   }
   try {
-    const result = await runUpgrade({ dryRun, yes, rollback, list, snapshotPath, target });
+    const result = await runUpgrade({ dryRun, yes, rollback, list, gc, snapshotPath, target });
     if (result.plan) for (const line of result.plan) console.log(line);
     if (result.phases) for (const p of result.phases) console.log(`[${p.name}] ${p.status}${p.cmd ? `: ${p.cmd}` : ""}`);
     if (result.steps) for (const s of result.steps) console.log(`  ${s.status === "ok" ? "✓" : s.status === "skipped-mock" ? "·" : "✗"} ${s.cmd}`);
@@ -313,6 +330,10 @@ if (_isMain()) {
       console.log(`Found ${result.snapshots.length} snapshots:`);
       for (const s of result.snapshots) console.log(`  ${s.name}`);
     }
+    if (result.removed && result.kept) {
+      console.log(`Snapshots: kept ${result.kept.length}, ${result.dryRun ? "would remove" : "removed"} ${result.removed.length}`);
+      for (const s of result.removed) console.log(`  - ${s.name}`);
+    }
     process.exit(0);
   } catch (e) {
     console.error(`✗ ${e.message}`);

server.mjs

@@ -2,7 +2,7 @@
 /**
  * openclaw-claude-proxy — OpenAI-compatible proxy for Claude CLI
  *
- * Translates OpenAI chat/completions requests into `claude -p` CLI calls,
+ * Translates OpenAI chat/completions requests into `claude --output-format stream-json` CLI calls,
  * letting you use your Claude Pro/Max subscription as an OpenClaw model provider.
  *
  * Timeout design: single CLAUDE_TIMEOUT (default 600s / 10 min).
@@ -11,7 +11,7 @@
  * This matches LiteLLM, OpenAI SDK, and other major LLM proxies.
  *
  * Env vars:
- *   CLAUDE_PROXY_PORT            — listen port (default: 3456)
+ *   CLAUDE_PROXY_PORT            — listen port (default: DEFAULT_PORT from lib/constants.mjs)
  *   CLAUDE_BIN                   — path to claude binary (default: auto-detect)
  *   CLAUDE_TIMEOUT               — per-request timeout in ms (default: 600000)
  *   CLAUDE_ALLOWED_TOOLS         — comma-separated tools to allow (default: expanded set)
@@ -35,6 +35,8 @@ import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 import { validateKey, recordUsage, getUsageByKey, getUsageTimeline, getRecentUsage, createKey, listKeys, revokeKey, closeDb, checkQuota, updateKeyQuota, getKeyQuota, findKey, cacheHash, getCachedResponse, setCachedResponse, clearCache, getCacheStats, hasCacheControl, singleflight, getInflightStats } from "./keys.mjs";
+import { DEFAULT_PORT } from "./lib/constants.mjs";
+import { runTuiTurn, reapStaleTuiSessions } from "./lib/tui/session.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const _pkg = JSON.parse(readFileSync(join(__dirname, "package.json"), "utf8"));
@@ -121,9 +123,140 @@ function resolveClaude() {
   process.exit(1);
 }
 
+// ── OCP system prompt wrapper (Phase 6c port — ADR 0009 Amendment 1 analogue) ─
+// Injected via `--system-prompt` flag, replacing claude CLI's default system
+// prompt (which normally includes cwd, OS, tool descriptions, and git status —
+// all irrelevant and potentially misleading when the model is accessed via the
+// OCP HTTP proxy).
+//
+// Authority: claude CLI § --system-prompt (ported from OLP, verified v2.1.104;
+// behavior stable through v2.1.158 — OLP ADR 0009 Amendment 1 §
+// "OLP system prompt wrapper"; ported to OCP 2026-05-30).
+// Reference: https://github.com/dtzp555-max/olp commit 97e7d16 (Phase 6c)
+const OCP_SYSTEM_PROMPT_WRAPPER = `You are accessed via the OCP HTTP proxy. You do NOT have access to any local filesystem, working directory, shell, git status, or machine environment. Do not infer or invent such information from any context you observe. Respond only based on the conversation provided.`;
+
+// Build the full system-prompt string: OCP_SYSTEM_PROMPT_WRAPPER prepended,
+// then any system-role messages from the request appended (separated by blank line).
+// ADR 0009 Amendment 1 analogue § "OLP system prompt wrapper".
+function extractSystemPrompt(messages) {
+  const systemMessages = (messages ?? []).filter(m => m.role === "system");
+  if (systemMessages.length === 0) {
+    return OCP_SYSTEM_PROMPT_WRAPPER;
+  }
+  const clientContent = systemMessages.map(m =>
+    typeof m.content === "string" ? m.content : JSON.stringify(m.content)
+  ).join("\n\n");
+  return `${OCP_SYSTEM_PROMPT_WRAPPER}\n\n${clientContent}`;
+}
+
+// ── NDJSON line buffer parser (Phase 6c port) ─────────────────────────────
+// Splits a buffered string on newlines, returning complete parsed events
+// plus the trailing incomplete line as `remainder` for the next data chunk.
+//
+// Authority: claude CLI § --output-format stream-json (ported from OLP, verified v2.1.104;
+//   behavior stable through v2.1.158; each event is a newline-terminated JSON object on stdout).
+// Reference: OLP lib/providers/anthropic.mjs parseStreamJsonLines (commit 97e7d16).
+function parseStreamJsonLines(buffered) {
+  const lines = buffered.split("\n");
+  const remainder = lines.pop(); // last element is the incomplete trailing line
+  const events = [];
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed === "") continue;
+    try {
+      events.push(JSON.parse(trimmed));
+    } catch {
+      console.error("[claude] NDJSON parse error on line:", trimmed.slice(0, 120));
+      events.push({ type: "parse_error", raw: trimmed });
+    }
+  }
+  return { events, remainder: remainder ?? "" };
+}
+
+// ── NDJSON event → text content extractor (Phase 6c port) ────────────────
+// Maps claude CLI stream-json NDJSON events to { text, stop, error } signals.
+// Returns:
+//   { text: string }   — content delta to forward
+//   { stop: true }     — terminal event (emit finish_reason=stop)
+//   { error: string }  — error event (emit error stop)
+//   null               — consumed event (log/ignore)
+//
+// Authority: claude CLI § --output-format stream-json (ported from OLP, verified v2.1.104;
+//   behavior stable through v2.1.158).
+// Reference: OLP lib/providers/anthropic.mjs anthropicStreamJsonEventToIR (commit 97e7d16).
+//
+// @param {object} event — parsed NDJSON event
+// @param {boolean} isFirstDelta — true if no content has been yielded yet
+function parseStreamJsonEvent(event, isFirstDelta) {
+  const t = event?.type;
+
+  // system/* — first-event init + other system meta (api_retry etc.)
+  if (t === "system") return null;
+  // user — echo of user message; consumed
+  if (t === "user") return null;
+
+  // stream_event — contains nested content_block_delta
+  if (t === "stream_event") {
+    const inner = event.event ?? event;
+    if (inner?.type === "content_block_delta" && inner.delta?.type === "text_delta") {
+      return { text: inner.delta.text ?? "" };
+    }
+    // Other stream_event sub-types (content_block_start, message_delta, etc.) — consumed
+    return null;
+  }
+
+  // assistant — aggregate message (fallback when no prior content_block_delta seen)
+  // Empirically (claude CLI without --include-partial-messages, verified v2.1.104 through v2.1.158): fast/short
+  // responses may emit ONLY the aggregate assistant event, no content_block_delta events.
+  // If isFirstDelta is true, extract text here; otherwise it's a duplicate, ignore.
+  // Reference: OLP commit 65f945c (assistant-aggregate fallback, fold-in).
+  if (t === "assistant") {
+    if (isFirstDelta) {
+      const blocks = event.message?.content;
+      if (Array.isArray(blocks)) {
+        const text = blocks
+          .filter(b => b && b.type === "text" && typeof b.text === "string")
+          .map(b => b.text)
+          .join("");
+        if (text) return { text };
+      }
+    }
+    return null;
+  }
+
+  // result — terminal event
+  if (t === "result") {
+    if (event.is_error === true) {
+      return { error: event.error_message ?? event.result ?? "claude returned is_error" };
+    }
+    return { stop: true };
+  }
+
+  // rate_limit_event / usage — log for observability, don't forward
+  if (t === "rate_limit_event" || t === "usage") {
+    logEvent("info", "claude_stream_event", { type: t, data: JSON.stringify(event).slice(0, 200) });
+    return null;
+  }
+
+  // control_request — per Anthropic stream-json docs
+  if (t === "control_request") {
+    console.error("[claude] stream_json control_request event (ignored):", JSON.stringify(event).slice(0, 120));
+    return null;
+  }
+
+  // parse_error — already logged by parseStreamJsonLines
+  if (t === "parse_error") return null;
+
+  // Unknown event type — log + skip; future-proof for new claude CLI events
+  if (t !== undefined) {
+    console.error("[claude] unknown stream_json event type:", t);
+  }
+  return null;
+}
+
 // ── Configuration ───────────────────────────────────────────────────────
 // Settings marked with `let` can be changed at runtime via PATCH /settings.
-const PORT = parseInt(process.env.CLAUDE_PROXY_PORT || "3456", 10);
+const PORT = parseInt(process.env.CLAUDE_PROXY_PORT || String(DEFAULT_PORT), 10);
 const CLAUDE = resolveClaude();
 let TIMEOUT = parseInt(process.env.CLAUDE_TIMEOUT || "600000", 10);
 const PROXY_API_KEY = process.env.PROXY_API_KEY || "";
@@ -146,6 +279,58 @@ const AUTH_MODE = process.env.CLAUDE_AUTH_MODE || (PROXY_API_KEY ? "shared" : "n
 const ADMIN_KEY = process.env.OCP_ADMIN_KEY || "";
 const PROXY_ANONYMOUS_KEY = process.env.PROXY_ANONYMOUS_KEY || "";
 let CACHE_TTL = parseInt(process.env.CLAUDE_CACHE_TTL || "0", 10); // 0 = disabled, value in ms
+
+// ── TUI-mode (subscription-pool bridge) — opt-in; default OFF ───────────
+// When ON: requests are served by spawning interactive `claude` (no -p / no
+// --output-format) so cc_entrypoint=cli (subscription pool). Responses are
+// buffered then replayed as chunked SSE.  Streaming is always buffered here.
+// Authority: docs/adr/0007-tui-interactive-mode.md
+// SECURITY: TUI-mode is SINGLE-USER ONLY.  Never enable on a multi-user OCP
+// (guest prompts would run claude with operator filesystem access).
+const TUI_MODE = process.env.CLAUDE_TUI_MODE === "true";
+const TUI_WALLCLOCK_MS = parseInt(process.env.CLAUDE_TUI_WALLCLOCK_MS || "120000", 10);
+const TUI_CWD  = process.env.OCP_TUI_CWD  || `${process.env.HOME}/.ocp-tui/work`;
+const TUI_HOME = process.env.OCP_TUI_HOME  || process.env.HOME;
+const TUI_ENTRYPOINT = process.env.OCP_TUI_ENTRYPOINT || "cli"; // cli|auto|off — see ADR 0007
+
+// SECURITY fail-loud: TUI-mode is incompatible with any configuration that allows
+// non-operator prompts to reach the interactive claude session. Three cases:
+//   1. AUTH_MODE=multi — guest/anonymous keys can submit prompts.
+//   2. BIND_ADDRESS=0.0.0.0 — server is LAN-exposed; any LAN peer can send prompts
+//      unless per-request trust is in place. Override with OCP_TUI_ALLOW_LAN=1
+//      ONLY if you have a separate network-layer trust (firewall, VPN).
+//   3. PROXY_ANONYMOUS_KEY set — anonymous callers can submit prompts without a key.
+// In all three cases TUI runs interactive claude with the OPERATOR's full filesystem
+// access — home is NOT isolation. Refuse to boot. See ADR 0007.
+if (TUI_MODE && AUTH_MODE === "multi") {
+  console.error(
+    "FATAL: CLAUDE_TUI_MODE=true is incompatible with CLAUDE_AUTH_MODE=multi.\n" +
+    "  TUI runs interactive claude with the operator's filesystem access, so a guest/anonymous\n" +
+    "  prompt could read operator data. TUI-mode is single-user only until B-path isolation lands.\n" +
+    "  See docs/adr/0007-tui-interactive-mode.md. Refusing to start."
+  );
+  process.exit(1);
+}
+if (TUI_MODE && BIND_ADDRESS === "0.0.0.0" && process.env.OCP_TUI_ALLOW_LAN !== "1") {
+  console.error(
+    "FATAL: CLAUDE_TUI_MODE=true with CLAUDE_BIND=0.0.0.0 is unsafe.\n" +
+    "  TUI runs interactive claude with operator filesystem access; LAN-exposed without\n" +
+    "  per-request isolation means any LAN peer could drive the operator's claude session.\n" +
+    "  Either bind to 127.0.0.1 (default) or set OCP_TUI_ALLOW_LAN=1 if you have a\n" +
+    "  separate network-layer trust (firewall/VPN). See docs/adr/0007-tui-interactive-mode.md."
+  );
+  process.exit(1);
+}
+if (TUI_MODE && PROXY_ANONYMOUS_KEY) {
+  console.error(
+    "FATAL: CLAUDE_TUI_MODE=true with PROXY_ANONYMOUS_KEY set is unsafe.\n" +
+    "  TUI runs interactive claude with operator filesystem access; anonymous callers\n" +
+    "  could drive the operator's claude session without a named key.\n" +
+    "  Remove PROXY_ANONYMOUS_KEY or disable TUI-mode. See docs/adr/0007-tui-interactive-mode.md."
+  );
+  process.exit(1);
+}
+
 if (PROXY_ANONYMOUS_KEY && AUTH_MODE !== "multi") {
   console.warn("WARNING: PROXY_ANONYMOUS_KEY is set but AUTH_MODE is not 'multi' — anonymous key will be ignored");
 }
@@ -380,30 +565,57 @@ checkAuth();
 const authCheckInterval = setInterval(checkAuth, 600000);
 
