openzoo 0.29.3 → 0.29.5

package/lib/cursorbackend.js

@@ -80,14 +80,59 @@ function envelope(payload) {
   return Buffer.concat([head, payload]);
 }
 
+/** CORS headers — the editor's renderer is a browser; without these the
+ *  preflight fails and the REAL request (e.g. full_stripe_profile) never fires. */
+const CORS = {
+  'access-control-allow-origin': '*',
+  'access-control-allow-methods': 'GET,POST,OPTIONS,PUT,DELETE',
+  'access-control-allow-headers': '*',
+  'access-control-expose-headers': '*',
+  'access-control-allow-credentials': 'true',
+};
+
+/**
+ * An ENTITLED stripe profile. `#4 OPTIONS /auth/full_stripe_profile` in the log
+ * is THE plan gate — this is what tells the editor whether it may use models.
+ * Empty (my first stub) reads as free, hence "upgrade". These fields report an
+ * active, unlimited membership so nothing is gated.
+ */
+function stripeProfile() {
+  return JSON.stringify({
+    membershipType: 'pro',
+    subscriptionStatus: 'active',
+    verifiedStudent: false,
+    trialEligible: false,
+    daysRemainingOnTrial: 0,
+    isOnStudentPlan: false,
+    hardLimit: null,
+    hardLimitPerUser: null,
+    usageBasedPricingEnabled: true,
+    monthlyUsageBasedLimit: 1000000,
+    individualMembershipType: 'pro',
+    teamMembershipType: null,
+  });
+}
+
 /**
  * Answer one Connect/gRPC-web call. `method` is the trailing method name,
  * `models` the catalog to publish. Non-catalog methods get an empty-OK body.
  */
 function respond(req, res, method, models) {
+  // CORS preflight: answer 204 with the headers, so the real call proceeds.
+  if (req.method === 'OPTIONS') { res.writeHead(204, CORS); res.end(); return; }
+
+  const url = req.url || '';
   const ct = String(req.headers['content-type'] || '');
   const isGrpcWeb = ct.includes('grpc-web');
-  const isJson = ct.includes('json');
+  const isJson = ct.includes('json') || url.startsWith('/auth/');
+
+  // THE ENTITLEMENT ENDPOINT. /auth/full_stripe_profile (and any /auth/*stripe*)
+  // must report an active membership or the editor gates every model.
+  if (/full_stripe_profile|stripe|membership|subscription/i.test(url)) {
+    res.writeHead(200, { 'content-type': 'application/json', ...CORS });
+    res.end(stripeProfile());
+    return;
+  }
 
   const bodyProto = method === 'AvailableModels' ? encodeAvailableModels(models) : Buffer.alloc(0);
 
@@ -100,7 +145,7 @@ function respond(req, res, method, models) {
           clientDisplayName: m.label ?? m.name, serverModelName: m.name, supportsPlanMode: true,
         })) })
       : '{}';
-    res.writeHead(200, { 'content-type': 'application/json' });
+    res.writeHead(200, { 'content-type': 'application/json', ...CORS });
     res.end(json);
     return;
   }
@@ -108,14 +153,14 @@ function respond(req, res, method, models) {
   if (isGrpcWeb) {
     res.writeHead(200, {
       'content-type': ct.includes('text') ? 'application/grpc-web-text+proto' : 'application/grpc-web+proto',
-      'grpc-status': '0',
+      'grpc-status': '0', ...CORS,
     });
     res.end(Buffer.concat([envelope(bodyProto), grpcWebTrailer()]));
     return;
   }
 
   // Connect unary proto: bare message, status in headers.
-  res.writeHead(200, { 'content-type': 'application/proto' });
+  res.writeHead(200, { 'content-type': 'application/proto', ...CORS });
   res.end(bodyProto);
 }
 
@@ -127,13 +172,17 @@ function respond(req, res, method, models) {
 export function startCursorBackend({ port = 8443, models, log = () => {} } = {}) {
   const { cert, key } = ensureCert(log);
   let conns = 0;
+  // HTTP/1.1 ONLY, but with ALPN advertising http/1.1. Two measured facts drove
+  // this: (1) with NO ALPN the client aborts with ERR_SSL_NO_APPLICATION_PROTOCOL
+  // — it requires the server to name a protocol; (2) when we offered h2, the
+  // editor's h2 connections RESET (ECONNRESET wall) while its h1 calls completed
+  // (requests #1-5). Connect-RPC and gRPC-web both work over h1, so we advertise
+  // ONLY http/1.1: the client negotiates it and every call completes.
   const server = https.createServer(
     {
       cert: fs.readFileSync(cert),
       key: fs.readFileSync(key),
-      // Log which hostname the editor asked for on the TLS handshake — this is
-      // the single clearest proof the redirect is working and the editor is
-      // reaching US instead of the real backend.
+      ALPNProtocols: ['http/1.1'],
       SNICallback: (servername, cb) => { log(`cursor-tls: <- ClientHello SNI=${servername}`); cb(null); },
     },
     async (req, res) => {
@@ -145,7 +194,11 @@ export function startCursorBackend({ port = 8443, models, log = () => {} } = {})
       log(`cursor-backend: #${conns} ${req.method} ${full}  ct=${ct}  body=${body.length}b`);
       try {
         respond(req, res, method, models);
-        log(`cursor-backend:      -> ${method === 'AvailableModels' ? `AvailableModels (${models.length} models, gates open)` : 'empty-ok'}`);
+        const what = /stripe|membership|subscription/i.test(full) ? 'ENTITLED stripe profile'
+          : method === 'AvailableModels' ? `AvailableModels (${models.length} models, gates open)`
+          : req.method === 'OPTIONS' ? 'CORS preflight 204'
+          : 'empty-ok';
+        log(`cursor-backend:      -> ${what}`);
       } catch (e) {
         res.writeHead(200, { 'content-type': 'application/proto', 'grpc-status': '0' });
         res.end(Buffer.alloc(0));
@@ -153,9 +206,10 @@ export function startCursorBackend({ port = 8443, models, log = () => {} } = {})
       }
     },
   );
+  server.on('secureConnection', (sock) => { log(`cursor-tls: connected alpn=${sock.alpnProtocol || 'none'} sni=${sock.servername || '?'}`); });
   // NEVER swallow this — a rejected handshake is exactly the failure to see.
   server.on('tlsClientError', (e, sock) => {
-    log(`cursor-tls: HANDSHAKE FAILED ${e.code || e.message} (peer ${sock?.remoteAddress || '?'})`);
+    log(`cursor-tls: HANDSHAKE FAILED ${e.code || e.message} alpn=${sock?.alpnProtocol || '?'}`);
   });
   server.listen(port, '127.0.0.1', () => log(`cursor-backend: listening on 127.0.0.1:${port} as ${CURSOR_HOSTS[0]}`));
   return { server, port };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.29.3",
+  "version": "0.29.5",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",