openzoo 0.39.2 → 0.39.4

package/lib/cursorbackend.js

@@ -469,6 +469,17 @@ export function startCursorBackend({ port = 8443, models, log = () => {} } = {})
         return;
       }
       log(`cursor-backend: #${conns} ${req.method} ${full}  ct=${ct}  body=${body.length}b`);
+      // HIJACK EnsureSandBox FIRST — before passthrough, or passthrough eats it.
+      // MEASURED: with OPENZOO_PASSTHRU=1 set, EnsureSandBox went `-> REAL
+      // anthropic (200, 707b)` every time and the app got a real cursorvm pod,
+      // never our box. This method (and ONLY this one) must be answered locally
+      // with OUR box so Grok Bot's UI wires to our sandbox; everything else
+      // still passes through so the app loads normally.
+      if (/GrokBotService\/EnsureSandBox/.test(full) && process.env.OZ_HIJACK_POD) {
+        respond(req, res, method, models);   // encodeForMethod('EnsureSandBox') reads OZ_HIJACK_POD
+        log(`cursor-backend:      -> HIJACKED EnsureSandBox -> our box`);
+        return;
+      }
       // CAPTURE the chat inference request so its schema can be decoded from
       // REAL bytes (Auto's StreamUnifiedChat). Written once; inspect then build.
       if (/StreamUnifiedChat/.test(full)) {

package/lib/podagent.mjs

@@ -1,14 +1,23 @@
-// Pod capture agent — runs INSIDE our box, on the ports Grok Bot expects a
-// Cursor sandbox to answer (1337 agent, 6080 vnc, 1340, 6081).
+// Pod agent — runs INSIDE our box, on the ports Grok Bot expects a Cursor
+// sandbox to answer (1337 agent, 6080 vnc, 1340 local-exec, 6081).
 //
-// THIS IS THE PROBE THAT ANSWERS THE WALL. Once EnsureSandBox is rewritten to
-// point Grok Bot at our box, the app speaks Cursor's in-pod agent protocol to
-// port 1337 and expects a VNC/websockify desktop on 6080. We do not know that
-// protocol. This server logs EVERY request — method, path, headers, body
-// (hex + utf8) — to /var/log/openzoo/agent.jsonl and stdout, and answers a
-// benign 200/101 so the app keeps talking and reveals more. Read the log and
-// you have the spec; until then, "serve our VMs into their UI" is a capture,
-// not a working hijack, and this file is honest about which.
+// THE PROTOCOL, DECODED FROM A LIVE CAPTURE (2026-08-16). Grok Bot's sandbox
+// speaks plain HTTP JSON, not a proprietary binary:
+//   GET  /local-exec/requests   <- the local-exec-daemon opens an SSE stream to
+//                                  RECEIVE exec requests from the pod.
+//   POST /local-exec/responses  <- the daemon SENDS frames back:
+//        {"frames":[{"kind":"hello","localRoot":"/Users/…","variant":"sand",…}]}
+//        {"frames":[{"kind":"ping","supervised":true}]}
+//   auth: Bearer <network_token> / x-anyrun-network-token: nto-…
+//
+// So the box is the ORCHESTRATOR: it holds the SSE open and pushes exec frames
+// down it; the daemon runs them and posts results to /local-exec/responses.
+// This file (a) answers the handshake so the daemon stays connected, (b) can
+// PUSH a probe command down the SSE to capture what an exec frame + its output
+// frame look like (OZ_PROBE_CMD), and (c) logs every frame to agent.jsonl.
+//
+// STILL A CAPTURE until we've seen one real exec/output frame — then the
+// openzoo agent brain can drive this for real. Honest about which.
 
 import http from 'node:http';
 import { appendFileSync } from 'node:fs';
@@ -16,53 +25,83 @@ import { appendFileSync } from 'node:fs';
 const PORTS = (process.env.OZ_AGENT_PORTS || '1337,6080,1340,6081')
   .split(',').map((s) => Number(s.trim())).filter(Boolean);
 const LOG = process.env.OZ_AGENT_LOG || '/var/log/openzoo/agent.jsonl';
+// A shell command to push down the SSE the first time a daemon connects, to
+// capture the exec-request AND its result frame. Default probes harmlessly.
+const PROBE = process.env.OZ_PROBE_CMD || 'echo openzoo-probe && uname -a';
 
