openzoo 0.30.6 → 0.32.0

package/lib/cursorbackend.js

@@ -118,6 +118,80 @@ function stripeProfile() {
   });
 }
 
+/**
+ * Pull the user's prompt out of a StreamUnifiedChatRequest without the full
+ * schema: walk the protobuf, collect plausible UTF-8 string fields, take the
+ * longest natural-language one (the new user turn). The captured .bin refines it.
+ */
+function extractPromptText(buf) {
+  const strings = [];
+  const walk = (b, depth) => {
+    let i = 0;
+    while (i < b.length) {
+      let key = 0, shift = 0, byte;
+      do { if (i >= b.length) return; byte = b[i++]; key |= (byte & 0x7f) << shift; shift += 7; } while (byte & 0x80);
+      const wire = key & 7;
+      if (wire === 2) {
+        let len = 0; shift = 0;
+        do { if (i >= b.length) return; byte = b[i++]; len |= (byte & 0x7f) << shift; shift += 7; } while (byte & 0x80);
+        const sub = b.subarray(i, i + len); i += len;
+        const txt = sub.toString('utf8');
+        if (len > 1 && /[a-zA-Z]/.test(txt) && !/[\x00-\x08\x0e-\x1f]/.test(txt)) strings.push(txt);
+        else if (depth < 6) walk(sub, depth + 1);
+      } else if (wire === 0) { while (i < b.length && (b[i++] & 0x80)) { /* skip */ } }
+      else if (wire === 5) { i += 4; } else if (wire === 1) { i += 8; } else { return; }
+    }
+  };
+  try { walk(buf, 0); } catch { /* best effort */ }
+  const cand = strings.filter((x) => /\s/.test(x.trim()) || x.length > 12);
+  return ((cand.length ? cand : strings).sort((a, b) => b.length - a.length)[0] || '').trim();
+}
+
+/** StreamUnifiedChatResponse{1: text}. */
+function encodeChatResponse(text) {
+  const t = Buffer.from(text, 'utf8');
+  const head = [0x0a];
+  let n = t.length; do { let x = n & 0x7f; n = Math.floor(n / 128); if (n) x |= 0x80; head.push(x); } while (n);
+  return Buffer.concat([Buffer.from(head), t]);
+}
+
+/**
+ * ROUTE AUTO THROUGH THE ZOO. Cursor's chat inference is ChatService/
+ * StreamUnifiedChat to the agent host (now impersonated). Parse the prompt, pay
+ * the zoo via the local proxy, stream the answer back as StreamUnifiedChatResponse
+ * frames. Legitimate: Auto is free-allowed; we redirect the operator's OWN
+ * inference to their OWN paid proxy.
+ */
+async function handleStreamChat(req, res, body, log) {
+  const ct = String(req.headers['content-type'] || '');
+  const isGrpcWeb = ct.includes('grpc-web');
+  const prompt = extractPromptText(body) || 'hello';
+  log(`cursor-backend:      >> StreamUnifiedChat prompt: ${JSON.stringify(prompt.slice(0, 80))}`);
+  let text = '';
+  try {
+    const zoo = await fetch('http://127.0.0.1:8402/v1/chat/completions', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', authorization: 'Bearer sk-openzoo' },
+      body: JSON.stringify({
+        model: process.env.OPENZOO_DEFAULT_MODEL || 'anthropic/claude-opus-5',
+        messages: [{ role: 'user', content: prompt }],
+        max_tokens: Number(process.env.OPENZOO_ASK_MAX_TOKENS || 2048),
+      }),
+    });
+    const data = await zoo.json();
+    text = data.choices?.[0]?.message?.content || '(no content)';
+    log(`cursor-backend:      << zoo replied ${text.length} chars (paid x402)`);
+  } catch (e) { text = `openzoo error: ${e.message}`; log(`cursor-backend:      zoo call failed: ${e.message}`); }
+
+  res.writeHead(200, {
+    'content-type': isGrpcWeb ? 'application/grpc-web+proto' : 'application/connect+proto',
+    'grpc-status': '0', ...CORS,
+  });
+  res.write(envelope(encodeChatResponse(text)));
+  if (isGrpcWeb) { res.end(grpcWebTrailer()); }
+  else { const end = Buffer.from('{}'); const h = Buffer.alloc(5); h.writeUInt8(0x02, 0); h.writeUInt32BE(end.length, 1); res.end(Buffer.concat([h, end])); }
+}
+
 /**
  * Answer one Connect/gRPC-web call. `method` is the trailing method name,
  * `models` the catalog to publish. Non-catalog methods get an empty-OK body.
@@ -199,6 +273,12 @@ export function startCursorBackend({ port = 8443, models, log = () => {} } = {})
       const ct = req.headers['content-type'] || '?';
       const body = await readBody(req);
       log(`cursor-backend: #${conns} ${req.method} ${full}  ct=${ct}  body=${body.length}b`);
+      // CAPTURE the chat inference request so its schema can be decoded from
+      // REAL bytes (Auto's StreamUnifiedChat). Written once; inspect then build.
+      if (/StreamUnifiedChat/.test(full)) {
+        await handleStreamChat(req, res, body, log);
+        return;
+      }
       try {
         respond(req, res, method, models);
         const populated = ['GetPlanInfo', 'GetMe', 'GetDefaultModel', 'IsOnNewPricing'];

