openzoo 0.50.19 → 0.50.20

package/bin/openzoo.js

@@ -89,6 +89,10 @@ const HELP = `openzoo — local x402-paying proxy + MCP server for openzoo.fun
 usage:
   npx openzoo            start the proxy: http://localhost:8402/v1 (keyless) PLUS a
                          public HTTPS url for cloud IDEs (key required, printed at start)
+  npx openzoo bot             Grok Bot.app on the zoo. Starts :8402 + aiserver on
+                              :8443, then launches the app with
+                              CURSOR_API_BASE_URL=https://127.0.0.1:8443
+                              (no sudo, no /etc/hosts). Leave it running.
   npx openzoo cursor [dir]    start proxy+tunnel, write MCP config + every model
                               into the picker, and LAUNCH Cursor on [dir]
                               (defaults to the current directory; ~ works;
@@ -164,6 +168,9 @@ async function main() {
     case 'start':
       await (await import('../lib/proxy.js')).startProxy({ autoTunnel: true });
       break;
+    case 'bot':
+      await (await import('../lib/grokcli.js')).runBot(process.argv.slice(3));
+      break;
     case 'editor':
     case 'cursor':
     case 'vscode':

package/lib/cursorapi.js

@@ -177,6 +177,11 @@ export function encodeForMethod(method, models) {
         return encodeEnsureSandBox(pod);
       } catch { return null; }
     }
+    case 'GetGrokBotSendStatus':
+      // Empty body decodes status=UNSPECIFIED → UI "Failed to send".
+      // ACCEPTED=2 (aiserver.v1.GrokBotSendStatus). echo_entry_id (field 2)
+      // must echo the request's message_id or the overlay never reconciles.
+      return encodeGetGrokBotSendStatus();
     case 'GetPlanInfo': return encodeGetPlanInfo();
     case 'GetMe': return encodeGetMe();
     case 'GetDefaultModel': return encodeGetDefaultModel(models);
@@ -204,10 +209,80 @@ export function encodeForMethod(method, models) {
  * those. This encoder is the redirect; whether the box satisfies the protocol
  * is a separate, unfinished problem — point it at a logging box first.
  */
-export function encodeEnsureSandBox({ region = 'us1', accountId, podId, token, agent, vnc, p1340, p6081 }) {
+/** GetGrokBotSendStatusResponse { status=ACCEPTED, echo_entry_id, accepted_at_ms } */
+export function encodeGetGrokBotSendStatus(echoId = `oz-${Date.now()}`) {
+  return new Buf()
+    .int(1, 2)                 // GROK_BOT_SEND_STATUS_ACCEPTED
+    .str(2, echoId)
+    .int(4, Date.now())
+    .done();
+}
+
+/** Strip Connect-RPC 5-byte envelope if present (flags=0, big-endian length). */
+export function unwrapConnect(buf) {
+  const b = Buffer.isBuffer(buf) ? buf : Buffer.from(buf || []);
+  if (b.length >= 5 && (b[0] === 0 || b[0] === 2)) {
+    const n = b.readUInt32BE(1);
+    if (n > 0 && 5 + n <= b.length) return b.subarray(5, 5 + n);
+  }
+  return b;
+}
+
+/** Bare protobuf → {fieldNumber: string|number}. Enough for GetGrokBotSendStatusRequest
+ *  {1 agent_id, 2 message_id} (measured body=76b = two uuid strings). */
+export function decodeProtoFields(buf) {
+  const b = unwrapConnect(buf);
+  const out = {};
+  let i = 0;
+  while (i < b.length) {
+    let key = 0;
+    let shift = 0;
+    while (i < b.length) {
+      const v = b[i++];
+      key |= (v & 0x7f) << shift;
+      if (!(v & 0x80)) break;
+      shift += 7;
+      if (shift > 28) return out;
+    }
+    const field = key >>> 3;
+    const wire = key & 7;
+    if (wire === 0) {
+      let n = 0;
+      shift = 0;
+      while (i < b.length) {
+        const v = b[i++];
+        n |= (v & 0x7f) << shift;
+        if (!(v & 0x80)) break;
+        shift += 7;
+      }
+      out[field] = n;
+    } else if (wire === 2) {
+      let len = 0;
+      shift = 0;
+      while (i < b.length) {
+        const v = b[i++];
+        len |= (v & 0x7f) << shift;
+        if (!(v & 0x80)) break;
+        shift += 7;
+      }
+      if (i + len > b.length) break;
+      out[field] = b.subarray(i, i + len).toString('utf8');
+      i += len;
+    } else {
+      break;
+    }
+  }
+  return out;
+}
+
+export function encodeEnsureSandBox({ region = 'us1', accountId, podId, token, accessToken, agent, vnc, vncPath, p1340, p6081 }) {
   // per-port URLs — field 6 is the agent (1337), field 7 the VNC desktop
   // (6080), matching the live cursorvm response. RunPod fronts each port at
   // https://<id>-<port>.proxy.runpod.net, so agent !== vnc.
+  // Field 4 = network_token (nto-…); field 11 = agent HTTP bearer. Mixing
+  // them 401s /api/* on the real pod (measured sniff 2026-08-29).
+  const auth = accessToken || token;
+  const vncUrl = vncPath || `${vnc}/vnc.html?network_token=${token}&resume_lower_s=900&resume_upper_s=18000&path=websockify%3Fnetwork_token%3D${token}`;
   return new Buf()
     .str(1, region)
     .str(2, accountId)
@@ -215,11 +290,11 @@ export function encodeEnsureSandBox({ region = 'us1', accountId, podId, token, a
     .str(4, token)
     .str(5, 'local')
     .str(6, agent)
-    .str(7, `${vnc}/vnc.html?network_token=${token}&resume_lower_s=900&resume_upper_s=18000&path=websockify%3Fnetwork_token%3D${token}`)
+    .str(7, vncUrl)
     .str(8, '/workspace/terminals')
     .int(9, 1)
     .str(10, p1340 || agent)
-    .str(11, token)
+    .str(11, auth)
     .str(12, p6081 || vnc)
     .done();
 }

package/lib/cursorbackend.js

@@ -31,8 +31,10 @@ import https from 'node:https';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import zlib from 'node:zlib';
 import { execFileSync } from 'node:child_process';
-import { encodeAvailableModels, encodeForMethod } from './cursorapi.js';
+import { randomUUID } from 'node:crypto';
+import { encodeAvailableModels, encodeForMethod, encodeEnsureSandBox, encodeGetGrokBotSendStatus, decodeProtoFields, unwrapConnect } from './cursorapi.js';
 
 const TLS_DIR = path.join(os.homedir(), '.openzoo', 'cursor-tls');
 const CURSOR_HOSTS = ['api2.cursor.sh', 'api3.cursor.sh', 'api4.cursor.sh', 'repo42.cursor.sh'];
@@ -284,70 +286,815 @@ const RESP_DROP = new Set([
   'transfer-encoding', 'te', 'trailer', 'content-length',
 ]);
 
+const SNIFF_FILE = path.join(os.homedir(), '.openzoo', 'grokbot-sniff.jsonl');
+let realPod = null; // { agent, vnc, token, p1340, p6081, region, accountId, podId }
+
+function sniffOn() { return process.env.OPENZOO_SNIFF === '1'; }
+function sniffSelf() { return process.env.OZ_SNIFF_SELF || 'https://127.0.0.1:8443'; }
+/** CURSOR_API_BASE_URL=https://127.0.0.1:8443 makes Host 127.0.0.1 — public DNS
