openzoo 0.29.1 → 0.29.2

package/lib/setup.js

@@ -448,7 +448,11 @@ export async function setupEditor(which, target) {
   //     ourselves: catalog with every gate open, empty-valid for the rest. No CA
   //     install — the editor is launched with --ignore-certificate-errors below,
   //     and it does not pin certs (verified), so a self-signed cert is accepted.
-  if (target0 === 'cursor' && process.argv.includes('--takeover')) {
+  // DEFAULT ON. Takeover is what makes a plan-less account route, and it is
+  // harmless on an entitled one (the editor just reads our catalog instead of
+  // theirs), so it runs unless explicitly disabled with --no-takeover.
+  const doTakeover = target0 === 'cursor' && !process.argv.includes('--no-takeover');
+  if (doTakeover) {
     try {
       const { startCursorBackend } = await import('./cursorbackend.js');
       const { redirect443 } = await import('./hosts.js');
@@ -458,6 +462,31 @@ export async function setupEditor(which, target) {
       console.log(rr.ok ? 'takeover: 443 -> 8443 redirect installed (npx openzoo unblock reverts)'
         : rr.manual ? 'takeover: apply the redirect above, then relaunch'
         : 'takeover: could NOT install the 443 redirect — impersonation will not receive traffic');
+
+      // SELF-TEST — prove the whole path (hosts -> redirect -> our server) works
+      // NOW, at startup, so a failure is a loud line here instead of a silent
+      // "still gated" in the editor. We dial api2.cursor.sh exactly as the editor
+      // will; if our backend logs the ClientHello and answers, it is wired.
+      await new Promise((r) => setTimeout(r, 400));
+      try {
+        const https = await import('node:https');
+        const ok = await new Promise((resolve) => {
+          const rq = https.request({
+            host: 'api2.cursor.sh', port: 443, method: 'POST',
+            path: '/aiserver.v1.AiService/AvailableModels',
+            headers: { 'content-type': 'application/grpc-web+proto' },
+            rejectUnauthorized: false, timeout: 4000,
+          }, (rp) => { rp.on('data', () => {}); rp.on('end', () => resolve(rp.statusCode === 200)); });
+          rq.on('error', () => resolve(false));
+          rq.on('timeout', () => { rq.destroy(); resolve(false); });
+          rq.end();
+        });
+        console.log(ok
+          ? 'takeover: SELF-TEST PASS — api2.cursor.sh:443 reaches our backend. The editor will too.'
+          : 'takeover: SELF-TEST FAIL — api2.cursor.sh:443 did NOT reach our backend.\n'
+            + '          The 443->8443 redirect is not delivering (pfctl/loopback). Tell me and I switch to a root-bound 443.');
+      } catch (e) { console.log(`takeover: self-test error (${e.message})`); }
+
       console.log('takeover: launching with --ignore-certificate-errors so the self-signed cert is trusted (no CA install)');
     } catch (e) {
       console.log(`takeover: failed to start (${e.message}) — falling back to plain routing`);
@@ -497,7 +526,7 @@ export async function setupEditor(which, target) {
   const args = [cwd];
   // Trust our self-signed impersonation cert without any CA install — this flag
   // is the entire reason no trust prompt is needed. Only added under --takeover.
-  if (target0 === 'cursor' && process.argv.includes('--takeover')) args.unshift('--ignore-certificate-errors');
+  if (target0 === 'cursor' && !process.argv.includes('--no-takeover')) args.unshift('--ignore-certificate-errors');
   if (useProfile) {
     fs.mkdirSync(PROFILE_DIR, { recursive: true });
     args.unshift(`--user-data-dir=${PROFILE_DIR}`, `--extensions-dir=${path.join(PROFILE_DIR, 'extensions')}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.29.1",
+  "version": "0.29.2",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",