openzoo 0.20.8 → 0.21.0

package/lib/proxy.js

@@ -285,6 +285,7 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
   // origin, not off whether the URL exists yet, so there is no startup window
   // where public traffic slips through ungated.
   let tunnelGate = null;
+  const rebindHooks = [];
   let tunnelError = null;
 
   const server = http.createServer(async (req, res) => {
@@ -730,12 +731,21 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
   if (autoTunnel && process.env.OPENZOO_NO_TUNNEL !== '1') {
     (async () => {
       try {
-        const { ensureCloudflared, startCloudflared, mintToken } = await import('./tunnel.js');
+        const { ensureCloudflared, startHealthyTunnel, superviseTunnel, mintToken } = await import('./tunnel.js');
         const token = mintToken();
         const cap = process.env.OPENZOO_TUNNEL_MAX_USD ? Number(process.env.OPENZOO_TUNNEL_MAX_USD) : Infinity;
         const bin = await ensureCloudflared((m) => log(m));
-        const { url, proc } = await startCloudflared(bin, config.port, log);
+        // VERIFIED, not merely printed — and supervised, because a quick tunnel
+        // that dies leaves every configured client reconnect-looping at a dead host.
+        const { url, proc } = await startHealthyTunnel(bin, config.port, log);
         tunnelGate = { token, sessionMaxUsd: cap, publicUrl: url };
+        superviseTunnel({
+          bin, port: config.port, url, proc, log,
+          onRebind: async (next) => {
+            tunnelGate.publicUrl = next;                 // /v1/info and callers follow
+            for (const fn of rebindHooks) { try { await fn(next); } catch { /* advisory */ } }
+          },
+        });
         const bye = () => { try { proc.kill('SIGTERM'); } catch { /* already gone */ } };
         process.once('SIGINT', () => { bye(); process.exit(0); });
         process.once('SIGTERM', () => { bye(); process.exit(0); });
@@ -765,6 +775,8 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     spent: () => sessionSpent,
     get publicUrl() { return tunnelGate?.publicUrl ?? null; },
     get tunnelToken() { return tunnelGate?.token ?? null; },
+    /** Called with the new public URL whenever the tunnel self-heals. */
+    onTunnelRebind(fn) { rebindHooks.push(fn); },
     get tunnelError() { return tunnelError; },
   };
 }

package/lib/setup.js

@@ -20,7 +20,10 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
 import { config } from './config.js';
-import { writeEditorProviderConfig, editorRunning, quitEditor, pinEditorProviderConfig } from './cursorcfg.js';
+import {
+  writeEditorProviderConfig, editorRunning, quitEditor,
+  pinEditorProviderConfig, unpinEditorProviderConfig,
+} from './cursorcfg.js';
 
 /**
  * Models offered in the editor's picker — named the way the EDITOR names them.
@@ -163,10 +166,13 @@ export async function setupEditor(which, target) {
   //    harness must use; we surface it rather than leaving them to find it.
   let publicUrl = null;
   let tunnelKey = null;
+  // Declared out here: the tunnel-rebind hook is registered further down, well
+  // outside the block that starts the proxy.
+  let started = null;
   if (!(await proxyUp(base))) {
     console.log(`starting proxy on ${base} (+ public tunnel)...`);
     const { startProxy } = await import('./proxy.js');
-    const started = await startProxy({ silent: true, autoTunnel: true });
+    started = await startProxy({ silent: true, autoTunnel: true });
     publicUrl = started?.publicUrl ?? null;
     tunnelKey = started?.tunnelToken ?? null;
     // DO NOT BLOCK ON THE TUNNEL. Everything below (settings, MCP, launching
@@ -259,6 +265,23 @@ export async function setupEditor(which, target) {
       ? '          pinned        -> yes (the editor re-syncs these from its account; a DB trigger re-applies them)'
       : `          pinned        -> NO (${pin?.error || 'unavailable'}) — the editor may revert these on launch`);
     console.log('  verify: send one message, watch for "paid $0.0… · rail solana · tx …" here.');
+    // FOLLOW THE TUNNEL. A quick tunnel is ephemeral; when it dies the proxy
+    // brings up a new one with a NEW hostname, and an editor still holding the
+    // old URL reconnect-loops against a dead host forever (measured: cloudflare
+    // 530 / error 1033 on every request). Re-write and re-pin on every rebind so
+    // the editor follows without the user restarting anything.
+    started?.onTunnelRebind?.(async (next) => {
+      const base2 = `${next}/v1`;
+      try {
+        unpinEditorProviderConfig(target0);
+        writeEditorProviderConfig(target0, { baseUrl: base2, models, apiKey: tunnelKey });
+        pinEditorProviderConfig(target0, { baseUrl: base2, models });
+        console.log(`\nsettings: tunnel healed — openAIBaseUrl -> ${base2}`);
+        console.log('          (reload the editor window if a request was in flight)');
+      } catch (e) {
+        console.log(`\nsettings: tunnel healed to ${base2} but the config rewrite failed (${e.message})`);
+      }
+    });
   }
 
