docs(changelog): correct contributor count — four of six PRs are @vvlasy-openclaw's, not two (release reviewer)

Consolidates #179/#153/#154/#183/#181/#182 (merged since the v3.23.0 tag).
3.23.0 → 3.24.0.

Minor: four user-facing features (multimodal vision #154, structured outputs
#153, SPOT-derived prompt budget #179, OCP_LOCAL_TOOLS #182) + two fixes
(#183 agentic final-answer, #181 deep-reply-500). No breaking change; no new
endpoint; no new cli.js wire behavior. Two features from @vvlasy-openclaw.

Release-kit walk: new env vars all documented in-PR (CLAUDE_IMAGE_ALLOW_URL /
CLAUDE_MAX_IMAGE_* #154, OCP_STRUCTURED_MAX_ATTEMPTS #153, OCP_LOCAL_TOOLS #182 —
grepped present in README env table); ADR 0009 (#179) + ADR 0006 (B.1, #153/#154)
indexed; version from package.json only (no stale refs); the CHANGELOG Unreleased
section (which held #182) is retitled to v3.24.0 with the other five entries added.

Tag push v3.24.0 at this squash commit triggers release.yml.

Co-Authored-By: Claude <claude-opus-4-8> <noreply@anthropic.com>

docs/tui-mode.md

@@ -65,7 +65,7 @@ Then restart OCP. At boot you will see (with the env token set, isolated home au
 - **Callers see no API change.** The response is a normal OpenAI completion object or chunked SSE — identical wire format.
 - **Real streaming is opt-in (`OCP_TUI_STREAM=1`), and off by default.** By default TUI-mode buffers the full response and replays it as chunked SSE — you see a delay, then the complete response. Set `OCP_TUI_STREAM=1` and `stream:true` turns emit real SSE `delta.content` chunks as `claude` renders them, sourced from `claude`'s own `MessageDisplay` hook (byte-faithful raw markdown, on the subscription pool, no `-p`). Two honest caveats: granularity is **block-level** — the hook fires once per rendered block, so a handful of chunks per answer, scaling with length, not token-by-token; and it moves the **first** byte, not the last, so a consumer that must parse a complete reply gains nothing. The transcript stays authoritative: every streamed turn is asserted against it at the end, and a turn whose stream disagrees is **failed rather than served** (watch `tui.streamDivergences` on `/health`). Evidence: [`plans/2026-07-13-tui-latency/streaming-spike.md`](plans/2026-07-13-tui-latency/streaming-spike.md).
 - **Cache and singleflight work normally.** TUI-mode writes the buffered response to the cache on success; cache-hits skip the interactive turn entirely.
-- **The host's `CLAUDE.md` / auto-memory is never injected.** OCP is a proxy — the proxied client (OpenClaw / your IDE) owns its own context and memory. TUI-mode runs `claude` with `--safe-mode`, which disables all host customizations (CLAUDE.md, skills, plugins, hooks, MCP servers) while leaving auth, model selection, built-in tools, and permissions untouched — so a `CLAUDE.md` on the OCP host can never leak into a proxied turn and steer the answer, and the session still bills the subscription pool (`cc_entrypoint=cli`, unlike `--bare`). The `CLAUDE_CODE_DISABLE_CLAUDE_MDS` / `CLAUDE_CODE_DISABLE_AUTO_MEMORY` env vars are kept as a fallback (see #4). Built-in tool schemas + the interactive system prompt remain (the inherent ~20–35K context floor of interactive mode); MCP is hard-disabled. **Exception:** the two opt-in modes that deliberately need a customization `--safe-mode` would strip — real streaming (`OCP_TUI_STREAM`, which registers a `MessageDisplay` **hook** via `--settings`) and `OCP_TUI_FULL_TOOLS` (which grants an **MCP** / skills surface) — run without `--safe-mode` and rely on the env-var suppression alone.
+- **The host's `CLAUDE.md` / auto-memory is never injected.** OCP is a proxy — the proxied client (OpenClaw / your IDE) owns its own context and memory. TUI-mode always runs `claude` with `CLAUDE_CODE_DISABLE_CLAUDE_MDS` + `CLAUDE_CODE_DISABLE_AUTO_MEMORY`, so a `CLAUDE.md` on the OCP host can never leak into proxied turns (verified live; see #4). Built-in tool schemas + the interactive system prompt remain (the inherent ~20–35K context floor of interactive mode); MCP is hard-disabled.
 - **Authenticate via `CLAUDE_CODE_OAUTH_TOKEN` in a credential-isolated home (recommended).** tmux does not forward the parent process's env to the pane, so OCP sets the token explicitly on the spawned `claude` when `CLAUDE_CODE_OAUTH_TOKEN` is present. With the env token set and `OCP_TUI_HOME` unset, OCP runs claude in a **credential-isolated home** (`$HOME/.ocp-tui/home`) that has **no `credentials.json`** — so the env token is the only credential and is authoritative, and claude never runs the token-refresh path. This both stops a stale `credentials.json` from shadowing the token and ends the refresh-token corruption behind the permanent `Please run /login · API Error: 401` (full two-layer root cause, live proof, and fix in [Troubleshooting § the permanent TUI-mode 401](troubleshooting.md#tui-401)). Transcripts land under the same isolated home, so the answer-reader is unaffected. Without the env token, claude falls back to the real home's `credentials.json` (byte-for-byte the previous behaviour). (The token is visible in `ps` on the pane command — acceptable for the single-user A-path; the multi-user B-path is refused at boot.) See ADR 0007 PR-C / PR-D amendments.
 - **Stale tmux sessions are reaped.** The pane's `claude` is a child of the tmux server (not OCP), so OCP cannot reap it directly; `claude` zombies can otherwise accumulate as `<defunct>` over a long-running host. OCP reaps them at boot and on a 15-min idle sweep by issuing `tmux kill-server` — but **only when no foreign tmux session remains** (it never disrupts a co-hosted `olp-tui-*` instance). See ADR 0007 PR-C amendment.
 - **Default path unchanged.** Unset `CLAUDE_TUI_MODE` and restart → `callClaude` / `callClaudeStreaming` are used again, byte-for-byte identical to today.

