openzoo 0.29.2 → 0.29.4

package/bin/cursor-backend.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+/**
+ * Standalone impersonation backend, meant to be spawned WITH PRIVILEGE so it can
+ * bind 127.0.0.1:443 directly — the port the editor dials for api2.cursor.sh.
+ *
+ * WHY A SEPARATE ROOT PROCESS. Binding 443 needs root on unix, but the paying
+ * proxy must NOT run as root (it holds the wallet). This process is static — it
+ * serves a model catalog and empty stubs, touches no keys, no money — so running
+ * only THIS as root is the safe split. The pfctl 443->8443 redirect that would
+ * have avoided root does not deliver loopback-to-loopback on macOS (measured:
+ * self-test FAIL), so a direct bind is the reliable path.
+ *
+ * argv: <port> <models.json> <log-file>
+ */
+import fs from 'node:fs';
+import { startCursorBackend } from '../lib/cursorbackend.js';
+
+const port = Number(process.argv[2] || 443);
+const modelsPath = process.argv[3];
+const logPath = process.argv[4];
+
+const log = (s) => {
+  const line = `${s}\n`;
+  try { if (logPath) fs.appendFileSync(logPath, line); } catch { /* ignore */ }
+  process.stdout.write(line);
+};
+
+let models = [];
+try { models = JSON.parse(fs.readFileSync(modelsPath, 'utf8')); }
+catch (e) { log(`cursor-backend: could not read models (${e.message})`); process.exit(1); }
+
+startCursorBackend({ port, models, log });
+log(`cursor-backend: standalone up on :${port} (${models.length} models)`);

package/bin/openzoo.js

@@ -78,7 +78,8 @@ async function main() {
     }
     case 'unblock': {
       const { unblockBackend, unredirect443, isBlocked } = await import('../lib/hosts.js');
-      try { unredirect443(); } catch { /* no redirect to remove */ }
+      try { unredirect443(); } catch { /* no redirect */ }
+      try { (await import('../lib/hosts.js')).unbindBackend443(); } catch { /* no backend */ }
       const r = unblockBackend();
       console.log(r.already ? 'not blocked — nothing to undo' : (isBlocked() ? 'still blocked (sudo declined?)' : 'restored: the editor can reach its own backend again'));
       break;

package/lib/cursorbackend.js

@@ -26,7 +26,7 @@
  * content-type and answer in kind: bare message for connect unary proto, enveloped
  * + trailers for grpc-web. Both are handled below.
  */
-import https from 'node:https';
+import http2 from 'node:http2';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -80,14 +80,59 @@ function envelope(payload) {
   return Buffer.concat([head, payload]);
 }
 
+/** CORS headers — the editor's renderer is a browser; without these the
+ *  preflight fails and the REAL request (e.g. full_stripe_profile) never fires. */
+const CORS = {
+  'access-control-allow-origin': '*',
+  'access-control-allow-methods': 'GET,POST,OPTIONS,PUT,DELETE',
+  'access-control-allow-headers': '*',
+  'access-control-expose-headers': '*',
+  'access-control-allow-credentials': 'true',
+};
+
+/**
+ * An ENTITLED stripe profile. `#4 OPTIONS /auth/full_stripe_profile` in the log
+ * is THE plan gate — this is what tells the editor whether it may use models.
+ * Empty (my first stub) reads as free, hence "upgrade". These fields report an
+ * active, unlimited membership so nothing is gated.
+ */
+function stripeProfile() {
+  return JSON.stringify({
+    membershipType: 'pro',
+    subscriptionStatus: 'active',
+    verifiedStudent: false,
+    trialEligible: false,
+    daysRemainingOnTrial: 0,
+    isOnStudentPlan: false,
+    hardLimit: null,
+    hardLimitPerUser: null,
+    usageBasedPricingEnabled: true,
+    monthlyUsageBasedLimit: 1000000,
+    individualMembershipType: 'pro',
+    teamMembershipType: null,
+  });
+}
+
 /**
  * Answer one Connect/gRPC-web call. `method` is the trailing method name,
  * `models` the catalog to publish. Non-catalog methods get an empty-OK body.
  */
 function respond(req, res, method, models) {
+  // CORS preflight: answer 204 with the headers, so the real call proceeds.
+  if (req.method === 'OPTIONS') { res.writeHead(204, CORS); res.end(); return; }
+
+  const url = req.url || '';
   const ct = String(req.headers['content-type'] || '');
   const isGrpcWeb = ct.includes('grpc-web');
-  const isJson = ct.includes('json');
+  const isJson = ct.includes('json') || url.startsWith('/auth/');
+
+  // THE ENTITLEMENT ENDPOINT. /auth/full_stripe_profile (and any /auth/*stripe*)
+  // must report an active membership or the editor gates every model.
+  if (/full_stripe_profile|stripe|membership|subscription/i.test(url)) {
+    res.writeHead(200, { 'content-type': 'application/json', ...CORS });
+    res.end(stripeProfile());
+    return;
+  }
 
