openzoo 0.38.8 → 0.39.0

package/bin/openzoo.js

@@ -23,7 +23,11 @@ usage:
                                           by default, --terminal for the Claude Code CLI
   npx openzoo launch <cmd> [args]   launch a TERMINAL Messages API client
                                     (claude, aider...) already pointed at the zoo
-  npx openzoo grokbot         point Grok Bot / the grok CLI at the zoo — GROK MODELS ONLY,
+  npx openzoo grokbot         KEEP Grok Bot's UI, serve YOUR RunPod box under it:
+                              spawns a CPU box, MITMs api2.cursor.sh, and answers
+                              EnsureSandBox with your box instead of a cursorvm pod.
+                              Inference x402-paid; needs RUNPOD_API_KEY + sudo.
+  npx openzoo grok-cli        point the grok CLI at the zoo — GROK MODELS ONLY,
                               paid per call by x402 instead of xAI first-party billing,
                               then TAKE OVER the app's backend: pins api2.cursor.sh in
                               /etc/hosts, serves it locally on :443 with byok_enabled,
@@ -76,11 +80,14 @@ async function main() {
       await (await import('../lib/setup.js')).setupEditor(cmd === 'editor' ? undefined : cmd, process.argv[3]);
       break;
     case 'grokbot':
+      await (await import('../lib/grokbot.js')).runGrokBot(process.argv.slice(3));
+      break;
+    case 'grok-cli':
     case 'grok':
       // Grok Bot (com.anysphere.sand) fronts the `grok` CLI, and the CLI reads
       // ~/.grok/config.toml — so pointing that model table at the local proxy
       // is enough; no patching of the app bundle.
-      await (await import('../lib/grokbot.js')).setupGrokBot(process.argv.slice(3));
+      await (await import('../lib/grokcli.js')).setupGrokBot(process.argv.slice(3));
       break;
     case 'mcp':
       await (await import('../lib/mcp.js')).startMcp();

