openzoo 0.50.19 → 0.50.21

package/lib/cursorbackend.js

@@ -31,8 +31,12 @@ import https from 'node:https';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { execFileSync } from 'node:child_process';
-import { encodeAvailableModels, encodeForMethod } from './cursorapi.js';
+import zlib from 'node:zlib';
+import { execFileSync, execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import tls from 'node:tls';
+import { randomUUID } from 'node:crypto';
+import { encodeAvailableModels, encodeForMethod, encodeEnsureSandBox, encodeGetGrokBotSendStatus, decodeProtoFields, unwrapConnect } from './cursorapi.js';
 
 const TLS_DIR = path.join(os.homedir(), '.openzoo', 'cursor-tls');
 const CURSOR_HOSTS = ['api2.cursor.sh', 'api3.cursor.sh', 'api4.cursor.sh', 'repo42.cursor.sh'];
@@ -284,70 +288,1073 @@ const RESP_DROP = new Set([
   'transfer-encoding', 'te', 'trailer', 'content-length',
 ]);
 
+const SNIFF_FILE = path.join(os.homedir(), '.openzoo', 'grokbot-sniff.jsonl');
+let realPod = null; // { agent, vnc, token, p1340, p6081, region, accountId, podId }
+
+function sniffOn() { return process.env.OPENZOO_SNIFF === '1'; }
+function sniffSelf() { return process.env.OZ_SNIFF_SELF || 'https://127.0.0.1:8443'; }
+/** CURSOR_API_BASE_URL=https://127.0.0.1:8443 makes Host 127.0.0.1 — public DNS
+ *  of that name is ENOTFOUND (measured sniff #3 /events, #4 listAgents). */
+function cursorUpstream(host) {
+  const h = String(host || '').replace(/:\d+$/, '');
+  if (/cursor\.sh$/.test(h) || /anthropic\.com$/.test(h) || /cursorvm\.com$/.test(h)) return h;
+  return 'api2.cursor.sh';
+}
+function sniffDump(rec) {
+  if (!sniffOn()) return;
+  try {
+    fs.mkdirSync(path.dirname(SNIFF_FILE), { recursive: true, mode: 0o700 });
+    fs.appendFileSync(SNIFF_FILE, JSON.stringify({ at: new Date().toISOString(), ...rec }) + '\n');
+  } catch { /* dump must never break the proxy */ }
+}
+function jsonish(buf, limit = 12000) {
+  const s = Buffer.isBuffer(buf) ? buf.toString('utf8') : String(buf || '');
+  try { return JSON.parse(s); } catch { return s.slice(0, limit); }
+}
+function copyReqHeaders(req, host) {
+  const headers = {};
+  for (const [k, v] of Object.entries(req.headers)) {
+    if (k.startsWith(':') || HOP_BY_HOP.has(k)) continue;
+    headers[k] = Array.isArray(v) ? v.join(', ') : String(v);
+  }
+  if (host) headers.host = host;
+  delete headers['content-length'];
+  return headers;
+}
+function lookupPinned(ip) {
+  return (h, o, cb) => (o && o.all ? cb(null, [{ address: ip, family: 4 }]) : cb(null, ip, 4));
+}
+function inflateBody(buf, headers) {
+  const enc = String(headers?.['content-encoding'] || '').toLowerCase();
+  try {
+    if (enc.includes('gzip')) return zlib.gunzipSync(buf);
+    if (enc.includes('deflate')) return zlib.inflateSync(buf);
+    if (enc.includes('br')) return zlib.brotliDecompressSync(buf);
+  } catch { /* fall through */ }
+  if (buf.length >= 2 && buf[0] === 0x1f && buf[1] === 0x8b) {
+    try { return zlib.gunzipSync(buf); } catch { /* */ }
+  }
+  return buf;
+}
+function writeCaptured(res, status, respHeaders, buf) {
+  const h = {};
+  for (const [k, v] of Object.entries(respHeaders || {})) {
+    if (RESP_DROP.has(k.toLowerCase())) continue;
+    h[k] = v;
+  }
+  res.writeHead(status, h);
+  res.end(buf);
+}
+
+async function upstreamUnary({ host, path: pth, method, headers, body, timeoutMs = 20000 }) {
+  const ip = await resolveRealAnthropic(host);
+  return new Promise((resolve, reject) => {
+    const up = https.request({
+      hostname: host, servername: host, port: 443, path: pth,
+      method, headers, lookup: lookupPinned(ip),
+    }, (r) => {
+      const chunks = [];
+      r.on('data', (d) => chunks.push(d));
+      r.on('end', () => resolve({
+        status: r.statusCode, respHeaders: r.headers, buf: Buffer.concat(chunks),
+      }));
