openzoo 0.50.18 → 0.50.19

package/lib/cursorbackend.js

@@ -342,7 +342,7 @@ async function passthroughToRealAnthropic(req, res, body, host, full, log) {
         fs.writeFileSync(`${dir}/${Date.now()}_${safe}.bin`, buf);
       } catch { /* dumping must never break the proxy */ }
     }
-    log(`cursor-backend:      ${req.method} ${full} -> REAL anthropic (${status}, ${buf.length}b)`);
+    log(`cursor-backend:      ${req.method} ${full} -> REAL ${host} (${status}, ${buf.length}b)`);
   } catch (e) {
     res.writeHead(502, { 'content-type': 'application/json' });
     res.end(JSON.stringify({ type: 'error', error: { type: 'api_error', message: `passthrough failed: ${e.message}` } }));
@@ -486,6 +486,22 @@ export function startCursorBackend({ port = 8443, models, log = () => {} } = {})
         return;
       }
       log(`cursor-backend: #${conns} ${req.method} ${full}  ct=${ct}  body=${body.length}b`);
+      // OAUTH MUST HIT THE REAL ISSUER. empty-ok on /oauth/token is the
+      // "Reconnecting to your computer" / edge/handler-failed loop: the app
+      // retries the same 509b body forever and never reaches AvailableModels
+      // or EnsureSandBox. Measured live: #14–#88 POST /oauth/token -> empty-ok.
+      // Same for the sandbox RPCs unless we are hijacking the pod.
+      {
+        const path0 = full.split('?')[0];
+        const oauth = /^\/oauth(\/|$)/.test(path0);
+        const needRealPod = /GrokBotService\/(EnsureSandBox|WatchSandBoxMigration)/.test(full)
+          && !process.env.OZ_HIJACK_POD;
+        if (oauth || needRealPod) {
+          const upstream = /cursor\.sh$/.test(host) ? host : 'api2.cursor.sh';
+          await passthroughToRealAnthropic(req, res, body, upstream, full, log);
+          return;
+        }
+      }
       // HIJACK EnsureSandBox FIRST — before passthrough, or passthrough eats it.
       // MEASURED: with OPENZOO_PASSTHRU=1 set, EnsureSandBox went `-> REAL
       // anthropic (200, 707b)` every time and the app got a real cursorvm pod,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.50.18",
+  "version": "0.50.19",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",