package/lib/boxes.js

@@ -0,0 +1,233 @@
+// RunPod CPU boxes — the sandbox fleet `openzoo grokbot` runs its agents in.
+//
+// SAME SHAPE AS GROK BOT, DIFFERENT ECONOMICS. Grok Bot provisions a
+// cursorvm.com pod per bot and runs the agent inside Cursor's cloud, billing
+// through them (MEASURED: EnsureSandBox returns
+// `<id>-pod-<id>-1337.us9.cursorvm.com` + a VNC port + /workspace/terminals).
+// This does the same thing on RunPod, with inference paid per-call by x402
+// from a wallet the box holds — no account, no provider key.
+//
+// CPU ONLY, ALWAYS. A GPU flavour here would be a silent 100x on the bill for
+// a box that only ever runs a shell and a node process. `spawnBox` builds its
+// request body without GPU fields AND asserts on the serialized JSON, because
+// an `in` check against a literal you wrote three lines earlier can never fail
+// — that guard is decoration, not enforcement.
+
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+const pexec = promisify(execFile);
+
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+let _agentB64 = null;
+function podAgentB64() {
+  if (_agentB64) return _agentB64;
+  const here = dirname(fileURLToPath(import.meta.url));
+  _agentB64 = readFileSync(join(here, 'podagent.mjs')).toString('base64');
+  return _agentB64;
+}
+
+const REST = 'https://rest.runpod.io/v1';
+export const BOX_PREFIX = 'openzoo-box-';
+const CPU_FLAVORS = ['cpu3c', 'cpu3g', 'cpu5c'];
+const BOX_IMAGE = process.env.OPENZOO_BOX_IMAGE || 'node:22-alpine';
+const BOX_PORTS = ['8402/http', '1337/http', '6080/http', '1340/http', '6081/http', '22/tcp'];
+const TTL_MAX_HOURS = 90 * 24;
+
+/**
+ * Boot: write the wallet, start the x402 proxy, keep the container alive.
+ *
+ * The proxy is the point — everything the agent asks for is paid per request
+ * from this box's own wallet. `npx --yes openzoo` is fetched at boot rather
+ * than baked, so a box always runs the published shim; the tradeoff is a hard
+ * dependency on npm being reachable in the first ~30s, which readyBox() waits
+ * for explicitly instead of assuming.
+ */
+const ENTRYPOINT = [
+  'sh', '-c',
+  'set -e; mkdir -p /workspace /root/.openzoo /var/log/openzoo; '
+  + 'if [ -n "$OPENZOO_WALLET_JSON" ]; then printf %s "$OPENZOO_WALLET_JSON" > /root/.openzoo/wallet.json; chmod 600 /root/.openzoo/wallet.json; fi; '
+  + 'apk add --no-cache openssh bash git curl >/dev/null 2>&1 || true; '
+  + 'npx --yes openzoo > /var/log/openzoo/proxy.log 2>&1 & '
+  // the capture agent answers the ports Grok Bot expects a Cursor sandbox on,
+  // logging the protocol we do not yet speak (see lib/podagent.mjs)
+  + 'if [ -n "$OZ_PODAGENT_B64" ]; then printf %s "$OZ_PODAGENT_B64" | base64 -d > /opt/podagent.mjs; node /opt/podagent.mjs > /var/log/openzoo/agent.log 2>&1 & fi; '
+  + 'wait',
+];
+
+function key() {
+  const k = process.env.RUNPOD_API_KEY || '';
+  return typeof k === 'string' ? k.trim() : '';
+}
+
+export function runpodConfigured() {
+  // guard the access, not just the prefix — an unset key must not throw here
+  return key().startsWith('rpa_');
+}
+
+async function rp(path, init) {
+  const k = key();
+  if (!k) return { ok: false, status: 503, data: { error: 'RUNPOD_API_KEY not set' } };
+  const res = await fetch(`${REST}${path}`, {
+    ...init,
+    headers: { authorization: `Bearer ${k}`, 'content-type': 'application/json', ...(init?.headers || {}) },
+  });
+  const data = await res.json().catch(() => ({}));
+  return { ok: res.ok, status: res.status, data };
+}
+
+export function ttlHours(days = 30) {
+  return Math.min(Math.max(Number(days) || 30, 1) * 24, TTL_MAX_HOURS);
+}
+
+/**
+ * Expiry is encoded in the name so a box is reapable even if its env is lost.
+ *
+ * PARSED FROM A FIXED POSITION, NOT `.pop()`. The name ends
+ * `-<unix>-<rand4>`, so popping the last segment yields the RANDOM suffix,
+ * Number() gives NaN, and every box reports "no expiry" — which is exactly the
+ * bug the site's copy of this had.
+ */
+export function expiresFromName(name) {
+  if (!name?.startsWith(BOX_PREFIX)) return null;
+  const parts = name.split('-');
+  const n = Number(parts[parts.length - 2]);
+  return Number.isFinite(n) && n > 1_700_000_000 ? n : null;
+}
+
+export function proxyUrl(id, port = 8402) {
+  return id ? `https://${id}-${port}.proxy.runpod.net` : null;
+}
+
+/** The URLs Grok Bot's EnsureSandBox response needs, all fronted by RunPod. */
+export function podEndpoints(id) {
+  return id ? {
+    agent: proxyUrl(id, 1337),
+    vnc: proxyUrl(id, 6080),
+    p1340: proxyUrl(id, 1340),
+    p6081: proxyUrl(id, 6081),
+    proxy: proxyUrl(id, 8402),
+  } : null;
+}
+
+/** What a caller may see. NEVER the raw pod: `env` carries OPENZOO_WALLET_JSON,
+ *  which is a funded private key. Raw pods must not escape this module. */
+export function serializeBox(p) {
+  const exp = expiresFromName(p.name) || Number(p.env?.OPENZOO_EXPIRES_UNIX || 0) || null;
+  const sshPort = p.portMappings?.['22'];
+  return {
+    id: p.id,
+    name: p.name,
+    status: p.desiredStatus,
+    costPerHr: p.costPerHr,
+    proxy: proxyUrl(p.id),
+    ssh: p.publicIp && sshPort ? `ssh -o StrictHostKeyChecking=no root@${p.publicIp} -p ${sshPort}` : null,
+    host: p.publicIp || null,
+    sshPort: sshPort || null,
+    console: p.id ? `https://www.runpod.io/console/pods/${p.id}` : null,
+    expiresAt: exp ? new Date(exp * 1000).toISOString() : null,
+  };
+}
+
+/** Our boxes only, serialized. */
+export async function listBoxes() {
+  const r = await rp('/pods');
+  if (!Array.isArray(r.data)) return { ok: false, error: r.data?.error || `pods ${r.status}`, boxes: [] };
+  return {
+    ok: true,
+    boxes: r.data.filter((p) => !p.gpuCount && p.name?.startsWith(BOX_PREFIX)).map(serializeBox),
+  };
+}
+
+export async function killBox(id) {
+  return rp(`/pods/${id}`, { method: 'DELETE' });
+}
+
+/** Delete our boxes past their deadline. Name-prefix scoped AND gpu-guarded. */
+export async function reapExpired() {
+  const r = await rp('/pods');
+  if (!Array.isArray(r.data)) return { reaped: [] };
+  const now = Math.floor(Date.now() / 1000);
+  const reaped = [];
+  for (const p of r.data) {
+    if (!p.id || p.gpuCount || !p.name?.startsWith(BOX_PREFIX)) continue;
+    const deadline = expiresFromName(p.name) || Number(p.env?.OPENZOO_EXPIRES_UNIX || 0);
+    if (deadline && now >= deadline) {
+      await killBox(p.id);
+      reaped.push(p.id);
+    }
+  }
+  return { reaped };
+}
+
+export async function spawnBox({ name = 'bot', days = 1, vcpu = 2, walletJson, pubkey } = {}) {
+  const expiresAt = new Date(Date.now() + ttlHours(days) * 3600 * 1000);
+  const unix = Math.floor(expiresAt.getTime() / 1000);
+  const rand = Math.random().toString(36).slice(2, 6);
+  const full = `${BOX_PREFIX}${name}-${unix}-${rand}`;
+
+  const body = {
+    name: full,
+    computeType: 'CPU',
+    cloudType: 'SECURE',
+    vcpuCount: Math.max(1, Math.min(Number(vcpu) || 2, 4)),
+    cpuFlavorIds: CPU_FLAVORS,
+    cpuFlavorPriority: 'availability',
+    imageName: BOX_IMAGE,
+    containerDiskInGb: 20,
+    volumeInGb: 10,
+    volumeMountPath: '/workspace',
+    ports: BOX_PORTS,
+    dockerStartCmd: ENTRYPOINT,
+    env: {
+      OPENZOO_BOX: '1',
+      OPENZOO_EXPIRES_UNIX: String(unix),
+      OPENZOO_NO_TUNNEL: '1',           // the runpod proxy already fronts it
+      ...(walletJson ? { OPENZOO_WALLET_JSON: walletJson } : {}),
+      ...(pubkey ? { OPENZOO_WALLET_PUBKEY: pubkey } : {}),
+      OZ_PODAGENT_B64: podAgentB64(),
+    },
+  };
+  // ENFORCE on the actual payload, not on a literal we just wrote.
+  const wire = JSON.stringify(body);
+  if (/"gpu(Count|TypeIds)"/.test(wire)) throw new Error('refusing to spawn: GPU fields present');
+
+  const created = await rp('/pods', { method: 'POST', body: wire });
+  if (!created.ok) return { ok: false, error: created.data?.error || `spawn ${created.status}` };
+  return { ok: true, box: serializeBox(created.data), expiresAt: expiresAt.toISOString() };
+}
+
+/** Poll until the box answers on its proxy — npx has to fetch the shim first. */
+export async function readyBox(id, { timeoutMs = 240_000, log = () => {} } = {}) {
+  const url = `${proxyUrl(id)}/v1/models`;
+  const started = Date.now();
+  let last = '';
+  while (Date.now() - started < timeoutMs) {
+    try {
+      const r = await fetch(url, { signal: AbortSignal.timeout(6000) });
+      if (r.ok) return { ok: true, seconds: Math.round((Date.now() - started) / 1000) };
+      last = `http ${r.status}`;
+    } catch (e) { last = e.name === 'TimeoutError' ? 'timeout' : e.message; }
+    log(`  waiting for box proxy… (${Math.round((Date.now() - started) / 1000)}s, ${last})`);
+    await new Promise((r) => setTimeout(r, 6000));
+  }
+  return { ok: false, error: `box proxy never came up (${last})` };
+}
+
+/** Run a command INSIDE the box. This is the sandbox half of the product:
+ *  the model runs wherever openzoo routes it, the side effects land here. */
+export async function execInBox(box, cmd, { timeoutMs = 120_000 } = {}) {
+  if (!box.host || !box.sshPort) return { ok: false, stdout: '', stderr: 'box has no ssh yet' };
+  try {
+    const { stdout, stderr } = await pexec('ssh', [
+      '-o', 'StrictHostKeyChecking=no', '-o', 'UserKnownHostsFile=/dev/null',
+      '-o', 'LogLevel=ERROR', '-o', 'ConnectTimeout=15',
+      '-p', String(box.sshPort), `root@${box.host}`, cmd,
+    ], { timeout: timeoutMs, maxBuffer: 8 * 1024 * 1024 });
+    return { ok: true, stdout, stderr };
+  } catch (e) {
+    return { ok: false, stdout: e.stdout || '', stderr: e.stderr || e.message };
+  }
+}

package/lib/cursorapi.js

@@ -166,6 +166,17 @@ export function encodeForMethod(method, models) {
   }
   switch (method) {
     case 'AvailableModels': return encodeAvailableModels(models);
+    case 'EnsureSandBox': {
+      // HIJACK: hand Grok Bot OUR box instead of a cursorvm.com pod. The
+      // orchestrator (openzoo grokbot) sets OZ_HIJACK_POD = {base,podId,token}
+      // once its RunPod box is ready. Absent -> fall through to empty-ok, i.e.
+      // the app gets no sandbox (harmless, and how sniff mode behaves).
+      if (!process.env.OZ_HIJACK_POD) return null;
+      try {
+        const pod = JSON.parse(process.env.OZ_HIJACK_POD);
+        return encodeEnsureSandBox(pod);
+      } catch { return null; }
+    }
     case 'GetPlanInfo': return encodeGetPlanInfo();
     case 'GetMe': return encodeGetMe();
     case 'GetDefaultModel': return encodeGetDefaultModel(models);
@@ -175,6 +186,44 @@ export function encodeForMethod(method, models) {
 }
 
