openzoo 0.49.17 → 0.50.0

package/lib/boxes.js

@@ -1,299 +0,0 @@
-// RunPod CPU boxes — the sandbox fleet `openzoo grokbot` runs its agents in.
-//
-// SAME SHAPE AS GROK BOT, DIFFERENT ECONOMICS. Grok Bot provisions a
-// cursorvm.com pod per bot and runs the agent inside Cursor's cloud, billing
-// through them (MEASURED: EnsureSandBox returns
-// `<id>-pod-<id>-1337.us9.cursorvm.com` + a VNC port + /workspace/terminals).
-// This does the same thing on RunPod, with inference paid per-call by x402
-// from a wallet the box holds — no account, no provider key.
-//
-// CPU ONLY, ALWAYS. A GPU flavour here would be a silent 100x on the bill for
-// a box that only ever runs a shell and a node process. `spawnBox` builds its
-// request body without GPU fields AND asserts on the serialized JSON, because
-// an `in` check against a literal you wrote three lines earlier can never fail
-// — that guard is decoration, not enforcement.
-
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-
-const pexec = promisify(execFile);
-
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { dirname, join } from 'node:path';
-let _agentB64 = null;
-function podAgentB64() {
-  if (_agentB64) return _agentB64;
-  const here = dirname(fileURLToPath(import.meta.url));
-  _agentB64 = readFileSync(join(here, 'podagent.mjs')).toString('base64');
-  return _agentB64;
-}
-
-const REST = 'https://rest.runpod.io/v1';
-export const BOX_PREFIX = 'openzoo-box-';
-const CPU_FLAVORS = ['cpu3c', 'cpu3g', 'cpu5c'];
-// GLIBC, NOT ALPINE. `npx openzoo` pulls native deps (ed25519 / ws helpers);
-// on musl they fail to build because the entrypoint has no toolchain, which is
-// why alpine boxes sat at 404 forever. Debian-slim runs the shim as published,
-// and its apt has a real sshd.
-// Everything the box runs is ALREADY IN THE IMAGE: the shim, its node_modules,
-// grokui, and sshd. Boxes used to apt-get and `npx openzoo` at boot, which put
-// a package fetch on the critical path from RunPod egress IPs — and those get
-// rate limited. A 429 from raw.githubusercontent arrives as a FILE whose
-// contents are the text "429: Too Many Requests", so node ran it and failed in
-// a way that read as an app bug rather than a download bug.
-// Still glibc, never musl: @solana's native deps don't build on the box.
-const BOX_IMAGE = process.env.OPENZOO_BOX_IMAGE || 'jrsdunn123/openzoo-box:latest';
-const BOX_PORTS = ['8402/http', '4173/http', '1337/http', '6080/http', '1340/http', '6081/http', '22/tcp'];
-const TTL_MAX_HOURS = 90 * 24;
-
-/**
- * Boot: write the wallet, START SSHD, start the x402 proxy + capture agent.
- *
- * SSHD IS NOT OPTIONAL and was the second bug: our dockerStartCmd replaces the
- * image's own init, so nothing starts sshd and every `execInBox` got
- * "connection refused" — the agent had no hands. RunPod injects the account
- * key at $PUBLIC_KEY / $SSH_PUBLIC_KEY; we write it to authorized_keys, generate
- * host keys, and run sshd in the foreground of the background. Passwordless
- * root login is NOT enabled — key-only.
- *
- * NOTHING IS FETCHED AT BOOT. sshd, the shim and grokui are baked into
- * BOX_IMAGE by box.Dockerfile; this only copies /opt into the volume RunPod
- * mounts over /workspace and starts things. readyBox() still polls /v1/models
- * rather than assuming a timing.