+ *  of that name is ENOTFOUND (measured sniff #3 /events, #4 listAgents). */
+function cursorUpstream(host) {
+  const h = String(host || '').replace(/:\d+$/, '');
+  if (/cursor\.sh$/.test(h) || /anthropic\.com$/.test(h) || /cursorvm\.com$/.test(h)) return h;
+  return 'api2.cursor.sh';
+}
+function sniffDump(rec) {
+  if (!sniffOn()) return;
+  try {
+    fs.mkdirSync(path.dirname(SNIFF_FILE), { recursive: true, mode: 0o700 });
+    fs.appendFileSync(SNIFF_FILE, JSON.stringify({ at: new Date().toISOString(), ...rec }) + '\n');
+  } catch { /* dump must never break the proxy */ }
+}
+function jsonish(buf, limit = 12000) {
+  const s = Buffer.isBuffer(buf) ? buf.toString('utf8') : String(buf || '');
+  try { return JSON.parse(s); } catch { return s.slice(0, limit); }
+}
+function copyReqHeaders(req, host) {
+  const headers = {};
+  for (const [k, v] of Object.entries(req.headers)) {
+    if (k.startsWith(':') || HOP_BY_HOP.has(k)) continue;
+    headers[k] = Array.isArray(v) ? v.join(', ') : String(v);
+  }
+  if (host) headers.host = host;
+  delete headers['content-length'];
+  return headers;
+}
+function lookupPinned(ip) {
+  return (h, o, cb) => (o && o.all ? cb(null, [{ address: ip, family: 4 }]) : cb(null, ip, 4));
+}
+function inflateBody(buf, headers) {
+  const enc = String(headers?.['content-encoding'] || '').toLowerCase();
+  try {
+    if (enc.includes('gzip')) return zlib.gunzipSync(buf);
+    if (enc.includes('deflate')) return zlib.inflateSync(buf);
+    if (enc.includes('br')) return zlib.brotliDecompressSync(buf);
+  } catch { /* fall through */ }
+  if (buf.length >= 2 && buf[0] === 0x1f && buf[1] === 0x8b) {
+    try { return zlib.gunzipSync(buf); } catch { /* */ }
+  }
+  return buf;
+}
+function writeCaptured(res, status, respHeaders, buf) {
+  const h = {};
+  for (const [k, v] of Object.entries(respHeaders || {})) {
+    if (RESP_DROP.has(k.toLowerCase())) continue;
+    h[k] = v;
+  }
+  res.writeHead(status, h);
+  res.end(buf);
+}
+
+async function upstreamUnary({ host, path: pth, method, headers, body, timeoutMs = 20000 }) {
+  const ip = await resolveRealAnthropic(host);
+  return new Promise((resolve, reject) => {
+    const up = https.request({
+      hostname: host, servername: host, port: 443, path: pth,
+      method, headers, lookup: lookupPinned(ip),
+    }, (r) => {
+      const chunks = [];
+      r.on('data', (d) => chunks.push(d));
+      r.on('end', () => resolve({
+        status: r.statusCode, respHeaders: r.headers, buf: Buffer.concat(chunks),
+      }));
+      r.on('error', reject);
+    });
+    up.on('error', reject);
+    if (timeoutMs) {
+      up.setTimeout(timeoutMs, () => {
+        reject(new Error('upstream timeout'));
+        try { up.destroy(); } catch { /* */ }
+      });
+    }
+    if (method !== 'GET' && method !== 'HEAD' && body && body.length) up.write(body);
+    up.end();
+  });
+}
+
 async function passthroughToRealAnthropic(req, res, body, host, full, log) {
   try {
-    const ip = await resolveRealAnthropic(host);
-    const headers = {};
-    for (const [k, v] of Object.entries(req.headers)) {
-      if (k.startsWith(':') || HOP_BY_HOP.has(k)) continue;
-      headers[k] = Array.isArray(v) ? v.join(', ') : String(v);
+    host = cursorUpstream(host);
+    const streaming = /Watch|Stream|Subscribe/i.test(full);
+    if (streaming) {
+      await passthroughPipe(req, res, body, host, full, log);
+      return;
     }
-    headers.host = host;
-
-    // DIAL THE ADDRESS, BUT SPEAK THE NAME. fetch(`https://${ip}/...`) cannot do
-    // this: undici derives SNI from the URL, so the server saw a bare IP, had no
-    // certificate to offer for it, and killed the handshake
-    // (ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE). node:https lets the two be set
-    // independently — a custom `lookup` pins the connection to the public-DNS
-    // address (bypassing our own /etc/hosts entry, which would otherwise loop
-    // this request straight back into this very server), while `servername` and
-    // the Host header keep presenting the real hostname so the cert validates.
-    const lookup = (h, o, cb) => (o && o.all ? cb(null, [{ address: ip, family: 4 }]) : cb(null, ip, 4));
-    const { status, respHeaders, buf } = await new Promise((resolve, reject) => {
+    const headers = copyReqHeaders(req, host);
+    const cap = await upstreamUnary({
+      host, path: full, method: req.method, headers, body, timeoutMs: 20000,
+    });
+    if (process.env.OPENZOO_DUMP === '1' && cap.buf.length) {
+      try {
+        const dir = '/tmp/openzoo-sniff';
+        fs.mkdirSync(dir, { recursive: true });
+        const safe = full.replace(/[^a-zA-Z0-9]+/g, '_').slice(0, 80);
+        fs.writeFileSync(`${dir}/${Date.now()}_${safe}.bin`, cap.buf);
+      } catch { /* dumping must never break the proxy */ }
+    }
+    writeCaptured(res, cap.status, cap.respHeaders, cap.buf);
+    log(`cursor-backend:      ${req.method} ${full} -> REAL ${host} (${cap.status}, ${cap.buf.length}b)`);
+  } catch (e) {
+    res.writeHead(502, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ type: 'error', error: { type: 'api_error', message: `passthrough failed: ${e.message}` } }));
+    log(`cursor-backend:      passthrough ${full} FAILED: ${e.message}`);
+  }
+}
+
+async function passthroughPipe(req, res, body, host, full, log) {
+  host = cursorUpstream(host);
+  const ip = await resolveRealAnthropic(host);
+  const headers = copyReqHeaders(req, host);
+  await new Promise((resolve, reject) => {
+    const up = https.request({
+      hostname: host, servername: host, port: 443, path: full,
+      method: req.method, headers, lookup: lookupPinned(ip),
+    }, (r) => {
+      const h = {};
+      for (const [k, v] of Object.entries(r.headers || {})) {
+        if (RESP_DROP.has(k.toLowerCase())) continue;
+        h[k] = v;
+      }
+      res.writeHead(r.statusCode, h);
+      r.pipe(res);
+      r.on('end', resolve);
+      r.on('error', reject);
+    });
+    up.on('error', reject);
+    req.on('close', () => { try { up.destroy(); } catch { /* */ } });
+    if (req.method !== 'GET' && req.method !== 'HEAD' && body && body.length) up.write(body);
+    up.end();
+  });
+  log(`cursor-backend:      -> PIPE ${full} -> REAL ${host}`);
+}
+
+function rememberPod(fields, log) {
+  if (!fields || !fields[6]) return null;
+  const execDaemon = String(fields[6] || '');
+  const gateway = String(fields[10] || fields[6] || '');