 /** Connect unary framing: 5-byte prefix (flags + big-endian length) + payload. */
+/**
+ * EnsureSandBox response — OUR pod, in Cursor's exact shape.
+ *
+ * Field map decoded from a live cursorvm.com response (2026-08-16):
+ *   1 region · 2 accountId · 3 podId · 4 network_token · 5 "local"
+ *   6 AGENT url (port 1337) · 7 VNC url (6080/vnc.html?...) · 8 /workspace/terminals
+ *   9 ready=1 · 10 url (1340) · 11 token · 12 url (6081)
+ *
+ * We keep 1-5,8,9,11 plausible and repoint 6/7/10/12 at a box WE control, so
+ * Grok Bot's UI connects to our sandbox instead of Cursor's. The RunPod proxy
+ * fronts one port; we map the agent port there and the app's own path suffixes
+ * (`/vnc.html`, the websockify query) ride along unchanged.
+ *
+ * HONEST LIMIT: the app will then speak Cursor's in-pod agent protocol to
+ * field-6 and expect a VNC desktop at field-7. Our box must actually serve
+ * those. This encoder is the redirect; whether the box satisfies the protocol
+ * is a separate, unfinished problem — point it at a logging box first.
+ */
+export function encodeEnsureSandBox({ region = 'us1', accountId, podId, token, agent, vnc, p1340, p6081 }) {
+  // per-port URLs — field 6 is the agent (1337), field 7 the VNC desktop
+  // (6080), matching the live cursorvm response. RunPod fronts each port at
+  // https://<id>-<port>.proxy.runpod.net, so agent !== vnc.
+  return new Buf()
+    .str(1, region)
+    .str(2, accountId)
+    .str(3, podId)
+    .str(4, token)
+    .str(5, 'local')
+    .str(6, agent)
+    .str(7, `${vnc}/vnc.html?network_token=${token}&resume_lower_s=900&resume_upper_s=18000&path=websockify%3Fnetwork_token%3D${token}`)
+    .str(8, '/workspace/terminals')
+    .int(9, 1)
+    .str(10, p1340 || agent)
+    .str(11, token)
+    .str(12, p6081 || vnc)
+    .done();
+}
+
 export function connectFrame(payload) {
   const head = Buffer.alloc(5);
   head.writeUInt8(0, 0);

package/lib/grokbot.js

@@ -1,264 +1,107 @@
-// `npx openzoo grokbot` — Grok Bot (xAI's agent app) on the zoo, Grok-only.
+// `npx openzoo grokbot` — keep Grok Bot's UI, serve OUR box underneath.
 //
-// WHAT GROK BOT IS: an Electron app, bundle id `com.anysphere.sand` (Anysphere,
-// the Cursor company) shipped as "Grok Bot". It fronts the `grok` CLI, and the
-// CLI is what reads ~/.grok/config.toml — which is why pointing the CLI's model
-// table at the local proxy is enough, with no patching of the app bundle.
+// Grok Bot is a thin client over Cursor's aiserver.v1 API. Each bot gets a
+// pod from `GrokBotService/EnsureSandBox` — a cursorvm.com VM the agent runs
+// in. We MITM api2.cursor.sh (proven: /etc/hosts pin + Node TLS override lets
+// us answer 88 methods and passthrough the rest with real bodies), and for
+// that ONE method we return OUR RunPod box in Cursor's exact 12-field wire
+// shape. The polished UI is theirs; the sandbox is ours.
 //
-// WHY GROK-ONLY: the point of running it on the zoo is x402 per-call billing
-// instead of first-party xAI billing, while keeping the product it is — a Grok
-// agent. So every model written here is an x-ai/* id and nothing else is
-// reachable from the picker.
-//
-// WHY THE LOCAL PROXY AND NOT x402-tokens.fly.dev: the gateway answers 402 on
-// every call by design. The proxy is the thing that builds and signs the
-// payment. Pointing base_url at the gateway makes every request fail
-// "payment required".
+// THE WALL, STATED HONESTLY: once the app has our pod, it speaks Cursor's
+// in-pod agent protocol to port 1337 and expects a VNC/websockify desktop on
+// 6080. We do not yet speak either. The box therefore runs lib/podagent.mjs,
+// which LOGS every request on those ports to /var/log/openzoo/agent.jsonl. So
+// this ships as a CAPTURE hijack: the UI connects to our box, and we read what
+// it sends to learn the protocol we then have to implement. That is the honest
+// state — a working hijack needs that protocol, and this is how we get it.
 
 import { spawn, execSync } from 'node:child_process';
-import { existsSync, readFileSync, writeFileSync, copyFileSync, mkdirSync } from 'node:fs';
+import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 
 import { config } from './config.js';
+import { PayClient } from './pay.js';
+import {
+  podEndpoints, readyBox, runpodConfigured, spawnBox, listBoxes,
+} from './boxes.js';
 
-const GROK_HOME = process.env.GROK_HOME || join(homedir(), '.grok');
-const CONFIG_PATH = join(GROK_HOME, 'config.toml');
 const APP = '/Applications/Grok Bot.app';
+const GROK_HOME = process.env.GROK_HOME || join(homedir(), '.grok');
 
