openzoo 0.11.2 → 0.12.0

package/lib/bindpath.js

@@ -23,6 +23,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { config } from './config.js';
 import { corpusHash, rememberContext, lookupContext } from './contexts.js';
+import { withNamespace } from './namespace.js';
 
 /** Bodies over this go in their own part. Under the ~8MB transport ceiling
  *  with room for JSON escaping, which can inflate text substantially. */
@@ -115,7 +116,7 @@ export function splitIntoParts(text, maxBytes = MAX_PART_BYTES) {
 async function postBind(payload) {
   const r = await fetch(`${config.apiBase}/v1/hrr/bind`, {
     method: 'POST',
-    headers: { 'content-type': 'application/json' },
+    headers: withNamespace({ 'content-type': 'application/json' }),
     body: JSON.stringify(payload),
   });
   if (r.status !== 200) throw new Error(`bind failed: HTTP ${r.status}: ${(await r.text()).slice(0, 300)}`);

package/lib/hrr.js

@@ -14,6 +14,7 @@
 import { config } from './config.js';
 import { corpusHash, lookupContext, rememberContext, forgetContext } from './contexts.js';
 import { postWithUploadSignal } from './spinner.js';
+import { withNamespace } from './namespace.js';
 
 /** Corpora under this many chars ride inline — binding has a round-trip cost
  *  and the reuse win only matters when the body is actually big. */
@@ -37,6 +38,7 @@ export async function bindCorpus(corpus, { onStage, force = false } = {}) {
   }
   onStage?.('binding', { bytes });
   const r = await postWithUploadSignal(`${config.apiBase}/v1/hrr/bind`, JSON.stringify({ corpus }), {
+    headers: withNamespace(),
     onUploaded: () => onStage?.('bound-uploading-done', { bytes }),
   });
   if (r.status !== 200) {

package/lib/mcp.js

@@ -16,7 +16,7 @@ function text(obj) {
 }
 
 /** `npx openzoo mcp` — stdio MCP server sharing the proxy's wallet + payment core. */
-export async function startMcp() {
+export function buildMcpServer() {
   const client = new PayClient();
   // MCP's own channel for "what am I connected to" — clients surface this to
   // the model before any tool is called, which is exactly when it needs to
@@ -186,6 +186,12 @@ export async function startMcp() {
     })),
   }));
 
+  return { server, client };
+}
+
+/** `npx openzoo mcp` — stdio transport, for clients that spawn a process. */
+export async function startMcp() {
+  const { server, client } = buildMcpServer();
   const transport = new StdioServerTransport();
   await server.connect(transport);
   console.error(`openzoo mcp on stdio — wallet ${client.address} — zoo ${config.apiBase}`);

package/lib/mcphttp.js

@@ -0,0 +1,51 @@
+/**
+ * MCP over Streamable HTTP, mounted on the proxy's own port at /mcp.
+ *
+ * WHY: `npx openzoo` should give a harness BOTH surfaces without a second
+ * command — point base_url at /v1 for transparent context spilling, or add
+ * /mcp for the tools (zoo_bind, zoo_ask, zoo_wallet...). Clients that spawn a
+ * process still get stdio via `npx openzoo mcp`.
+ *
+ * Stateless on purpose: no session ids to track, no server-side state to
+ * expire, and any client that reconnects just works. The MCP server object
+ * itself is built once and reused across requests.
+ */
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { buildMcpServer } from './mcp.js';
+
+let ready = null;
+
+async function ensure() {
+  if (!ready) {
+    ready = (async () => {
+      const { server, client } = buildMcpServer();
+      const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: undefined, // stateless
+        enableJsonResponse: true,
+      });
+      await server.connect(transport);
+      return { transport, client };
+    })();
+  }
+  return ready;
+}
+
+/** Read and JSON-parse a request body. MCP posts are small. */
+function readJson(req) {
+  return new Promise((resolve) => {
+    const chunks = [];
+    req.on('data', (c) => chunks.push(c));
+    req.on('end', () => {
+      const raw = Buffer.concat(chunks).toString('utf8');
+      if (!raw) return resolve(undefined);
+      try { resolve(JSON.parse(raw)); } catch { resolve(undefined); }
+    });
+    req.on('error', () => resolve(undefined));
+  });
+}
+
+export async function handleMcpRequest(req, res) {
+  const { transport } = await ensure();
+  const body = req.method === 'POST' ? await readJson(req) : undefined;
+  await transport.handleRequest(req, res, body);
+}