- */
-const ENTRYPOINT = [
-  'bash', '-lc',
-  'set +e; mkdir -p /workspace /root/.openzoo /var/log/openzoo /run/sshd /root/.ssh; '
-  + 'if [ -n "$OPENZOO_WALLET_JSON" ]; then printf %s "$OPENZOO_WALLET_JSON" > /root/.openzoo/wallet.json; chmod 600 /root/.openzoo/wallet.json; fi; '
-  // RunPod hands the operator pubkey in one of these — accept whichever is set
-  + 'for K in "$PUBLIC_KEY" "$SSH_PUBLIC_KEY"; do [ -n "$K" ] && echo "$K" >> /root/.ssh/authorized_keys; done; chmod 600 /root/.ssh/authorized_keys 2>/dev/null; '
-  + 'ssh-keygen -A >/dev/null 2>&1; sed -i "s/^#\\?PermitRootLogin.*/PermitRootLogin prohibit-password/" /etc/ssh/sshd_config 2>/dev/null; /usr/sbin/sshd -e >/var/log/openzoo/sshd.log 2>&1 & '
-  // RUN FROM /opt, never from /workspace. Staging the app onto the volume and
-  // gating on `[ ! -f .../bin/openzoo.js ]` is a trap: one interrupted copy
-  // leaves that file behind, every later boot skips the copy, and the box
-  // crash-loops on a half-copied node_modules forever (seen in production as
-  // "Cannot find module .../viem/accounts" every 15s, which also cost the pod
-  // its HTTP port mappings). The app is read-only at runtime; mutable state
-  // lives in /root/.openzoo.
-  + 'until OPENZOO_BIND=0.0.0.0 node /opt/openzoo/bin/openzoo.js >> /var/log/openzoo/proxy.log 2>&1; do echo "proxy exited, restarting" >> /var/log/openzoo/proxy.log; sleep 2; done & '
-  + 'until OZ_GROKUI_BIND=0.0.0.0 OZ_GROKUI_PORT=4173 node /opt/openzoo/lib/grokui.mjs >> /var/log/openzoo/grokui.log 2>&1; do echo "grokui exited, restarting" >> /var/log/openzoo/grokui.log; sleep 2; done & '
-  // the capture agent answers the ports Grok Bot expects a Cursor sandbox on,
-  // logging the protocol we do not yet speak (see lib/podagent.mjs)
-  + 'if [ -n "$OZ_PODAGENT_B64" ]; then printf %s "$OZ_PODAGENT_B64" | base64 -d > /opt/podagent.mjs; node /opt/podagent.mjs > /var/log/openzoo/agent.log 2>&1 & fi; '
-  + 'sleep infinity',
-];
-
-function key() {
-  const k = process.env.RUNPOD_API_KEY || '';
-  return typeof k === 'string' ? k.trim() : '';
-}
-
-export function runpodConfigured() {
-  // guard the access, not just the prefix — an unset key must not throw here
-  return key().startsWith('rpa_');
-}
-
-async function rp(path, init) {
-  const k = key();
-  if (!k) return { ok: false, status: 503, data: { error: 'RUNPOD_API_KEY not set' } };
-  const res = await fetch(`${REST}${path}`, {
-    ...init,
-    headers: { authorization: `Bearer ${k}`, 'content-type': 'application/json', ...(init?.headers || {}) },
-  });
-  const data = await res.json().catch(() => ({}));
-  return { ok: res.ok, status: res.status, data };
-}
-
-export function ttlHours(days = 30) {
-  return Math.min(Math.max(Number(days) || 30, 1) * 24, TTL_MAX_HOURS);
-}
-
-/**
- * Expiry is encoded in the name so a box is reapable even if its env is lost.
- *
- * PARSED FROM A FIXED POSITION, NOT `.pop()`. The name ends
- * `-<unix>-<rand4>`, so popping the last segment yields the RANDOM suffix,
- * Number() gives NaN, and every box reports "no expiry" — which is exactly the
- * bug the site's copy of this had.
