openzoo 0.48.23 → 0.48.25

package/bin/openzoo.js

@@ -53,6 +53,35 @@ if (Number(process.versions.node.split('.')[0]) < MIN_NODE && !process.env.OPENZ
   process.exit(1);
 }
 
+// A DEAD IPv6 ROUTE MUST NOT EAT THE CONNECT BUDGET.
+//
+// x402-tokens.fly.dev publishes both AAAA (2a09:8280:1::16a:5795) and A
+// (66.241.124.74). Node resolves `verbatim` by default, so on a network whose
+// IPv6 is advertised but blackholed it opens the v6 socket first and waits —
+// and the aggregate error names BOTH addresses, which reads as "the whole host
+// is down" when v4 was never given a fair chance:
+//
+//   Connect Timeout Error (attempted addresses: 2a09:8280:1::16a:5795:443,
+//                          66.241.124.74:443, timeout: 10000ms)
+//
+// Reported from the wild on macOS: the proxy binds, every upstream call times
+// out, the health poll never passes, and it exits after ~1 minute looking like
+// a startup bug. Same shape as the cloudflared IPv6+QUIC note in the wiki.
+//
+// Happy Eyeballs (RFC 8305) races the families instead of guessing, with a
+// short per-attempt timeout so a dead route costs 500ms rather than ten
+// seconds. Both calls are version-gated and best-effort — an older Node just
+// keeps its default behaviour, and the ipv4first fallback covers it.
+try {
+  const net = await import('node:net');
+  net.setDefaultAutoSelectFamily?.(true);
+  net.setDefaultAutoSelectFamilyAttemptTimeout?.(500);
+} catch { /* older node: fall through to the DNS order below */ }
+try {
+  const dns = await import('node:dns');
+  if (!process.env.OPENZOO_DNS_VERBATIM) dns.setDefaultResultOrder?.('ipv4first');
+} catch { /* nothing to do */ }
+
 const cmd = process.argv[2] || 'proxy';
 
 const HELP = `openzoo — local x402-paying proxy + MCP server for openzoo.fun

package/lib/info.js

@@ -24,8 +24,53 @@ function fmtUi(raw, decimals) {
  * price is known ($1 stables); everything else gets an honest `?`.
  * A chain whose RPC does not answer prints as unreachable — never as zero.
  */
+/**
+ * USD per whole token, by SYMBOL, straight from the 402 quote.
+ *
+ * The quote already carries `extra.tokenUsd` for every asset it settles in —
+ * the very "priced at the 402" this file kept promising in a footnote while
+ * printing `$?`. So a wallet holding 845,486 TOKEN summed to "≈ $0.11 known".
+ * Symbols come back wrapped (wTOKENx, wLEOSx, wUSDGx); strip the wrapper so a
+ * row for the plain token the user actually holds finds its price.
+ */
+async function quotedPrices() {
+  const out = {};
+  try {
+    // Imported here, not at module scope, matching affordableUsd below — this
+    // file is loaded by `openzoo address`, which must work with no network.
+    const { withNamespace } = await import('./namespace.js');
+    const r = await fetch(`${config.apiBase}/v1/credits/topup`, {
+      method: 'POST',
+      headers: withNamespace({ 'content-type': 'application/json' }),
+      body: JSON.stringify({ usd: 1 }),
+    });
+    if (r.status !== 402) return out;
+    const ch = await r.json().catch(() => ({}));
+    for (const row of ch.accepts || []) {
+      const usd = Number(row?.extra?.tokenUsd);
+      const sym = String(row?.extra?.symbol || '');
+      if (!sym || !Number.isFinite(usd)) continue;
+      // wTOKENx -> TOKEN, wUSDGx -> USDG, yUSDCx -> USDC
+      const plain = sym.replace(/^[wy]/, '').replace(/x$/, '').toUpperCase();
+      out[sym.toUpperCase()] = usd;
+      if (!(plain in out)) out[plain] = usd;
+    }
+  } catch { /* offline: fall back to printing what we know */ }
+  return out;
+}
+
 export async function printBalance() {
   const { keypair, evmPrivateKey } = loadOrCreateWallet();
+  const px = await quotedPrices();
+  const priceOf = (sym) => px[String(sym).toUpperCase()];
+  const show = (sym, ui) => {
+    const p = priceOf(sym);
+    if (p == null) return ' ($?)';
+    const v = ui * p;
+    // Sub-cent holdings read as "$0.00", which is indistinguishable from
+    // worthless; show enough digits that a real balance is visible.
+    return ` ($${v >= 0.01 || v === 0 ? v.toFixed(2) : v.toFixed(6)})`;
+  };
   const evmAddress = privateKeyToAccount(evmPrivateKey).address;
   const connection = new Connection(config.rpcUrl, 'confirmed');
 
@@ -34,14 +79,17 @@ export async function printBalance() {
     Promise.all(FUNDING_ASSETS.map((a) => tokenBalance(connection, keypair.publicKey, a.mint))),
     connection.getBalance(keypair.publicKey),
   ]);
-  const usdcUi = balances[0].ui ?? 0;
-  let knownUsd = usdcUi;
+  // Seeded at zero: every asset is priced from the quote below, so seeding
+  // with USDC would count it twice.
+  let knownUsd = 0;
   let anyFunds = balances.some((b) => b.raw);
 
   console.log(`Solana — ${keypair.publicKey.toBase58()}`);
   FUNDING_ASSETS.forEach((a, i) => {
-    const usd = a.symbol === 'USDC' ? ` ($${(balances[i].ui ?? 0).toFixed(2)})` : ' ($?, valued at the 402)';
-    console.log(`  ${a.symbol.padEnd(11)}: ${balances[i].ui ?? 0}${usd}`);
+    const ui = balances[i].ui ?? 0;
+    const p = priceOf(a.symbol);
+    if (p != null) knownUsd += ui * p;
+    console.log(`  ${a.symbol.padEnd(11)}: ${ui}${show(a.symbol, ui)}`);
   });
   console.log(`  ${'SOL'.padEnd(11)}: ${lamports / 1e9} (gas — optional, payments are sponsored)`);
 
@@ -57,9 +105,9 @@ export async function printBalance() {
       assets.forEach((a, i) => {
         const ui = fmtUi(raws[i], a.decimals);
         if (raws[i] > 0n) anyFunds = true;
-        if (a.usd != null) knownUsd += ui * a.usd;
-        const usd = a.usd != null ? ` ($${(ui * a.usd).toFixed(2)})` : ' ($?)';
-        console.log(`  ${a.symbol.padEnd(11)}: ${ui}${usd}`);
+        const p = priceOf(a.symbol) ?? a.usd;
+        if (p != null) knownUsd += ui * p;
+        console.log(`  ${a.symbol.padEnd(11)}: ${ui}${p != null ? show(a.symbol, ui) : ' ($?)'}`);
       });
       console.log(`  ${'ETH'.padEnd(11)}: ${fmtUi(native, 18)} (gas — optional, payments are sponsored)`);
     } catch {
@@ -67,7 +115,7 @@ export async function printBalance() {
     }
   }
 
-  console.log(`value : ≈ $${knownUsd.toFixed(2)} known (stable legs; TOKEN and the RH memecoins are priced at the 402, shown as $?)`);
+  console.log(`value : ≈ $${knownUsd.toFixed(2)}${Object.keys(px).length ? ' (every asset priced at the 402)' : ' known (402 unreachable — unpriced assets shown as $?)'}`);
   if (!anyFunds) {
     console.log(`fund  : ${fundingLine(keypair.publicKey.toBase58())}`);
     console.log(`        or USDC on Base to ${evmAddress}`);
@@ -110,10 +158,20 @@ export async function affordableUsd() {
     const perUsd = BigInt(row.maxAmountRequired || '0');
     if (perUsd <= 0n) continue;
     try {
-      const bal = await client.balanceForAccept?.(row);
-      const raw = typeof bal === 'bigint' ? bal : BigInt(bal?.raw ?? 0);
-      const usd = Number(raw * 1000n / perUsd) / 1000;
-      if (usd > best) best = usd;
+      // SPENDABLE, not merely wrapped. Every quote names the WRAPPER, and the
+      // plain token is converted at payment time (topUpQuotedAsset /
+      // acquireWrappedIfNeeded) — so counting only pre-wrapped balance told a
+      // user holding 14,847 TOKEN that their wallet "covers only $1.0230" and
+      // sent them off to fund an account that was already funded.
+      let usd;
+      if (client.spendableUsdForAccept) {
+        usd = await client.spendableUsdForAccept(row);
+      } else {
+        const bal = await client.balanceForAccept?.(row);
+        const raw = typeof bal === 'bigint' ? bal : BigInt(bal?.raw ?? 0);
+        usd = Number(raw * 1000n / perUsd) / 1000;
+      }
+      if (Number.isFinite(usd) && usd > best) best = usd;
     } catch { /* a rail we cannot read is simply not a candidate */ }
   }
   return best;

