openzoo 0.29.7 → 0.29.9

package/lib/cursorbackend.js

@@ -26,7 +26,7 @@
  * content-type and answer in kind: bare message for connect unary proto, enveloped
  * + trailers for grpc-web. Both are handled below.
  */
-import https from 'node:https';
+import http2 from 'node:http2';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -172,17 +172,19 @@ function respond(req, res, method, models) {
 export function startCursorBackend({ port = 8443, models, log = () => {} } = {}) {
   const { cert, key } = ensureCert(log);
   let conns = 0;
-  // HTTP/1.1 ONLY, but with ALPN advertising http/1.1. Two measured facts drove
-  // this: (1) with NO ALPN the client aborts with ERR_SSL_NO_APPLICATION_PROTOCOL
-  // — it requires the server to name a protocol; (2) when we offered h2, the
-  // editor's h2 connections RESET (ECONNRESET wall) while its h1 calls completed
-  // (requests #1-5). Connect-RPC and gRPC-web both work over h1, so we advertise
-  // ONLY http/1.1: the client negotiates it and every call completes.
-  const server = https.createServer(
+  // SERVE BOTH h2 AND h1. An earlier build forced h1-only after concluding the
+  // editor's h2 connections reset — but that log was the STALE 8443 backend the
+  // pf redirect was still intercepting, not this server, so the conclusion was
+  // contaminated. Measured cleanly now: some editor connections offer ONLY h2
+  // (ERR_SSL_NO_APPLICATION_PROTOCOL when we advertise just h1), so we must
+  // negotiate both. allowHTTP1 keeps the h1 fetch() calls (stripe/updates)
+  // working; ALPN h2 first satisfies the Connect gRPC client.
+  const server = http2.createSecureServer(
     {
       cert: fs.readFileSync(cert),
       key: fs.readFileSync(key),
-      ALPNProtocols: ['http/1.1'],
+      allowHTTP1: true,
+      ALPNProtocols: ['h2', 'http/1.1'],
       SNICallback: (servername, cb) => { log(`cursor-tls: <- ClientHello SNI=${servername}`); cb(null); },
     },
     async (req, res) => {

package/lib/setup.js

@@ -328,6 +328,14 @@ export async function setupEditor(which, target) {
     ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY || 'sk-openzoo',
     ANTHROPIC_AUTH_TOKEN: process.env.ANTHROPIC_AUTH_TOKEN || 'sk-openzoo',
   };
+  // TRUST OUR SELF-SIGNED IMPERSONATION CERT IN THE EDITOR'S NODE STACK TOO.
+  // --ignore-certificate-errors covers only the Chromium RENDERER (browser fetch:
+  // stripe, updates — those succeeded). The editor's gRPC/Connect transport runs
+  // in the Electron MAIN process on Node's own TLS, which ignores that flag and
+  // rejected our cert — the ECONNRESET-before-ALPN wall in the backend log, and
+  // exactly the model/chat calls we need. NODE_TLS_REJECT_UNAUTHORIZED=0 is the
+  // Node-side switch. Only set under takeover, where we own the endpoint.
+  if (which === 'cursor' && !process.argv.includes('--no-takeover')) env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
 
   console.log('');
   console.log(`mcp:     ${mcpFile}  (openzoo: zoo_bind, zoo_ask, zoo_models, zoo_wallet, zoo_contexts)`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.29.7",
+  "version": "0.29.9",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",