openzoo 0.21.4 → 0.21.6

package/lib/setup.js

@@ -203,7 +203,7 @@ export async function setupEditor(which, target) {
     // does not, we say so plainly and still launch.
     if (!publicUrl) {
       process.stdout.write('waiting for the public tunnel');
-      for (let i = 0; i < 60 && !started?.publicUrl; i++) {     // up to 30s
+      for (let i = 0; i < 180 && !started?.publicUrl; i++) {    // up to 90s
         await new Promise((r) => setTimeout(r, 500));
         if (i % 4 === 3) process.stdout.write('.');
       }
@@ -212,9 +212,7 @@ export async function setupEditor(which, target) {
       tunnelKey = started?.tunnelToken ?? tunnelKey;
     }
     if (publicUrl) console.log(`tunnel:  ${publicUrl}/v1   api_key ${tunnelKey}`);
-    else console.log('tunnel:  did not come up in 30s — launching anyway on localhost;\n'
-      + '         the editor will say "Access to private networks is forbidden"\n'
-      + '         until you re-run this command.');
+    else console.log('tunnel:  did not come up in 90s.');
   } else {
     console.log(`proxy already running on ${base}`);
     // A proxy someone else started owns the tunnel; ask it for the public URL.
@@ -227,8 +225,13 @@ export async function setupEditor(which, target) {
   }
   // What the EDITOR is configured with. Localhost only as a last resort, and
   // said out loud, because it will fail with the private-networks error.
-  const editorBase = publicUrl ? `${publicUrl}/v1` : base;
-  if (!publicUrl) console.log('settings: falling back to localhost — expect "Access to private networks is forbidden"');
+  // NEVER WRITE LOCALHOST INTO THE EDITOR. Its server makes the request, so a
+  // private address is unreachable from there and every call returns "Access to
+  // private networks is forbidden". Writing it anyway does not degrade
+  // gracefully — it overwrites a config that may have been working with one
+  // that provably cannot. With no tunnel we leave the existing settings alone
+  // and say why.
+  const editorBase = publicUrl ? `${publicUrl}/v1` : null;
 
   // 2. ENV INTO THE EDITOR. Both vendor shapes, so an OpenAI-compatible pane
   //    and an Anthropic-shaped one (Claude Code extension) both route here.
@@ -256,6 +259,12 @@ export async function setupEditor(which, target) {
   // globalStorage sqlite — not an encrypted store, as previously assumed — so
   // the "paste four things into Settings" ritual is unnecessary. Must happen
   // while the editor is CLOSED or it rewrites them from memory on exit.
+  if (!editorBase) {
+    console.log('settings: NOT touched — a tunnel is required for the editor path and none came up.');
+    console.log('          (localhost cannot work here: the editor calls the endpoint from ITS server,');
+    console.log('           which answers "Access to private networks is forbidden".)');
+    console.log('          your previous settings are left as they were — re-run when the network settles.');
+  }
   const picked0 = pickEditor(which);
   const target0 = picked0?.which || which || 'cursor';
   // Quit it FOR the user — a running editor reverts our write on exit.
@@ -266,7 +275,9 @@ export async function setupEditor(which, target) {
   }
   const models = await catalogModels(base);
   let wrote = null;
-  try { wrote = writeEditorProviderConfig(target0, { baseUrl: editorBase, models, apiKey: tunnelKey }); } catch (e) { wrote = { error: e.message }; }
+  if (editorBase) {
+    try { wrote = writeEditorProviderConfig(target0, { baseUrl: editorBase, models, apiKey: tunnelKey }); } catch (e) { wrote = { error: e.message }; }
+  }
   if (wrote?.error) {
     console.log(`settings: could not write automatically (${wrote.error}) — set them in Settings → Models`);
   } else if (wrote) {

package/lib/tunnel.js

@@ -20,7 +20,7 @@
  *     OPENZOO_MAX_USD_PER_CALL and/or OPENZOO_TUNNEL_MAX_USD to add them;
  *   - every tunnel-served request is logged with its running spend.
  */
-import { spawn } from 'node:child_process';
+import { spawn, execFileSync } from 'node:child_process';
 import { createWriteStream } from 'node:fs';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -91,8 +91,27 @@ export async function ensureCloudflared(log = console.log) {
   return cached;
 }
 
+/**
+ * Kill cloudflared processes left over from previous runs against OUR port.
+ *
+ * WHY: the proxy exits with its terminal but cloudflared does not always go with
+ * it, so repeated `openzoo cursor` runs stack tunnels. Observed: two orphaned
+ * cloudflared processes, the editor configured with a third hostname, and every
+ * request answering 530/1033 — the editor was pointed at a tunnel whose origin
+ * had died while other live tunnels sat there serving nothing.
+ */
+function killStaleTunnels(port, log) {
+  try {
+    const out = execFileSync('pgrep', ['-f', `cloudflared tunnel --url http://localhost:${port}`], { encoding: 'utf8' });
+    const pids = out.split('\n').map((x) => x.trim()).filter(Boolean).filter((x) => Number(x) !== process.pid);
+    for (const pid of pids) { try { process.kill(Number(pid), 'SIGTERM'); } catch { /* already gone */ } }
+    if (pids.length) log(`tunnel: cleared ${pids.length} stale cloudflared process(es) from an earlier run`);
+  } catch { /* pgrep exits non-zero when nothing matches — that is the good case */ }
+}
+
 /** Start a quick tunnel to localhost:<port>; resolve with its public URL. */
 export function startCloudflared(bin, port, log) {
+  killStaleTunnels(port, log);
   return new Promise((resolve, reject) => {
     // --edge-ip-version 4: cloudflared prefers IPv6+QUIC to reach the edge
     // whenever the interface merely HAS an IPv6 address — it never checks the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.21.4",
+  "version": "0.21.6",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",