npm - openzoo - Versions diffs - 0.49.7 → 0.49.8 - Mend

openzoo 0.49.7 → 0.49.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (10) hide show

package/README.md CHANGED Viewed

@@ -23,7 +23,26 @@ paid $0.002137 (9.5× cheaper than direct) · rail solana · tx 5Kd…
 **Cursor** (Settings → Models → OpenAI API): set *Override OpenAI Base URL* to `http://localhost:8402/v1`, API key `sk-openzoo`. (Cursor Hobby can't BYOK; Pro can.)
-**Claude Code / any OpenAI-env tool:**
+**Claude Code (zoo catalog, not opus-5-only):**
+Prefer this. `ANTHROPIC_API_KEY` stays unset (it would bill api.anthropic.com). Base URL is `http://localhost:8402/v1`. `/model` should list zoo animals from the live OpenRouter catalog (plus `openzoo-*` twins), not a single opus-5.
+```bash
+npx openzoo claude
+```
+Leave a healthy `:8402` sidecar alone. Manual equivalent:
+```bash
+unset ANTHROPIC_API_KEY
+export ANTHROPIC_BASE_URL=http://localhost:8402/v1
+export ANTHROPIC_AUTH_TOKEN=sk-openzoo
+export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1
+curl -s "$ANTHROPIC_BASE_URL/models"   # many OpenRouter ids, not 1
+claude                                 # /model lists those zoo animals
+```
+**Any OpenAI-env tool:**
 ```bash
 export OPENAI_BASE_URL=http://localhost:8402/v1
 export OPENAI_API_KEY=sk-openzoo

package/lib/grokui.mjs CHANGED Viewed

@@ -716,8 +716,13 @@ function isTransientModelFail(text) {
   if (/returned nothing \d+ times|each returned nothing/i.test(s)) return true;
   return false;
 }
+function isEmptyWalletPayment(text) {
+  // Empty/underfunded only — not a generic HTTP 402 handshake.
+  return /\b(?:wallet is empty|empty wallet|wallet underfunded|underfunded)\b/i.test(String(text || ''));
+}
 function isPaymentFailed(text) {
-  return /\b(?:payment failed|HTTP 402|wallet is empty|empty wallet)\b/i.test(String(text || ''));
+  return isEmptyWalletPayment(text)
+    || /\b(?:payment failed|HTTP 402|payment required)\b/i.test(String(text || ''));
 }
 // Empty stdout, "(no output)", or a directive that found nothing. That is
 // still a command-output hop today, so AUTO used to chain once and then park
@@ -3212,6 +3217,10 @@ const APP_HTML = `<!doctype html>
   #walletOverlay, #sitrepOverlay { position: fixed; inset: 0; background: rgba(0,0,0,.66); z-index: 1200;
                    display: none; align-items: center; justify-content: center; padding: 24px; }
   #walletOverlay.show, #sitrepOverlay.show { display: flex; }
+  .payneed-btn { display: block; margin-top: 10px; border: 0; cursor: pointer;
+    background: #b8f240; color: #0b0b0d; font: 700 12px/1.2 inherit;
+    letter-spacing: .04em; padding: 7px 14px; border-radius: 999px; }
+  .payneed-btn:hover { filter: brightness(1.05); }
   #walletBox, #sitrepBox { width: 100%; max-width: 560px; max-height: 82vh; overflow-y: auto; background: #111113;
                border: 1px solid #2c2c2e; border-radius: 16px; padding: 20px 22px; }
   #walletBox h3, #sitrepBox h3 { margin: 0 0 2px; font-size: 15px; font-weight: 600; }
@@ -4056,6 +4065,15 @@ const APP_HTML = `<!doctype html>
     });
     return row;
   }
+  function isEmptyWalletPayment(text) {
+    return /\b(?:wallet is empty|empty wallet|wallet underfunded|underfunded)\b/i.test(String(text || ''));
+  }
+  var openedPayForEmpty = false;
+  function maybeOpenPayForEmptyWallet(text) {
+    if (openedPayForEmpty || !isEmptyWalletPayment(text)) return;
+    openedPayForEmpty = true;
+    openWallet();
+  }
   async function openWallet() {
     walletOverlay.classList.add('show');
     walletBody.textContent = 'loading…';
@@ -4865,6 +4883,15 @@ const APP_HTML = `<!doctype html>
         const preview = htmlPreviewUrl(text);
         if (preview) textEl.appendChild(previewFrame(preview, htmlPreviewKey(text, preview)));
       }
+      if (who === 'bot' && isEmptyWalletPayment(text)) {
+        const pay = document.createElement('button');
+        pay.type = 'button';
+        pay.className = 'payneed-btn';
+        pay.textContent = 'payment required';
+        pay.addEventListener('click', function (e) { e.preventDefault(); openWallet(); });
+        textEl.appendChild(pay);
+        maybeOpenPayForEmptyWallet(text);
+      }
       bubble.appendChild(textEl);
       row.appendChild(bubble);
       // Copy the message SOURCE, not rendered HTML — markdown, code fences and
@@ -5889,7 +5916,7 @@ export {
   parseRun, looksLikeMcpAsBash, stripThinkTags, safeResolveIn, inDir, listDir,
   handleSlash, newThread, setRunTurnForTest, setBrainAskForTest, runTurn,
   AUTO_CONTINUE, AUTO_RACE_RETRY, AUTO_EMPTY_RETRY, pingWakeText, pingCanWake, shouldKeepAuto,
-  isDoneReply, isTransientModelFail, isEmptyToolResult, enqueueAutoHop, childKickoff, findByName,
+  isDoneReply, isTransientModelFail, isPaymentFailed, isEmptyWalletPayment, isEmptyToolResult, enqueueAutoHop, childKickoff, findByName,
   attachChildDir, finishChildDir,
   lockWorktree, unlockWorktree, parsePrRef, fetchSpecsForOrigin, agentSlug,
   filesForCorpus, noteFileForCorpus, noteRunForCorpus, resetFilesForCorpus,

package/lib/launch.js CHANGED Viewed

@@ -15,6 +15,30 @@ import os from 'node:os';
 import path from 'node:path';
 import { config } from './config.js';
+/**
+ * Claude Code ≥2.1.129 only reads GET /v1/models when gateway discovery is
+ * opted in. Without this flag the picker stays the built-in opus-5 / tiny
+ * claude-* set instead of the zoo catalog the proxy publishes.
+ * CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC (even "0") blocks that GET.
+ *
+ * Do NOT invent ANTHROPIC_MODEL=openzoo-claude-sonnet-5. That pin hid the
+ * live OpenRouter catalog behind one Anthropic-native row. Only alias a
+ * model the caller already chose (OPENZOO_CLAUDE_ALIAS or ANTHROPIC_MODEL).
+ */
+export function applyClaudeCodeCatalogEnv(env) {
+  if (env.OPENZOO_NO_GATEWAY_DISCOVERY !== '1') {
+    env.CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY = env.CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY || '1';
+    delete env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC;
+  }
+  if (env.OPENZOO_NO_ALIAS === '1') return env;
+  const want = env.OPENZOO_CLAUDE_ALIAS || env.ANTHROPIC_MODEL;
+  if (!want) return env;
+  const bare = String(want).replace(/^openzoo-/, '').replace(/^[^/]+\//, '');
+  const SAFE = /^claude-(opus|sonnet|fable)-/;
+  if (SAFE.test(bare)) env.ANTHROPIC_MODEL = `openzoo-${bare}`;
+  return env;
+}
 /** Resolve the Claude DESKTOP app binary, platform-agnostically. Spawn the
  *  binary directly (not `open -a`) so the env — ANTHROPIC_BASE_URL — survives;
  *  macOS `open` hands off to launchd and drops it. */
@@ -143,40 +167,9 @@ export async function launchClaude(argv) {
   delete env.ANTHROPIC_API_KEY;
   env.ANTHROPIC_BASE_URL = base;
   env.ANTHROPIC_AUTH_TOKEN = process.env.ANTHROPIC_AUTH_TOKEN || 'sk-openzoo';
-  // STOP CLAUDE CODE COMPACTING ON A WINDOW THAT IS NOT REAL.
-  //
-  // It counts the WHOLE local transcript and compacts against a window it looks
-  // up from the MODEL NAME — hardcoded 200k for a recognised Claude id, which is
-  // why `/autocompact 1m` answered "capped to 200k by model" and why raising
-  // CLAUDE_CODE_MAX_CONTEXT_TOKENS alone did nothing. It never sees that the
-  // proxy binds the prefix and forwards ~8 of 166 turns.
-  //
-  // An `openzoo-` alias is the same model upstream (models.js resolves by
-  // SUFFIX, so openzoo-claude-sonnet-5 -> anthropic/claude-sonnet-5) but is not
-  // in that table, so the client falls back to the advertised context_length —
-  // which this gateway publishes as 128,000,000.
-  //
-  // OPENZOO_NO_ALIAS=1 opts out. Worth knowing: model-specific client behaviour
-  // (thinking budget, tool formats) also keys off the name, so if a session
-  // behaves oddly this is the first thing to turn off.
-  // Applies to WHATEVER model you are on — opus, fable, sonnet, haiku. The
-  // 200k table is keyed by name, so every recognised Claude id hits it; the
-  // alias is minted from the requested model rather than pinned to sonnet.
-  if (process.env.OPENZOO_NO_ALIAS !== '1') {
-    const want = process.env.OPENZOO_CLAUDE_ALIAS
-      || process.env.ANTHROPIC_MODEL
-      || 'claude-sonnet-5';
-    // idempotent: never openzoo-openzoo-…; strip a vendor prefix so the SUFFIX
-    // resolver in models.js gets the bare family name it matches on.
-    const bare = String(want).replace(/^openzoo-/, '').replace(/^[^/]+\//, '');
-    // ONLY families whose alias was VERIFIED to resolve back to themselves.
