openzoo 0.40.0 → 0.41.0

package/lib/podagent.mjs

@@ -1,77 +1,136 @@
-// Pod agent — runs INSIDE our box, on the ports Grok Bot expects a Cursor
-// sandbox to answer (1337 agent, 6080 vnc, 1340 local-exec, 6081).
+// Pod agent — runs INSIDE our box. It IS the Grok Bot sandbox brain, on the
+// ports the app expects (1337 agent, 6080 vnc, 1340 local-exec), but the brain
+// is openzoo (x402-paid) and the sandbox is ours.
 //
-// THE PROTOCOL, DECODED FROM A LIVE CAPTURE (2026-08-16). Grok Bot's sandbox
-// speaks plain HTTP JSON, not a proprietary binary:
-//   GET  /local-exec/requests   <- the local-exec-daemon opens an SSE stream to
-//                                  RECEIVE exec requests from the pod.
-//   POST /local-exec/responses  <- the daemon SENDS frames back:
-//        {"frames":[{"kind":"hello","localRoot":"/Users/…","variant":"sand",…}]}
-//        {"frames":[{"kind":"ping","supervised":true}]}
-//   auth: Bearer <network_token> / x-anyrun-network-token: nto-…
+// PROTOCOL, REVERSE-ENGINEERED FROM local-exec-daemon/main.cjs (2026-08-16):
+//   GET  /local-exec/requests   the daemon opens an SSE stream to RECEIVE frames
+//   POST /local-exec/responses   the daemon SENDS frames: hello, ping, output,
+//                                stdout, result, exit
+//   frames the daemon RECEIVES (we push down the SSE):
+//     {kind:"welcome", providerId}
+//     {kind:"exec", requestId, approvalId, serverMessage:{shellArgs:{command,
+//        workingDirectory, timeout}}}   (serverMessage = agent.v1.ExecServerMessage,
+//        shellArgs = agent.v1.ShellArgs; the daemon assigns id itself)
+//     {kind:"upload"|"download"|"cancel", ...}
+//   exec is APPROVAL-GATED on the user's Mac (isLocalUseBlocked / supervised).
 //
-// So the box is the ORCHESTRATOR: it holds the SSE open and pushes exec frames
-// down it; the daemon runs them and posts results to /local-exec/responses.
-// This file (a) answers the handshake so the daemon stays connected, (b) can
-// PUSH a probe command down the SSE to capture what an exec frame + its output
-// frame look like (OZ_PROBE_CMD), and (c) logs every frame to agent.jsonl.
-//
-// STILL A CAPTURE until we've seen one real exec/output frame — then the
-// openzoo agent brain can drive this for real. Honest about which.
+// So: the daemon runs commands on the USER's machine (variant "sand",
+// localRoot=/Users/…), and WE — from the box — decide what to run, paying for
+// the reasoning via openzoo. That is the whole product: a Grok-Bot-shaped agent
+// whose brain is the zoo.
 
 import http from 'node:http';
 import { appendFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
 
 const PORTS = (process.env.OZ_AGENT_PORTS || '1337,6080,1340,6081')
   .split(',').map((s) => Number(s.trim())).filter(Boolean);
 const LOG = process.env.OZ_AGENT_LOG || '/var/log/openzoo/agent.jsonl';
-// A shell command to push down the SSE the first time a daemon connects, to
-// capture the exec-request AND its result frame. Default probes harmlessly.
-const PROBE = process.env.OZ_PROBE_CMD || 'echo openzoo-probe && uname -a';
+const PROXY = process.env.OZ_PROXY || 'http://127.0.0.1:8402/v1';
+const MODEL = process.env.OZ_BRAIN_MODEL || 'x-ai/grok-4.6';
+const MAX_STEPS = Number(process.env.OZ_MAX_STEPS || 10);
 
