npm - openzoo - Versions diffs - 0.48.84 → 0.48.86 - Mend

openzoo 0.48.84 → 0.48.86

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/lib/grokui.mjs CHANGED Viewed

@@ -5,7 +5,7 @@
 // own independent agent (and that agent can spawn further threads too) —
 // reusing the same SPAWN/SEND pattern podagent.mjs built for shell delegation,
 // adapted here for plain chat.
-import { exec, execFile } from 'node:child_process';
+import { exec } from 'node:child_process';
 import http from 'node:http';
 import { randomUUID } from 'node:crypto';
 import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
@@ -2495,7 +2495,7 @@ const APP_HTML = `<!doctype html>
   }
   @keyframes twarnpulse { 0%,100% { opacity: 1; } 50% { opacity: .45; } }
   @media (prefers-reduced-motion: reduce) { .twarn { animation: none; } }
-  #main { flex: 1; min-width: 0; display: flex; flex-direction: column; height: 100vh; }
+  #main { position: relative; flex: 1; min-width: 0; display: flex; flex-direction: column; height: 100vh; }
   #chatHeader { padding: 14px 20px; border-bottom: 1px solid #1c1c1e; display: flex; align-items: center;
                 flex-wrap: wrap; gap: 8px 10px; font-weight: 600; }
   #chatHeader .tavatar { width: 26px; height: 26px; border-radius: 7px; font-size: 11px; flex: 0 0 26px; }
@@ -2537,9 +2537,9 @@ const APP_HTML = `<!doctype html>
      whose entire premise is that the box pays for itself. Click-to-copy is a
      shortcut; the address is selectable so Cmd/Ctrl+C still works if copy
      fails. */
-  #walletOverlay, #assetsOverlay { position: fixed; inset: 0; background: rgba(0,0,0,.66); z-index: 1200;
+  #walletOverlay { position: fixed; inset: 0; background: rgba(0,0,0,.66); z-index: 1200;
                    display: none; align-items: center; justify-content: center; padding: 24px; }
-  #walletOverlay.show, #assetsOverlay.show { display: flex; }
+  #walletOverlay.show { display: flex; }
   #walletBox { width: 100%; max-width: 560px; max-height: 82vh; overflow-y: auto; background: #111113;
                border: 1px solid #2c2c2e; border-radius: 16px; padding: 20px 22px; }
   #walletBox h3 { margin: 0 0 2px; font-size: 15px; font-weight: 600; }
@@ -2561,16 +2561,6 @@ const APP_HTML = `<!doctype html>
           font-size: 12px; color: #ececec; line-height: 1.7; word-break: break-word; }
   .wnote { color: #6f7080; font-size: 11px; line-height: 1.6; margin-top: 12px; }
   .wempty { color: #f28c4d; }
-  /* The passphrase field. type=password so it never renders in clear, and
-     autocomplete off so a browser is not tempted to remember a key that
-     unlocks a public blob. */
-  .wpass { width: 100%; margin-top: 4px; padding: 9px 12px; background: #0d0d0f; color: #ececec;
-           border: 1px solid #2c2c2e; border-radius: 10px; font: inherit; font-size: 13px;
-           font-family: ui-monospace, SFMono-Regular, Menlo, monospace; letter-spacing: .12em; }
-  .wpass:focus { outline: none; border-color: #6ab0ff; }
-  .wgo { margin-top: 10px; width: 100%; padding: 9px; border: 0; border-radius: 10px;
-         background: #b8f240; color: #000; font: inherit; font-weight: 600; cursor: pointer; }
-  .wgo[disabled] { background: #2c2c2e; color: #6f7080; cursor: default; }
   /* Slash autocomplete. Anchored above the composer because the composer sits
      at the bottom of the viewport — a dropdown BELOW it would render off
      screen. */
@@ -2585,7 +2575,11 @@ const APP_HTML = `<!doctype html>
   .scmd i { color: #6f7080; font-style: normal; font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
   .scmd span { color: #999aa8; margin-left: auto; text-align: right; }
   #hudBtn { margin-left: 2px; }
-  #hud { position: fixed; top: 40px; right: 14px; width: 250px; background: rgba(14,14,17,.94);
+  /* Below #chatHeader, not a hardcoded 40px — the header wraps, so 40px lands
+     inside the dials (race / wallet / ◎) once they take a second row. top is
+     set from the header's live bottom in placeHud(). z-index stays high; the
+     bug was geometry, not stacking. */
+  #hud { position: absolute; right: 14px; width: 250px; background: rgba(14,14,17,.94);
