openzoo 0.39.1 → 0.39.3

package/lib/boxes.js

@@ -196,6 +196,8 @@ export async function spawnBox({ name = 'bot', days = 1, vcpu = 2, walletJson, p
       OPENZOO_BOX: '1',
       OPENZOO_EXPIRES_UNIX: String(unix),
       OPENZOO_NO_TUNNEL: '1',           // the runpod proxy already fronts it
+      OPENZOO_BIND: '0.0.0.0',          // else the runpod proxy can't reach :8402
+      OPENZOO_TUNNEL_TOKEN: `oz-${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`,
       ...(walletJson ? { OPENZOO_WALLET_JSON: walletJson } : {}),
       ...(pubkey ? { OPENZOO_WALLET_PUBKEY: pubkey } : {}),
       OZ_PODAGENT_B64: podAgentB64(),

package/lib/cursorbackend.js

@@ -469,6 +469,17 @@ export function startCursorBackend({ port = 8443, models, log = () => {} } = {})
         return;
       }
       log(`cursor-backend: #${conns} ${req.method} ${full}  ct=${ct}  body=${body.length}b`);
+      // HIJACK EnsureSandBox FIRST — before passthrough, or passthrough eats it.
+      // MEASURED: with OPENZOO_PASSTHRU=1 set, EnsureSandBox went `-> REAL
+      // anthropic (200, 707b)` every time and the app got a real cursorvm pod,
+      // never our box. This method (and ONLY this one) must be answered locally
+      // with OUR box so Grok Bot's UI wires to our sandbox; everything else
+      // still passes through so the app loads normally.
+      if (/GrokBotService\/EnsureSandBox/.test(full) && process.env.OZ_HIJACK_POD) {
+        respond(req, res, method, models);   // encodeForMethod('EnsureSandBox') reads OZ_HIJACK_POD
+        log(`cursor-backend:      -> HIJACKED EnsureSandBox -> our box`);
+        return;
+      }
       // CAPTURE the chat inference request so its schema can be decoded from
       // REAL bytes (Auto's StreamUnifiedChat). Written once; inspect then build.
       if (/StreamUnifiedChat/.test(full)) {

package/lib/proxy.js

@@ -715,9 +715,17 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     }
   });
 
+  // BIND HOST. Default 127.0.0.1 — the keyless localhost path must never be
+  // world-reachable on an ordinary machine. A RunPod box is the exception: its
+  // HTTP proxy reaches the container over the pod network, so a localhost bind
+  // shows "Initializing…" forever (MEASURED: podagent's 0.0.0.0 ports went
+  // Ready, the 127.0.0.1 proxy never did). The box sets OPENZOO_BIND=0.0.0.0
+  // AND a tunnel token, so the RunPod-fronted port stays gated exactly like the
+  // public tunnel path.
+  const bindHost = process.env.OPENZOO_BIND || '127.0.0.1';
   await new Promise((resolve, reject) => {
     server.on('error', reject);
-    server.listen(config.port, '127.0.0.1', resolve);
+    server.listen(config.port, bindHost, resolve);
   });
 
   if (!silent) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.39.1",
+  "version": "0.39.3",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",