openzoo 0.48.87 → 0.48.92

package/lib/info.js

@@ -33,7 +33,7 @@ function fmtUi(raw, decimals) {
  * Symbols come back wrapped (wTOKENx, wLEOSx, wUSDGx); strip the wrapper so a
  * row for the plain token the user actually holds finds its price.
  */
-async function quotedPrices() {
+export async function quotedPrices() {
   const out = {};
   try {
     // Imported here, not at module scope, matching affordableUsd below — this
@@ -244,6 +244,8 @@ export async function topUp(usdArg) {
   console.log('calls now settle against this balance instead of paying on-chain each time.');
 }
 
+export { priceHoldings, formatHoldingMoney } from './livestatus.js';
+
 /** Current prepaid credit for this wallet's namespace. */
 export async function creditBalance() {
   const { withNamespace } = await import('./namespace.js');

package/lib/livestatus.js

@@ -0,0 +1,102 @@
+/**
+ * Live turn status + stream idle timeout.
+ *
+ * A long x402 pay or a quiet SSE used to leave grokui on mute "…" dots.
+ * Callers paint ONE mutating status line (paying / waiting on model / current
+ * tool) and abort a reader that has gone silent.
+ */
+
+export const STREAM_IDLE_MS = Number(process.env.OZ_STREAM_IDLE_MS || 55_000);
+export const STALE_THINKING_MS = Number(process.env.OZ_STALE_THINKING_MS || 90_000);
+export const MODEL_WAIT_TICK_MS = 1000;
+export const MODEL_WAIT_SECONDS_AFTER_MS = 2000;
+
+const DIRECTIVE = /^(?:[ \t>*-]*)(SPAWN|SEND|PING|PEEK|WRITE|READ|EDIT|MULTIEDIT|NOTEBOOK|LS|LIST|DIR|GLOB|FIND|GREP|TODO|SERVE|FETCH|MCP|RUN):\s*(.*)$/im;
+
+export function clipStatusArg(s, n = 42) {
+  const t = String(s || '').replace(/\s+/g, ' ').trim();
+  if (!t) return '';
+  return t.length > n ? `${t.slice(0, n - 1)}…` : t;
+}
+
+export function formatModelWait(elapsedMs) {
+  const s = Math.floor(Math.max(0, Number(elapsedMs) || 0) / 1000);
+  return s >= 2 ? `waiting on model… ${s}s` : 'waiting on model…';
+}
+
+export function formatPayStatus(attempt = 0) {
+  return Number(attempt) > 0 ? 'waiting on x402…' : 'paying…';
+}
+
+export function peekDirectiveStatus(reply, runCmd) {
+  if (runCmd) return `RUN: ${clipStatusArg(runCmd)}`;
+  const raw = String(reply || '');
+  const m = DIRECTIVE.exec(raw);
+  if (!m) return '';
+  let kind = m[1].toUpperCase();
+  if (kind === 'LS' || kind === 'LIST' || kind === 'DIR' || kind === 'FIND') kind = 'GLOB';
+  const rest = clipStatusArg(m[2]);
+  return rest ? `${kind}: ${rest}` : `${kind}:`;
+}
+
+/** One-shot wait clock. Calls onStatus immediately, then every 1s with elapsed. */
+export function startModelWait(onStatus, now = Date.now) {
+  if (typeof onStatus !== 'function') return () => {};
+  const t0 = now();
+  let stopped = false;
+  const tick = () => {
+    if (stopped) return;
+    onStatus(formatModelWait(now() - t0));
+  };
+  tick();
+  const iv = setInterval(tick, MODEL_WAIT_TICK_MS);
+  iv.unref?.();
+  return () => { stopped = true; clearInterval(iv); };
+}
+
+/**
+ * On-chain holdings as money. Stables are $1 even without a quote; everything
+ * else needs tokenUsd from the chat 402 (same prices `openzoo balance` uses).
+ * A TOKEN pile that used to print as "18584 TOKEN" becomes $4.25 here.
+ */
+export function priceHoldings(snap, prices = {}) {
+  let chainUsd = 0;
+  const holdings = [];
+  for (const b of snap || []) {
+    const symbol = String(b.symbol || '');
+    const ui = Number(b.ui) || 0;
+    const key = symbol.toUpperCase();
+    const listed = prices[key] ?? prices[symbol];
+    const stable = (key === 'USDC' || key === 'USDG') ? 1 : null;
+    const tokenUsd = listed != null && Number.isFinite(Number(listed)) ? Number(listed) : stable;
+    const usd = tokenUsd != null ? ui * tokenUsd : null;
+    if (usd != null) chainUsd += usd;
+    holdings.push({ symbol, ui, chain: b.chain || 'solana', tokenUsd, usd });
+  }
+  return { chainUsd, holdings };
+}
+
+export function formatHoldingMoney(h) {
+  const qty = `${h.ui} ${h.symbol}`;
+  if (h.usd == null || !Number.isFinite(h.usd)) return qty;
+  const money = h.usd >= 0.01 || h.usd === 0 ? h.usd.toFixed(2) : h.usd.toFixed(4);
+  return `${qty}  ($${money})`;
+}
+
+export async function readWithIdleTimeout(reader, idleMs = STREAM_IDLE_MS) {
+  let to;
+  try {
+    return await Promise.race([
+      reader.read(),
+      new Promise((_, reject) => {
+        to = setTimeout(() => {
+          const err = new Error('stream idle timeout');
+          err.code = 'STREAM_IDLE';
+          reject(err);
+        }, idleMs);
+      }),
+    ]);
+  } finally {
+    clearTimeout(to);
+  }
+}