package/lib/launch.js

@@ -91,7 +91,26 @@ export async function launchClaude(argv) {
       try { up = (await fetch(`${base}/models`, { signal: AbortSignal.timeout(2000) })).ok; } catch { /* keep waiting */ }
     }
     if (!up) {
-      done(`proxy did not answer on ${base}`);
+      // NAME THE REAL FAILURE. /v1/models is proxied upstream, so an unreachable
+      // gateway looks identical to a broken local proxy — and the message sent
+      // one user hunting their own machine for an hour while the actual fault
+      // was a blackholed IPv6 route to fly.dev. Probe the gateway directly and
+      // say which of the two is actually down.
+      let upstream = null;
+      try {
+        const r = await fetch(`${config.apiBase}/v1/models`, { signal: AbortSignal.timeout(8000) });
+        upstream = r.ok;
+      } catch (e) { upstream = e?.message || false; }
+      if (upstream !== true) {
+        done(`cannot reach the gateway at ${config.apiBase}`);
+        console.error(`  the local proxy started fine; ${config.apiBase} did not answer.`);
+        console.error(`  reason: ${typeof upstream === 'string' ? upstream : 'no response'}`);
+        console.error('  if that mentions two addresses (one starting 2a09:), your network');
+        console.error('  advertises IPv6 but drops it — this build already prefers IPv4;');
+        console.error('  force it explicitly with:  NODE_OPTIONS=--dns-result-order=ipv4first');
+      } else {
+        done(`proxy did not answer on ${base} (the gateway is up)`);
+      }
       console.error('  full log: ~/.openzoo/proxy.log');
       console.error('  try: OPENZOO_NO_TUNNEL=1 npx openzoo claude   (skips the cloudflared download)');
       process.exit(1);

package/lib/pay.js

@@ -150,6 +150,66 @@ export class PayClient {
     return BigInt(raw || 0);
   }
 
+  /**
+   * What this wallet can actually PAY with on this rail, in settlement-asset
+   * units — wrapped holdings PLUS the plain token it can convert on the fly.
+   *
+   * balanceForAccept answers a different question: how much of the WRAPPED
+   * asset is sitting there right now. Every quote names the wrapper (wTOKENx,
+   * the RH vault twins), so a wallet holding 845,486 plain TOKEN read as
+   * "$3.14 covered" — only the sliver already wrapped — while `openzoo balance`
+   * showed the full holding priced as `$?`. Two different wrong answers about
+   * the same wallet, and a user was told to fund an account with $177 in it.
+   *
+   * buildPaymentFor already wraps what it needs at payment time (topUpQuotedAsset
+   * on Solana, acquireWrappedIfNeeded on EVM), so the convertible balance IS
+   * spendable and the estimate was simply lying by omission. Advisory only:
+   * anything unreadable degrades to the wrapped figure rather than throwing,
+   * because this feeds a display and a top-up hint, never a settlement.
+   */
+  async spendableUsdForAccept(accept) {
+    const perUsd = BigInt(accept.maxAmountRequired || '0');
+    if (perUsd <= 0n) return 0;
+    const wrappedRaw = await this.balanceForAccept(accept).catch(() => 0n);
+    let usd = Number(wrappedRaw * 1000n / perUsd) / 1000;
+
+    // Price the PLAIN token with the quote's own tokenUsd, NOT with the pool's
+    // supply/reserves ratio. That ratio is share accounting, not a price: the
+    // live wTOKENx pool reads supply/reserves ≈ 5659, so treating it as a
+    // conversion rate valued 845,486 TOKEN at $1,004,132. The 402 already
+    // publishes what a whole token is worth, and the wrapper is a claim on the
+    // same asset — so underlying and wrapped are priced identically, which is
+    // exactly what `openzoo balance` now shows.
+    const px = Number(accept?.extra?.tokenUsd);
+    if (!Number.isFinite(px) || px <= 0) return usd;
+    const rail = railOf(accept);
+    try {
+      if (rail === 'solana') {
+        const pool = await resolvePool(this.connection, accept.asset);
+        if (!pool) return usd;
+        const under = await tokenBalance(this.connection, this.keypair.publicKey,
+          pool.underlying.toBase58());
+        usd += Number(under?.ui || 0) * px;
+        return usd;
+      }
+      // EVM wrappers are ERC-4626; asset() names the plain token behind them.
+      const { createPublicClient, http } = await import('viem');
+      const pc = createPublicClient({ transport: http(evmRpcFor(rail)) });
+      const ABI = [
+        { name: 'asset', type: 'function', stateMutability: 'view', inputs: [], outputs: [{ type: 'address' }] },
+        { name: 'decimals', type: 'function', stateMutability: 'view', inputs: [], outputs: [{ type: 'uint8' }] },
+      ];
+      const under = await pc.readContract({ address: accept.asset, abi: ABI, functionName: 'asset', args: [] });
+      const raw = await evmTokenBalance({ rpcUrl: evmRpcFor(rail), token: under, owner: this.evmAddress });
+      if (!raw || raw <= 0n) return usd;
+      const dec = Number(accept?.extra?.decimals ?? 18);
+      usd += (Number(raw) / 10 ** dec) * px;
+      return usd;
+    } catch {
+      return usd;          // not a wrapper, or a rail we cannot read
+    }
+  }
+
   async buildPaymentFor(accept, onStage) {
     const rail = railOf(accept);
     if (rail === 'solana') {

package/lib/wrap.js

@@ -180,6 +180,19 @@ export async function poolState(connection, pool) {
 export function buildWrapInstructions({ pool, owner, depositRaw, rentPayer = owner }) {
   const userWrapped = getAssociatedTokenAddressSync(pool.wrapped, owner, false, pool.wrappedProgram);
   const userUnderlying = getAssociatedTokenAddressSync(pool.underlying, owner, false, pool.underlyingProgram);
+  // NINE ACCOUNTS, AND THE PROGRAM PULLS THE DEPOSIT ITSELF.
+  //
+  // This used to emit three instructions — ensure ATA, Wrap, then a separate
+  // TransferChecked moving the underlying into escrow — because the program
+  // only minted shares and trusted that the caller's own transfer would follow.
+  // Nothing enforced it. On 2026-08-18 a caller sent the Wrap instruction ALONE
+  // and minted shares backed by nothing, then unwrapped them: 829,559 TOKEN out
+  // of the vault, NAV 1 -> 0.000177.
+  //
+  // The deployed program (slot 440219442) now CPIs the transfer itself, so the
+  // Wrap instruction carries the depositor's source account and signature and
+  // the separate transfer is GONE. A 5-account call is rejected outright with
+  // NotEnoughAccounts (0x6a) — verified against mainnet by simulation.
   const wrapIx = new TransactionInstruction({
     programId: pool.programId || WRAP_PROGRAM_ID,
     keys: [
@@ -188,16 +201,17 @@ export function buildWrapInstructions({ pool, owner, depositRaw, rentPayer = own
       { pubkey: userWrapped, isSigner: false, isWritable: true },
       { pubkey: pool.authority, isSigner: false, isWritable: false },
       { pubkey: pool.wrappedProgram, isSigner: false, isWritable: false },
+      // the deposit the program will pull, and who authorises it
+      { pubkey: userUnderlying, isSigner: false, isWritable: true },
+      { pubkey: owner, isSigner: true, isWritable: false },
+      { pubkey: pool.underlying, isSigner: false, isWritable: false },
+      { pubkey: pool.underlyingProgram, isSigner: false, isWritable: false },
     ],
     data: Buffer.concat([Buffer.from([1]), u64le(depositRaw), Buffer.from([pool.bump])]),
   });
   return [
     createAssociatedTokenAccountIdempotentInstruction(rentPayer, userWrapped, owner, pool.wrapped, pool.wrappedProgram),
     wrapIx,
-    createTransferCheckedInstruction(
-      userUnderlying, pool.underlying, pool.escrow, owner,
-      depositRaw, pool.underlyingDecimals, [], pool.underlyingProgram,
-    ),
   ];
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.48.23",
+  "version": "0.48.25",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",

