openzoo 0.20.1 → 0.20.3

package/bin/openzoo.js

@@ -6,8 +6,10 @@ const HELP = `openzoo — local x402-paying proxy + MCP server for openzoo.fun
 usage:
   npx openzoo            start the proxy: http://localhost:8402/v1 (keyless) PLUS a
                          public HTTPS url for cloud IDEs (key required, printed at start)
-  npx openzoo cursor [path]   start proxy+tunnel, write MCP config, and LAUNCH
-                              Cursor already pointed at the zoo (env inherited)
+  npx openzoo cursor [dir]    start proxy+tunnel, write MCP config + every model
+                              into the picker, and LAUNCH Cursor on [dir]
+                              (defaults to the current directory; ~ works;
+                               a missing dir is created)
                               --profile  use an isolated editor profile the
                                          vendor account cannot re-sync over
   npx openzoo vscode [path]   same, for VS Code

package/lib/hosts.js

@@ -0,0 +1,110 @@
+/**
+ * Force the editor off its own backend by blackholing it in /etc/hosts.
+ *
+ * WHY THIS IS NEEDED: Cursor renders its model picker from IN-MEMORY state that
+ * it re-syncs from `api2.cursor.sh` on window focus. Writing the database is not
+ * enough — measured, the DB held 413 openzoo models and the correct selection
+ * while the UI showed none, because the sync repainted memory a moment later.
+ * The same host is `bcProxyUrl`, the route Cursor's own inference takes, so
+ * while it is reachable the editor will always prefer it over a custom endpoint.
+ *
+ * Pointing it at 127.0.0.1 makes that path fail, leaving the configured OpenAI
+ * base URL as the only way out.
+ *
+ * COLLATERAL, STATED PLAINLY: that host also carries auth and usage reporting.
+ * The editor may report being signed out or degraded. This is a system-wide
+ * change requiring sudo — so it is OPT-IN (`--block-backend`), always backs up
+ * to /etc/hosts.openzoo-backup, and `--unblock` restores it.
+ */
+import fs from 'node:fs';
+import { execFileSync, spawnSync } from 'node:child_process';
+
+/**
+ * Hosts-file location and the privilege/flush mechanics differ per platform:
+ *   macOS   /etc/hosts          sudo   + dscacheutil/mDNSResponder
+ *   Linux   /etc/hosts          sudo   + systemd-resolve or nscd (best effort)
+ *   Windows %SystemRoot%\\System32\\drivers\\etc\\hosts, needs an ELEVATED shell
+ * Everything below branches on that rather than assuming macOS.
+ */
+const WIN = process.platform === 'win32';
+const HOSTS = WIN
+  ? `${process.env.SystemRoot || 'C:\\Windows'}\\System32\\drivers\\etc\\hosts`
+  : '/etc/hosts';
+const BACKUP = `${HOSTS}.openzoo-backup`;
+const MARK = '# openzoo: force the editor onto the local proxy';
+
+/** Hosts the editor uses for model sync + its own inference proxy. */
+export const BACKEND_HOSTS = ['api2.cursor.sh'];
+
+export function isBlocked() {
+  try {
+    const txt = fs.readFileSync(HOSTS, 'utf8');
+    return BACKEND_HOSTS.every((h) => new RegExp(`^\\s*127\\.0\\.0\\.1\\s+${h.replace('.', '\\.')}`, 'm').test(txt));
+  } catch { return false; }
+}
+
+/**
+ * Run a privileged command. On unix sudo prompts in the user's own terminal;
+ * on Windows we cannot elevate from here, so we return false and the caller
+ * prints the line to run in an Administrator shell.
+ */
+function privileged(unixLine) {
+  if (WIN) return false;
+  const r = spawnSync('sudo', ['sh', '-c', unixLine], { stdio: 'inherit' });
+  return r.status === 0;
+}
+
+/** Flush the OS resolver cache, best effort, per platform. */
+function flushDnsCmd() {
+  if (process.platform === 'darwin') {
+    return 'dscacheutil -flushcache 2>/dev/null; killall -HUP mDNSResponder 2>/dev/null; true';