-/** Grok ids as the zoo serves them. Verified against GET /v1/models at write
- *  time so a renamed/retired model never lands in the picker as a dead row. */
-const FALLBACK_MODELS = [
-  { key: 'openzoo-grok-46', id: 'x-ai/grok-4.6', name: 'Grok 4.6 (openzoo)' },
-  { key: 'openzoo-grok-45', id: 'x-ai/grok-4.5', name: 'Grok 4.5 (openzoo)' },
-];
-
-/**
- * TOML table keys cannot contain a bare dot — `[model.openzoo-grok-4.6]` parses
- * as model -> "openzoo-grok-4" -> "6", silently producing a malformed entry
- * with no `model` field. Slugify to keep the key flat.
- */
-function slug(id) {
-  return 'openzoo-' + id.replace(/^x-ai\//, '').replace(/[^a-zA-Z0-9]+/g, '-').replace(/-+$/, '');
-}
-
-async function grokModels(base) {
-  try {
-    const r = await fetch(`${base}/models`, { signal: AbortSignal.timeout(8000) });
-    if (!r.ok) throw new Error(`models ${r.status}`);
-    const j = await r.json();
-    const rows = (j.data || [])
-      // VENDOR-PREFIXED IDS ONLY. The local proxy augments /v1/models with
-      // harness aliases ("grok-4", "openzoo-grok-4.6") so editors that validate
-      // a configured id upfront do not refuse to start. Those are routing
-      // conveniences, not catalog rows — writing them here would produce
-      // duplicate picker entries that all resolve to the same model.
-      .filter((m) => typeof m.id === 'string' && m.id.startsWith('x-ai/') && !m.kind)
-      .map((m) => ({ key: slug(m.id), id: m.id, name: `${m.id.replace(/^x-ai\//, 'Grok ')} (openzoo)` }));
-    return rows.length ? rows : FALLBACK_MODELS;
-  } catch {
-    // never write an empty picker because the catalog blipped
-    return FALLBACK_MODELS;
-  }
-}
-
-/** Strip the blocks we own so a re-run is idempotent, keeping everything else
- *  (mcp_servers, plugins, marketplace, privacy, ui) exactly as the user had it. */
-function stripOurs(toml) {
-  const lines = toml.split('\n');
-  const out = [];
-  let skipping = false;
-  for (const line of lines) {
-    const header = line.match(/^\s*\[([^\]]+)\]\s*$/);
-    if (header) {
-      const name = header[1];
-      skipping = name === 'models' || name.startsWith('model.');
-    }
-    if (!skipping) out.push(line);
-  }
-  return out.join('\n').replace(/\n{3,}/g, '\n\n').trimEnd();
-}
-
-function renderModels(models, base) {
-  const def = models[0].key;
-  const body = models.map((m) => `[model.${m.key}]
-model = "${m.id}"
-base_url = "${base}"
-api_key = "openzoo"
-name = "${m.name}"`).join('\n\n');
-  return `
-# --- openzoo: Grok-only, paid per call by x402 -------------------------------
-# Written by \`npx openzoo grokbot\`. Re-running rewrites ONLY this block.
-# base_url is the LOCAL proxy: the public gateway 402s every call by design,
-# and the proxy is what signs the payment.
-[models]
-default = "${def}"
-
-${body}
-`;
-}
-
-export async function setupGrokBot(argv = []) {
-  const base = `http://localhost:${config.port}/v1`;
-  const launch = !argv.includes('--no-launch');
-
-  // 1. proxy up, or nothing can pay
-  let up = false;
-  try { up = (await fetch(`${base}/models`, { signal: AbortSignal.timeout(3000) })).ok; } catch { up = false; }
-  if (!up) {
-    console.error('openzoo: starting the proxy...');
-    const { startProxy } = await import('./proxy.js');
-    await startProxy({ silent: true, autoTunnel: true });
-    for (let i = 0; i < 25 && !up; i++) {
-      await new Promise((r) => setTimeout(r, 300));
-      try { up = (await fetch(`${base}/models`, { signal: AbortSignal.timeout(2000) })).ok; } catch { /* wait */ }
-    }
-    if (!up) { console.error(`openzoo: proxy did not come up on ${base}`); process.exit(1); }
+export async function runGrokBot(argv = []) {
+  if (process.platform !== 'darwin') {
+    console.error('openzoo grokbot: the app hijack is macOS-only (needs Grok Bot.app + /etc/hosts).');
+    process.exit(1);
   }
-
-  const models = await grokModels(base);
-
-  // 2. rewrite ONLY our block, after a timestamped backup
-  if (!existsSync(GROK_HOME)) mkdirSync(GROK_HOME, { recursive: true });
-  let existing = '';
-  if (existsSync(CONFIG_PATH)) {
-    const backup = `${CONFIG_PATH}.bak-${Date.now()}`;
-    copyFileSync(CONFIG_PATH, backup);
-    existing = readFileSync(CONFIG_PATH, 'utf8');
-    console.error(`openzoo: backed up ${CONFIG_PATH} -> ${backup}`);
+  if (!existsSync(APP)) {
+    console.error('openzoo grokbot: /Applications/Grok Bot.app not found.');
+    process.exit(1);
   }
-  let next = stripOurs(existing);
-  // the fork/secondary model must ride the zoo too, or forks quietly bill xAI
-  // first-party while the main model is on openzoo
-  if (/^\s*fork_secondary_model\s*=/m.test(next)) {
-    next = next.replace(/^\s*fork_secondary_model\s*=.*$/m, `fork_secondary_model = "${models[0].key}"`);
+  if (!runpodConfigured()) {
+    console.error('openzoo grokbot: RUNPOD_API_KEY not set (needs an rpa_… key).');
+    console.error('  export RUNPOD_API_KEY=rpa_…   then re-run. Boxes bill to that account;');
+    console.error('  inference bills per-call to the box\'s own openzoo wallet.');
+    process.exit(1);
   }
-  writeFileSync(CONFIG_PATH, `${next}\n${renderModels(models, base)}`, 'utf8');
-
-  console.error(`openzoo: wrote ${models.length} Grok model(s) to ${CONFIG_PATH}`);
-  for (const m of models) console.error(`         ${m.key}  ->  ${m.id}`);
-  console.error(`openzoo: default = ${models[0].key} · all calls paid by x402 from your burner wallet`);
-
-  if (!launch) return;
-
-  // 3. launch the app if it exists, else the CLI
-  if (existsSync(APP)) {
-    // BYOK IS THE DEFAULT. Without it this command only rewrites the CLI's
-    // model table, and the APP — the thing you actually look at — keeps talking
-    // to Cursor's cloud, which is the whole problem it was meant to solve.
-    // --no-byok drops back to plain launch.
-    // TAKEOVER IS THE DEFAULT. The --host-resolver-rules probe below is kept
-    // only for reference: it was PROVED not to intercept this app (flags present,
-    // backend listening, zero connections). Nothing routes without the hosts pin.
-    if (!argv.includes('--no-takeover')) {
-      // TAKEOVER — the Cursor recipe, because it is the only one that works.
-      //
-      // WHY NOT --host-resolver-rules: PROVED not to work here. The flag was
-      // verified present in the running process args for all four cursor hosts,
-      // the backend was listening, and ZERO connections arrived — the app kept
-      // talking to the real api2.cursor.sh (cert CN confirmed on its live
-      // sockets). That flag only steers CHROMIUM's stack; Grok Bot's Connect/gRPC
-      // transport runs in the Electron MAIN process on Node's DNS + Node's TLS,
-      // which ignore it. Same reason setup.js sets NODE_TLS_REJECT_UNAUTHORIZED
-      // for Cursor takeover.
-      //
-      // So: /etc/hosts (Node reads the OS resolver) + Node-side TLS override,
-      // and the app is spawned DIRECTLY rather than via `open`, because `open`
-      // does not pass an environment to the app.
-      const { blockBackend, unblockBackend, isBlocked } = await import('./hosts.js');
-      const { startCursorBackend } = await import('./cursorbackend.js');
-      const port = 443; // Node's DNS gives no port control — we must own :443
 