package/lib/mcp.js

@@ -8,6 +8,7 @@ import { tokenBalance } from './x402.js';
 import { askWithContext, contextCacheDisabled, BIND_MIN_CHARS } from './hrr.js';
 import { listContexts } from './contexts.js';
 import { withNamespace } from './namespace.js';
+import { subscriptionPublicView } from './subscription.js';
 
 const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
 // The model zoo_ask uses when the caller does not name one. Opus 5 by default:
@@ -383,6 +384,7 @@ export function buildMcpServer() {
       fundHint: 'send a few cents of a listed asset to the address for that rail — Solana assets to solanaAddress, Base assets to evmAddress. The shim converts to whatever the 402 quotes, at payment time. Force a rail with OPENZOO_RAIL=solana|base|robinhood.',
       balances,
       receipts: client.receipts.map((r) => ({ at: r.at, line: r.line })),
+      subscription: subscriptionPublicView(),
     });
   });
 

package/lib/pay.js

@@ -13,6 +13,7 @@ import { withNamespace } from './namespace.js';
 import {
   resolvePool, poolState, depositForShares, buildWrapInstructions, sendWrap,
 } from './wrap.js';
+import { applySubscriptionHeaders, loadSubscription, stripAuthorization } from './subscription.js';
 
 export class QuoteTooHighError extends Error {
   constructor(billedUsd, quote) {
@@ -333,8 +334,15 @@ export class PayClient {
     // Contexts are tenanted by this namespace server-side — a request without
     // it cannot see corpora this wallet bound.
     init = { ...init, headers: withNamespace(init.headers || {}) };
+    // Subscription key · no x402. A stored Stripe key is a bearer on the zoo
+    // API (same as the public /billing/done snippet). Wallet/x402 stays if
+    // there is no key, or if the gateway still answers 402.
+    const sub = loadSubscription();
+    if (sub?.key) init = { ...init, headers: applySubscriptionHeaders(init.headers, sub) };
     const first = await fetch(url, init);
-    if (first.status !== 402) return { response: first, paid: false };
+    if (first.status !== 402) {
+      return { response: first, paid: false, subscription: Boolean(sub?.key && first.ok) };
+    }
 
