open-claude-p 1.1.0 → 1.1.1

package/CHANGELOG.md

@@ -7,6 +7,72 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [1.1.1] — 2026-05-19
+
+Post-1.1.0 fixes driven by Cosmica integration testing. Several of
+these are essentially the 1.1.0 release "actually working" — the
+1.1.0 surface was correct on paper but a handful of subtle parser
+and default-value bugs kept the new behaviour from landing in
+practice.
+
+### Fixed
+
+- **Trust dialog auto-accept regressed silently for two distinct
+  reasons.**
+  - The driver's `❯` chevron pattern matched both the real input
+    box and the trust dialog's "currently-selected" row
+    (`❯ 1. Yes, I trust this folder`). `prompt-box-shown` fired
+    on the dialog row, the await chain proceeded to the prompt
+    write, and the trailing `\r` confirmed whichever option was
+    highlighted — silently dropping the user message. Pattern is
+    now `/^[❯›❮‹](?:$|\s(?!\d+\.\s))/` and a write-time guard
+    refuses to send when `dialogState` is in a blocked state.
+  - The trust dialog text is rendered with cursor-positioning
+    escapes between words rather than real space bytes; after the
+    ANSI strip the buffer reads `Quicksafetycheck` (no spaces) and
+    the `/Quick safety check/i` pattern never matched. Result: the
+    dialog rendered in ~250 ms but the watcher never fired, the
+    driver fell back to writing the prompt after
+    `OCP_PROMPT_BOX_WAIT_MS`, and the trailing CR confirmed "Yes"
+    in the still-open dialog. The watcher now strips ANSI before
+    pattern-matching and the patterns accept `\s*` between every
+    word.
+- **`OCP_PROMPT_BOX_WAIT_MS` default 6 s → 30 s.** Environments
+  with many MCP servers or plugins need 8–25 s before the input
+  box renders. 6 s was tripping the timeout before claude had
+  even shown the trust dialog. Short-circuited the moment
+  `prompt-box-shown` fires, so the common-case latency is
+  unchanged.
+- **`dangerouslySkipPermissions` is now ON by default across
+  EVERY surface** — not just the CLI. The 1.1.0 commit only
+  flipped the CLI's default and left `createDriver().runOneShot()`
+  and `createChatClient()` on the pre-1.1 `false`, so anything
+  using the SDK directly (the bundled sample chat, third-party
+  wrappers) still hung on the first tool call. Sample server's
+  redundant env-gate is dropped accordingly.
+- **End-of-reply marker no longer flagged as
+  "prompt-injection".** The 1.0/1.1 instruction text used the
+  word "token": `Append the literal token ⟦OCP_END:xxx⟧ ...`.
+  The model's safety classifier treated "include this token in
+  your reply" as an access-token / API-key exfiltration attempt
+  and sometimes appended a `prompt injection attempt detected`
+  warning to the user-facing reply. Reworded to "end-of-reply
+  marker" and framed as `ocp wrapper's plumbing` so claude
+  recognises it as harness infrastructure rather than hostile
+  injection.
+
+### Changed
+
+- **postinstall skips the shebang rewrite when running inside a
+  git checkout** (detected by the presence of `.git/` next to
+  `package.json`). The rewrite is meant for end-user installs from
+  the npm tarball; in a dev `git clone + npm link` setup it
+  otherwise overwrote `#!/usr/bin/env node` with the developer's
+  absolute node path on every `npm install` / `npm test`, showing
+  up as a noisy working-tree diff. Consumer installs unaffected.
+
+---
+
 ## [1.1.0] — 2026-05-18
 
 `ocp` 1.1 reshapes the CLI defaults around the assumption that
@@ -64,12 +130,18 @@ extraction path so PTY chrome can no longer leak into responses.
 