-      // --sniff: intercept but PASS EVERYTHING THROUGH to the real backend, so
-      // the app works normally and every method/size/status is logged. This is
-      // the only way to see the chat path: stubbing breaks EnsureSandBox and the
-      // app never reaches inference at all.
-      if (argv.includes('--sniff')) { process.env.OPENZOO_PASSTHRU = '1'; process.env.OPENZOO_DUMP = '1'; }
-      else process.env.OPENZOO_BYOK = '1';
-      process.env.OPENZOO_FORCE_BLOCK = '1';   // our own guard refuses otherwise
-      console.error(argv.includes('--sniff')
-        ? 'openzoo: SNIFF — pinning api2.cursor.sh, proxying it to the REAL backend, logging everything.'
-        : 'openzoo: TAKEOVER — pinning api2.cursor.sh and serving it locally.');
-      if (argv.includes('--sniff')) console.error('         response bodies -> /tmp/openzoo-sniff/');
-      console.error('         sudo will ask for your password (hosts file + :443).');
-      if (!isBlocked()) blockBackend();
-
-      startCursorBackend({ port, log: (m) => console.error(`  backend: ${m}`) });
-
-      const restore = () => {
-        try { unblockBackend(); console.error('openzoo: /etc/hosts restored.'); } catch { /* best effort */ }
-      };
-      process.on('SIGINT', () => { restore(); process.exit(0); });
-      process.on('exit', restore);
-
-      console.error('openzoo: launching Grok Bot with Node TLS override...');
-      spawn(`${APP}/Contents/MacOS/Grok Bot`, ['--ignore-certificate-errors'], {
-        stdio: 'ignore',
-        detached: true,
-        env: { ...process.env, NODE_TLS_REJECT_UNAUTHORIZED: '0' },
-      }).unref();
-
-      console.error('openzoo: ctrl-c to stop and RESTORE /etc/hosts (do not just close the terminal).');
-      await new Promise(() => {});
-      return;
-    }
-
-    if (!argv.includes('--no-byok')) {
-      // BYOK PROBE — NO /etc/hosts, NO sudo.
-      //
-      // Grok Bot asks aiserver.v1 whether BYOK is allowed (`byok_enabled`,
-      // field 14). Answering that ourselves needs us to BE api2.cursor.sh, and
-      // the obvious way — pinning it in /etc/hosts — is exactly what took the
-      // app offline for an hour with "Reconnecting to your computer", because
-      // the pin is machine-wide and outlives the app.
-      //
-      // Chromium's own --host-resolver-rules does the same redirect scoped to
-      // THIS LAUNCH ONLY. Quit and reopen normally and it is gone; nothing
-      // persists, nothing else on the machine is affected, no password needed.
-      const { startCursorBackend } = await import('./cursorbackend.js');
-      const port = 8443;
-      process.env.OPENZOO_BYOK = '1';
-      // LOUD BY DEFAULT. The previous run failed silently — "listening" and then
-      // nothing — and silence looked identical to success. Every arriving method
-      // is printed so "did it connect at all" is answerable at a glance.
-      startCursorBackend({ port, log: (m) => console.error(`  backend: ${m}`) });
-      console.error('openzoo: BYOK probe — impersonating api2/api3/api4/repo42.cursor.sh on :' + port);
-      console.error('         scoped to this launch only (no /etc/hosts, no sudo)');
-      console.error('         WATCH: if StreamChat starts arriving at the proxy, inference moved.');
-      console.error('         If only a BYOK settings pane appears, it is xAI-key-only and buys nothing.');
-      // QUIT FIRST — `open -a X --args` is a NO-OP ON A RUNNING APP.
-      // macOS just activates the existing instance and drops the args, so the
-      // resolver rule never applies and the app keeps talking to the real
-      // api2.cursor.sh. MEASURED: the backend logged "listening" and then zero
-      // requests, while the app carried on answering normally.
-      try {
-        execSync('osascript -e \'tell application "Grok Bot" to quit\'', { stdio: 'ignore' });
-      } catch { /* not running is fine */ }
-      // give it a moment to actually exit before relaunching
-      await new Promise((r) => setTimeout(r, 2500));
-      // MAP EVERY CURSOR HOST, NOT JUST api2.
-      // MEASURED: mapping api2 alone applied cleanly (verified in the running
-      // process args) and still produced ZERO requests, because Grok Bot's own
-      // surface is api3 — the bundle carries `https://api3.cursor.sh/tev1/v1`.
-      // The self-signed cert already covers all four names, so map them all.
-      const hosts = ['api2.cursor.sh', 'api3.cursor.sh', 'api4.cursor.sh', 'repo42.cursor.sh'];
-      const rules = hosts.map((h) => `MAP ${h} 127.0.0.1:${port}`).join(',');
-      spawn('open', ['-n', '-a', APP, '--args',
-        '--ignore-certificate-errors',
-        `--host-resolver-rules=${rules}`,
-      ], { stdio: 'ignore', detached: true }).unref();
-      // keep this process alive so the backend keeps answering
-      console.error('openzoo: leave this running while Grok Bot is open. ctrl-c stops the');
-      console.error('         backend; the app then reconnects to xAI normally on next launch.');
-      console.error('         (skip all of this with --no-byok)');
-      await new Promise(() => {});
-      return;
-    }
-    console.error('openzoo: launching Grok Bot...');
-    spawn('open', ['-a', APP], { stdio: 'ignore', detached: true }).unref();
-  } else {
-    console.error('openzoo: Grok Bot.app not found — starting the `grok` CLI instead');
-    const p = spawn('grok', argv.filter((a) => a !== '--no-launch'), { stdio: 'inherit' });
-    p.on('exit', (c) => process.exit(c ?? 0));
-  }
+  const days = Number((argv.find((a) => /^--days=/.test(a)) || '').split('=')[1]) || 1;
+  const shareWallet = argv.includes('--share-wallet');
+  const client = new PayClient();
+
+  // 1) a box, ready, BEFORE we touch the app — so the first EnsureSandBox we
+  //    hijack already has a live pod to point at.
+  console.error('openzoo grokbot: spawning your box (CPU, x402-funded)…');
+  const spawned = await spawnBox({
+    name: 'grokbot', days,
+    ...(shareWallet ? { walletJson: JSON.stringify([...client.keypair.secretKey]) } : {}),
+  });
+  if (!spawned.ok) { console.error(`  spawn failed: ${spawned.error}`); process.exit(1); }
+  const box = spawned.box;
+  console.error(`  ${box.name}  ${box.id}  expires ${spawned.expiresAt.slice(0, 16)}`);
+  const ready = await readyBox(box.id, { log: (m) => console.error(m) });
+  if (!ready.ok) console.error(`  ${ready.error} — continuing; the capture agent may still bind`);
+  else console.error(`  box ready in ${ready.seconds}s`);
+
+  const ep = podEndpoints(box.id);
+  process.env.OZ_HIJACK_POD = JSON.stringify({
+    region: 'us1',
+    accountId: box.id.replace(/[^a-z0-9]/gi, '').slice(0, 20),
+    podId: `pod-${box.id}`,
+    token: `nto-${Math.random().toString(36).slice(2, 12)}`,
+    agent: ep.agent, vnc: ep.vnc, p1340: ep.p1340, p6081: ep.p6081,
+  });
+  // other methods must still reach the REAL backend, or the app can't load
+  process.env.OPENZOO_PASSTHRU = '1';
+  process.env.OPENZOO_FORCE_BLOCK = '1';
+
+  // 2) pin + serve api2.cursor.sh locally (sudo). Chromium flags don't reach
+  //    the Electron main process; only /etc/hosts + Node TLS override do.
+  const { blockBackend, unblockBackend, isBlocked } = await import('./hosts.js');
+  const { startCursorBackend } = await import('./cursorbackend.js');
+  console.error('openzoo grokbot: pinning api2.cursor.sh (sudo)…');
+  if (!isBlocked()) blockBackend();
+  startCursorBackend({ port: 443, log: (m) => console.error(`  backend: ${m}`) });
+
+  const restore = () => { try { unblockBackend(); console.error('openzoo: /etc/hosts restored.'); } catch { /* */ } };
+  process.on('SIGINT', () => { restore(); process.exit(0); });
+  process.on('exit', restore);
+
+  // 3) launch the app directly (open -a can't pass env) with Node TLS override
+  console.error('openzoo grokbot: launching Grok Bot pointed at your box…');
+  console.error(`  box proxy   : ${ep.proxy}`);
+  console.error(`  agent (1337): ${ep.agent}`);
+  console.error(`  ssh         : ${box.ssh || '(pending)'}`);
+  console.error('  WATCH the box agent log for what the app sends:');
+  console.error(`    ${box.ssh ? box.ssh + " 'tail -f /var/log/openzoo/agent.log'" : '(ssh not ready yet)'}`);
+  try { execSync('osascript -e \'tell application "Grok Bot" to quit\'', { stdio: 'ignore' }); } catch { /* */ }
+  await new Promise((r) => setTimeout(r, 2500));
+  spawn(`${APP}/Contents/MacOS/Grok Bot`, ['--ignore-certificate-errors'], {
+    stdio: 'ignore', detached: true,
+    env: { ...process.env, NODE_TLS_REJECT_UNAUTHORIZED: '0' },
+  }).unref();
+
+  console.error('openzoo grokbot: ctrl-c to stop, restore /etc/hosts, and leave the box running.');
+  console.error(`  the box keeps running until its TTL — manage with: RUNPOD_API_KEY=… openzoo grokbot (again) or the runpod console`);
+  await new Promise(() => {});
 }

