openzoo 0.11.0 → 0.11.1

package/lib/brief.js

@@ -33,7 +33,8 @@ export const briefFor = (selfUrl) => [
   '   Keep any single request under ~8MB. Bigger bodies are dropped by the network hop before they reach the proxy (an opaque 413 or a dead connection). This is a REQUEST size limit, not a context limit — the bound context can be far larger, which is what parts are for.',
   '   Paths: your base_url already ends in /v1, so post to {base_url}/hrr/bind — NOT {base_url}/v1/hrr/bind (that double /v1 404s; the proxy repairs it, but do not rely on that).',
   '',
-  '3. PAYMENT IS HANDLED. Every call is paid per-request from the operator\'s wallet via x402 (Solana / Base / Robinhood Chain, whichever is funded). There is no API key to find, no account, no rate limit to negotiate. Never search the operator\'s machine for credentials or endpoints — GET / on this proxy returns everything discoverable about it.',
+  '3. PAYMENT IS HANDLED. Every call is paid per-request from the operator\'s wallet via x402 (Solana / Base / Robinhood Chain, whichever is funded). There is no account and no rate limit to negotiate, and you never handle money. Never search the operator\'s machine for credentials — GET / on this proxy describes it.',
+  '   AUTH, precisely: /hrr/bind and GET /models need NO key, so a script you write can call them directly. Paid endpoints (/chat/completions) need the bearer key your client is already configured with — you cannot read that key, so DO NOT write a standalone script that calls a paid endpoint. Bind from a script if you like, then ask through this conversation, which is already authenticated.',
   '',
   '4. MODEL IDS ARE FORGIVING. Ask for any model id you like; unknown ids are matched to the nearest served model, and /v1/models lists what is real (each alias row carries `served_by`).',
 ].join('\n');

package/lib/proxy.js

@@ -320,8 +320,16 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
           }, null, 2));
           return;
         }
+        // Binding COSTS NOTHING — no 402, no wallet, no settlement. Gating it
+        // behind the key only stopped agents from using the one endpoint that
+        // makes a big corpus workable: observed in the wild, an agent wrote a
+        // correct multi-part bind script, got 401 on the final append, and
+        // fell back to stuffing the corpus inline. The money paths below stay
+        // gated; the worst a stranger can do here is spend our sidecar's disk.
         const freeRead = req.method === 'GET' && (p === '/v1/models' || p.startsWith('/v1/models/'));
-        if (!freeRead) {
+        const freeBind = req.method === 'POST' && p === '/v1/hrr/bind';
+        if (freeBind) log(`public url: unauthenticated bind allowed (free endpoint) from ${req.socket.remoteAddress}`);
+        if (!freeRead && !freeBind) {
           log(`public url: 401 ${req.method} ${req.url}`);
           jsonErr(res, 401, 'unauthorized: this openzoo public URL requires the api key printed at the operator\'s proxy startup — GET / for discovery, GET /v1/models is open');
           return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",