+  realPod = {
+    execDaemon,
+    agent: gateway, // /api/sendPrompt lives on gateway_url (1340), not exec_daemon (1337)
+    vnc: fields[7] ? String(fields[7]).split('/vnc.html')[0] : gateway,
+    vncPath: fields[7] ? String(fields[7]) : undefined,
+    token: String(fields[4] || ''),
+    accessToken: String(fields[11] || ''),
+    p1340: gateway,
+    p6081: fields[12] ? String(fields[12]) : undefined,
+    region: String(fields[1] || 'us1'),
+    accountId: String(fields[2] || ''),
+    podId: String(fields[3] || ''),
+  };
+  sniffDump({ kind: 'pod', fields, realPod });
+  log(`cursor-backend:      SNIFF real pod ${realPod.agent}`);
+  return realPod;
+}
+
+function rewrittenBox() {
+  const self = sniffSelf();
+  const p = realPod || {};
+  return encodeEnsureSandBox({
+    region: p.region || 'us1',
+    accountId: p.accountId || 'openzoo',
+    podId: p.podId || 'openzoo-sniff',
+    token: p.token || 'openzoo',
+    accessToken: p.accessToken || p.token || 'openzoo',
+    agent: self,
+    vnc: self,
+    p1340: self,
+    p6081: self,
+  });
+}
+
+async function sniffEnsureSandBox(req, res, body, host, full, log) {
+  const upstream = cursorUpstream(host);
+  const headers = copyReqHeaders(req, upstream);
+  const cap = await upstreamUnary({
+    host: upstream, path: full, method: req.method, headers, body, timeoutMs: 30000,
+  });
+  const raw = inflateBody(cap.buf, cap.respHeaders);
+  const proto = unwrapConnect(raw);
+  const fields = decodeProtoFields(proto);
+  rememberPod(fields, log);
+  sniffDump({
+    kind: 'EnsureSandBox',
+    status: cap.status,
+    bytes: cap.buf.length,
+    inflated: raw.length,
+    encoding: cap.respHeaders?.['content-encoding'] || '',
+    head: Buffer.from(raw.subarray(0, 24)).toString('hex'),
+    fields,
+    rewrittenTo: sniffSelf(),
+  });
+  const payload = realPod ? rewrittenBox() : proto;
+  const ct = String(req.headers['content-type'] || cap.respHeaders?.['content-type'] || '');
+  if (/WatchSandBoxMigration/.test(full) || ct.includes('connect+proto')) {
+    res.writeHead(200, {
+      'content-type': 'application/connect+proto',
+      'grpc-status': '0',
+      ...CORS,
+    });
+    const end = Buffer.from('{}');
+    const h = Buffer.alloc(5); h.writeUInt8(0x02, 0); h.writeUInt32BE(end.length, 1);
+    res.end(Buffer.concat([envelope(payload), h, end]));
+  } else if (ct.includes('grpc-web')) {
+    res.writeHead(200, {
+      'content-type': ct.includes('text') ? 'application/grpc-web-text+proto' : 'application/grpc-web+proto',
+      'grpc-status': '0', ...CORS,
+    });
+    res.end(Buffer.concat([envelope(payload), grpcWebTrailer()]));
+  } else {
+    res.writeHead(200, { 'content-type': 'application/proto', ...CORS });
+    res.end(payload);
+  }
+  log(`cursor-backend:      SNIFF EnsureSandBox -> rewrite ${sniffSelf()} (${cap.status}, real ${cap.buf.length}b)`);
+}
+
+async function proxyPodHttp(req, res, full, body, log) {
+  if (!realPod?.agent) return false;
+  const agent = new URL(realPod.agent);
+  const headers = copyReqHeaders(req, agent.host);
+  if (realPod.accessToken && !headers.authorization && !headers.Authorization) {
+    headers.authorization = `Bearer ${realPod.accessToken}`;
+  }
+  if (realPod.token && !headers['x-anyrun-network-token']) {
+    headers['x-anyrun-network-token'] = realPod.token;
+  }
+  if (!headers['x-sand-slim-avatars']) headers['x-sand-slim-avatars'] = '1';
+  const path0 = (full || '').split('?')[0];
+  const interesting = /sendPrompt|Transcript|listAgents|promptAcceptance|openAgentTail|createAgent/i.test(path0);
+  if (path0 === '/events') {
+    const ip = await resolveRealAnthropic(agent.hostname);
+    await new Promise((resolve, reject) => {
       const up = https.request({
-        hostname: host, servername: host, port: 443, path: full,
-        method: req.method, headers, lookup,
+        hostname: agent.hostname, servername: agent.hostname, port: 443, path: full,
+        method: req.method, headers, lookup: lookupPinned(ip),
       }, (r) => {
+        const h = { ...CORS };
+        for (const [k, v] of Object.entries(r.headers || {})) {
+          if (RESP_DROP.has(k.toLowerCase())) continue;
+          h[k] = v;
+        }
+        res.writeHead(r.statusCode, h);
         const chunks = [];
-        r.on('data', (d) => chunks.push(d));
-        r.on('end', () => resolve({
-          status: r.statusCode, respHeaders: r.headers, buf: Buffer.concat(chunks),
-        }));
+        r.on('data', (d) => {
+          res.write(d);
+          if (chunks.length < 40) chunks.push(d);
+        });
+        r.on('end', () => {
+          sniffDump({ kind: 'sse', path: full, sample: Buffer.concat(chunks).toString('utf8').slice(0, 8000) });
+          try { res.end(); } catch { /* */ }
+          resolve();
+        });
         r.on('error', reject);
       });
       up.on('error', reject);
-      // WatchSandBoxMigration is a LONG POLL — a 20s cap aborts it every time and
-      // the app never learns its sandbox is ready. Streams get no deadline.
-      const streaming = /Watch|Stream|Subscribe/i.test(full);
-      if (!streaming) up.setTimeout(20000, () => up.destroy(new Error('upstream timeout')));
-      if (req.method !== 'GET' && req.method !== 'HEAD' && body && body.length) up.write(body);
+      req.on('close', () => { try { up.destroy(); } catch { /* */ } });
       up.end();
     });
+    log('cursor-backend:      SNIFF /events -> real pod (piped)');
+    return true;
+  }
+  try {
+    const cap = await upstreamUnary({
+      host: agent.hostname,
+      path: full,
+      method: req.method,
+      headers,
+      body,
+      timeoutMs: path0 === '/health' ? 8000 : 120000,
+    });
+    writeCaptured(res, cap.status, cap.respHeaders, cap.buf);
+    const rec = {
+      kind: 'pod-http',
+      method: req.method,
+      path: path0,
+      status: cap.status,
+      reqBytes: body?.length || 0,
+      resBytes: cap.buf.length,
+      req: jsonish(body, 4000),
+      res: jsonish(inflateBody(cap.buf, cap.respHeaders), 16000),
+    };
+    sniffDump(rec);
+    if (interesting) {
+      log(`cursor-backend:      SNIFF ${path0} ${cap.status} req=${JSON.stringify(rec.req).slice(0, 220)} res=${JSON.stringify(rec.res).slice(0, 500)}`);
+    } else {
+      log(`cursor-backend:      SNIFF ${path0} -> real pod (${cap.status}, ${cap.buf.length}b)`);
+    }
+    return true;
+  } catch (e) {
