openzoo 0.34.0 → 0.34.2

package/lib/cursorbackend.js

@@ -326,6 +326,18 @@ export function startCursorBackend({ port = 8443, models, log = () => {} } = {})
   server.on('tlsClientError', (e, sock) => {
     log(`cursor-tls: HANDSHAKE FAILED ${e.code || e.message} alpn=${sock?.alpnProtocol || '?'}`);
   });
-  server.listen(port, '127.0.0.1', () => log(`cursor-backend: listening on 127.0.0.1:${port} as ${CURSOR_HOSTS[0]}`));
+  // BIND BOTH LOOPBACK FAMILIES. lib/hosts.js now pins each host to 127.0.0.1
+  // AND ::1 (a v4-only entry let dual-stack clients take the AAAA route straight
+  // to the real backend). Listening on v4 alone would turn that bypass into a
+  // v6 blackhole — connection refused instead of a wrong answer. Binding the
+  // unspecified address '::' with ipv6Only off accepts both on one socket; if
+  // the platform refuses (v6 disabled), fall back to v4 so we still work.
+  server.on('error', (e) => log(`cursor-backend: server error ${e.code || e.message}`));
+  const onUp = (what) => log(`cursor-backend: listening on ${what}:${port} as ${CURSOR_HOSTS[0]}`);
+  try {
+    server.listen({ port, host: '::', ipv6Only: false }, () => onUp('[::]+127.0.0.1'));
+  } catch {
+    server.listen(port, '127.0.0.1', () => onUp('127.0.0.1'));
+  }
   return { server, port };
 }

package/lib/hosts.js

@@ -58,11 +58,49 @@ export const AGENT_HOSTS = [
   'agent-gcpp-apsoutheast.api5.cursor.sh', 'agentn-gcpp-apsoutheast.api5.cursor.sh',
 ];
 
-export function isBlocked() {
-  try {
-    const txt = fs.readFileSync(HOSTS, 'utf8');
-    return BACKEND_HOSTS.every((h) => new RegExp(`^\\s*127\\.0\\.0\\.1\\s+${h.replace('.', '\\.')}`, 'm').test(txt));
-  } catch { return false; }
+/** Every host this tool ever adds — the set `unblock` is responsible for removing. */
+const ALL_MANAGED = [...BACKEND_HOSTS, ...CLAUDE_HOSTS, ...AGENT_HOSTS];
+
+/**
+ * A HOST IS NOT BLOCKED UNTIL BOTH FAMILIES ARE. Writing only the A record leaves
+ * the AAAA intact, and a dual-stack client (Claude desktop / Chromium, happy
+ * eyeballs) will simply take the v6 route straight to the real backend. Measured:
+ * with `127.0.0.1 api.anthropic.com` in place, `curl -6` still reached
+ * 2607:6bc0::10 and the real API answered. Every entry is therefore written and
+ * matched as a v4+v6 pair.
+ */
+const FAMILIES = ['127.0.0.1', '::1'];
+
+const esc = (s) => s.replace(/[.:]/g, '\\$&');
+
+/** Matches a hosts line pinning `h` to loopback in either family. */
+function hostLineRe(h, ip) {
+  const addr = ip ? esc(ip) : `(?:${FAMILIES.map(esc).join('|')})`;
+  return new RegExp(`^\\s*${addr}\\s+${esc(h)}\\b`, 'm');
+}
+
+function readHosts() {
+  try { return fs.readFileSync(HOSTS, 'utf8'); } catch { return ''; }
+}
+
+/**
+ * True when EVERY host in `hosts` is pinned to loopback in BOTH families.
+ * Defaulting to BACKEND_HOSTS was a latent bug: `openzoo claude --desktop`
+ * blocks CLAUDE_HOSTS, so this returned false, and `unblock`'s
+ * `if (!isBlocked()) return { already: true }` guard bailed out without ever
+ * removing the api.anthropic.com lines it had just written.
+ */
+export function isBlocked(hosts = BACKEND_HOSTS) {
+  const txt = readHosts();
+  if (!txt) return false;
+  return hosts.every((h) => FAMILIES.every((ip) => hostLineRe(h, ip).test(txt)));
+}
+
+/** True when ANY host this tool manages is still pinned — what `unblock` must test. */
+export function isAnyBlocked() {
+  const txt = readHosts();
+  if (!txt) return false;
+  return ALL_MANAGED.some((h) => hostLineRe(h).test(txt));
 }
 