   // 2b. THE BACKEND BLOCK. Pinning the database is not sufficient on its own:

package/lib/tunnel.js

@@ -91,10 +91,99 @@ export async function ensureCloudflared(log = console.log) {
   return cached;
 }
 
+/**
+ * TUNNEL RUNGS, tried in order until one actually SERVES.
+ *
+ * MEASURED FAILURE: cloudflared came up, printed a URL, and held a single IPv6
+ * socket to :443 with NO connection on 7844 — registration never completed — so
+ * the edge answered every request with 530 / error 1033 "unable to reach origin"
+ * while the process looked perfectly healthy. The URL had already been written
+ * into the editor, which then reconnect-looped forever against a dead host.
+ *
+ * Two lessons, both encoded below: a printed URL is NOT a working tunnel (probe
+ * it), and the default QUIC/auto-edge path can fail in a way that a different
+ * edge-IP or protocol survives — so cascade instead of giving up.
+ */
+const TUNNEL_RUNGS = [
+  { args: [], why: 'default (quic, auto edge ip)' },
+  { args: ['--edge-ip-version', '4'], why: 'ipv4 edge (the ipv6 path failed to register)' },
+  { args: ['--protocol', 'http2'], why: 'http2 (quic/udp blocked or lossy)' },
+  { args: ['--edge-ip-version', '4', '--protocol', 'http2'], why: 'ipv4 + http2 (most conservative)' },
+];
+
+/**
+ * Does this public URL actually reach OUR proxy? A 200 from /v1/models is proof
+ * end to end; 530/1033 is the edge saying it cannot reach the origin. Retries
+ * because a fresh tunnel takes a few seconds to propagate.
+ */
+export async function probeTunnel(url, { tries = 8, gapMs = 2500 } = {}) {
+  for (let i = 0; i < tries; i++) {
+    try {
+      const r = await fetch(`${url}/v1/models`, { signal: AbortSignal.timeout(10000) });
+      if (r.ok) return true;
+    } catch { /* not up yet */ }
+    if (i < tries - 1) await new Promise((r) => setTimeout(r, gapMs));
+  }
+  return false;
+}
+
+/**
+ * Bring up a tunnel that is VERIFIED to serve, walking the rungs above.
+ * Returns { url, proc, rung } or throws when every rung fails.
+ */
+export async function startHealthyTunnel(bin, port, log = () => {}) {
+  let lastErr = null;
+  for (const rung of TUNNEL_RUNGS) {
+    let started = null;
+    try {
+      started = await startCloudflared(bin, port, log, { args: rung.args });
+    } catch (e) { lastErr = e; log(`tunnel: ${rung.why} — ${e.message}`); continue; }
+    if (await probeTunnel(started.url)) {
+      log(`tunnel: up via ${rung.why}`);
+      return { ...started, rung: rung.why };
+    }
+    // Printed a URL but never served — kill it before trying the next rung, or
+    // the dead process keeps holding the port's tunnel slot.
+    log(`tunnel: ${rung.why} printed ${started.url} but the edge could not reach it — next`);
+    try { started.proc.kill(); } catch { /* already gone */ }
+  }
+  throw lastErr || new Error('no cloudflared configuration produced a working tunnel');
+}
+
+/**
+ * Watch a live tunnel and rebuild it when it dies. Quick tunnels are ephemeral;
+ * when one drops, the editor is left pointed at a dead host and reconnect-loops,
+ * so onRebind is how the caller re-writes the new URL wherever it was published.
+ * Returns a stop() function.
+ */
+export function superviseTunnel({ bin, port, url, proc, log = () => {}, onRebind, everyMs = 30000 }) {
+  let current = { url, proc };
+  let stopped = false;
+  let healing = false;
+  const timer = setInterval(async () => {
+    if (stopped || healing) return;
+    // One quick probe; a single blip is not a death sentence.
+    if (await probeTunnel(current.url, { tries: 2, gapMs: 3000 })) return;
+    healing = true;
+    log('tunnel: went unreachable — self-healing');
+    try { current.proc?.kill(); } catch { /* already gone */ }
+    try {
+      const next = await startHealthyTunnel(bin, port, log);
+      current = { url: next.url, proc: next.proc };
+      log(`tunnel: healed -> ${next.url}`);
+      await onRebind?.(next.url);
+    } catch (e) {
+      log(`tunnel: could not heal (${e.message}) — localhost is unaffected; will retry`);
+    } finally { healing = false; }
+  }, everyMs);
+  timer.unref?.();
+  return () => { stopped = true; clearInterval(timer); };
+}
+
 /** Start a quick tunnel to localhost:<port>; resolve with its public URL. */
-export function startCloudflared(bin, port, log) {
+export function startCloudflared(bin, port, log, { args = [] } = {}) {
   return new Promise((resolve, reject) => {
-    const proc = spawn(bin, ['tunnel', '--url', `http://localhost:${port}`, '--no-autoupdate'], {
+    const proc = spawn(bin, ['tunnel', '--url', `http://localhost:${port}`, '--no-autoupdate', ...args], {
       stdio: ['ignore', 'pipe', 'pipe'],
     });
     let settled = false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.20.8",
+  "version": "0.21.0",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",