+    log(`cursor-backend:      SNIFF ${path0} FAILED ${e.message}`);
+    return false;
+  }
+}
 
-    const h = {};
-    for (const [k, v] of Object.entries(respHeaders)) {
-      if (RESP_DROP.has(k.toLowerCase())) continue;
-      h[k] = v;
+/** JSON for the in-pod agent HTTP API. Hijack points field-6 at THIS
+ *  server, so GET /health and POST /api/* land here — empty protobuf on
+ *  those is "unhealthy" and Grok Bot retries EnsureSandBox forever
+ *  (measured: /health empty-ok then EnsureSandBox #1945+). */
+function jsonSend(res, obj) {
+  res.writeHead(200, { 'content-type': 'application/json', ...CORS });
+  res.end(JSON.stringify(obj));
+}
+/** Box HTTP API envelope. Client parse (CVr) returns null unless both
+ *  status==="ok" AND "value" in n — our unwrapped {ok:true}/{entries} was
+ *  dropped, so Grok Bot never painted the zoo reply (measured: << zoo 200 91c
+ *  then tail polls with Failed to send). */
+function jsonApi(res, value) {
+  jsonSend(res, { status: 'ok', value });
+}
+
+const sseClients = new Set();
+/** Gateway SSE parser (asar dispatchEventBlock) only reads `data:` lines and
+ *  requires `{channel, payload}`. `event:` names are ignored. */
+function ssePush(channel, payload) {
+  const chunk = `data: ${JSON.stringify({ channel, payload })}\n\n`;
+  for (const c of sseClients) {
+    try { c.write(chunk); } catch { sseClients.delete(c); }
+  }
+}
+
+/** Grok Bot Helper daemon: GET /local-exec/requests is SSE, POST /local-exec/responses
+ *  is `{providerId, frames}`. We used to JSON-[] the GET which is "disconnected"
+ *  (measured: Grok Bot "can't see files on your local computer"). */
+const localExecSse = new Set();
+const localExecWaiters = new Map();
+let localExecHello = null;
+function localExecPush(frame) {
+  const chunk = `data: ${JSON.stringify(frame)}\n\n`;
+  for (const c of localExecSse) {
+    try { c.write(chunk); } catch { localExecSse.delete(c); }
+  }
+}
+function handleLocalExecFrames(frames, log) {
+  for (const f of frames || []) {
+    if (!f || typeof f !== 'object') continue;
+    if (f.kind === 'hello') {
+      localExecHello = f;
+      log(`cursor-backend:      local-exec hello computer=${f.computerId || f.label || '?'} root=${f.localRoot || '?'}`);
+    }
+    const w = f.requestId && localExecWaiters.get(f.requestId);
+    if (!w) continue;
+    if (f.kind === 'file') {
+      const buf = Buffer.from(f.bytesBase64 || '', 'base64');
+      w.resolve({ kind: 'file', bytes: buf, text: buf.toString('utf8') });
+      localExecWaiters.delete(f.requestId);
+    } else if (f.kind === 'file-error' || f.kind === 'messages-error') {
+      w.reject(new Error(f.error || 'local-exec error'));
+      localExecWaiters.delete(f.requestId);
+    } else if (f.kind === 'client' || f.kind === 'control') {
+      w.resolve({ kind: f.kind, message: f.message });
+      localExecWaiters.delete(f.requestId);
     }
-    res.writeHead(status, h);
-    res.end(buf);
-    // DUMP THE INTERESTING ONES. EnsureSandBox's response is what names the
-    // sandbox, and the sandbox is the candidate inference path — you cannot
-    // read that from a byte count. Written raw for offline decoding.
-    if (process.env.OPENZOO_DUMP === '1' && buf.length) {
+  }
+}
+function localExecAsk(frame, timeoutMs = 45000) {
+  const requestId = frame.requestId || randomUUID();
+  const job = { ...frame, requestId };
+  return new Promise((resolve, reject) => {
+    const t = setTimeout(() => {
+      localExecWaiters.delete(requestId);
+      reject(new Error('local-exec timeout — is Grok Bot Helper connected?'));
+    }, timeoutMs);
+    localExecWaiters.set(requestId, {
+      resolve: (v) => { clearTimeout(t); resolve(v); },
+      reject: (e) => { clearTimeout(t); reject(e); },
+    });
+    localExecPush(job);
+  });
+}
+async function handleLocalExecHttp(req, res, path0, body, log) {
+  if (!/^\/local-exec\//.test(path0)) return false;
+  if (req.method === 'GET' && /\/requests$/.test(path0)) {
+    res.writeHead(200, {
+      'content-type': 'text/event-stream',
+      'cache-control': 'no-cache',
+      ...CORS,
+    });
+    localExecSse.add(res);
+    res.write(`data: ${JSON.stringify({ kind: 'welcome', providerId: 'openzoo' })}\n\n`);
+    const iv = setInterval(() => {
+      try { res.write(': ping\n\n'); } catch { clearInterval(iv); localExecSse.delete(res); }
+    }, 15000);
+    req.on('close', () => { clearInterval(iv); localExecSse.delete(res); });
+    log('cursor-backend:      -> local-exec /requests sse');
+    return true;
+  }
+  if (/\/responses$/.test(path0)) {
+    let parsed = {};
+    try { parsed = JSON.parse(String(body || '{}')); } catch { parsed = {}; }
+    handleLocalExecFrames(parsed.frames, log);
+    jsonSend(res, { ok: true });
+    log(`cursor-backend:      -> local-exec /responses n=${(parsed.frames || []).length}`);
+    return true;
+  }
+  jsonSend(res, { ok: true });
+  return true;
+}
+function extractLocalPaths(text) {
+  const out = [];
+  const re = /(?:~\/|\/Users\/)[^\s,;:!?()[\]{}"'`]+/g;
+  let m;
+  while ((m = re.exec(String(text || '')))) {
+    out.push(m[0].replace(/[.,;:]+$/, ''));
+  }
+  return [...new Set(out)];
+}
+function expandUserPath(p) {
+  if (p.startsWith('~/')) return path.join(os.homedir(), p.slice(2));
+  return p;
+}
+
+/** Per-agent transcript. sendPrompt is async: accept immediately, zooComplete
+ *  fills this, getAgentTranscriptTail is what the UI actually polls.
+ *
+ *  Gateway `isValidTranscriptEntry` (asar Fgi/RC) DROPS anything that is not
+ *  `{id, kind:"message", content}` / `{id, kind:"send-message", message}` —
+ *  proto wrappers with entryKind/body were counted n=2/2 here and painted
+ *  as zero on the client, so overlay timed out → "Failed to send". */
+const transcripts = new Map();
+const tailedAgents = new Set();
+let lastSendEchoId = `oz-${Date.now()}`;
+function agentTranscript(id) {
+  let t = transcripts.get(id);
+  if (!t) { t = { seq: 0, entries: [] }; transcripts.set(id, t); }
+  return t;
+}
+function appendLine(agentId, role, text, extra = {}) {
+  const t = agentTranscript(agentId);
+  t.seq += 1;
+  const nonce = extra.clientNonce ? String(extra.clientNonce) : undefined;
+  const ts = Date.now();
+  const requestId = extra.requestId || nonce || `oz-req-${t.seq}`;
+  let e;
+  if (role === 'user') {
+    // Live cursorvm getAgentTranscriptTail (2026-08-29): user echo is
+    // kind:"message" + role:"user" + clientNonce. Assistant is kind:"send-message".