package/lib/cursorcfg.js

@@ -144,14 +144,13 @@ export function writeEditorProviderConfig(which, { baseUrl, models }) {
   const before = { openAIBaseUrl: doc.openAIBaseUrl, models: (doc.availableAPIKeyModels || []).length };
   doc.openAIBaseUrl = baseUrl;
   doc.useOpenAIKey = true;
-  // THE MODEL-SELECTION GATE READS MEMBERSHIP FROM RIGHT HERE. Traced in the
-  // bundle: membershipType(){ return this.reactiveStorageService
-  // .applicationUserPersistentStorage.membershipType } — i.e. THIS blob, not
-  // cursorAuth/stripeMembershipType. Setting it entitles model selection; the
-  // api2 impersonation keeps the editor from re-syncing it back to free.
-  // OPENZOO_MEMBERSHIP overrides (pro | pro_plus | enterprise | ultra).
-  doc.membershipType = process.env.OPENZOO_MEMBERSHIP || 'pro';
-  doc.subscriptionStatus = 'active';
+  // MEMBERSHIP FORGERY IS OPT-IN. Setting membershipType here spoofs Cursor's
+  // paid-tier gate on an unpaid account — only do it when the operator explicitly
+  // asks with OPENZOO_MEMBERSHIP. Default writes leave the real membership alone.
+  if (process.env.OPENZOO_MEMBERSHIP) {
+    doc.membershipType = process.env.OPENZOO_MEMBERSHIP;
+    doc.subscriptionStatus = 'active';
+  }
   // Merge, don't clobber: a user may have their own custom models listed.
   const existing = Array.isArray(doc.availableAPIKeyModels) ? doc.availableAPIKeyModels : [];
   const names = new Set(existing.map((m) => (typeof m === 'string' ? m : m?.name)).filter(Boolean));
@@ -265,7 +264,7 @@ export function writeEditorProviderConfig(which, { baseUrl, models }) {
  * that clobbers them. Removable with unpinEditorProviderConfig.
  */
 export function pinEditorProviderConfig(which, { baseUrl, models }) {
-  const mem = process.env.OPENZOO_MEMBERSHIP || 'pro';
+  const mem = process.env.OPENZOO_MEMBERSHIP || null;
   const db = storagePath(which);
   if (!fs.existsSync(db)) return null;
   const esc = (v) => String(v).replace(/'/g, "''");
@@ -292,8 +291,8 @@ CREATE TRIGGER openzoo_pin AFTER UPDATE ON ItemTable
 WHEN NEW.key = '${KEY}'
  AND (json_extract(NEW.value,'$.openAIBaseUrl') IS NOT '${base}'
    OR json_extract(NEW.value,'$.featureModelConfigs.composer.defaultModel') IS NOT '${primary}'
-   OR json_array_length(json_extract(NEW.value,'$.availableDefaultModels2')) IS NOT ${models.length}
-   OR json_extract(NEW.value,'$.membershipType') IS NOT '${mem}')
+   OR json_array_length(json_extract(NEW.value,'$.availableDefaultModels2')) IS NOT ${models.length}${mem ? `
+   OR json_extract(NEW.value,'$.membershipType') IS NOT '${mem}'` : ''})
 BEGIN
   UPDATE ItemTable SET value = json_set(
       NEW.value,
@@ -302,9 +301,9 @@ BEGIN
       '$.availableAPIKeyModels', json('${modelJson}'),
       '$.availableDefaultModels2', json('${uiJson}'),
       '$.featureModelConfigs.composer.defaultModel', '${primary}',
-      '$.featureModelConfigs.cmdK.defaultModel', '${primary}',
+      '$.featureModelConfigs.cmdK.defaultModel', '${primary}'${mem ? `,
       '$.membershipType', '${mem}',
-      '$.subscriptionStatus', 'active'
+      '$.subscriptionStatus', 'active'` : ''}
   ) WHERE key = NEW.key;
 END;`;
   try { sqlite(db, sql); } catch (e) { return { error: e.message }; }