- */
-export function expiresFromName(name) {
-  if (!name?.startsWith(BOX_PREFIX)) return null;
-  const parts = name.split('-');
-  const n = Number(parts[parts.length - 2]);
-  return Number.isFinite(n) && n > 1_700_000_000 ? n : null;
-}
-
-export function proxyUrl(id, port = 8402) {
-  return id ? `https://${id}-${port}.proxy.runpod.net` : null;
-}
-
-/** The URLs Grok Bot's EnsureSandBox response needs, all fronted by RunPod. */
-export function podEndpoints(id) {
-  return id ? {
-    agent: proxyUrl(id, 1337),
-    vnc: proxyUrl(id, 6080),
-    p1340: proxyUrl(id, 1340),
-    p6081: proxyUrl(id, 6081),
-    proxy: proxyUrl(id, 8402),
-  } : null;
-}
-
-/** What a caller may see. NEVER the raw pod: `env` carries OPENZOO_WALLET_JSON,
- *  which is a funded private key. Raw pods must not escape this module. */
-export function serializeBox(p) {
-  const exp = expiresFromName(p.name) || Number(p.env?.OPENZOO_EXPIRES_UNIX || 0) || null;
-  const sshPort = p.portMappings?.['22'];
-  return {
-    id: p.id,
-    name: p.name,
-    status: p.desiredStatus,
-    costPerHr: p.costPerHr,
-    proxy: proxyUrl(p.id),
-    ssh: p.publicIp && sshPort ? `ssh -o StrictHostKeyChecking=no root@${p.publicIp} -p ${sshPort}` : null,
-    host: p.publicIp || null,
-    sshPort: sshPort || null,
-    console: p.id ? `https://www.runpod.io/console/pods/${p.id}` : null,
-    expiresAt: exp ? new Date(exp * 1000).toISOString() : null,
-  };
-}
-
-/** Our boxes only, serialized. */
-export async function listBoxes() {
-  const r = await rp('/pods');
-  if (!Array.isArray(r.data)) return { ok: false, error: r.data?.error || `pods ${r.status}`, boxes: [] };
-  return {
-    ok: true,
-    boxes: r.data.filter((p) => !p.gpuCount && p.name?.startsWith(BOX_PREFIX)).map(serializeBox),
-  };
-}
-
-export async function killBox(id) {
-  return rp(`/pods/${id}`, { method: 'DELETE' });
-}
-
-/** Delete our boxes past their deadline. Name-prefix scoped AND gpu-guarded. */
-export async function reapExpired() {
-  const r = await rp('/pods');
-  if (!Array.isArray(r.data)) return { reaped: [] };
-  const now = Math.floor(Date.now() / 1000);
-  const reaped = [];
-  for (const p of r.data) {
-    if (!p.id || p.gpuCount || !p.name?.startsWith(BOX_PREFIX)) continue;
-    const deadline = expiresFromName(p.name) || Number(p.env?.OPENZOO_EXPIRES_UNIX || 0);
-    if (deadline && now >= deadline) {
-      await killBox(p.id);
-      reaped.push(p.id);
-    }
-  }
-  return { reaped };
-}
-
-/**
- * MACHINE TIERS — a menu, not one size.
- *
- * A box that only runs a shell is fine on 2 vCPU, but a grokbot agent that
- * builds a site, runs a dev server, or compiles wants real muscle — and some
- * tasks want a GPU. So the orchestrator quotes SEVERAL tiers per timeframe and
- * the user picks. GPU is a DELIBERATE tier here, never an accident: the guard
- * below refuses GPU fields on a CPU tier, so a cpu tier can't silently 100x the
- * bill, while a gpu tier carries them on purpose.
- *
- * $/hr are approximate RunPod secure-cloud rates for sizing the quote; the real
- * charge is whatever RunPod bills. estUsdHr is labelled approximate for that.
