openzoo 0.35.1 → 0.35.2

package/lib/proxy.js

@@ -194,8 +194,29 @@ function serveAsSse(res, data, upstream) {
  */
 const REPLAY_TTL_MS = 30_000;
 const replayCache = new Map(); // sha256(body) -> { at, data, settle }
-function replayKey(bodyBuf) {
-  return crypto.createHash('sha256').update(bodyBuf).digest('hex');
+/**
+ * The key MUST include the routing headers, not just the body.
+ *
+ * Keying on the body alone was a correctness bug, not merely a caching one:
+ * N shards asking the SAME question of N DIFFERENT bound corpora send
+ * byte-identical bodies and differ only in X-HRR-Context. They collided on one
+ * key, so shards 2..N were served shard 1's answer — REPRODUCED in the field:
+ * 10 shards, 7 byte-identical replies across corpora known to differ, and the
+ * batch finished in 12s where a single uncached call took ~7s.
+ *
+ * Wrong answers attributed to the wrong corpus is a far worse failure than the
+ * double-billing this cache exists to prevent, so every header that can change
+ * the ANSWER joins the key.
+ */
+const REPLAY_KEY_HEADERS = ['x-hrr-context', 'x-hrr-top-k', 'x-hrr-gate', 'x-openzoo-namespace'];
+
+function replayKey(bodyBuf, headers = {}) {
+  const h = crypto.createHash('sha256').update(bodyBuf);
+  for (const name of REPLAY_KEY_HEADERS) {
+    const v = headers[name];
+    if (v) h.update(`\n${name}:${v}`);
+  }
+  return h.digest('hex');
 }
 function replayGet(key) {
   const hit = replayCache.get(key);
@@ -531,7 +552,7 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     // Retry of a body we answered seconds ago? Serve the cached completion —
     // never pay twice for a harness's reconnect loop.
     const isChat = req.method === 'POST' && (req.url || '').includes('/chat/completions');
-    const rKey = isChat ? replayKey(bodyBuf) : null;
+    const rKey = isChat ? replayKey(bodyBuf, req.headers) : null;
     if (rKey) {
       const hit = replayGet(rKey);
       if (hit) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.35.1",
+  "version": "0.35.2",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",