package/lib/proxy.js.bak

@@ -1,980 +0,0 @@
-import { readFileSync, appendFileSync, mkdirSync } from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import http from 'node:http';
-import crypto from 'node:crypto';
-import { Readable } from 'node:stream';
-import {
-  config, FUNDING_ASSETS, EVM_FUNDING_ASSETS, evmRpcFor, fundingLine, liveRails, railFundingHint, railFundingAddresses, unfundableRails, RAIL_FUNDING,
-} from './config.js';
-import { PayClient, QuoteTooHighError, UnderfundedError } from './pay.js';
-import { tokenBalance } from './x402.js';
-import { evmTokenBalance } from './evm.js';
-import { bindCorpus, contextCacheDisabled, BIND_MIN_CHARS } from './hrr.js';
-import { maybeRewriteModel, rewritablePath, augmentModelList, ALIAS_IDS } from './models.js';
-import { forgetContext } from './contexts.js';
-import { injectBrief } from './brief.js';
-import { withNamespace } from './namespace.js';
-import { anthropicToOpenAI, openAIToAnthropic, writeAnthropicSse } from './anthropic.js';
-
-const HOP_BY_HOP = new Set([
-  'host', 'connection', 'keep-alive', 'transfer-encoding', 'upgrade',
-  'proxy-authorization', 'proxy-connection', 'te', 'trailer', 'content-length',
-  // `Expect: 100-continue` is sent by curl and most HTTP libraries once a body
-  // passes ~1KB. undici REFUSES it outright ("expect header not supported"),
-  // so forwarding it made every LARGE-body request fail while small ones
-  // worked — i.e. it broke exactly the corpus calls this proxy exists for.
-  'expect',
-  // The harness's api key (sk-openzoo or anything) is accepted and dropped:
-  // the zoo takes payment, not keys.
-  'authorization',
-]);
-
-/**
- * Be forgiving about the path, the same way we are about model ids.
- * Harnesses are configured with a base_url that ALREADY ends in /v1, so an
- * agent building "{base}/v1/hrr/bind" sends /v1/v1/hrr/bind and gets a 404 it
- * cannot diagnose (observed: agent concluded the bind endpoint "is not
- * functioning as advertised" and fell back to stuffing the corpus inline).
- * Collapse repeated /v1 and add a missing one.
- */
-function normalizePath(url) {
-  const [path, query] = (url || '/').split(/(?=\?)/);
-  let p = path.replace(/^(?:\/v1)+(?=\/v1\/)/, '');       // /v1/v1/x -> /v1/x
-  if (!/^\/v1(\/|$)/.test(p) && /^\/(hrr|chat|models|completions|embeddings|usage)/.test(p)) p = `/v1${p}`;
-  return p === path ? url : `${p}${query || ''}`;
-}
-
-function upstreamHeaders(req) {
-  const out = {};
-  for (const [k, v] of Object.entries(req.headers)) {
-    if (!HOP_BY_HOP.has(k.toLowerCase())) out[k] = v;
-  }
-  // EVERY forwarded request carries this wallet's context namespace, not just
-  // the ones PayClient builds itself. Without it a bind sent THROUGH the proxy
-  // (an agent posting to /v1/hrr/bind) landed in the shared tenant while the
-  // chat that referenced it looked in the wallet's tenant — the context was
-  // unreachable and every spill bind came back 400, silently forwarding the
-  // whole body at full price.
-  return withNamespace(out);
-}
-
-async function readBody(req) {
-  const chunks = [];
-  for await (const c of req) chunks.push(c);
-  return Buffer.concat(chunks);
-}
-
-/** Pipe an upstream fetch Response to the client, unbuffered (SSE-safe). */
-function relay(res, upstream) {
-  const headers = {};
-  upstream.headers.forEach((v, k) => {
-    if (!['transfer-encoding', 'connection', 'content-encoding', 'content-length'].includes(k)) headers[k] = v;
-  });
-  res.writeHead(upstream.status, headers);
-  if (!upstream.body) { res.end(); return Promise.resolve(); }
-  return new Promise((resolve) => {
-    const body = Readable.fromWeb(upstream.body);
-    body.on('error', () => res.destroy());
-    res.on('close', () => body.destroy());
-    body.on('end', resolve);
-    body.pipe(res);
-  });
-}
-
-function jsonErr(res, status, message, extraFields = {}) {
-  res.writeHead(status, { 'content-type': 'application/json' });
-  res.end(JSON.stringify({ error: { message }, ...extraFields }));
-}
-
-const mb = (n) => (n / 1048576).toFixed(1);
-
-/**
- * Every fundable balance across all three chains, for the startup line and
- * the live refresh. Each read is independent and advisory — one lagging RPC
- * drops its entry rather than blanking the whole line.
- */
-async function snapshotBalances(client) {
-  const out = [];
-  try {
-    const bals = await Promise.all(
-      FUNDING_ASSETS.map((a) => tokenBalance(client.connection, client.keypair.publicKey, a.mint)),
-    );
-    FUNDING_ASSETS.forEach((a, i) => out.push({ symbol: a.symbol, ui: Number(bals[i].ui ?? 0), chain: 'solana' }));
-  } catch { /* Solana RPC hiccup — EVM entries still report */ }
-  const owner = client.evmAddress;
-  if (owner) {
-    await Promise.all(Object.entries(EVM_FUNDING_ASSETS).flatMap(([rail, assets]) => assets.map(async (a) => {
-      try {
-        const raw = await evmTokenBalance({ rpcUrl: evmRpcFor(rail), token: a.address, owner });
-        out.push({ symbol: a.symbol, ui: Number(raw) / 10 ** a.decimals, chain: rail });
-      } catch { /* advisory */ }
-    })));
-  }
-  // Parallel reads land in racy order; sort so the printed line is stable
-  // and diffs against the previous snapshot read cleanly.
-  const rank = { solana: 0, base: 1, robinhood: 2 };
-  return out.sort((a, b) => (rank[a.chain] ?? 9) - (rank[b.chain] ?? 9) || a.symbol.localeCompare(b.symbol));
-}
-
-/** Solana entries always show; EVM entries only once they hold something. */
-function balanceLine(snap) {
-  return snap
-    .filter((b) => b.chain === 'solana' || b.ui > 0)
-    .map((b) => `${b.ui} ${b.symbol}${b.chain !== 'solana' ? ` (${b.chain})` : ''}`)
-    .join('  ·  ');
-}
-
-/**
- * The zoo answers chat completions as ONE JSON object (it settles payment
- * before serving — there is nothing to stream until generation is done).
- * Harnesses that sent `stream: true` expect SSE and treat a JSON body as a
- * dead connection: Cursor shows "Reconnecting…", RETRIES, and every retry is
- * a fresh payment. So the proxy honours the contract itself — the finished
- * completion is re-emitted as spec-shaped chat.completion.chunk events.
- */
-function serveAsSse(res, data, upstream) {
-  const headers = {
-    'content-type': 'text/event-stream; charset=utf-8',
-    'cache-control': 'no-cache',
-    // Tell any proxy in front of us (cloudflare quick tunnel, nginx) NOT to
-    // buffer the stream. Without this the tunnel accumulates the whole SSE
-    // body and releases it at once, which reorders/merges the tool_call frames
-    // an agent parses incrementally — observed as "provider-side tool-call
-    // protocol error" over the tunnel while localhost (no proxy) is fine.
-    'x-accel-buffering': 'no',
-    connection: 'keep-alive',
-  };
-  const settle = upstream?.headers?.get?.('x-payment-response');
-  if (settle) headers['x-payment-response'] = settle;
-  res.writeHead(200, headers);
-  const base = {
-    id: data.id, object: 'chat.completion.chunk', created: data.created, model: data.model,
-  };
-  const ev = (obj) => res.write(`data: ${JSON.stringify(obj)}\n\n`);
-  for (const c of data.choices || []) {
-    ev({ ...base, choices: [{ index: c.index ?? 0, delta: { role: 'assistant' }, finish_reason: null }] });
-    if (c.message?.content) {
-      ev({ ...base, choices: [{ index: c.index ?? 0, delta: { content: c.message.content }, finish_reason: null }] });
-    }
-    // Agent mode lives or dies here: a finish_reason of "tool_calls" with the
-    // calls themselves dropped strands the harness mid-turn (observed: Cursor
-    // agent hangs). Streaming spec: tool_calls ride the delta with an index,
-    // arguments as a string chunk — one full chunk per call is valid SSE.
-    if (Array.isArray(c.message?.tool_calls) && c.message.tool_calls.length) {
-      ev({
-        ...base,
-        choices: [{
-          index: c.index ?? 0,
-          delta: {
-            tool_calls: c.message.tool_calls.map((t, i) => ({
-              index: i,
-              id: t.id,
-              type: t.type || 'function',
-              function: { name: t.function?.name, arguments: t.function?.arguments ?? '' },
-            })),
-          },
-          finish_reason: null,
-        }],
-      });
-    }
-    ev({ ...base, choices: [{ index: c.index ?? 0, delta: {}, finish_reason: c.finish_reason ?? 'stop' }], ...(data.usage ? { usage: data.usage } : {}) });
