openzoo 0.49.11 → 0.49.13

package/bin/openzoo.js

@@ -103,6 +103,8 @@ usage:
   npx openzoo vscode [path]   same, for VS Code
   npx openzoo editor [path]   whichever is installed (Cursor wins if both)
   npx openzoo claude [dir]        Claude Code CLI on the zoo (x402 per turn); --desktop for the app
+  npx openzoo xbot                @openzoobot on X: 1 free question per account, then x402
+                                    --once (single poll) --dry-run (answer, do not post)
                                           by default, --terminal for the Claude Code CLI
   npx openzoo launch <cmd> [args]   launch a TERMINAL Messages API client
                                     (claude, aider...) already pointed at the zoo
@@ -117,6 +119,11 @@ usage:
                               and launches Grok Bot with Node TLS override (sudo required;
                               ctrl-c restores /etc/hosts).
                               --no-takeover plain launch · --no-launch config only
+  npx openzoo openclaw   write the zoo into ~/.openclaw/openclaw.json as a model
+                         provider WITH REAL PRICES (OpenClaw's own custom-provider
+                         path hard-codes $0.00 and ignores /v1/models pricing)
+                         --all (whole catalog) --models a,b (exact ids)
+                         --default <id> (set the agents' primary model)
   npx openzoo mcp        stdio MCP server (tools: zoo_ask, zoo_bind, zoo_models, zoo_wallet, zoo_contexts)
   npx openzoo unblock    restore the editor's own backend in the hosts file
   npx openzoo tunnel     public-url-only mode (everything key-gated, no keyless localhost)
@@ -172,9 +179,21 @@ async function main() {
       // is enough; no patching of the app bundle.
       await (await import('../lib/grokcli.js')).setupGrokBot(process.argv.slice(3));
       break;
+    case 'openclaw':
+      await (await import('../lib/openclaw.js')).setupOpenClaw(process.argv.slice(3));
+      break;
     case 'mcp':
       await (await import('../lib/mcp.js')).startMcp();
       break;
+    case 'xbot': {
+      const rest = process.argv.slice(3);
+      await (await import('../lib/xbot.js')).runXBot({
+        once: rest.includes('--once'),
+        dryRun: rest.includes('--dry-run'),
+        seed: rest.includes('--seed'),
+      });
+      break;
+    }
     case 'claude':
       await (await import('../lib/launch.js')).launchClaude(process.argv.slice(3));
       break;

package/lib/launch.js

@@ -280,18 +280,22 @@ export async function launchClaude(argv) {
 
   if (terminal) {
     const rejected = [];
-    const cli = resolveClaudeCli(process.env, rejected);
+    let cli = resolveClaudeCli(process.env, rejected);
+    if (!cli && rejected.length) {
+      // THE FORMAT CHECK IS A TIE-BREAKER, NOT A VETO.
+      //
+      // isRunnableExecutable() knows four magics. Something legitimate that it
+      // has never seen — a packaging format we did not anticipate — would be
+      // refused here even though the OS would have run it happily, and we would
+      // have told the user to reinstall a CLI that was fine. When there is a
+      // real alternative the check earns its keep by preferring the good file;
+      // when this is the ONLY candidate, defer to the kernel and let the spawn
+      // below decide. A wrong heuristic must never be the sole reason we refuse.
+      cli = rejected[0];
+      console.error(`openzoo: ${cli} does not look like a runnable executable — trying it anyway.`);
+    }
     if (!cli) {
-      if (rejected.length) {
-        // Found it, could not run it. Say so — "not found on PATH" is a lie
-        // here and sends the user off to reinstall something they already have.
-        console.error('openzoo: found `claude` but it is not a runnable executable:');
-        for (const f of rejected) console.error(`         ${f}`);
-        console.error('         (no shebang and no binary magic — usually a truncated or half-finished install)');
-        console.error('         fix: reinstall Claude Code, or delete the broken file so another copy on PATH is used.');
-      } else {
-        console.error('openzoo: `claude` CLI not found on PATH — install Claude Code, or drop --terminal for the desktop app');
-      }
+      console.error('openzoo: `claude` CLI not found on PATH — install Claude Code, or drop --terminal for the desktop app');
       process.exit(1);
     }
     // ALWAYS-ON HUD via Claude Code's NATIVE status line (the title bar is owned
@@ -422,9 +426,11 @@ export async function launchClaude(argv) {
       try { restoreStatus?.(); } catch { /* ignore */ }
       console.error(`openzoo: cannot execute ${cli} (${e?.code || e?.message})`);
       console.error('         it is marked executable but the OS refused to run it.');
-      console.error(`         check: head -1 ${cli}   and   file ${cli}`);
+      console.error(`         check:  file ${cli}`);
+      console.error(`                 head -c 2 ${cli} | xxd     # a healthy script starts 2321 ("#!")`);
       console.error('         usually a truncated install, a wrong-architecture binary,');
       console.error('         or a shebang pointing at an interpreter that no longer exists.');
+      console.error('         fix:    npm i -g @anthropic-ai/claude-code');
       process.exit(1);
     }
     child.on('exit', (c) => { try { restoreStatus?.(); } catch { /* ignore */ } process.exit(c ?? 0); });