 // ── Build CLI arguments ─────────────────────────────────────────────────
-function buildCliArgs(cliModel, sessionInfo) {
+// Phase 6c port (2026-05-30): removed `-p` / `--output-format text`.
-  const args = ["-p", "--model", cliModel, "--output-format", "text"];
+// Now uses `--output-format stream-json --verbose --no-session-persistence
-
+// --system-prompt <OCP_SYSTEM_PROMPT_WRAPPER + client system messages>`.
-  // Session handling
+//
-  if (sessionInfo?.resume) {
+// Authority: claude CLI § --output-format stream-json, § --verbose,
-    args.push("--resume", sessionInfo.uuid);
+//   § --no-session-persistence, § --system-prompt (ported from OLP, verified v2.1.104;
-  } else if (sessionInfo?.uuid) {
+//   behavior stable through v2.1.158).
-    args.push("--session-id", sessionInfo.uuid);
+// Reference: OLP ADR 0009 Amendment 1 + commit 97e7d16.
-  } else {
+//
-    args.push("--no-session-persistence");
+// Session flags (--resume, --session-id) are dropped: they are incompatible
-  }
+// with stream-json mode without -p. OCP always passes full conversation context
+// via stdin instead (messagesToPrompt), preserving multi-turn correctness.
+// CLAUDE_SYSTEM_PROMPT env var is absorbed into the system prompt via
+// extractSystemPrompt() at the caller level; APPEND_SYSTEM_PROMPT no longer used.
+// Note: ALLOWED_TOOLS / SKIP_PERMISSIONS / MCP_CONFIG are preserved as before.
+function buildCliArgs(cliModel, systemPrompt) {
+  const args = [
+    "--model", cliModel,
+    "--output-format", "stream-json",
+    "--verbose",
+    "--no-session-persistence",
+    "--system-prompt", systemPrompt,
+  ];
 
   // Permissions
-  if (SKIP_PERMISSIONS) {
+  // ADR 0007 B-path: in multi-tenant mode, suppress operator-FS tools so a guest
+  // prompt cannot drive Bash/Read/Write/Edit/etc. on the operator's filesystem.
+  // For AUTH_MODE !== "multi" (none/shared — single-operator/trusted), preserve
+  // existing behaviour unchanged.
+  if (AUTH_MODE === "multi") {
+    // Disallow the full operator-FS + web + agent surface. "--disallowedTools" may
+    // be repeated; claude accepts multiple occurrences (TUI path already uses it).
+    args.push(
+      "--disallowedTools", "Bash",
+      "--disallowedTools", "Read",
+      "--disallowedTools", "Write",
+      "--disallowedTools", "Edit",
+      "--disallowedTools", "Glob",
+      "--disallowedTools", "Grep",
+      "--disallowedTools", "WebFetch",
+      "--disallowedTools", "WebSearch",
+      "--disallowedTools", "Agent",
+      "--disallowedTools", "mcp__*",
+    );
+    // Do NOT push --allowedTools in multi mode.
+  } else if (SKIP_PERMISSIONS) {
     args.push("--dangerously-skip-permissions");
   } else if (ALLOWED_TOOLS.length > 0) {
     args.push("--allowedTools", ...ALLOWED_TOOLS);
   }
 
-  // System prompt
-  if (SYSTEM_PROMPT) {
-    args.push("--append-system-prompt", SYSTEM_PROMPT);
-  }
-
   // MCP config
   if (MCP_CONFIG) {
     args.push("--mcp-config", MCP_CONFIG);
@@ -474,8 +686,15 @@ function getModelTier(cliModel) {
 }
 
 // ── Spawn claude CLI (shared setup) ─────────────────────────────────────
-// Resolves session logic, builds CLI args, spawns the process, and sets up
+// Builds CLI args, spawns the process, and sets up timeouts.
-// timeouts. Returns context object or throws synchronously.
+// Returns context object or throws synchronously.
+//
+// Phase 6c port (2026-05-30): session resume (--resume / --session-id) is
+// dropped because it is incompatible with stream-json mode without -p.
+// OCP now always passes the full serialized conversation via stdin
+// (messagesToPrompt), so multi-turn correctness is preserved without sessions.
+// The sessions Map is retained for stats/logging but no longer drives --resume.
+// Reference: OLP ADR 0009 Amendment 1 + commit 97e7d16.
 function spawnClaudeProcess(model, messages, conversationId, keyName) {
   if (stats.activeRequests >= MAX_CONCURRENT) {
     throw new Error(`concurrency limit reached (${stats.activeRequests}/${MAX_CONCURRENT})`);
@@ -488,43 +707,22 @@ function spawnClaudeProcess(model, messages, conversationId, keyName) {
   stats.activeRequests++;
   stats.totalRequests++;
 
-  let sessionInfo = null;
+  // Phase 6c: always serialize full conversation via stdin (no session resume).
-  let prompt;
+  // System messages are extracted and passed via --system-prompt; the remaining
+  // messages (user/assistant/tool) are serialized by messagesToPrompt.
+  const systemPrompt = extractSystemPrompt(messages);
 
-  // ── Session logic ──
+  // messagesToPrompt skips system messages now that they go via --system-prompt.
-  // sessionKey namespaces the Map key by keyName to prevent cross-caller collision
+  // Filter them out before calling to avoid double-injection.
-  // when two callers with different API keys share the same conversationId string.
+  const nonSystemMessages = messages.filter(m => m.role !== "system");
-  const sessionKey = _sessionKey(conversationId, keyName);
+  const prompt = messagesToPrompt(nonSystemMessages);
-  if (sessionKey && sessions.has(sessionKey)) {
-    const session = sessions.get(sessionKey);
-    session.lastUsed = Date.now();
-    sessionInfo = { uuid: session.uuid, resume: true };
-    stats.sessionHits++;
 
-    const lastUserMsg = [...messages].reverse().find((m) => m.role === "user");
+  stats.oneOffRequests++;
-    prompt = lastUserMsg
+  if (conversationId) {
-      ? (typeof lastUserMsg.content === "string" ? lastUserMsg.content : JSON.stringify(lastUserMsg.content))
+    console.log(`[session] stateless conv=${conversationId.slice(0, 12)}... key=${keyName || "anon"} msgs=${messages.length} prompt_chars=${prompt.length}`);
-      : "";
-    session.messageCount = messages.length;
-
-    console.log(`[session] resume conv=${conversationId.slice(0, 12)}... key=${keyName || "anon"} uuid=${session.uuid.slice(0, 8)}... msgs=${messages.length} prompt_chars=${prompt.length}`);
-
-  } else if (sessionKey) {
-    const uuid = randomUUID();
-    const now = Date.now();
-    sessions.set(sessionKey, { uuid, messageCount: messages.length, firstSeen: now, lastUsed: now, model: cliModel });
-    sessionInfo = { uuid, resume: false };
-    stats.sessionMisses++;
-    prompt = messagesToPrompt(messages);
-
-    console.log(`[session] new conv=${conversationId.slice(0, 12)}... key=${keyName || "anon"} uuid=${uuid.slice(0, 8)}... msgs=${messages.length}`);
-
-  } else {
-    stats.oneOffRequests++;
-    prompt = messagesToPrompt(messages);
   }
 
-  const cliArgs = buildCliArgs(cliModel, sessionInfo);
+  const cliArgs = buildCliArgs(cliModel, systemPrompt);
 
   const env = { ...process.env };
   delete env.CLAUDECODE;
@@ -562,15 +760,10 @@ function spawnClaudeProcess(model, messages, conversationId, keyName) {
   proc.once("exit", cleanup);
 
   function handleSessionFailure() {
-    if (sessionInfo?.resume && sessionKey) {
+    // Phase 6c: session resume (--resume/--session-id) is no longer used;
-      console.warn(`[session] resume failed for ${conversationId.slice(0, 12)}..., removing stale session`);
+    // OCP always passes full context via stdin. No session state to clean up.
-      logEvent("warn", "session_failure", { mode: "resume", conversationId: conversationId.slice(0, 12) + "...", action: "deleted" });
+    if (conversationId) {
-      sessions.delete(sessionKey);
+      logEvent("warn", "session_failure", { mode: "stateless", conversationId: conversationId.slice(0, 12) + "...", action: "none" });
-    } else if (sessionInfo && !sessionInfo.resume && sessionKey) {
-      // #41 evidence-gathering: session-create failures currently leave a stale entry
-      // in the sessions map. Log without action so the staleness pattern can be
-      // confirmed in /logs before any code change. Do NOT delete here speculatively.
-      logEvent("warn", "session_failure", { mode: "create", conversationId: conversationId.slice(0, 12) + "...", action: "kept" });
     }
   }
 
@@ -581,6 +774,11 @@ function spawnClaudeProcess(model, messages, conversationId, keyName) {
     }
   }
 
+  // Guard stdin writes against EPIPE (child may close stdin before we finish
+  // writing, e.g. early exit on bad model). The ChildProcess "error" event is on
+  // the spawned process, NOT on the stdin Writable — it does not catch this.
+  proc.stdin.on("error", (e) => logEvent("warn", "stdin_write_error", { error: e.message }));
+
   // Write prompt to stdin immediately
   proc.stdin.write(prompt);
   proc.stdin.end();
@@ -606,9 +804,14 @@ function spawnClaudeProcess(model, messages, conversationId, keyName) {
 }
 