-    // openzoo-claude-haiku-4-5 resolved to deepseek/deepseek-v4-pro-0813 — the
-    // suffix scorer found no haiku in the catalog and picked a neighbour, so
-    // aliasing it would silently swap the user's model. A compaction fix is
-    // never worth answering as a different model than the one asked for.
-    const SAFE = /^claude-(opus|sonnet|fable)-/;
-    if (SAFE.test(bare)) env.ANTHROPIC_MODEL = `openzoo-${bare}`;
-  }
+  applyClaudeCodeCatalogEnv(env);
+  // ANTHROPIC_MODEL is only aliased (never invented) in applyClaudeCodeCatalogEnv.
+  // A default pin to openzoo-claude-sonnet-5 hid the live zoo catalog.
   // THE ACTUAL SWITCHES. Three earlier attempts missed these entirely:
   // autoCompactEnabled in settings (global, trapped a session), a raised
   // CLAUDE_CODE_MAX_CONTEXT_TOKENS (clamped to 200k by the model table), and an
@@ -319,6 +312,7 @@ export async function launchClaude(argv) {
     console.error('');
     console.error('  \x1b[38;5;208m●\x1b[0m openzoo — this Claude Code session routes through the zoo');
     console.error(`     endpoint : ${base}`);
+    console.error('     models   : GET /v1/models (zoo catalog — /model lists zoo animals, not opus-5-only)');
     console.error('     auth     : gateway token (ANTHROPIC_API_KEY unset — no api.anthropic.com billing)');
     if (wallet) console.error(`     wallet   : ${wallet}`);
     console.error('     spend    : live in the status line below (bottom of screen); receipts in ~/.openzoo/proxy.log');
@@ -425,40 +419,9 @@ export async function launchHarness(cmd, args) {
   delete env.ANTHROPIC_API_KEY;   // conflicts with the gateway auth-token path
   env.ANTHROPIC_BASE_URL = base;
   env.ANTHROPIC_AUTH_TOKEN = process.env.ANTHROPIC_AUTH_TOKEN || 'sk-openzoo';
-  // STOP CLAUDE CODE COMPACTING ON A WINDOW THAT IS NOT REAL.
-  //
-  // It counts the WHOLE local transcript and compacts against a window it looks
-  // up from the MODEL NAME — hardcoded 200k for a recognised Claude id, which is
-  // why `/autocompact 1m` answered "capped to 200k by model" and why raising
-  // CLAUDE_CODE_MAX_CONTEXT_TOKENS alone did nothing. It never sees that the
-  // proxy binds the prefix and forwards ~8 of 166 turns.
-  //
-  // An `openzoo-` alias is the same model upstream (models.js resolves by
-  // SUFFIX, so openzoo-claude-sonnet-5 -> anthropic/claude-sonnet-5) but is not
-  // in that table, so the client falls back to the advertised context_length —
-  // which this gateway publishes as 128,000,000.
-  //
-  // OPENZOO_NO_ALIAS=1 opts out. Worth knowing: model-specific client behaviour
-  // (thinking budget, tool formats) also keys off the name, so if a session
-  // behaves oddly this is the first thing to turn off.
-  // Applies to WHATEVER model you are on — opus, fable, sonnet, haiku. The
-  // 200k table is keyed by name, so every recognised Claude id hits it; the
-  // alias is minted from the requested model rather than pinned to sonnet.
-  if (process.env.OPENZOO_NO_ALIAS !== '1') {
-    const want = process.env.OPENZOO_CLAUDE_ALIAS
-      || process.env.ANTHROPIC_MODEL
-      || 'claude-sonnet-5';
-    // idempotent: never openzoo-openzoo-…; strip a vendor prefix so the SUFFIX
-    // resolver in models.js gets the bare family name it matches on.
-    const bare = String(want).replace(/^openzoo-/, '').replace(/^[^/]+\//, '');
-    // ONLY families whose alias was VERIFIED to resolve back to themselves.
-    // openzoo-claude-haiku-4-5 resolved to deepseek/deepseek-v4-pro-0813 — the
-    // suffix scorer found no haiku in the catalog and picked a neighbour, so
-    // aliasing it would silently swap the user's model. A compaction fix is
-    // never worth answering as a different model than the one asked for.
-    const SAFE = /^claude-(opus|sonnet|fable)-/;
-    if (SAFE.test(bare)) env.ANTHROPIC_MODEL = `openzoo-${bare}`;
-  }
+  applyClaudeCodeCatalogEnv(env);
+  // ANTHROPIC_MODEL is only aliased (never invented) in applyClaudeCodeCatalogEnv.
+  // A default pin to openzoo-claude-sonnet-5 hid the live zoo catalog.