package/lib/namespace.js

@@ -66,11 +66,11 @@ import { loadOrCreateWallet } from './wallet.js';
  */
 export const STACC_NAMESPACE = 'stacc';
 
-export function namespaceHeaderValue() {
+export function namespaceHeaderValue(wallet) {
   try {
     // Still require a wallet: the namespace is meaningless without a signer to
     // prove it, and sending one unsigned drops you into the SHARED tenant.
-    loadOrCreateWallet();
+    if (!wallet?.keypair) loadOrCreateWallet();
     return STACC_NAMESPACE;
   } catch {
     return ''; // no wallet (read-only use): fall back to the shared tenant
@@ -96,8 +96,14 @@ export function namespaceHeaderValue() {
  */
 const PKCS8_ED25519_PREFIX = Buffer.from('302e020100300506032b657004220420', 'hex');
 
-function signNamespace(namespace) {
-  const w = loadOrCreateWallet();
+function signNamespace(namespace, wallet) {
+  // SIGN WITH THE WALLET THAT IS PAYING, not with whatever this machine owns.
+  // The gateway derives the tenant from the PROVEN signer, and credit is held
+  // per tenant — so signing every burner's request with the operator's machine
+  // key put all of them in the operator's tenant and let them spend the
+  // operator's gateway credit. MEASURED: an empty burner got `paid: "credit"`
+  // and a 200, with no 402 ever issued.
+  const w = wallet?.keypair ? wallet : loadOrCreateWallet();
   const timestamp = String(Date.now());
   // Node has no raw-ed25519 signer, but it will build one from a PKCS8 DER
   // wrapper around the 32-byte seed (a Solana secretKey is seed||pubkey).
@@ -113,13 +119,13 @@ function signNamespace(namespace) {
 }
 
 /** Merge the namespace header — and its proof — into any headers object. */
-export function withNamespace(headers = {}) {
-  const ns = namespaceHeaderValue();
+export function withNamespace(headers = {}, wallet) {
+  const ns = namespaceHeaderValue(wallet);
   if (!ns) return headers;
   // No unsigned fallback. The gateway REQUIRES the signature, so a bare
   // namespace buys nothing — it would just be silently demoted to the shared
   // tenant, which looks like "my corpus vanished" instead of a clear failure.
-  return { ...headers, 'x-openzoo-namespace': ns, ...signNamespace(ns) };
+  return { ...headers, 'x-openzoo-namespace': ns, ...signNamespace(ns, wallet) };
 }
 
 // Bitcoin-alphabet base58, matching what the gateway's bs58 decode expects.