     const quote = parse402(await first.json());
     // config.rail (OPENZOO_RAIL) steers every front — proxy, demo, MCP — since
@@ -394,7 +402,7 @@ export class PayClient {
     onStage?.('paying');
     const response = await fetch(url, {
       ...init,
-      headers: { ...(init.headers || {}), 'X-PAYMENT': payment.header },
+      headers: { ...stripAuthorization(init.headers || {}), 'X-PAYMENT': payment.header },
     });
     const settle = decodeSettleHeader(response.headers.get('x-payment-response'))
       || { signature: payment.ownerSignature };

package/lib/podagent.mjs

@@ -22,6 +22,9 @@
 import http from 'node:http';
 import { appendFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
+import {
+  formatPayStatus, startModelWait, readWithIdleTimeout, STREAM_IDLE_MS,
+} from './livestatus.js';
 
 const PORTS = (process.env.OZ_AGENT_PORTS || '1337,6080,1340,6081')
   .split(',').map((s) => Number(s.trim())).filter(Boolean);
@@ -273,7 +276,7 @@ export function adaptiveTopK(boundItems) {
   return Math.max(16, Math.min(256, Math.ceil(Math.sqrt(n) * 2)));
 }
 
-async function postChat(body, contextId, topK) {
+async function postChat(body, contextId, topK, onStatus) {
   let r;
   for (let attempt = 0; attempt <= PAYMENT_RETRIES; attempt++) {
     r = await fetch(`${PROXY}/chat/completions`, {
@@ -291,6 +294,9 @@ async function postChat(body, contextId, topK) {
       body: JSON.stringify(body),
     });
     if (r.status !== 402 || attempt === PAYMENT_RETRIES) return r;
+    // A 402 retry used to be silent — grokui sat on mute "…" for the whole
+    // settle. Tell the watcher this attempt is paying, not wedged.
+    onStatus?.(formatPayStatus(attempt));
     await new Promise((res) => setTimeout(res, 800 * (attempt + 1)));
   }
   return r;
@@ -326,7 +332,7 @@ export async function brain(messages, contextId, modelOverride, topK) {
   messages = vision ? messages : stripImages(messages);
   const r = await postChat(
     { model, max_tokens: 4096, messages: withModelId(messages, model), plugins: [{ id: 'web' }] },
-    contextId, topK,
+    contextId, topK, undefined,
   );
   const j = await r.json().catch(() => ({}));
   const content = j?.choices?.[0]?.message?.content;
@@ -352,7 +358,7 @@ async function brainContinue(messages, sofar, contextId, modelOverride, round) {
   const r = await postChat(
     { model, max_tokens: Math.min(4096 * (2 ** (round + 1)), MAX_CONTINUE_TOKENS),
       messages: withModelId(vision ? next : stripImages(next), model), plugins: [{ id: 'web' }] },
-    contextId,
+    contextId, undefined, undefined,
   );
   const j = await r.json().catch(() => ({}));
   const more = j?.choices?.[0]?.message?.content || '';
@@ -364,15 +370,17 @@ async function brainContinue(messages, sofar, contextId, modelOverride, round) {
 
