openzoo 0.29.4 → 0.29.6

package/lib/cursorbackend.js

@@ -26,7 +26,7 @@
  * content-type and answer in kind: bare message for connect unary proto, enveloped
  * + trailers for grpc-web. Both are handled below.
  */
-import http2 from 'node:http2';
+import https from 'node:https';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -172,17 +172,17 @@ function respond(req, res, method, models) {
 export function startCursorBackend({ port = 8443, models, log = () => {} } = {}) {
   const { cert, key } = ensureCert(log);
   let conns = 0;
-  // HTTP/2 with ALPN, HTTP/1.1 fallback. The editor's Connect-RPC client speaks
-  // h2; a plain https (h1-only) server with no ALPN made most handshakes fail
-  // with ERR_SSL_NO_APPLICATION_PROTOCOL / ECONNRESET (measured in the log), so
-  // only a couple of h1 requests ever completed. allowHTTP1 keeps h1 working too;
-  // the (req,res) compatibility handler serves both.
-  const server = http2.createSecureServer(
+  // HTTP/1.1 ONLY, but with ALPN advertising http/1.1. Two measured facts drove
+  // this: (1) with NO ALPN the client aborts with ERR_SSL_NO_APPLICATION_PROTOCOL
+  // — it requires the server to name a protocol; (2) when we offered h2, the
+  // editor's h2 connections RESET (ECONNRESET wall) while its h1 calls completed
+  // (requests #1-5). Connect-RPC and gRPC-web both work over h1, so we advertise
+  // ONLY http/1.1: the client negotiates it and every call completes.
+  const server = https.createServer(
     {
       cert: fs.readFileSync(cert),
       key: fs.readFileSync(key),
-      allowHTTP1: true,
-      ALPNProtocols: ['h2', 'http/1.1'],
+      ALPNProtocols: ['http/1.1'],
       SNICallback: (servername, cb) => { log(`cursor-tls: <- ClientHello SNI=${servername}`); cb(null); },
     },
     async (req, res) => {
@@ -206,9 +206,10 @@ export function startCursorBackend({ port = 8443, models, log = () => {} } = {})
       }
     },
   );
+  server.on('secureConnection', (sock) => { log(`cursor-tls: connected alpn=${sock.alpnProtocol || 'none'} sni=${sock.servername || '?'}`); });
   // NEVER swallow this — a rejected handshake is exactly the failure to see.
   server.on('tlsClientError', (e, sock) => {
-    log(`cursor-tls: HANDSHAKE FAILED ${e.code || e.message} (peer ${sock?.remoteAddress || '?'})`);
+    log(`cursor-tls: HANDSHAKE FAILED ${e.code || e.message} alpn=${sock?.alpnProtocol || '?'}`);
   });
   server.listen(port, '127.0.0.1', () => log(`cursor-backend: listening on 127.0.0.1:${port} as ${CURSOR_HOSTS[0]}`));
   return { server, port };

package/lib/hosts.js

@@ -155,9 +155,16 @@ export function bindBackend443(modelsPath, logPath, log = console.log) {
     log(`    "${node}" "${script}" 443 "${modelsPath}" "${logPath}"`);
     return { ok: false, manual: true };
   }
-  // nohup + & so sudo returns immediately; the root process keeps 443 bound.
+  // KILL THE OLD ROOT BACKEND FIRST, HARD, AND WAIT FOR 443 TO FREE.
+  // A prior version's root-owned listener keeps holding 443; `pkill openzoo` as
+  // the user cannot touch it, so the new backend hit "port taken" and the OLD,
+  // broken one kept answering — the reason a fix looked like it never landed.
+  // We SIGKILL by name AND by whoever holds 443, poll until the port is actually
+  // free (up to ~5s), then start the new one.
   const ok = privileged(
-    `pkill -f 'cursor-backend.js' 2>/dev/null; `
+    `pkill -9 -f 'cursor-backend.js' 2>/dev/null; `
+    + `for p in $(lsof -nP -iTCP:443 -sTCP:LISTEN -t 2>/dev/null); do kill -9 "$p" 2>/dev/null; done; `
+    + `for i in 1 2 3 4 5 6 7 8 9 10; do lsof -nP -iTCP:443 -sTCP:LISTEN -t >/dev/null 2>&1 || break; sleep 0.5; done; `
     + `nohup '${node}' '${script}' 443 '${modelsPath}' '${logPath}' >/dev/null 2>&1 & `
     + 'sleep 1; true',
   );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.29.4",
+  "version": "0.29.6",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",