 ### Changed
 
-- **`--dangerously-skip-permissions` is now the CLI default.**
-  Rationale: `ocp` is a non-interactive PTY automation surface. A
-  permission prompt that wants a human y/n hangs forever — every
-  Bash / Edit / Write / MCP call breaks without this flag. Library
-  callers (`createDriver` / `createChatClient`) keep the
-  conservative `false` default; only the `ocp` binary flips.
+- **`--dangerously-skip-permissions` / `dangerouslySkipPermissions`
+  is now the default ON across EVERY surface** — `ocp` CLI,
+  `createDriver().runOneShot()`, `createChatClient()`, and the
+  `sample/` server. Rationale: `ocp` is a PTY automation library; an
+  interactive permission prompt that wants a human y/n hangs forever
+  — every Bash / Edit / Write / MCP / WebSearch call breaks without
+  this flag. The pre-1.1 library default of `false` was the cause
+  of nearly every "the SDK silently hangs on tool use" report.
+  Opt out per surface:
+  - CLI: `OCP_NO_SKIP_PERMS=1` (env)
+  - `createChatClient({ dangerouslySkipPermissions: false })`
+  - `runOneShot({ dangerouslySkipPermissions: false })`
   Pre-1.1 users with `OCP_DEFAULT_SKIP_PERMS=1` exported see no
   change; the env is now a no-op.
 - **Folder-trust dialog is auto-accepted by default.** Same
@@ -183,5 +255,6 @@ Initial release.
   `OCP_NO_DEFAULT_PROMPT=1`).
 - Localised READMEs: Korean, Japanese, Chinese.
 
+[1.1.1]: https://github.com/empty-user77/open-claude-p/releases/tag/v1.1.1
 [1.1.0]: https://github.com/empty-user77/open-claude-p/releases/tag/v1.1.0
 [1.0.0]: https://github.com/empty-user77/open-claude-p/releases/tag/v1.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-claude-p",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "A PTY-backed compatibility shim for `claude -p` (Claude Code headless/print mode). Drives the interactive `claude` CLI via node-pty and exposes the same option surface and stream-json contract. Ships as both a library and an `ocp` CLI binary.",
   "type": "module",
   "main": "./src/index.js",

package/scripts/postinstall.js

@@ -79,6 +79,23 @@ if (!fixedAny) {
 // and the file extension makes shebang lines a no-op.
 if (process.platform !== 'win32') {
   const here = path.dirname(fileURLToPath(import.meta.url));
+  const repoRoot = path.resolve(here, '..');
+  // Skip the shebang rewrite when this install is a git checkout
+  // (dev environment via `git clone + npm link`, or a contributor
+  // running `npm install` inside the repo). The rewrite would
+  // otherwise overwrite the portable `#!/usr/bin/env node` with the
+  // developer's absolute node path, which then shows up as a noisy
+  // working-tree diff on every commit and risks getting committed
+  // by mistake. Consumers installing from the npm tarball never
+  // have a `.git/` so they still get the GUI-launch fix.
+  try {
+    const st = await lstat(path.join(repoRoot, '.git'));
+    if (st.isDirectory() || st.isFile()) {
+      process.stdout.write('postinstall: detected git checkout — skipping shebang rewrite\n');
+      process.exit(0);
+    }
+  } catch { /* no .git/ — npm-tarball install, proceed */ }
+
   // Every shipped bin entry needs the same shebang treatment. List them
   // here rather than re-reading package.json (the file may be pruned
   // from production installs and the bin field is small enough to

package/src/chat/index.js

@@ -500,9 +500,13 @@ const SENTINEL_REGEX = /⟦OCP_END:[a-f0-9]+⟧/g;
  * @param {string} [opts.dbPath]                  Path to the conversations JSON file. Default `./conversations.json`
  *                                                in the process cwd, so each project keeps its own history.
  * @param {string} [opts.skillsDir]               Directory holding `<name>/SKILL.md` files. Default `~/.claude/skills`.
- * @param {boolean} [opts.dangerouslySkipPermissions=false]
+ * @param {boolean} [opts.dangerouslySkipPermissions=true]
  *                                                Forward `--dangerously-skip-permissions` to upstream so tool
- *                                                calls (WebSearch, Bash, …) do not block on a permission prompt.
+ *                                                calls (WebSearch, Bash, …) do not block on a permission prompt
+ *                                                PTY automation cannot answer. Default ON in 1.1+ across every
+ *                                                surface (CLI, driver, chat client) — pass `false` explicitly
+ *                                                to restore claude's interactive permission prompts (and accept
+ *                                                that every tool call will then hang).
  * @param {string|null} [opts.appendSystemPrompt] Appended to every turn's system prompt. Pass `null` to disable
  *                                                the default ("use WebSearch immediately …") text.
  * @param {object} [opts.pricing]                 Per-token rates: `{ input, cacheWrite, cacheRead, output }`.
@@ -518,7 +522,12 @@ export function createChatClient(opts = {}) {
     ? path.resolve(opts.dbPath)
     : path.resolve(process.cwd(), DEFAULT_DB_FILENAME);
   const skillsDir = path.resolve(opts.skillsDir ?? DEFAULT_SKILLS_DIR);
-  const dangerouslySkipPermissions = opts.dangerouslySkipPermissions ?? false;
+  // Default ON across the SDK in 1.1+: PTY automation cannot answer
+  // an interactive permission prompt, so leaving this off makes the
+  // first tool call hang forever. Library callers who genuinely want
+  // claude to prompt must pass `dangerouslySkipPermissions: false`
+  // explicitly. The `??` operator preserves explicit `false`.
+  const dangerouslySkipPermissions = opts.dangerouslySkipPermissions ?? true;
   // Store the raw client-level option (string | null | undefined); the
   // per-turn compose merges it with the SDK base default and any
   // per-turn override.