-  }
-  res.write('data: [DONE]\n\n');
-  res.end();
-}
-
-/**
- * Replay guard — a harness that cannot consume a response retries the SAME
- * body within seconds, and each retry used to be a fresh payment (observed:
- * six identical $0.06 settles for one Cursor message). An identical POST body
- * arriving within the window is served the cached completion, not re-paid.
- * Window is deliberately short: a genuinely new turn always differs (harnesses
- * resend the whole conversation), so only true retries can hit.
- */
-const REPLAY_TTL_MS = 30_000;
-const replayCache = new Map(); // sha256(body) -> { at, data, settle }
-/**
- * The key MUST include the routing headers, not just the body.
- *
- * Keying on the body alone was a correctness bug, not merely a caching one:
- * N shards asking the SAME question of N DIFFERENT bound corpora send
- * byte-identical bodies and differ only in X-HRR-Context. They collided on one
- * key, so shards 2..N were served shard 1's answer — REPRODUCED in the field:
- * 10 shards, 7 byte-identical replies across corpora known to differ, and the
- * batch finished in 12s where a single uncached call took ~7s.
- *
- * Wrong answers attributed to the wrong corpus is a far worse failure than the
- * double-billing this cache exists to prevent, so every header that can change
- * the ANSWER joins the key.
- */
-const REPLAY_KEY_HEADERS = ['x-hrr-context', 'x-hrr-top-k', 'x-hrr-gate', 'x-openzoo-namespace'];
-
-function replayKey(bodyBuf, headers = {}) {
-  const h = crypto.createHash('sha256').update(bodyBuf);
-  for (const name of REPLAY_KEY_HEADERS) {
-    const v = headers[name];
-    if (v) h.update(`\n${name}:${v}`);
-  }
-  return h.digest('hex');
-}
-function replayGet(key) {
-  const hit = replayCache.get(key);
-  if (!hit) return null;
-  if (Date.now() - hit.at > REPLAY_TTL_MS) { replayCache.delete(key); return null; }
-  return hit;
-}
-function replayPut(key, data, settle) {
-  replayCache.set(key, { at: Date.now(), data, settle });
-  if (replayCache.size > 50) {
-    const oldest = [...replayCache.entries()].sort((a, b) => a[1].at - b[1].at)[0];
-    if (oldest) replayCache.delete(oldest[0]);
-  }
-}
-
-/**
- * "The body never ships twice" at the proxy. A chat body whose LAST message
- * carries a huge pasted corpus gets split at its last blank line — corpus vs
- * ask — so the corpus can be bound ONCE on the zoo and every later call ships
- * only the ask plus X-HRR-Context. The split point is deterministic, which is
- * what makes the sha256 manifest hit on run 2 even when the question changed.
- *
- * Conservative on purpose: only a single big STRING content on the final
- * message, only when a blank-line boundary exists, and any failure falls back
- * to sending the original body untouched — caching must never break a call.
- * Returns null (send as-is) or { body, contextId, hash, corpus, reused, savedBytes }.
- */
-async function maybeCacheCorpus(req, bodyBuf, log) {
-  if (contextCacheDisabled()) return null;
-  if (req.method !== 'POST' || !(req.url || '').includes('/chat/completions')) return null;
-  if (req.headers['x-hrr-context']) return null; // harness manages its own context
-  if (bodyBuf.length <= BIND_MIN_CHARS) return null;
-  let body;
-  try { body = JSON.parse(bodyBuf.toString('utf8')); } catch { return null; }
-  const msgs = Array.isArray(body?.messages) ? body.messages : null;
-  if (!msgs?.length) return null;
-  const last = msgs[msgs.length - 1];
-  if (typeof last?.content !== 'string' || last.content.length <= BIND_MIN_CHARS) return null;
-  const cut = last.content.lastIndexOf('\n\n');
-  if (cut < BIND_MIN_CHARS) return null;
-  const corpus = last.content.slice(0, cut);
-  const ask = last.content.slice(cut + 2).trim();
-  if (!ask || ask.length > 8000) return null;
-
-  const bind = await bindCorpus(corpus, {
-    onStage: (stage, info) => {
-      if (stage === 'binding') log(`binding ${mb(info.bytes)}MB corpus to holographic memory (one-time)...`);
-    },
-  });
-  if (bind.reused) {
-    log(`corpus already bound (${bind.hash.slice(0, 12)}… → ${bind.contextId}) — skipped ${mb(bind.bytes)}MB upload`);
-  } else {
-    log(`corpus bound once (${mb(bind.bytes)}MB → ${bind.contextId}) — repeats of this body are near-free`);
-  }
-  const rewritten = { ...body, messages: [...msgs.slice(0, -1), { ...last, content: ask }] };
-  return {
-    body: Buffer.from(JSON.stringify(rewritten)),
-    contextId: bind.contextId,
-    hash: bind.hash,
-    corpus,
-    reused: bind.reused,
-    savedBytes: bind.bytes,
-  };
-}
-
-/**
- * `requireToken` / `sessionMaxUsd` are TUNNEL MODE (see lib/tunnel.js): once the
- * proxy is reachable from the internet, the api key stops being decorative and
- * becomes the only thing between a stranger and your wallet. Both are off by
- * default, so localhost behaviour is unchanged.
- */
-export async function startProxy({ silent = false, requireToken = null, sessionMaxUsd = null, autoTunnel = false } = {}) {
-  const client = new PayClient();
-  const log = silent ? () => {} : (...a) => console.log(...a);
-  // ALWAYS-ON. `silent: true` is used by the editor path to keep startup tidy,
-  // but it also swallowed the per-request lines and the payment receipts — so the
-  // terminal sat blank and there was no way to tell a working setup from an editor
-  // quietly answering from its own backend. Traffic and receipts are the whole
-  // point of watching this window; they are never silenced.
-  // ALWAYS-ON, BUT NEVER INTO A HARNESS'S TERMINAL. `silent` means another
-  // process (openzoo claude, the editor launcher) owns stdio — printing request
-  // lines / payment receipts there corrupts that program's output (observed: the
-  // Solana receipt leaking into the Claude Code CLI). When silent, route this
-  // channel to a log file instead; only print to the console when we own it.
-  let paidCalls = 0;
-  let sayFile = null;
-  if (silent) {
-    try {
-      sayFile = path.join(os.homedir(), '.openzoo', 'proxy.log');
-      mkdirSync(path.dirname(sayFile), { recursive: true });
-    } catch { sayFile = null; }
-  }
-  const say = (...a) => {
-    const line = a.join(' ');
-    if (sayFile) { try { appendFileSync(sayFile, line + '\n'); return; } catch { /* fall through */ } }
-    console.log(line);
-  };
-  let sessionSpent = 0;
-  let sessionCogs = 0;
-  let sessionDirect = 0;
-  const MARKUP = 3; // confirmed constant, see .claude/wiki.md "Margin needs a like-for-like denominator"
-  let tunnelSpent = 0;
-  // Live balance refresh state — the real implementation is assigned in the
-  // banner section below; the handler only ever calls scheduleRefresh().
-  let lastSnap = null;
-  let refreshBalances = async () => {};
-  let refreshPending = false;
-  const scheduleRefresh = (ms) => {
-    if (silent || refreshPending) return;
-    refreshPending = true;
-    const t = setTimeout(async () => { refreshPending = false; await refreshBalances(); }, ms);
-    t.unref?.();
-  };
-  // Set once cloudflared is up (see below). Gating keys off the REQUEST's
-  // origin, not off whether the URL exists yet, so there is no startup window
-  // where public traffic slips through ungated.
-  let tunnelGate = null;
-  // How many chat requests actually ARRIVED. The single number that answers
-  // "is the editor really routing through us?" — an editor that silently keeps
-  // using its own backend leaves this at 0 while looking perfectly healthy.
-  let servedRequests = 0;
-  let tunnelError = null;
-
-  const server = http.createServer(async (req, res) => {
-    // MCP on the SAME port as the proxy. One `npx openzoo` gives a harness
-    // both surfaces: point base_url at /v1 for transparent context spilling,
-    // or add /mcp for tools (zoo_bind, zoo_ask...). Running two commands to
-    // get both was friction nobody should pay.
-    // This wallet's own running total for THIS proxy process — every paid
-    // call through this port counts (GUI, MCP, CLI, any harness), not just
-    // whichever surface happens to be asking. Local-only, no auth needed:
-    // it's a number, not a capability.
-    if (req.method === 'GET' && (req.url || '').split('?')[0] === '/v1/session') {
-      res.writeHead(200, { 'content-type': 'application/json' });