lib/tui/session.mjs

@@ -182,13 +182,8 @@ function tuiCapturePane(tmux, tmuxName) {
 }
 
 // True once claude's input bar is rendered and ready for keystrokes.
-// Two known ready-state footers across claude versions: the classic `? for shortcuts`
-// hint, and the `shift+tab to cycle` hint (part of "⏵⏵ bypass permissions on (shift+tab
-// to cycle)") that newer claude 2.1.x renders in its place. Match EITHER — a matcher that
-// only knew the classic string silently reported "never ready" on those builds, timing out
-// every boot (tui_pane_not_ready) and, with the warm pool on, failing every pre-boot.
 function tuiInputReady(pane) {
-  return /\? for shortcuts|shift\+tab to cycle/.test(pane);
+  return /\? for shortcuts/.test(pane);
 }
 
 // True once the pasted prompt has POSITIVELY landed in the input box. We only trust
@@ -389,15 +384,9 @@ export function buildTuiCmd(claudeBin, model, sessionId, ehome, entrypointMode,
   // CLAUDE.md and auto-memory must NEVER leak into the agent OCP runs on the user's behalf.
   // Without these, claude loads the host's project/user CLAUDE.md + memory into every proxied
   // turn — verified live 2026-06-02: a cwd CLAUDE.md ("end every reply with QUACKMARKER_42") was
-  // obeyed by the proxied turn until these flags were set, after which it was not. Mirrors the
-  // -p path's CLAUDE_NO_CONTEXT vars. Harmless on hosts with no CLAUDE.md (they suppress nothing).
-  //
-  // These env vars stopped being sufficient on newer claude: they are present in the pane's
-  // environment yet the host CLAUDE.md is still injected into the turn's context, so a proxied
-  // turn again obeys the operator's private CLAUDE.md instead of the caller's prompt — a leak of
-  // the operator's private context into API responses. The robust suppression is the --safe-mode
-  // flag added to the argv below; these env vars are kept as belt-and-braces for the two argv
-  // paths that cannot take --safe-mode (see the safeModeArgs note near the return).
+  // obeyed by the proxied turn until these flags were set, after which it was not. Unconditional
+  // by design (not gated): proxy purity is not an opt-in. Harmless on hosts with no CLAUDE.md
+  // (the common case — they suppress nothing). Mirrors the -p path's CLAUDE_NO_CONTEXT vars.
   const sets = [
     `HOME=${shq(ehome)}`,
     "DISABLE_AUTOUPDATER=1",
@@ -488,32 +477,9 @@ export function buildTuiCmd(claudeBin, model, sessionId, ehome, entrypointMode,
   // so the OFF argv is byte-for-byte the pre-streaming argv.
   const settingsArgs = stream && stream.settings ? ["--settings", shq(stream.settings)] : [];
 