package/src/index.js

@@ -163,7 +163,15 @@ class Driver {
       maxEvents: finiteNonNeg(opts.maxEvents, 10_000),
       firstResponseMs: finiteNonNeg(opts.firstResponseMs, numberFromEnv('OCP_FIRST_RESPONSE_MS', 120_000)),
       trustSettleMs: finiteNonNeg(opts.trustSettleMs, numberFromEnv('OCP_TRUST_SETTLE_MS', 2_500)),
-      promptBoxWaitMs: finiteNonNeg(opts.promptBoxWaitMs, numberFromEnv('OCP_PROMPT_BOX_WAIT_MS', 6_000)),
+      // 30 s default: in environments with many MCP servers, plugins,
+      // or hooks the first prompt-box render can take 8–25 s. The pre-
+      // 1.1 default of 6 s caused the driver to give up on
+      // prompt-box-shown and write the prompt anyway, *before* claude
+      // had even shown the trust dialog — the prompt's trailing CR
+      // then confirmed whatever option was highlighted on the dialog
+      // and the user message was dropped. 30 s leaves room for slow
+      // startups while still bounding total spawn latency.
+      promptBoxWaitMs: finiteNonNeg(opts.promptBoxWaitMs, numberFromEnv('OCP_PROMPT_BOX_WAIT_MS', 30_000)),
       initialSessionId: opts.initialSessionId ?? null,
       printMode:
         opts.printMode === true ||
@@ -199,7 +207,11 @@ class Driver {
    * @param {string} [req.systemPrompt]
    * @param {string[]} [req.allowedTools]
    * @param {string[]} [req.disallowedTools]
-   * @param {boolean} [req.dangerouslySkipPermissions]
+   * @param {boolean} [req.dangerouslySkipPermissions=true]
+   *   Default ON in 1.1+. PTY automation cannot answer claude's
+   *   interactive y/n permission prompt, so leaving it OFF makes
+   *   the first tool call hang forever. Pass `false` explicitly to
+   *   restore the prompts (and accept the hang).
    * @param {boolean} [req.debug]
    * @param {boolean} [req.verbose]
    * @param {string[]} [req.passThroughArgv]   extra argv to forward verbatim
@@ -215,6 +227,14 @@ class Driver {
       throw new Error('runOneShot: `prompt` (string) is required');
     }
 
+    // Default ON across the driver in 1.1+: PTY automation has no
+    // way to answer claude's interactive permission prompt, so a
+    // request that doesn't explicitly set it would otherwise hang on
+    // the first tool call. We mutate `req` in place because every
+    // downstream branch (print-mode, daemon proxy, buildSpawnArgs)
+    // reads the same field. `??` keeps an explicit `false` intact.
+    req.dangerouslySkipPermissions = req.dangerouslySkipPermissions ?? true;
+
     // Print-mode short-circuit: spawn `claude --print` directly, bypass
     // the PTY+TUI pipeline. Caller opts in via req.printMode, driver-level
     // opts.printMode, or env OCP_PRINT_MODE=1.
@@ -426,10 +446,16 @@ class Driver {
                           || process.env.OCP_NO_AUTO_ACCEPT_TRUST === 'true'
                           || req.autoAcceptFolderTrust === false;
     const autoAcceptTrust = !autoAcceptOptOut;
+    // The trust dialog text is rendered with cursor-positioning
+    // escapes between words rather than real space bytes. After our
+    // ANSI strip the buffer reads `Quicksafetycheck...` with the
+    // spaces gone, so `/Quick safety check/i` no longer matches.
+    // Allow zero-or-more whitespace between every word and accept
+    // the seq with or without spaces.
     const TRUST_PATTERNS = [
-      /Quick safety check/i,
-      /Is this a project you (?:created|trust)/i,
-      /trust this folder/i,
+      /Quick\s*safety\s*check/i,
+      /Is\s*this\s*a\s*project\s*you\s*(?:created|trust)/i,
+      /trust\s*this\s*folder/i,
     ];
     const TRUST_SETTLE_MS = this.opts.trustSettleMs
                          ?? numberFromEnv('OCP_TRUST_SETTLE_MS')
@@ -439,7 +465,21 @@ class Driver {
 
