openzoo 0.39.0 → 0.39.2

package/lib/boxes.js

@@ -32,29 +32,40 @@ function podAgentB64() {
 const REST = 'https://rest.runpod.io/v1';
 export const BOX_PREFIX = 'openzoo-box-';
 const CPU_FLAVORS = ['cpu3c', 'cpu3g', 'cpu5c'];
-const BOX_IMAGE = process.env.OPENZOO_BOX_IMAGE || 'node:22-alpine';
+// GLIBC, NOT ALPINE. `npx openzoo` pulls native deps (ed25519 / ws helpers);
+// on musl they fail to build because the entrypoint has no toolchain, which is
+// why alpine boxes sat at 404 forever. Debian-slim runs the shim as published,
+// and its apt has a real sshd.
+const BOX_IMAGE = process.env.OPENZOO_BOX_IMAGE || 'node:22-slim';
 const BOX_PORTS = ['8402/http', '1337/http', '6080/http', '1340/http', '6081/http', '22/tcp'];
 const TTL_MAX_HOURS = 90 * 24;
 
 /**
- * Boot: write the wallet, start the x402 proxy, keep the container alive.
+ * Boot: write the wallet, START SSHD, start the x402 proxy + capture agent.
  *
- * The proxy is the point — everything the agent asks for is paid per request
- * from this box's own wallet. `npx --yes openzoo` is fetched at boot rather
- * than baked, so a box always runs the published shim; the tradeoff is a hard
- * dependency on npm being reachable in the first ~30s, which readyBox() waits
- * for explicitly instead of assuming.
+ * SSHD IS NOT OPTIONAL and was the second bug: our dockerStartCmd replaces the
+ * image's own init, so nothing starts sshd and every `execInBox` got
+ * "connection refused" — the agent had no hands. RunPod injects the account
+ * key at $PUBLIC_KEY / $SSH_PUBLIC_KEY; we write it to authorized_keys, generate
+ * host keys, and run sshd in the foreground of the background. Passwordless
+ * root login is NOT enabled — key-only.
+ *
+ * `npx --yes openzoo` is still fetched at boot so a box always runs the
+ * published shim; readyBox() polls /v1/models rather than assuming a timing.
  */
 const ENTRYPOINT = [
-  'sh', '-c',
-  'set -e; mkdir -p /workspace /root/.openzoo /var/log/openzoo; '
+  'bash', '-lc',
+  'set +e; mkdir -p /workspace /root/.openzoo /var/log/openzoo /run/sshd /root/.ssh; '
   + 'if [ -n "$OPENZOO_WALLET_JSON" ]; then printf %s "$OPENZOO_WALLET_JSON" > /root/.openzoo/wallet.json; chmod 600 /root/.openzoo/wallet.json; fi; '
-  + 'apk add --no-cache openssh bash git curl >/dev/null 2>&1 || true; '
+  + 'export DEBIAN_FRONTEND=noninteractive; apt-get update >/dev/null 2>&1; apt-get install -y --no-install-recommends openssh-server git ca-certificates >/dev/null 2>&1; '
+  // RunPod hands the operator pubkey in one of these — accept whichever is set
+  + 'for K in "$PUBLIC_KEY" "$SSH_PUBLIC_KEY"; do [ -n "$K" ] && echo "$K" >> /root/.ssh/authorized_keys; done; chmod 600 /root/.ssh/authorized_keys 2>/dev/null; '
+  + 'ssh-keygen -A >/dev/null 2>&1; sed -i "s/^#\\?PermitRootLogin.*/PermitRootLogin prohibit-password/" /etc/ssh/sshd_config 2>/dev/null; /usr/sbin/sshd -e >/var/log/openzoo/sshd.log 2>&1 & '
   + 'npx --yes openzoo > /var/log/openzoo/proxy.log 2>&1 & '
   // the capture agent answers the ports Grok Bot expects a Cursor sandbox on,
   // logging the protocol we do not yet speak (see lib/podagent.mjs)
   + 'if [ -n "$OZ_PODAGENT_B64" ]; then printf %s "$OZ_PODAGENT_B64" | base64 -d > /opt/podagent.mjs; node /opt/podagent.mjs > /var/log/openzoo/agent.log 2>&1 & fi; '
-  + 'wait',
+  + 'sleep infinity',
 ];
 
 function key() {
@@ -185,6 +196,8 @@ export async function spawnBox({ name = 'bot', days = 1, vcpu = 2, walletJson, p
       OPENZOO_BOX: '1',
       OPENZOO_EXPIRES_UNIX: String(unix),
       OPENZOO_NO_TUNNEL: '1',           // the runpod proxy already fronts it
+      OPENZOO_BIND: '0.0.0.0',          // else the runpod proxy can't reach :8402
+      OPENZOO_TUNNEL_TOKEN: `oz-${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`,
       ...(walletJson ? { OPENZOO_WALLET_JSON: walletJson } : {}),
       ...(pubkey ? { OPENZOO_WALLET_PUBKEY: pubkey } : {}),
       OZ_PODAGENT_B64: podAgentB64(),

package/lib/proxy.js

@@ -715,9 +715,17 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     }
   });
 
+  // BIND HOST. Default 127.0.0.1 — the keyless localhost path must never be
+  // world-reachable on an ordinary machine. A RunPod box is the exception: its
+  // HTTP proxy reaches the container over the pod network, so a localhost bind
+  // shows "Initializing…" forever (MEASURED: podagent's 0.0.0.0 ports went
+  // Ready, the 127.0.0.1 proxy never did). The box sets OPENZOO_BIND=0.0.0.0
+  // AND a tunnel token, so the RunPod-fronted port stays gated exactly like the
+  // public tunnel path.
+  const bindHost = process.env.OPENZOO_BIND || '127.0.0.1';
   await new Promise((resolve, reject) => {
     server.on('error', reject);
-    server.listen(config.port, '127.0.0.1', resolve);
+    server.listen(config.port, bindHost, resolve);
   });
 
   if (!silent) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.39.0",
+  "version": "0.39.2",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",