+    e = {
+      seq: t.seq,
+      kind: 'message',
+      id: extra.id || `t${t.seq}u`,
+      role: 'user',
+      content: String(text || ''),
+      richText: extra.richText || JSON.stringify({ type: 'doc', content: [{ type: 'paragraph', content: [{ type: 'text', text: String(text || '') }] }] }),
+      isStreaming: false,
+      timestampMs: ts,
+      ...(nonce ? { clientNonce: nonce } : {}),
+      requestId,
+    };
+  } else {
+    e = {
+      seq: t.seq,
+      kind: 'send-message',
+      id: extra.id || `t${t.seq}s0`,
+      message: { type: 'text', content: String(text || '') },
+      timestampMs: ts,
+      requestId,
+    };
+  }
+  t.entries.push(e);
+  return e;
+}
+function fanoutLine(primaryId, role, text, extra = {}) {
+  const ids = new Set([primaryId, ...tailedAgents]);
+  let last = null;
+  for (const id of ids) last = appendLine(id, role, text, extra);
+  return last;
+}
+function gatewayEntry(e) {
+  const { seq, ...rest } = e;
+  return rest;
+}
+
+function promptFromSendBody(raw) {
+  let obj = raw;
+  if (Buffer.isBuffer(raw) || typeof raw === 'string') {
+    try { obj = JSON.parse(String(raw)); } catch { return String(raw || ''); }
+  }
+  if (!obj || typeof obj !== 'object') return '';
+  const pick = (v) => (typeof v === 'string' && v.trim() ? v : '');
+  let fromMsgs = '';
+  if (Array.isArray(obj.messages)) {
+    for (let i = obj.messages.length - 1; i >= 0; i--) {
+      const m = obj.messages[i];
+      fromMsgs = pick(m?.content) || pick(m?.text) || pick(m?.prompt);
+      if (fromMsgs) break;
+    }
+  }
+  return pick(obj.prompt) || pick(obj.text) || pick(obj.message)
+    || pick(obj.content) || pick(obj.input)
+    || pick(obj.message?.content) || pick(obj.message?.text)
+    || fromMsgs
+    || '';
+}
+
+let walletUsdCache = { usd: null, at: 0 };
+async function walletUsdCached() {
+  if (walletUsdCache.usd != null && Date.now() - walletUsdCache.at < 60_000) return walletUsdCache.usd;
+  try {
+    const { affordableUsd } = await import('./info.js');
+    const n = await Promise.race([
+      affordableUsd(),
+      new Promise((_, rej) => setTimeout(() => rej(new Error('balance timeout')), 4000)),
+    ]);
+    if (Number.isFinite(n)) {
+      walletUsdCache = { usd: Number(n), at: Date.now() };
+      return walletUsdCache.usd;
+    }
+  } catch { /* keep last */ }
+  return walletUsdCache.usd;
+}
+
+async function zooSpendOverlay(data) {
+  const x = data?.x402 || {};
+  let info = {};
+  try {
+    const r = await fetch('http://127.0.0.1:8402/v1/info', { signal: AbortSignal.timeout(1500) });
+    if (r.ok) info = await r.json();
+  } catch { /* */ }
+  let session = {};
+  try {
+    session = JSON.parse(fs.readFileSync(path.join(os.homedir(), '.openzoo', 'session.json'), 'utf8'));
+  } catch { /* */ }
+  const spent = Number(info.spendUsd ?? session.spentUsd ?? x.billedUsd ?? 0);
+  const would = Number(info.directUsd ?? session.directUsd ?? x.directUsd ?? 0);
+  const saved = Number(info.savedUsd ?? Math.max(0, would - spent));
+  const pct = would > 0 ? (100 * saved / would) : 0;
+  const credit = Number(info.creditUsd);
+  const wallet = await walletUsdCached();
+  const bal = Number.isFinite(wallet) && wallet > 0.004
+    ? wallet
+    : (Number.isFinite(credit) && credit > 0.004 ? credit : null);
+  const lines = ['', ''];
+  if (x.billedUsd != null) {
+    lines.push(`this call $${Number(x.billedUsd).toFixed(6)} · OpenRouter $${Number(x.directUsd || 0).toFixed(6)}`);
+  }
+  const balTxt = bal != null ? ` · balance $${bal.toFixed(2)}` : '';
+  lines.push(`spent $${spent.toFixed(4)}${balTxt} · OpenRouter would $${would.toFixed(4)} · saved $${saved.toFixed(4)} (${pct.toFixed(0)}%)`);
+  return lines.join('\n');
+}
+
+const agentModels = new Map();
+const MODEL_ALIASES = {
+  fable: 'anthropic/claude-fable-5',
+  'fable-5': 'anthropic/claude-fable-5',
+  'claude-fable-5': 'anthropic/claude-fable-5',
+  opus: 'anthropic/claude-opus-5',
+  'opus-5': 'anthropic/claude-opus-5',
+  sonnet: 'anthropic/claude-sonnet-5',
+  grok: 'x-ai/grok-4.6',
+  'grok-4': 'x-ai/grok-4.6',
+  'grok-4.6': 'x-ai/grok-4.6',
+};
+function resolveModelId(raw) {
+  const s = String(raw || '').trim();
+  if (!s) return null;
+  const lower = s.toLowerCase().replace(/^\/+/, '');
+  if (MODEL_ALIASES[lower]) return MODEL_ALIASES[lower];
+  if (s.includes('/')) return s;
+  return null;
+}
+
+async function zooComplete(prompt, log, agentId) {
+  log(`cursor-backend:      zoo POST :8402 ${JSON.stringify((prompt || '').slice(0, 60))}`);
+  const model = agentModels.get(agentId)
+    || process.env.OPENZOO_DEFAULT_MODEL
+    || 'anthropic/claude-opus-5';
+  const attachments = [];
+  for (const raw of extractLocalPaths(prompt)) {
+    const abs = expandUserPath(raw);
+    try {
+      if (localExecSse.size > 0) {
+        log(`cursor-backend:      local-exec download ${abs}`);
+        const got = await localExecAsk({ kind: 'download', path: abs });
+        attachments.push({ path: raw, abs, text: got.text || '' });
+      } else {
+        const text = fs.readFileSync(abs, 'utf8');
+        attachments.push({ path: raw, abs, text });
+      }
+    } catch (e) {
+      attachments.push({ path: raw, abs, error: e.message });
+    }
+  }
+  const messages = [];
+  if (attachments.length) {
+    const bits = attachments.map((a) => (
+      a.error
+        ? `FILE ${a.path} ERROR: ${a.error}`
+        : `FILE ${a.path} (${a.abs})\n${String(a.text).slice(0, 180000)}`
+    ));
+    messages.push({
+      role: 'system',
+      content: 'Local files below were fetched via Grok Bot local-exec (the user\'s computer). You CAN review them. Do not claim you lack filesystem access.',
+    });
+    messages.push({ role: 'user', content: bits.join('\n\n') });
+  }
+  messages.push({ role: 'user', content: prompt || 'hello' });
+  const payload = {
+    model,
+    messages,
+    max_tokens: Number(process.env.OPENZOO_ASK_MAX_TOKENS || 2048),
+  };
+  const post = () => fetch('http://127.0.0.1:8402/v1/chat/completions', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', authorization: 'Bearer sk-openzoo' },
+    body: JSON.stringify(payload),
+    signal: AbortSignal.timeout(120000),
+  });
+  let r = await post();
+  // x402 dwell: proxy usually pays internally; a leftover 402 is retryable.
