openzoo 0.34.3 → 0.34.4

package/lib/hosts.js

@@ -269,9 +269,31 @@ export function bindBackend443(modelsPath, logPath, log = console.log) {
   );
   // Report whether it ACTUALLY came up rather than whether sudo exited 0 —
   // `nohup ... &` always succeeds, so `ok` alone said nothing about the bind.
-  const listening = spawnSync('sh', ['-c',
-    'for i in 1 2 3 4 5 6 7 8; do lsof -nP -iTCP:443 -sTCP:LISTEN -t >/dev/null 2>&1 && exit 0; sleep 0.5; done; exit 1',
-  ]).status === 0;
+  //
+  // PROBE BY CONNECTING, NOT BY lsof. The backend we just started is ROOT-owned;
+  // unprivileged `lsof -iTCP:443` cannot see another user's descriptors and exits
+  // 1 even while `netstat -an` shows `*.443 LISTEN`. That false negative made the
+  // caller tear down a WORKING setup and print "FAILED to bind" directly under
+  // the backend's own "listening on [::]+127.0.0.1:443" log line. A TCP connect
+  // is ownership-blind, and it proves the far more useful property anyway: that
+  // the socket actually accepts. Try both families — hosts.js pins both.
+  const listening = spawnSync(node, ['-e', `
+    const net = require('net');
+    const hit = (host) => new Promise((r) => {
+      const s = net.connect({ host, port: 443 });
+      s.setTimeout(1000);
+      s.on('connect', () => { s.destroy(); r(true); });
+      s.on('error', () => r(false));
+      s.on('timeout', () => { s.destroy(); r(false); });
+    });
+    (async () => {
+      for (let i = 0; i < 10; i++) {
+        if (await hit('127.0.0.1') || await hit('::1')) process.exit(0);
+        await new Promise((r) => setTimeout(r, 500));
+      }
+      process.exit(1);
+    })();
+  `], { timeout: 20000 }).status === 0;
   if (!listening) {
     log(`  backend did NOT bind :443 — see ${logPath}`);
     try {
@@ -288,6 +310,8 @@ export function unbindBackend443() {
   return { ok: privileged(
     flushPf
     + "pkill -9 -f 'cursor-backend.js' 2>/dev/null; "
-    + 'for p in $(lsof -nP -iTCP:8443 -sTCP:LISTEN -t 2>/dev/null); do kill -9 "$p" 2>/dev/null; done; true',
+    // 443 as well as 8443: the backend binds :443 directly now, and this runs
+    // under sudo so lsof CAN see the root-owned socket here.
+    + 'for p in $(lsof -nP -iTCP:443 -sTCP:LISTEN -t 2>/dev/null) $(lsof -nP -iTCP:8443 -sTCP:LISTEN -t 2>/dev/null); do kill -9 "$p" 2>/dev/null; done; true',
   ) };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.34.3",
+  "version": "0.34.4",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",