openzoo 0.28.2 → 0.29.0

package/bin/openzoo.js

@@ -77,7 +77,8 @@ async function main() {
       break;
     }
     case 'unblock': {
-      const { unblockBackend, isBlocked } = await import('../lib/hosts.js');
+      const { unblockBackend, unredirect443, isBlocked } = await import('../lib/hosts.js');
+      try { unredirect443(); } catch { /* no redirect to remove */ }
       const r = unblockBackend();
       console.log(r.already ? 'not blocked — nothing to undo' : (isBlocked() ? 'still blocked (sudo declined?)' : 'restored: the editor can reach its own backend again'));
       break;

package/lib/cursorapi.js

@@ -0,0 +1,101 @@
+/**
+ * ANSWER api2.cursor.sh OURSELVES — so a plan-less account can still route.
+ *
+ * WHY THIS EXISTS. Every config-level trick hit the same wall: the editor decides
+ * client-side whether a model may be used, and that decision comes from its own
+ * backend. On an entitled account the custom OpenAI endpoint works (measured: two
+ * Solana settlements). On a plan-less one the editor refuses before a request
+ * exists — "NOT ROUTING, 0 requests" — and nothing we write to its database can
+ * reach that. Blackholing api2.cursor.sh stops the refusal but also stops the
+ * catalog, which is why the picker collapses.
+ *
+ * So: instead of blackholing that host, SERVE it. /etc/hosts already points it at
+ * 127.0.0.1; this is the thing that answers. We return the model catalog and the
+ * entitlement fields ourselves, so the editor believes every model we publish is
+ * available, and its inference still goes to the configured base URL — us.
+ *
+ * WIRE FORMAT, read out of the editor's own bundle (not guessed):
+ *   POST /aiserver.v1.<Service>/<Method>, Connect-RPC, content-type
+ *   application/proto (binary) or application/json.
+ *   aiserver.v1.AvailableModelsResponse
+ *     1 model_names  repeated string
+ *     2 models       repeated AvailableModel
+ *   AvailableModelsResponse.AvailableModel
+ *     1 name string · 2 default_on bool · 5 supports_agent bool
+ *     6 degradation_status enum(0=UNSPECIFIED) · 9 supports_thinking bool
+ *     10 supports_images bool · 14 supports_max_mode bool
+ *     19 supports_non_max_mode bool · 17 client_display_name string
+ *     18 server_model_name string · 22 supports_plan_mode bool
+ *
+ * LIMITS, STATED PLAINLY: this impersonates a host the editor authenticates to,
+ * so it needs a TLS cert the editor trusts (a local CA in the system store) and
+ * it will break whenever the vendor changes their protobuf. It is opt-in.
+ */
+
+/** Minimal protobuf wire writer — enough for the two message shapes above. */
+class Buf {
+  constructor() { this.parts = []; }
+
+  tag(field, wire) { return this.varint((field << 3) | wire); }
+
+  varint(n) {
+    const out = [];
+    let v = Number(n);
+    do { let b = v & 0x7f; v >>>= 7; if (v) b |= 0x80; out.push(b); } while (v);
+    this.parts.push(Buffer.from(out));
+    return this;
+  }
+
+  bool(field, v) { if (v === undefined) return this; this.tag(field, 0); return this.varint(v ? 1 : 0); }
+
+  int(field, v) { if (v === undefined) return this; this.tag(field, 0); return this.varint(v); }
+
+  str(field, v) {
+    if (v === undefined || v === null) return this;
+    const b = Buffer.from(String(v), 'utf8');
+    this.tag(field, 2); this.varint(b.length); this.parts.push(b);
+    return this;
+  }
+
+  msg(field, inner) {
+    const b = inner.done();
+    this.tag(field, 2); this.varint(b.length); this.parts.push(b);
+    return this;
+  }
+
+  done() { return Buffer.concat(this.parts); }
+}
+
+/** One AvailableModel, with every gate answered in the affirmative. */
+function encodeModel(m) {
+  return new Buf()
+    .str(1, m.name)
+    .bool(2, true)                    // default_on
+    .bool(5, true)                    // supports_agent
+    .int(6, 0)                        // degradation_status = UNSPECIFIED
+    .bool(9, true)                    // supports_thinking
+    .bool(10, true)                   // supports_images
+    .bool(14, true)                   // supports_max_mode  <- kills "Max Mode required"
+    .bool(19, true)                   // supports_non_max_mode
+    .int(15, m.contextTokenLimit ?? 200000)
+    .str(17, m.label ?? m.name)       // client_display_name
+    .str(18, m.name)                  // server_model_name
+    .bool(21, true)                   // is_recommended_for_background_composer
+    .bool(22, true);                  // supports_plan_mode
+}
+
+/** aiserver.v1.AvailableModelsResponse over the models we serve. */
+export function encodeAvailableModels(models) {
+  const b = new Buf();
+  for (const m of models) b.str(1, m.name);          // model_names
+  for (const m of models) b.msg(2, encodeModel(m));  // models
+  return b.done();
+}
+
+/** Connect unary framing: 5-byte prefix (flags + big-endian length) + payload. */
+export function connectFrame(payload) {
+  const head = Buffer.alloc(5);
+  head.writeUInt8(0, 0);
+  head.writeUInt32BE(payload.length, 1);
+  return Buffer.concat([head, payload]);
+}