     const dialogWatchHandler = (chunk) => {
       if (dialogState !== 'none') return;
-      dialogScanBuf += typeof chunk === 'string' ? chunk : chunk.toString('utf8');
+      // Strip ANSI escapes BEFORE pattern-matching. claude's TUI wraps
+      // the dialog text in color codes mid-word ("\x1b[1mQ\x1b[muick
+      // safety check..."), which prevents a simple `/Quick safety/`
+      // regex from ever matching the raw byte stream. Result observed
+      // in user testing: trust dialog renders in 1-2 s but our
+      // detector never fires, the driver falls back to writing the
+      // user's prompt after `OCP_PROMPT_BOX_WAIT_MS`, and the
+      // trailing `\r` confirms whichever dialog option is highlighted
+      // (silently dropping the user message). Stripping here keeps
+      // the watcher decoupled from the main parser pipeline while
+      // still seeing the plain text claude actually rendered.
+      const raw = typeof chunk === 'string' ? chunk : chunk.toString('utf8');
+      dialogScanBuf += raw.replace(/\x1b\[[0-9;?]*[A-Za-z]/g, '')
+                          .replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g, '')
+                          .replace(/[\x00-\x08\x0b-\x1f\x7f]/g, '');
       if (dialogScanBuf.length > 16384) dialogScanBuf = dialogScanBuf.slice(-8192);
       if (TRUST_PATTERNS.some((p) => p.test(dialogScanBuf))) {
         if (autoAcceptTrust) {
@@ -508,6 +548,27 @@ class Driver {
         promptBoxReadyPromise,
         sleep(PROMPT_BOX_WAIT_MS).then(() => { promptBoxTimeoutHit = true; }),
       ]);
+      // If the dialog watcher is mid-flow (trust just auto-accepted)
+      // when our prompt-box wait times out, claude is still transitioning
+      // from the dialog to the main UI — the chevron has not landed
+      // because it doesn't exist yet. Give it the trust-settle window
+      // plus another bounded wait for the real input box to appear.
+      // Writing now would land the prompt into the dialog (and its
+      // trailing `\r` would confirm whichever option is highlighted),
+      // silently dropping the user's message.
+      if (promptBoxTimeoutHit && !promptBoxReady && dialogState === 'trust-accepted') {
+        const EXTRA_WAIT = PROMPT_BOX_WAIT_MS;
+        this._logDebug(
+          `prompt-box-shown still not seen but trust dialog is processing — ` +
+          `extending wait by ${EXTRA_WAIT}ms`,
+        );
+        let extendedTimeoutHit = false;
+        await Promise.race([
+          promptBoxReadyPromise,
+          sleep(EXTRA_WAIT).then(() => { extendedTimeoutHit = true; }),
+        ]);
+        promptBoxTimeoutHit = extendedTimeoutHit;
+      }
       if (promptBoxTimeoutHit && !promptBoxReady) {
         this._logDebug(`prompt-box-shown not seen within ${PROMPT_BOX_WAIT_MS}ms — sending anyway`);
       } else if (promptBoxReady && PROMPT_BOX_SETTLE_MS > 0) {
@@ -516,22 +577,50 @@ class Driver {
         await sleep(PROMPT_BOX_SETTLE_MS);
       }
 