+      r.on('error', reject);
+    });
+    up.on('error', reject);
+    if (timeoutMs) {
+      up.setTimeout(timeoutMs, () => {
+        reject(new Error('upstream timeout'));
+        try { up.destroy(); } catch { /* */ }
+      });
+    }
+    if (method !== 'GET' && method !== 'HEAD' && body && body.length) up.write(body);
+    up.end();
+  });
+}
+
 async function passthroughToRealAnthropic(req, res, body, host, full, log) {
   try {
-    const ip = await resolveRealAnthropic(host);
-    const headers = {};
-    for (const [k, v] of Object.entries(req.headers)) {
-      if (k.startsWith(':') || HOP_BY_HOP.has(k)) continue;
-      headers[k] = Array.isArray(v) ? v.join(', ') : String(v);
+    host = cursorUpstream(host);
+    const streaming = /Watch|Stream|Subscribe/i.test(full);
+    if (streaming) {
+      await passthroughPipe(req, res, body, host, full, log);
+      return;
+    }
+    const headers = copyReqHeaders(req, host);
+    const cap = await upstreamUnary({
+      host, path: full, method: req.method, headers, body, timeoutMs: 20000,
+    });
+    if (process.env.OPENZOO_DUMP === '1' && cap.buf.length) {
+      try {
+        const dir = '/tmp/openzoo-sniff';
+        fs.mkdirSync(dir, { recursive: true });
+        const safe = full.replace(/[^a-zA-Z0-9]+/g, '_').slice(0, 80);
+        fs.writeFileSync(`${dir}/${Date.now()}_${safe}.bin`, cap.buf);
+      } catch { /* dumping must never break the proxy */ }
     }
-    headers.host = host;
-
-    // DIAL THE ADDRESS, BUT SPEAK THE NAME. fetch(`https://${ip}/...`) cannot do
-    // this: undici derives SNI from the URL, so the server saw a bare IP, had no
-    // certificate to offer for it, and killed the handshake
-    // (ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE). node:https lets the two be set
-    // independently — a custom `lookup` pins the connection to the public-DNS
-    // address (bypassing our own /etc/hosts entry, which would otherwise loop
-    // this request straight back into this very server), while `servername` and
-    // the Host header keep presenting the real hostname so the cert validates.
-    const lookup = (h, o, cb) => (o && o.all ? cb(null, [{ address: ip, family: 4 }]) : cb(null, ip, 4));
-    const { status, respHeaders, buf } = await new Promise((resolve, reject) => {
+    writeCaptured(res, cap.status, cap.respHeaders, cap.buf);
+    log(`cursor-backend:      ${req.method} ${full} -> REAL ${host} (${cap.status}, ${cap.buf.length}b)`);
+  } catch (e) {
+    res.writeHead(502, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ type: 'error', error: { type: 'api_error', message: `passthrough failed: ${e.message}` } }));
+    log(`cursor-backend:      passthrough ${full} FAILED: ${e.message}`);
+  }
+}
+
+async function passthroughPipe(req, res, body, host, full, log) {
+  host = cursorUpstream(host);
+  const ip = await resolveRealAnthropic(host);
+  const headers = copyReqHeaders(req, host);
+  await new Promise((resolve, reject) => {
+    const up = https.request({
+      hostname: host, servername: host, port: 443, path: full,
+      method: req.method, headers, lookup: lookupPinned(ip),
+    }, (r) => {
+      const h = {};
+      for (const [k, v] of Object.entries(r.headers || {})) {
+        if (RESP_DROP.has(k.toLowerCase())) continue;
+        h[k] = v;
+      }
+      res.writeHead(r.statusCode, h);
+      r.pipe(res);
+      r.on('end', resolve);
+      r.on('error', reject);
+    });
+    up.on('error', reject);
+    req.on('close', () => { try { up.destroy(); } catch { /* */ } });
+    if (req.method !== 'GET' && req.method !== 'HEAD' && body && body.length) up.write(body);
+    up.end();
+  });
+  log(`cursor-backend:      -> PIPE ${full} -> REAL ${host}`);
+}
+
+function rememberPod(fields, log) {
+  if (!fields || !fields[6]) return null;
+  const execDaemon = String(fields[6] || '');