package/lib/openclaw.js

@@ -0,0 +1,196 @@
+/**
+ * `npx openzoo openclaw` — write the zoo into OpenClaw's config WITH REAL
+ * PRICES, because OpenClaw will never learn them from the wire.
+ *
+ * MEASURED, on OpenClaw 2026.7.1-2: its custom-provider discovery hard-codes
+ * `cost: {input:0, output:0, ...}` (SELF_HOSTED_DEFAULT_COST in
+ * provider-self-hosted-setup) and ignores both the OpenRouter-style `pricing`
+ * field our /v1/models already serves and any per-response usage cost. Its
+ * cost panel prices turns purely from the `cost` block in
+ * ~/.openclaw/openclaw.json — so a hand-added provider shows $0.00 forever.
+ * The OpenRouter pricing parser it DOES have (parseOpenRouterPricing,
+ * value * 1e6 → USD per Mtok) is wired only to the first-party OpenRouter
+ * provider. Hence this command: fetch the live catalog, convert
+ * pricing.prompt/completion (USD/token) into OpenClaw's USD/Mtok `cost`
+ * blocks, and merge the provider into the config file ourselves.
+ *
+ * The written numbers are the CEILING (openrouter-direct basis): the gateway
+ * charges at most this, less with trailing volume and leCore context reuse.
+ * A client-side estimate can only be honest-or-high; receipts on the proxy
+ * console stay the ground truth.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { config } from './config.js';
+import { fetchHeaders } from './fetch.js';
+import {
+  quoteableRows, pickClaudePickerRows, displayNameFor, tokenPricePair, isAutoModel,
+} from './models.js';
+
+export const PROVIDER_KEY = 'openzoo';
+
+/** ~/.openclaw/openclaw.json unless overridden (tests, ports of OpenClaw). */
+export function openclawConfigPath() {
+  return process.env.OPENCLAW_CONFIG_PATH
+    || path.join(os.homedir(), '.openclaw', 'openclaw.json');
+}
+
+/**
+ * Reasoning flag only where the id says so unambiguously. A wrong `true`
+ * makes OpenClaw send thinking parameters the model rejects; a wrong `false`
+ * merely hides a toggle. Asymmetric costs → conservative test.
+ */
+export function isReasoningId(id) {
+  return /(^|\/)o[134](-|$)|reasoner|thinking|qwq|(^|[/-])r1($|[.-])/i.test(String(id || ''));
+}
+
+/**
+ * One catalog row → one OpenClaw model entry. Pricing arrives in USD per
+ * token (OpenRouter units); OpenClaw's `cost` is USD per MILLION tokens —
+ * same conversion its own OpenRouter parser does (value * 1e6).
+ */
+export function openclawModelEntry(row) {
+  const [prompt, completion] = tokenPricePair(row?.pricing);
+  const perM = (v) => (Number.isFinite(v) && v > 0 ? Number((v * 1e6).toFixed(6)) : 0);
+  return {
+    id: row.id,
+    name: displayNameFor(row.id) || row.id,
+    reasoning: isReasoningId(row.id),
+    input: ['text'],
+    // context_length is the CLIENT-USABLE ceiling (leCore auto-spill), which
+    // is the honest number for a harness deciding whether to chunk.
+    contextWindow: Number(row.context_length) > 0 ? Number(row.context_length) : 128000,
+    maxTokens: 8192,
+    cost: {
+      input: perM(prompt),
+      output: perM(completion),
+      cacheRead: 0,
+      cacheWrite: 0,
+    },
+  };
+}
+
+/**
+ * Merge the openzoo provider into an OpenClaw config object. Pure — takes and
+ * returns plain objects, touches no disk. Other providers and every unrelated
+ * key survive untouched; OUR provider block is replaced wholesale (it is
+ * generated, and a stale half-merge would resurrect dead models or prices).
+ * The agent default is only claimed when the user asked (`forceDefault`) or
+ * no primary model is configured at all — never silently re-pointed.
+ */
+export function mergeOpenClawConfig(existing, { port, entries, defaultId, forceDefault } = {}) {
+  const cfg = existing && typeof existing === 'object' ? existing : {};
+  cfg.models = cfg.models && typeof cfg.models === 'object' ? cfg.models : {};
+  cfg.models.providers = cfg.models.providers && typeof cfg.models.providers === 'object'
+    ? cfg.models.providers : {};
+  cfg.models.providers[PROVIDER_KEY] = {
+    baseUrl: `http://localhost:${port}/v1`,
+    apiKey: 'sk-openzoo', // any value: the zoo takes payment, not keys
+    api: 'openai-completions',
+    models: entries,
+  };
+  let changedDefault = false;
+  const ref = defaultId ? `${PROVIDER_KEY}/${defaultId}` : null;
+  if (ref) {
+    cfg.agents = cfg.agents && typeof cfg.agents === 'object' ? cfg.agents : {};
+    cfg.agents.defaults = cfg.agents.defaults && typeof cfg.agents.defaults === 'object'