   const bodyProto = method === 'AvailableModels' ? encodeAvailableModels(models) : Buffer.alloc(0);
 
@@ -100,7 +145,7 @@ function respond(req, res, method, models) {
           clientDisplayName: m.label ?? m.name, serverModelName: m.name, supportsPlanMode: true,
         })) })
       : '{}';
-    res.writeHead(200, { 'content-type': 'application/json' });
+    res.writeHead(200, { 'content-type': 'application/json', ...CORS });
     res.end(json);
     return;
   }
@@ -108,14 +153,14 @@ function respond(req, res, method, models) {
   if (isGrpcWeb) {
     res.writeHead(200, {
       'content-type': ct.includes('text') ? 'application/grpc-web-text+proto' : 'application/grpc-web+proto',
-      'grpc-status': '0',
+      'grpc-status': '0', ...CORS,
     });
     res.end(Buffer.concat([envelope(bodyProto), grpcWebTrailer()]));
     return;
   }
 
   // Connect unary proto: bare message, status in headers.
-  res.writeHead(200, { 'content-type': 'application/proto' });
+  res.writeHead(200, { 'content-type': 'application/proto', ...CORS });
   res.end(bodyProto);
 }
 
@@ -127,13 +172,17 @@ function respond(req, res, method, models) {
 export function startCursorBackend({ port = 8443, models, log = () => {} } = {}) {
   const { cert, key } = ensureCert(log);
   let conns = 0;
-  const server = https.createServer(
+  // HTTP/2 with ALPN, HTTP/1.1 fallback. The editor's Connect-RPC client speaks
+  // h2; a plain https (h1-only) server with no ALPN made most handshakes fail
+  // with ERR_SSL_NO_APPLICATION_PROTOCOL / ECONNRESET (measured in the log), so
+  // only a couple of h1 requests ever completed. allowHTTP1 keeps h1 working too;
+  // the (req,res) compatibility handler serves both.
+  const server = http2.createSecureServer(
     {
       cert: fs.readFileSync(cert),
       key: fs.readFileSync(key),
-      // Log which hostname the editor asked for on the TLS handshake — this is
-      // the single clearest proof the redirect is working and the editor is
-      // reaching US instead of the real backend.
+      allowHTTP1: true,
+      ALPNProtocols: ['h2', 'http/1.1'],
       SNICallback: (servername, cb) => { log(`cursor-tls: <- ClientHello SNI=${servername}`); cb(null); },
     },
     async (req, res) => {
@@ -145,7 +194,11 @@ export function startCursorBackend({ port = 8443, models, log = () => {} } = {})
       log(`cursor-backend: #${conns} ${req.method} ${full}  ct=${ct}  body=${body.length}b`);
       try {
         respond(req, res, method, models);
-        log(`cursor-backend:      -> ${method === 'AvailableModels' ? `AvailableModels (${models.length} models, gates open)` : 'empty-ok'}`);
+        const what = /stripe|membership|subscription/i.test(full) ? 'ENTITLED stripe profile'
+          : method === 'AvailableModels' ? `AvailableModels (${models.length} models, gates open)`
+          : req.method === 'OPTIONS' ? 'CORS preflight 204'
+          : 'empty-ok';
+        log(`cursor-backend:      -> ${what}`);
       } catch (e) {
         res.writeHead(200, { 'content-type': 'application/proto', 'grpc-status': '0' });
         res.end(Buffer.alloc(0));

package/lib/hosts.js

@@ -17,6 +17,8 @@
  * `npx openzoo unblock` restores it. `--no-block` skips it entirely.
  */
 import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { execFileSync, spawnSync } from 'node:child_process';
 