- */
-export const BOX_TIERS = {
-  'cpu-sm':  { label: 'CPU · 2 vCPU',       compute: 'CPU', vcpu: 2, disk: 20,  estUsdHr: 0.06 },
-  'cpu-md':  { label: 'CPU · 4 vCPU',       compute: 'CPU', vcpu: 4, disk: 40,  estUsdHr: 0.12 },
-  'cpu-lg':  { label: 'CPU · 8 vCPU',       compute: 'CPU', vcpu: 8, disk: 60,  estUsdHr: 0.24 },
-  'gpu-4090':{ label: 'GPU · 1× RTX 4090',  compute: 'GPU', gpuTypeIds: ['NVIDIA GeForce RTX 4090'], gpuCount: 1, disk: 60,  estUsdHr: 0.44 },
-  'gpu-a100':{ label: 'GPU · 1× A100 80GB', compute: 'GPU', gpuTypeIds: ['NVIDIA A100 80GB PCIe'],   gpuCount: 1, disk: 80,  estUsdHr: 1.64 },
-};
-export const DEFAULT_TIER = 'cpu-sm';
-
-/** The quote menu the orchestrator shows: every tier priced for `days`. */
-export function quoteTiers(days = 1) {
-  const hrs = ttlHours(days);
-  return Object.entries(BOX_TIERS).map(([key, t]) => ({
-    tier: key, label: t.label, days: Math.round(hrs / 24 * 10) / 10,
-    estUsd: Math.round(t.estUsdHr * hrs * 100) / 100, estUsdHr: t.estUsdHr, gpu: t.compute === 'GPU',
-  }));
-}
-
-export async function spawnBox({ name = 'bot', days = 1, tier = DEFAULT_TIER, walletJson, pubkey, task } = {}) {
-  const spec = BOX_TIERS[tier] || BOX_TIERS[DEFAULT_TIER];
-  const expiresAt = new Date(Date.now() + ttlHours(days) * 3600 * 1000);
-  const unix = Math.floor(expiresAt.getTime() / 1000);
-  const rand = Math.random().toString(36).slice(2, 6);
-  const full = `${BOX_PREFIX}${name}-${unix}-${rand}`;
-
-  const body = {
-    name: full,
-    computeType: spec.compute,
-    cloudType: 'SECURE',
-    imageName: BOX_IMAGE,
-    containerDiskInGb: spec.disk,
-    volumeInGb: 10,
-    volumeMountPath: '/workspace',
-    ports: BOX_PORTS,
-    dockerStartCmd: ENTRYPOINT,
-    ...(spec.compute === 'CPU'
-      ? { vcpuCount: spec.vcpu, cpuFlavorIds: CPU_FLAVORS, cpuFlavorPriority: 'availability' }
-      : { gpuCount: spec.gpuCount, gpuTypeIds: spec.gpuTypeIds }),
-    env: {
-      OPENZOO_BOX: '1',
-      OPENZOO_TIER: tier,
-      OPENZOO_EXPIRES_UNIX: String(unix),
-      OPENZOO_NO_TUNNEL: '1',           // the runpod proxy already fronts it
-      OPENZOO_BIND: '0.0.0.0',          // else the runpod proxy can't reach :8402
-      OPENZOO_TUNNEL_TOKEN: `oz-${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`,
-      ...(walletJson ? { OPENZOO_WALLET_JSON: walletJson } : {}),
-      ...(pubkey ? { OPENZOO_WALLET_PUBKEY: pubkey } : {}),
-      OZ_PODAGENT_B64: podAgentB64(),
-      ...(task ? { OZ_TASK: task } : {}),
-    },
-  };
-  // GPU ONLY ON A GPU TIER. A cpu tier must never carry GPU fields — that would
-  // be a silent 100x. Enforced on the serialized payload, not a literal.
-  const wire = JSON.stringify(body);
-  if (spec.compute === 'CPU' && /"gpu(Count|TypeIds)"/.test(wire)) {
-    throw new Error('refusing to spawn: GPU fields on a CPU tier');
-  }
-
-  const created = await rp('/pods', { method: 'POST', body: wire });
-  if (!created.ok) return { ok: false, error: created.data?.error || `spawn ${created.status}` };
-  return { ok: true, tier, box: serializeBox(created.data), expiresAt: expiresAt.toISOString() };
-}
-
-/** Poll until the box answers on its proxy — npx has to fetch the shim first. */
-export async function readyBox(id, { timeoutMs = 240_000, log = () => {} } = {}) {
-  const url = `${proxyUrl(id)}/v1/models`;
-  const started = Date.now();
-  let last = '';
-  while (Date.now() - started < timeoutMs) {
-    try {
-      const r = await fetch(url, { signal: AbortSignal.timeout(6000) });
-      if (r.ok) return { ok: true, seconds: Math.round((Date.now() - started) / 1000) };
-      last = `http ${r.status}`;
-    } catch (e) { last = e.name === 'TimeoutError' ? 'timeout' : e.message; }
-    log(`  waiting for box proxy… (${Math.round((Date.now() - started) / 1000)}s, ${last})`);
-    await new Promise((r) => setTimeout(r, 6000));
-  }
-  return { ok: false, error: `box proxy never came up (${last})` };
-}
-
-/** Run a command INSIDE the box. This is the sandbox half of the product:
- *  the model runs wherever openzoo routes it, the side effects land here. */
-export async function execInBox(box, cmd, { timeoutMs = 120_000 } = {}) {
-  if (!box.host || !box.sshPort) return { ok: false, stdout: '', stderr: 'box has no ssh yet' };
-  try {
-    const { stdout, stderr } = await pexec('ssh', [
-      '-o', 'StrictHostKeyChecking=no', '-o', 'UserKnownHostsFile=/dev/null',
-      '-o', 'LogLevel=ERROR', '-o', 'ConnectTimeout=15',
-      '-p', String(box.sshPort), `root@${box.host}`, cmd,
-    ], { timeout: timeoutMs, maxBuffer: 8 * 1024 * 1024 });
-    return { ok: true, stdout, stderr };
-  } catch (e) {
-    return { ok: false, stdout: e.stdout || '', stderr: e.stderr || e.message };
-  }
-}

package/lib/brief.js

@@ -1,76 +0,0 @@
-/**
- * The capability briefing the proxy injects into every conversation.