 // ── Call claude CLI (non-streaming) ─────────────────────────────────────
-// On-demand spawning: each request spawns a fresh `claude -p` process.
+// On-demand spawning: each request spawns a fresh claude process.
 // No pool = no crash loops, no stale workers, no degraded states.
 // Stdin is written immediately so there's no 3s stdin timeout issue.
+//
+// Phase 6c port (2026-05-30): stdout is now NDJSON (stream-json format).
+// We accumulate full text across all content_block_delta events plus the
+// assistant-aggregate fallback, then resolve with the assembled string.
+// Reference: OLP ADR 0009 Amendment 1 + commit 97e7d16.
 function callClaude(model, messages, conversationId, keyName) {
   return new Promise((resolve, reject) => {
     let ctx;
@@ -619,12 +822,30 @@ function callClaude(model, messages, conversationId, keyName) {
     }
 
     const { proc, cliModel, conversationId: convId, t0, cleanup, handleSessionFailure, markFirstByte } = ctx;
-    let stdout = "";
+    let lineBuffer = "";
+    let assembledText = "";
+    let isFirstDelta = true;
+    let resultEventSeen = false;
     let stderr = "";
 
     proc.stdout.on("data", (d) => {
       markFirstByte();
-      stdout += d;
+      lineBuffer += d.toString();
+      const { events, remainder } = parseStreamJsonLines(lineBuffer);
+      lineBuffer = remainder;
+      for (const event of events) {
+        const parsed = parseStreamJsonEvent(event, isFirstDelta);
+        if (!parsed) continue;
+        if (parsed.text !== undefined) {
+          assembledText += parsed.text;
+          isFirstDelta = false;
+        } else if (parsed.stop) {
+          resultEventSeen = true;
+        } else if (parsed.error) {
+          // is_error result — treat as process error
+          reject(new Error(String(parsed.error)));
+        }
+      }
     });
     proc.stderr.on("data", (d) => (stderr += d));
 
@@ -632,17 +853,19 @@ function callClaude(model, messages, conversationId, keyName) {
       activeProcesses.delete(proc);
       const elapsed = Date.now() - t0;
       cleanup();
-      if (code !== 0) {
+      // Tolerate null exit code when result event was seen (sandbox-wrap noise, same
+      // as OLP commit 2864275 — bwrap shell exits null after model completes).
+      if (code !== 0 && !resultEventSeen) {
         recordModelError(cliModel, false);
         logEvent("error", "claude_exit", { model: cliModel, code, signal: signal || "none", elapsed, stderr: stderr.slice(0, 300) });
-        trackError(stderr.slice(0, 300) || stdout.slice(0, 300) || `claude exit ${code}`);
+        trackError(stderr.slice(0, 300) || assembledText.slice(0, 300) || `claude exit ${code}`);
         handleSessionFailure();
-        reject(new Error(stderr.slice(0, 300) || stdout.slice(0, 300) || `claude exit ${code}`));
+        reject(new Error(stderr.slice(0, 300) || assembledText.slice(0, 300) || `claude exit ${code}`));
       } else {
         recordModelSuccess(cliModel, elapsed);
         breakerRecordSuccess(cliModel);
-        logEvent("info", "claude_ok", { model: cliModel, chars: stdout.length, elapsed, session: convId ? convId.slice(0, 12) + "..." : "none" });
+        logEvent("info", "claude_ok", { model: cliModel, chars: assembledText.length, elapsed, session: convId ? convId.slice(0, 12) + "..." : "none" });
-        resolve(stdout.trim());
+        resolve(assembledText);
       }
     });
 
@@ -656,6 +879,37 @@ function callClaude(model, messages, conversationId, keyName) {
   });
 }
 
+// ── TUI-mode upstream (interactive claude, cc_entrypoint=cli) ───────────
+// Drop-in replacement for callClaude when TUI_MODE is ON.
+// Same signature and Promise<string> contract so all downstream
+// (singleflight → setCachedResponse → completionResponse) is unchanged.
+// System messages are rendered inline as [System] blocks by messagesToPrompt;
+// we deliberately do NOT pass --system-prompt in interactive mode to avoid any
+// flag that could perturb cc_entrypoint classification.
+// Authority: claude CLI v2.1.158 interactive mode (cc_entrypoint=cli).
+// SECURITY: A-path single-user ONLY — home is NOT isolation (see ADR 0007).
+function callClaudeTui(model, messages, _conversationId, _keyName) {
+  const cliModel = MODEL_MAP[model] || model;
+  const prompt = messagesToPrompt(messages); // includes system as [System] inline
+  recordModelRequest(cliModel, prompt.length);
+  return runTuiTurn({
+    prompt,
+    model: cliModel,
+    claudeBin: CLAUDE,
+    home: TUI_HOME,
+    realHome: process.env.HOME,
+    cwd: TUI_CWD,
+    wallclockMs: TUI_WALLCLOCK_MS,
+    entrypointMode: TUI_ENTRYPOINT,
+  }).then((text) => {
+    recordModelSuccess(cliModel, 0); // elapsed not measurable here; wallclock at reader level
+    return text;
+  }).catch((err) => {
+    recordModelError(cliModel, false);
+    throw err;
+  });
+}
+
 // ── SSE heartbeat (opt-in idle watchdog) ────────────────────────────────
 // Emits `: keepalive\n\n` SSE comment frames during silent windows on the
 // streaming response. Design: docs/superpowers/specs/2026-04-25-47-sse-heartbeat-design.md
@@ -684,9 +938,14 @@ function startHeartbeat(res, intervalMs, sessionId) {
 }
 
 // ── Call claude CLI (real streaming) ─────────────────────────────────────
-// Pipes stdout from the claude process directly to SSE chunks as they arrive.
+// Pipes stdout from the claude process as SSE chunks as they arrive.
-// Each data chunk becomes a proper SSE event with delta content in real time.
+// Each NDJSON content_block_delta text event becomes one SSE delta.
 // TODO(cache-singleflight-stream): streaming-path singleflight is out of scope for v3.13.0; see spec D4 streaming caveat.
+//
+// Phase 6c port (2026-05-30): stdout is now NDJSON (stream-json format).
+// We parse line-by-line and forward content_block_delta text events as SSE.
+// The result event triggers the stop/[DONE] sequence.
+// Reference: OLP ADR 0009 Amendment 1 + commits 97e7d16, 65f945c.
 function callClaudeStreaming(model, messages, conversationId, res, authInfo = {}) {
   const id = `chatcmpl-${randomUUID()}`;
   const created = Math.floor(Date.now() / 1000);
@@ -703,6 +962,13 @@ function callClaudeStreaming(model, messages, conversationId, res, authInfo = {}
   let headersSent = false;
   let totalChars = 0;
   let cachedContent = ""; // accumulate for cache write-back
+  let lineBuffer = "";
+  let isFirstDelta = true;
+  let resultEventSeen = false;
+  // Separate flag for is_error result — must NOT be conflated with resultEventSeen.
+  // If errored===true the close handler must not cache the response or record success
+  // (mirrors callClaude which rejects and never caches on is_error).
+  let errored = false;
 
   function ensureHeaders() {
     if (res.writableEnded || res.destroyed) return false;
@@ -723,27 +989,65 @@ function callClaudeStreaming(model, messages, conversationId, res, authInfo = {}
   }
 
   // D4 (spec 2026-04-25): eagerly send SSE headers post-spawn so the
-  // heartbeat started in the next statement (Task 1.3) covers the
+  // heartbeat started in the next statement covers the pre-first-byte silent window.
-  // pre-first-byte silent window. Behavior change: the `code !== 0`
-  // before-first-byte branch at server.mjs:610-611 becomes effectively
-  // unreachable in the common case — the post-headers SSE-stop path
-  // (612-619) handles it instead.
   ensureHeaders();
   const hb = startHeartbeat(res, HEARTBEAT_INTERVAL, convId);
 
   proc.stdout.on("data", (d) => {
     markFirstByte();
-    const text = d.toString();
+    lineBuffer += d.toString();
-    totalChars += text.length;
+    const { events, remainder } = parseStreamJsonLines(lineBuffer);
-    if (CACHE_TTL > 0) cachedContent += text;
+    lineBuffer = remainder;
 
-    if (!ensureHeaders()) return;
+    for (const event of events) {
+      const parsed = parseStreamJsonEvent(event, isFirstDelta);
+      if (!parsed) continue;
 
-    // Stream each chunk as it arrives from the CLI process
+      if (parsed.text !== undefined) {
-    sendSSE(res, {
+        // content_block_delta text — forward as SSE delta
-      id, object: "chat.completion.chunk", created, model,
+        const text = parsed.text;
-      choices: [{ index: 0, delta: { content: text }, finish_reason: null }],
+        totalChars += text.length;
-    }, hb);
+        if (CACHE_TTL > 0) cachedContent += text;
+        isFirstDelta = false;
+
+        if (!ensureHeaders()) continue;
+        sendSSE(res, {
+          id, object: "chat.completion.chunk", created, model,
+          choices: [{ index: 0, delta: { content: text }, finish_reason: null }],
+        }, hb);
+
+      } else if (parsed.stop) {
+        // result event — emit stop and [DONE] immediately
+        resultEventSeen = true;
+        if (!ensureHeaders()) continue;
+        sendSSE(res, {
+          id, object: "chat.completion.chunk", created, model,
+          choices: [{ index: 0, delta: {}, finish_reason: "stop" }],
+        }, hb);
+        if (!res.writableEnded && !res.destroyed) {
+          res.write("data: [DONE]\n\n");
+          res.end();
+        }
+
+      } else if (parsed.error) {
+        // is_error result — emit error stop; do NOT set resultEventSeen (that would
+        // cause the close handler to record success + write cache). Set errored instead.
+        errored = true;
+        const errStr = String(parsed.error);
+        logEvent("error", "claude_result_error", { model: cliModel, error: errStr.slice(0, 200) });
+        trackError(errStr.slice(0, 200));
+        if (!headersSent && !res.writableEnded && !res.destroyed) {
+          jsonResponse(res, 500, { error: { message: errStr, type: "provider_error" } });
+        } else if (!res.writableEnded && !res.destroyed) {
+          sendSSE(res, {
+            id, object: "chat.completion.chunk", created, model,
+            choices: [{ index: 0, delta: {}, finish_reason: "stop" }],
+          }, hb);
+          res.write("data: [DONE]\n\n");
+          res.end();
+        }
+      }
+    }
   });
 
   proc.stderr.on("data", (d) => (stderr += d));
@@ -754,13 +1058,19 @@ function callClaudeStreaming(model, messages, conversationId, res, authInfo = {}
     cleanup();
     const elapsed = Date.now() - t0;
 
-    if (code !== 0) {
+    // Tolerate null exit code when result event was seen (sandbox-wrap noise, same
+    // as OLP commit 2864275 — bwrap shell exits null after model completes).
+    // Also route to the error path when errored===true (is_error result received):
+    // never record success or write cache for an errored response.
+    if ((code !== 0 && !resultEventSeen) || errored) {
       recordModelError(cliModel, false);
       try { recordUsage({ keyId: authInfo.keyId, keyName: authInfo.keyName, model, promptChars: messages.reduce((a, m) => a + (typeof m.content === "string" ? m.content.length : JSON.stringify(m.content).length), 0), responseChars: 0, elapsedMs: elapsed, success: false }); } catch (e) { logEvent("error", "usage_record_failed", { error: e.message }); }
-      logEvent("error", "claude_exit", { model: cliModel, code, signal: signal || "none", elapsed, stderr: stderr.slice(0, 300) });
+      logEvent("error", "claude_exit", { model: cliModel, code, signal: signal || "none", elapsed, errored, stderr: stderr.slice(0, 300) });
       trackError(stderr.slice(0, 300) || `claude exit ${code}`);
       handleSessionFailure();
 