 /** Same call, but streamed — invokes onDelta(text) as tokens arrive (for a
  *  live-typing UI) and resolves with the full accumulated text at the end, so
- *  callers that need to parse a directive out of the complete reply still can. */
-export async function brainStream(messages, onDelta, contextId, modelOverride, maxTokens, round = 0, topK = 0) {
+ *  callers that need to parse a directive out of the complete reply still can.
+ *  onStatus(detail) is an optional second channel: paying / waiting on model /
+ *  thinking, so a 20–40s settle is visibly alive instead of mute dots. */
+export async function brainStream(messages, onDelta, contextId, modelOverride, maxTokens, round = 0, topK = 0, onStatus) {
   const vision = hasImages(messages);
   const model = vision ? VISION_MODEL : (modelOverride || MODEL);
   messages = vision ? messages : stripImages(messages);
   const budget = maxTokens || MAX_TOKENS;
   const r = await postChat(
     { model, max_tokens: budget, messages: withModelId(messages, model), plugins: [{ id: 'web' }], stream: true },
-    contextId, topK,
+    contextId, topK, onStatus,
   );
   if (!r.ok || !r.body) {
     // fall back to the non-streaming path rather than fail outright
@@ -384,32 +392,69 @@ export async function brainStream(messages, onDelta, contextId, modelOverride, m
   const reader = r.body.getReader();
   const decoder = new TextDecoder();
   let buf = '', full = '', reasonedChars = 0, finish = '';
-  for (;;) {
-    const { value, done } = await reader.read();
-    if (done) break;
-    buf += decoder.decode(value, { stream: true });
-    const lines = buf.split('\n');
-    buf = lines.pop(); // last line may be incomplete — keep it for next chunk
-    for (const line of lines) {
-      const s = line.trim();
-      if (!s.startsWith('data:')) continue;
-      const payload = s.slice(5).trim();
-      if (payload === '[DONE]') continue;
+  let stopWait = startModelWait(onStatus);
+  const noteThinking = () => {
+    stopWait();
+    onStatus?.('thinking…');
+  };
+  try {
+    for (;;) {
+      let chunk;
       try {
-        const c = JSON.parse(payload)?.choices?.[0];
-        const d = c?.delta;
-        // The LAST chunk carries why generation stopped. "length" means the
-        // budget ran out mid-answer — the only way to tell a finished reply
-        // from a guillotined one.
-        if (c?.finish_reason) finish = c.finish_reason;
-        if (d?.content) { full += d.content; onDelta(d.content); }
-        // Reasoning models emit their chain of thought on a SEPARATE field and
-        // only then start producing content. Count it — not to show it, but to
-        // tell "the model said nothing" apart from "the model spent its whole
-        // budget thinking and got cut off".
-        else if (d?.reasoning || d?.reasoning_content) reasonedChars += (d.reasoning || d.reasoning_content).length;
-      } catch { /* keep-alive line or partial JSON — ignore */ }
+        chunk = await readWithIdleTimeout(reader, STREAM_IDLE_MS);
+      } catch (e) {
+        if (e?.code !== 'STREAM_IDLE') throw e;
+        try { await reader.cancel(); } catch { /* already closed */ }
+        stopWait();
+        // A quiet SSE used to hang this loop forever and leave grokui on
+        // thinking / "…". Prefer what we have; if we have nothing, one
+        // non-stream retry rather than a mute bubble.
+        if (full) {
+          const note = '\n\n(stream stalled — showing what arrived before the timeout)';
+          onDelta(note);
+          return full + note;
+        }
+        onStatus?.('waiting on model…');
+        const fallback = await brain(messages, contextId, modelOverride, topK);
+        if (fallback) onDelta(fallback);
+        return fallback || '(stream timed out — no tokens arrived)';
+      }
+      const { value, done } = chunk;
+      if (done) break;
+      buf += decoder.decode(value, { stream: true });
+      const lines = buf.split('\n');
+      buf = lines.pop(); // last line may be incomplete — keep it for next chunk
+      for (const line of lines) {
+        const s = line.trim();
+        if (!s.startsWith('data:')) continue;
+        const payload = s.slice(5).trim();
+        if (payload === '[DONE]') continue;
+        try {
+          const c = JSON.parse(payload)?.choices?.[0];
+          const d = c?.delta;
+          // The LAST chunk carries why generation stopped. "length" means the
+          // budget ran out mid-answer — the only way to tell a finished reply
+          // from a guillotined one.
+          if (c?.finish_reason) finish = c.finish_reason;
+          if (d?.content) {
+            stopWait();
+            full += d.content;
+            onDelta(d.content);
+          }
+          // Reasoning models emit their chain of thought on a SEPARATE field and
+          // only then start producing content. Count it — not to show it, but to
+          // tell "the model said nothing" apart from "the model spent its whole
+          // budget thinking and got cut off". Surface "thinking…" so the wait
+          // is not mute dots.
+          else if (d?.reasoning || d?.reasoning_content) {
+            reasonedChars += (d.reasoning || d.reasoning_content).length;
+            if (!full) noteThinking();
+          }
+        } catch { /* keep-alive line or partial JSON — ignore */ }
+      }
     }
+  } finally {
+    stopWait();
   }
 