   // THE ACTUAL SWITCHES. Three earlier attempts missed these entirely:
   // autoCompactEnabled in settings (global, trapped a session), a raised
   // CLAUDE_CODE_MAX_CONTEXT_TOKENS (clamped to 200k by the model table), and an

package/lib/livestatus.js CHANGED Viewed

@@ -118,7 +118,7 @@ export function clipRacePreview(text, maxLines = 8, maxChars = 420) {
 /** Race-level failure when no countable answer exists. Never a single model name. */
 export const RACE_EVERY_FAILED = '(race: every model failed — no reply)';
-const RACE_HTTP_NOTE = /^\((?:upstream error|request failed|payment failed|rate limited|stream timed out|stream stalled)/i;
+const RACE_HTTP_NOTE = /^\((?:upstream error|request failed|payment failed|payment required|rate limited|stream timed out|stream stalled)/i;
 const RACE_MODEL_FAILED = /^\([^)]+ (?:failed:|returned nothing)/i;
 const RACE_FETCH_FAILED = /^(?:typeerror:\s*)?fetch failed$/i;
@@ -159,7 +159,7 @@ export function raceFailKind(arrival) {
   const s = `${err} ${text}`.trim();
   if (!s) return 'empty body';
   if (/timeout|STREAM_IDLE|aborted|AbortError/i.test(s)) return 'timeout';
-  if (/402|payment failed/i.test(s)) return 'pay';
+  if (/402|payment failed|payment required/i.test(s)) return 'pay';
   if (/fetch failed/i.test(s)) return 'fetch failed';
   const http = /HTTP\s+(\d{3})/i.exec(s);
   if (http) return `HTTP ${http[1]}`;

package/lib/models.js CHANGED Viewed

@@ -251,6 +251,92 @@ export function augmentModelList(payload) {
   return { ...payload, object: payload?.object || 'list', data: [...data, ...branded, ...aliases] };
 }
+/**
+ * Label a catalog id for a picker without minting a new id.
+ * `x-ai/grok-4.6` stays `x-ai/grok-4.6` on the wire; the label is just
+ * "grok-4.6 (x-ai)". Never invents a `claude-*` name for a non-Anthropic animal.
+ */
+export function displayNameFor(id) {
+  const raw = String(id || '').trim();
+  if (!raw) return raw;
+  if (raw.includes('/')) {
+    const slash = raw.indexOf('/');
+    return `${raw.slice(slash + 1)} (${raw.slice(0, slash)})`;
+  }
+  return raw;
+}
+function decorateModelEntry(m) {
+  if (!m || typeof m !== 'object') return m;
+  return {
+    ...m,
+    object: m.object || 'model',
+    type: m.type || 'model',
+    display_name: m.display_name || displayNameFor(m.id),
+  };
+}
+/**
+ * OpenAI-compatible /v1/models body Claude Code and every other harness can
+ * read. The full zoo catalog is kept — no claude-* filter, no single opus-5
+ * collapse. Extra Anthropic fields (`type`, `display_name`) sit alongside
+ * OpenAI ones so a Messages-API client can label rows without a second
+ * endpoint. Existing OpenAI clients ignore the extras.
+ */
+export function publishModelList(payload) {
+  const merged = augmentModelList(payload);
+  const data = (merged.data || []).map(decorateModelEntry);
+  return {
+    ...merged,
+    object: merged.object || 'list',
+    data,
+    has_more: false,
+    first_id: data[0]?.id ?? null,
+    last_id: data[data.length - 1]?.id ?? null,
+  };
+}
+/**
+ * Anthropic GET /v1/models shape (id + display_name + type).
+ * Claude Code gateway discovery reads `data[].id` and optional `display_name`.
+ * Ids are the zoo's real catalog ids — never rewritten to fake `claude-*`
+ * aliases for grok / deepseek / gemini / etc.
+ */
+export function anthropicModelList(payload) {
+  const published = publishModelList(payload);
+  const data = (published.data || []).map((m) => ({
+    type: 'model',
+    id: m.id,
+    display_name: m.display_name || displayNameFor(m.id),
+    ...(m.created_at ? { created_at: m.created_at } : {}),
+    ...(m.served_by ? { served_by: m.served_by } : {}),
+  }));
+  return {
+    data,
+    has_more: false,
+    first_id: data[0]?.id ?? null,
+    last_id: data[data.length - 1]?.id ?? null,
+  };
+}
+/** Claude Code / Anthropic SDKs send anthropic-version or an x-app / UA hint. */
+export function wantsAnthropicModelList(headers = {}) {
+  const h = headers && typeof headers === 'object' ? headers : {};
+  const get = (k) => h[k] ?? h[k.toLowerCase()] ?? '';
+  return Boolean(get('anthropic-version'))
+    || /claude|anthropic/i.test(String(get('x-app')))
+    || /claude|anthropic/i.test(String(get('user-agent')));
+}
+/**
+ * Body for GET /v1/models. Always the full zoo catalog (never opus-5-only).
+ * Anthropic-shaped clients get id+display_name; OpenAI clients keep object:list.