-      res.end(JSON.stringify({ spentUsd: sessionSpent, cogsUsd: sessionCogs, directUsd: sessionDirect, paidCalls }));
-      return;
-    }
-
-    // Public addresses only — never the private key. Exists so a caller (the
-    // grokui error path, in particular) can print REAL funding instructions
-    // inline instead of telling the user to go look somewhere else.
-    if (req.method === 'GET' && (req.url || '').split('?')[0] === '/v1/wallet') {
-      res.writeHead(200, { 'content-type': 'application/json' });
-      res.end(JSON.stringify({
-        solana: client.address,
-        evm: client.evmAddress,
-        funding: fundingLine(client.address),
-        // from the same background poll the startup/refresh lines use, so a
-        // caller can tell a genuinely empty wallet from a transient 402
-        balances: balanceLine(lastSnap || []) || null,
-        funded: (lastSnap || []).some((b) => b.ui > 0),
-      }));
-      return;
-    }
-
-    if ((req.url || '').split('?')[0] === '/mcp') {
-      try {
-        const { handleMcpRequest } = await import('./mcphttp.js');
-        await handleMcpRequest(req, res);
-      } catch (err) {
-        jsonErr(res, 500, `openzoo mcp error: ${err.message}`);
-      }
-      return;
-    }
-
-    // THE CUTESY GUI. Local browsers hitting GET / get a little chat app —
-    // model zoo, bind-a-corpus drawer, live spent/saved ticker off the x402
-    // receipts. Tunnel traffic (cf headers) keeps the JSON discovery below:
-    // the GUI is the operator's, not the public's.
-    {
-      const p0 = (req.url || '').split('?')[0];
-      const local = !(req.headers['cf-connecting-ip'] || req.headers['cf-ray']);
-      if (local && req.method === 'GET' && (p0 === '/' || p0 === '/gui')) {
-        try {
-          const html = readFileSync(new URL('./gui.html', import.meta.url), 'utf8');
-          res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
-          res.end(html);
-          return;
-        } catch { /* fall through to proxy behavior if the file is missing */ }
-      }
-    }
-
-    const normalized = normalizePath(req.url);
-    if (normalized !== req.url) {
-      log(`path ${req.url} -> ${normalized} (base_url already ends in /v1)`);
-      req.url = normalized;
-    }
-    let url = `${config.apiBase}${req.url}`;
-    // Requests that arrived over the public quick-tunnel URL carry cloudflared's
-    // headers; nothing dialing 127.0.0.1 directly does. That distinction is what
-    // lets localhost stay keyless while the SAME port is safely public.
-    const viaTunnel = !requireToken && tunnelGate
-      && Boolean(req.headers['cf-connecting-ip'] || req.headers['cf-ray']);
-    // Auth first: refuse before reading a body, forwarding, quoting or paying.
-    if (requireToken) {
-      const got = (req.headers.authorization || '').replace(/^Bearer\s+/i, '').trim();
-      if (got !== requireToken) {
-        log(`tunnel: 401 ${req.method} ${req.url} from ${req.socket.remoteAddress}`);
-        jsonErr(res, 401, 'unauthorized: this openzoo tunnel requires the api key printed at startup');
-        return;
-      }
-      if (sessionMaxUsd != null && sessionSpent >= sessionMaxUsd) {
-        jsonErr(res, 402, `openzoo tunnel session cap reached ($${sessionMaxUsd}) — restart the tunnel or raise OPENZOO_TUNNEL_MAX_USD`);
-        return;
-      }
-    }
-    // ROUTING TRUTH, SERVED FROM WHATEVER URL YOU REACHED US ON. A cloud agent
-    // only ever touches the tunnel, so asking a local MCP process "what is my
-    // routing" is the wrong question — the answer has to come from the tunnel
-    // itself, and name the tunnel. Free and unauthenticated: discovery must
-    // never be the thing that is gated.
-    {
-      const p0 = (req.url || '').split('?')[0];
-      if (req.method === 'GET' && (p0 === '/v1/info' || p0 === '/info')) {
-        const self = viaTunnel && tunnelGate?.publicUrl
-          ? `${tunnelGate.publicUrl}/v1`
-          : `http://localhost:${config.port}/v1`;
-        res.writeHead(200, { 'content-type': 'application/json' });
-        res.end(JSON.stringify({
-          youAreTalkingTo: 'openzoo proxy',
-          yourEndpoint: self,
-          reachedVia: viaTunnel ? 'public tunnel' : 'localhost',
-          publicTunnel: tunnelGate?.publicUrl ? `${tunnelGate.publicUrl}/v1` : null,
-          servedRequests,
-          spendUsd: sessionSpent,
-          paidCalls,
-          mcp: `${self.replace(/\/v1$/, '')}/mcp`,
-          upstream: config.apiBase,
-          payment: 'x402 per request from the operator\'s local burner wallet — no API key, no account',
-          auth: viaTunnel
-            ? 'this public URL requires the oz_… bearer for paid endpoints; /v1/models and /v1/hrr/bind are free'
-            : 'localhost is keyless',
-          context: {
-            yourAttentionWindow: 'unchanged — openzoo does not enlarge it',
-            boundCeiling: '~128M tokens client-usable via bind + retrieval',
-            singleRequestLimit: '~8MB per request; larger corpora bind in parts',
-            retrieval: 'lossy top-k retrieval, NOT lossless compression',
-          },
-          tools: ['zoo_bind', 'zoo_ask', 'zoo_status', 'zoo_models', 'zoo_wallet', 'zoo_contexts'],
-          docs: 'https://openzoo.fun',
-        }, null, 2));
-        return;
-      }
-    }
-
-    if (viaTunnel) {
-      const got = (req.headers.authorization || '').replace(/^Bearer\s+/i, '').trim();
-      // TRUST ON FIRST USE, so a stale key still works without weakening the
-      // tunnel to "any key forever".
-      //
-      // Tunnel tokens are minted per session, so a client holding a key from an
-      // earlier run silently failed — and the only fixes were re-pasting by
-      // hand or writing into the editor's OS-encrypted credential store, which
-      // would mean prompting for keychain access to install a value the user
-      // never chose. Instead: the printed token always works, and the FIRST
-      // other key to present itself claims the tunnel for the rest of the
-      // session. Your editor (which reaches the URL first, from this machine)
-      // adopts it; anyone who finds the URL afterwards is refused because the
-      // slot is taken. The URL is unguessable and ephemeral, the spend ceiling
-      // still applies, and OPENZOO_TUNNEL_STRICT=1 restores exact-match only.
-      const strict = process.env.OPENZOO_TUNNEL_STRICT === '1';
-      let authed = got === tunnelGate.token;
-      if (!authed && !strict && got.length >= 8) {
-        if (!tunnelGate.adopted) {
-          tunnelGate.adopted = got;
-          log(`public url: adopted the caller's key (first-use) — later keys must match it`);
-          authed = true;
-        } else {
-          authed = got === tunnelGate.adopted;
-        }
-      }
-      const p = (req.url || '').split('?')[0];
-      // DISCOVERY IS FREE. An agent probing this URL cold should be able to
-      // work out what it is and what to ask its operator for — a bare 401 on
-      // every path just sends it spelunking through the operator's machine.
-      // Reads that cost nothing and leak nothing (the catalog is public on
-      // the zoo anyway) go through without the key; money paths stay gated.
-      if (!authed) {
-        if (req.method === 'GET' && (p === '/' || p === '/v1' || p === '/v1/info')) {
-          res.writeHead(200, { 'content-type': 'application/json' });
-          res.end(JSON.stringify({
-            name: 'openzoo proxy (public tunnel)',
-            what: 'OpenAI-compatible pay-per-call proxy — the operator\'s wallet pays per request via x402; no account, no signup.',
-            authentication: 'All POST endpoints require `Authorization: Bearer <api key>`. The key is printed in the operator\'s terminal at proxy startup — ask them for it. It is NOT guessable.',
-            endpoints: {
-              'GET /v1/models': 'model catalog with pricing + context_length — no key needed',
-              'GET /v1/models/{id}': 'single-model probe — no key needed',
-              'POST /v1/chat/completions': 'chat (streaming supported, any model id — unknown ids are matched to the nearest served model) — key required',
-            },
-            docs: 'https://openzoo.fun · https://www.npmjs.com/package/openzoo',
-          }, null, 2));
-          return;