package/lib/namespace.js

@@ -0,0 +1,37 @@
+import crypto from 'node:crypto';
+import { loadOrCreateWallet } from './wallet.js';
+
+/**
+ * The namespace that isolates THIS wallet's bound corpora from everyone
+ * else's on the shared sidecar.
+ *
+ * Contexts used to live in one global tenant, so a context was protected only
+ * by its id being unguessable — and the bind endpoint is free and open, so
+ * anyone could write into that same space. The gateway now hashes this header
+ * into the sidecar tenant id, which means a leaked context id is useless to a
+ * different wallet.
+ *
+ * Derived from the PUBLIC key, never the secret: it must be stable across
+ * restarts and reveal nothing. It is hashed again server-side, so the value on
+ * the wire is not the address either.
+ */
+let cached = null;
+
+export function namespaceHeaderValue() {
+  if (cached) return cached;
+  try {
+    const w = loadOrCreateWallet();
+    cached = crypto.createHash('sha256')
+      .update(`openzoo-ns:${w.keypair.publicKey.toBase58()}`)
+      .digest('hex');
+  } catch {
+    cached = ''; // no wallet (read-only use): fall back to the shared tenant
+  }
+  return cached;
+}
+
+/** Merge the namespace header into any headers object. */
+export function withNamespace(headers = {}) {
+  const ns = namespaceHeaderValue();
+  return ns ? { ...headers, 'x-openzoo-namespace': ns } : headers;
+}

package/lib/pay.js

@@ -9,6 +9,7 @@ import {
 import { buildEvmPayment, evmTokenBalance } from './evm.js';
 import { acquireWrappedIfNeeded } from './evmwrap.js';
 import { privateKeyToAccount } from 'viem/accounts';
+import { withNamespace } from './namespace.js';
 import {
   resolvePool, poolState, depositForShares, buildWrapInstructions, sendWrap,
 } from './wrap.js';
@@ -175,6 +176,9 @@ export class PayClient {
    */
   async fetch(url, init = {}, { onStage } = {}) {
     onStage?.('request');
+    // Contexts are tenanted by this namespace server-side — a request without
+    // it cannot see corpora this wallet bound.
+    init = { ...init, headers: withNamespace(init.headers || {}) };
     const first = await fetch(url, init);
     if (first.status !== 402) return { response: first, paid: false };
 

package/lib/proxy.js

@@ -271,6 +271,20 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
   let tunnelGate = null;
 
   const server = http.createServer(async (req, res) => {
+    // MCP on the SAME port as the proxy. One `npx openzoo` gives a harness
+    // both surfaces: point base_url at /v1 for transparent context spilling,
+    // or add /mcp for tools (zoo_bind, zoo_ask...). Running two commands to
+    // get both was friction nobody should pay.
+    if ((req.url || '').split('?')[0] === '/mcp') {
+      try {
+        const { handleMcpRequest } = await import('./mcphttp.js');
+        await handleMcpRequest(req, res);
+      } catch (err) {
+        jsonErr(res, 500, `openzoo mcp error: ${err.message}`);
+      }
+      return;
+    }
+
     const normalized = normalizePath(req.url);
     if (normalized !== req.url) {
       log(`path ${req.url} -> ${normalized} (base_url already ends in /v1)`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.11.2",
+  "version": "0.12.0",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",