mirror of
https://github.com/dtzp555-max/ocp.git
synced 2026-07-23 05:55:09 +00:00
OCP is a proxy: the operator's private ~/.claude/CLAUDE.md and auto-memory must never enter a proxied turn's context. The pane already sets CLAUDE_CODE_DISABLE_CLAUDE_MDS + CLAUDE_CODE_DISABLE_AUTO_MEMORY, but on newer claude (2.1.216) those env vars no longer suppress the injection, so a proxied turn can obey the operator's private CLAUDE.md instead of the caller's prompt — a leak of private context into API responses. Add --safe-mode to the interactive spawn argv (gated off on the streaming and OCP_TUI_FULL_TOOLS paths). Docs + tests updated. Co-authored-by: sumlin <3495838+sumlin@users.noreply.github.com>