-  // --safe-mode: disable ALL customizations (host CLAUDE.md, skills, plugins, hooks, MCP
-  // servers, custom commands/agents, output styles, ...) while leaving auth, model selection,
-  // built-in tools, and permissions untouched (claude 2.1.216 --help). This is the robust
-  // replacement for the CLAUDE_CODE_DISABLE_CLAUDE_MDS / _AUTO_MEMORY env vars above, which no
-  // longer suppress the host CLAUDE.md on newer claude — so the operator's private CLAUDE.md
-  // could otherwise leak into a proxied API response. Unlike --bare, --safe-mode does NOT drop
-  // the interactive session off the subscription pool (it keeps auth + model selection), so the
-  // billing classifier stays cc_entrypoint=cli.
-  //
-  // NOT applied when the pane deliberately relies on a customization --safe-mode would strip,
-  // because those would break SILENTLY:
-  //   - streaming (settingsArgs present): the MessageDisplay hook is a HOOK, which --safe-mode
-  //     disables — every streamed turn would then fire zero deltas (tui.streamZeroDeltaTurns)
-  //     and fall back to buffered, defeating OCP_TUI_STREAM.
-  //   - OCP_TUI_FULL_TOOLS=1: grants an MCP / skills / agent surface (--mcp-config, ...) that
-  //     --safe-mode disables wholesale.
-  // Those two opt-in paths keep the env-var suppression above as their best-effort fallback.
-  const safeModeArgs =
-    settingsArgs.length === 0 && process.env.OCP_TUI_FULL_TOOLS !== "1"
-      ? ["--safe-mode"]
-      : [];
-
   return [
     envPrefix,
     shq(claudeBin),
-    ...safeModeArgs,
     "--model",          shq(model),
     "--session-id",     sessionId,
     ...toolArgs,
@@ -649,9 +615,8 @@ export async function bootTuiPane({
 //      A pooled pane is SINGLE-USE: it already carries its own fresh --session-id, it
 //      serves this one turn, and it is killed in the finally like any other pane.
 //   2. On a MISS: pre-trust the scratch cwd, boot an interactive `claude` in a fresh tmux
-//      session in the scratch cwd, poll capture-pane until the input bar appears — see
-//      tuiInputReady for the ready-state footers matched (bootTuiPane). BOOT_MS is the max
-//      wait, not a fixed delay.
+//      session in the scratch cwd, poll capture-pane until the `? for shortcuts` input bar
+//      appears (bootTuiPane). BOOT_MS is the max wait, not a fixed delay.
 //   3. Write prompt to a 0600 temp file (no shell injection from prompt content).
 //   4. Paste the prompt via tmux load-buffer + paste-buffer -p (bracketed paste) —
 //      reliable for large multi-line prompts where send-keys -l is not (issue #130).

test-features.mjs

@@ -2209,32 +2209,10 @@ console.log("\nTUI command construction (proxy-purity / #4):");
 test("buildTuiCmd suppresses host CLAUDE.md + auto-memory (proxy purity, #4)", () => {
   const cmd = buildTuiCmd("/usr/bin/claude", "claude-haiku", "sid-1", "/home/u", "cli");
   // OCP is a proxy: the host's CLAUDE.md / auto-memory must never leak into the proxied turn.
-  // Primary mechanism is --safe-mode (env vars alone stopped suppressing on newer claude);
-  // the env vars remain as belt-and-braces.
-  assert.ok(/(^| )--safe-mode( |$)/.test(cmd), "default pane must pass --safe-mode (disables host CLAUDE.md/skills/plugins/hooks)");
   assert.ok(/(^| )CLAUDE_CODE_DISABLE_CLAUDE_MDS=1( |$)/.test(cmd), "must disable CLAUDE.md injection");
   assert.ok(/(^| )CLAUDE_CODE_DISABLE_AUTO_MEMORY=1( |$)/.test(cmd), "must disable auto-memory injection");
 });
 