package/lib/grokcli.js

@@ -0,0 +1,264 @@
+// `npx openzoo grokbot` — Grok Bot (xAI's agent app) on the zoo, Grok-only.
+//
+// WHAT GROK BOT IS: an Electron app, bundle id `com.anysphere.sand` (Anysphere,
+// the Cursor company) shipped as "Grok Bot". It fronts the `grok` CLI, and the
+// CLI is what reads ~/.grok/config.toml — which is why pointing the CLI's model
+// table at the local proxy is enough, with no patching of the app bundle.
+//
+// WHY GROK-ONLY: the point of running it on the zoo is x402 per-call billing
+// instead of first-party xAI billing, while keeping the product it is — a Grok
+// agent. So every model written here is an x-ai/* id and nothing else is
+// reachable from the picker.
+//
+// WHY THE LOCAL PROXY AND NOT x402-tokens.fly.dev: the gateway answers 402 on
+// every call by design. The proxy is the thing that builds and signs the
+// payment. Pointing base_url at the gateway makes every request fail
+// "payment required".
+
+import { spawn, execSync } from 'node:child_process';
+import { existsSync, readFileSync, writeFileSync, copyFileSync, mkdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+import { config } from './config.js';
+
+const GROK_HOME = process.env.GROK_HOME || join(homedir(), '.grok');
+const CONFIG_PATH = join(GROK_HOME, 'config.toml');
+const APP = '/Applications/Grok Bot.app';
+
+/** Grok ids as the zoo serves them. Verified against GET /v1/models at write
+ *  time so a renamed/retired model never lands in the picker as a dead row. */
+const FALLBACK_MODELS = [
+  { key: 'openzoo-grok-46', id: 'x-ai/grok-4.6', name: 'Grok 4.6 (openzoo)' },
+  { key: 'openzoo-grok-45', id: 'x-ai/grok-4.5', name: 'Grok 4.5 (openzoo)' },
+];
+
+/**
+ * TOML table keys cannot contain a bare dot — `[model.openzoo-grok-4.6]` parses
+ * as model -> "openzoo-grok-4" -> "6", silently producing a malformed entry
+ * with no `model` field. Slugify to keep the key flat.
+ */
+function slug(id) {
+  return 'openzoo-' + id.replace(/^x-ai\//, '').replace(/[^a-zA-Z0-9]+/g, '-').replace(/-+$/, '');
+}
+
+async function grokModels(base) {
+  try {
+    const r = await fetch(`${base}/models`, { signal: AbortSignal.timeout(8000) });
+    if (!r.ok) throw new Error(`models ${r.status}`);
+    const j = await r.json();
+    const rows = (j.data || [])
+      // VENDOR-PREFIXED IDS ONLY. The local proxy augments /v1/models with
+      // harness aliases ("grok-4", "openzoo-grok-4.6") so editors that validate
+      // a configured id upfront do not refuse to start. Those are routing
+      // conveniences, not catalog rows — writing them here would produce
+      // duplicate picker entries that all resolve to the same model.
+      .filter((m) => typeof m.id === 'string' && m.id.startsWith('x-ai/') && !m.kind)
+      .map((m) => ({ key: slug(m.id), id: m.id, name: `${m.id.replace(/^x-ai\//, 'Grok ')} (openzoo)` }));
+    return rows.length ? rows : FALLBACK_MODELS;
+  } catch {
+    // never write an empty picker because the catalog blipped
+    return FALLBACK_MODELS;
+  }
+}
+
+/** Strip the blocks we own so a re-run is idempotent, keeping everything else
+ *  (mcp_servers, plugins, marketplace, privacy, ui) exactly as the user had it. */
+function stripOurs(toml) {
+  const lines = toml.split('\n');
+  const out = [];
+  let skipping = false;
+  for (const line of lines) {
+    const header = line.match(/^\s*\[([^\]]+)\]\s*$/);
+    if (header) {
+      const name = header[1];
+      skipping = name === 'models' || name.startsWith('model.');
+    }
+    if (!skipping) out.push(line);
+  }
+  return out.join('\n').replace(/\n{3,}/g, '\n\n').trimEnd();
+}
+
+function renderModels(models, base) {
+  const def = models[0].key;
+  const body = models.map((m) => `[model.${m.key}]
+model = "${m.id}"
+base_url = "${base}"
+api_key = "openzoo"
+name = "${m.name}"`).join('\n\n');
+  return `
+# --- openzoo: Grok-only, paid per call by x402 -------------------------------
+# Written by \`npx openzoo grokbot\`. Re-running rewrites ONLY this block.
+# base_url is the LOCAL proxy: the public gateway 402s every call by design,
+# and the proxy is what signs the payment.
+[models]
+default = "${def}"
+
+${body}
+`;
+}
+
+export async function setupGrokBot(argv = []) {
+  const base = `http://localhost:${config.port}/v1`;
+  const launch = !argv.includes('--no-launch');
+
+  // 1. proxy up, or nothing can pay
+  let up = false;
+  try { up = (await fetch(`${base}/models`, { signal: AbortSignal.timeout(3000) })).ok; } catch { up = false; }
+  if (!up) {
+    console.error('openzoo: starting the proxy...');
+    const { startProxy } = await import('./proxy.js');
+    await startProxy({ silent: true, autoTunnel: true });
+    for (let i = 0; i < 25 && !up; i++) {
+      await new Promise((r) => setTimeout(r, 300));
+      try { up = (await fetch(`${base}/models`, { signal: AbortSignal.timeout(2000) })).ok; } catch { /* wait */ }
+    }
+    if (!up) { console.error(`openzoo: proxy did not come up on ${base}`); process.exit(1); }
+  }
+
+  const models = await grokModels(base);
+
+  // 2. rewrite ONLY our block, after a timestamped backup
+  if (!existsSync(GROK_HOME)) mkdirSync(GROK_HOME, { recursive: true });
+  let existing = '';
+  if (existsSync(CONFIG_PATH)) {
+    const backup = `${CONFIG_PATH}.bak-${Date.now()}`;
+    copyFileSync(CONFIG_PATH, backup);
+    existing = readFileSync(CONFIG_PATH, 'utf8');
+    console.error(`openzoo: backed up ${CONFIG_PATH} -> ${backup}`);
+  }
+  let next = stripOurs(existing);
+  // the fork/secondary model must ride the zoo too, or forks quietly bill xAI
+  // first-party while the main model is on openzoo
+  if (/^\s*fork_secondary_model\s*=/m.test(next)) {
+    next = next.replace(/^\s*fork_secondary_model\s*=.*$/m, `fork_secondary_model = "${models[0].key}"`);
+  }
+  writeFileSync(CONFIG_PATH, `${next}\n${renderModels(models, base)}`, 'utf8');
+
+  console.error(`openzoo: wrote ${models.length} Grok model(s) to ${CONFIG_PATH}`);
+  for (const m of models) console.error(`         ${m.key}  ->  ${m.id}`);
+  console.error(`openzoo: default = ${models[0].key} · all calls paid by x402 from your burner wallet`);
+
+  if (!launch) return;
+
+  // 3. launch the app if it exists, else the CLI
+  if (existsSync(APP)) {
+    // BYOK IS THE DEFAULT. Without it this command only rewrites the CLI's
+    // model table, and the APP — the thing you actually look at — keeps talking
+    // to Cursor's cloud, which is the whole problem it was meant to solve.
+    // --no-byok drops back to plain launch.
+    // TAKEOVER IS THE DEFAULT. The --host-resolver-rules probe below is kept
+    // only for reference: it was PROVED not to intercept this app (flags present,
+    // backend listening, zero connections). Nothing routes without the hosts pin.