 /**
@@ -137,3 +139,32 @@ export function unredirect443() {
   if (process.platform === 'linux') return { ok: privileged('iptables -t nat -D OUTPUT -p tcp -o lo --dport 443 -j REDIRECT --to-ports 8443 2>/dev/null; true') };
   return { ok: false, manual: true };
 }
+
+/**
+ * Bind the impersonation backend on 127.0.0.1:443 as ROOT — the reliable path
+ * after pfctl loopback redirect proved not to deliver on macOS. Spawned detached
+ * inside the SAME sudo prompt used for the hosts entry; only this static server
+ * runs privileged, never the wallet-holding proxy. unbindBackend443 kills it.
+ */
+export function bindBackend443(modelsPath, logPath, log = console.log) {
+  const here = path.dirname(fileURLToPath(import.meta.url));
+  const script = path.join(here, '..', 'bin', 'cursor-backend.js');
+  const node = process.execPath;
+  if (WIN) {
+    log('  windows: run in an ADMINISTRATOR shell:');
+    log(`    "${node}" "${script}" 443 "${modelsPath}" "${logPath}"`);
+    return { ok: false, manual: true };
+  }
+  // nohup + & so sudo returns immediately; the root process keeps 443 bound.
+  const ok = privileged(
+    `pkill -f 'cursor-backend.js' 2>/dev/null; `
+    + `nohup '${node}' '${script}' 443 '${modelsPath}' '${logPath}' >/dev/null 2>&1 & `
+    + 'sleep 1; true',
+  );
+  return { ok };
+}
+
+export function unbindBackend443() {
+  if (WIN) return { ok: false, manual: true };
+  return { ok: privileged("pkill -f 'cursor-backend.js' 2>/dev/null; true") };
+}

package/lib/setup.js

@@ -454,14 +454,22 @@ export async function setupEditor(which, target) {
   const doTakeover = target0 === 'cursor' && !process.argv.includes('--no-takeover');
   if (doTakeover) {
     try {
-      const { startCursorBackend } = await import('./cursorbackend.js');
-      const { redirect443 } = await import('./hosts.js');
+      const { ensureCert } = await import('./cursorbackend.js');
+      const { bindBackend443 } = await import('./hosts.js');
       const backModels = models.map((m) => ({ name: m, label: m }));
-      startCursorBackend({ port: 8443, models: backModels, log: (s) => console.log(s) });
-      const rr = redirect443(8443, console.log);
-      console.log(rr.ok ? 'takeover: 443 -> 8443 redirect installed (npx openzoo unblock reverts)'
-        : rr.manual ? 'takeover: apply the redirect above, then relaunch'
-        : 'takeover: could NOT install the 443 redirect — impersonation will not receive traffic');
+      // Cert is minted as the USER (root can still read it); models handed to the
+      // privileged listener via a temp file.
+      ensureCert(console.log);
+      const modelsFile = path.join(os.tmpdir(), 'openzoo-cursor-models.json');
+      fs.writeFileSync(modelsFile, JSON.stringify(backModels));
+      const backendLog = path.join(os.homedir(), '.openzoo', 'cursor-backend.log');
+      try { fs.writeFileSync(backendLog, ''); } catch { /* ignore */ }
+      // DIRECT 443 BIND (root) — pfctl loopback redirect measured FAIL, this is
+      // the reliable path. Only this static server runs privileged.
+      const rr = bindBackend443(modelsFile, backendLog, console.log);
+      console.log(rr.ok ? `takeover: backend bound on 127.0.0.1:443 (root); log ${backendLog}`
+        : rr.manual ? 'takeover: run the printed command in an elevated shell, then relaunch'
+        : 'takeover: could NOT bind 443 — impersonation will not receive traffic');
 
       // SELF-TEST — prove the whole path (hosts -> redirect -> our server) works
       // NOW, at startup, so a failure is a loud line here instead of a silent

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.29.2",
+  "version": "0.29.4",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",