+  const gateway = String(fields[10] || fields[6] || '');
+  realPod = {
+    execDaemon,
+    agent: gateway, // /api/sendPrompt lives on gateway_url (1340), not exec_daemon (1337)
+    vnc: fields[7] ? String(fields[7]).split('/vnc.html')[0] : gateway,
+    vncPath: fields[7] ? String(fields[7]) : undefined,
+    token: String(fields[4] || ''),
+    accessToken: String(fields[11] || ''),
+    p1340: gateway,
+    p6081: fields[12] ? String(fields[12]) : undefined,
+    region: String(fields[1] || 'us1'),
+    accountId: String(fields[2] || ''),
+    podId: String(fields[3] || ''),
+  };
+  sniffDump({ kind: 'pod', fields, realPod });
+  log(`cursor-backend:      SNIFF real pod ${realPod.agent}`);
+  return realPod;
+}
+
+function rewrittenBox() {
+  const self = sniffSelf();
+  const p = realPod || {};
+  return encodeEnsureSandBox({
+    region: p.region || 'us1',
+    accountId: p.accountId || 'openzoo',
+    podId: p.podId || 'openzoo-sniff',
+    token: p.token || 'openzoo',
+    accessToken: p.accessToken || p.token || 'openzoo',
+    agent: self,
+    vnc: self,
+    p1340: self,
+    p6081: self,
+  });
+}
+
+async function sniffEnsureSandBox(req, res, body, host, full, log) {
+  const upstream = cursorUpstream(host);
+  const headers = copyReqHeaders(req, upstream);
+  const cap = await upstreamUnary({
+    host: upstream, path: full, method: req.method, headers, body, timeoutMs: 30000,
+  });
+  const raw = inflateBody(cap.buf, cap.respHeaders);
+  const proto = unwrapConnect(raw);
+  const fields = decodeProtoFields(proto);
+  rememberPod(fields, log);
+  sniffDump({
+    kind: 'EnsureSandBox',
+    status: cap.status,
+    bytes: cap.buf.length,
+    inflated: raw.length,
+    encoding: cap.respHeaders?.['content-encoding'] || '',
+    head: Buffer.from(raw.subarray(0, 24)).toString('hex'),
+    fields,
+    rewrittenTo: sniffSelf(),
+  });
+  const payload = realPod ? rewrittenBox() : proto;
+  const ct = String(req.headers['content-type'] || cap.respHeaders?.['content-type'] || '');
+  if (/WatchSandBoxMigration/.test(full) || ct.includes('connect+proto')) {
+    res.writeHead(200, {
+      'content-type': 'application/connect+proto',
+      'grpc-status': '0',
+      ...CORS,
+    });
+    const end = Buffer.from('{}');
+    const h = Buffer.alloc(5); h.writeUInt8(0x02, 0); h.writeUInt32BE(end.length, 1);
+    res.end(Buffer.concat([envelope(payload), h, end]));
+  } else if (ct.includes('grpc-web')) {
+    res.writeHead(200, {
+      'content-type': ct.includes('text') ? 'application/grpc-web-text+proto' : 'application/grpc-web+proto',
+      'grpc-status': '0', ...CORS,
+    });
+    res.end(Buffer.concat([envelope(payload), grpcWebTrailer()]));
+  } else {
+    res.writeHead(200, { 'content-type': 'application/proto', ...CORS });
+    res.end(payload);
+  }
+  log(`cursor-backend:      SNIFF EnsureSandBox -> rewrite ${sniffSelf()} (${cap.status}, real ${cap.buf.length}b)`);
+}
+
+async function proxyPodHttp(req, res, full, body, log) {
+  if (!realPod?.agent) return false;
+  const agent = new URL(realPod.agent);
+  const headers = copyReqHeaders(req, agent.host);
+  if (realPod.accessToken && !headers.authorization && !headers.Authorization) {
+    headers.authorization = `Bearer ${realPod.accessToken}`;
+  }
+  if (realPod.token && !headers['x-anyrun-network-token']) {
+    headers['x-anyrun-network-token'] = realPod.token;
+  }
+  if (!headers['x-sand-slim-avatars']) headers['x-sand-slim-avatars'] = '1';
+  const path0 = (full || '').split('?')[0];
+  const interesting = /sendPrompt|Transcript|listAgents|promptAcceptance|openAgentTail|createAgent/i.test(path0);
+  if (path0 === '/events') {
+    const ip = await resolveRealAnthropic(agent.hostname);
+    await new Promise((resolve, reject) => {
       const up = https.request({
