openzoo 0.49.6 → 0.49.8

package/lib/proxy.js

@@ -14,11 +14,13 @@ import { evmTokenBalance } from './evm.js';
 import { bindCorpus, contextCacheDisabled, BIND_MIN_CHARS } from './hrr.js';
 import {
   loadBoundChars, noteCorpusLedger, filesForCorpus, readFilesForCorpus, boundAbsFromKeys,
-  createSpillStats, corpusCharsForSend, applySpillCut, msgText, hudDollarX,
+  createSpillStats, corpusCharsForSend, msgText, hudDollarX,
   spillPricedLine,
   planConversationBind, rememberSpillMemo, SPILL_CONTENT_ANCHOR_CHARS,
+  corpusRecall,
+  decideChatSpill, isOneShotCorpusAsk,
 } from './spill.js';
-import { rewritablePath, augmentModelList, ALIAS_IDS, rewriteChatModel, zooModelIds, CLASSIFY_MAX_TOKENS } from './models.js';
+import { rewritablePath, modelsListForRequest, ALIAS_IDS, rewriteChatModel, zooModelIds, CLASSIFY_MAX_TOKENS } from './models.js';
 import { forgetContext } from './contexts.js';
 import { injectBrief } from './brief.js';
 import { withNamespace } from './namespace.js';
@@ -28,8 +30,9 @@ import { loadSessionSpend, saveSessionSpend } from './session.js';
 import { creditBalance, quotedPrices } from './info.js';
 import { subscriptionPublicView } from './subscription.js';
 import { priceHoldings } from './livestatus.js';
-import { receiptUsedCogs, receiptDirectUsd } from './racesettle.js';
+import { receiptUsedCogs, receiptDirectUsd, pairActualBilled } from './racesettle.js';
 import { rewriteWrapClientError } from './wrap.js';
+import { fetchHeaders } from './fetch.js';
 
 const HOP_BY_HOP = new Set([
   'host', 'connection', 'keep-alive', 'transfer-encoding', 'upgrade',
@@ -431,40 +434,61 @@ async function spillTranscript(body, log, req, stats, extra = {}) {
   // in process memory so this request recuts when the green x is under 10.
   // No restart. OPENZOO_ADAPT=0 freezes the env defaults. The ask always
   // stays; we never drop below 2 real user/assistant turns to delete it.
+  //
+  // 1-model AND raced grokui AUTO both land here (same POST /chat/completions
+  // door). The old `msgs.length < 6` bail skipped fat 1-model hops � a 40k
+  // command-output turn with 4�5 messages never bound, so spent?direct.
+  // decideChatSpill is the shared gate: oversized ? bind prefix + system/tail
+  // + x-hrr-context; small ? passthrough. Race fields do not change it.
   const knownLedger = (sessionKey && spillMemo.get(sessionKey))
     || (sessionKey && sessionLedger.get(sessionKey))
     || null;
   const knownChars = knownLedger?.contextId
     ? (boundChars.get(knownLedger.contextId) || 0)
     : 0;
-  const adapted = applySpillCut(msgs, {
+  const decision = decideChatSpill(body, {
     corpusChars: knownChars,
     boundAbs: previouslyBoundAbs,
+    recall: corpusRecall(typeof knownLedger?.corpus === 'string' ? knownLedger.corpus : ''),
     log,
     persist: true,
     dollarX: extra.dollarX ?? hudDollarX(stats || {}),
     lastSend: extra.lastSend,
+    minPrefixChars: BIND_MIN_CHARS,
   });
-  if (adapted.cut <= adapted.firstSpillable) {
+  if (decision.mode === 'passthrough') {
+    bindFilesInBackground(decision.reason === 'no-cut'
+      ? 'no severable cut, files only'
+      : 'conversation under spill threshold, background');
+    return null;
+  }
+  if (decision.mode === 'stub-only') {
     bindFilesInBackground('no severable cut, files only');
     // Still forward stubbed/trimmed bodies so an un-severable storm is not
     // shipped at full size just because cutTranscript could not move.
-    if (adapted.stubbed?.dropped || adapted.stubbed?.stubbed) {
-      return {
-        body: Buffer.from(JSON.stringify({ ...body, messages: adapted.stubbed.messages })),
-        corpus: '',
-        reused: false,
-        savedBytes: 0,
-        sent: adapted.stubbed.messages.length,
-        msgs: msgs.length,
-      };
-    }
-    return null;
+    return {
+      body: Buffer.from(JSON.stringify({ ...body, messages: decision.forwarded })),
+      corpus: '',
+      reused: false,
+      savedBytes: 0,
+      sent: decision.forwarded.length,
+      msgs: msgs.length,
+    };
   }
+  // oneshot is handled in maybeCacheCorpus; if we reach it here, bind the
+  // extracted corpus the same way as a transcript prefix.
+  if (decision.mode === 'oneshot' && !decision.adapted) {
+    decision.adapted = {
+      cut: msgs.length - 1,
+      firstSpillable: Math.max(0, msgs.findIndex((m) => m?.role !== 'system')),
+      stubbed: { messages: decision.forwarded, stubbed: 0, dropped: 0 },
+    };
+  }
+  const adapted = decision.adapted;
   const { cut, firstSpillable } = adapted;
   const stubbed = adapted.stubbed;
 