 function record(entry) {
   try { appendFileSync(LOG, JSON.stringify(entry) + '\n'); } catch { /* best effort */ }
-  const tag = entry.frames ? ` frames=${entry.frames}` : '';
-  console.log(`[agent:${entry.port}] ${entry.method} ${entry.path} ${entry.bodyBytes}b${tag}`);
+  console.log(`[agent:${entry.port ?? '-'}] ${entry.method || entry.ev} ${entry.path || ''} ${entry.bodyBytes ?? ''}${entry.frames ? ' frames=' + entry.frames : ''}`);
+}
+
+// ------------------------------------------------------------------ frames --
+
+/** Send frames to the daemon down its SSE. The daemon reads the stream with a
+ *  TextDecoder and parses per-line JSON, so one frame per `data:` line. We wrap
+ *  as {frames:[…]} to mirror the response side; a bare frame is the fallback. */
+function sseSend(res, frame) {
+  const line = `data: ${JSON.stringify({ frames: [frame] })}\n\n`;
+  try { res.write(line); return true; } catch { return false; }
+}
+
+function execFrame(command, cwd = '/tmp') {
+  return {
+    kind: 'exec',
+    requestId: randomUUID(),
+    approvalId: randomUUID(),
+    // agent.v1.ExecServerMessage as protobuf-es JSON (camelCase). The daemon
+    // assigns `id`; we only supply the shell variant.
+    serverMessage: { shellArgs: { command, workingDirectory: cwd, timeout: 120 } },
+  };
+}
+
+// ------------------------------------------------------------------- brain --
+
+/** One openzoo chat turn. Paid per call by the box's own wallet via the local
+ *  proxy — no key, no account. */
+async function brain(messages) {
+  const r = await fetch(`${PROXY}/chat/completions`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', authorization: 'Bearer sk-openzoo' },
+    body: JSON.stringify({ model: MODEL, max_tokens: 900, messages }),
+  });
+  const j = await r.json().catch(() => ({}));
+  return j?.choices?.[0]?.message?.content ?? '';
+}
+
+const SYSTEM = `You drive a Linux/macOS shell to accomplish a task. Reply with EXACTLY one line:
+either  RUN: <a single shell command>
+or      DONE: <one-line summary>  when the task is complete.
+No prose, no fences. You are given each command's output before your next line.`;
+
+/** The agent loop for one task, executed through the connected daemon. Each
+ *  RUN is pushed as an exec frame; the daemon's result frames (captured in
+ *  `pendingResults`) feed the next turn. */
+async function runTask(task, stream, ctx) {
+  const messages = [{ role: 'system', content: SYSTEM }, { role: 'user', content: task }];
+  for (let step = 0; step < MAX_STEPS; step++) {
+    const line = (await brain(messages)).trim();
+    record({ ev: 'brain', step, line });
+    const run = /^RUN:\s*([\s\S]+)/.exec(line);
+    if (!run) { record({ ev: 'task-done', step, line }); return; }
+    const cmd = run[1].trim();
+    const frame = execFrame(cmd);
+    ctx.awaiting = frame.requestId;
+    ctx.output = '';
+    sseSend(stream, frame);
+    record({ ev: 'exec-push', step, requestId: frame.requestId, cmd });
+    // wait for the daemon's result frames for this requestId (or timeout)
+    const out = await waitResult(ctx, 60_000);
+    messages.push({ role: 'assistant', content: line });
+    messages.push({ role: 'user', content: `output:\n${out || '(none)'}` });
+  }
 }
 
-// SSE clients currently holding /local-exec/requests open, so we can push.
-const execStreams = new Set();
-let probedOnce = false;
-
-/** Push one exec frame down every open request stream. Frame shape is our best
- *  guess from the response frames; the daemon's reply (accept or error) TEACHES
- *  us the real schema, which is the whole point. */
-function pushExec(cmd) {
-  const id = `oz-${Date.now().toString(36)}`;
-  // THE COMMAND FRAME IS kind:"shell", NOT "exec". Decoded from the app bundle:
-  // the daemon's receive-union has kind "shell" (run), "sequence", "abort"; the
-  // proto is {command: scalar, args, cwd, env}. Our first probe used "exec"
-  // (which appears once in the bundle) and the daemon silently ignored it,
-  // sending only pings. "shell" is what it actually runs.
-  const frame = { frames: [{ kind: 'shell', id, command: cmd, cwd: '/tmp', supervised: true }] };
-  const payload = `data: ${JSON.stringify(frame)}\n\n`;
-  for (const res of execStreams) { try { res.write(payload); } catch { /* dead stream */ } }
-  record({ t: new Date().toISOString(), port: 1340, method: 'SSE-PUSH', path: '/local-exec/requests',
-    bodyBytes: payload.length, pushed: frame });
+function waitResult(ctx, timeoutMs) {
+  return new Promise((resolve) => {
+    const started = Date.now();
+    const iv = setInterval(() => {
+      if (ctx.done || Date.now() - started > timeoutMs) {
+        clearInterval(iv); ctx.done = false; resolve(ctx.output || '');
+      }
+    }, 250);
+  });
 }
 
