openzoo 0.21.1 → 0.21.3

package/lib/setup.js

@@ -188,18 +188,24 @@ export async function setupEditor(which, target) {
     // (see the header of lib/tunnel.js). So the public URL is a HARD dependency
     // of the editor path, and we wait for it — bounded, with progress, because
     // an unbounded wait once left the editor never launching at all.
+    // NEVER BLOCK THE LAUNCH ON THE TUNNEL. Waiting inline is what made this
+    // command sit on "waiting for the public tunnel....." with nothing else
+    // happening — and if the tunnel was slow or failing, the editor never opened
+    // at all. The tunnel is genuinely required for the EDITOR path (its server
+    // cannot reach localhost), but we already have a rebind hook that rewrites
+    // and re-pins the config the moment a URL exists, so the honest design is:
+    // launch now with what we have, and follow the tunnel in when it arrives.
     if (!publicUrl) {
-      process.stdout.write('waiting for the public tunnel (the editor\'s server cannot reach localhost)');
-      for (let i = 0; i < 240 && !started?.publicUrl; i++) {   // up to 120s (rungs race; first to SERVE wins)
+      // A couple of seconds only, in case it is already up — then move on.
+      for (let i = 0; i < 6 && !started?.publicUrl; i++) {
         await new Promise((r) => setTimeout(r, 500));
-        if (i % 4 === 3) process.stdout.write('.');
       }
-      console.log('');
       publicUrl = started?.publicUrl ?? null;
       tunnelKey = started?.tunnelToken ?? tunnelKey;
     }
     if (publicUrl) console.log(`tunnel:  ${publicUrl}/v1   api_key ${tunnelKey}`);
-    else console.log('tunnel:  NOT up — the editor will not be able to reach the proxy\n         (OPENZOO_NO_TUNNEL=1 to skip; terminal harnesses still work on localhost)');
+    else console.log('tunnel:  still coming up — launching now; the editor config is\n'
+      + '         rewritten and re-pinned automatically the moment it is ready.');
   } else {
     console.log(`proxy already running on ${base}`);
     // A proxy someone else started owns the tunnel; ask it for the public URL.

package/lib/tunnel.js

@@ -105,10 +105,18 @@ export async function ensureCloudflared(log = console.log) {
  * edge-IP or protocol survives — so cascade instead of giving up.
  */
 const TUNNEL_RUNGS = [
+  // IPv4 FIRST, deliberately. cloudflared prefers IPv6+QUIC to reach the edge
+  // whenever the interface merely HAS an IPv6 address — it never checks the
+  // route is usable. MEASURED on a box with an IPv6 address and no IPv6 route:
+  //   failed to dial to edge with quic: write udp6 [::]->[2606:4700:a8::1]:7844:
+  //   sendmsg: no route to host
+  // ...on every retry, so the tunnel registered and immediately died and the
+  // edge served 502/530 — which looks exactly like a dead origin or a rate
+  // limit, and is neither. Forcing v4 registered first try on the same machine.
+  { args: ['--edge-ip-version', '4'], why: 'ipv4 edge' },
   { args: [], why: 'default (quic, auto edge ip)' },
-  { args: ['--edge-ip-version', '4'], why: 'ipv4 edge (the ipv6 path failed to register)' },
+  { args: ['--edge-ip-version', '4', '--protocol', 'http2'], why: 'ipv4 + http2' },
   { args: ['--protocol', 'http2'], why: 'http2 (quic/udp blocked or lossy)' },
-  { args: ['--edge-ip-version', '4', '--protocol', 'http2'], why: 'ipv4 + http2 (most conservative)' },
 ];
 