+      // If the error was already sent inline (parsed.error branch above), the
+      // response may be writableEnded — nothing more to send.
       if (!headersSent && !res.writableEnded && !res.destroyed) {
         jsonResponse(res, 500, { error: { message: stderr.slice(0, 300) || `claude exit ${code}`, type: "proxy_error" } });
       } else if (!res.writableEnded && !res.destroyed) {
@@ -776,19 +1086,23 @@ function callClaudeStreaming(model, messages, conversationId, res, authInfo = {}
       breakerRecordSuccess(cliModel);
       try { recordUsage({ keyId: authInfo.keyId, keyName: authInfo.keyName, model, promptChars: messages.reduce((a, m) => a + (typeof m.content === "string" ? m.content.length : JSON.stringify(m.content).length), 0), responseChars: totalChars, elapsedMs: elapsed, success: true }); } catch (e) { logEvent("error", "usage_record_failed", { error: e.message }); }
       logEvent("info", "claude_ok", { model: cliModel, chars: totalChars, elapsed, session: convId ? convId.slice(0, 12) + "..." : "none" });
-      // Cache write-back for streaming
+      // Cache write-back for streaming — only on true success (not errored)
       if (CACHE_TTL > 0 && authInfo.cacheHash) {
         try { setCachedResponse(authInfo.cacheHash, model, cachedContent); } catch (e) { logEvent("error", "cache_write_failed", { error: e.message }); }
       }
 
-      if (!headersSent) ensureHeaders();
+      // If result event already closed the response, nothing more to do.
-      if (!res.writableEnded && !res.destroyed) {
+      // Otherwise emit a synthetic stop (version drift safety net, same as OLP).
-        sendSSE(res, {
+      if (!resultEventSeen) {
-          id, object: "chat.completion.chunk", created, model,
+        if (!headersSent) ensureHeaders();
-          choices: [{ index: 0, delta: {}, finish_reason: "stop" }],
+        if (!res.writableEnded && !res.destroyed) {
-        }, hb);
+          sendSSE(res, {
-        res.write("data: [DONE]\n\n");
+            id, object: "chat.completion.chunk", created, model,
-        res.end();
+            choices: [{ index: 0, delta: {}, finish_reason: "stop" }],
+          }, hb);
+          res.write("data: [DONE]\n\n");
+          res.end();
+        }
       }
     }
   });
@@ -837,6 +1151,24 @@ function completionResponse(res, id, model, content) {
   });
 }
 
+// Replay a complete string as a chunked SSE stream (80 codepoints/chunk).
+// Used by: (a) cache-hit replay on the streaming path; (b) TUI-mode streaming
+// (buffered response replayed as SSE so clients get the same wire format).
+// Behaviour is byte-for-byte identical to the original inline cache-replay block.
+function streamStringAsSSE(res, id, model, content) {
+  const created = Math.floor(Date.now() / 1000);
+  res.writeHead(200, { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", "Connection": "keep-alive", "X-Accel-Buffering": "no" });
+  sendSSE(res, { id, object: "chat.completion.chunk", created, model, choices: [{ index: 0, delta: { role: "assistant" }, finish_reason: null }] });
+  const CHUNK = 80;
+  const codepoints = Array.from(content);
+  for (let i = 0; i < codepoints.length; i += CHUNK) {
+    sendSSE(res, { id, object: "chat.completion.chunk", created, model, choices: [{ index: 0, delta: { content: codepoints.slice(i, i + CHUNK).join("") }, finish_reason: null }] });
+  }
+  sendSSE(res, { id, object: "chat.completion.chunk", created, model, choices: [{ index: 0, delta: {}, finish_reason: "stop" }] });
+  res.write("data: [DONE]\n\n");
+  res.end();
+}
+
 // ── Plan usage probe ────────────────────────────────────────────────────
 // ── Plan usage probe ────────────────────────────────────────────────────
 // ALIGNMENT: mirrors Claude Code cli.js vE4 rate-limit header extraction.
@@ -1234,9 +1566,16 @@ async function handleSettings(req, res) {
 
   // PATCH
   let body = "";
-  for await (const chunk of req) {
+  try {
-    body += chunk;
+    for await (const chunk of req) {
-    if (body.length > 10000) return jsonResponse(res, 413, { error: "Body too large" });
+      body += chunk;
+      if (body.length > 10000) return jsonResponse(res, 413, { error: "Body too large" });
+    }
+  } catch (e) {
+    if (!res.headersSent && !res.writableEnded) {
+      try { return jsonResponse(res, 400, { error: { message: "request aborted", type: "invalid_request_error" } }); } catch {}
+    }
+    return;
   }
   let updates;
   try { updates = JSON.parse(body); } catch { return jsonResponse(res, 400, { error: "Invalid JSON" }); }
@@ -1273,11 +1612,18 @@ const VALID_MODELS = new Set(Object.keys(MODEL_MAP));
 
 async function handleChatCompletions(req, res) {
   let body = "";
-  for await (const chunk of req) {
+  try {
-    body += chunk;
+    for await (const chunk of req) {
-    if (body.length > MAX_BODY_SIZE) {
+      body += chunk;
-      return jsonResponse(res, 413, { error: { message: "Request body too large (max 5MB)", type: "invalid_request_error" } });
+      if (body.length > MAX_BODY_SIZE) {
+        return jsonResponse(res, 413, { error: { message: "Request body too large (max 5MB)", type: "invalid_request_error" } });
+      }
     }
+  } catch (e) {
+    if (!res.headersSent && !res.writableEnded) {
+      try { return jsonResponse(res, 400, { error: { message: "request aborted", type: "invalid_request_error" } }); } catch {}
+    }
+    return;
   }
 
   let parsed;
@@ -1329,20 +1675,9 @@ async function handleChatCompletions(req, res) {
         if (cached) {
           logEvent("info", "cache_hit", { model, hash: hash.slice(0, 12), hits: cached.hits });
           if (stream) {
-            // D3: replay cached content as chunked SSE stream (80 codepoints/chunk)
+            // D3: replay cached content as chunked SSE stream — delegated to streamStringAsSSE (DRY).
-            const CACHE_REPLAY_CHUNK_SIZE = 80;
             const id = `chatcmpl-${randomUUID()}`;
-            const created = Math.floor(Date.now() / 1000);
+            streamStringAsSSE(res, id, model, cached.response);
-            res.writeHead(200, { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", "Connection": "keep-alive", "X-Accel-Buffering": "no" });
-            sendSSE(res, { id, object: "chat.completion.chunk", created, model, choices: [{ index: 0, delta: { role: "assistant" }, finish_reason: null }] });
-            const codepoints = Array.from(cached.response);
-            for (let i = 0; i < codepoints.length; i += CACHE_REPLAY_CHUNK_SIZE) {
-              const chunk = codepoints.slice(i, i + CACHE_REPLAY_CHUNK_SIZE).join("");
-              sendSSE(res, { id, object: "chat.completion.chunk", created, model, choices: [{ index: 0, delta: { content: chunk }, finish_reason: null }] });
-            }
-            sendSSE(res, { id, object: "chat.completion.chunk", created, model, choices: [{ index: 0, delta: {}, finish_reason: "stop" }] });
-            res.write("data: [DONE]\n\n");
-            res.end();
             return;
           } else {
             const id = `chatcmpl-${randomUUID()}`;
@@ -1356,13 +1691,39 @@ async function handleChatCompletions(req, res) {
   }
 
   if (stream) {
-    // Real streaming: pipe stdout from claude process directly as SSE chunks
+    if (TUI_MODE) {
+      // TUI-mode: no real token stream — buffer the full turn via callClaudeTui,
+      // optionally write-back to cache, then replay as chunked SSE.
+      // Default path (TUI_MODE===false) falls through to callClaudeStreaming below,
+      // which is byte-for-byte unchanged from before this gate was added.
+      const t0TuiStream = Date.now();
+      const promptCharsTuiStream = messages.reduce((a, m) => a + (typeof m.content === "string" ? m.content.length : JSON.stringify(m.content).length), 0);
+      try {
+        const content = await callClaudeTui(model, messages, conversationId, req._authKeyName);
+        if (CACHE_TTL > 0 && req._cacheHash) {
+          try { setCachedResponse(req._cacheHash, model, content); } catch (e) { logEvent("error", "cache_write_failed", { error: e.message }); }
+        }
+        const id = `chatcmpl-${randomUUID()}`;
+        streamStringAsSSE(res, id, model, content);
+        try { recordUsage({ keyId: req._authKeyId, keyName: req._authKeyName, model, promptChars: promptCharsTuiStream, responseChars: content.length, elapsedMs: Date.now() - t0TuiStream, success: true }); } catch {}
+        return;
+      } catch (err) {
+        if (res.headersSent || res.writableEnded || res.destroyed) { try { res.end(); } catch {} return; }
+        const safeMessage = (err.message || "Internal error").replace(/\/[\w/.\-]+/g, "[path]");
+        return jsonResponse(res, 500, { error: { message: safeMessage, type: "proxy_error" } });
+      }
+    }
+    // Default: real stream-json streaming, unchanged.
     return callClaudeStreaming(model, messages, conversationId, res, { keyId: req._authKeyId, keyName: req._authKeyName, cacheHash: req._cacheHash });
   }
 
   const t0Usage = Date.now();
   const promptChars = messages.reduce((a, m) => a + (typeof m.content === "string" ? m.content.length : JSON.stringify(m.content).length), 0);
 
+  // Select upstream based on TUI_MODE flag. With TUI_MODE===false (default),
+  // upstreamCall===callClaude — identical to the pre-TUI code path.
+  const upstreamCall = TUI_MODE ? callClaudeTui : callClaude;
+
   // Non-streaming path with stampede protection: wrap the upstream call in singleflight
   // when cache is enabled and a hash is present. Concurrent identical requests share
   // one upstream spawn; followers receive the same promise. Streaming-path dedup is
@@ -1376,7 +1737,7 @@ async function handleChatCompletions(req, res) {
         // will re-read the freshly-populated cache entry here rather than spawning.
         const recheck = getCachedResponse(req._cacheHash, CACHE_TTL);
         if (recheck) return recheck.response;
-        const c = await callClaude(model, messages, conversationId, req._authKeyName);
+        const c = await upstreamCall(model, messages, conversationId, req._authKeyName);
         try { setCachedResponse(req._cacheHash, model, c); } catch (e) { logEvent("error", "cache_write_failed", { error: e.message }); }
         return c;
       });
@@ -1398,7 +1759,7 @@ async function handleChatCompletions(req, res) {
 
   // Fallback: cache disabled (CACHE_TTL=0) or no _cacheHash — original path untouched.
   try {
-    const content = await callClaude(model, messages, conversationId, req._authKeyName);
+    const content = await upstreamCall(model, messages, conversationId, req._authKeyName);
     const id = `chatcmpl-${randomUUID()}`;
     completionResponse(res, id, model, content);
     try { recordUsage({ keyId: req._authKeyId, keyName: req._authKeyName, model, promptChars, responseChars: content.length, elapsedMs: Date.now() - t0Usage, success: true }); } catch (e) { logEvent("error", "usage_record_failed", { error: e.message }); }
@@ -1508,6 +1869,12 @@ const server = createServer(async (req, res) => {
   req._authKeyName = authKeyName;
   req._authKeyId = authKeyId;
 