- *
- * WHY THIS EXISTS: an agent on the other side of this proxy has no idea what
- * it is connected to. It assumes a stock OpenAI endpoint, so it chunks corpora
- * it could bind whole, hunts for metadata by shelling around the operator's
- * machine, and re-uploads the same megabytes every turn. Documentation the
- * agent never reads does not help it. Telling it IN BAND does.
- *
- * Kept short on purpose — it rides every request, so it earns its tokens.
- * OPENZOO_NO_BRIEF=1 turns it off.
- */
-
-/**
- * `selfUrl` is the base URL THIS request arrived on — the tunnel URL for a
- * remote harness, localhost otherwise. Without it an agent writing a helper
- * script has to guess its own endpoint, and it guesses wrong: observed in the
- * wild, a Cursor agent hardcoded `https://openzoo.fun/v1` (a marketing site,
- * not an API) because nothing in the conversation named the real one.
- */
-export const briefFor = (selfUrl) => [
-  // SMALL ON PURPOSE. This used to be ~2.2KB of prose on EVERY request —
-  // corpus binding, request-size limits, payment rails, model-id matching —
-  // most of which a given call never needs, all of which the caller pays for in
-  // tokens and latency. An agent that needs the detail can ask; what it cannot
-  // work out for itself is the base URL and the one behaviour that changes how
-  // it should send a big body. Everything else was documentation shipped as
-  // overhead.
-  ...(selfUrl ? [`Endpoint: ${selfUrl} (already ends in /v1). Routes: /chat/completions, /hrr/bind, /models.`] : []),
-  'Bodies over ~16KB are bound to holographic memory and answered by retrieval, so a large corpus can be sent whole rather than summarised or chunked. A corpus sent once is not re-uploaded.',
-  'Calls are paid per request from the operator\'s wallet; there is no key to supply. Unknown model ids match the nearest served model.',
-].join('\n');
-
-/** Stable substring used to detect an already-injected brief. Must appear in
- *  briefFor() output verbatim — see injectBrief(). */
-export const BRIEF_MARK = 'bound to holographic memory and answered by retrieval';
-
-/** Back-compat: the briefing with no endpoint line. */
-export const BRIEF = briefFor(null);
-
-/**
- * Inject the briefing as a system message. Idempotent (never doubles up if a
- * conversation already carries it), non-destructive (an existing system
- * message keeps its position and content — ours is appended after it, since
- * harnesses often pin behaviour in the first system turn).
- * Returns null when nothing should change.
- */
-export function injectBrief(body, selfUrl = null) {
-  if (process.env.OPENZOO_NO_BRIEF === '1') return null;
-  const msgs = body?.messages;
-  if (!Array.isArray(msgs) || !msgs.length) return null;
-  // THE SENTINEL MUST BE TEXT THE BRIEF ACTUALLY CONTAINS. This checked for
-  // 'connected through an openzoo proxy' — the old opening line — so shrinking
-  // the brief would have silently broken idempotency and stacked a fresh copy
-  // onto every single turn, growing the system block without bound.
