openzoo 0.18.5 → 0.18.6

package/bin/openzoo.js

@@ -8,6 +8,8 @@ usage:
                          public HTTPS url for cloud IDEs (key required, printed at start)
   npx openzoo cursor [path]   start proxy+tunnel, write MCP config, and LAUNCH
                               Cursor already pointed at the zoo (env inherited)
+                              --profile  use an isolated editor profile the
+                                         vendor account cannot re-sync over
   npx openzoo vscode [path]   same, for VS Code
   npx openzoo editor [path]   whichever is installed (Cursor wins if both)
   npx openzoo launch <cmd> [args]   launch a TERMINAL Messages API client

package/lib/setup.js

@@ -24,6 +24,19 @@ import { writeEditorProviderConfig, editorRunning, quitEditor, pinEditorProvider
 
 const DEFAULT_MODELS = ['anthropic/claude-opus-5', 'deepseek/deepseek-v4-pro-0813'];
 
+/**
+ * An ISOLATED editor profile we own.
+ *
+ * The editor's normal profile syncs provider settings from the vendor account
+ * and overwrites local state on launch — measured repeatedly. `--user-data-dir`
+ * gives it a profile directory we control, so our settings are the only ones
+ * there and nothing upstream reclaims them. Opt in with OPENZOO_PROFILE=1 (or
+ * --profile) because a fresh profile means signing in again and re-adding
+ * extensions; that is a real cost, not a detail to spring on someone.
+ */
+const PROFILE_DIR = process.env.OPENZOO_PROFILE_DIR
+  || path.join(os.homedir(), '.openzoo', 'editor-profile');
+
 const MCP_FILES = {
   cursor: path.join(os.homedir(), '.cursor', 'mcp.json'),
   vscode: path.join(os.homedir(), '.vscode', 'mcp.json'),
@@ -202,8 +215,16 @@ export async function setupEditor(which, target) {
     console.error(`(config is written either way: ${mcpFile})`);
     return;
   }
-  console.log(`launching ${picked.which}...`);
-  const child = spawn(picked.cmd, [cwd], { stdio: 'ignore', env, detached: true });
+  const useProfile = process.env.OPENZOO_PROFILE === '1' || process.argv.includes('--profile');
+  const args = [cwd];
+  if (useProfile) {
+    fs.mkdirSync(PROFILE_DIR, { recursive: true });
+    args.unshift(`--user-data-dir=${PROFILE_DIR}`, `--extensions-dir=${path.join(PROFILE_DIR, 'extensions')}`);
+    console.log(`profile: ${PROFILE_DIR}  (isolated — vendor account sync cannot reclaim these settings)`);
+    console.log('         first run in this profile asks you to sign in; extensions are separate.');
+  }
+  console.log(`launching ${picked.which}${useProfile ? ' (isolated profile)' : ''}...`);
+  const child = spawn(picked.cmd, args, { stdio: 'ignore', env, detached: true });
   child.on('error', (e) => {
     console.error(`could not launch ${picked.which}: ${e.message}`);
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.18.5",
+  "version": "0.18.6",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",