+  // isAdmin computed here (early, before any admin-gated handler) so that
+  // DELETE /sessions, GET /logs, GET /usage, GET /status, PATCH /settings
+  // can all gate on it.  Localhost and explicit admin key are always admin;
+  // in multi-tenant mode only the "admin" named key qualifies.
+  const isAdmin = AUTH_MODE !== "multi" || authKeyName === "admin" || isLocalhost;
+
   // GET /v1/models
   if (req.url === "/v1/models" && req.method === "GET") {
     return jsonResponse(res, 200, {
@@ -1569,15 +1936,17 @@ const server = createServer(async (req, res) => {
     });
   }
 
-  // DELETE /sessions — clear all sessions
+  // DELETE /sessions — clear all sessions (mutating; admin only)
   if (req.url === "/sessions" && req.method === "DELETE") {
+    if (!isAdmin) return jsonResponse(res, 403, { error: { message: "admin only", type: "auth_error" } });
     const count = sessions.size;
     sessions.clear();
     return jsonResponse(res, 200, { cleared: count });
   }
 
-  // GET /sessions — list active sessions
+  // GET /sessions — list active sessions (operator data; admin only)
   if (req.url === "/sessions" && req.method === "GET") {
+    if (!isAdmin) return jsonResponse(res, 403, { error: { message: "admin only", type: "auth_error" } });
     const list = [];
     for (const [id, s] of sessions) {
       // id is "${keyName}|${conversationId}"; expose only the public-facing conversationId
@@ -1587,34 +1956,45 @@ const server = createServer(async (req, res) => {
     return jsonResponse(res, 200, { sessions: list });
   }
 
-  // GET /usage — fetch plan usage limits from Anthropic API
+  // GET /usage — fetches plan usage from Anthropic API with operator token; admin only
   if (req.url === "/usage" && req.method === "GET") {
+    if (!isAdmin) return jsonResponse(res, 403, { error: { message: "admin only", type: "auth_error" } });
     return handleUsage(req, res);
   }
 
-  // GET /logs — recent proxy log entries (errors and key events)
+  // GET /logs — recent proxy log entries (errors and key events); admin only
   if (req.url?.startsWith("/logs") && req.method === "GET") {
+    if (!isAdmin) return jsonResponse(res, 403, { error: { message: "admin only", type: "auth_error" } });
     return handleLogs(req, res);
   }
 
-  // GET /status — combined usage + health summary
+  // GET /status — combined usage + health summary; uses operator token; admin only
   if (req.url === "/status" && req.method === "GET") {
+    if (!isAdmin) return jsonResponse(res, 403, { error: { message: "admin only", type: "auth_error" } });
     return handleStatus(req, res);
   }
 
-  // GET /settings — view current tunable settings
+  // GET /settings — view current tunable settings (admin only)
-  // PATCH /settings — update settings at runtime (JSON body)
+  // PATCH /settings — update settings at runtime (JSON body; admin only, mutating)
   if (req.url === "/settings" && (req.method === "GET" || req.method === "PATCH")) {
+    if (!isAdmin) return jsonResponse(res, 403, { error: { message: "admin only", type: "auth_error" } });
     return handleSettings(req, res);
   }
 
   // ── Key management API ──
-  const isAdmin = AUTH_MODE !== "multi" || authKeyName === "admin" || isLocalhost;
+  // (isAdmin is computed early in the request handler, before the admin-gated routes)
 
   if (req.url === "/api/keys" && req.method === "POST") {
     if (!isAdmin) return jsonResponse(res, 403, { error: "Admin access required" });
     let body = "";
-    for await (const chunk of req) body += chunk;
+    try {
+      for await (const chunk of req) { body += chunk; if (body.length > 10000) return jsonResponse(res, 413, { error: "Body too large" }); }
+    } catch (e) {
+      if (!res.headersSent && !res.writableEnded) {
+        try { return jsonResponse(res, 400, { error: { message: "request aborted", type: "invalid_request_error" } }); } catch {}
+      }
+      return;
+    }
     let parsed;
     try { parsed = JSON.parse(body); } catch { return jsonResponse(res, 400, { error: "Invalid JSON" }); }
     const name = parsed.name || `key-${Date.now()}`;
@@ -1640,7 +2020,14 @@ const server = createServer(async (req, res) => {
     if (!isAdmin) return jsonResponse(res, 403, { error: "Admin access required" });
     const idOrName = decodeURIComponent(req.url.split("/api/keys/")[1].replace("/quota", ""));
     let body = "";
-    for await (const chunk of req) { body += chunk; if (body.length > 10000) return jsonResponse(res, 413, { error: "Body too large" }); }
+    try {
+      for await (const chunk of req) { body += chunk; if (body.length > 10000) return jsonResponse(res, 413, { error: "Body too large" }); }
+    } catch (e) {
+      if (!res.headersSent && !res.writableEnded) {
+        try { return jsonResponse(res, 400, { error: { message: "request aborted", type: "invalid_request_error" } }); } catch {}
+      }
+      return;
+    }
     let quotaBody;
     try { quotaBody = JSON.parse(body); } catch { return jsonResponse(res, 400, { error: "Invalid JSON" }); }
     // Validate quota values: must be positive integers or null
@@ -1744,6 +2131,20 @@ const server = createServer(async (req, res) => {
 });
 
 
+// ── Process-level safety nets ────────────────────────────────────────────
+// Prevent unhandled async rejections and synchronous exceptions from crashing
+// the daemon. Each registers once at module level so they are installed before
+// the first request arrives. These are global no-ops on the happy path.
+process.on("unhandledRejection", (e) =>
+  logEvent("error", "unhandled_rejection", { error: e && e.message ? e.message : String(e) })
+);
+process.on("uncaughtException", (e) =>
+  logEvent("error", "uncaught_exception", { error: e && e.message ? e.message : String(e) })
+);
+// Destroy the socket on low-level HTTP parse errors so broken connections
+// don't accumulate as open file descriptors.
+server.on("clientError", (err, socket) => { try { socket.destroy(); } catch {} });
+
 // ── Graceful shutdown ────────────────────────────────────────────────────
 let shuttingDown = false;
 
@@ -1817,9 +2218,17 @@ server.listen(PORT, BIND_ADDRESS, () => {
   if (NO_CONTEXT) console.log(`Context: suppressed (CLAUDE_NO_CONTEXT=true — no CLAUDE.md, no auto-memory)`);
   if (CACHE_TTL > 0) console.log(`Cache: enabled (TTL=${CACHE_TTL / 1000}s)`);
   else console.log(`Cache: disabled (set CLAUDE_CACHE_TTL to enable)`);
+  if (TUI_MODE) {
+    console.warn(`⚠️  TUI-mode ON — single-user only; do NOT enable on a multi-user OCP (guest prompts would run claude with operator filesystem access). See ADR 0007.`);
+    console.log(`  TUI-mode: ON home=${TUI_HOME} cwd=${TUI_CWD} wallclock=${TUI_WALLCLOCK_MS}ms`);
+    try {
+      const n = reapStaleTuiSessions();
+      if (n) logEvent("info", "tui_reaped_stale_sessions", { count: n });
+    } catch {}
+  }
   console.log(`---`);
   console.log(`Coexistence: This proxy does NOT conflict with Claude Code interactive mode.`);
-  console.log(`  OCP uses: localhost:${PORT} (HTTP) → claude -p (per-request process)`);
+  console.log(`  OCP uses: localhost:${PORT} (HTTP) → claude --output-format stream-json (per-request process)`);
   console.log(`  CC uses:  MCP protocol (in-process) → persistent session`);
   console.log(`  Both can run simultaneously on the same machine.`);
 

setup.mjs

@@ -3,7 +3,8 @@
  * OCP (Open Claude Proxy) setup
  *
  * Automatically configures OpenClaw to use Claude CLI as a model provider.
- * Run: node setup.mjs [--port 3456] [--default-model opus|sonnet|haiku] [--dry-run]
+ * Run: node setup.mjs [--port N] [--default-model opus|sonnet|haiku] [--dry-run]
+ *      (default port = DEFAULT_PORT from lib/constants.mjs)
  *
  * What it does:
  *   1. Verifies claude CLI is installed and authenticated
@@ -18,6 +19,7 @@ import { execSync } from "node:child_process";
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
+import { DEFAULT_PORT } from "./lib/constants.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const HOME = homedir();
@@ -32,7 +34,7 @@ const opt = (name, fallback) => {
   return i >= 0 && args[i + 1] ? args[i + 1] : fallback;
 };
 
-const PORT = parseInt(opt("port", "3456"), 10);
+const PORT = parseInt(opt("port", String(DEFAULT_PORT)), 10);
 const DEFAULT_MODEL = opt("default-model", "opus"); // opus | sonnet | haiku
 const DRY_RUN = flag("dry-run");
 const SKIP_START = flag("no-start");

test-features.mjs

@@ -719,8 +719,8 @@ test("upgrade full path executes 5 phases", async () => {
 });
 
 // ── Snapshot Tests ──
-import { writeSnapshot, readSnapshot, listSnapshots } from "./scripts/lib/snapshot.mjs";
+import { writeSnapshot, readSnapshot, listSnapshots, gcSnapshots } from "./scripts/lib/snapshot.mjs";
-import { mkdtempSync, rmSync, mkdirSync as tMkdirSync, writeFileSync as testWriteFile } from "node:fs";
+import { mkdtempSync, rmSync, mkdirSync as tMkdirSync, writeFileSync as testWriteFile, existsSync as testExistsSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join as testJoin } from "node:path";
 
@@ -843,6 +843,703 @@ test("rollback latest snapshot restores files (mockExec)", async () => {
   assert.ok(result.phases.some(p => p.name === "git-checkout"));
 });
 