-  if (msgs.some((m) => typeof m?.content === 'string' && m.content.includes(BRIEF_MARK))) return null;
-
-  const brief = { role: 'system', content: briefFor(selfUrl) };
-  // THE LEADING SYSTEM RUN ONLY — NOT THE LAST SYSTEM ANYWHERE.
-  //
-  // This used to reduce over the WHOLE array for the last `role === 'system'`,
-  // which is the same thing only while every system message sits at the front.
-  // The moment anything injects one later, the brief is spliced in AFTER the
-  // user's turn, and the conversation the model receives ends with operator
-  // notes instead of a question.
-  //
-  // OBSERVED live: forwarded tail `s a t a t a u s a u s s` — two system
-  // messages after the last user message. The agent replied "I don't see an
-  // explicit question or task for this turn", answered the PREVIOUS turn, and
-  // read as one message behind for an entire session.
-  let lead = -1;
-  while (lead + 1 < msgs.length && msgs[lead + 1]?.role === 'system') lead += 1;
-  const out = [...msgs];
-  out.splice(lead + 1, 0, brief); // after the leading system block, before any turn
-  return { ...body, messages: out };
-}

package/lib/grokbot.js

@@ -1,120 +0,0 @@
-// `npx openzoo grokbot` — keep Grok Bot's UI, serve OUR box underneath.
-//
-// Grok Bot is a thin client over Cursor's aiserver.v1 API. Each bot gets a
-// pod from `GrokBotService/EnsureSandBox` — a cursorvm.com VM the agent runs
-// in. We MITM api2.cursor.sh (proven: /etc/hosts pin + Node TLS override lets
-// us answer 88 methods and passthrough the rest with real bodies), and for
-// that ONE method we return OUR RunPod box in Cursor's exact 12-field wire
-// shape. The polished UI is theirs; the sandbox is ours.
-//
-// THE WALL, STATED HONESTLY: once the app has our pod, it speaks Cursor's
-// in-pod agent protocol to port 1337 and expects a VNC/websockify desktop on
-// 6080. We do not yet speak either. The box therefore runs lib/podagent.mjs,
-// which LOGS every request on those ports to /var/log/openzoo/agent.jsonl. So
-// this ships as a CAPTURE hijack: the UI connects to our box, and we read what
-// it sends to learn the protocol we then have to implement. That is the honest
-// state — a working hijack needs that protocol, and this is how we get it.
-
-import { spawn, execSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-
-import { config, USDC_MINT, TOKEN_MINT } from './config.js';
-import { PayClient } from './pay.js';
-import {
-  podEndpoints, readyBox, runpodConfigured, spawnBox, listBoxes, execInBox,
-} from './boxes.js';
-
-const APP = '/Applications/Grok Bot.app';
-const GROK_HOME = process.env.GROK_HOME || join(homedir(), '.grok');
-
-export async function runGrokBot(argv = []) {
-  if (process.platform !== 'darwin') {
-    console.error('openzoo grokbot: the app hijack is macOS-only (needs Grok Bot.app + /etc/hosts).');
-    process.exit(1);
-  }
-  if (!existsSync(APP)) {
-    console.error('openzoo grokbot: /Applications/Grok Bot.app not found.');
-    process.exit(1);
-  }
-  if (!runpodConfigured()) {
-    console.error('openzoo grokbot: RUNPOD_API_KEY not set (needs an rpa_… key).');
-    console.error('  export RUNPOD_API_KEY=rpa_…   then re-run. Boxes bill to that account;');
-    console.error('  inference bills per-call to the box\'s own openzoo wallet.');
-    process.exit(1);
-  }
-
-  const days = Number((argv.find((a) => /^--days=/.test(a)) || '').split('=')[1]) || 1;
-
-  // 1) a box, ready, BEFORE we touch the app — so the first EnsureSandBox we
-  //    hijack already has a live pod to point at. The box mints its OWN wallet
-  //    (never the operator's secret key — that never leaves this Mac). There is
-  //    NO --task and NO --share-wallet: the task is whatever the user types
-  //    into the Grok Bot UI, captured from the MITM'd chat request and driven
-  //    through to the box over POST /drive.