          border: 1px solid #333340; border-radius: 10px; padding: 12px 14px; font: 11px/1.5 Menlo, monospace;
          display: none; z-index: 300; box-shadow: 0 12px 30px rgba(0,0,0,.5); }
   #hud.show { display: block; }
@@ -2602,8 +2596,8 @@ const APP_HTML = `<!doctype html>
                 color: #f0c9a8; font-size: 10.5px; line-height: 1.45; }
   #hud .hhint.show { display: block; }
   #hud .hhint b { color: #f28c4d; font-weight: 600; }
-  #sidebar, #main, #walletOverlay, #assetsOverlay, #composeOverlay,
-  #inp, #search, #composeInp, .wpass, .bubble, .md-pre, .runoutput, .runcmd {
+  #sidebar, #main, #walletOverlay, #composeOverlay,
+  #inp, #search, #composeInp, .bubble, .md-pre, .runoutput, .runcmd {
     -webkit-app-region: no-drag; }
   #log { flex: 1; min-width: 0; overflow-y: auto; overflow-x: hidden; padding: 20px 24px 12px;
          display: flex; flex-direction: column; gap: 6px;
@@ -2800,16 +2794,6 @@ const APP_HTML = `<!doctype html>
       <div id="composeFoot"><span><kbd>Tab</kbd> add</span><span><kbd>Enter</kbd> open</span></div>
     </div>
   </div>
-  <div id="assetsOverlay" data-component="assets-modal">
-    <div id="walletBox">
-      <h3>Unlock baked assets</h3>
-      <div class="wsub">ProofFront ships encrypted inside this box's image. Your passphrase decrypts it here; it is never stored.</div>
-      <input class="wpass" id="assetsPass" type="password" autocomplete="off" spellcheck="false" placeholder="passphrase">
-      <button class="wgo" id="assetsGo" data-testid="assets-decrypt">decrypt</button>
-      <div class="wnote" id="assetsMsg"></div>
-      <div class="wnote">Once unlocked the files are served like anything else in the workspace, and this box's :8080 has no authentication — the lock protects the public image, not a running box whose id someone knows.</div>
-    </div>
-  </div>
   <div id="walletOverlay" data-component="wallet-modal">
     <div id="walletBox">
       <h3>Your wallet</h3>
@@ -2848,8 +2832,6 @@ const APP_HTML = `<!doctype html>
           <option value="4 4">best 4 of 4</option>
         </optgroup>
       </select>
-      <button class="dial" id="assetsBtn" data-component="assets-unlock"
-              title="Unlock the encrypted assets baked into this box's image">assets</button>
       <button class="dial" id="walletBtn" data-component="wallet-open"
               title="Your local burner wallet — deposit addresses and live balances">wallet</button>
       <button class="icon-btn" id="reloadBtn" title="Restart grokui on this box">&#8635;</button>
@@ -2858,6 +2840,7 @@ const APP_HTML = `<!doctype html>
     </div>
     <div id="hud">
       <div class="htitle">YOUR WALLET · THIS SESSION</div>
+      <div class="hrow"><span>prepaid credit</span><span id="hCredit" class="hlime">—</span></div>
       <div class="hrow"><span>you've paid</span><span id="hYouSpent">—</span></div>
       <div class="hrow"><span>our cost (cogs)</span><span id="hYouCogs">—</span></div>
       <div class="hrow"><span>margin</span><span id="hYouMargin" class="hlime">—</span></div>
@@ -3150,6 +3133,15 @@ const APP_HTML = `<!doctype html>
       walletBody.appendChild(p);
       return;
     }
+    if (w.creditUsd != null && w.creditUsd !== '') {
+      const c = document.createElement('div');
+      c.className = 'wbal';
+      c.style.color = '#b8f240';
+      c.style.fontSize = '18px';
+      c.style.fontWeight = '700';
+      c.textContent = 'Prepaid credit  $' + (Number(w.creditUsd) || 0).toFixed(2);
+      walletBody.appendChild(c);
+    }
     if (w.solana) walletBody.appendChild(walletRow('Solana', w.solana));
     if (w.evm) walletBody.appendChild(walletRow('Base / RH', w.evm));
     if (w.balances) {
@@ -3169,53 +3161,6 @@ const APP_HTML = `<!doctype html>
     if (w.funded === false) note.classList.add('wempty');
     if (note.textContent.trim()) walletBody.appendChild(note);
   }
-  // ASSETS UNLOCK. The passphrase lives in the input and in one fetch body and
-  // nowhere else — not in a variable that outlives the call, not in
-  // localStorage, and the field is cleared the moment it succeeds.
