openzoo 0.35.0 → 0.35.2

package/lib/mcp.js

@@ -292,6 +292,47 @@ export function buildMcpServer() {
     }
   });
 
+  // leCore's own catalog — leCore docs/ZOO.md §1. Rule-0 for the model: ask the
+  // engine whether a faculty exists BEFORE writing the algorithm yourself.
+  // 3,214 capabilities; a curated tools/list would hide almost all of them, so
+  // discovery is a search and execution is one generic tool, exactly as leCore
+  // ships it over its own MCP.
+  server.registerTool('zoo_lecore_find', {
+    description:
+      'BEFORE implementing any algorithm, search leCore for it — 3,214 verified capabilities '
+      + '(nearest-neighbour search, float compression, mesh ops, certified image operators, physics '
+      + 'stepping, forecasting, corpus QA, bootstrap CIs, void/discovery, program-to-weights). '
+      + 'Hand-rolling what this returns is wasted tokens and worse code. Free, no payment.',
+    inputSchema: {
+      query: z.string().describe('What you are trying to do, in plain words: "nearest neighbour search", "compress floats".'),
+      top: z.number().int().positive().optional().describe('How many hits. Default 8.'),
+    },
+  }, async ({ query, top }) => {
+    const r = await fetch(`${config.apiBase}/v1/lecore/find`, {
+      method: 'POST', headers: withNamespace({ 'content-type': 'application/json' }),
+      body: JSON.stringify({ query, top: top ?? 8 }),
+    });
+    return text(await r.json());
+  });
+
+  server.registerTool('zoo_lecore_invoke', {
+    description:
+      'Run any leCore capability by name (find it first with zoo_lecore_find). Returns the result plus '
+      + 'measured cost {elapsed_ms, payload_bytes} and a determinism receipt {input_sha256, output_sha256} — '
+      + 'the same call with the same args always produces the same output hash, so results are verifiable '
+      + 'and cacheable. Free, no payment.',
+    inputSchema: {
+      name: z.string().describe('Capability name exactly as zoo_lecore_find returned it.'),
+      args: z.record(z.any()).optional().describe('Arguments object for the capability.'),
+    },
+  }, async ({ name, args }) => {
+    const r = await fetch(`${config.apiBase}/v1/lecore/invoke`, {
+      method: 'POST', headers: withNamespace({ 'content-type': 'application/json' }),
+      body: JSON.stringify({ name, args: args || {} }),
+    });
+    return text(await r.json());
+  });
+
   server.registerTool('zoo_contexts', {
     description: 'List corpora already bound to the zoo\'s holographic memory (local manifest). A listed corpus is never re-uploaded — asks against it are near-free.',
     inputSchema: {},

package/lib/proxy.js

@@ -194,8 +194,29 @@ function serveAsSse(res, data, upstream) {
  */
 const REPLAY_TTL_MS = 30_000;
 const replayCache = new Map(); // sha256(body) -> { at, data, settle }
-function replayKey(bodyBuf) {
-  return crypto.createHash('sha256').update(bodyBuf).digest('hex');
+/**
+ * The key MUST include the routing headers, not just the body.
+ *
+ * Keying on the body alone was a correctness bug, not merely a caching one:
+ * N shards asking the SAME question of N DIFFERENT bound corpora send
+ * byte-identical bodies and differ only in X-HRR-Context. They collided on one
+ * key, so shards 2..N were served shard 1's answer — REPRODUCED in the field:
+ * 10 shards, 7 byte-identical replies across corpora known to differ, and the
+ * batch finished in 12s where a single uncached call took ~7s.
+ *
+ * Wrong answers attributed to the wrong corpus is a far worse failure than the
+ * double-billing this cache exists to prevent, so every header that can change
+ * the ANSWER joins the key.
+ */
+const REPLAY_KEY_HEADERS = ['x-hrr-context', 'x-hrr-top-k', 'x-hrr-gate', 'x-openzoo-namespace'];
+
+function replayKey(bodyBuf, headers = {}) {
+  const h = crypto.createHash('sha256').update(bodyBuf);
+  for (const name of REPLAY_KEY_HEADERS) {
+    const v = headers[name];
+    if (v) h.update(`\n${name}:${v}`);
+  }
+  return h.digest('hex');
 }
 function replayGet(key) {
   const hit = replayCache.get(key);
@@ -531,7 +552,7 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     // Retry of a body we answered seconds ago? Serve the cached completion —
     // never pay twice for a harness's reconnect loop.
     const isChat = req.method === 'POST' && (req.url || '').includes('/chat/completions');
-    const rKey = isChat ? replayKey(bodyBuf) : null;
+    const rKey = isChat ? replayKey(bodyBuf, req.headers) : null;
     if (rKey) {
       const hit = replayGet(rKey);
       if (hit) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.35.0",
+  "version": "0.35.2",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",