+// ----------------------------------------------------------------- servers --
+
+// per-connection context so a result frame can be matched to its exec
+const ctxByToken = new Map();
+
 for (const port of PORTS) {
   const server = http.createServer((req, res) => {
-    // SSE receive-channel: hold it open, let us push exec frames.
+    // The daemon's receive-channel: hold the SSE open; when it connects, if a
+    // task is queued (OZ_TASK) run the agent loop against it.
     if (req.method === 'GET' && req.url && req.url.startsWith('/local-exec/requests')) {
-      record({ t: new Date().toISOString(), port, method: 'GET', path: req.url,
-        headers: req.headers, bodyBytes: 0, note: 'SSE stream opened' });
-      res.writeHead(200, {
-        'content-type': 'text/event-stream',
-        'cache-control': 'no-cache',
-        connection: 'keep-alive',
-      });
+      const token = (req.headers['x-anyrun-network-token'] || 'default');
+      const ctx = { awaiting: null, output: '', done: false };
+      ctxByToken.set(token, ctx);
+      record({ port, method: 'GET', path: req.url, note: 'SSE opened', bodyBytes: 0 });
+      res.writeHead(200, { 'content-type': 'text/event-stream', 'cache-control': 'no-cache', connection: 'keep-alive' });
       res.write(':ok\n\n');
-      execStreams.add(res);
-      req.on('close', () => execStreams.delete(res));
-      // once a stream is open, push the probe command to capture the exec loop
-      if (!probedOnce) { probedOnce = true; setTimeout(() => pushExec(PROBE), 1500); }
+      // announce ourselves, then drive the task
+      sseSend(res, { kind: 'welcome', providerId: 'openzoo' });
+      req.on('close', () => ctxByToken.delete(token));
+      if (process.env.OZ_TASK) {
+        setTimeout(() => runTask(process.env.OZ_TASK, res, ctx).catch((e) => record({ ev: 'task-error', err: String(e) })), 1200);
+      }
       return;
     }
 
@@ -79,32 +138,35 @@ for (const port of PORTS) {
     req.on('data', (d) => chunks.push(d));
     req.on('end', () => {
       const body = Buffer.concat(chunks);
-      let frames;
-      try { frames = JSON.parse(body.toString('utf8')).frames?.map((f) => f.kind).join(','); } catch { /* not json */ }
-      record({
-        t: new Date().toISOString(), port,
-        method: req.method, path: req.url, headers: req.headers,
-        bodyBytes: body.length, frames,
-        bodyHex: body.slice(0, 256).toString('hex'),
-        bodyUtf8: body.slice(0, 1024).toString('utf8').replace(/[^\x20-\x7e]/g, '.'),
-      });
+      let parsed, kinds;
+      try { parsed = JSON.parse(body.toString('utf8')); kinds = parsed.frames?.map((f) => f.kind).join(','); } catch { /* not json */ }
+      record({ port, method: req.method, path: req.url, bodyBytes: body.length, frames: kinds,
+        bodyUtf8: body.slice(0, 1024).toString('utf8').replace(/[^\x20-\x7e]/g, '.') });
+
+      // the daemon posts result frames here — accumulate output for the loop
+      if (parsed?.frames && req.url?.includes('/local-exec/responses')) {
+        const token = (req.headers['x-anyrun-network-token'] || 'default');
+        const ctx = ctxByToken.get(token);
+        for (const f of parsed.frames) {
+          if (ctx && (f.kind === 'output' || f.kind === 'stdout')) ctx.output += (f.data || f.text || f.chunk || '');
+          if (ctx && (f.kind === 'result' || f.kind === 'exit')) ctx.done = true;
+        }
+      }
+
       if (req.url && req.url.includes('/vnc')) {
         res.writeHead(200, { 'content-type': 'text/html' });
-        res.end('<!doctype html><title>openzoo box</title><body>capture</body>');
+        res.end('<!doctype html><title>openzoo box</title>');
       } else {
-        // /local-exec/responses and everything else: accept it so the daemon
-        // keeps its session and keeps sending frames.
         res.writeHead(200, { 'content-type': 'application/json' });
         res.end('{"ok":true}');
       }
     });
   });
   server.on('upgrade', (req, socket) => {
-    record({ t: new Date().toISOString(), port, method: 'UPGRADE', path: req.url,
-      upgrade: req.headers.upgrade, headers: req.headers, bodyBytes: 0 });
+    record({ port, method: 'UPGRADE', path: req.url, bodyBytes: 0 });
     socket.write('HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\n\r\n');
-    socket.on('data', (d) => record({ t: new Date().toISOString(), port, method: 'WS-DATA', path: req.url,
-      bodyBytes: d.length, bodyHex: d.slice(0, 256).toString('hex') }));
   });
-  server.listen(port, '0.0.0.0', () => console.log(`[agent] capturing on :${port}`));
+  server.listen(port, '0.0.0.0', () => console.log(`[agent] on :${port}`));
 }
+
+console.log(`[agent] brain=${MODEL} via ${PROXY}  task=${process.env.OZ_TASK ? JSON.stringify(process.env.OZ_TASK).slice(0, 60) : '(none — waiting)'}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.40.0",
+  "version": "0.41.0",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",