-        hostname: host, servername: host, port: 443, path: full,
-        method: req.method, headers, lookup,
+        hostname: agent.hostname, servername: agent.hostname, port: 443, path: full,
+        method: req.method, headers, lookup: lookupPinned(ip),
       }, (r) => {
+        const h = { ...CORS };
+        for (const [k, v] of Object.entries(r.headers || {})) {
+          if (RESP_DROP.has(k.toLowerCase())) continue;
+          h[k] = v;
+        }
+        res.writeHead(r.statusCode, h);
         const chunks = [];
-        r.on('data', (d) => chunks.push(d));
-        r.on('end', () => resolve({
-          status: r.statusCode, respHeaders: r.headers, buf: Buffer.concat(chunks),
-        }));
+        r.on('data', (d) => {
+          res.write(d);
+          if (chunks.length < 40) chunks.push(d);
+        });
+        r.on('end', () => {
+          sniffDump({ kind: 'sse', path: full, sample: Buffer.concat(chunks).toString('utf8').slice(0, 8000) });
+          try { res.end(); } catch { /* */ }
+          resolve();
+        });
         r.on('error', reject);
       });
       up.on('error', reject);
-      // WatchSandBoxMigration is a LONG POLL — a 20s cap aborts it every time and
-      // the app never learns its sandbox is ready. Streams get no deadline.
-      const streaming = /Watch|Stream|Subscribe/i.test(full);
-      if (!streaming) up.setTimeout(20000, () => up.destroy(new Error('upstream timeout')));
-      if (req.method !== 'GET' && req.method !== 'HEAD' && body && body.length) up.write(body);
+      req.on('close', () => { try { up.destroy(); } catch { /* */ } });
       up.end();
     });
+    log('cursor-backend:      SNIFF /events -> real pod (piped)');
+    return true;
+  }
+  try {
+    const cap = await upstreamUnary({
+      host: agent.hostname,
+      path: full,
+      method: req.method,
+      headers,
+      body,
+      timeoutMs: path0 === '/health' ? 8000 : 120000,
+    });
+    writeCaptured(res, cap.status, cap.respHeaders, cap.buf);
+    const rec = {
+      kind: 'pod-http',
+      method: req.method,
+      path: path0,
+      status: cap.status,
+      reqBytes: body?.length || 0,
+      resBytes: cap.buf.length,
+      req: jsonish(body, 4000),
+      res: jsonish(inflateBody(cap.buf, cap.respHeaders), 16000),
+    };
+    sniffDump(rec);
+    if (interesting) {
+      log(`cursor-backend:      SNIFF ${path0} ${cap.status} req=${JSON.stringify(rec.req).slice(0, 220)} res=${JSON.stringify(rec.res).slice(0, 500)}`);
+    } else {
+      log(`cursor-backend:      SNIFF ${path0} -> real pod (${cap.status}, ${cap.buf.length}b)`);
+    }
+    return true;
+  } catch (e) {
+    log(`cursor-backend:      SNIFF ${path0} FAILED ${e.message}`);
+    return false;
+  }
+}
+
+/** JSON for the in-pod agent HTTP API. Hijack points field-6 at THIS
+ *  server, so GET /health and POST /api/* land here — empty protobuf on
+ *  those is "unhealthy" and Grok Bot retries EnsureSandBox forever
+ *  (measured: /health empty-ok then EnsureSandBox #1945+). */
+function jsonSend(res, obj) {
+  res.writeHead(200, { 'content-type': 'application/json', ...CORS });
+  res.end(JSON.stringify(obj));
+}
+/** Box HTTP API envelope. Client parse (CVr) returns null unless both
+ *  status==="ok" AND "value" in n — our unwrapped {ok:true}/{entries} was
+ *  dropped, so Grok Bot never painted the zoo reply (measured: << zoo 200 91c
+ *  then tail polls with Failed to send). */
+function jsonApi(res, value) {
+  jsonSend(res, { status: 'ok', value });
+}
+
+const sseClients = new Set();
+/** Gateway SSE parser (asar dispatchEventBlock) only reads `data:` lines and
+ *  requires `{channel, payload}`. `event:` names are ignored. */
+function ssePush(channel, payload) {
+  const chunk = `data: ${JSON.stringify({ channel, payload })}\n\n`;
+  for (const c of sseClients) {
+    try { c.write(chunk); } catch { sseClients.delete(c); }