-  const head = msgs.slice(0, firstSpillable);     // system block, always kept
+  const head = decision.head.length ? decision.head : msgs.slice(0, firstSpillable);     // system block, always kept
   // EVERY FILE THE AGENT TOUCHED, AT FULL SIZE.
   //
   // The saving ratio is corpus/sent, so on a fresh session — where the corpus
@@ -493,7 +517,8 @@ async function spillTranscript(body, log, req, stats, extra = {}) {
   // Nothing recalls a file during the turn that read it � the model already has
   // the tool result in its window. Files are only worth having bound for the
   // NEXT ask, so they append after the conversation bind completes.
-  const turns = msgs.slice(firstSpillable, cut).map(msgText).filter(Boolean).join('\n\n');
+  const turns = decision.prefix
+    || msgs.slice(firstSpillable, cut).map(msgText).filter(Boolean).join('\n\n');
   const corpus = turns;
   if (!sessionKey) sessionKey = corpus.slice(0, SPILL_CONTENT_ANCHOR_CHARS);
 
@@ -704,7 +729,10 @@ async function spillTranscript(body, log, req, stats, extra = {}) {
   const topK = Math.max(4, Math.min(12, Math.round(budget / 320)));
 
   return {
-    body: Buffer.from(JSON.stringify({ ...body, messages: [...head, ...stubbed.messages.slice(cut)] })),
+    body: Buffer.from(JSON.stringify({
+      ...body,
+      messages: decision.forwarded || [...head, ...stubbed.messages.slice(cut)],
+    })),
     topK,
     contextId: bind.contextId,
     hash: bind.hash,
@@ -740,10 +768,10 @@ async function maybeCacheCorpus(req, bodyBuf, log, stats, extra = {}) {
   // the ask verbatim. Anything else (an agent transcript) falls through to the
   // transcript spill, which used to be a silent no-op.
   const last = msgs[msgs.length - 1];
-  const oneShot = typeof last?.content === 'string'
-    && last.content.length > BIND_MIN_CHARS
-    && last.content.lastIndexOf('\n\n') >= BIND_MIN_CHARS;
-  if (!oneShot) return spillTranscript(body, log, req, stats, extra);
+  // Same gate decideChatSpill uses � 1-model and race share it. zoo_ask
+  // stays on the corpus+question bind; everything else (including grokui
+  // AUTO, raced or not) falls through to spillTranscript ? decideChatSpill.
+  if (!isOneShotCorpusAsk(msgs, BIND_MIN_CHARS)) return spillTranscript(body, log, req, stats, extra);
   const cut = last.content.lastIndexOf('\n\n');
   const corpus = last.content.slice(0, cut);
   const ask = last.content.slice(cut + 2).trim();
@@ -933,7 +961,13 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
       refreshPrices();
       const money = walletMoney();
       res.writeHead(200, { 'content-type': 'application/json' });
+      // Same package.json the startup banner reads � grokui-app refuses to
+      // attach to a leftover :8402 whose version is older than it shipped with.
+      const { version } = JSON.parse(
+        readFileSync(new URL('../package.json', import.meta.url), 'utf8'),
+      );
       res.end(JSON.stringify({
+        version,
         spentUsd: sessionSpent, cogsUsd: sessionCogs, directUsd: sessionDirect, paidCalls,
         creditUsd, chainUsd: money.chainUsd, lastQuoteUsd,
         subscription: subscriptionPublicView(),
@@ -1468,13 +1502,24 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     // rewrite never gets its chance.
     const path = (req.url || '').split('?')[0];
     if (req.method === 'GET' && path === '/v1/models') {
+      // Catalog is chrome, not a paid call. Paying the list would wrap-walk
+      // an empty burner (~4.5s/row) and stall first paint / harness probe.
       try {
-        const { response } = await client.fetch(url, init);
-        const payload = await response.json();
-        res.writeHead(response.status, { 'content-type': 'application/json' });
-        res.end(JSON.stringify(response.ok ? augmentModelList(payload) : payload));
-        return;
-      } catch { /* fall through to the plain relay below */ }
+        const response = await fetchHeaders(url, init);
+        if (response.ok) {
+          const payload = await response.json();
