openzoo 0.34.9 → 0.34.11

package/lib/cursorbackend.js

@@ -27,6 +27,7 @@
  * + trailers for grpc-web. Both are handled below.
  */
 import http2 from 'node:http2';
+import https from 'node:https';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -210,6 +211,114 @@ async function handleStreamChat(req, res, body, log) {
   else { const end = Buffer.from('{}'); const h = Buffer.alloc(5); h.writeUInt8(0x02, 0); h.writeUInt32BE(end.length, 1); res.end(Buffer.concat([h, end])); }
 }
 
+/** Headers that are illegal to copy onto an HTTP/2 response (RFC 7540 §8.1.2.2),
+ *  plus the length/encoding fields that no longer describe our re-buffered body. */
+const HOP_BY_HOP = new Set([
+  'connection', 'keep-alive', 'upgrade', 'proxy-connection',
+  'transfer-encoding', 'te', 'trailer', 'proxy-authenticate',
+  'proxy-authorization', 'content-encoding', 'content-length',
+]);
+
+/**
+ * FORWARD A NON-INFERENCE REQUEST TO THE REAL ANTHROPIC API.
+ *
+ * We hijack api.anthropic.com at the DNS level, which catches far more than
+ * inference: the desktop app is OAuth/subscription-bound and boots by calling
+ * /api/organizations, /api/bootstrap, /api/account on the SAME host. Those are
+ * not ours to answer — the local proxy 404s them, the app cannot establish a
+ * session, and it hangs until macOS offers Force Quit.
+ *
+ * So for anything that is not inference we act as a plain reverse proxy to the
+ * genuine API, preserving the client's auth headers verbatim so the app's own
+ * OAuth session keeps working untouched.
+ *
+ * WE CANNOT RESOLVE THE NAME NORMALLY — /etc/hosts points it at us, so a plain
+ * fetch would loop straight back into this server. Resolve against public DNS
+ * over UDP (which ignores /etc/hosts entirely), cache it, and dial the address
+ * with the Host/SNI still set to the real hostname so TLS and routing succeed.
+ */
+// KEYED BY HOST. A single shared slot meant whichever of api/api-staging
+// resolved first pinned its address for the other one too.
+const realIpCache = new Map();
+async function resolveRealAnthropic(host) {
+  const hit = realIpCache.get(host);
+  if (hit) return hit;
+  const { Resolver } = await import('node:dns/promises');
+  const r = new Resolver();
+  r.setServers(['1.1.1.1', '8.8.8.8']);
+  const [ip] = await r.resolve4(host);
+  realIpCache.set(host, ip);
+  return ip;
+}
+
+/**
+ * Headers we must NOT copy back from the upstream response.
+ *
+ * DELIBERATELY NARROWER THAN HOP_BY_HOP: `content-encoding` is absent here on
+ * purpose. Unlike fetch(), node:https hands us the body EXACTLY as it arrived —
+ * still gzip/brotli compressed. Stripping the encoding header while forwarding
+ * compressed bytes tells the app "this is plain JSON" over binary garbage, and
+ * it fails to parse the bootstrap payload. Forward body and label together.
+ * `content-length` still goes, because we set it from the buffer we actually
+ * have, and the h2 layer rejects the connection-specific ones outright.
+ */
+const RESP_DROP = new Set([
+  'connection', 'keep-alive', 'upgrade', 'proxy-connection',
+  'transfer-encoding', 'te', 'trailer', 'content-length',
+]);
+
+async function passthroughToRealAnthropic(req, res, body, host, full, log) {
+  try {
+    const ip = await resolveRealAnthropic(host);
+    const headers = {};
+    for (const [k, v] of Object.entries(req.headers)) {
+      if (k.startsWith(':') || HOP_BY_HOP.has(k)) continue;
+      headers[k] = Array.isArray(v) ? v.join(', ') : String(v);
+    }
+    headers.host = host;
+
+    // DIAL THE ADDRESS, BUT SPEAK THE NAME. fetch(`https://${ip}/...`) cannot do
+    // this: undici derives SNI from the URL, so the server saw a bare IP, had no
+    // certificate to offer for it, and killed the handshake
+    // (ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE). node:https lets the two be set
+    // independently — a custom `lookup` pins the connection to the public-DNS
+    // address (bypassing our own /etc/hosts entry, which would otherwise loop
+    // this request straight back into this very server), while `servername` and
+    // the Host header keep presenting the real hostname so the cert validates.
+    const lookup = (h, o, cb) => (o && o.all ? cb(null, [{ address: ip, family: 4 }]) : cb(null, ip, 4));
+    const { status, respHeaders, buf } = await new Promise((resolve, reject) => {
+      const up = https.request({
+        hostname: host, servername: host, port: 443, path: full,