+  if (r.status === 402) {
+    log('cursor-backend:      x402 402 — dwell/retry');
+    await new Promise((ok) => setTimeout(ok, 2500));
+    r = await post();
+  }
+  const data = await r.json();
+  let text = data.choices?.[0]?.message?.content || data.error?.message || '(empty zoo reply)';
+  try { text += await zooSpendOverlay(data); } catch { /* overlay must never eat the reply */ }
+  log(`cursor-backend:      << zoo ${r.status} ${text.length}c`);
+  return { text, data };
+}
+
+async function handleHijackedPodHttp(req, res, full, body, log) {
+  if (sniffOn()) {
+    const waiting = (full || '').split('?')[0];
+    const podPath = waiting === '/health' || waiting === '/healthz' || waiting === '/events'
+      || waiting.startsWith('/api/') || waiting.startsWith('/webauthn/')
+      || waiting.startsWith('/cookie-origin-approval/') || waiting.startsWith('/local-exec/');
+    if (realPod?.agent && podPath) return proxyPodHttp(req, res, full, body, log);
+    if (!podPath) return false;
+    if (waiting === '/health' || waiting === '/healthz') {
+      jsonSend(res, { ok: true, status: 'ok', ready: true });
+      return true;
+    }
+    return false;
+  }
+  const path0 = (full || '').split('?')[0];
+  if (path0 === '/health' || path0 === '/healthz') {
+    jsonSend(res, { ok: true, status: 'ok', ready: true });
+    log('cursor-backend:      -> pod /health ok');
+    return true;
+  }
+  if (path0 === '/events') {
+    res.writeHead(200, {
+      'content-type': 'text/event-stream',
+      'cache-control': 'no-cache',
+      ...CORS,
+    });
+    res.write('data: {"channel":"ping","payload":{}}\n\n');
+    sseClients.add(res);
+    const iv = setInterval(() => {
+      try { res.write('data: {"channel":"ping","payload":{}}\n\n'); } catch { clearInterval(iv); sseClients.delete(res); }
+    }, 15000);
+    req.on('close', () => { clearInterval(iv); sseClients.delete(res); });
+    log('cursor-backend:      -> pod /events sse');
+    return true;
+  }
+  if (path0.startsWith('/webauthn/') || path0.startsWith('/cookie-origin-approval/')) {
+    if (req.method === 'GET') jsonSend(res, []);
+    else jsonSend(res, { ok: true });
+    log(`cursor-backend:      -> pod ${path0}`);
+    return true;
+  }
+  if (!path0.startsWith('/api/')) return false;
+  const name = path0.slice('/api/'.length);
+  // Roster/settings come from the REAL 1340 gateway (names, avatars, trays).
+  // Chat stays local so inference is zoo. Discovered on EnsureSandBox rewrite.
+  const roster = new Set([
+    'listAgents', 'countAgents', 'searchAgents', 'getTrays', 'getHostSettings',
+    'setHostSettings', 'getAgentChannels', 'getAgentWorkflows', 'skillsCatalog',
+    'getSubagents', 'getAsyncTasks', 'getForeverBoxStatus', 'getSharingState',
+    'getBotTemplateExportPolicy', 'getTeachRecordingStatus', 'isGlobalSearchEnabled',
+    'isEgressTunnelAvailable', 'listBoxMcpServers', 'getHostStatus',
+    'setWindowFocused', 'getAgentAutomations',
+    'createAgent', 'createAgentFromTemplate', 'createGroup', 'setGroupMembers',
+    'updateAgent', 'deleteAgents', 'duplicateAgent', 'kickstartAgent',
+    'interruptAgentRun', 'requestDiskSaverAudit', 'broadcastToAgents',
+    'setAgentUnread', 'setAgentHiddenFromSidebar', 'setAgentNotificationsEnabled',
+    'setAgentNotifyOnUpdates', 'setAgentAvatarBytes', 'getAgentAvatar',
+  ]);
+  if (!sniffOn() && realPod?.agent && roster.has(name)) {
+    return proxyPodHttp(req, res, full, body, log);
+  }
+
+  // THE ACTUAL CHAT PATH. Grok Bot does not send StreamUnifiedChat on this
+  // surface — measured: POST /api/sendPrompt 374b/462b after EnsureSandBox
+  // hijack. Stubbing {ok:true} ate the prompt. Forward to the paying proxy.
+  if (name === 'sendPrompt') {
+    let parsed = {};
+    try { parsed = JSON.parse(String(body || '{}')); } catch { parsed = {}; }
+    const prompt = promptFromSendBody(parsed);
+    const agentId = String(parsed.agentId || parsed.id || 'openzoo');
+    const nonce = parsed.clientNonce || `oz-${Date.now()}`;
+    log(`cursor-backend:      >> sendPrompt agent=${agentId} keys=${Object.keys(parsed).join(',')} prompt=${JSON.stringify((prompt || '').slice(0, 80))}`);
+    lastSendEchoId = String(nonce);
+    const userLine = fanoutLine(agentId, 'user', prompt, {
+      clientNonce: nonce,
+      requestId: nonce,
+      richText: parsed.richText,
+    });
+    ssePush('transcript', { ...gatewayEntry(userLine), agentId });
+    jsonSend(res, { accepted: true });
+    const modelCmd = /^\s*\/model(?:\s+(\S+))?\s*$/i.exec(prompt || '');
+    setImmediate(async () => {
+      let text = '';
       try {
-        const dir = '/tmp/openzoo-sniff';
-        fs.mkdirSync(dir, { recursive: true });
-        const safe = full.replace(/[^a-zA-Z0-9]+/g, '_').slice(0, 80);
-        fs.writeFileSync(`${dir}/${Date.now()}_${safe}.bin`, buf);
-      } catch { /* dumping must never break the proxy */ }
+        if (modelCmd) {
+          const want = modelCmd[1];
+          if (!want) {
+            const cur = agentModels.get(agentId) || process.env.OPENZOO_DEFAULT_MODEL || 'anthropic/claude-opus-5';
+            text = `current model: ${cur}\nset with /model fable | opus | sonnet | grok | provider/id`;
+          } else {
+            const id = resolveModelId(want) || (want.includes('/') ? want : null);
+            if (!id) {
+              text = `unknown model "${want}". try /model fable | opus | sonnet | grok or a full id like anthropic/claude-fable-5`;
+            } else {
+              agentModels.set(agentId, id);
+              text = `model set to ${id}`;
+            }
+          }
+          try { text += await zooSpendOverlay({}); } catch { /* */ }
+        } else {
+          const z = await zooComplete(prompt, log, agentId);
+          text = z.text;
+        }
+      } catch (e) {
+        text = `openzoo error: ${e.message}`;
+        log(`cursor-backend:      sendPrompt zoo failed: ${e.message}`);
+      }
+      const line = fanoutLine(agentId, 'assistant', text, { clientNonce: nonce, requestId: nonce });
+      ssePush('transcript', { ...gatewayEntry(line), agentId });
+      log(`cursor-backend:      sendPrompt done agent=${agentId} seq=${line.seq} text=${JSON.stringify(text.slice(0, 80))}`);
+    });
+    return true;
+  }
+  if (name === 'getAgentTranscriptTail' || name === 'getAgentTranscriptWindow' || name === 'openAgentTail') {
+    let parsed = {};
+    try { parsed = JSON.parse(String(body || '{}')); } catch { parsed = {}; }
+    let id = String(parsed.id || parsed.agentId || 'openzoo');
+    tailedAgents.add(id);
+    let t = agentTranscript(id);
+    if (!t.entries.length) {
+      for (const [other, ot] of transcripts) {
+        if (ot.entries.length) { id = other; t = ot; break; }
+      }
     }
-    log(`cursor-backend:      ${req.method} ${full} -> REAL ${host} (${status}, ${buf.length}b)`);
-  } catch (e) {
-    res.writeHead(502, { 'content-type': 'application/json' });
-    res.end(JSON.stringify({ type: 'error', error: { type: 'api_error', message: `passthrough failed: ${e.message}` } }));
-    log(`cursor-backend:      passthrough ${full} FAILED: ${e.message}`);
+    const limit = Math.min(Number(parsed.limit) || 50, 200);
+    const before = parsed.beforeSeq != null ? Number(parsed.beforeSeq) : Infinity;
+    const sliced = t.entries.filter((e) => e.seq < before).slice(-limit);
+    const page = { entries: sliced.map(gatewayEntry) };
+    if (t.entries.length > sliced.length && sliced.length) page.nextBeforeSeq = sliced[0].seq;
+    // Live pod returns RAW {entries, nextBeforeSeq} — no CVr envelope
+    // (measured 1340 getAgentTranscriptTail 2026-08-29). Wrapping {status,value}
+    // made transcript-page validation fail and the canvas stayed empty.