+          // Full zoo catalog � never collapse to a single opus-5 or a claude-*
+          // allowlist. Claude Code (ANTHROPIC_BASE_URL + gateway discovery) reads
+          // data[].id / display_name; OpenAI clients keep object:"list".
+          res.writeHead(200, { 'content-type': 'application/json' });
+          res.end(JSON.stringify(modelsListForRequest(payload, req.headers)));
+          return;
+        }
+        await response.text().catch(() => {});
+      } catch { /* gateway 402/down � serve aliases so chrome still paints */ }
+      res.writeHead(200, { 'content-type': 'application/json' });
+      res.end(JSON.stringify(modelsListForRequest({ object: 'list', data: [] }, req.headers)));
+      return;
     }
     const probe = req.method === 'GET' && /^\/v1\/models\/(.+)$/.exec(path);
     if (probe && ALIAS_IDS.includes(decodeURIComponent(probe[1]))) {
@@ -1598,18 +1643,26 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
         // completion already — no extra call, and unlike the account-level
         // /api/v1/credits total it is attributable to THIS proxy even though the
         // same OpenRouter key also pays for ttfx and everything else.
-        if (typeof data?.usage?.cost === 'number' && data.usage.cost >= 0) {
-          sessionActual += data.usage.cost;
-          actualCalls += 1;
+        {
           // PAIR THE NUMERATOR WITH THE DENOMINATOR. sessionSpent is summed on
           // three paths and sessionActual on two, so markupX divided ALL billed
-          // by the SUBSET that reported a real cost — a 402-receipt call added
+          // by the SUBSET that reported a real cost � a 402-receipt call added
           // to billed and nothing to real, and the ratio read 12.55x on a stack
           // running at ~1.0x. Track the billed side of exactly the calls whose
           // cost we actually learned.
           // Both figures ride the SAME response object, so read them together
           // rather than carrying one across sites and hoping the order holds.
-          billedWithActual += Number(data?.x402?.billedUsd) || 0;
+          //
+          // x402.billedUsd is often the QUOTE reserve (max_tokens � catalog),
+          // not the settled charge. MEASURED: $0.9858 reserved vs $0.007962
+          // usage.cost -> markupX lied at 124x on a ~1x call. Pair usage.cost
+          // with post-completion billed, never the reserve.
+          const pair = pairActualBilled(data?.x402, data?.usage);
+          if (pair) {
+            sessionActual += pair.upstreamUsd;
+            actualCalls += 1;
+            billedWithActual += pair.billedUsd;
+          }
         }
         // PREPAID CALLS STILL COST MONEY. The block above only meters calls
         // where THIS proxy answered a 402 and paid. When prepaid credit covers
@@ -1681,12 +1734,20 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
       // same figures the JSON path reads out of `data.x402`, same counters, so
       // the status line does not care which transport served the answer.
       const meterStreamed = (x) => {
+        // Same pairing rule as the JSON path: actualUsd / usage.cost with the
+        // settled billed twin, even on a wallet-paid stream (do not skip just
+        // because `paid` already recorded the quote-time receipt).
+        const pair = pairActualBilled(x, x?.usage);
+        if (pair) {
+          sessionActual += pair.upstreamUsd;
+          actualCalls += 1;
+          billedWithActual += pair.billedUsd;
+        }
         if (paid || typeof x?.billedUsd !== 'number') return;
         sessionSpent += x.billedUsd;
         sessionCogs += receiptUsedCogs(x);
         noteQuote(x);
         sessionDirect += receiptDirectUsd(x);
-        if (typeof x.actualUsd === 'number' && x.actualUsd >= 0) { sessionActual += x.actualUsd; actualCalls += 1; billedWithActual += x.billedUsd || 0; }
         if (didSpill) {
           log(spillPricedLine(x, { streamed: true }));
           spill.spillSpend += x.billedUsd;