+    if (!argv.includes('--no-takeover')) {
+      // TAKEOVER — the Cursor recipe, because it is the only one that works.
+      //
+      // WHY NOT --host-resolver-rules: PROVED not to work here. The flag was
+      // verified present in the running process args for all four cursor hosts,
+      // the backend was listening, and ZERO connections arrived — the app kept
+      // talking to the real api2.cursor.sh (cert CN confirmed on its live
+      // sockets). That flag only steers CHROMIUM's stack; Grok Bot's Connect/gRPC
+      // transport runs in the Electron MAIN process on Node's DNS + Node's TLS,
+      // which ignore it. Same reason setup.js sets NODE_TLS_REJECT_UNAUTHORIZED
+      // for Cursor takeover.
+      //
+      // So: /etc/hosts (Node reads the OS resolver) + Node-side TLS override,
+      // and the app is spawned DIRECTLY rather than via `open`, because `open`
+      // does not pass an environment to the app.
+      const { blockBackend, unblockBackend, isBlocked } = await import('./hosts.js');
+      const { startCursorBackend } = await import('./cursorbackend.js');
+      const port = 443; // Node's DNS gives no port control — we must own :443
+
+      // --sniff: intercept but PASS EVERYTHING THROUGH to the real backend, so
+      // the app works normally and every method/size/status is logged. This is
+      // the only way to see the chat path: stubbing breaks EnsureSandBox and the
+      // app never reaches inference at all.
+      if (argv.includes('--sniff')) { process.env.OPENZOO_PASSTHRU = '1'; process.env.OPENZOO_DUMP = '1'; }
+      else process.env.OPENZOO_BYOK = '1';
+      process.env.OPENZOO_FORCE_BLOCK = '1';   // our own guard refuses otherwise
+      console.error(argv.includes('--sniff')
+        ? 'openzoo: SNIFF — pinning api2.cursor.sh, proxying it to the REAL backend, logging everything.'
+        : 'openzoo: TAKEOVER — pinning api2.cursor.sh and serving it locally.');
+      if (argv.includes('--sniff')) console.error('         response bodies -> /tmp/openzoo-sniff/');
+      console.error('         sudo will ask for your password (hosts file + :443).');
+      if (!isBlocked()) blockBackend();
+
+      startCursorBackend({ port, log: (m) => console.error(`  backend: ${m}`) });
+
+      const restore = () => {
+        try { unblockBackend(); console.error('openzoo: /etc/hosts restored.'); } catch { /* best effort */ }
+      };
+      process.on('SIGINT', () => { restore(); process.exit(0); });
+      process.on('exit', restore);
+
+      console.error('openzoo: launching Grok Bot with Node TLS override...');
+      spawn(`${APP}/Contents/MacOS/Grok Bot`, ['--ignore-certificate-errors'], {
+        stdio: 'ignore',
+        detached: true,
+        env: { ...process.env, NODE_TLS_REJECT_UNAUTHORIZED: '0' },
+      }).unref();
+
+      console.error('openzoo: ctrl-c to stop and RESTORE /etc/hosts (do not just close the terminal).');
+      await new Promise(() => {});
+      return;
+    }
+
+    if (!argv.includes('--no-byok')) {
+      // BYOK PROBE — NO /etc/hosts, NO sudo.
+      //
+      // Grok Bot asks aiserver.v1 whether BYOK is allowed (`byok_enabled`,
+      // field 14). Answering that ourselves needs us to BE api2.cursor.sh, and
+      // the obvious way — pinning it in /etc/hosts — is exactly what took the
+      // app offline for an hour with "Reconnecting to your computer", because
+      // the pin is machine-wide and outlives the app.
+      //
+      // Chromium's own --host-resolver-rules does the same redirect scoped to
+      // THIS LAUNCH ONLY. Quit and reopen normally and it is gone; nothing
+      // persists, nothing else on the machine is affected, no password needed.
+      const { startCursorBackend } = await import('./cursorbackend.js');
+      const port = 8443;
+      process.env.OPENZOO_BYOK = '1';
+      // LOUD BY DEFAULT. The previous run failed silently — "listening" and then
+      // nothing — and silence looked identical to success. Every arriving method
+      // is printed so "did it connect at all" is answerable at a glance.
+      startCursorBackend({ port, log: (m) => console.error(`  backend: ${m}`) });
+      console.error('openzoo: BYOK probe — impersonating api2/api3/api4/repo42.cursor.sh on :' + port);
+      console.error('         scoped to this launch only (no /etc/hosts, no sudo)');
+      console.error('         WATCH: if StreamChat starts arriving at the proxy, inference moved.');
+      console.error('         If only a BYOK settings pane appears, it is xAI-key-only and buys nothing.');
+      // QUIT FIRST — `open -a X --args` is a NO-OP ON A RUNNING APP.
+      // macOS just activates the existing instance and drops the args, so the
+      // resolver rule never applies and the app keeps talking to the real
+      // api2.cursor.sh. MEASURED: the backend logged "listening" and then zero
+      // requests, while the app carried on answering normally.
+      try {
+        execSync('osascript -e \'tell application "Grok Bot" to quit\'', { stdio: 'ignore' });
+      } catch { /* not running is fine */ }
+      // give it a moment to actually exit before relaunching
+      await new Promise((r) => setTimeout(r, 2500));
+      // MAP EVERY CURSOR HOST, NOT JUST api2.
+      // MEASURED: mapping api2 alone applied cleanly (verified in the running
+      // process args) and still produced ZERO requests, because Grok Bot's own
+      // surface is api3 — the bundle carries `https://api3.cursor.sh/tev1/v1`.
+      // The self-signed cert already covers all four names, so map them all.
+      const hosts = ['api2.cursor.sh', 'api3.cursor.sh', 'api4.cursor.sh', 'repo42.cursor.sh'];
+      const rules = hosts.map((h) => `MAP ${h} 127.0.0.1:${port}`).join(',');
+      spawn('open', ['-n', '-a', APP, '--args',
+        '--ignore-certificate-errors',
+        `--host-resolver-rules=${rules}`,
+      ], { stdio: 'ignore', detached: true }).unref();
+      // keep this process alive so the backend keeps answering
+      console.error('openzoo: leave this running while Grok Bot is open. ctrl-c stops the');
+      console.error('         backend; the app then reconnects to xAI normally on next launch.');
+      console.error('         (skip all of this with --no-byok)');
+      await new Promise(() => {});
+      return;
+    }
+    console.error('openzoo: launching Grok Bot...');
+    spawn('open', ['-a', APP], { stdio: 'ignore', detached: true }).unref();
+  } else {
+    console.error('openzoo: Grok Bot.app not found — starting the `grok` CLI instead');
+    const p = spawn('grok', argv.filter((a) => a !== '--no-launch'), { stdio: 'inherit' });
+    p.on('exit', (c) => process.exit(c ?? 0));
+  }
+}