+    jsonSend(res, page);
+    log(`cursor-backend:      -> transcript ${id} n=${sliced.length}/${t.seq}`);
+    return true;
+  }
+  if (name === 'promptAcceptanceStatus') {
+    let parsed = {};
+    try { parsed = JSON.parse(String(body || '{}')); } catch { parsed = {}; }
+    const nonce = String(parsed.clientNonce || lastSendEchoId);
+    const agentId = String(parsed.agentId || '');
+    jsonSend(res, {
+      outcome: 'found',
+      record: {
+        status: 'accepted',
+        acceptedAtMs: Date.now(),
+        echoEntryId: nonce,
+        clientNonce: nonce,
+        agentId,
+        inputDigest: '',
+      },
+    });
+    log(`cursor-backend:      -> promptAcceptanceStatus found echo=${nonce}`);
+    return true;
   }
+
+  const stubs = {
+    getHostStatus: { status: 'ready', ready: true, state: 'ready', hostStatus: 'ready' },
+    getHostSettings: { settings: {} },
+    setHostSettings: { ok: true },
+    setBoxSecrets: { ok: true },
+    listAgents: [...new Set([...transcripts.keys(), ...tailedAgents])].map((id) => ({ id, name: id, status: 'ready' })),
+    getAgentTranscriptTail: { tail: '', lines: [], dropped: false, ok: true },
+    getTeachRecordingStatus: { recording: false },
+    getTrays: { trays: [] },
+    isGlobalSearchEnabled: { enabled: false },
+    isEgressTunnelAvailable: { available: false },
+    getSharingState: { sharing: false },
+    getBotTemplateExportPolicy: { allowed: true },
+    getAgentAutomations: { automations: [] },
+    getForeverBoxStatus: { enabled: false },
+    getSubagents: { subagents: [] },
+    getAsyncTasks: { tasks: [] },
+    getAgentWorkflows: { workflows: [] },
+    setWindowFocused: { ok: true },
+  };
+  const payload = stubs[name] !== undefined ? stubs[name] : { ok: true };
+  // Live 1340 listAgents is a RAW array, not CVr (measured 104674b 2026-08-29).
+  if (name === 'listAgents') jsonSend(res, payload);
+  else jsonApi(res, payload);
+  log(`cursor-backend:      -> pod /api/${name}`);
+  return true;
 }
 
 /**
@@ -494,13 +1241,38 @@ export function startCursorBackend({ port = 8443, models, log = () => {} } = {})
       {
         const path0 = full.split('?')[0];
         const oauth = /^\/oauth(\/|$)/.test(path0);
-        const needRealPod = /GrokBotService\/(EnsureSandBox|WatchSandBoxMigration)/.test(full)
-          && !process.env.OZ_HIJACK_POD;
-        if (oauth || needRealPod) {
+        // Coordinator talks to /sand-box/local-exec-daemon-credential. empty-ok
+        // here is ControlPortCallError: main-execution-failure: fetch failed.
+        const sandBox = /^\/sand-box(\/|$)/.test(path0);
+        const grokCred = /IssueGrokBotUserComputerCredential/.test(full);
+        const sniffBox = sniffOn() && /GrokBotService\/(EnsureSandBox|WatchSandBoxMigration)/.test(full);
+        const needRealPod = /GrokBotService\/EnsureSandBox/.test(full)
+          && !process.env.OZ_HIJACK_POD
+          && !sniffBox;
+        if (sniffBox) {
+          if (/WatchSandBoxMigration/.test(full) && realPod) {
+            const payload = rewrittenBox();
+            res.writeHead(200, {
+              'content-type': 'application/connect+proto',
+              'grpc-status': '0',
+              ...CORS,
+            });
+            const end = Buffer.from('{}');
+            const h = Buffer.alloc(5); h.writeUInt8(0x02, 0); h.writeUInt32BE(end.length, 1);
+            res.end(Buffer.concat([envelope(payload), h, end]));
+            log('cursor-backend:      SNIFF WatchSandBoxMigration ready (rewritten)');
+            return;
+          }
+          await sniffEnsureSandBox(req, res, body, host, full, log);
+          return;
+        }
+        if (oauth || sandBox || grokCred || needRealPod) {
           const upstream = /cursor\.sh$/.test(host) ? host : 'api2.cursor.sh';
           await passthroughToRealAnthropic(req, res, body, upstream, full, log);
           return;
         }
+        if (await handleLocalExecHttp(req, res, path0, body, log)) return;
+        if (await handleHijackedPodHttp(req, res, full, body, log)) return;
       }
       // HIJACK EnsureSandBox FIRST — before passthrough, or passthrough eats it.
       // MEASURED: with OPENZOO_PASSTHRU=1 set, EnsureSandBox went `-> REAL
@@ -508,8 +1280,44 @@ export function startCursorBackend({ port = 8443, models, log = () => {} } = {})
       // never our box. This method (and ONLY this one) must be answered locally
       // with OUR box so Grok Bot's UI wires to our sandbox; everything else
       // still passes through so the app loads normally.
-      if (/GrokBotService\/EnsureSandBox/.test(full) && process.env.OZ_HIJACK_POD) {
-        respond(req, res, method, models);   // encodeForMethod('EnsureSandBox') reads OZ_HIJACK_POD
+      if (/GrokBotService\/(EnsureSandBox|WatchSandBoxMigration)/.test(full) && process.env.OZ_HIJACK_POD) {
+        if (/WatchSandBoxMigration/.test(full) && realPod) {
+          const payload = rewrittenBox();
+          res.writeHead(200, {
+            'content-type': 'application/connect+proto',
+            'grpc-status': '0',
+            ...CORS,
+          });
+          const end = Buffer.from('{}');
+          const h = Buffer.alloc(5); h.writeUInt8(0x02, 0); h.writeUInt32BE(end.length, 1);
+          res.end(Buffer.concat([envelope(payload), h, end]));
+          log('cursor-backend:      -> WatchSandBoxMigration ready (hijack, real roster)');
+          return;
+        }
+        try {
+          process.env.OZ_SNIFF_SELF = process.env.OZ_SNIFF_SELF || 'https://127.0.0.1:8443';
+          await sniffEnsureSandBox(req, res, body, host, full, log);
+          log('cursor-backend:      -> HIJACKED EnsureSandBox -> our box (roster from real 1340)');
+          return;
+        } catch (e) {
+          log(`cursor-backend:      EnsureSandBox discover failed (${e.message}) — env box`);
+        }
+        let pod;
+        try { pod = JSON.parse(process.env.OZ_HIJACK_POD); } catch { pod = null; }
+        if (pod && /WatchSandBoxMigration/.test(full)) {
+          const payload = encodeEnsureSandBox(pod);
+          res.writeHead(200, {
+            'content-type': 'application/connect+proto',
+            'grpc-status': '0',
+            ...CORS,
+          });
+          const end = Buffer.from('{}');
+          const h = Buffer.alloc(5); h.writeUInt8(0x02, 0); h.writeUInt32BE(end.length, 1);
+          res.end(Buffer.concat([envelope(payload), h, end]));
+          log('cursor-backend:      -> WatchSandBoxMigration ready (hijack)');
+          return;
+        }
+        respond(req, res, 'EnsureSandBox', models);
         log(`cursor-backend:      -> HIJACKED EnsureSandBox -> our box`);
         return;
       }
@@ -519,6 +1327,50 @@ export function startCursorBackend({ port = 8443, models, log = () => {} } = {})
         await handleStreamChat(req, res, body, log);
         return;
       }
+      // Telegram/"Failed to send": GetGrokBotSendStatus empty proto is
+      // UNSPECIFIED. ACCEPTED=2. WatchGrokBotUserComputerRequests is a
+      // long-lived stream — empty-ok closes it and the channel looks offline.