 /**
@@ -89,11 +127,17 @@ function flushDnsCmd() {
 export function blockBackend(hosts = BACKEND_HOSTS) {
   // Add only the hosts NOT already present, so a prior api2-only block still gets
   // the agent/chat hosts appended (early-returning on isBlocked left them out).
-  let current = '';
-  try { current = fs.readFileSync(HOSTS, 'utf8'); } catch { /* new */ }
-  const missing = hosts.filter((h) => !new RegExp(`^\\s*127\\.0\\.0\\.1\\s+${h.replace(/\./g, '\\.')}\\b`, 'm').test(current));
-  if (!missing.length) return { already: true };
-  const entries = missing.map((h) => `127.0.0.1 ${h}`).join('\\n');
+  const current = readHosts();
+  // A host counts as missing if EITHER family is absent, so a v4-only block
+  // written by an older version gets its ::1 line added on the next run.
+  const pairs = [];
+  for (const h of hosts) {
+    for (const ip of FAMILIES) {
+      if (!hostLineRe(h, ip).test(current)) pairs.push(`${ip} ${h}`);
+    }
+  }
+  if (!pairs.length) return { already: true };
+  const entries = pairs.join('\\n');
   console.log('');
   console.log('blocking the editor\'s backend so it cannot re-sync over your model list.');
   console.log(`  hosts   : ${hosts.join(', ')} -> 127.0.0.1`);
@@ -118,10 +162,15 @@ export function blockBackend(hosts = BACKEND_HOSTS) {
 }
 
 export function unblockBackend() {
-  if (!isBlocked()) return { already: true };
+  // Test EVERY managed host, not just BACKEND_HOSTS. `openzoo claude --desktop`
+  // only ever blocks CLAUDE_HOSTS, so the old `isBlocked()` default reported
+  // "nothing to do" and left 127.0.0.1 api.anthropic.com pinned forever — the
+  // Claude desktop app then had no route to inference at all once the root
+  // backend on :443 was gone.
+  if (!isAnyBlocked()) return { already: true };
   // Remove only OUR lines, never restore wholesale — the user may have edited
   // /etc/hosts for unrelated reasons since the backup was taken.
-  const pattern = [...BACKEND_HOSTS, ...AGENT_HOSTS].map((h) => h.replace(/\./g, '\\.')).join('|');
+  const pattern = ALL_MANAGED.map((h) => h.replace(/\./g, '\\.')).join('|');
   if (WIN) {
     console.log('windows: run in an ADMINISTRATOR PowerShell:');
     console.log(`  Copy-Item "${BACKUP}" "${HOSTS}" -Force; ipconfig /flushdns`);
@@ -129,12 +178,14 @@ export function unblockBackend() {
   }
   // BSD sed (macOS) needs -i ''; GNU sed (linux) must NOT have it. Use a temp
   // file instead so one command is correct on both.
-  const re = `/^[[:space:]]*127\\.0\\.0\\.1[[:space:]]+(${pattern})[[:space:]]*$/d; /openzoo: force the editor/d`;
+  // Both families, or the ::1 lines we now write would survive the unblock.
+  const addr = '(127\\.0\\.0\\.1|::1)';
+  const re = `/^[[:space:]]*${addr}[[:space:]]+(${pattern})[[:space:]]*$/d; /openzoo: force the editor/d`;
   const ok = privileged(
     `sed -E '${re}' ${HOSTS} > ${HOSTS}.oztmp && cat ${HOSTS}.oztmp > ${HOSTS} && rm -f ${HOSTS}.oztmp; `
     + flushDnsCmd(),
   );
-  return { ok, blocked: isBlocked() };
+  return { ok, blocked: isAnyBlocked() };
 }
 
 /**
@@ -200,10 +251,29 @@ export function bindBackend443(modelsPath, logPath, log = console.log) {
     + `pkill -9 -f 'cursor-backend.js' 2>/dev/null; `
     + `for p in $(lsof -nP -iTCP:443 -sTCP:LISTEN -t 2>/dev/null) $(lsof -nP -iTCP:8443 -sTCP:LISTEN -t 2>/dev/null); do kill -9 "$p" 2>/dev/null; done; `
     + `for i in 1 2 3 4 5 6 7 8 9 10; do lsof -nP -iTCP:443 -sTCP:LISTEN -t >/dev/null 2>&1 || break; sleep 0.5; done; `
-    + `nohup ${memEnv} '${node}' '${script}' 443 '${modelsPath}' '${logPath}' >/dev/null 2>&1 & `
+    // NEVER >/dev/null THE ROOT BACKEND. It is the only privileged half, it is
+    // spawned detached, and if it dies at startup (port taken, bad models file,
+    // module error) discarding its output leaves no evidence anywhere — the
+    // failure mode this cost a session to find was exactly that: no listener on
+    // 443, no cursor-backend.log, nothing to read. Send both streams to the log
+    // the caller already passes, so a crash is on disk.
+    + `mkdir -p "$(dirname '${logPath}')" 2>/dev/null; `
+    + `nohup ${memEnv} '${node}' '${script}' 443 '${modelsPath}' '${logPath}' >>'${logPath}' 2>&1 & `
     + 'sleep 1; true',
   );
-  return { ok };
+  // Report whether it ACTUALLY came up rather than whether sudo exited 0 —
+  // `nohup ... &` always succeeds, so `ok` alone said nothing about the bind.
+  const listening = spawnSync('sh', ['-c',
+    'for i in 1 2 3 4 5 6 7 8; do lsof -nP -iTCP:443 -sTCP:LISTEN -t >/dev/null 2>&1 && exit 0; sleep 0.5; done; exit 1',
+  ]).status === 0;
+  if (!listening) {
+    log(`  backend did NOT bind :443 — see ${logPath}`);
+    try {
+      const tail = fs.readFileSync(logPath, 'utf8').trim().split('\n').slice(-8);
+      for (const l of tail) log(`    ${l}`);
+    } catch { log('    (no log written — the process died before it could open one)'); }
+  }
+  return { ok: ok && listening, listening };
 }
 