package/lib/podagent.mjs

@@ -0,0 +1,68 @@
+// Pod capture agent — runs INSIDE our box, on the ports Grok Bot expects a
+// Cursor sandbox to answer (1337 agent, 6080 vnc, 1340, 6081).
+//
+// THIS IS THE PROBE THAT ANSWERS THE WALL. Once EnsureSandBox is rewritten to
+// point Grok Bot at our box, the app speaks Cursor's in-pod agent protocol to
+// port 1337 and expects a VNC/websockify desktop on 6080. We do not know that
+// protocol. This server logs EVERY request — method, path, headers, body
+// (hex + utf8) — to /var/log/openzoo/agent.jsonl and stdout, and answers a
+// benign 200/101 so the app keeps talking and reveals more. Read the log and
+// you have the spec; until then, "serve our VMs into their UI" is a capture,
+// not a working hijack, and this file is honest about which.
+
+import http from 'node:http';
+import { appendFileSync } from 'node:fs';
+
+const PORTS = (process.env.OZ_AGENT_PORTS || '1337,6080,1340,6081')
+  .split(',').map((s) => Number(s.trim())).filter(Boolean);
+const LOG = process.env.OZ_AGENT_LOG || '/var/log/openzoo/agent.jsonl';
+
+function record(entry) {
+  const line = JSON.stringify(entry);
+  try { appendFileSync(LOG, line + '\n'); } catch { /* best effort */ }
+  console.log(`[agent:${entry.port}] ${entry.method} ${entry.path} ${entry.bodyBytes}b` +
+    (entry.upgrade ? ` (UPGRADE ${entry.upgrade})` : ''));
+}
+
+for (const port of PORTS) {
+  const server = http.createServer((req, res) => {
+    const chunks = [];
+    req.on('data', (d) => chunks.push(d));
+    req.on('end', () => {
+      const body = Buffer.concat(chunks);
+      record({
+        t: new Date().toISOString(), port,
+        method: req.method, path: req.url,
+        headers: req.headers,
+        bodyBytes: body.length,
+        bodyHex: body.slice(0, 512).toString('hex'),
+        bodyUtf8: body.slice(0, 512).toString('utf8').replace(/[^\x20-\x7e]/g, '.'),
+      });
+      // Benign answers so the client does not give up immediately.
+      if (req.url && req.url.includes('/vnc')) {
+        res.writeHead(200, { 'content-type': 'text/html' });
+        res.end('<!doctype html><title>openzoo box</title><body>capture</body>');
+      } else {
+        res.writeHead(200, { 'content-type': 'application/json' });
+        res.end('{}');
+      }
+    });
+  });
+  // Capture websocket upgrades too — VNC/websockify is a WS, and the agent
+  // channel may be one; log the handshake even though we don't speak it yet.
+  server.on('upgrade', (req, socket) => {
+    record({
+      t: new Date().toISOString(), port,
+      method: req.method, path: req.url, upgrade: req.headers.upgrade,
+      headers: req.headers, bodyBytes: 0,
+    });
+    // 101 with no real protocol; the client will close, which is fine — we
+    // only needed the handshake headers.
+    socket.write('HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\n\r\n');
+    socket.on('data', (d) => record({
+      t: new Date().toISOString(), port, method: 'WS-DATA', path: req.url,
+      bodyBytes: d.length, bodyHex: d.slice(0, 256).toString('hex'),
+    }));
+  });
+  server.listen(port, '0.0.0.0', () => console.log(`[agent] capturing on :${port}`));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.38.8",
+  "version": "0.39.0",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",