-  const assetsOverlay = document.getElementById('assetsOverlay');
-  const assetsPass = document.getElementById('assetsPass');
-  const assetsGo = document.getElementById('assetsGo');
-  const assetsMsg = document.getElementById('assetsMsg');
-  async function unlockAssets() {
-    const pass = assetsPass.value;
-    if (!pass) { assetsMsg.textContent = 'enter the passphrase'; return; }
-    assetsGo.disabled = true;
-    assetsGo.textContent = 'decrypting…';
-    assetsMsg.textContent = 'this takes a minute — 800MB';
-    try {
-      const r = await fetch(API + '/decrypt-assets', {
-        method: 'POST', headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ pass }),
-      });
-      const j = await r.json().catch(() => ({}));
-      if (j.ok) {
-        assetsPass.value = '';   // do not leave it sitting in the DOM
-        assetsMsg.textContent = j.already ? 'already unlocked' : ('unlocked — ' + j.files + ' files in /workspace/prooffront');
-        assetsMsg.className = 'wnote';
-      } else {
-        assetsMsg.textContent = j.error || ('failed (HTTP ' + r.status + ')');
-        assetsMsg.className = 'wnote wempty';
-      }
-    } catch (e) {
-      assetsMsg.textContent = 'could not reach the box';
-      assetsMsg.className = 'wnote wempty';
-    }
-    assetsGo.disabled = false;
-    assetsGo.textContent = 'decrypt';
-  }
-  assetsGo.addEventListener('click', unlockAssets);
-  assetsPass.addEventListener('keydown', (e) => { if (e.key === 'Enter') unlockAssets(); });
-  document.getElementById('assetsBtn').addEventListener('click', () => {
-    assetsOverlay.classList.add('show');
-    assetsMsg.textContent = '';
-    assetsMsg.className = 'wnote';
-    requestAnimationFrame(() => { try { assetsPass.focus(); } catch (e) {} });
-  });
-  assetsOverlay.addEventListener('click', (e) => {
-    // Clear on dismiss so a passphrase never lingers behind a closed modal.
-    if (e.target === assetsOverlay) { assetsPass.value = ''; assetsOverlay.classList.remove('show'); }
-  });
   document.getElementById('walletBtn').addEventListener('click', openWallet);
   // First launch: if the burner is empty, open the wallet once so they see
   // addresses they can copy — and whose wallet this is. localStorage so a
@@ -3245,7 +3190,6 @@ const APP_HTML = `<!doctype html>
   });
   document.addEventListener('keydown', (e) => {
     if (e.key === 'Escape' && walletOverlay.classList.contains('show')) walletOverlay.classList.remove('show');
-    if (e.key === 'Escape' && assetsOverlay.classList.contains('show')) { assetsPass.value = ''; assetsOverlay.classList.remove('show'); }
   });
   document.getElementById('tierSel').addEventListener('change', (e) => setDial('tier', e.target.value));
@@ -3984,6 +3928,16 @@ const APP_HTML = `<!doctype html>
   const hudBtn = document.getElementById('hudBtn');
   const hud = document.getElementById('hud');
+  const chatHeader = document.getElementById('chatHeader');
+  const mainEl = document.getElementById('main');
+  // Pin the cost card just under the header. #chatHeader wraps, so a fixed
+  // 40px sat on top of the spend dials. Measure the live bottom each time
+  // it opens or the header changes height.
