openzoo 0.29.3 → 0.29.4

package/lib/cursorbackend.js

@@ -26,7 +26,7 @@
  * content-type and answer in kind: bare message for connect unary proto, enveloped
  * + trailers for grpc-web. Both are handled below.
  */
-import https from 'node:https';
+import http2 from 'node:http2';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -80,14 +80,59 @@ function envelope(payload) {
   return Buffer.concat([head, payload]);
 }
 
+/** CORS headers — the editor's renderer is a browser; without these the
+ *  preflight fails and the REAL request (e.g. full_stripe_profile) never fires. */
+const CORS = {
+  'access-control-allow-origin': '*',
+  'access-control-allow-methods': 'GET,POST,OPTIONS,PUT,DELETE',
+  'access-control-allow-headers': '*',
+  'access-control-expose-headers': '*',
+  'access-control-allow-credentials': 'true',
+};
+
+/**
+ * An ENTITLED stripe profile. `#4 OPTIONS /auth/full_stripe_profile` in the log
+ * is THE plan gate — this is what tells the editor whether it may use models.
+ * Empty (my first stub) reads as free, hence "upgrade". These fields report an
+ * active, unlimited membership so nothing is gated.
+ */
+function stripeProfile() {
+  return JSON.stringify({
+    membershipType: 'pro',
+    subscriptionStatus: 'active',
+    verifiedStudent: false,
+    trialEligible: false,
+    daysRemainingOnTrial: 0,
+    isOnStudentPlan: false,
+    hardLimit: null,
+    hardLimitPerUser: null,
+    usageBasedPricingEnabled: true,
+    monthlyUsageBasedLimit: 1000000,
+    individualMembershipType: 'pro',
+    teamMembershipType: null,
+  });
+}
+
 /**
  * Answer one Connect/gRPC-web call. `method` is the trailing method name,
  * `models` the catalog to publish. Non-catalog methods get an empty-OK body.
  */
 function respond(req, res, method, models) {
+  // CORS preflight: answer 204 with the headers, so the real call proceeds.
+  if (req.method === 'OPTIONS') { res.writeHead(204, CORS); res.end(); return; }
+
+  const url = req.url || '';
   const ct = String(req.headers['content-type'] || '');
   const isGrpcWeb = ct.includes('grpc-web');
-  const isJson = ct.includes('json');
+  const isJson = ct.includes('json') || url.startsWith('/auth/');
+
+  // THE ENTITLEMENT ENDPOINT. /auth/full_stripe_profile (and any /auth/*stripe*)
+  // must report an active membership or the editor gates every model.
+  if (/full_stripe_profile|stripe|membership|subscription/i.test(url)) {
+    res.writeHead(200, { 'content-type': 'application/json', ...CORS });
+    res.end(stripeProfile());
+    return;
+  }
 
   const bodyProto = method === 'AvailableModels' ? encodeAvailableModels(models) : Buffer.alloc(0);
 
@@ -100,7 +145,7 @@ function respond(req, res, method, models) {
           clientDisplayName: m.label ?? m.name, serverModelName: m.name, supportsPlanMode: true,
         })) })
       : '{}';
-    res.writeHead(200, { 'content-type': 'application/json' });
+    res.writeHead(200, { 'content-type': 'application/json', ...CORS });
     res.end(json);
     return;
   }
@@ -108,14 +153,14 @@ function respond(req, res, method, models) {
   if (isGrpcWeb) {
     res.writeHead(200, {
       'content-type': ct.includes('text') ? 'application/grpc-web-text+proto' : 'application/grpc-web+proto',
-      'grpc-status': '0',
+      'grpc-status': '0', ...CORS,
     });
     res.end(Buffer.concat([envelope(bodyProto), grpcWebTrailer()]));
     return;
   }
 
   // Connect unary proto: bare message, status in headers.
-  res.writeHead(200, { 'content-type': 'application/proto' });
+  res.writeHead(200, { 'content-type': 'application/proto', ...CORS });
   res.end(bodyProto);
 }
 
@@ -127,13 +172,17 @@ function respond(req, res, method, models) {
 export function startCursorBackend({ port = 8443, models, log = () => {} } = {}) {
   const { cert, key } = ensureCert(log);
   let conns = 0;
-  const server = https.createServer(
+  // HTTP/2 with ALPN, HTTP/1.1 fallback. The editor's Connect-RPC client speaks
+  // h2; a plain https (h1-only) server with no ALPN made most handshakes fail
+  // with ERR_SSL_NO_APPLICATION_PROTOCOL / ECONNRESET (measured in the log), so
+  // only a couple of h1 requests ever completed. allowHTTP1 keeps h1 working too;
+  // the (req,res) compatibility handler serves both.
+  const server = http2.createSecureServer(
     {
       cert: fs.readFileSync(cert),
       key: fs.readFileSync(key),
-      // Log which hostname the editor asked for on the TLS handshake — this is
-      // the single clearest proof the redirect is working and the editor is
-      // reaching US instead of the real backend.
+      allowHTTP1: true,
+      ALPNProtocols: ['h2', 'http/1.1'],
       SNICallback: (servername, cb) => { log(`cursor-tls: <- ClientHello SNI=${servername}`); cb(null); },
     },
     async (req, res) => {
@@ -145,7 +194,11 @@ export function startCursorBackend({ port = 8443, models, log = () => {} } = {})
       log(`cursor-backend: #${conns} ${req.method} ${full}  ct=${ct}  body=${body.length}b`);
       try {
         respond(req, res, method, models);
-        log(`cursor-backend:      -> ${method === 'AvailableModels' ? `AvailableModels (${models.length} models, gates open)` : 'empty-ok'}`);
+        const what = /stripe|membership|subscription/i.test(full) ? 'ENTITLED stripe profile'
+          : method === 'AvailableModels' ? `AvailableModels (${models.length} models, gates open)`
+          : req.method === 'OPTIONS' ? 'CORS preflight 204'
+          : 'empty-ok';
+        log(`cursor-backend:      -> ${what}`);
       } catch (e) {
         res.writeHead(200, { 'content-type': 'application/proto', 'grpc-status': '0' });
         res.end(Buffer.alloc(0));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.29.3",
+  "version": "0.29.4",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",