-        }
-        // Binding COSTS NOTHING — no 402, no wallet, no settlement. Gating it
-        // behind the key only stopped agents from using the one endpoint that
-        // makes a big corpus workable: observed in the wild, an agent wrote a
-        // correct multi-part bind script, got 401 on the final append, and
-        // fell back to stuffing the corpus inline. The money paths below stay
-        // gated; the worst a stranger can do here is spend our sidecar's disk.
-        const freeRead = req.method === 'GET' && (p === '/v1/models' || p.startsWith('/v1/models/'));
-        const freeBind = req.method === 'POST' && p === '/v1/hrr/bind';
-        if (freeBind) log(`public url: unauthenticated bind allowed (free endpoint) from ${req.socket.remoteAddress}`);
-        if (!freeRead && !freeBind) {
-          log(`public url: 401 ${req.method} ${req.url}`);
-          jsonErr(res, 401, 'unauthorized: this openzoo public URL requires the api key printed at the operator\'s proxy startup — GET / for discovery, GET /v1/models is open');
-          return;
-        }
-      }
-      if (authed && tunnelSpent >= tunnelGate.sessionMaxUsd) {
-        jsonErr(res, 402, `openzoo public-URL session cap reached ($${tunnelGate.sessionMaxUsd}) — restart the proxy or raise OPENZOO_TUNNEL_MAX_USD`);
-        return;
-      }
-    }
-    let bodyBuf;
-    try {
-      bodyBuf = await readBody(req);
-    } catch {
-      jsonErr(res, 400, 'bad request body');
-      return;
-    }
-
-    // ANTHROPIC MESSAGES SHAPE. A harness pointed here via ANTHROPIC_BASE_URL
-    // (Claude Code, the Anthropic SDKs) speaks POST /v1/messages, not chat
-    // completions — this is how such a harness routes its inference through
-    // x402 without any DNS or TLS trickery. Translate the body to OpenAI shape
-    // and rewrite the path so EVERYTHING downstream (model rewrite, brief,
-    // corpus cache, payment, replay, streaming) runs unchanged; translate the
-    // answer back on the way out. See lib/anthropic.js.
-    let anthropicMode = false;
-    let anthropicModel = null;
-    const rawPath = (req.url || '').split('?')[0];
-    if (req.method === 'POST' && (rawPath === '/v1/messages' || rawPath === '/messages')) {
-      try {
-        const inbound = JSON.parse(bodyBuf.toString('utf8'));
-        anthropicModel = inbound.model;
-        bodyBuf = Buffer.from(JSON.stringify(anthropicToOpenAI(inbound)));
-        anthropicMode = true;
-        req.url = '/v1/chat/completions';
-        url = `${config.apiBase}${req.url}`;
-      } catch {
-        jsonErr(res, 400, 'invalid anthropic messages body');
-        return;
-      }
-    }
-
-    // Harness model ids ("gpt-5.6-sol", "claude-…") are rewritten onto the
-    // NEAREST zoo model BEFORE anything else sees the body — any POST that
-    // carries a model field, not just chat/completions, so /completions,
-    // /responses and future shapes all work. Never silent.
-    let wantsStream = false;
-      if ((req.url || '').includes('/chat/completions') && req.method === 'POST') {
-        servedRequests += 1;
-        say(`\n<- request #${servedRequests} from ${(req.headers['user-agent'] || 'unknown').slice(0, 40)}`);
-      }
-    if (rewritablePath(req.method, req.url)) {
-      const rw = await maybeRewriteModel(bodyBuf);
-      if (rw) {
-        log(`model "${rw.from}" is not on the zoo — nearest match ${rw.to} (OPENZOO_DEFAULT_MODEL overrides)`);
-        bodyBuf = rw.body;
-      }
-      try {
-        const parsed = JSON.parse(bodyBuf.toString('utf8'));
-        wantsStream = parsed?.stream === true;
-        // Tell the agent what it is actually connected to — in band, where it
-        // will read it, instead of leaving it to guess (and to chunk corpora
-        // it could bind whole). See lib/brief.js.
-        if ((req.url || '').includes('/chat/completions')) {
-          // Tell it the URL it actually reached us on — the public tunnel for
-          // a remote harness, localhost for a local one. An agent that has to
-          // guess its own endpoint guesses a website.
-          const selfUrl = viaTunnel && tunnelGate?.publicUrl
-            ? `${tunnelGate.publicUrl}/v1`
-            : `http://localhost:${config.port}/v1`;
-          const briefed = injectBrief(parsed, selfUrl);
-          if (briefed) bodyBuf = Buffer.from(JSON.stringify(briefed));
-        }
-      } catch { /* not JSON */ }
-    }
-
-    // Retry of a body we answered seconds ago? Serve the cached completion —
-    // never pay twice for a harness's reconnect loop.
-    const isChat = req.method === 'POST' && (req.url || '').includes('/chat/completions');
-    const rKey = isChat ? replayKey(bodyBuf, req.headers) : null;
-    if (rKey) {
-      const hit = replayGet(rKey);
-      if (hit) {
-        log('identical request within 30s — served the cached completion, NOT re-paid');
-        if (wantsStream) { serveAsSse(res, hit.data, null); return; }
-        const h = { 'content-type': 'application/json' };
-        if (hit.settle) h['x-payment-response'] = hit.settle;
-        res.writeHead(200, h);
-        res.end(JSON.stringify(hit.data));
-        return;
-      }
-    }
-    const init = { method: req.method, headers: upstreamHeaders(req) };
-    if (req.method !== 'GET' && req.method !== 'HEAD') init.body = bodyBuf;
-
-    // Harnesses validate their configured model BEFORE ever POSTing — some
-    // list /v1/models, some probe /v1/models/<id>. Both must succeed for the
-    // ids we know how to rewrite, or the harness refuses upfront and the
-    // rewrite never gets its chance.
-    const path = (req.url || '').split('?')[0];
-    if (req.method === 'GET' && path === '/v1/models') {
-      try {
-        const { response } = await client.fetch(url, init);
-        const payload = await response.json();
-        res.writeHead(response.status, { 'content-type': 'application/json' });
-        res.end(JSON.stringify(response.ok ? augmentModelList(payload) : payload));
-        return;
-      } catch { /* fall through to the plain relay below */ }
-    }
-    const probe = req.method === 'GET' && /^\/v1\/models\/(.+)$/.exec(path);
-    if (probe && ALIAS_IDS.includes(decodeURIComponent(probe[1]))) {
-      res.writeHead(200, { 'content-type': 'application/json' });
-      res.end(JSON.stringify({ id: decodeURIComponent(probe[1]), object: 'model', owned_by: 'openzoo-alias' }));
-      return;
-    }
-
-    try {
-      let cached = null;
-      try {
-        cached = await maybeCacheCorpus(req, bodyBuf, log);
-      } catch (err) {
-        log(`context cache skipped for this call: ${err.message}`);
-      }
-      const send = (buf, ctxId) => client.fetch(url, {
-        ...init,
-        body: buf,
-        headers: ctxId ? { ...init.headers, 'x-hrr-context': ctxId } : init.headers,
-      });
-      let result;
-      if (cached) {
-        result = await send(cached.body, cached.contextId);
-        // Sidecar wiped between runs: the gateway 404s BEFORE the 402 (nothing
-        // paid). Never fail on a stale manifest — re-bind once and retry.
-        if (result.response.status === 404) {
-          const text = await result.response.text();
-          if (/context_not_found/.test(text)) {
-            log('bound context is gone on the zoo — re-binding once...');
-            forgetContext(config.apiBase, cached.hash);
-            const rebound = await bindCorpus(cached.corpus, { force: true });
-            result = await send(cached.body, rebound.contextId);
-          } else {
-            res.writeHead(404, { 'content-type': 'application/json' });
-            res.end(text);
-            return;
-          }
-        }
-      } else {
-        result = await client.fetch(url, init);
-      }
-      const { response, paid, receipt } = result;
-      if (paid && receipt) {
-        if (receipt.ok && typeof receipt.billedUsd === 'number') {
-          sessionSpent += receipt.billedUsd;
-          // cogs: no per-call field for it, but MARKUP is a known constant
-          // (3x — confirmed against the gateway's own margin math), and
-          // billedUsd = cogs * markup on a straight-markup call. Close enough
-          // on a counterfactual (leCore-discounted) call too since markup is
-          // still the ceiling those get capped against.