+  function placeHud() {
+    if (!hud || !chatHeader || !mainEl) return;
+    const top = chatHeader.getBoundingClientRect().bottom - mainEl.getBoundingClientRect().top + 8;
+    hud.style.top = Math.max(8, Math.round(top)) + 'px';
+  }
   function usd(n) {
     if (n === null || n === undefined) return '—';
     if (n === 0) return '$0';
@@ -3996,6 +3950,8 @@ const APP_HTML = `<!doctype html>
       // straight to localhost:8402 would work fine, but routing it through
       // our own backend keeps one fetch path if that ever needs to change.
       const you = await (await fetch(API + '/hud-summary')).json();
+      const creditEl = document.getElementById('hCredit');
+      if (creditEl) creditEl.textContent = (you.creditUsd == null) ? '—' : usd(Number(you.creditUsd) || 0);
       const spent = Number(you.spentUsd) || 0;
       const cogs = Number(you.cogsUsd) || 0;
       const direct = Number(you.directUsd) || 0;
@@ -4039,12 +3995,17 @@ const APP_HTML = `<!doctype html>
     e.stopPropagation();
     hud.classList.toggle('show');
     if (hud.classList.contains('show')) {
+      placeHud();
       refreshHud();
       hudTimer = setInterval(refreshHud, 30000);
     } else if (hudTimer) {
       clearInterval(hudTimer); hudTimer = null;
     }
   });
+  window.addEventListener('resize', () => { if (hud.classList.contains('show')) placeHud(); });
+  if (typeof ResizeObserver !== 'undefined' && chatHeader) {
+    new ResizeObserver(() => { if (hud.classList.contains('show')) placeHud(); }).observe(chatHeader);
+  }
   document.addEventListener('click', (e) => { if (!hud.contains(e.target)) hud.classList.remove('show'); });
 </script>
 </body></html>`;
@@ -4059,55 +4020,16 @@ const server = http.createServer((req, res) => {
       let w = { error: 'proxy unreachable' };
       try { w = await (await fetch(`${PROXY}/wallet`)).json(); }
       catch { /* proxy not up yet — say so rather than render an empty modal */ }
+      try {
+        const { creditBalance } = await import('./info.js');
+        w.creditUsd = await creditBalance();
+      } catch { /* leave credit off if the gateway is down */ }
       res.writeHead(200, { 'content-type': 'application/json' });
       res.end(JSON.stringify(w));
     })();
     return;
   }
-  // UNLOCK THE BAKED ASSETS. The image ships ProofFront as ciphertext; this is
-  // where the operator supplies the passphrase that opens it.
-  //
-  // The passphrase is used and dropped: passed to openssl via an ENV VAR (never
-  // argv — a command line is world-readable in /proc), never written to disk,
-  // never logged, never stored on the thread. A wrong one is reported as wrong
-  // and nothing else happens.
-  //
-  // SAY WHAT THIS DOES: once decrypted the files are served by /api/files and
-  // /site like anything else in the workspace, and :8080 has no authentication.
-  // The lock protects the IMAGE, which is public. It does not protect a running
-  // box from anyone who knows its pod id.
-  if (req.method === 'POST' && req.url === '/decrypt-assets') {
-    const chunks = [];
-    req.on('data', (d) => chunks.push(d));
-    req.on('end', () => {
-      let pass = '';
-      try { pass = String(JSON.parse(Buffer.concat(chunks).toString('utf8')).pass || ''); } catch { /* ignore */ }
-      const done = (code, obj) => { res.writeHead(code, { 'content-type': 'application/json' }); res.end(JSON.stringify(obj)); };
-      if (!pass) return done(400, { ok: false, error: 'no passphrase' });
-      if (!existsSync('/opt/prooffront.enc')) return done(404, { ok: false, error: 'this image has no encrypted assets baked in' });
-      if (existsSync('/workspace/prooffront')) return done(200, { ok: true, already: true, note: 'already unlocked' });
-      // Same shape as box-boot: decrypt to temp, verify it is really a zip,
-      // then unpack and swap. Never unzip unverified plaintext into /workspace.