+      ? cfg.agents.defaults : {};
+    const model = cfg.agents.defaults.model && typeof cfg.agents.defaults.model === 'object'
+      ? cfg.agents.defaults.model : {};
+    if (forceDefault || !model.primary) {
+      model.primary = ref;
+      cfg.agents.defaults.model = model;
+      changedDefault = true;
+    }
+  }
+  return { cfg, changedDefault };
+}
+
+async function fetchCatalogRows() {
+  const r = await fetchHeaders(`${config.apiBase}/v1/models`);
+  if (!r.ok) throw new Error(`model catalog fetch failed: HTTP ${r.status}`);
+  const d = await r.json();
+  return quoteableRows(d.data).filter((m) => !isAutoModel(m.id));
+}
+
+function pickRows(rows, { all, wanted }) {
+  if (wanted && wanted.length) {
+    const byId = new Map(rows.map((m) => [m.id, m]));
+    const missing = wanted.filter((id) => !byId.has(id));
+    if (missing.length) {
+      throw new Error(`not in the live catalog: ${missing.join(', ')} (see: npx openzoo models)`);
+    }
+    return wanted.map((id) => byId.get(id));
+  }
+  if (all) return rows;
+  // Short honest default: same flagship picker Claude Code gets, minus Auto
+  // (Auto's price varies per route — a fixed cost block would be a lie).
+  const picked = pickClaudePickerRows(rows).filter((m) => !isAutoModel(m.id));
+  return picked.length ? picked : rows.slice(0, 8);
+}
+
+/**
+ * `npx openzoo openclaw [--all | --models a,b] [--default <id>] [--config <path>]`
+ */
+export async function setupOpenClaw(argv = []) {
+  const args = [...argv];
+  const opt = { all: false, wanted: null, defaultId: null, configPath: null };
+  while (args.length) {
+    const a = args.shift();
+    if (a === '--all') opt.all = true;
+    else if (a === '--models') opt.wanted = String(args.shift() || '').split(',').map((s) => s.trim()).filter(Boolean);
+    else if (a === '--default') opt.defaultId = String(args.shift() || '').trim() || null;
+    else if (a === '--config') opt.configPath = String(args.shift() || '').trim() || null;
+    else throw new Error(`unknown flag: ${a}`);
+  }
+
+  const rows = pickRows(await fetchCatalogRows(), opt);
+  if (!rows.length) throw new Error('live catalog returned no quoteable models');
+  const entries = rows.map(openclawModelEntry);
+  const defaultId = opt.defaultId || entries[0].id;
+  if (!entries.some((e) => e.id === defaultId)) {
+    throw new Error(`--default ${defaultId} is not among the written models (add it via --models)`);
+  }
+
+  const file = opt.configPath || openclawConfigPath();
+  let existing = {};
+  if (fs.existsSync(file)) {
+    const raw = fs.readFileSync(file, 'utf8');
+    try {
+      existing = raw.trim() ? JSON.parse(raw) : {};
+    } catch (e) {
+      // OpenClaw itself writes strict JSON; a parse failure means the user
+      // hand-edited (JSON5 comments etc.). Print the block instead of
+      // corrupting their file — fail open with a usable result.
+      console.error(`openzoo: could not parse ${file} (${e.message}).`);
+      console.error('add this under models.providers yourself:\n');
+      console.error(JSON.stringify({ [PROVIDER_KEY]: mergeOpenClawConfig({}, { port: config.port, entries, defaultId }).cfg.models.providers[PROVIDER_KEY] }, null, 2));
+      process.exitCode = 1;
+      return null;
+    }
+    fs.copyFileSync(file, `${file}.openzoo-backup`);
+  } else {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+  }
+
+  const { cfg, changedDefault } = mergeOpenClawConfig(existing, {
+    port: config.port,
+    entries,
+    defaultId,
+    forceDefault: Boolean(opt.defaultId),
+  });
+  fs.writeFileSync(file, `${JSON.stringify(cfg, null, 2)}\n`);
+
+  console.log(`wrote ${entries.length} zoo model(s) with real ceiling prices into ${file}`);
+  for (const e of entries) {
+    console.log(`  ${PROVIDER_KEY}/${e.id}  $${e.cost.input}/Mtok in, $${e.cost.output}/Mtok out`);
+  }
+  console.log(changedDefault
+    ? `default model: ${PROVIDER_KEY}/${defaultId}`
+    : `default model kept (${cfg.agents?.defaults?.model?.primary || 'unset'}); use --default <id> to switch`);
+  console.log('prices are the CEILING (openrouter-direct): volume + context reuse only lower them;');
+  console.log('receipts on the proxy console remain the ground truth.');
+  console.log('\nnow: keep `npx openzoo` running, then `openclaw gateway restart`');
+  return { file, entries, defaultId, changedDefault };
+}