-  console.error('openzoo grokbot: spawning your box (CPU, x402-funded)…');
-  const spawned = await spawnBox({ name: 'grokbot', days });
-  if (!spawned.ok) { console.error(`  spawn failed: ${spawned.error}`); process.exit(1); }
-  const box = spawned.box;
-  console.error(`  ${box.name}  ${box.id}  expires ${spawned.expiresAt.slice(0, 16)}`);
-  const ready = await readyBox(box.id, { log: (m) => console.error(m) });
-  if (!ready.ok) console.error(`  ${ready.error} — continuing; the capture agent may still bind`);
-  else console.error(`  box ready in ${ready.seconds}s`);
-
-  // the box minted its OWN wallet on boot — print its funding address so it
-  // can be topped up directly. Its brain pays per call from THIS wallet, not
-  // the operator's; a fresh box starts at $0 until funded.
-  if (box.ssh) {
-    const addr = await execInBox(box, 'npx --yes openzoo address 2>/dev/null');
-    if (addr.ok && addr.stdout.trim()) {
-      console.error('  box wallet (top up to give it inference budget):');
-      console.error(addr.stdout.trim().split('\n').map((l) => `    ${l}`).join('\n'));
-    }
-    console.error(`  mints: USDC ${USDC_MINT} · TOKEN ${TOKEN_MINT} (Solana)`);
-  }
-
-  const ep = podEndpoints(box.id);
-  process.env.OZ_HIJACK_POD = JSON.stringify({
-    region: 'us1',
-    accountId: box.id.replace(/[^a-z0-9]/gi, '').slice(0, 20),
-    podId: `pod-${box.id}`,
-    token: `nto-${Math.random().toString(36).slice(2, 12)}`,
-    agent: ep.agent, vnc: ep.vnc, p1340: ep.p1340, p6081: ep.p6081,
-  });
-  // the backend (handleStreamChat) forwards each UI prompt here to be driven
-  process.env.OZ_BOX_AGENT = ep.agent;
-  // other methods must still reach the REAL backend, or the app can't load
-  process.env.OPENZOO_PASSTHRU = '1';
-  process.env.OPENZOO_FORCE_BLOCK = '1';
-
-  // 2) pin + serve api2.cursor.sh locally (sudo). Chromium flags don't reach
-  //    the Electron main process; only /etc/hosts + Node TLS override do.
-  const { blockBackend, unblockBackend, isBlocked } = await import('./hosts.js');
-  const { startCursorBackend } = await import('./cursorbackend.js');
-  console.error('openzoo grokbot: pinning api2.cursor.sh (sudo)…');
-  if (!isBlocked()) blockBackend();
-  startCursorBackend({ port: 443, log: (m) => console.error(`  backend: ${m}`) });
-
-  const restore = () => { try { unblockBackend(); console.error('openzoo: /etc/hosts restored.'); } catch { /* */ } };
-  process.on('SIGINT', () => { restore(); process.exit(0); });
-  process.on('exit', restore);
-
-  // 3) launch the app directly (open -a can't pass env) with Node TLS override
-  console.error('openzoo grokbot: launching Grok Bot pointed at your box…');
-  console.error(`  box proxy   : ${ep.proxy}`);
-  console.error(`  agent (1337): ${ep.agent}`);
-  console.error(`  ssh         : ${box.ssh || '(pending)'}`);
-  console.error('  WATCH the box agent log for what the app sends:');
-  console.error(`    ${box.ssh ? box.ssh + " 'tail -f /var/log/openzoo/agent.log'" : '(ssh not ready yet)'}`);
-  try { execSync('osascript -e \'tell application "Grok Bot" to quit\'', { stdio: 'ignore' }); } catch { /* */ }
-  await new Promise((r) => setTimeout(r, 2500));
-  spawn(`${APP}/Contents/MacOS/Grok Bot`, ['--ignore-certificate-errors'], {
-    stdio: 'ignore', detached: true,
-    env: { ...process.env, NODE_TLS_REJECT_UNAUTHORIZED: '0' },
-  }).unref();
-
-  console.error('openzoo grokbot: ctrl-c to stop, restore /etc/hosts, and leave the box running.');
-  console.error(`  the box keeps running until its TTL — manage with: RUNPOD_API_KEY=… openzoo grokbot (again) or the runpod console`);
-  await new Promise(() => {});
-}