+test("gcSnapshots keeps last N regardless of age", () => {
+  const root = mkdtempSync(testJoin(tmpdir(), "ocp-gc-test-"));
+  const dotOcp = testJoin(root, ".ocp");
+  tMkdirSync(dotOcp, { recursive: true });
+  for (const ts of ["2026-04-01T10:00:00Z", "2026-04-15T10:00:00Z", "2026-04-30T10:00:00Z", "2026-05-01T10:00:00Z", "2026-05-10T10:00:00Z"]) {
+    tMkdirSync(testJoin(dotOcp, `upgrade-snapshot-${ts}`));
+  }
+  const result = gcSnapshots(root, { keepCount: 3, keepDays: 0, now: new Date("2026-05-11T00:00:00Z") });
+  assert.equal(result.kept.length, 3);
+  assert.equal(result.removed.length, 2);
+  assert.ok(result.kept[0].name.includes("2026-04-30"));
+  assert.ok(result.kept[2].name.includes("2026-05-10"));
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("gcSnapshots keeps snapshots newer than keepDays regardless of count", () => {
+  const root = mkdtempSync(testJoin(tmpdir(), "ocp-gc-days-"));
+  const dotOcp = testJoin(root, ".ocp");
+  tMkdirSync(dotOcp, { recursive: true });
+  for (const ts of ["2026-04-01T10:00:00Z", "2026-04-15T10:00:00Z", "2026-04-30T10:00:00Z", "2026-05-01T10:00:00Z", "2026-05-10T10:00:00Z"]) {
+    tMkdirSync(testJoin(dotOcp, `upgrade-snapshot-${ts}`));
+  }
+  // keepCount=1 but keepDays=15 means anything from after 2026-04-26 is kept too
+  const result = gcSnapshots(root, { keepCount: 1, keepDays: 15, now: new Date("2026-05-11T00:00:00Z") });
+  // Kept: 2026-04-30 (within 15 days), 2026-05-01 (within 15 days), 2026-05-10 (within 15 days)
+  assert.ok(result.kept.length >= 3);
+  // Removed: 2026-04-01, 2026-04-15
+  assert.ok(result.removed.some(s => s.name.includes("2026-04-01")));
+});
+
+test("gcSnapshots never deletes the most recent snapshot", () => {
+  const root = mkdtempSync(testJoin(tmpdir(), "ocp-gc-recent-"));
+  const dotOcp = testJoin(root, ".ocp");
+  tMkdirSync(dotOcp, { recursive: true });
+  tMkdirSync(testJoin(dotOcp, "upgrade-snapshot-2026-01-01T10:00:00Z"));
+  // Even with keepCount=0 and keepDays=0, the most recent must survive
+  const result = gcSnapshots(root, { keepCount: 0, keepDays: 0, now: new Date("2026-05-11T00:00:00Z") });
+  assert.equal(result.kept.length, 1);
+  assert.equal(result.removed.length, 0);
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("gcSnapshots --dry-run reports plan without deleting", () => {
+  const root = mkdtempSync(testJoin(tmpdir(), "ocp-gc-dryrun-"));
+  const dotOcp = testJoin(root, ".ocp");
+  tMkdirSync(dotOcp, { recursive: true });
+  for (const ts of ["2026-04-01T10:00:00Z", "2026-04-15T10:00:00Z", "2026-05-10T10:00:00Z"]) {
+    tMkdirSync(testJoin(dotOcp, `upgrade-snapshot-${ts}`));
+  }
+  const result = gcSnapshots(root, { keepCount: 1, keepDays: 0, dryRun: true, now: new Date("2026-05-11T00:00:00Z") });
+  assert.equal(result.dryRun, true);
+  assert.equal(result.removed.length, 2);
+  // Files still exist
+  assert.ok(testExistsSync(testJoin(dotOcp, "upgrade-snapshot-2026-04-01T10:00:00Z")));
+  rmSync(root, { recursive: true, force: true });
+});
+
+// ── Doctor --check oauth fast path tests ──
+console.log("\nDoctor --check oauth:");
+
+await asyncTest("doctor --check oauth runs only oauth check (skips version/from-version)", async () => {
+  const result = await runDoctor({
+    checkOnly: "oauth",
+    mockVersion: "v3.10.0",
+    mockLatest: "v3.14.0",
+    mockHealth: { status: 200, body: { auth: { ok: true, message: "authenticated" } } }
+  });
+  // Should still produce a valid result object
+  assert.equal(result.schema_version, "1");
+  // checks[] should only contain oauth_ok (no current_version, no from_version_supported)
+  const ids = result.checks.map(c => c.id);
+  assert.deepEqual(ids, ["oauth_ok"]);
+  assert.equal(result.next_action.kind, "noop");
+});
+
+await asyncTest("doctor --check oauth + OAuth FAIL → fix_oauth", async () => {
+  const result = await runDoctor({
+    checkOnly: "oauth",
+    mockHealth: { status: 200, body: { auth: { ok: false, message: "ENOEXEC" } } }
+  });
+  const ids = result.checks.map(c => c.id);
+  assert.deepEqual(ids, ["oauth_ok"]);
+  assert.equal(result.next_action.kind, "fix_oauth");
+  assert.equal(result.fail_count, 1);
+});
+
+await asyncTest("doctor --check oauth + service down → fix_service", async () => {
+  const result = await runDoctor({
+    checkOnly: "oauth",
+    mockHealth: { error: "ECONNREFUSED" }
+  });
+  const ids = result.checks.map(c => c.id);
+  assert.deepEqual(ids, ["oauth_ok"]);
+  assert.equal(result.next_action.kind, "fix_service");
+  assert.equal(result.fail_count, 1);
+});
+
+await asyncTest("doctor --check oauth + 200 with null body → fix_service", async () => {
+  const result = await runDoctor({
+    checkOnly: "oauth",
+    mockHealth: { status: 200, body: null }
+  });
+  const ids = result.checks.map(c => c.id);
+  assert.deepEqual(ids, ["oauth_ok"]);
+  assert.equal(result.next_action.kind, "fix_service");
+  assert.equal(result.fail_count, 1);
+});
+
+// ── Stream-JSON parser tests ──────────────────────────────────────────────
+// MIRRORS server.mjs parseStreamJsonLines/parseStreamJsonEvent — keep in sync.
+// Copied verbatim to avoid importing server.mjs (top-level server.listen() would
+// start a live HTTP server). The logEvent stub silences observability side-effects.
+console.log("\nStream-JSON parsers:");
+
+function logEvent() {} // stub — observability side-effect not needed in tests
+
+function parseStreamJsonLines(buffered) {
+  const lines = buffered.split("\n");
+  const remainder = lines.pop(); // last element is the incomplete trailing line
+  const events = [];
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed === "") continue;
+    try {
+      events.push(JSON.parse(trimmed));
+    } catch {
+      console.error("[claude] NDJSON parse error on line:", trimmed.slice(0, 120));
+      events.push({ type: "parse_error", raw: trimmed });
+    }
+  }
+  return { events, remainder: remainder ?? "" };
+}
+
+function parseStreamJsonEvent(event, isFirstDelta) {
+  const t = event?.type;
+
+  // system/* — first-event init + other system meta (api_retry etc.)
+  if (t === "system") return null;
+  // user — echo of user message; consumed
+  if (t === "user") return null;
+
+  // stream_event — contains nested content_block_delta
+  if (t === "stream_event") {
+    const inner = event.event ?? event;
+    if (inner?.type === "content_block_delta" && inner.delta?.type === "text_delta") {
+      return { text: inner.delta.text ?? "" };
+    }
+    // Other stream_event sub-types (content_block_start, message_delta, etc.) — consumed
+    return null;
+  }
+
+  // assistant — aggregate message (fallback when no prior content_block_delta seen)
+  // Empirically (claude CLI without --include-partial-messages, verified v2.1.104 through v2.1.158): fast/short
+  // responses may emit ONLY the aggregate assistant event, no content_block_delta events.
+  // If isFirstDelta is true, extract text here; otherwise it's a duplicate, ignore.
+  // Reference: OLP commit 65f945c (assistant-aggregate fallback, fold-in).
+  if (t === "assistant") {
+    if (isFirstDelta) {
+      const blocks = event.message?.content;
+      if (Array.isArray(blocks)) {
+        const text = blocks
+          .filter(b => b && b.type === "text" && typeof b.text === "string")
+          .map(b => b.text)
+          .join("");
+        if (text) return { text };
+      }
+    }
+    return null;
+  }
+
+  // result — terminal event
+  if (t === "result") {
+    if (event.is_error === true) {
+      return { error: event.error_message ?? event.result ?? "claude returned is_error" };
+    }
+    return { stop: true };
+  }
+
+  // rate_limit_event / usage — log for observability, don't forward
+  if (t === "rate_limit_event" || t === "usage") {
+    logEvent("info", "claude_stream_event", { type: t, data: JSON.stringify(event).slice(0, 200) });
+    return null;
+  }
+
+  // control_request — per Anthropic stream-json docs
+  if (t === "control_request") {
+    console.error("[claude] stream_json control_request event (ignored):", JSON.stringify(event).slice(0, 120));
+    return null;
+  }
+
+  // parse_error — already logged by parseStreamJsonLines
+  if (t === "parse_error") return null;
+
+  // Unknown event type — log + skip; future-proof for new claude CLI events
+  if (t !== undefined) {
+    console.error("[claude] unknown stream_json event type:", t);
+  }
+  return null;
+}
+
+// (a) content_block_delta deltas + assistant-aggregate fallback → assembled text with NO double-count
+test("parseStreamJsonEvent: stream_event content_block_delta yields text", () => {
+  const event = {
+    type: "stream_event",
+    event: { type: "content_block_delta", delta: { type: "text_delta", text: "Hello" } }
+  };
+  const result = parseStreamJsonEvent(event, true);
+  assert.deepEqual(result, { text: "Hello" });
+});
+
+test("parseStreamJsonEvent: assistant-aggregate used when isFirstDelta=true (no prior delta)", () => {
+  const event = {
+    type: "assistant",
+    message: { content: [{ type: "text", text: "Short answer." }] }
+  };
+  const result = parseStreamJsonEvent(event, true);
+  assert.deepEqual(result, { text: "Short answer." });
+});
+
+test("parseStreamJsonEvent: assistant-aggregate skipped when isFirstDelta=false (no double-count)", () => {
+  const event = {
+    type: "assistant",
+    message: { content: [{ type: "text", text: "Short answer." }] }
+  };
+  const result = parseStreamJsonEvent(event, false);
+  assert.equal(result, null);
+});
+
+test("parseStreamJsonEvent: stream_event + assistant → assembled without double-count", () => {
+  // Simulate receiving a content_block_delta first, then an assistant aggregate
+  const delta = {
+    type: "stream_event",
+    event: { type: "content_block_delta", delta: { type: "text_delta", text: "Streaming text." } }
+  };
+  const agg = {
+    type: "assistant",
+    message: { content: [{ type: "text", text: "Streaming text." }] }
+  };
+  // First event: isFirstDelta=true → yields text
+  const r1 = parseStreamJsonEvent(delta, true);
+  assert.deepEqual(r1, { text: "Streaming text." });
+  // Second event (aggregate): isFirstDelta is now false (content already emitted) → null
+  const r2 = parseStreamJsonEvent(agg, false);
+  assert.equal(r2, null);
+});
+
+// (b) aggregate-only short response → assembles correctly
+test("parseStreamJsonEvent: aggregate-only multi-block response assembles all text blocks", () => {
+  const event = {
+    type: "assistant",
+    message: {
+      content: [
+        { type: "text", text: "Part one." },
+        { type: "tool_use", id: "x" }, // non-text block — should be filtered
+        { type: "text", text: " Part two." }
+      ]
+    }
+  };