-          // Prefer the gateway's own cogsUsd. Deriving it as billedUsd/MARKUP
-          // is only correct on a straight-markup call: under counterfactual
-          // pricing billedUsd is min(direct×discount, markupUsd), so the
-          // division understates cost and overstates margin.
-          sessionCogs += typeof receipt.cogsUsd === 'number'
-            ? receipt.cogsUsd
-            : receipt.billedUsd / MARKUP;
-          // direct = what answering this WITHOUT the zoo would have cost. On an
-          // attach call that is the whole bound corpus, which is why it can be
-          // orders of magnitude above what was billed. directUsd is exact and
-          // always present; savesVsDirect is the same number as a ratio.
-          sessionDirect += typeof receipt.directUsd === 'number'
-            ? receipt.directUsd
-            : typeof receipt.savesVsDirect === 'number'
-              ? receipt.savesVsDirect * receipt.billedUsd
-              : receipt.billedUsd;
-          // The public-URL ceiling meters only public-origin spend — your own
-          // local calls never eat into it.
-          if (viaTunnel) tunnelSpent += receipt.billedUsd;
-        }
-        const line = receipt.ok ? receipt.line : `paid retry -> HTTP ${receipt.status}`;
-        // Wherever a running total is the thing to watch, it rides the receipt.
-        if (requireToken) say(`${line}  ·  session $${sessionSpent.toFixed(6)}`);
-        else if (viaTunnel) say(`${line}  ·  public-url session $${tunnelSpent.toFixed(6)}`);
-        else say(line);
-        // ALWAYS-ON SPEND, TUI-SAFE. When a harness owns the terminal (silent),
-        // the receipt lines go to a file (they corrupt a TUI). But the running
-        // total should still be visible — so write it to the terminal TITLE via
-        // an OSC escape, which updates the window/tab title without touching the
-        // TUI's content. `openzoo ● $0.0042 · 12 calls` in the title bar, live.
-        if (receipt.ok && typeof receipt.billedUsd === 'number') { paidCalls += 1; }
-        if (sayFile) {
-          try { process.stderr.write(`]0;openzoo ● $${sessionSpent.toFixed(4)} · ${paidCalls} call${paidCalls === 1 ? '' : 's'}`); } catch { /* no tty */ }
-        }
-        scheduleRefresh(4000); // settlement lands on-chain in a few seconds
-      }
-      // Chat completions come back as one JSON object (settle-before-serve).
-      // Cache it against retries, and if the harness asked to stream, honour
-      // that contract ourselves. An upstream that someday truly streams (SSE
-      // content-type) passes straight through the relay below, untouched.
-      const upCt = response.headers.get('content-type') || '';
-      if (isChat && response.ok && upCt.includes('application/json')) {
-        let data = null;
-        try { data = await response.clone().json(); } catch { /* not JSON after all */ }
-        // PREPAID CALLS STILL COST MONEY. The block above only meters calls
-        // where THIS proxy answered a 402 and paid. When prepaid credit covers
-        // the quote the gateway serves 200 on the FIRST request, so there is
-        // no 402, no payment and no receipt — and the session read $0.05 / 2
-        // calls while the credit balance had actually fallen $3.017 -> $1.395
-        // over a 30-question run. The receipt still rides the response body,
-        // so meter it from there.
-        if (!paid && data?.x402 && typeof data.x402.billedUsd === 'number') {
-          const x = data.x402;
-          sessionSpent += x.billedUsd;
-          sessionCogs += typeof x.cogsUsd === 'number' ? x.cogsUsd : x.billedUsd / MARKUP;
-          sessionDirect += typeof x.directUsd === 'number' ? x.directUsd : x.billedUsd;
-          paidCalls += 1;
-          if (viaTunnel) tunnelSpent += x.billedUsd;
-          say(`credit -> $${x.billedUsd.toFixed(6)}  ·  session $${sessionSpent.toFixed(6)}`);
-        }
-        if (data?.object === 'chat.completion') {
-          if (rKey) replayPut(rKey, data, response.headers.get('x-payment-response'));
-          // Anthropic-shaped caller gets an Anthropic-shaped answer, streamed
-          // or not, so Claude Code and the SDKs parse it natively.
-          if (anthropicMode) {
-            const msg = openAIToAnthropic(data, anthropicModel);
-            if (wantsStream) { writeAnthropicSse(res, msg, response); return; }
-            const h = { 'content-type': 'application/json' };
-            const settleHdr = response.headers.get('x-payment-response');
-            if (settleHdr) h['x-payment-response'] = settleHdr;
-            res.writeHead(200, h);
-            res.end(JSON.stringify(msg));
-            return;
-          }
-          if (wantsStream) { serveAsSse(res, data, response); return; }
-          const h = { 'content-type': 'application/json' };
-          const settleHdr = response.headers.get('x-payment-response');
-          if (settleHdr) h['x-payment-response'] = settleHdr;
-          res.writeHead(200, h);
-          res.end(JSON.stringify(data));
-          return;
-        }
-      }
-      await relay(res, response);
-    } catch (err) {
-      if (err instanceof QuoteTooHighError) {
-        log(err.message);
-        jsonErr(res, 402, err.message, { quote: err.quote });
-      } else if (err instanceof UnderfundedError) {
-        log(err.message);
-        jsonErr(res, 402, err.message);
-      } else {
-        // "fetch failed" alone is undiagnosable — undici hides the real
-        // network error in `cause`. Surface it (and log the stack) or every
-        // transport hiccup looks identical to a payment bug.
-        const cause = err.cause?.message || err.cause?.code || err.cause;
-        const detail = cause ? `${err.message} (${cause})` : err.message;
-        log(`proxy error: ${detail}`);
-        if (process.env.OPENZOO_DEBUG) console.error(err.stack);
-        jsonErr(res, 502, `openzoo proxy error: ${detail}`);
-      }
-    }
-  });
-
-  // BIND HOST. Default 127.0.0.1 — the keyless localhost path must never be
-  // world-reachable on an ordinary machine. A RunPod box is the exception: its
-  // HTTP proxy reaches the container over the pod network, so a localhost bind
-  // shows "Initializing…" forever (MEASURED: podagent's 0.0.0.0 ports went
-  // Ready, the 127.0.0.1 proxy never did). The box sets OPENZOO_BIND=0.0.0.0
-  // AND a tunnel token, so the RunPod-fronted port stays gated exactly like the
-  // public tunnel path.
-  const bindHost = process.env.OPENZOO_BIND || '127.0.0.1';
-  await new Promise((resolve, reject) => {
-    server.on('error', reject);
-    server.listen(config.port, bindHost, resolve);
-  });
-
-  // AUTO-PREPAY. Paying on-chain per call is where the latency lives: the
-  // gateway answers its 402 challenge in ~0.12s while a full settled call
-  // MEASURED 9-37s end to end. Credit is applied automatically server-side
-  // whenever a balance covers the quote, so buying it once makes every later
-  // call skip verify+settle entirely.
-  //
-  // Runs in the background — never block the listener on a payment — and only
-  // when this wallet actually has funds, so a fresh/empty wallet is untouched.
-  // Opt out with OPENZOO_NO_AUTOTOPUP=1; size it with OPENZOO_AUTOTOPUP_USD.
-  if (!process.env.OPENZOO_NO_AUTOTOPUP) {
-    // Keep credit topped up, forever, from whatever the wallet holds.
-    //
-    // The first version ran ONCE at startup and bought a fixed $5, so funding
-    // the wallet later did nothing at all — the user sent TOKEN and kept
-    // paying on-chain per call. This checks on an interval and spends what the
-    // wallet can actually cover, priced by the gateway's own live quote (so
-    // TOKEN is valued exactly as it settles).
-    const FLOOR = Number(process.env.OPENZOO_AUTOTOPUP_FLOOR || 2);
-    const EVERY = Number(process.env.OPENZOO_AUTOTOPUP_EVERY_MS || 60_000);
-    let topping = false;
-    const tick = async () => {
-      if (topping) return;
-      topping = true;
-      try {
-        const { creditBalance, topUp, affordableUsd } = await import('./info.js');
-        const have = await creditBalance();
-        if (have >= FLOOR) return;
-        const can = await affordableUsd();
-        if (can < 1) return;             // nothing to convert; stay quiet
-        say(`credit $${have.toFixed(4)} below $${FLOOR} — wallet covers ~$${can.toFixed(2)}, topping up`);