+      if (/GetGrokBotSendStatus/.test(full)) {
+        if (sniffOn()) {
+          const fields = decodeProtoFields(body);
+          sniffDump({ kind: 'GetGrokBotSendStatus.req', fields });
+          const upstream = /cursor\.sh$/.test(host) ? host : 'api2.cursor.sh';
+          await passthroughToRealAnthropic(req, res, body, upstream, full, log);
+          return;
+        }
+        const fields = decodeProtoFields(body);
+        const echoId = String(fields[2] || lastSendEchoId);
+        lastSendEchoId = echoId;
+        const payload = encodeGetGrokBotSendStatus(echoId);
+        const reqCt = String(req.headers['content-type'] || '');
+        if (reqCt.includes('grpc-web')) {
+          res.writeHead(200, {
+            'content-type': reqCt.includes('text') ? 'application/grpc-web-text+proto' : 'application/grpc-web+proto',
+            'grpc-status': '0', ...CORS,
+          });
+          res.end(Buffer.concat([envelope(payload), grpcWebTrailer()]));
+        } else {
+          res.writeHead(200, { 'content-type': 'application/proto', ...CORS });
+          res.end(payload);
+        }
+        log(`cursor-backend:      -> GetGrokBotSendStatus ACCEPTED echo=${echoId}`);
+        return;
+      }
+      if (/WatchGrokBotUserComputerRequests/.test(full)) {
+        if (sniffOn()) {
+          const upstream = /cursor\.sh$/.test(host) ? host : 'api2.cursor.sh';
+          await passthroughPipe(req, res, body, upstream, full, log);
+          return;
+        }
+        res.writeHead(200, {
+          'content-type': 'application/connect+proto',
+          'grpc-status': '0',
+          ...CORS,
+        });
+        req.on('close', () => { try { res.end(); } catch { /* */ } });
+        log('cursor-backend:      -> WatchGrokBotUserComputerRequests held');
+        return;
+      }
       // FULL PASSTHROUGH MODE — observe, do not stub.
       //
       // Stubbing unknown methods with empty protobufs BREAKS Grok Bot: it never

package/lib/grokcli.js

@@ -98,6 +98,106 @@ ${body}
 `;
 }
 
+/**
+ * `openzoo bot` — Grok Bot.app on the zoo, no sudo, no /etc/hosts.
+ *
+ * CURSOR_API_BASE_URL (and SAND_BACKEND_URL) are what the Electron MAIN
+ * process actually reads. Chromium --host-resolver-rules do not. Measured:
+ * a bare `127.0.0.1:443` is HTTP and logs ERR_SSL_HTTP_REQUEST; the URL
+ * must be https://127.0.0.1:8443. The TLS warning on launch is Node
+ * complaining about NODE_TLS_REJECT_UNAUTHORIZED=0 — expected, the cert
+ * is ours and self-signed.
+ *
+ * We bind 8443 ourselves (unprivileged). :443 is the old root takeover and
+ * stubs oauth if it is the unpatched npx copy — do not point the app there.
+ */
+export async function runBot(argv = []) {
+  const port = 8443;
+  const url = `https://127.0.0.1:${port}`;
+  const bin = `${APP}/Contents/MacOS/Grok Bot`;
+  if (!existsSync(bin)) {
+    console.error('openzoo: Grok Bot.app not found at', APP);
+    process.exit(1);
+  }
+
+  const proxyBase = `http://localhost:${config.port}/v1`;
+  let up = false;
+  try { up = (await fetch(`${proxyBase}/models`, { signal: AbortSignal.timeout(2000) })).ok; } catch { up = false; }
+  if (!up) {
+    console.error('openzoo: starting proxy on', proxyBase);
+    const { startProxy } = await import('./proxy.js');
+    await startProxy({ silent: true, autoTunnel: process.env.OPENZOO_NO_TUNNEL === '1' ? false : true });
+  }
+
+  process.env.OPENZOO_BYOK = '1';
+  const sniff = argv.includes('--sniff') || argv.includes('--passthru');
+  if (sniff) {
+    // REAL pod, we only sit in the middle. EnsureSandBox is rewritten so
+    // /api/sendPrompt and getAgentTranscriptTail land here, then we proxy
+    // them to cursorvm and dump the live JSON. That is the comparison
+    // surface — hijack guesses have been wrong twice.
+    delete process.env.OZ_HIJACK_POD;
+    process.env.OPENZOO_PASSTHRU = '1';
+    process.env.OPENZOO_SNIFF = '1';
+    process.env.OZ_SNIFF_SELF = url;
+  } else {
+    // Do NOT hand Grok Bot a real cursorvm pod — inference then never leaves
+    // Anysphere (measured: EnsureSandBox -> REAL api2, then StreamUnifiedChat
+    // never arrives). Point the sandbox URLs at THIS aiserver; StreamUnifiedChat
+    // is answered from :8402 (x402).
+    process.env.OZ_HIJACK_POD = JSON.stringify({
+      region: 'local',
+      accountId: 'openzoo',
+      podId: 'openzoo-local',
+      token: 'openzoo',
+      agent: url,
+      vnc: url,
+      p1340: url,
+      p6081: url,
+    });
+    process.env.OZ_SNIFF_SELF = url;
+  }
+  const { startCursorBackend } = await import('./cursorbackend.js');
+  const models = [
+    'gpt-4o', 'gpt-4o-mini', 'gpt-4-turbo', 'gpt-4.1', 'gpt-4.1-mini', 'gpt-3.5-turbo',
+  ].map((n) => ({ name: n, label: n }));
+  const log = (m) => console.error('  backend:', m);
+  try {
+    startCursorBackend({ port, models, log });
+  } catch (e) {
+    console.error('openzoo: 8443 already bound — reusing it (', e.message, ')');
+  }
+  await new Promise((r) => setTimeout(r, 400));
+  console.error(`openzoo: aiserver on ${url}`);
+  console.error('         oauth + /sand-box creds -> real api2');
+  if (sniff) {
+    console.error('         SNIFF: real EnsureSandBox, /api/* proxied, dump ~/.openzoo/grokbot-sniff.jsonl');
+    console.error('         send a message in Grok Bot — it should paint for real');
+  } else {
+    console.error('         EnsureSandBox HIJACKED here; StreamUnifiedChat -> :8402 (x402)');
+  }
+
+  try { execSync('osascript -e \'tell application "Grok Bot" to quit\'', { stdio: 'ignore' }); } catch { /* ok */ }
+  await new Promise((r) => setTimeout(r, 1500));
+
+  console.error('openzoo: launching Grok Bot');
+  console.error(`         CURSOR_API_BASE_URL=${url}`);
+  spawn(bin, ['--ignore-certificate-errors'], {
+    stdio: 'ignore',
+    detached: true,
+    env: {
+      ...process.env,
+      NODE_TLS_REJECT_UNAUTHORIZED: '0',
+      CURSOR_API_BASE_URL: url,
+      SAND_BACKEND_URL: url,
+    },
+  }).unref();
+
+  console.error('openzoo: leave this running. ctrl-c stops the backend.');
+  if (argv.includes('--once')) return;
+  await new Promise(() => {});
+}
+
 export async function setupGrokBot(argv = []) {
   const base = `http://localhost:${config.port}/v1`;
   const launch = !argv.includes('--no-launch');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.50.19",
+  "version": "0.50.20",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",