+  const result = parseStreamJsonEvent(event, true);
+  assert.deepEqual(result, { text: "Part one. Part two." });
+});
+
+// (c) JSON line split across two parseStreamJsonLines calls → partial-line buffering
+test("parseStreamJsonLines: partial line carried as remainder", () => {
+  const chunk1 = '{"type":"system","subtype":"init"}\n{"type":"stream_ev';
+  const { events: ev1, remainder: rem1 } = parseStreamJsonLines(chunk1);
+  assert.equal(ev1.length, 1);
+  assert.equal(ev1[0].type, "system");
+  assert.equal(rem1, '{"type":"stream_ev');
+
+  const chunk2 = rem1 + 'ent","event":{"type":"content_block_delta","delta":{"type":"text_delta","text":"Hi"}}}\n';
+  const { events: ev2, remainder: rem2 } = parseStreamJsonLines(chunk2);
+  assert.equal(ev2.length, 1);
+  assert.equal(ev2[0].type, "stream_event");
+  assert.equal(rem2, "");
+  // Verify the reassembled event parses through parseStreamJsonEvent correctly
+  const parsed = parseStreamJsonEvent(ev2[0], true);
+  assert.deepEqual(parsed, { text: "Hi" });
+});
+
+test("parseStreamJsonLines: empty input returns no events and empty remainder", () => {
+  const { events, remainder } = parseStreamJsonLines("");
+  assert.equal(events.length, 0);
+  assert.equal(remainder, "");
+});
+
+// (d) is_error result event → surfaces the error
+test("parseStreamJsonEvent: result is_error=true surfaces error_message", () => {
+  const event = { type: "result", is_error: true, error_message: "Rate limit hit" };
+  const result = parseStreamJsonEvent(event, false);
+  assert.deepEqual(result, { error: "Rate limit hit" });
+});
+
+test("parseStreamJsonEvent: result is_error=true falls back to result field when no error_message", () => {
+  const event = { type: "result", is_error: true, result: "error detail" };
+  const result = parseStreamJsonEvent(event, false);
+  assert.deepEqual(result, { error: "error detail" });
+});
+
+test("parseStreamJsonEvent: result is_error=true falls back to default string when no detail", () => {
+  const event = { type: "result", is_error: true };
+  const result = parseStreamJsonEvent(event, false);
+  assert.deepEqual(result, { error: "claude returned is_error" });
+});
+
+test("parseStreamJsonEvent: result is_error=false yields stop", () => {
+  const event = { type: "result", is_error: false, result: "success" };
+  const result = parseStreamJsonEvent(event, false);
+  assert.deepEqual(result, { stop: true });
+});
+
+// (e) malformed/non-JSON line → skipped without throwing
+test("parseStreamJsonLines: malformed JSON line becomes parse_error event without throwing", () => {
+  const input = '{"type":"system"}\nnot-valid-json\n{"type":"result","is_error":false}\n';
+  const { events, remainder } = parseStreamJsonLines(input);
+  assert.equal(events.length, 3);
+  assert.equal(events[0].type, "system");
+  assert.equal(events[1].type, "parse_error");
+  assert.equal(events[1].raw, "not-valid-json");
+  assert.equal(events[2].type, "result");
+});
+
+test("parseStreamJsonEvent: parse_error event returns null without throwing", () => {
+  const event = { type: "parse_error", raw: "garbage" };
+  const result = parseStreamJsonEvent(event, false);
+  assert.equal(result, null);
+});
+
+// Additional edge cases
+test("parseStreamJsonEvent: system event returns null", () => {
+  const result = parseStreamJsonEvent({ type: "system", subtype: "init" }, true);
+  assert.equal(result, null);
+});
+
+test("parseStreamJsonEvent: user event returns null", () => {
+  const result = parseStreamJsonEvent({ type: "user", message: {} }, true);
+  assert.equal(result, null);
+});
+
+test("parseStreamJsonEvent: stream_event non-text-delta (content_block_start) returns null", () => {
+  const event = { type: "stream_event", event: { type: "content_block_start", index: 0 } };
+  const result = parseStreamJsonEvent(event, true);
+  assert.equal(result, null);
+});
+
+test("parseStreamJsonEvent: unknown event type returns null", () => {
+  const result = parseStreamJsonEvent({ type: "future_event_type" }, false);
+  assert.equal(result, null);
+});
+// ── Suite: streamStringAsSSE wire-format ────────────────────────────────
+// streamStringAsSSE is not exported from server.mjs (internal helper), so we
+// test the wire format contract using a local implementation with the same
+// logic.  This validates the protocol shape (role chunk → content chunks →
+// stop → [DONE]) that both the cache-hit replay and TUI streaming paths rely on.
+console.log("\nstreamStringAsSSE wire-format:");
+
+function _testSendSSE(res, data) { res.write(`data: ${JSON.stringify(data)}\n\n`); }
+
+function _testStreamStringAsSSE(res, id, model, content) {
+  const created = Math.floor(Date.now() / 1000);
+  res.writeHead(200, { "Content-Type": "text/event-stream" });
+  _testSendSSE(res, { id, object: "chat.completion.chunk", created, model, choices: [{ index: 0, delta: { role: "assistant" }, finish_reason: null }] });
+  const CHUNK = 80;
+  const codepoints = Array.from(content);
+  for (let i = 0; i < codepoints.length; i += CHUNK) {
+    _testSendSSE(res, { id, object: "chat.completion.chunk", created, model, choices: [{ index: 0, delta: { content: codepoints.slice(i, i + CHUNK).join("") }, finish_reason: null }] });
+  }
+  _testSendSSE(res, { id, object: "chat.completion.chunk", created, model, choices: [{ index: 0, delta: {}, finish_reason: "stop" }] });
+  res.write("data: [DONE]\n\n");
+  res.end();
+}
+
+function _makeFakeRes() {
+  const writes = [];
+  let headsSent = false;
+  return {
+    writes,
+    writeHead(status, headers) { headsSent = true; this._status = status; this._headers = headers; },
+    write(s) { writes.push(s); },
+    end() { this._ended = true; },
+  };
+}
+
+test("streamStringAsSSE emits role chunk + content chunks + stop + [DONE]", () => {
+  const res = _makeFakeRes();
+  const content = "hello world";
+  _testStreamStringAsSSE(res, "test-id", "claude-haiku", content);
+  assert.ok(res._status === 200, "writeHead(200) called");
+  assert.ok(res._ended, "res.end() called");
+  // First write: role delta
+  const firstEvent = JSON.parse(res.writes[0].replace(/^data: /, "").trim());
+  assert.equal(firstEvent.choices[0].delta.role, "assistant");
+  assert.equal(firstEvent.choices[0].finish_reason, null);
+  // Since content < 80 chars it fits in one chunk
+  const secondEvent = JSON.parse(res.writes[1].replace(/^data: /, "").trim());
+  assert.equal(secondEvent.choices[0].delta.content, content);
+  // Second-to-last: stop chunk
+  const stopEvent = JSON.parse(res.writes[res.writes.length - 2].replace(/^data: /, "").trim());
+  assert.equal(stopEvent.choices[0].finish_reason, "stop");
+  // Last: [DONE]
+  assert.equal(res.writes[res.writes.length - 1], "data: [DONE]\n\n");
+});
+
+test("streamStringAsSSE splits content at 80 codepoints per chunk", () => {
+  const res = _makeFakeRes();
+  const content = "x".repeat(200); // 3 chunks: 80+80+40
+  _testStreamStringAsSSE(res, "test-id-2", "claude-haiku", content);
+  // writes: [role_chunk, content_chunk_1, content_chunk_2, content_chunk_3, stop_chunk, [DONE]]
+  assert.equal(res.writes.length, 6);
+  const c1 = JSON.parse(res.writes[1].replace(/^data: /, "").trim());
+  assert.equal(c1.choices[0].delta.content.length, 80);
+  const c2 = JSON.parse(res.writes[2].replace(/^data: /, "").trim());
+  assert.equal(c2.choices[0].delta.content.length, 80);
+  const c3 = JSON.parse(res.writes[3].replace(/^data: /, "").trim());
+  assert.equal(c3.choices[0].delta.content.length, 40);
+});
+
+test("streamStringAsSSE empty content: role + stop + [DONE] only", () => {
+  const res = _makeFakeRes();
+  _testStreamStringAsSSE(res, "test-id-3", "claude-haiku", "");
+  // writes: [role_chunk, stop_chunk, [DONE]]
+  assert.equal(res.writes.length, 3);
+  const stop = JSON.parse(res.writes[1].replace(/^data: /, "").trim());
+  assert.equal(stop.choices[0].finish_reason, "stop");
+  assert.equal(res.writes[2], "data: [DONE]\n\n");
+});
+
+// ── Suite: TUI transcript reader ────────────────────────────────────────
+import { encodeCwd, transcriptPath, findTranscriptPath, parseTranscriptLines, isTerminalLine, extractLatestAssistantText, verifyEntrypoint } from "./lib/tui/transcript.mjs";
+import { readFileSync as tuiReadFileSync, mkdtempSync as tuiMkdtemp0, mkdirSync as tuiMkdir0, writeFileSync as tuiWrite0 } from "node:fs";
+import { tmpdir as tuiTmp0 } from "node:os";
+
+console.log("\nTUI transcript — path formula:");
+
+test("encodeCwd replaces every slash AND every dot with dash", () => {
+  // Verified live (claude v2.1.158): /home/u/.ocp-tui/work -> -home-u--ocp-tui-work
+  assert.equal(encodeCwd("/home/u/.ocp-tui/work"), "-home-u--ocp-tui-work");
+  assert.equal(encodeCwd("/tmp/tui-test"), "-tmp-tui-test"); // dot-free path still correct
+});
+test("transcriptPath composes HOME/.claude/projects/<enc>/<sid>.jsonl", () => {
+  assert.equal(
+    transcriptPath("/home/u", "/home/u/.ocp-tui/work", "abc-123"),
+    "/home/u/.claude/projects/-home-u--ocp-tui-work/abc-123.jsonl"
+  );
+});
+test("findTranscriptPath locates <sid>.jsonl across projects subdirs by UUID", () => {
+  const home = tuiMkdtemp0(`${tuiTmp0()}/tui-home-`);
+  const sid = "11111111-2222-3333-4444-555555555555";
+  const proj = `${home}/.claude/projects/-some--weird-encoding`;
+  tuiMkdir0(proj, { recursive: true });
+  tuiWrite0(`${proj}/${sid}.jsonl`, "{}\n");
+  assert.equal(findTranscriptPath(home, sid), `${proj}/${sid}.jsonl`);
+  assert.equal(findTranscriptPath(home, "no-such-uuid"), null);
+  assert.equal(findTranscriptPath(null, sid), null);
+});
+
+console.log("\nTUI transcript — parsing + terminal detection:");
+
+test("parseTranscriptLines skips blank + malformed/partial lines", () => {
+  const evs = parseTranscriptLines('{"a":1}\n\n{bad json\n{"b":2}\n');
+  assert.equal(evs.length, 2);
+  assert.equal(evs[1].b, 2);
+});
+test("isTerminalLine true on turn_duration", () => {
+  assert.equal(isTerminalLine({ type: "system", subtype: "turn_duration" }), true);
+});
+test("isTerminalLine false on stop_reason tool_use (message-wrapped) — tool_use is mid-turn in TUI mode", () => {
+  assert.equal(isTerminalLine({ type: "assistant", message: { stop_reason: "tool_use" } }), false);
+});
+test("isTerminalLine false on stop_reason tool_use (flat) — claude continues after tool, turn not done", () => {
+  assert.equal(isTerminalLine({ stop_reason: "tool_use" }), false);
+});
+test("isTerminalLine false on ordinary assistant text line", () => {
+  assert.equal(isTerminalLine({ type: "assistant", message: { content: [{ type: "text", text: "hi" }] } }), false);
+});
+test("extractLatestAssistantText concatenates text blocks of LAST assistant entry", () => {
+  const evs = [
