openzoo 0.29.1 → 0.29.3

package/bin/cursor-backend.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+/**
+ * Standalone impersonation backend, meant to be spawned WITH PRIVILEGE so it can
+ * bind 127.0.0.1:443 directly — the port the editor dials for api2.cursor.sh.
+ *
+ * WHY A SEPARATE ROOT PROCESS. Binding 443 needs root on unix, but the paying
+ * proxy must NOT run as root (it holds the wallet). This process is static — it
+ * serves a model catalog and empty stubs, touches no keys, no money — so running
+ * only THIS as root is the safe split. The pfctl 443->8443 redirect that would
+ * have avoided root does not deliver loopback-to-loopback on macOS (measured:
+ * self-test FAIL), so a direct bind is the reliable path.
+ *
+ * argv: <port> <models.json> <log-file>
+ */
+import fs from 'node:fs';
+import { startCursorBackend } from '../lib/cursorbackend.js';
+
+const port = Number(process.argv[2] || 443);
+const modelsPath = process.argv[3];
+const logPath = process.argv[4];
+
+const log = (s) => {
+  const line = `${s}\n`;
+  try { if (logPath) fs.appendFileSync(logPath, line); } catch { /* ignore */ }
+  process.stdout.write(line);
+};
+
+let models = [];
+try { models = JSON.parse(fs.readFileSync(modelsPath, 'utf8')); }
+catch (e) { log(`cursor-backend: could not read models (${e.message})`); process.exit(1); }
+
+startCursorBackend({ port, models, log });
+log(`cursor-backend: standalone up on :${port} (${models.length} models)`);

package/bin/openzoo.js

@@ -78,7 +78,8 @@ async function main() {
     }
     case 'unblock': {
       const { unblockBackend, unredirect443, isBlocked } = await import('../lib/hosts.js');
-      try { unredirect443(); } catch { /* no redirect to remove */ }
+      try { unredirect443(); } catch { /* no redirect */ }
+      try { (await import('../lib/hosts.js')).unbindBackend443(); } catch { /* no backend */ }
       const r = unblockBackend();
       console.log(r.already ? 'not blocked — nothing to undo' : (isBlocked() ? 'still blocked (sudo declined?)' : 'restored: the editor can reach its own backend again'));
       break;

package/lib/hosts.js

@@ -17,6 +17,8 @@
  * `npx openzoo unblock` restores it. `--no-block` skips it entirely.
  */
 import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { execFileSync, spawnSync } from 'node:child_process';
 
 /**
@@ -137,3 +139,32 @@ export function unredirect443() {
   if (process.platform === 'linux') return { ok: privileged('iptables -t nat -D OUTPUT -p tcp -o lo --dport 443 -j REDIRECT --to-ports 8443 2>/dev/null; true') };
   return { ok: false, manual: true };
 }
+
+/**
+ * Bind the impersonation backend on 127.0.0.1:443 as ROOT — the reliable path
+ * after pfctl loopback redirect proved not to deliver on macOS. Spawned detached
+ * inside the SAME sudo prompt used for the hosts entry; only this static server
+ * runs privileged, never the wallet-holding proxy. unbindBackend443 kills it.
+ */
+export function bindBackend443(modelsPath, logPath, log = console.log) {
+  const here = path.dirname(fileURLToPath(import.meta.url));
+  const script = path.join(here, '..', 'bin', 'cursor-backend.js');
+  const node = process.execPath;
+  if (WIN) {
+    log('  windows: run in an ADMINISTRATOR shell:');
+    log(`    "${node}" "${script}" 443 "${modelsPath}" "${logPath}"`);
+    return { ok: false, manual: true };
+  }
+  // nohup + & so sudo returns immediately; the root process keeps 443 bound.
+  const ok = privileged(
+    `pkill -f 'cursor-backend.js' 2>/dev/null; `
+    + `nohup '${node}' '${script}' 443 '${modelsPath}' '${logPath}' >/dev/null 2>&1 & `
+    + 'sleep 1; true',
+  );
+  return { ok };
+}
+
+export function unbindBackend443() {
+  if (WIN) return { ok: false, manual: true };
+  return { ok: privileged("pkill -f 'cursor-backend.js' 2>/dev/null; true") };
+}