+ */
+export function modelsListForRequest(payload, headers) {
+  const published = publishModelList(payload);
+  return wantsAnthropicModelList(headers) ? anthropicModelList(published) : published;
+}
 /**
  * Which request paths carry a rewritable model field. POST-only; embeddings /
  * audio / image / moderation models are DIFFERENT model families — rewriting

package/lib/pay.js CHANGED Viewed

@@ -1,6 +1,6 @@
 import { Connection, PublicKey } from '@solana/web3.js';
 import { getAssociatedTokenAddressSync } from '@solana/spl-token';
-import { config, fundingLine, evmRpcFor } from './config.js';
+import { config, fundingLine, evmRpcFor, FUNDING_ASSETS } from './config.js';
 import { loadOrCreateWallet } from './wallet.js';
 import {
   parse402, orderAccepts, railOf, buildPaymentOnline, tokenBalance,
@@ -120,6 +120,37 @@ export function resetRailMemory() {
   lastGoodAsset = null;
 }
+/**
+ * Skip wrap / pool / sendWrap when there is nothing to convert.
+ * wrapped < need AND underlying == 0 → UnderfundedError, no RPC walk.
+ * A funded wallet (underlying > 0) still wraps.
+ */
+export function skipWrapWhenEmpty(wrappedRaw, underlyingRaw, need) {
+  const wrapped = wrappedRaw == null ? 0n : BigInt(wrappedRaw);
+  const underlying = underlyingRaw == null ? 0n : BigInt(underlyingRaw);
+  const want = need == null ? 0n : BigInt(need);
+  return wrapped < want && underlying <= 0n;
+}
+/**
+ * Cheap underlying mint for a 402 row — directory acquire address, or the
+ * known USDC / TOKEN / LEOS twin named in extra.symbol. No chain probe.
+ */
+export function hintedUnderlyingMint(accept) {
+  const acq = accept?.extra?.acquire?.underlying;
+  const addr = typeof acq === 'string' ? acq : acq?.address;
+  if (addr && /^[1-9A-HJ-NP-Za-km-z]{32,44}$/.test(addr)) return addr;
+  const plain = String(accept?.extra?.symbol || '').replace(/^[wy]/i, '').replace(/x$/i, '').toUpperCase();
+  return FUNDING_ASSETS.find((a) => a.symbol === plain)?.mint || null;
+}
+/** True when every Solana funding mint (USDC / TOKEN / LEOS) reads 0. */
+export function solanaFundingEmpty(balances) {
+  const rows = Array.isArray(balances) ? balances : [];
+  if (!rows.length) return false;
+  return rows.every((b) => (b?.raw == null ? 0n : BigInt(b.raw)) <= 0n);
+}
 export class PayClient {
   constructor() {
     const w = loadOrCreateWallet();
@@ -213,6 +244,11 @@ export class PayClient {
     }
   }
+  async solanaFundingBalances() {
+    const owner = this.keypair.publicKey;
+    return Promise.all(FUNDING_ASSETS.map((a) => cachedTokenBalance(this.connection, owner, a.mint)));
+  }
   async buildPaymentFor(accept, onStage) {
     const rail = railOf(accept);
     if (rail === 'solana') {
@@ -224,6 +260,22 @@ export class PayClient {
         bal = await cachedTokenBalance(this.connection, this.keypair.publicKey, accept.asset, { force: true });
       }
       if (bal.raw < need) {
+        // Empty first-run burner: 0 wrapped + 0 USDC/TOKEN/LEOS. Do not
+        // resolvePool / poolState / sendWrap just to learn that.
+        const funding = await this.solanaFundingBalances();
+        if (solanaFundingEmpty(funding)) {
+          throw new UnderfundedError(accept, 0, this.address);
+        }
+        const underMint = hintedUnderlyingMint(accept);
+        if (underMint) {
+          let under = await cachedTokenBalance(this.connection, this.keypair.publicKey, underMint);
+          if (under.raw <= 0n && under.cached) {
+            under = await cachedTokenBalance(this.connection, this.keypair.publicKey, underMint, { force: true });
+          }
+          if (skipWrapWhenEmpty(bal.raw, under.raw, need)) {
+            throw new UnderfundedError(accept, under.ui, this.address);
+          }
+        }
         const topUp = await this.topUpQuotedAsset(accept, need, onStage);
         if (topUp.preInstructions) {
           return buildPaymentOnline(this.connection, this.keypair, accept, {
@@ -290,14 +342,26 @@ export class PayClient {
     const pool = await resolvePool(this.connection, accept.asset).catch(() => null);
     if (!pool) throw new UnderfundedError(accept, null, this.address);
+    // Balances first. 0 wrapped + 0 underlying → throw. Never poolState or
+    // sendWrap just to discover an empty burner (measured ~4.5s per row).
