openzoo 0.50.10 → 0.50.12

package/bin/openzoo.js

@@ -280,9 +280,21 @@ async function main() {
     }
     case 'ask': {
       const question = process.argv[3];
-      if (!question) throw new Error('usage: openzoo ask "<question>" [--context <id>] [--model <id>]');
+      if (!question) throw new Error('usage: openzoo ask "<question>" [--context <id>] [--model <id>] [--system <text>]');
       const ci = process.argv.indexOf('--context');
       const mi = process.argv.indexOf('--model');
+      // A BARE QUESTION IS A DIFFERENT PRODUCT FROM A BRIEFED ONE.
+      //
+      // This path drives PayClient straight at the gateway, so it never passes
+      // through the local proxy that injects lib/brief.js — the model gets the
+      // user's words and nothing else. OBSERVED from the Omarchy bar widget:
+      // "do you even love omarchy thru this uiux?!?" came back "I think you
+      // mean *anarchy*?" from deepseek, while the same question in the terminal
+      // (Claude Code: full system prompt + the omarchy skill) answered about
+      // DHH, Hyprland and theming. Same gateway, same product, one had context.
+      // A caller that knows where it is running can now say so.
+      const si = process.argv.indexOf('--system');
+      const system = si !== -1 ? process.argv[si + 1] : '';
       const { PayClient } = await import('../lib/pay.js');
       const { config } = await import('../lib/config.js');
       const client = new PayClient();
@@ -293,7 +305,9 @@ async function main() {
         headers,
         body: JSON.stringify({
           model: (mi !== -1 && process.argv[mi + 1]) || process.env.OPENZOO_DEFAULT_MODEL || 'anthropic/claude-opus-5',
-          messages: [{ role: 'user', content: question }],
+          messages: system
+            ? [{ role: 'system', content: system }, { role: 'user', content: question }]
+            : [{ role: 'user', content: question }],
           max_tokens: Number(process.env.OPENZOO_ASK_MAX_TOKENS || 1024),
         }),
       });

package/lib/pay.js

@@ -125,17 +125,28 @@ export function resetRailMemory() {
 
 export class PayClient {
   /**
-   * Always this machine's ~/.openzoo/wallet.json. The constructor used to take
-   * a per-user derived burner so the X bot could make each asker pay their own
-   * way; that bot is gone and nothing else ever passed one, so the override was
-   * a second wallet path with no caller and no test.
+   * This machine's ~/.openzoo/wallet.json, OR a derived burner passed in.
+   *
+   * The override was removed once with the note "that bot is gone and nothing
+   * else ever passed one" — THE BOT WAS NOT GONE. xbot.js kept calling
+   * `new PayClient(burner)`, the argument was silently swallowed, and every
+   * "asker pays" answer settled from the OPERATOR's shared wallet instead:
+   * measured live 2026-08-27 as gateway `paid_200 payer:0x640944…` (the
+   * machine EVM key) for calls the log attributed to a per-asker burner. The
+   * paid lane's entire economics ran backwards and nothing errored.
+   *
+   * A burner carries BOTH keys (Solana + EVM from one HMAC), so an override
+   * must never fall back to the machine wallet for either rail — an
+   * underfunded burner is the FUNDING REPLY path, not "bill the operator".
    */
-  constructor() {
-    const w = loadOrCreateWallet();
+  constructor(wallet) {
+    const w = wallet?.keypair ? wallet : loadOrCreateWallet();
     this.keypair = w.keypair;
-    this.evmPrivateKey = w.evmPrivateKey;
-    this.walletCreated = w.created;
-    this.walletPath = w.path;
+    // ?? null, NOT || machine key: a burner without an EVM key must fail
+    // underfunded on EVM rails rather than quietly spending the operator's.
+    this.evmPrivateKey = w.evmPrivateKey ?? null;
+    this.walletCreated = w.created ?? false;
+    this.walletPath = w.path ?? (w.xUserId ? `derived burner for X user ${w.xUserId}` : 'passed-in wallet');
     this.connection = new Connection(config.rpcUrl, 'confirmed');
     this.receipts = []; // last paid calls, newest last
     // EVERY OFFERED RAIL IS A FALLBACK, INCLUDING ROBINHOOD.
@@ -335,6 +346,11 @@ export class PayClient {
     const receipt = {
       at: new Date().toISOString(),
       line: receiptLine(accept, settle),
+      // The settle SIGNATURE as its own field, not only baked into `line`.
+      // The xbot printed a burner ADDRESS prefix in its PAID log and the
+      // operator spent an evening searching Solscan for it as a tx hash —
+      // an id a machine can log must be one a human can look up.
+      tx: settle?.transaction || settle?.txHash || settle?.signature || null,
       rail: railOf(accept),
       billedUsd: accept.extra?.billedUsd,
       directUsd: accept.extra?.directUsd,

package/lib/xbot.js

@@ -1258,7 +1258,12 @@ export async function askZooPaid(question, { burner, thread = '', maxTokens = AN
     // Same shared context as the free lane — a paid asker should recall
     // everything the bot has read, not start from an empty corpus.
     call: async (body) => (await pay.chat(body, { headers: contextId ? { 'x-hrr-context': contextId } : {} })).data,
-  });
+  }).then((result) => ({
+    ...result,
+    // Every on-chain settle signature this answer paid with, so the PAID log
+    // can print something Solscan actually finds.
+    txSigs: pay.receipts.map((r) => r.tx).filter(Boolean),
+  }));
 }
 
 /**
@@ -2604,9 +2609,19 @@ export async function runXBot({ once = false, intervalMs = POLL_MS, dryRun = fal
           // Print the SAME comparison the free lane does. This showed billed
           // alone, so a paid answer gave no way to see whether the asker beat
           // buying direct — the one thing the receipt exists to demonstrate.
-          console.error(`  ${t.id} @${t.author_id}: PAID ${burner.address.slice(0, 8)}… ${result.routedModel} ${usd(result.billedUsd)}`
+          // The tx SIGNATURE, or an explicit REPLAYED marker — never a bare
+          // "PAID" that might not have settled. The 8-char burner prefix here
+          // was read as a tx hash and hunted on Solscan for an evening; and a
+          // restart re-asking answered questions got cached 200s whose echoed
+          // receipts printed as fresh payments. Both lies die here: label the
+          // wallet as a wallet, print the settle sig when one exists, and say
+          // REPLAYED when none does.
+          const sigs = Array.isArray(result.txSigs) ? result.txSigs : [];
+          console.error(`  ${t.id} @${t.author_id}: ${sigs.length ? 'PAID' : 'REPLAYED (no new settlement)'}`
+            + ` payer ${burner.address.slice(0, 8)}… ${result.routedModel} ${usd(result.billedUsd)}`
             + (result.directUsd > 0 ? ` (direct ${usd(result.directUsd)})` : '')
-            + (result.actualUsd > 0 ? ` [cost ${usd(result.actualUsd)}]` : ''));
+            + (result.actualUsd > 0 ? ` [cost ${usd(result.actualUsd)}]` : '')
+            + (sigs.length ? `\n   tx ${sigs[sigs.length - 1]}` : ''));
           await postAndLog({ creds, text, inReplyTo: t.id, state, dryRun, tag: 'paid', conversationId: t.conversation_id });
           state.answered[t.id] = 'paid';
         } catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.50.10",
+  "version": "0.50.12",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",