package/lib/racesettle.js

@@ -180,6 +180,133 @@ export function receiptDirectUsd(x) {
   return billedOk ? billed : 0;
 }
 
+/** Zoo's share of (direct − OpenRouter) when the 402 has real savings. */
+export const SAVINGS_SHARE = 0.33;
+/**
+ * billed / usage.cost above this, without settled house cogs, is the
+ * max_tokens quote reserve — not the charge after completion.
+ * MEASURED 2026-08-19: $0.9858 reserved / $0.007962 usage.cost ≈ 124× on a ~1× call.
+ */
+export const QUOTE_RESERVE_X = 2;
+
+function money(v) {
+  return typeof v === 'number' && Number.isFinite(v) && v >= 0 ? v : null;
+}
+
+function closeRatio(a, b, rel = 0.25) {
+  const den = Math.max(b, 1e-12);
+  return Math.abs(a - b) / den <= rel;
+}
+
+/**
+ * After-completion billed fields the gateway may already put on x402 / usage.
+ * Read only if present — do not invent them on the wire.
+ */
+function explicitSettledBilled(x, usage) {
+  const bags = [x, usage, x?.used, x?.settled, x?.receipt, usage?.used, usage?.settled]
+    .filter((o) => o && typeof o === 'object' && !Array.isArray(o));
+  const keys = [
+    'billedActual', 'billedActualUsd', 'settledUsd', 'settledBilledUsd',
+    'chargedUsd', 'usedUsd', 'actualBilledUsd',
+  ];
+  for (const bag of bags) {
+    for (const k of keys) {
+      const n = money(bag[k]);
+      if (n != null) return n;
+    }
+  }
+  return null;
+}
+
+/** tokens actually used × unit prices, only when both sides are already on the object. */
+function billedFromUsedTokens(x, usage) {
+  const prompt = money(usage?.prompt_tokens ?? usage?.promptTokens ?? x?.prompt_tokens);
+  const completion = money(usage?.completion_tokens ?? usage?.completionTokens ?? x?.completion_tokens);
+  const inPrice = money(x?.promptPriceUsd ?? x?.inputPriceUsd ?? x?.priceInUsd);
+  const outPrice = money(x?.completionPriceUsd ?? x?.outputPriceUsd ?? x?.priceOutUsd);
+  if (prompt != null && completion != null && inPrice != null && outPrice != null) {
+    return prompt * inPrice + completion * outPrice;
+  }
+  return null;
+}
+
+/**
+ * True when `billed` is the quote-time max_tokens ceiling, not the settled charge.
+ * A large billed/cost is honest when cogs already matches usage.cost (33% of
+ * real savings). The 124× lie is billed >> cost with at-cost / reserved cogs.
+ */
+export function isQuoteReserveBilled(billed, cost, x = {}) {
+  if (money(billed) == null || money(cost) == null) return false;
+  if (cost === 0) return billed > 0;
+  if (billed <= cost * QUOTE_RESERVE_X) return false;
+  const cogs = money(x?.cogsUsd);
+  if (cogs != null && closeRatio(cogs, cost)) return false;