package/lib/cursorbackend.js

@@ -0,0 +1,148 @@
+/**
+ * Impersonate api2.cursor.sh so a PLAN-LESS editor still routes to the zoo.
+ *
+ * THE PROBLEM THIS SOLVES. The editor decides client-side whether a model may be
+ * used, from an answer its own backend gives. On an entitled account the custom
+ * OpenAI endpoint works (measured: real Solana settlements). On a free account the
+ * editor refuses before a request exists — "NOT ROUTING, 0 requests" — and nothing
+ * we write to its database reaches that decision. The only way to change the
+ * decision is to be the thing that answers it.
+ *
+ * WHY NO CERT INSTALL. Impersonating an HTTPS host normally needs a CA the editor
+ * trusts, and no real user installs one — the correct objection that killed the
+ * mkcert approach. But WE spawn the editor binary, so we pass Chromium's
+ * `--ignore-certificate-errors`, and a plain self-signed cert is accepted with
+ * zero prompts and zero trust-store changes. Verified from the bundle that the
+ * editor does NOT pin certs (no certificatePinning / pinnedPublicKey /
+ * checkServerIdentity), so the flag is honoured.
+ *
+ * WHAT WE ANSWER. Only `AvailableModels` needs a real body — the catalog, with
+ * every gate (supports_max_mode, etc.) set true so nothing is refused. Every other
+ * startup call (GetServerConfig, CheckUsage, GetTeams, GetUserPrivacyMode, …) gets
+ * an EMPTY protobuf message, which decodes as all-defaults and is valid for ANY
+ * message type — so we do not need each method's schema, only the one that matters.
+ *
+ * WIRE FORMAT. The editor uses Connect-RPC and gRPC-web. We detect the request's
+ * content-type and answer in kind: bare message for connect unary proto, enveloped
+ * + trailers for grpc-web. Both are handled below.
+ */
+import https from 'node:https';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { encodeAvailableModels } from './cursorapi.js';
+
+const TLS_DIR = path.join(os.homedir(), '.openzoo', 'cursor-tls');
+const CURSOR_HOSTS = ['api2.cursor.sh', 'api3.cursor.sh', 'api4.cursor.sh', 'repo42.cursor.sh'];
+
+/** Generate (once) a self-signed cert covering the cursor backends. openssl is
+ *  on every mac/linux; this is the only external tool and it is not a trust op. */
+export function ensureCert(log = () => {}) {
+  const cert = path.join(TLS_DIR, 'cert.pem');
+  const key = path.join(TLS_DIR, 'key.pem');
+  try { fs.accessSync(cert); fs.accessSync(key); return { cert, key }; } catch { /* make it */ }
+  fs.mkdirSync(TLS_DIR, { recursive: true });
+  const san = `subjectAltName=${CURSOR_HOSTS.map((h) => `DNS:${h}`).join(',')}`;
+  execFileSync('openssl', [
+    'req', '-x509', '-newkey', 'rsa:2048', '-nodes',
+    '-keyout', key, '-out', cert, '-days', '3650',
+    '-subj', '/CN=api2.cursor.sh', '-addext', san,
+  ], { stdio: 'ignore' });
+  log(`cursor-tls: self-signed cert minted at ${TLS_DIR} (no CA, no trust prompt)`);
+  return { cert, key };
+}
+
+/** Read the whole request body. */
+function readBody(req) {
+  return new Promise((resolve) => {
+    const chunks = [];
+    req.on('data', (c) => chunks.push(c));
+    req.on('end', () => resolve(Buffer.concat(chunks)));
+    req.on('error', () => resolve(Buffer.alloc(0)));
+  });
+}
+
+/** grpc-web trailers frame: an enveloped block of "grpc-status:0\r\n". */
+function grpcWebTrailer() {