+    const [wrappedNow, underlyingNow] = await Promise.all([
+      tokenBalance(this.connection, owner, accept.asset),
+      tokenBalance(this.connection, owner, pool.underlying.toBase58()),
+    ]);
+    if (skipWrapWhenEmpty(wrappedNow.raw, underlyingNow.raw, need)) {
+      throw new UnderfundedError(accept, underlyingNow.ui, this.address);
+    }
     for (let attempt = 0; attempt < 3; attempt++) {
-      const bal = await tokenBalance(this.connection, owner, accept.asset);
+      const bal = attempt === 0 ? wrappedNow : await tokenBalance(this.connection, owner, accept.asset);
       const short = need - bal.raw;
       if (short <= 0n) return {};
       const { reserves, supply } = await poolState(this.connection, pool);
       const deposit = depositForShares(short, reserves, supply);
-      const underlyingBal = await tokenBalance(this.connection, owner, pool.underlying.toBase58());
+      const underlyingBal = attempt === 0
+        ? underlyingNow
+        : await tokenBalance(this.connection, owner, pool.underlying.toBase58());
       if (underlyingBal.raw < deposit) {
         throw new UnderfundedError(accept, underlyingBal.ui, this.address);
       }

package/lib/podagent.mjs CHANGED Viewed

@@ -247,7 +247,7 @@ async function httpErrorNote(status) {
         // funded === false is the genuinely-empty case; funded === true after
         // the retries above means the rail/quote failed, not the balance
         if (w.funded === false) {
-          return `(payment failed — HTTP 402, the wallet is empty. ${w.funding}. EVM (Base/Robinhood): ${w.evm}.)`;
+          return `(payment required — HTTP 402, the wallet is empty. ${w.funding}. EVM (Base/Robinhood): ${w.evm}.)`;
         }
         return `(payment failed — HTTP 402 after ${PAYMENT_RETRIES} retries, though the wallet holds ${w.balances || 'a balance'}. Send it again; if it keeps failing the quoted asset may not be convertible right now. Fund with: ${w.funding})`;
       }
@@ -276,7 +276,13 @@ function sanitizeProxiedError(msg) {
 // this attempt, but the NEXT attempt usually settles (measured: same wallet,
 // same rail, second call pays fine). Surfacing that as a chat message makes
 // the user do the retry by hand — so do it here instead.
+// Empty/underfunded is NOT that handshake: retrying just re-walks wrap.
 const PAYMENT_RETRIES = 3;
+export function isUnderfunded402Body(body) {
+  const msg = String(body?.error?.message || body?.error || body?.message || '');
+  return /\b(?:underfunded|wallet is empty|empty wallet)\b/i.test(msg);
+}
 /**
  * ADAPTIVE top_k. We have learned this one the expensive way already.
  *
@@ -329,6 +335,10 @@ async function postChat(body, contextId, topK, onStatus, signal) {
       ...(signal ? { signal } : {}),
     });
     if (r.status !== 402 || attempt === PAYMENT_RETRIES) return r;
+    // Handshake 402 (funded, settle flake) → retry. Empty-wallet 402 → stop.
+    // Opening Pay / parking happens on the empty body, not on every 402.
+    const peek = await r.clone().json().catch(() => null);
+    if (isUnderfunded402Body(peek)) return r;
     // A 402 retry used to be silent — grokui sat on mute "…" for the whole
     // settle. Tell the watcher this attempt is paying, not wedged.
     onStatus?.(formatPayStatus(attempt));

package/lib/proxy.js CHANGED Viewed

@@ -20,7 +20,7 @@ import {
   corpusRecall,
   decideChatSpill, isOneShotCorpusAsk,
 } from './spill.js';
-import { rewritablePath, augmentModelList, ALIAS_IDS, rewriteChatModel, zooModelIds, CLASSIFY_MAX_TOKENS } from './models.js';
+import { rewritablePath, modelsListForRequest, ALIAS_IDS, rewriteChatModel, zooModelIds, CLASSIFY_MAX_TOKENS } from './models.js';
 import { forgetContext } from './contexts.js';
 import { injectBrief } from './brief.js';
 import { withNamespace } from './namespace.js';
@@ -30,8 +30,9 @@ import { loadSessionSpend, saveSessionSpend } from './session.js';
 import { creditBalance, quotedPrices } from './info.js';
 import { subscriptionPublicView } from './subscription.js';
 import { priceHoldings } from './livestatus.js';
-import { receiptUsedCogs, receiptDirectUsd } from './racesettle.js';
+import { receiptUsedCogs, receiptDirectUsd, pairActualBilled } from './racesettle.js';
 import { rewriteWrapClientError } from './wrap.js';
+import { fetchHeaders } from './fetch.js';
 const HOP_BY_HOP = new Set([
   'host', 'connection', 'keep-alive', 'transfer-encoding', 'upgrade',
@@ -1501,13 +1502,24 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     // rewrite never gets its chance.
     const path = (req.url || '').split('?')[0];
     if (req.method === 'GET' && path === '/v1/models') {
+      // Catalog is chrome, not a paid call. Paying the list would wrap-walk
+      // an empty burner (~4.5s/row) and stall first paint / harness probe.
       try {
-        const { response } = await client.fetch(url, init);
-        const payload = await response.json();
-        res.writeHead(response.status, { 'content-type': 'application/json' });
-        res.end(JSON.stringify(response.ok ? augmentModelList(payload) : payload));
-        return;
-      } catch { /* fall through to the plain relay below */ }
+        const response = await fetchHeaders(url, init);
+        if (response.ok) {
+          const payload = await response.json();
+          // Full zoo catalog � never collapse to a single opus-5 or a claude-*
+          // allowlist. Claude Code (ANTHROPIC_BASE_URL + gateway discovery) reads
+          // data[].id / display_name; OpenAI clients keep object:"list".