   // EMPTY CONTENT AFTER HEAVY REASONING is a truncation, not an answer. It
@@ -417,7 +462,8 @@ export async function brainStream(messages, onDelta, contextId, modelOverride, m
   // turn and explained nothing — on exactly the long, complex prompts where a
   // reasoning model thinks the most. Retry ONCE with a bigger budget.
   if (!full && reasonedChars > 0 && !maxTokens) {
-    return brainStream(messages, onDelta, contextId, modelOverride, budget * 4);
+    onStatus?.('retrying…');
+    return brainStream(messages, onDelta, contextId, modelOverride, budget * 4, round, topK, onStatus);
   }
 
   // CUT OFF MID-ANSWER. finish_reason "length" means the model had more to say
@@ -438,7 +484,7 @@ export async function brainStream(messages, onDelta, contextId, modelOverride, m
         { role: 'assistant', content: full },
         { role: 'user', content: CONTINUE_NUDGE }],
       onDelta, contextId, modelOverride,
-      Math.min(budget * 2, MAX_CONTINUE_TOKENS), round + 1,
+      Math.min(budget * 2, MAX_CONTINUE_TOKENS), round + 1, topK, onStatus,
     );
     return full + (more || '');
   }

package/lib/proxy.js

@@ -22,6 +22,10 @@ import { injectBrief } from './brief.js';
 import { withNamespace } from './namespace.js';
 import { anthropicToOpenAI, openAIToAnthropic, streamOpenAIToAnthropic, writeAnthropicSse } from './anthropic.js';
 import { responsesToChat, chatToResponses, writeResponsesSse } from './responses.js';
+import { loadSessionSpend, saveSessionSpend } from './session.js';
+import { creditBalance, quotedPrices } from './info.js';
+import { subscriptionPublicView } from './subscription.js';
+import { priceHoldings } from './livestatus.js';
 