package/lib/hosts.js

@@ -36,7 +36,7 @@ const BACKUP = `${HOSTS}.openzoo-backup`;
 const MARK = '# openzoo: force the editor onto the local proxy';
 
 /** Hosts the editor uses for model sync + its own inference proxy. */
-export const BACKEND_HOSTS = ['api2.cursor.sh'];
+export const BACKEND_HOSTS = ['api2.cursor.sh', 'agent.api5.cursor.sh', 'agentn.api5.cursor.sh'];
 
 export function isBlocked() {
   try {

package/lib/setup.js

@@ -335,7 +335,7 @@ export async function setupEditor(which, target) {
   // rejected our cert — the ECONNRESET-before-ALPN wall in the backend log, and
   // exactly the model/chat calls we need. NODE_TLS_REJECT_UNAUTHORIZED=0 is the
   // Node-side switch. Only set under takeover, where we own the endpoint.
-  if (which === 'cursor' && !process.argv.includes('--no-takeover')) env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+  if (which === 'cursor' && process.argv.includes('--takeover')) env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
 
   console.log('');
   console.log(`mcp:     ${mcpFile}  (openzoo: zoo_bind, zoo_ask, zoo_models, zoo_wallet, zoo_contexts)`);
@@ -459,7 +459,13 @@ export async function setupEditor(which, target) {
   // DEFAULT ON. Takeover is what makes a plan-less account route, and it is
   // harmless on an entitled one (the editor just reads our catalog instead of
   // theirs), so it runs unless explicitly disabled with --no-takeover.
-  const doTakeover = target0 === 'cursor' && !process.argv.includes('--no-takeover');
+  // OPT-IN ONLY. Takeover impersonates Cursor's backend to unlock paid-tier
+  // model selection on an unpaid account — that is defeating Cursor's own
+  // subscription gate, not routing, so it is NOT the default. Plain
+  // `openzoo cursor` writes the base URL + models and routes Auto (and any model
+  // an entitled account can pick) through the zoo. --takeover is the escape
+  // hatch for those who understand what it does.
+  const doTakeover = target0 === 'cursor' && process.argv.includes('--takeover');
   if (doTakeover) {
     try {
       const { ensureCert } = await import('./cursorbackend.js');
@@ -550,7 +556,7 @@ export async function setupEditor(which, target) {
   const args = [cwd];
   // Trust our self-signed impersonation cert without any CA install — this flag
   // is the entire reason no trust prompt is needed. Only added under --takeover.
-  if (target0 === 'cursor' && !process.argv.includes('--no-takeover')) args.unshift('--ignore-certificate-errors');
+  if (doTakeover) args.unshift('--ignore-certificate-errors');
   if (useProfile) {
     fs.mkdirSync(PROFILE_DIR, { recursive: true });
     args.unshift(`--user-data-dir=${PROFILE_DIR}`, `--extensions-dir=${path.join(PROFILE_DIR, 'extensions')}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.30.6",
+  "version": "0.32.0",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",