+  const t = Buffer.from('grpc-status:0\r\ngrpc-message:\r\n', 'utf8');
+  const head = Buffer.alloc(5);
+  head.writeUInt8(0x80, 0);                 // trailer flag
+  head.writeUInt32BE(t.length, 1);
+  return Buffer.concat([head, t]);
+}
+
+/** Envelope a message for grpc-web / connect-streaming (5-byte prefix). */
+function envelope(payload) {
+  const head = Buffer.alloc(5);
+  head.writeUInt8(0, 0);
+  head.writeUInt32BE(payload.length, 1);
+  return Buffer.concat([head, payload]);
+}
+
+/**
+ * Answer one Connect/gRPC-web call. `method` is the trailing method name,
+ * `models` the catalog to publish. Non-catalog methods get an empty-OK body.
+ */
+function respond(req, res, method, models) {
+  const ct = String(req.headers['content-type'] || '');
+  const isGrpcWeb = ct.includes('grpc-web');
+  const isJson = ct.includes('json');
+
+  const bodyProto = method === 'AvailableModels' ? encodeAvailableModels(models) : Buffer.alloc(0);
+
+  if (isJson) {
+    // Connect unary JSON. AvailableModels as JSON; everything else an empty object.
+    const json = method === 'AvailableModels'
+      ? JSON.stringify({ modelNames: models.map((m) => m.name), models: models.map((m) => ({
+          name: m.name, defaultOn: true, supportsAgent: true, supportsMaxMode: true,
+          supportsNonMaxMode: true, supportsThinking: true, supportsImages: true,
+          clientDisplayName: m.label ?? m.name, serverModelName: m.name, supportsPlanMode: true,
+        })) })
+      : '{}';
+    res.writeHead(200, { 'content-type': 'application/json' });
+    res.end(json);
+    return;
+  }
+
+  if (isGrpcWeb) {
+    res.writeHead(200, {
+      'content-type': ct.includes('text') ? 'application/grpc-web-text+proto' : 'application/grpc-web+proto',
+      'grpc-status': '0',
+    });
+    res.end(Buffer.concat([envelope(bodyProto), grpcWebTrailer()]));
+    return;
+  }
+
+  // Connect unary proto: bare message, status in headers.
+  res.writeHead(200, { 'content-type': 'application/proto' });
+  res.end(bodyProto);
+}
+
+/**
+ * Start the impersonation server. Binds `port` (default 8443 — a privileged
+ * 443->port redirect is installed alongside the /etc/hosts entry, so this stays
+ * unprivileged). Returns { server, port }.
+ */
+export function startCursorBackend({ port = 8443, models, log = () => {} } = {}) {
+  const { cert, key } = ensureCert(log);
+  const server = https.createServer(
+    { cert: fs.readFileSync(cert), key: fs.readFileSync(key) },
+    async (req, res) => {
+      // Connect method is the last path segment: /aiserver.v1.XService/Method
+      const method = (req.url || '').split('/').filter(Boolean).pop() || '';
+      await readBody(req);
+      try {
+        respond(req, res, method, models);
+        if (method === 'AvailableModels') log(`cursor-backend: served AvailableModels (${models.length} models, all gates open)`);
+      } catch (e) {
+        res.writeHead(200, { 'content-type': 'application/proto', 'grpc-status': '0' });
+        res.end(Buffer.alloc(0));
+        log(`cursor-backend: ${method} -> empty-ok (${e.message})`);
+      }
+    },
+  );
+  server.on('tlsClientError', () => { /* editor probing; ignore */ });
+  server.listen(port, '127.0.0.1', () => log(`cursor-backend: listening on 127.0.0.1:${port} as ${CURSOR_HOSTS[0]}`));
+  return { server, port };
+}