-        await topUp('all');
-      } catch (e) {
-        say(`auto top-up skipped: ${String(e.message || e).slice(0, 120)}`);
-      } finally {
-        topping = false;
-      }
-    };
-    tick();
-    const timer = setInterval(tick, EVERY);
-    timer.unref?.();   // never hold the process open just for this
-  }
-
-  if (!silent) {
-    // VERSION IN THE BANNER, deliberately. `npx openzoo` can serve a STALE
-    // cached copy — npx reuses a cache entry that matches the bare spec, so a
-    // user running the newest published version still gets old behaviour and
-    // no clue why (observed: a missing tunnel and a missing token row, both
-    // "fixed" releases ago). Printing the version makes that one glance.
-    const { version } = JSON.parse(
-      readFileSync(new URL('../package.json', import.meta.url), 'utf8'),
-    );
-    console.log(`openzoo v${version}  ->  ${config.apiBase}`);
-    console.log(`listening on   http://localhost:${config.port}/v1`);
-    // LAND THEM IN THE APP. `npx openzoo` in a human terminal opens the chat
-    // GUI — a stranger's first 8 seconds should be a working chat, not a URL
-    // to notice. Never in CI/agents (no TTY), never twice, opt out with
-    // OPENZOO_NO_OPEN=1.
-    if (process.stdout.isTTY && !process.env.OPENZOO_NO_OPEN) {
-      const opener = process.platform === 'darwin' ? 'open'
-        : process.platform === 'win32' ? 'start' : 'xdg-open';
-      import('node:child_process').then(({ exec }) =>
-        exec(`${opener} http://localhost:${config.port}/`, () => {}));
-    }
-    console.log('');
-    if (client.walletCreated) console.log(`new burner wallet created at ${client.walletPath} (chmod 600)`);
-    console.log(`wallet (fund me) · solana: ${client.address}`);
-    if (client.evmAddress) console.log(`wallet (fund me) · evm (base / robinhood): ${client.evmAddress}`);
-    try {
-      lastSnap = await snapshotBalances(client);
-      console.log(`balance: ${balanceLine(lastSnap) || '(no RPC reachable — advisory only)'}`);
-      if (!lastSnap.some((b) => b.ui > 0)) {
-        console.log(`fund it: ${fundingLine('the address above')} — a few cents goes a long way.`);
-      }
-    } catch { /* RPC hiccup: balance is advisory */ }
-    // LIVE REFRESH: the startup line goes stale the moment a call settles or
-    // the user funds mid-session. Poll on an interval (and shortly after each
-    // paid call), print ONLY on change, and call out arrivals explicitly so
-    // "did my top-up land?" answers itself in the running log.
-    refreshBalances = async () => {
-      try {
-        const snap = await snapshotBalances(client);
-        if (!snap.length) return;
-        const prev = new Map((lastSnap || []).map((b) => [`${b.chain}:${b.symbol}`, b.ui]));
-        const changed = snap.some((b) => Math.abs((prev.get(`${b.chain}:${b.symbol}`) ?? 0) - b.ui) > 1e-9)
-          || snap.length !== (lastSnap || []).length;
-        if (!changed) return;
-        if (lastSnap) {
-          for (const b of snap) {
-            const gain = b.ui - (prev.get(`${b.chain}:${b.symbol}`) ?? 0);
-            if (gain > 1e-9) console.log(`funding arrived: +${gain.toFixed(6)} ${b.symbol}${b.chain !== 'solana' ? ` (${b.chain})` : ''}`);
-          }
-        }
-        lastSnap = snap;
-        console.log(`balance: ${balanceLine(snap)}`);
-      } catch { /* advisory — never noisy on RPC trouble */ }
-    };
-    const pollSecs = Number(process.env.OPENZOO_BALANCE_POLL_SECS ?? 45);
-    if (pollSecs > 0) {
-      const timer = setInterval(refreshBalances, pollSecs * 1000);
-      timer.unref?.();
-    }
-    // Which rails the zoo will actually settle right now, straight off a live
-    // 402 — so nobody funds a lane the resource is not currently offering.
-    try {
-      const rails = await liveRails();
-      if (rails) {
-        console.log(`rails live now: ${rails.live.join(' · ')}`);
-        // Funding advice is derived from those rails, never hardcoded — the
-        // zoo can add a chain without this package shipping again.
-        const hint = railFundingHint(rails.live);
-        if (hint) console.log(`fund with:      ${hint}`);
-        // The exact contracts those symbols mean — every chain has impersonator
-        // mints, so a symbol without its CA is an invitation to fund the wrong one.
-        for (const row of railFundingAddresses(rails.live)) {
-          row.assets.forEach((a, i) => {
-            const label = i === 0 ? row.label : '';
-            console.log(`  ${label.padEnd(16)} ${a.symbol.padEnd(11)} ${a.address}${a.note ? `  (${a.note})` : ''}`);
-          });
-        }
-        const unfundable = unfundableRails(rails.live);
-        if (unfundable.length) {
-          const fundable = rails.live.filter((r) => RAIL_FUNDING[r]?.assets.length).map((r) => RAIL_FUNDING[r].label);
-          const instead = fundable.length ? `pay from ${fundable.join(' or ')} instead` : 'no fundable rail is offered right now';
-          console.log(`note:           ${unfundable.join(' / ')} is offered by the zoo but not fundable from a plain balance here — ${instead}.`);
-        }
-        if (rails.dark.length) {
-          const rh = rails.dark.includes('robinhood') ? ' — robinhood also needs OPENZOO_ENABLE_RH=1' : '';
-          console.log(`rails implemented but not offered by the zoo right now: ${rails.dark.join(' · ')}${rh}`);
-        }
-      }
-    } catch { /* quote probe is advisory */ }
-    console.log('');
-    console.log('point any OpenAI-compatible harness at:');
-    console.log(`  base_url = http://localhost:${config.port}/v1`);
-    console.log('  api_key  = sk-openzoo   (any value works; the zoo takes payment, not keys)');
-  }
-
-  // AUTO-TUNNEL: `npx openzoo` must be end-to-end for cloud IDEs too — their
-  // servers cannot dial localhost, so the default command also publishes a
-  // quick-tunnel URL. It comes up in the background (never delays localhost),
-  // failure degrades to local-only, and public traffic is gated above by
-  // token + its own spend ceiling. OPENZOO_NO_TUNNEL=1 opts out.
-  if (autoTunnel && process.env.OPENZOO_NO_TUNNEL !== '1') {
-    (async () => {
-      try {
-        const { ensureCloudflared, startCloudflared, mintToken } = await import('./tunnel.js');
-        const token = mintToken();
-        const cap = process.env.OPENZOO_TUNNEL_MAX_USD ? Number(process.env.OPENZOO_TUNNEL_MAX_USD) : Infinity;
-        const bin = await ensureCloudflared((m) => log(m));
-        const { url, proc } = await startCloudflared(bin, config.port, log);
-        tunnelGate = { token, sessionMaxUsd: cap, publicUrl: url };
-        const bye = () => { try { proc.kill('SIGTERM'); } catch { /* already gone */ } };
-        process.once('SIGINT', () => { bye(); process.exit(0); });
-        process.once('SIGTERM', () => { bye(); process.exit(0); });
-        process.once('exit', bye);
-        log('');
-        log('cloud IDE / remote harness? use the public URL (they cannot reach localhost):');
-        log(`  base_url = ${url}/v1`);
-        log(`  api_key  = ${token}`);
-        log(`  (key REQUIRED on the public URL — it spends this wallet; ${Number.isFinite(cap) ? `capped at $${cap.toFixed(2)}/session` : 'NO session cap — OPENZOO_TUNNEL_MAX_USD adds one'},`);
-        log('   OPENZOO_NO_TUNNEL=1 for localhost-only)');
-      } catch (err) {
-        // Record it: a caller polling for publicUrl (openzoo cursor) would
-        // otherwise spin the full timeout on a tunnel that already died, with
-        // silent:true swallowing this very message.
-        tunnelError = err.message;
-        log(`public URL unavailable (${err.message}) — localhost still works; OPENZOO_NO_TUNNEL=1 hides this line`);
-      }
-    })();
-  }
-  // Expose live tunnel details so a caller that starts the proxy in-process
-  // (openzoo cursor/vscode) can surface the public URL + key instead of the
-  // user hunting for them. Getters, because the tunnel resolves ASYNC after
-  // this returns — a snapshot would always be null.
-  return {
-    server,
-    client,
-    spent: () => sessionSpent,
-    get publicUrl() { return tunnelGate?.publicUrl ?? null; },
-    get tunnelToken() { return tunnelGate?.token ?? null; },
-    get tunnelError() { return tunnelError; },
-  };
-}