+    { type: "assistant", message: { content: [{ type: "text", text: "first" }] } },
+    { type: "user", message: { content: "..." } },
+    { type: "assistant", message: { content: [{ type: "text", text: "A" }, { type: "thinking", thinking: "x" }, { type: "text", text: "B" }] } },
+  ];
+  assert.equal(extractLatestAssistantText(evs), "AB");
+});
+test("extractLatestAssistantText ignores thinking-only assistant entries", () => {
+  // Fixture shape: thinking block and text block are SEPARATE top-level entries sharing same msg id
+  const evs = [
+    { type: "assistant", message: { content: [{ type: "thinking", thinking: "hmm" }] } },
+    { type: "assistant", message: { content: [{ type: "text", text: "PONG" }] } },
+  ];
+  assert.equal(extractLatestAssistantText(evs), "PONG");
+});
+test("real complete fixture: parseTranscriptLines yields >0 events", () => {
+  const evs = parseTranscriptLines(tuiReadFileSync("./lib/tui/fixtures/complete-haiku.jsonl", "utf8"));
+  assert.ok(evs.length > 0, "fixture must parse to events");
+});
+test("real complete fixture: at least one isTerminalLine", () => {
+  const evs = parseTranscriptLines(tuiReadFileSync("./lib/tui/fixtures/complete-haiku.jsonl", "utf8"));
+  assert.ok(evs.some(isTerminalLine), "fixture must contain a terminal line");
+});
+test("real complete fixture: extractLatestAssistantText returns non-empty text", () => {
+  const evs = parseTranscriptLines(tuiReadFileSync("./lib/tui/fixtures/complete-haiku.jsonl", "utf8"));
+  assert.ok(extractLatestAssistantText(evs).length > 0, "fixture must yield assistant text");
+});
+test("real complete fixture: extractLatestAssistantText returns the FINAL text, not the first", () => {
+  // The fixture's first assistant text is "PONG"; it is followed by 8 later refusal
+  // turns. Pinning the exact FINAL string guards the overwrite-to-last semantic —
+  // a regression that returned the first text block would still pass a length check.
+  const evs = parseTranscriptLines(tuiReadFileSync("./lib/tui/fixtures/complete-haiku.jsonl", "utf8"));
+  assert.equal(extractLatestAssistantText(evs), "I'm moving on. If you have a genuine task, let me know.");
+});
+test("real complete fixture: verifyEntrypoint returns 'cli'", () => {
+  const evs = parseTranscriptLines(tuiReadFileSync("./lib/tui/fixtures/complete-haiku.jsonl", "utf8"));
+  assert.equal(verifyEntrypoint(evs), "cli");
+});
+
+// ── TUI transcript — polling reader (async) ──────────────────────────────
+import { readTuiTranscript } from "./lib/tui/transcript.mjs";
+import { mkdtempSync as tuiMkdtemp, writeFileSync as tuiWriteFile } from "node:fs";
+import { tmpdir as tuiTmpdir } from "node:os";
+
+console.log("\nTUI transcript — polling reader:");
+
+await asyncTest("readTuiTranscript returns assistant text when terminal marker present", async () => {
+  const dir = tuiMkdtemp(`${tuiTmpdir()}/tui-`);
+  const p = `${dir}/s.jsonl`;
+  tuiWriteFile(p, [
+    JSON.stringify({ type: "assistant", message: { content: [{ type: "text", text: "hello world" }] } }),
+    JSON.stringify({ type: "system", subtype: "turn_duration", durationMs: 1200 }),
+  ].join("\n") + "\n");
+  const out = await readTuiTranscript({ transcriptPath: p, wallclockMs: 2000, pollMs: 50 });
+  assert.equal(out, "hello world");
+});
+
+await asyncTest("readTuiTranscript honours wall-clock cap and returns partial text", async () => {
+  const dir = tuiMkdtemp(`${tuiTmpdir()}/tui-`);
+  const p = `${dir}/s.jsonl`;
+  tuiWriteFile(p, JSON.stringify({ type: "assistant", message: { content: [{ type: "text", text: "partial" }] } }) + "\n");
+  const out = await readTuiTranscript({ transcriptPath: p, wallclockMs: 300, pollMs: 50 });
+  assert.equal(out, "partial");
+});
+
+await asyncTest("readTuiTranscript throws when no text and cap elapses", async () => {
+  const dir = tuiMkdtemp(`${tuiTmpdir()}/tui-`);
+  const p = `${dir}/missing.jsonl`;
+  let threw = false;
+  try { await readTuiTranscript({ transcriptPath: p, wallclockMs: 200, pollMs: 50 }); }
+  catch { threw = true; }
+  assert.ok(threw, "must throw on empty timeout");
+});
+
+// ── TUI session reaper ───────────────────────────────────────────────────
+import { reapStaleTuiSessions, SESSION_PREFIX } from "./lib/tui/session.mjs";
+
+console.log("\nTUI session reaper:");
+
+test("SESSION_PREFIX is ocp-tui-", () => {
+  assert.equal(SESSION_PREFIX, "ocp-tui-");
+});
+
+test("reaper kills ONLY ocp-tui- sessions, never olp-tui-", () => {
+  const killed = [];
+  const fakeTmux = (args) => {
+    if (args[0] === "list-sessions") return { status: 0, stdout: "ocp-tui-aaaa\nolp-tui-bbbb\nmisc\nocp-tui-cccc\n" };
+    if (args[0] === "kill-session") { killed.push(args[args.indexOf("-t") + 1]); return { status: 0 }; }
+    return { status: 0, stdout: "" };
+  };
+  const n = reapStaleTuiSessions({ tmux: fakeTmux });
+  assert.equal(n, 2);
+  assert.equal(killed.join(","), "ocp-tui-aaaa,ocp-tui-cccc");
+  assert.ok(!killed.includes("olp-tui-bbbb"), "olp-tui-bbbb must never be killed");
+});
+
+test("reaper returns 0 when tmux status !== 0 (no server)", () => {
+  const fakeTmux = (_args) => ({ status: 1, stdout: "" });
+  const n = reapStaleTuiSessions({ tmux: fakeTmux });
+  assert.equal(n, 0);
+});
+
+test("reaper returns 0 for empty session list", () => {
+  const killed = [];
+  const fakeTmux = (args) => {
+    if (args[0] === "list-sessions") return { status: 0, stdout: "" };
+    if (args[0] === "kill-session") { killed.push(args[args.indexOf("-t") + 1]); return { status: 0 }; }
+    return { status: 0, stdout: "" };
+  };
+  const n = reapStaleTuiSessions({ tmux: fakeTmux });
+  assert.equal(n, 0);
+  assert.equal(killed.length, 0);
+});
+
+// ── TUI home preparation (scratch vs real) ───────────────────────────────
+import { prepareTuiHome, ensureTuiCwdTrusted } from "./lib/tui/session.mjs";
+import { mkdtempSync as hMkdtemp, mkdirSync as hMkdir, writeFileSync as hWrite, readFileSync as hRead, existsSync as hExists, readlinkSync as hReadlink } from "node:fs";
+import { tmpdir as hTmp } from "node:os";
+
+console.log("\nTUI home preparation:");
+
+test("prepareTuiHome scratch mode: symlinks creds, seeds onboarded config, trusts cwd, strips history", () => {
+  const realHome = hMkdtemp(`${hTmp()}/real-`);
+  hMkdir(`${realHome}/.claude`, { recursive: true });
+  hWrite(`${realHome}/.claude/.credentials.json`, '{"token":"x"}');
+  hWrite(`${realHome}/.claude.json`, JSON.stringify({ theme: "dark", projects: { "/old/secret/project": { hasTrustDialogAccepted: true } } }));
+  const tuiHome = hMkdtemp(`${hTmp()}/tui-`);
+  const cwd = `${tuiHome}/work`;
+  prepareTuiHome(realHome, tuiHome, cwd);
+  // credentials symlinked (token never copied)
+  assert.equal(hReadlink(`${tuiHome}/.claude/.credentials.json`), `${realHome}/.claude/.credentials.json`);
+  const seed = JSON.parse(hRead(`${tuiHome}/.claude.json`, "utf8"));
+  assert.equal(seed.hasCompletedOnboarding, true);
+  assert.equal(seed.theme, "dark");                                   // onboarded config carried over
+  assert.equal(seed.projects[cwd].hasTrustDialogAccepted, true);      // scratch cwd trusted
+  assert.equal(seed.projects["/old/secret/project"], undefined);      // user project history stripped
+  assert.ok(hExists(`${tuiHome}/.claude/projects`));                  // own projects dir
+});
+
+test("prepareTuiHome real mode (tuiHome===realHome): no symlink, just trusts cwd in real config", () => {
+  const realHome = hMkdtemp(`${hTmp()}/real2-`);
+  hWrite(`${realHome}/.claude.json`, JSON.stringify({ projects: {} }));
+  const cwd = `${realHome}/work`;
+  prepareTuiHome(realHome, realHome, cwd);
+  assert.ok(!hExists(`${realHome}/.claude/.credentials.json`));        // no scratch symlink created
+  const j = JSON.parse(hRead(`${realHome}/.claude.json`, "utf8"));
+  assert.equal(j.projects[cwd].hasTrustDialogAccepted, true);         // cwd trusted in real config
+});
+
+// ── resolveTuiEntrypointEnv ───────────────────────────────────────────────
+import { resolveTuiEntrypointEnv } from "./lib/tui/session.mjs";
+
+console.log("\nresolveTuiEntrypointEnv:");
+
+test("mode 'cli' sets CLAUDE_CODE_ENTRYPOINT=cli", () => {
+  const env = {};
+  resolveTuiEntrypointEnv(env, "cli");
+  assert.equal(env.CLAUDE_CODE_ENTRYPOINT, "cli");
+});
+
+test("mode 'cli' overwrites an inherited CLAUDE_CODE_ENTRYPOINT value", () => {
+  const env = { CLAUDE_CODE_ENTRYPOINT: "sdk-cli" };
+  resolveTuiEntrypointEnv(env, "cli");
+  assert.equal(env.CLAUDE_CODE_ENTRYPOINT, "cli");
+});
+
+test("mode 'auto' deletes CLAUDE_CODE_ENTRYPOINT (leaves unset)", () => {
+  const env = {};
+  resolveTuiEntrypointEnv(env, "auto");
+  assert.equal(env.CLAUDE_CODE_ENTRYPOINT, undefined);
+  assert.ok(!Object.prototype.hasOwnProperty.call(env, "CLAUDE_CODE_ENTRYPOINT"));
+});
+
+test("mode 'auto' deletes an inherited CLAUDE_CODE_ENTRYPOINT value", () => {
+  const env = { CLAUDE_CODE_ENTRYPOINT: "sdk-cli" };
+  resolveTuiEntrypointEnv(env, "auto");
+  assert.equal(env.CLAUDE_CODE_ENTRYPOINT, undefined);
+  assert.ok(!Object.prototype.hasOwnProperty.call(env, "CLAUDE_CODE_ENTRYPOINT"));
+});
+
+test("mode 'off' leaves an inherited CLAUDE_CODE_ENTRYPOINT value untouched", () => {
+  const env = { CLAUDE_CODE_ENTRYPOINT: "sdk-cli" };
+  resolveTuiEntrypointEnv(env, "off");
+  assert.equal(env.CLAUDE_CODE_ENTRYPOINT, "sdk-cli");
+});
+
+test("mode 'off' with no inherited value leaves env unchanged", () => {
+  const env = { OTHER: "x" };
+  resolveTuiEntrypointEnv(env, "off");
+  assert.equal(env.CLAUDE_CODE_ENTRYPOINT, undefined);
+  assert.equal(env.OTHER, "x");
+});
+
+test("default mode (no second arg) behaves like 'cli'", () => {
+  const env = { CLAUDE_CODE_ENTRYPOINT: "sdk-cli" };
+  resolveTuiEntrypointEnv(env);
+  assert.equal(env.CLAUDE_CODE_ENTRYPOINT, "cli");
+});
+
+// ── TUI session driver: runTuiTurn (live-only, guarded) ──────────────────
+console.log("\nTUI session driver:");
+
+if (process.env.OCP_TUI_LIVE === "1") {
+  await asyncTest("runTuiTurn drives a real interactive turn and returns text", async () => {
+    const { runTuiTurn } = await import("./lib/tui/session.mjs");
+    const out = await runTuiTurn({
+      prompt: "Reply with exactly the word PONG and nothing else.",
+      model: "claude-haiku-4-5-20251001",
+      claudeBin: process.env.OCP_TUI_CLAUDE_BIN || "claude",
+      home: process.env.HOME,
+      cwd: `${process.env.HOME}/.ocp-tui/work`,
+      wallclockMs: 120000,
+    });
+    assert.ok(/PONG/i.test(out), `expected PONG, got: ${out.slice(0, 200)}`);
+  });
+} else {
+  test("runTuiTurn (live) — SKIPPED (set OCP_TUI_LIVE=1 on PI231 to run)", () => {
+    assert.ok(true);
+  });
+}
+
 // ── Cleanup ──
 closeDb();