 /**
@@ -132,33 +140,26 @@ export async function probeTunnel(url, { tries = 8, gapMs = 2500 } = {}) {
  * Returns { url, proc, rung } or throws when every rung fails.
  */
 export async function startHealthyTunnel(bin, port, log = () => {}) {
-  // RACE, DO NOT WALK. Tried serially, four rungs cost up to 60s waiting for a
-  // URL plus ~20s of probing EACH — minutes of "waiting for the public tunnel"
-  // before the good one is even attempted, and the caller times out first.
-  // Quick tunnels are free and independent, so all rungs are started at once and
-  // the first one that actually SERVES wins; the losers are killed. Worst case
-  // becomes one rung's latency instead of four.
-  const losers = [];
-  let settled = false;
-  const attempts = TUNNEL_RUNGS.map(async (rung) => {
-    const started = await startCloudflared(bin, port, log, { args: rung.args });
-    losers.push(started.proc);
-    const ok = await probeTunnel(started.url, { tries: 6, gapMs: 2000 });
-    if (!ok) throw new Error(`${rung.why}: printed ${started.url} but the edge could not reach it`);
-    if (settled) throw new Error('another rung won');
-    settled = true;
-    return { ...started, rung: rung.why };
-  });
-  try {
-    const winner = await Promise.any(attempts);
-    log(`tunnel: up via ${winner.rung}`);
-    for (const p of losers) { if (p !== winner.proc) { try { p.kill(); } catch { /* gone */ } } }
-    return winner;
-  } catch (agg) {
-    for (const p of losers) { try { p.kill(); } catch { /* gone */ } }
-    const why = agg?.errors?.map((e) => e.message).join(' | ') || agg?.message || 'unknown';
-    throw new Error(`no cloudflared configuration produced a working tunnel (${why})`);
+  // ONE AT A TIME, best rung first. An earlier version raced all four at once;
+  // that is four quick tunnels per invocation against a per-IP-limited free
+  // service, which is a good way to get throttled into exactly the failure it
+  // was meant to dodge. Rung 1 (ipv4) is the measured winner on this network,
+  // so the common path costs one tunnel.
+  let lastErr = null;
+  for (const rung of TUNNEL_RUNGS) {
+    let started = null;
+    try {
+      started = await startCloudflared(bin, port, log, { args: rung.args });
+    } catch (e) { lastErr = e; log(`tunnel: ${rung.why} — ${e.message}`); continue; }
+    if (await probeTunnel(started.url, { tries: 5, gapMs: 2000 })) {
+      log(`tunnel: up via ${rung.why}`);
+      return { ...started, rung: rung.why };
+    }
+    log(`tunnel: ${rung.why} registered but the edge could not reach it — next`);
+    try { started.proc.kill(); } catch { /* already gone */ }
+    lastErr = new Error(`${rung.why}: edge could not reach the origin`);
   }
+  throw lastErr || new Error('no cloudflared configuration produced a working tunnel');
 }
 
 /**
@@ -194,7 +195,13 @@ export function superviseTunnel({ bin, port, url, proc, log = () => {}, onRebind
 /** Start a quick tunnel to localhost:<port>; resolve with its public URL. */
 export function startCloudflared(bin, port, log, { args = [] } = {}) {
   return new Promise((resolve, reject) => {
-    const proc = spawn(bin, ['tunnel', '--url', `http://localhost:${port}`, '--no-autoupdate', ...args], {
+    // 127.0.0.1, NOT localhost. MEASURED: the proxy binds IPv4 only, while
+    // `localhost` resolves to ::1 FIRST on macOS — cloudflared dialled the IPv6
+    // loopback, got connection-refused, and reported "Unable to reach the origin
+    // service" (502) on a tunnel that had registered with Cloudflare perfectly.
+    // Every rung failed identically, which is what made it look like a network
+    // or rate-limit problem when it was a loopback address-family mismatch.
+    const proc = spawn(bin, ['tunnel', '--url', `http://127.0.0.1:${port}`, '--no-autoupdate', ...args], {
       stdio: ['ignore', 'pipe', 'pipe'],
     });
     let settled = false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.21.1",
+  "version": "0.21.3",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",