 const HOP_BY_HOP = new Set([
   'host', 'connection', 'keep-alive', 'transfer-encoding', 'upgrade',
@@ -759,7 +763,8 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
   // lines / payment receipts there corrupts that program's output (observed: the
   // Solana receipt leaking into the Claude Code CLI). When silent, route this
   // channel to a log file instead; only print to the console when we own it.
-  let paidCalls = 0;
+  const restored = loadSessionSpend();
+  let paidCalls = restored.paidCalls;
   let sayFile = null;
   if (silent) {
     try {
@@ -775,9 +780,16 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     if (sayFile) { try { appendFileSync(sayFile, line + '\n'); return; } catch { /* fall through */ } }
     console.log(line);
   };
-  let sessionSpent = 0;
-  let sessionCogs = 0;
-  let sessionDirect = 0;
+  let sessionSpent = restored.spentUsd;
+  let sessionCogs = restored.cogsUsd;
+  let sessionDirect = restored.directUsd;
+  const rememberSpend = () => {
+    saveSessionSpend({ spentUsd: sessionSpent, cogsUsd: sessionCogs, directUsd: sessionDirect, paidCalls });
+  };
+  if (restored.ok && (sessionSpent > 0 || paidCalls > 0)) {
+    say(`session restored: $${sessionSpent.toFixed(6)} � ${paidCalls} paid call${paidCalls === 1 ? '' : 's'}`);
+  }
+  process.on('exit', rememberSpend);
   const MARKUP = 3; // confirmed constant, see .claude/wiki.md "Margin needs a like-for-like denominator"
   let tunnelSpent = 0;
   // Live balance refresh state — the real implementation is assigned in the
@@ -836,14 +848,31 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
   // latency to the thing it is describing.
   let creditUsd = null;
   let creditAt = 0;
-  const refreshCredit = () => {
-    if (Date.now() - creditAt < 20000) return;
-    creditAt = Date.now();
-    fetch(`${config.apiBase}/v1/credits`, { headers: withNamespace({}), signal: AbortSignal.timeout(4000) })
-      .then((r) => r.json())
-      .then((j) => { creditUsd = Number(j.balanceUsd) || 0; })
-      .catch(() => { /* advisory only */ });
+  let creditInflight = null;
+  let lastPrices = {};
+  let pricesAt = 0;
+  const refreshCredit = async (force = false) => {
+    if (!force && Date.now() - creditAt < 20000 && creditUsd != null) return creditUsd;
+    if (creditInflight) return creditInflight;
+    creditInflight = (async () => {
+      try {
+        creditUsd = await creditBalance();
+        creditAt = Date.now();
+      } catch { /* keep last known */ }
+      creditInflight = null;
+      return creditUsd;
+    })();
+    return creditInflight;
   };
+  const refreshPrices = async () => {
+    if (Date.now() - pricesAt < 60000 && Object.keys(lastPrices).length) return lastPrices;
+    try {
+      lastPrices = await quotedPrices();
+      pricesAt = Date.now();
+    } catch { /* keep last */ }
+    return lastPrices;
+  };
+  const walletMoney = () => priceHoldings(lastSnap || [], lastPrices);
   let tunnelError = null;
 
   const server = http.createServer(async (req, res) => {
@@ -856,9 +885,15 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     // whichever surface happens to be asking. Local-only, no auth needed:
     // it's a number, not a capability.
     if (req.method === 'GET' && (req.url || '').split('?')[0] === '/v1/session') {
-      refreshCredit();
+      await refreshCredit();
+      refreshPrices();
+      const money = walletMoney();
       res.writeHead(200, { 'content-type': 'application/json' });
-      res.end(JSON.stringify({ spentUsd: sessionSpent, cogsUsd: sessionCogs, directUsd: sessionDirect, paidCalls, creditUsd }));
+      res.end(JSON.stringify({
+        spentUsd: sessionSpent, cogsUsd: sessionCogs, directUsd: sessionDirect, paidCalls,
+        creditUsd, chainUsd: money.chainUsd,
+        subscription: subscriptionPublicView(),
+      }));
       return;
     }
 
@@ -866,6 +901,9 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     // grokui error path, in particular) can print REAL funding instructions
     // inline instead of telling the user to go look somewhere else.
     if (req.method === 'GET' && (req.url || '').split('?')[0] === '/v1/wallet') {
+      await refreshCredit();
+      await refreshPrices();
+      const money = walletMoney();
       res.writeHead(200, { 'content-type': 'application/json' });
       res.end(JSON.stringify({
         solana: client.address,
@@ -876,6 +914,9 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
         balances: balanceLine(lastSnap || []) || null,
         funded: (lastSnap || []).some((b) => b.ui > 0),
         creditUsd,
+        chainUsd: money.chainUsd,
+        holdings: money.holdings,
+        subscription: subscriptionPublicView(),
       }));
       return;
     }
@@ -983,7 +1024,9 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
           },
           mcp: `${self.replace(/\/v1$/, '')}/mcp`,
           upstream: config.apiBase,
-          payment: 'x402 per request from the operator\'s local burner wallet — no API key, no account',
+          payment: subscriptionPublicView().active
+            ? 'subscription key � no x402 � wallet/x402 remains the other method'
+            : 'x402 per request from the operator\'s local burner wallet � no API key, no account',
           auth: viaTunnel
             ? 'this public URL requires the oz_… bearer for paid endpoints; /v1/models and /v1/hrr/bind are free'
             : 'localhost is keyless',
@@ -1504,6 +1547,7 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
         // an OSC escape, which updates the window/tab title without touching the
         // TUI's content. `openzoo ◝ $0.0042 · 12 calls` in the title bar, live.
         if (receipt.ok && typeof receipt.billedUsd === 'number') { paidCalls += 1; }
+        if (receipt.ok && typeof receipt.billedUsd === 'number') rememberSpend();
         if (sayFile) {
           try { process.stderr.write(`]0;openzoo ◝ $${sessionSpent.toFixed(4)} · ${paidCalls} call${paidCalls === 1 ? '' : 's'}`); } catch { /* no tty */ }
         }
@@ -1563,6 +1607,7 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
           }
           paidCalls += 1;
           if (viaTunnel) tunnelSpent += x.billedUsd;
+          rememberSpend();
           say(`credit -> $${x.billedUsd.toFixed(6)}  ·  session $${sessionSpent.toFixed(6)}`);
         }
         if (data?.object === 'chat.completion') {
@@ -1619,6 +1664,7 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
         }
         paidCalls += 1;
         if (viaTunnel) tunnelSpent += x.billedUsd;
+        rememberSpend();
         say(`credit -> $${x.billedUsd.toFixed(6)}  ·  session $${sessionSpent.toFixed(6)}`);
       };
 