package/lib/cursorcfg.js

@@ -190,6 +190,14 @@ export function writeEditorProviderConfig(which, { baseUrl, models }) {
       // in a group the dropdown does not draw — visible in Settings (which ignores
       // the index) but "unavailable" in the composer picker. That split — right in
       // Settings, missing from the dropdown — is the tell.
+      // BOTH VIEWS. Read out of Cursor's own bundle:
+      //   routed view (the dropdown that opens on "Auto"):
+      //     _d_(t) => t.visibleInRoutedModelView === true && t.defaultOn !== false
+      //   named view (the Settings list):
+      //     filter(v => v.namedModelSectionIndex !== undefined)
+      // We only ever set the second, so our models were present in Settings and
+      // ABSENT from the composer dropdown — exactly the split that was reported.
+      visibleInRoutedModelView: true,
       namedModelSectionIndex: 0,
       cloudAgentEffortModes: [],
       modelPickerBadges: [],
@@ -265,7 +273,7 @@ export function pinEditorProviderConfig(which, { baseUrl, models }) {
     isRecommendedForBackgroundComposer: false, supportsPlanMode: true,
     supportsSandboxing: true, isUserAdded: true, inputboxShortModelName: slotFor(m).label,
     parameterDefinitions: [], variants: [], legacySlugs: [], idAliases: [],
-    namedModelSectionIndex: 0, cloudAgentEffortModes: [], modelPickerBadges: [],
+    visibleInRoutedModelView: true, namedModelSectionIndex: 0, cloudAgentEffortModes: [], modelPickerBadges: [],
   }))));
   const primary = esc(models[0]);
   const base = esc(baseUrl);

package/lib/hosts.js

@@ -109,3 +109,31 @@ export function unblockBackend() {
   );
   return { ok, blocked: isBlocked() };
 }
+
+/**
+ * Redirect 127.0.0.1:443 -> a high unprivileged port, so the impersonation
+ * server (lib/cursorbackend.js) can answer api2.cursor.sh without running as
+ * root. Applied in the SAME privileged step as the hosts entry; undone by
+ * unblock. Platform-branched; on anything but macOS/Linux we print the command.
+ */
+export function redirect443(toPort, log = console.log) {
+  if (process.platform === 'darwin') {
+    // pf anchor scoped to loopback; -E keeps pf enabled, the anchor is ours to flush.
+    const rule = `rdr pass on lo0 inet proto tcp from any to 127.0.0.1 port 443 -> 127.0.0.1 port ${toPort}`;
+    const ok = privileged(`echo '${rule}' | pfctl -a openzoo -f - 2>/dev/null; pfctl -e 2>/dev/null; true`);
+    return { ok };
+  }
+  if (process.platform === 'linux') {
+    const ok = privileged(`iptables -t nat -C OUTPUT -p tcp -o lo --dport 443 -j REDIRECT --to-ports ${toPort} 2>/dev/null || iptables -t nat -A OUTPUT -p tcp -o lo --dport 443 -j REDIRECT --to-ports ${toPort}; true`);
+    return { ok };
+  }
+  log(`  windows: run in an ADMINISTRATOR shell:`);
+  log(`    netsh interface portproxy add v4tov4 listenport=443 listenaddress=127.0.0.1 connectport=${toPort} connectaddress=127.0.0.1`);
+  return { ok: false, manual: true };
+}
+
+export function unredirect443() {
+  if (process.platform === 'darwin') return { ok: privileged('pfctl -a openzoo -F all 2>/dev/null; true') };
+  if (process.platform === 'linux') return { ok: privileged('iptables -t nat -D OUTPUT -p tcp -o lo --dport 443 -j REDIRECT --to-ports 8443 2>/dev/null; true') };
+  return { ok: false, manual: true };
+}