+  }
+  // Linux: whichever of these exists; none is fatal.
+  return 'resolvectl flush-caches 2>/dev/null || systemd-resolve --flush-caches 2>/dev/null'
+    + ' || service nscd restart 2>/dev/null; true';
+}
+
+export function blockBackend() {
+  if (isBlocked()) return { already: true };
+  const entries = BACKEND_HOSTS.map((h) => `127.0.0.1 ${h}`).join('\\n');
+  console.log('');
+  console.log('blocking the editor\'s backend so it cannot re-sync over your model list.');
+  console.log(`  hosts   : ${BACKEND_HOSTS.join(', ')} -> 127.0.0.1`);
+  console.log(`  backup  : ${BACKUP}`);
+  console.log('  NOTE    : that host also carries the editor\'s auth/usage — it may report');
+  console.log('            being signed out. Undo any time with: npx openzoo unblock');
+  console.log('  sudo will ask for your password now.');
+  if (WIN) {
+    console.log('  windows: run this in an ADMINISTRATOR PowerShell, then relaunch:');
+    console.log(`    Copy-Item "${HOSTS}" "${BACKUP}" -ErrorAction SilentlyContinue`);
+    for (const h of BACKEND_HOSTS) console.log(`    Add-Content "${HOSTS}" "127.0.0.1 ${h}"`);
+    console.log('    ipconfig /flushdns');
+    return { ok: false, manual: true, blocked: false };
+  }
+  const ok = privileged(
+    `cp -n ${HOSTS} ${BACKUP} 2>/dev/null; `
+    + `printf '\\n${MARK}\\n${entries}\\n' >> ${HOSTS}; `
+    + flushDnsCmd(),
+  );
+  return { ok, blocked: isBlocked() };
+}
+
+export function unblockBackend() {
+  if (!isBlocked()) return { already: true };
+  // Remove only OUR lines, never restore wholesale — the user may have edited
+  // /etc/hosts for unrelated reasons since the backup was taken.
+  const pattern = BACKEND_HOSTS.map((h) => h.replace('.', '\\.')).join('|');
+  if (WIN) {
+    console.log('windows: run in an ADMINISTRATOR PowerShell:');
+    console.log(`  Copy-Item "${BACKUP}" "${HOSTS}" -Force; ipconfig /flushdns`);
+    return { ok: false, manual: true };
+  }
+  // BSD sed (macOS) needs -i ''; GNU sed (linux) must NOT have it. Use a temp
+  // file instead so one command is correct on both.
+  const re = `/^[[:space:]]*127\\.0\\.0\\.1[[:space:]]+(${pattern})[[:space:]]*$/d; /openzoo: force the editor/d`;
+  const ok = privileged(
+    `sed -E '${re}' ${HOSTS} > ${HOSTS}.oztmp && cat ${HOSTS}.oztmp > ${HOSTS} && rm -f ${HOSTS}.oztmp; `
+    + flushDnsCmd(),
+  );
+  return { ok, blocked: isBlocked() };
+}

package/lib/setup.js

@@ -251,7 +251,21 @@ export async function setupEditor(which, target) {
   // Open the directory you ran this from, or the one you named. The earlier
   // "helpfully" substitute a ~/openzoo folder when run from $HOME was worse
   // than the problem it dodged: it silently opened the wrong project.
-  const cwd = target && !target.startsWith('-') ? target : process.cwd();
+  // WORKSPACE: `openzoo cursor ~/somedir` opens that directory. Resolve it
+  // ourselves — a quoted `~` never reaches the shell's expansion, and a path
+  // that does not exist yet should be created rather than silently opening the
+  // wrong folder (the editor treats a missing path as a file and opens blank).
+  let cwd = process.cwd();
+  if (target && !target.startsWith('-')) {
+    cwd = target.startsWith('~')
+      ? path.join(os.homedir(), target.slice(1))
+      : path.resolve(target);
+    if (!fs.existsSync(cwd)) {
+      fs.mkdirSync(cwd, { recursive: true });
+      console.log(`workspace: created ${cwd}`);
+    }
+  }
+  console.log(`workspace: ${cwd}`);
 
   const picked = pickEditor(which);
   if (!picked) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.20.1",
+  "version": "0.20.3",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",