+          res.writeHead(200, { 'content-type': 'application/json' });
+          res.end(JSON.stringify(modelsListForRequest(payload, req.headers)));
+          return;
+        }
+        await response.text().catch(() => {});
+      } catch { /* gateway 402/down � serve aliases so chrome still paints */ }
+      res.writeHead(200, { 'content-type': 'application/json' });
+      res.end(JSON.stringify(modelsListForRequest({ object: 'list', data: [] }, req.headers)));
+      return;
     }
     const probe = req.method === 'GET' && /^\/v1\/models\/(.+)$/.exec(path);
     if (probe && ALIAS_IDS.includes(decodeURIComponent(probe[1]))) {
@@ -1631,18 +1643,26 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
         // completion already — no extra call, and unlike the account-level
         // /api/v1/credits total it is attributable to THIS proxy even though the
         // same OpenRouter key also pays for ttfx and everything else.
-        if (typeof data?.usage?.cost === 'number' && data.usage.cost >= 0) {
-          sessionActual += data.usage.cost;
-          actualCalls += 1;
+        {
           // PAIR THE NUMERATOR WITH THE DENOMINATOR. sessionSpent is summed on
           // three paths and sessionActual on two, so markupX divided ALL billed
-          // by the SUBSET that reported a real cost — a 402-receipt call added
+          // by the SUBSET that reported a real cost � a 402-receipt call added
           // to billed and nothing to real, and the ratio read 12.55x on a stack
           // running at ~1.0x. Track the billed side of exactly the calls whose
           // cost we actually learned.
           // Both figures ride the SAME response object, so read them together
           // rather than carrying one across sites and hoping the order holds.
-          billedWithActual += Number(data?.x402?.billedUsd) || 0;
+          //
+          // x402.billedUsd is often the QUOTE reserve (max_tokens � catalog),
+          // not the settled charge. MEASURED: $0.9858 reserved vs $0.007962
+          // usage.cost -> markupX lied at 124x on a ~1x call. Pair usage.cost
+          // with post-completion billed, never the reserve.
+          const pair = pairActualBilled(data?.x402, data?.usage);
+          if (pair) {
+            sessionActual += pair.upstreamUsd;
+            actualCalls += 1;
+            billedWithActual += pair.billedUsd;
+          }
         }
         // PREPAID CALLS STILL COST MONEY. The block above only meters calls
         // where THIS proxy answered a 402 and paid. When prepaid credit covers
@@ -1714,12 +1734,20 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
       // same figures the JSON path reads out of `data.x402`, same counters, so
       // the status line does not care which transport served the answer.
       const meterStreamed = (x) => {
+        // Same pairing rule as the JSON path: actualUsd / usage.cost with the
+        // settled billed twin, even on a wallet-paid stream (do not skip just
+        // because `paid` already recorded the quote-time receipt).
+        const pair = pairActualBilled(x, x?.usage);
+        if (pair) {
+          sessionActual += pair.upstreamUsd;
+          actualCalls += 1;
+          billedWithActual += pair.billedUsd;
+        }
         if (paid || typeof x?.billedUsd !== 'number') return;
         sessionSpent += x.billedUsd;
         sessionCogs += receiptUsedCogs(x);
         noteQuote(x);
         sessionDirect += receiptDirectUsd(x);
-        if (typeof x.actualUsd === 'number' && x.actualUsd >= 0) { sessionActual += x.actualUsd; actualCalls += 1; billedWithActual += x.billedUsd || 0; }
         if (didSpill) {
           log(spillPricedLine(x, { streamed: true }));
           spill.spillSpend += x.billedUsd;

package/lib/racesettle.js CHANGED Viewed

@@ -180,6 +180,133 @@ export function receiptDirectUsd(x) {
   return billedOk ? billed : 0;
 }
+/** Zoo's share of (direct − OpenRouter) when the 402 has real savings. */
+export const SAVINGS_SHARE = 0.33;
+/**
+ * billed / usage.cost above this, without settled house cogs, is the
+ * max_tokens quote reserve — not the charge after completion.
+ * MEASURED 2026-08-19: $0.9858 reserved / $0.007962 usage.cost ≈ 124× on a ~1× call.
+ */
+export const QUOTE_RESERVE_X = 2;
+function money(v) {
+  return typeof v === 'number' && Number.isFinite(v) && v >= 0 ? v : null;
+}
+function closeRatio(a, b, rel = 0.25) {
+  const den = Math.max(b, 1e-12);
+  return Math.abs(a - b) / den <= rel;
+}
+/**
+ * After-completion billed fields the gateway may already put on x402 / usage.
+ * Read only if present — do not invent them on the wire.