+        method: req.method, headers, lookup,
+      }, (r) => {
+        const chunks = [];
+        r.on('data', (d) => chunks.push(d));
+        r.on('end', () => resolve({
+          status: r.statusCode, respHeaders: r.headers, buf: Buffer.concat(chunks),
+        }));
+        r.on('error', reject);
+      });
+      up.on('error', reject);
+      up.setTimeout(20000, () => up.destroy(new Error('upstream timeout')));
+      if (req.method !== 'GET' && req.method !== 'HEAD' && body && body.length) up.write(body);
+      up.end();
+    });
+
+    const h = {};
+    for (const [k, v] of Object.entries(respHeaders)) {
+      if (RESP_DROP.has(k.toLowerCase())) continue;
+      h[k] = v;
+    }
+    res.writeHead(status, h);
+    res.end(buf);
+    log(`cursor-backend:      ${req.method} ${full} -> REAL anthropic (${status}, ${buf.length}b)`);
+  } catch (e) {
+    res.writeHead(502, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ type: 'error', error: { type: 'api_error', message: `passthrough failed: ${e.message}` } }));
+    log(`cursor-backend:      passthrough ${full} FAILED: ${e.message}`);
+  }
+}
+
 /**
  * Answer one Connect/gRPC-web call. `method` is the trailing method name,
  * `models` the catalog to publish. Non-catalog methods get an empty-OK body.
@@ -295,8 +404,28 @@ export function startCursorBackend({ port = 8443, models, log = () => {} } = {})
       // verbatim to the local paying proxy and relay the response — reusing the
       // whole translate+x402 path. (SNI is checked because the Host header may be
       // absent on h2.)
-      const host = String(req.headers[':authority'] || req.headers.host || req.socket?.servername || '');
-      if (/anthropic\.com$/.test(host) || /\/v1\/messages\b/.test(full)) {
+      // STRIP THE PORT BEFORE MATCHING. :authority / Host carry `host:port`
+      // whenever the client dials a non-default port, so an anchored
+      // /anthropic\.com$/ silently failed to match and the request fell through
+      // to the gRPC branch, which answered empty-OK. The desktop app then saw a
+      // 200 with no body for its session bootstrap — indistinguishable from the
+      // 404 it used to get, and it wedged the same way.
+      const rawHost = String(req.headers[':authority'] || req.headers.host || req.socket?.servername || '');
+      const host = rawHost.replace(/:\d+$/, '');
+      const isAnthropic = /(^|\.)anthropic\.com$/.test(host);
+      // INTERCEPT INFERENCE ONLY. Matching the whole HOST sent every request the
+      // desktop app makes to the local proxy — including the session bootstrap
+      // (/api/organizations, /api/bootstrap, /api/account), which the proxy does
+      // not implement and answered 404. The app is OAuth/subscription-bound, so
+      // a 404 on bootstrap means it can never establish a session: it wedges and
+      // macOS offers Force Quit. Only /v1/messages (and /v1/complete) are ours;
+      // everything else on this host MUST reach the real Anthropic API.
+      const isInference = /\/v1\/(messages|complete)\b/.test(full);
+      if (isAnthropic && !isInference) {
+        await passthroughToRealAnthropic(req, res, body, host, full, log);
+        return;
+      }
+      if (isAnthropic || isInference) {
         try {
           const up = await fetch(`http://127.0.0.1:8402${full}`, {
             method: req.method,
@@ -313,12 +442,7 @@ export function startCursorBackend({ port = 8443, models, log = () => {} } = {})
           // desktop request killed the whole backend process (uncaught, since
           // this is inside the async handler), and every later attempt got
           // ECONNRESET with nothing listening. Content-length goes too: the
-          // body was re-buffered, so let Node recompute it.
-          const HOP_BY_HOP = new Set([
-            'connection', 'keep-alive', 'upgrade', 'proxy-connection',
-            'transfer-encoding', 'te', 'trailer', 'proxy-authenticate',
-            'proxy-authorization', 'content-encoding', 'content-length',
-          ]);
+          // body was re-buffered, so let Node recompute it. (Shared set above.)
           up.headers.forEach((v, k) => { if (!HOP_BY_HOP.has(k.toLowerCase())) h[k] = v; });
           res.writeHead(up.status, h);
           res.end(buf);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.34.9",
+  "version": "0.34.11",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",