-test("buildTuiCmd omits --safe-mode when a customization it would strip is in use", () => {
-  const save = process.env.OCP_TUI_FULL_TOOLS;
-  try {
-    delete process.env.OCP_TUI_FULL_TOOLS;
-    // streaming registers a MessageDisplay HOOK via --settings; --safe-mode would kill the hook
-    // (zero deltas), so it must be omitted on the streaming pane.
-    const streaming = buildTuiCmd("/usr/bin/claude", "m", "sid-s", "/home/u", "cli", { file: "/d/sid-s.jsonl", settings: "/d/s.json" });
-    assert.ok(!/--safe-mode/.test(streaming), "streaming pane must NOT pass --safe-mode (would disable the MessageDisplay hook)");
-    assert.ok(streaming.includes("--settings '/d/s.json'"), "streaming pane keeps its --settings hook");
-
-    // OCP_TUI_FULL_TOOLS grants an MCP/skills surface --safe-mode disables wholesale.
-    process.env.OCP_TUI_FULL_TOOLS = "1";
-    const full = buildTuiCmd("/usr/bin/claude", "m", "sid-f", "/home/u", "cli");
-    assert.ok(!/--safe-mode/.test(full), "full-tools pane must NOT pass --safe-mode (would disable MCP/skills)");
-  } finally {
-    if (save === undefined) delete process.env.OCP_TUI_FULL_TOOLS; else process.env.OCP_TUI_FULL_TOOLS = save;
-  }
-});
-
 test("buildTuiCmd keeps version pin + entrypoint label + MCP wall", () => {
   const cli = buildTuiCmd("/usr/bin/claude", "m", "sid-2", "/home/u", "cli");
   assert.ok(cli.includes("DISABLE_AUTOUPDATER=1"), "version pin retained");
@@ -3526,7 +3504,7 @@ if (process.env.OCP_TUI_LIVE === "1") {
 // Replicates tuiInputReady, tuiPromptLanded verbatim from lib/tui/session.mjs.
 // Keep in sync with the definitions there.
 function _tuiInputReady(pane) {
-  return /\? for shortcuts|shift\+tab to cycle/.test(pane);
+  return /\? for shortcuts/.test(pane);
 }
 function _tuiPromptLanded(pane, prompt) {
   const flatPane = pane.replace(/\s+/g, " ");
@@ -3544,12 +3522,7 @@ const TUI_READY_PANE = `❯ Try "how does <filepath> work?"
 const TUI_LANDED_PANE = `❯ Reply with exactly: PONG_TEST
   ? for shortcuts · ← for agents`;
 
-// Newer claude 2.1.x renders the input bar with a `shift+tab to cycle` footer instead of
-// `? for shortcuts` — the matcher must accept it too, or the pane reads as never-ready.
-const TUI_READY_PANE_SHIFT_TAB = `❯ Try "how does <filepath> work?"
-  ⏵⏵ bypass permissions on (shift+tab to cycle)`;
-
-// Welcome splash shown before input bar is rendered — neither ready-state footer.
+// Welcome splash shown before input bar is rendered — no `? for shortcuts`.
 const TUI_BOOT_PANE = `╭─ Claude Code v2.1.114 ─ Welcome back Tao! ─╮\n│ Tips for getting started │`;
 
 console.log("\nTUI readiness + paste-verify predicates (issue #130):");
@@ -3560,9 +3533,6 @@ test("tuiInputReady(READY_PANE) === true  (input bar rendered)", () => {
 test("tuiInputReady(LANDED_PANE) === true  (input bar still present after paste)", () => {
   assert.equal(_tuiInputReady(TUI_LANDED_PANE), true);
 });
-test("tuiInputReady(READY_PANE_SHIFT_TAB) === true  (newer claude `shift+tab to cycle` footer)", () => {
-  assert.equal(_tuiInputReady(TUI_READY_PANE_SHIFT_TAB), true);
-});
 test("tuiInputReady(BOOT_PANE) === false  (welcome splash, no input bar yet)", () => {
   assert.equal(_tuiInputReady(TUI_BOOT_PANE), false);
 });
@@ -4553,17 +4523,13 @@ test("stream: sink path is keyed by session_id (concurrent panes cannot interlea
   assert.ok(A.endsWith("/aaaa-1111.jsonl"));
 });
 
-test("stream: buildTuiCmd — streaming ON adds env + --settings and drops --safe-mode (hook survives)", () => {
+test("stream: buildTuiCmd — OFF is byte-for-byte the pre-streaming argv; ON adds only env + --settings", () => {
   const off = buildTuiCmd("/bin/claude", "m", "SID", "/h", "cli");
   assert.ok(!off.includes("--settings"), "no --settings when streaming is off");
   assert.ok(!off.includes("OCP_TUI_STREAM_FILE"), "no sink env when streaming is off");
-  assert.ok(off.includes("--safe-mode"), "the non-streaming pane carries --safe-mode");
   const on = buildTuiCmd("/bin/claude", "m", "SID", "/h", "cli", { file: "/d/SID.jsonl", settings: "/d/s.json" });
   assert.ok(on.includes("OCP_TUI_STREAM_FILE='/d/SID.jsonl'"), "sink delivered via the pane env");
   assert.ok(on.includes("--settings '/d/s.json'"));
-  // --safe-mode would disable the MessageDisplay hook registered by --settings, so the
-  // streaming pane must NOT carry it (it keeps the env-var suppression instead).
-  assert.ok(!on.includes("--safe-mode"), "streaming pane omits --safe-mode so the hook fires");
   // must not regress the MCP wall or the pinned effort (#156)
   assert.ok(on.includes("--strict-mcp-config") && on.includes("--disallowedTools 'mcp__*'"), "MCP wall intact");
   assert.ok(on.includes("--effort low"), "OCP_TUI_EFFORT default intact");