+ */
+function explicitSettledBilled(x, usage) {
+  const bags = [x, usage, x?.used, x?.settled, x?.receipt, usage?.used, usage?.settled]
+    .filter((o) => o && typeof o === 'object' && !Array.isArray(o));
+  const keys = [
+    'billedActual', 'billedActualUsd', 'settledUsd', 'settledBilledUsd',
+    'chargedUsd', 'usedUsd', 'actualBilledUsd',
+  ];
+  for (const bag of bags) {
+    for (const k of keys) {
+      const n = money(bag[k]);
+      if (n != null) return n;
+    }
+  }
+  return null;
+}
+/** tokens actually used × unit prices, only when both sides are already on the object. */
+function billedFromUsedTokens(x, usage) {
+  const prompt = money(usage?.prompt_tokens ?? usage?.promptTokens ?? x?.prompt_tokens);
+  const completion = money(usage?.completion_tokens ?? usage?.completionTokens ?? x?.completion_tokens);
+  const inPrice = money(x?.promptPriceUsd ?? x?.inputPriceUsd ?? x?.priceInUsd);
+  const outPrice = money(x?.completionPriceUsd ?? x?.outputPriceUsd ?? x?.priceOutUsd);
+  if (prompt != null && completion != null && inPrice != null && outPrice != null) {
+    return prompt * inPrice + completion * outPrice;
+  }
+  return null;
+}
+/**
+ * True when `billed` is the quote-time max_tokens ceiling, not the settled charge.
+ * A large billed/cost is honest when cogs already matches usage.cost (33% of
+ * real savings). The 124× lie is billed >> cost with at-cost / reserved cogs.
+ */
+export function isQuoteReserveBilled(billed, cost, x = {}) {
+  if (money(billed) == null || money(cost) == null) return false;
+  if (cost === 0) return billed > 0;
+  if (billed <= cost * QUOTE_RESERVE_X) return false;
+  const cogs = money(x?.cogsUsd);
+  if (cogs != null && closeRatio(cogs, cost)) return false;
+  const saved = money(x?.savedUsd);
+  if (saved == null || saved <= cost * 0.5) return true;
+  if (cogs != null && cogs > cost * QUOTE_RESERVE_X) return true;
+  return true;
+}
+/**
+ * Post-completion billed USD to pair with usage.cost / x.actualUsd.
+ * `x.billedUsd` is often the quote reserve (max_tokens × catalog), which made
+ * HUD markupX read 124× on a ~1× call. Prefer a settled field; otherwise
+ * reconstruct from tokens used × price or from usage.cost (+ 33% of settled
+ * savings). Never return the reserve when we learned the real upstream cost.
+ */
+export function receiptSettledBilled(x, usage) {
+  const cost = money(usage?.cost) ?? money(x?.actualUsd) ?? money(usage?.actualUsd);
+  const explicit = explicitSettledBilled(x, usage);
+  if (explicit != null) return explicit;
+  const fromTokens = billedFromUsedTokens(x, usage);
+  if (fromTokens != null) {
+    const billed = money(x?.billedUsd);
+    if (billed == null || isQuoteReserveBilled(billed, fromTokens, x)
+        || (cost != null && isQuoteReserveBilled(billed, cost, x))) {
+      return fromTokens;
+    }
+    return billed;
+  }
+  const billed = money(x?.billedUsd);
+  if (billed != null && (cost == null || !isQuoteReserveBilled(billed, cost, x))) {
+    return billed;
+  }
+  if (cost != null) {
+    const saved = settledSavedUsd(x, cost);
+    return cost + SAVINGS_SHARE * saved;
+  }
+  return billed ?? 0;
+}
+function settledSavedUsd(x, cost) {
+  const saved = money(x?.savedUsd);
+  if (saved == null || saved <= 0) return 0;
+  const cogs = money(x?.cogsUsd);
+  // Quote-time savedUsd rides the same max_tokens reserve. Only keep it when
+  // house cost already matches the metered upstream (settled cogs).
+  if (cogs != null && closeRatio(cogs, cost)) return saved;
+  return 0;
+}
+/**
+ * Pair the HUD denominator (real upstream) with the post-completion billed
+ * twin. Null when this call did not report a real cost — do not mix populations.
+ */
+export function pairActualBilled(x402, usage) {
+  const fromUsage = money(usage?.cost);
+  const fromX = money(x402?.actualUsd) ?? money(x402?.usage?.cost);
+  const upstreamUsd = fromUsage ?? fromX;
+  if (upstreamUsd == null) return null;
+  const bag = x402 && typeof x402 === 'object' ? x402 : {};
+  const usageBag = usage && typeof usage === 'object' ? usage : {};
+  return {
+    upstreamUsd,
+    billedUsd: receiptSettledBilled(bag, { ...usageBag, cost: upstreamUsd }),
+  };
+}
 /**
  * Session meter. spent/direct are the receipt totals as billed — never a
  * first-call rewrite, never a race_unused user refund.

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.49.7",
+  "version": "0.49.8",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",