openzoo 0.12.2 → 0.12.3

package/lib/namespace.js

@@ -14,10 +14,27 @@ import { loadOrCreateWallet } from './wallet.js';
  * Derived from the PUBLIC key, never the secret: it must be stable across
  * restarts and reveal nothing. It is hashed again server-side, so the value on
  * the wire is not the address either.
+ *
+ * OPT-IN (OPENZOO_NAMESPACE=1), and off by default, deliberately.
+ *
+ * Isolation is only sound if EVERY surface agrees on the namespace. In
+ * practice they do not: the MCP server, the CLI and the proxy are separate
+ * processes that a user upgrades at different times (npx happily serves a
+ * stale cached build), so a corpus bound by a namespaced `zoo_bind` became
+ * invisible to a chat sent through an older proxy — the context vanished,
+ * every spill bind returned 400, and the gateway fell open and forwarded the
+ * whole body at full price. MEASURED twice in one session, in both directions.
+ *
+ * A header the client controls was the wrong mechanism: real isolation should
+ * key off the settling payer, which the gateway already knows and cannot get
+ * out of sync. Until that exists, defaulting off restores the behaviour that
+ * always worked, and the gateway's fallback keeps namespaced contexts
+ * reachable for anyone who opts in.
  */
 let cached = null;
 
 export function namespaceHeaderValue() {
+  if (process.env.OPENZOO_NAMESPACE !== '1') return '';
   if (cached) return cached;
   try {
     const w = loadOrCreateWallet();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.12.2",
+  "version": "0.12.3",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",