@@ -1793,6 +1839,8 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
         console.log(`fund it: ${fundingLine('the address above')} — a few cents goes a long way.`);
       }
     } catch { /* RPC hiccup: balance is advisory */ }
+    refreshCredit();
+    refreshPrices();
     // LIVE REFRESH: the startup line goes stale the moment a call settles or
     // the user funds mid-session. Poll on an interval (and shortly after each
     // paid call), print ONLY on change, and call out arrivals explicitly so

package/lib/session.js

@@ -0,0 +1,58 @@
+/**
+ * Durable proxy-session spend. The HUD's /v1/session counters used to live
+ * only in RAM, so launching a fresh openzoo on :8402 (opening the desktop
+ * app, ensureProxy, a crash) reset spent/cogs/direct/paidCalls to $0 even
+ * though ~/.openzoo/proxy.log still showed a real session.
+ *
+ * Same home as the wallet and corpus ledger: ~/.openzoo/session.json.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+export function sessionSpendFile(home = os.homedir()) {
+  return process.env.OPENZOO_SESSION_PATH
+    || path.join(home, '.openzoo', 'session.json');
+}
+
+const EMPTY = { spentUsd: 0, cogsUsd: 0, directUsd: 0, paidCalls: 0 };
+
+function num(v) {
+  const n = Number(v);
+  return Number.isFinite(n) && n >= 0 ? n : 0;
+}
+
+export function loadSessionSpend(file = sessionSpendFile()) {
+  let raw;
+  try { raw = fs.readFileSync(file, 'utf8'); }
+  catch { return { ...EMPTY, ok: false, reason: 'missing' }; }
+  let data;
+  try { data = JSON.parse(raw); }
+  catch { return { ...EMPTY, ok: false, reason: 'corrupt' }; }
+  return {
+    spentUsd: num(data.spentUsd),
+    cogsUsd: num(data.cogsUsd),
+    directUsd: num(data.directUsd),
+    paidCalls: Math.floor(num(data.paidCalls)),
+    ok: true,
+  };
+}
+
+export function saveSessionSpend(stats, file = sessionSpendFile()) {
+  const payload = {
+    spentUsd: num(stats?.spentUsd),
+    cogsUsd: num(stats?.cogsUsd),
+    directUsd: num(stats?.directUsd),
+    paidCalls: Math.floor(num(stats?.paidCalls)),
+    updatedAt: Date.now(),
+  };
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const tmp = `${file}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(payload), { mode: 0o600 });
+    fs.renameSync(tmp, file);
+    return true;
+  } catch {
+    return false;
+  }
+}