package/lib/pay.js

@@ -152,8 +152,21 @@ export function solanaFundingEmpty(balances) {
 }
 
 export class PayClient {
-  constructor() {
-    const w = loadOrCreateWallet();
+  /**
+   * @param {{keypair?: import('@solana/web3.js').Keypair, evmPrivateKey?: string}} [burner]
+   *   Spend from a SPECIFIC wallet instead of this machine's ~/.openzoo/wallet.json.
+   *   @openzoobot needs this: the asker pays from their own derived burner, so
+   *   one poller process settles from a different wallet per question. Without
+   *   the override every X user's question would be paid by the operator's
+   *   machine wallet — which is not "the asker pays", it is us paying for
+   *   everyone and calling it x402.
+   */
+  constructor(burner) {
+    // A derived burner is only ever used to make SOMEONE ELSE pay, so it
+    // implies x402-only. Defaulting this off would silently reintroduce the
+    // bug it exists to prevent.
+    this.noSubscription = Boolean(burner?.keypair) && burner?.allowSubscription !== true;
+    const w = burner?.keypair ? { ...burner, created: false, path: '(derived)' } : loadOrCreateWallet();
     this.keypair = w.keypair;
     this.evmPrivateKey = w.evmPrivateKey;
     this.walletCreated = w.created;
@@ -358,13 +371,24 @@ export class PayClient {
       if (short <= 0n) return {};
 
       const { reserves, supply } = await poolState(this.connection, pool);
-      const deposit = depositForShares(short, reserves, supply);
+      const minDeposit = depositForShares(short, reserves, supply);
       const underlyingBal = attempt === 0
         ? underlyingNow
         : await tokenBalance(this.connection, owner, pool.underlying.toBase58());
-      if (underlyingBal.raw < deposit) {
+      if (underlyingBal.raw < minDeposit) {
         throw new UnderfundedError(accept, underlyingBal.ui, this.address);
       }
+      // WRAP EVERYTHING, NOT THE SHORTFALL. Wrapping per-payment meant every
+      // paid call re-ran resolvePool+poolState+wrap+confirm (~4.5s) and
+      // re-opened the same balance race that false-paywalled a funded wallet.
+      // Wrapped twins exist only to be spent on payments, so there is nothing
+      // to preserve by leaving the underlying raw: convert the full balance
+      // once, and every later payment takes the fast path (measured 0.36s)
+      // straight from wrapped funds. (Operator directive, verbatim: the burner
+      // must "autotopup with all my crypto".) The bundled no-SOL path below
+      // keeps the minimal amount — it rides inside the payment tx, where a
+      // full-balance wrap would bloat a transaction we do not control.
+      const deposit = underlyingBal.raw > minDeposit ? underlyingBal.raw : minDeposit;
 