package/lib/setup.js

@@ -442,6 +442,28 @@ export async function setupEditor(which, target) {
     else console.log('backend: NOT blocked — the editor will keep using its own backend and\n         nothing will reach the zoo. Re-run and enter your password.');
   }
 
+  // 2c. TAKEOVER (--takeover): impersonate the editor's backend so a PLAN-LESS
+  //     account can route. Config alone cannot help there — the editor refuses
+  //     unentitled models before a request exists. So we ANSWER api2.cursor.sh
+  //     ourselves: catalog with every gate open, empty-valid for the rest. No CA
+  //     install — the editor is launched with --ignore-certificate-errors below,
+  //     and it does not pin certs (verified), so a self-signed cert is accepted.
+  if (target0 === 'cursor' && process.argv.includes('--takeover')) {
+    try {
+      const { startCursorBackend } = await import('./cursorbackend.js');
+      const { redirect443 } = await import('./hosts.js');
+      const backModels = models.map((m) => ({ name: m, label: m }));
+      startCursorBackend({ port: 8443, models: backModels, log: (s) => console.log(s) });
+      const rr = redirect443(8443, console.log);
+      console.log(rr.ok ? 'takeover: 443 -> 8443 redirect installed (npx openzoo unblock reverts)'
+        : rr.manual ? 'takeover: apply the redirect above, then relaunch'
+        : 'takeover: could NOT install the 443 redirect — impersonation will not receive traffic');
+      console.log('takeover: launching with --ignore-certificate-errors so the self-signed cert is trusted (no CA install)');
+    } catch (e) {
+      console.log(`takeover: failed to start (${e.message}) — falling back to plain routing`);
+    }
+  }
+
 
 
   // 3. LAUNCH with that env. Editor resolved platform-agnostically; Cursor
@@ -473,6 +495,9 @@ export async function setupEditor(which, target) {
   }
   const useProfile = process.env.OPENZOO_PROFILE === '1' || process.argv.includes('--profile');
   const args = [cwd];
+  // Trust our self-signed impersonation cert without any CA install — this flag
+  // is the entire reason no trust prompt is needed. Only added under --takeover.
+  if (target0 === 'cursor' && process.argv.includes('--takeover')) args.unshift('--ignore-certificate-errors');
   if (useProfile) {
     fs.mkdirSync(PROFILE_DIR, { recursive: true });
     args.unshift(`--user-data-dir=${PROFILE_DIR}`, `--extensions-dir=${path.join(PROFILE_DIR, 'extensions')}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.28.2",
+  "version": "0.29.0",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",
@@ -22,6 +22,7 @@
     "@modelcontextprotocol/sdk": "^1.12.0",
     "@solana/spl-token": "^0.4.14",
     "@solana/web3.js": "^1.98.4",
+    "selfsigned": "^5.5.0",
     "viem": "^2.21.0",
     "zod": "^3.24.0"
   },