+  const saved = money(x?.savedUsd);
+  if (saved == null || saved <= cost * 0.5) return true;
+  if (cogs != null && cogs > cost * QUOTE_RESERVE_X) return true;
+  return true;
+}
+
+/**
+ * Post-completion billed USD to pair with usage.cost / x.actualUsd.
+ * `x.billedUsd` is often the quote reserve (max_tokens × catalog), which made
+ * HUD markupX read 124× on a ~1× call. Prefer a settled field; otherwise
+ * reconstruct from tokens used × price or from usage.cost (+ 33% of settled
+ * savings). Never return the reserve when we learned the real upstream cost.
+ */
+export function receiptSettledBilled(x, usage) {
+  const cost = money(usage?.cost) ?? money(x?.actualUsd) ?? money(usage?.actualUsd);
+  const explicit = explicitSettledBilled(x, usage);
+  if (explicit != null) return explicit;
+
+  const fromTokens = billedFromUsedTokens(x, usage);
+  if (fromTokens != null) {
+    const billed = money(x?.billedUsd);
+    if (billed == null || isQuoteReserveBilled(billed, fromTokens, x)
+        || (cost != null && isQuoteReserveBilled(billed, cost, x))) {
+      return fromTokens;
+    }
+    return billed;
+  }
+
+  const billed = money(x?.billedUsd);
+  if (billed != null && (cost == null || !isQuoteReserveBilled(billed, cost, x))) {
+    return billed;
+  }
+  if (cost != null) {
+    const saved = settledSavedUsd(x, cost);
+    return cost + SAVINGS_SHARE * saved;
+  }
+  return billed ?? 0;
+}
+
+function settledSavedUsd(x, cost) {
+  const saved = money(x?.savedUsd);
+  if (saved == null || saved <= 0) return 0;
+  const cogs = money(x?.cogsUsd);
+  // Quote-time savedUsd rides the same max_tokens reserve. Only keep it when
+  // house cost already matches the metered upstream (settled cogs).
+  if (cogs != null && closeRatio(cogs, cost)) return saved;
+  return 0;
+}
+
+/**
+ * Pair the HUD denominator (real upstream) with the post-completion billed
+ * twin. Null when this call did not report a real cost — do not mix populations.
+ */
+export function pairActualBilled(x402, usage) {
+  const fromUsage = money(usage?.cost);
+  const fromX = money(x402?.actualUsd) ?? money(x402?.usage?.cost);
+  const upstreamUsd = fromUsage ?? fromX;
+  if (upstreamUsd == null) return null;
+  const bag = x402 && typeof x402 === 'object' ? x402 : {};
+  const usageBag = usage && typeof usage === 'object' ? usage : {};
+  return {
+    upstreamUsd,
+    billedUsd: receiptSettledBilled(bag, { ...usageBag, cost: upstreamUsd }),
+  };
+}
+
 /**
  * Session meter. spent/direct are the receipt totals as billed — never a
  * first-call rewrite, never a race_unused user refund.