       onStage?.('funding');
       const wrappedAta = getAssociatedTokenAddressSync(pool.wrapped, owner, false, pool.wrappedProgram);
@@ -377,7 +401,7 @@ export class PayClient {
         // No SOL for a standalone conversion — bundle it into the payment tx.
         const rentPayer = new PublicKey(accept.extra.feePayer);
         return {
-          preInstructions: buildWrapInstructions({ pool, owner, depositRaw: deposit, rentPayer }),
+          preInstructions: buildWrapInstructions({ pool, owner, depositRaw: minDeposit, rentPayer }),
         };
       }
       const sig = await sendWrap(this.connection, this.keypair, pool, deposit);
@@ -399,12 +423,19 @@ export class PayClient {
     onStage?.('request');
     // Contexts are tenanted by this namespace server-side — a request without
     // it cannot see corpora this wallet bound.
-    init = { ...init, headers: withNamespace(init.headers || {}) };
+    init = { ...init, headers: withNamespace(init.headers || {}, { keypair: this.keypair }) };
     // Subscription key · no x402. A stored Stripe key is a bearer on the zoo
     // API (same as the public /billing/done snippet). Wallet/x402 stays if
     // there is no key, or if the gateway still answers 402.
-    const sub = loadSubscription();
+    // `noSubscription` forces the WALLET to pay. @openzoobot needs it: the
+    // operator's stored subscription key is on the same machine as the poller,
+    // so without this every asker's paid question would be settled on OUR key
+    // while the reply claimed x402 — and an empty burner would answer happily,
+    // which is precisely how this was caught.
+    const sub = this.noSubscription ? null : loadSubscription();
     if (sub?.key) init = { ...init, headers: applySubscriptionHeaders(init.headers, sub) };
+    // Strip any bearer the caller inherited, for the same reason.
+    if (this.noSubscription) init = { ...init, headers: stripAuthorization(init.headers || {}) };
     const first = await fetchHeaders(url, init);
     if (first.status !== 402) {
       return { response: first, paid: false, subscription: Boolean(sub?.key && first.ok) };

package/lib/wrap.js

@@ -275,7 +275,13 @@ export function buildWrapInstructions({ pool, owner, depositRaw, rentPayer = own
  */
 export async function confirmSignatureByPolling(connection, signature, {
   commitment = 'confirmed',
-  timeoutMs = 90000,
+  // 90s was too tight under load: OBSERVED "timed out after 90000ms waiting
+  // for confirmation" on a wrap that was still in flight. The cost of that
+  // timeout is not a slow reply — it is the asker having PAID and being told
+  // the call failed, because the transaction goes on confirming after we stop
+  // watching. Waiting longer is strictly cheaper than losing someone's money,
+  // so the default is generous and tunable.
+  timeoutMs = Number(process.env.OPENZOO_CONFIRM_TIMEOUT_MS || 900000),
   pollMs = 1500,
 } = {}) {
   const accept = commitment === 'finalized' ? ['finalized'] : ['confirmed', 'finalized'];
@@ -291,7 +297,15 @@ export async function confirmSignatureByPolling(connection, signature, {
       if (accept.includes(status.confirmationStatus)) return signature;
     }
     if (Date.now() >= deadline) {
-      throw new Error(`timed out after ${timeoutMs}ms waiting for confirmation of ${signature}`);
+      // Say what actually happened. "Timed out" reads as "it did not go
+      // through", and the opposite is more likely: the signature is real and
+      // usually lands. Anyone reading this needs to check before re-sending,
+      // or they will pay twice.
+      throw new Error(
+        `timed out after ${timeoutMs}ms waiting for confirmation of ${signature} `
+        + '— the transaction may STILL confirm; check it before retrying: '
+        + `https://solscan.io/tx/${signature}`,
+      );
     }
     await new Promise((resolve) => setTimeout(resolve, pollMs));
   }