package/lib/setup.js

@@ -448,16 +448,53 @@ export async function setupEditor(which, target) {
   //     ourselves: catalog with every gate open, empty-valid for the rest. No CA
   //     install — the editor is launched with --ignore-certificate-errors below,
   //     and it does not pin certs (verified), so a self-signed cert is accepted.
-  if (target0 === 'cursor' && process.argv.includes('--takeover')) {
+  // DEFAULT ON. Takeover is what makes a plan-less account route, and it is
+  // harmless on an entitled one (the editor just reads our catalog instead of
+  // theirs), so it runs unless explicitly disabled with --no-takeover.
+  const doTakeover = target0 === 'cursor' && !process.argv.includes('--no-takeover');
+  if (doTakeover) {
     try {
-      const { startCursorBackend } = await import('./cursorbackend.js');
-      const { redirect443 } = await import('./hosts.js');
+      const { ensureCert } = await import('./cursorbackend.js');
+      const { bindBackend443 } = await import('./hosts.js');
       const backModels = models.map((m) => ({ name: m, label: m }));
-      startCursorBackend({ port: 8443, models: backModels, log: (s) => console.log(s) });
-      const rr = redirect443(8443, console.log);
-      console.log(rr.ok ? 'takeover: 443 -> 8443 redirect installed (npx openzoo unblock reverts)'
-        : rr.manual ? 'takeover: apply the redirect above, then relaunch'
-        : 'takeover: could NOT install the 443 redirect — impersonation will not receive traffic');
+      // Cert is minted as the USER (root can still read it); models handed to the
+      // privileged listener via a temp file.
+      ensureCert(console.log);
+      const modelsFile = path.join(os.tmpdir(), 'openzoo-cursor-models.json');
+      fs.writeFileSync(modelsFile, JSON.stringify(backModels));
+      const backendLog = path.join(os.homedir(), '.openzoo', 'cursor-backend.log');
+      try { fs.writeFileSync(backendLog, ''); } catch { /* ignore */ }
+      // DIRECT 443 BIND (root) — pfctl loopback redirect measured FAIL, this is
+      // the reliable path. Only this static server runs privileged.
+      const rr = bindBackend443(modelsFile, backendLog, console.log);
+      console.log(rr.ok ? `takeover: backend bound on 127.0.0.1:443 (root); log ${backendLog}`
+        : rr.manual ? 'takeover: run the printed command in an elevated shell, then relaunch'
+        : 'takeover: could NOT bind 443 — impersonation will not receive traffic');
+
+      // SELF-TEST — prove the whole path (hosts -> redirect -> our server) works
+      // NOW, at startup, so a failure is a loud line here instead of a silent
+      // "still gated" in the editor. We dial api2.cursor.sh exactly as the editor
+      // will; if our backend logs the ClientHello and answers, it is wired.
+      await new Promise((r) => setTimeout(r, 400));
+      try {
+        const https = await import('node:https');
+        const ok = await new Promise((resolve) => {
+          const rq = https.request({
+            host: 'api2.cursor.sh', port: 443, method: 'POST',
+            path: '/aiserver.v1.AiService/AvailableModels',
+            headers: { 'content-type': 'application/grpc-web+proto' },
+            rejectUnauthorized: false, timeout: 4000,
+          }, (rp) => { rp.on('data', () => {}); rp.on('end', () => resolve(rp.statusCode === 200)); });
+          rq.on('error', () => resolve(false));
+          rq.on('timeout', () => { rq.destroy(); resolve(false); });
+          rq.end();
+        });
+        console.log(ok
+          ? 'takeover: SELF-TEST PASS — api2.cursor.sh:443 reaches our backend. The editor will too.'
+          : 'takeover: SELF-TEST FAIL — api2.cursor.sh:443 did NOT reach our backend.\n'
+            + '          The 443->8443 redirect is not delivering (pfctl/loopback). Tell me and I switch to a root-bound 443.');
+      } catch (e) { console.log(`takeover: self-test error (${e.message})`); }
+
       console.log('takeover: launching with --ignore-certificate-errors so the self-signed cert is trusted (no CA install)');
     } catch (e) {
       console.log(`takeover: failed to start (${e.message}) — falling back to plain routing`);
@@ -497,7 +534,7 @@ export async function setupEditor(which, target) {
   const args = [cwd];
   // Trust our self-signed impersonation cert without any CA install — this flag
   // is the entire reason no trust prompt is needed. Only added under --takeover.
-  if (target0 === 'cursor' && process.argv.includes('--takeover')) args.unshift('--ignore-certificate-errors');
+  if (target0 === 'cursor' && !process.argv.includes('--no-takeover')) args.unshift('--ignore-certificate-errors');
   if (useProfile) {
     fs.mkdirSync(PROFILE_DIR, { recursive: true });
     args.unshift(`--user-data-dir=${PROFILE_DIR}`, `--extensions-dir=${path.join(PROFILE_DIR, 'extensions')}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.29.1",
+  "version": "0.29.3",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",