 export function unbindBackend443() {

package/lib/launch.js

@@ -163,7 +163,7 @@ export async function launchClaude(argv) {
   // Opt out with --no-intercept (then it just opens, on the subscription).
   if (process.platform !== 'win32' && !argv.includes('--no-intercept')) {
     try {
-      const { blockBackend, bindBackend443, CLAUDE_HOSTS } = await import('./hosts.js');
+      const { blockBackend, bindBackend443, unblockBackend, CLAUDE_HOSTS } = await import('./hosts.js');
       const { ensureCert } = await import('./cursorbackend.js');
       ensureCert(console.error);
       const r = blockBackend(CLAUDE_HOSTS);
@@ -172,22 +172,41 @@ export async function launchClaude(argv) {
       const modelsFile = path.join(os.tmpdir(), 'openzoo-claude-models.json');
       fs.writeFileSync(modelsFile, '[]');
       const backendLog = path.join(os.homedir(), '.openzoo', 'cursor-backend.log');
-      bindBackend443(modelsFile, backendLog, console.error);
-      await new Promise((res) => setTimeout(res, 800));
-      console.error('openzoo: backend bound on :443 — Claude desktop inference now forwards to the zoo.');
-      console.error('         undo any time with: npx openzoo unblock');
+      const b = bindBackend443(modelsFile, backendLog, console.error);
+      // DO NOT CLAIM SUCCESS UNCONDITIONALLY. This line used to print even when
+      // nothing was listening, so the app launched into a blackholed host with a
+      // reassuring message — the exact reason the last failure was so hard to see.
+      if (b.listening) {
+        console.error('openzoo: backend bound on :443 — Claude desktop inference now forwards to the zoo.');
+        console.error('         undo any time with: npx openzoo unblock');
+      } else {
+        console.error('openzoo: backend FAILED to bind :443 — api.anthropic.com is blackholed with');
+        console.error('         nothing answering it, so Claude would not reach inference at all.');
+        console.error('         restoring your hosts file so the app keeps working.');
+        try { unblockBackend(); } catch { /* best effort */ }
+      }
     } catch (e) { console.error(`openzoo: desktop interception setup failed (${e.message}) — opening app plain`); }
   }
 
   if (process.platform === 'darwin') {
-    // Quit a running instance so the fresh one is not killed by the single-
-    // instance lock, and so it re-resolves api.anthropic.com to us on launch.
+    // Quit a running instance and WAIT until it is actually gone. A fixed 800ms
+    // wait raced the single-instance lock — Claude was still releasing its file
+    // locks (LOCK errors), so the fresh spawn saw a live instance and exited
+    // immediately ("didn't launch at all"). Poll pgrep until clear, up to ~6s.
     try { spawnSync('osascript', ['-e', 'tell application "Claude" to quit'], { stdio: 'ignore', timeout: 4000 }); } catch { /* not running */ }
-    try { spawnSync('pkill', ['-x', 'Claude'], { stdio: 'ignore' }); } catch { /* already gone */ }
-    await new Promise((r) => setTimeout(r, 800));
+    for (let i = 0; i < 24; i++) {
+      const r = spawnSync('pgrep', ['-x', 'Claude'], { encoding: 'utf8' });
+      if (!r.stdout || !r.stdout.trim()) break;              // gone
+      if (i === 8) { try { spawnSync('pkill', ['-9', '-x', 'Claude'], { stdio: 'ignore' }); } catch { /* */ } }
+      await new Promise((res) => setTimeout(res, 250));
+    }
+    await new Promise((r) => setTimeout(r, 400));            // let the lock file release
   }
   // Chromium flags: accept the self-signed cert, and MAP the Anthropic hosts to
   // us at the resolver level (defeats DoH, which ignores /etc/hosts).
+  // MAP to 127.0.0.1 for both hosts. The resolver rule replaces the lookup
+  // wholesale (no AAAA is returned), so the v6 bypass that /etc/hosts alone left
+  // open does not exist on this path — the backend listens on both regardless.
   const flags = argv.includes('--no-intercept') ? []
     : ['--ignore-certificate-errors', '--host-resolver-rules=MAP api.anthropic.com 127.0.0.1,MAP api-staging.anthropic.com 127.0.0.1'];
   console.error('openzoo: launching Claude desktop — inference routes through the zoo (pays x402).');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.34.0",
+  "version": "0.34.2",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",