-      // Sentinel marker appended to every user turn so PTY automation
-      // can tell when the reply is done. Phrased to be inert to model
-      // behaviour — do NOT use words like "finish", "complete",
-      // "wrap up", or "final" that nudge the model to cut tool use
-      // short. The reply itself is the actual signal of completion;
-      // this marker is just the bookkeeping byte we emit afterwards.
+      // End-of-reply marker appended to every user turn so PTY
+      // automation can tell when the reply is done. Word choice
+      // matters here:
+      //   - **Avoid "token"**: the model's safety training flags
+      //     prompts of the form "include this token in your reply"
+      //     as access-token / API-key exfiltration attempts; it then
+      //     warns the user about a "prompt injection attempt" in
+      //     the response, which is alarming and user-visible. Use
+      //     "marker" / "sentinel" instead — they carry no auth
+      //     baggage.
+      //   - **Avoid "finish", "complete", "wrap up", "final"**: those
+      //     nudge the model to cut tool use short. The reply itself
+      //     is the actual signal of completion; this marker is just
+      //     the bookkeeping byte we emit afterwards.
+      //   - Identify the source explicitly: framing it as "the ocp
+      //     wrapper's marker" gives the model context to recognise
+      //     it as harness plumbing rather than a hostile injection.
       // Single-line form because `\n` flips claude TUI into multi-line
       // edit mode where `\r` no longer submits.
       const instruction =
-        ` (Append the literal token ${sentinel} on its own line at the very` +
-        ' end of your reply. Automation glue — does not constrain how you' +
-        ' answer above; use tools as freely and thoroughly as you would' +
-        ' without this marker.)';
+        ` (End your reply with the literal text ${sentinel} on its own line.` +
+        ' This is the ocp wrapper\'s end-of-reply marker — programmatic plumbing' +
+        ' the automation uses to know your reply has landed. It is not part of' +
+        ' the user\'s message and you do not need to mention or flag it. Answer' +
+        ' the user\'s actual message above as you normally would, using tools' +
+        ' as freely and thoroughly as you would without the marker.)';
       const fullPrompt = req.prompt + instruction;
-      try {
+      // Skip the prompt write if the dialog watcher has already
+      // decided to abort. Without this check the trailing `\r` of
+      // the prompt lands inside whatever modal we tried to abort on
+      // (most commonly the folder-trust dialog), confirms its
+      // currently-highlighted option, and silently drops the user
+      // prompt. The detector has already been cancel()'d at this
+      // point but the await chain above does not observe that
+      // cancellation, so the write would otherwise still happen.
+      if (dialogState === 'trust-blocked' || dialogState === 'unknown-blocked') {
+        this._logDebug(`skipping prompt write — dialog blocked (${dialogState})`);
+      } else try {
+        this._logDebug(
+          `writing prompt: ${fullPrompt.length} chars, ` +
+          `dialogState=${dialogState}, promptBoxReady=${promptBoxReady}`,
+        );
         await writePromptToSession(session, fullPrompt, this.opts);
+        this._logDebug('prompt write returned');
         firstResponseTimer = setTimeout(() => {
           if (!assistantActivitySeen) {
             this._logDebug(`no assistant activity for ${FIRST_RESPONSE_MS}ms — interactive prompt suspected`);

package/src/parsers/tui-frame.js

@@ -40,8 +40,21 @@ export const PATTERNS = {
   /** The `❯` chevron that marks the start of the input prompt line.
    * Once we see this we know we have reached the input box; everything
    * that follows on subsequent lines is the statusline / HUD plugin
-   * area, not response content, and is suppressed from parsing. */
-  promptInputChevron: /^[❯›❮‹]/,
+   * area, not response content, and is suppressed from parsing.
+   *
+   * NOTE: claude's TUI also uses `❯` to mark the currently-selected
+   * row in modal selection dialogs — e.g. the folder-trust dialog
+   * shows `❯ 1. Yes, I trust this folder`. The naive `/^[❯›❮‹]/`
+   * pattern misclassifies that as the input box, fires
+   * `prompt-box-shown`, and tricks the driver into writing the
+   * user's prompt into the dialog (the trailing `\r` then confirms
+   * "Yes" while the prompt itself is dropped). Anchor the match to
+   * `chevron + space + (anything-but-numbered-option)` so dialog
+   * selections do not match. The real input box is either `❯`
+   * alone, `❯ ` with a placeholder hint (`❯ Try "refactor …"`), or
+   * `❯ <typed-text>` — none of those collide with `❯ <digit>.`.
+   */
+  promptInputChevron: /^[❯›❮‹](?:$|\s(?!\d+\.\s))/,
 };
 
 /**