 function record(entry) {
-  const line = JSON.stringify(entry);
-  try { appendFileSync(LOG, line + '\n'); } catch { /* best effort */ }
-  console.log(`[agent:${entry.port}] ${entry.method} ${entry.path} ${entry.bodyBytes}b` +
-    (entry.upgrade ? ` (UPGRADE ${entry.upgrade})` : ''));
+  try { appendFileSync(LOG, JSON.stringify(entry) + '\n'); } catch { /* best effort */ }
+  const tag = entry.frames ? ` frames=${entry.frames}` : '';
+  console.log(`[agent:${entry.port}] ${entry.method} ${entry.path} ${entry.bodyBytes}b${tag}`);
+}
+
+// SSE clients currently holding /local-exec/requests open, so we can push.
+const execStreams = new Set();
+let probedOnce = false;
+
+/** Push one exec frame down every open request stream. Frame shape is our best
+ *  guess from the response frames; the daemon's reply (accept or error) TEACHES
+ *  us the real schema, which is the whole point. */
+function pushExec(cmd) {
+  const id = `oz-${Date.now().toString(36)}`;
+  // Try the most likely shapes the daemon will accept; it will 400/echo the
+  // one it understands, which the capture records.
+  const frame = { frames: [{ kind: 'exec', id, command: cmd, cwd: '/tmp', supervised: true }] };
+  const payload = `data: ${JSON.stringify(frame)}\n\n`;
+  for (const res of execStreams) { try { res.write(payload); } catch { /* dead stream */ } }
+  record({ t: new Date().toISOString(), port: 1340, method: 'SSE-PUSH', path: '/local-exec/requests',
+    bodyBytes: payload.length, pushed: frame });
 }
 
 for (const port of PORTS) {
   const server = http.createServer((req, res) => {
+    // SSE receive-channel: hold it open, let us push exec frames.
+    if (req.method === 'GET' && req.url && req.url.startsWith('/local-exec/requests')) {
+      record({ t: new Date().toISOString(), port, method: 'GET', path: req.url,
+        headers: req.headers, bodyBytes: 0, note: 'SSE stream opened' });
+      res.writeHead(200, {
+        'content-type': 'text/event-stream',
+        'cache-control': 'no-cache',
+        connection: 'keep-alive',
+      });
+      res.write(':ok\n\n');
+      execStreams.add(res);
+      req.on('close', () => execStreams.delete(res));
+      // once a stream is open, push the probe command to capture the exec loop
+      if (!probedOnce) { probedOnce = true; setTimeout(() => pushExec(PROBE), 1500); }
+      return;
+    }
+
     const chunks = [];
     req.on('data', (d) => chunks.push(d));
     req.on('end', () => {
       const body = Buffer.concat(chunks);
+      let frames;
+      try { frames = JSON.parse(body.toString('utf8')).frames?.map((f) => f.kind).join(','); } catch { /* not json */ }
       record({
         t: new Date().toISOString(), port,
-        method: req.method, path: req.url,
-        headers: req.headers,
-        bodyBytes: body.length,
-        bodyHex: body.slice(0, 512).toString('hex'),
-        bodyUtf8: body.slice(0, 512).toString('utf8').replace(/[^\x20-\x7e]/g, '.'),
+        method: req.method, path: req.url, headers: req.headers,
+        bodyBytes: body.length, frames,
+        bodyHex: body.slice(0, 256).toString('hex'),
+        bodyUtf8: body.slice(0, 1024).toString('utf8').replace(/[^\x20-\x7e]/g, '.'),
       });
-      // Benign answers so the client does not give up immediately.
       if (req.url && req.url.includes('/vnc')) {
         res.writeHead(200, { 'content-type': 'text/html' });
         res.end('<!doctype html><title>openzoo box</title><body>capture</body>');
       } else {
+        // /local-exec/responses and everything else: accept it so the daemon
+        // keeps its session and keeps sending frames.
         res.writeHead(200, { 'content-type': 'application/json' });
-        res.end('{}');
+        res.end('{"ok":true}');
       }
     });
   });
-  // Capture websocket upgrades too — VNC/websockify is a WS, and the agent
-  // channel may be one; log the handshake even though we don't speak it yet.
   server.on('upgrade', (req, socket) => {
-    record({
-      t: new Date().toISOString(), port,
-      method: req.method, path: req.url, upgrade: req.headers.upgrade,
-      headers: req.headers, bodyBytes: 0,
-    });
-    // 101 with no real protocol; the client will close, which is fine — we
-    // only needed the handshake headers.
+    record({ t: new Date().toISOString(), port, method: 'UPGRADE', path: req.url,
+      upgrade: req.headers.upgrade, headers: req.headers, bodyBytes: 0 });
     socket.write('HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\n\r\n');
-    socket.on('data', (d) => record({
-      t: new Date().toISOString(), port, method: 'WS-DATA', path: req.url,
-      bodyBytes: d.length, bodyHex: d.slice(0, 256).toString('hex'),
-    }));
+    socket.on('data', (d) => record({ t: new Date().toISOString(), port, method: 'WS-DATA', path: req.url,
+      bodyBytes: d.length, bodyHex: d.slice(0, 256).toString('hex') }));
   });
   server.listen(port, '0.0.0.0', () => console.log(`[agent] capturing on :${port}`));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.39.2",
+  "version": "0.39.4",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",