-      const script = 'set -e; '
-        + 'openssl enc -d -aes-256-cbc -pbkdf2 -iter 600000 -in /opt/prooffront.enc -out /tmp/pf.zip -pass env:OZ_PF_PASS 2>/dev/null; '
-        + 'head -c 2 /tmp/pf.zip | grep -q PK; '
-        + 'rm -rf /workspace/.pf.tmp; mkdir -p /workspace/.pf.tmp; '
-        + 'unzip -q /tmp/pf.zip -d /workspace/.pf.tmp; '
-        + 'mv /workspace/.pf.tmp /workspace/prooffront; '
-        + 'rm -f /tmp/pf.zip; '
-        + 'find /workspace/prooffront -type f | wc -l';
-      execFile('bash', ['-lc', script], { env: { ...process.env, OZ_PF_PASS: pass }, timeout: 600000, maxBuffer: 1 << 20 },
-        (err, stdout) => {
-          // Wipe the copy we were handed as soon as openssl is done with it.
-          pass = '';
-          if (err) return done(200, { ok: false, error: 'wrong passphrase, or the blob is corrupt' });
-          done(200, { ok: true, files: Number(String(stdout).trim()) || 0 });
-        });
-    });
-    return;
-  }
   // Restart grokui in place — and ACTUALLY PICK UP THE NEW BUILD.
   //
   // Exiting is the restart: on a production box, box-server's ensureOz() poll
@@ -4157,9 +4079,13 @@ const server = http.createServer((req, res) => {
   if (req.method === 'GET' && req.url === '/hud-summary') {
     (async () => {
-      let you = { spentUsd: 0, cogsUsd: 0, directUsd: 0, paidCalls: 0 };
-      try { you = await (await fetch('http://127.0.0.1:8402/v1/session')).json(); }
+      let you = { spentUsd: 0, cogsUsd: 0, directUsd: 0, paidCalls: 0, creditUsd: null };
+      try { you = { ...you, ...(await (await fetch('http://127.0.0.1:8402/v1/session')).json()) }; }
       catch { /* local proxy not running — HUD shows zeros rather than guessing */ }
+      try {
+        const { creditBalance } = await import('./info.js');
+        you.creditUsd = await creditBalance();
+      } catch { /* credit is advisory */ }
       res.writeHead(200, { 'content-type': 'application/json' });
       res.end(JSON.stringify(you));
     })();

package/lib/proxy.js CHANGED Viewed

@@ -856,8 +856,9 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     // whichever surface happens to be asking. Local-only, no auth needed:
     // it's a number, not a capability.
     if (req.method === 'GET' && (req.url || '').split('?')[0] === '/v1/session') {
+      refreshCredit();
       res.writeHead(200, { 'content-type': 'application/json' });
-      res.end(JSON.stringify({ spentUsd: sessionSpent, cogsUsd: sessionCogs, directUsd: sessionDirect, paidCalls }));
+      res.end(JSON.stringify({ spentUsd: sessionSpent, cogsUsd: sessionCogs, directUsd: sessionDirect, paidCalls, creditUsd }));
       return;
     }
@@ -874,6 +875,7 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
         // caller can tell a genuinely empty wallet from a transient 402
         balances: balanceLine(lastSnap || []) || null,
         funded: (lastSnap || []).some((b) => b.ui > 0),
+        creditUsd,
       }));
       return;
     }

package/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "name": "openzoo",
-  "version": "0.48.84",
-  "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
+  "version": "0.48.86",
+  "description": "Local x402-paying proxy + MCP server for openzoo.fun \u2014 point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",
   "bin": {