+  }
+}
 
-    const h = {};
-    for (const [k, v] of Object.entries(respHeaders)) {
-      if (RESP_DROP.has(k.toLowerCase())) continue;
-      h[k] = v;
+/** Grok Bot Helper daemon: GET /local-exec/requests is SSE, POST /local-exec/responses
+ *  is `{providerId, frames}`. We used to JSON-[] the GET which is "disconnected"
+ *  (measured: Grok Bot "can't see files on your local computer"). */
+const localExecSse = new Set();
+const localExecWaiters = new Map();
+let localExecHello = null;
+function localExecPush(frame) {
+  const chunk = `data: ${JSON.stringify(frame)}\n\n`;
+  for (const c of localExecSse) {
+    try { c.write(chunk); } catch { localExecSse.delete(c); }
+  }
+}
+function handleLocalExecFrames(frames, log) {
+  for (const f of frames || []) {
+    if (!f || typeof f !== 'object') continue;
+    if (f.kind === 'hello') {
+      localExecHello = f;
+      log(`cursor-backend:      local-exec hello computer=${f.computerId || f.label || '?'} root=${f.localRoot || '?'}`);
     }
-    res.writeHead(status, h);
-    res.end(buf);
-    // DUMP THE INTERESTING ONES. EnsureSandBox's response is what names the
-    // sandbox, and the sandbox is the candidate inference path — you cannot
-    // read that from a byte count. Written raw for offline decoding.
-    if (process.env.OPENZOO_DUMP === '1' && buf.length) {
-      try {
-        const dir = '/tmp/openzoo-sniff';
-        fs.mkdirSync(dir, { recursive: true });
-        const safe = full.replace(/[^a-zA-Z0-9]+/g, '_').slice(0, 80);
-        fs.writeFileSync(`${dir}/${Date.now()}_${safe}.bin`, buf);
-      } catch { /* dumping must never break the proxy */ }
+    const w = f.requestId && localExecWaiters.get(f.requestId);
+    if (!w) continue;
+    if (f.kind === 'file') {
+      const buf = Buffer.from(f.bytesBase64 || '', 'base64');
+      w.resolve({ kind: 'file', bytes: buf, text: buf.toString('utf8') });
+      localExecWaiters.delete(f.requestId);
+    } else if (f.kind === 'file-error' || f.kind === 'messages-error') {
+      w.reject(new Error(f.error || 'local-exec error'));
+      localExecWaiters.delete(f.requestId);
+    } else if (f.kind === 'client' || f.kind === 'control' || f.kind === 'result' || f.kind === 'exec-result') {
+      w.resolve({
+        kind: f.kind,
+        message: f.message || f.text || f.stdout || JSON.stringify(f),
+        stdout: f.stdout,
+        stderr: f.stderr,
+        exitCode: f.exitCode,
+      });
+      localExecWaiters.delete(f.requestId);
+    }
+  }
+}
+function localExecAsk(frame, timeoutMs = 45000) {
+  const requestId = frame.requestId || randomUUID();
+  const job = { ...frame, requestId };
+  return new Promise((resolve, reject) => {
+    const t = setTimeout(() => {
+      localExecWaiters.delete(requestId);
+      reject(new Error('local-exec timeout — is Grok Bot Helper connected?'));
+    }, timeoutMs);
+    localExecWaiters.set(requestId, {
+      resolve: (v) => { clearTimeout(t); resolve(v); },
+      reject: (e) => { clearTimeout(t); reject(e); },
+    });
+    localExecPush(job);
+  });
+}
+async function handleLocalExecHttp(req, res, path0, body, log) {
+  if (!/^\/local-exec\//.test(path0)) return false;
+  if (req.method === 'GET' && /\/requests$/.test(path0)) {
+    res.writeHead(200, {
+      'content-type': 'text/event-stream',
+      'cache-control': 'no-cache',
+      ...CORS,
+    });
+    localExecSse.add(res);
+    // Daemon parser (asar CNt) ignores unknown welcome; a comment ping is enough
+    // to keep the stream alive until it POSTs hello to /responses.
+    res.write(': openzoo local-exec\n\n');
+    const iv = setInterval(() => {
+      try { res.write(': ping\n\n'); } catch { clearInterval(iv); localExecSse.delete(res); }
+    }, 10000);
+    req.on('close', () => { clearInterval(iv); localExecSse.delete(res); log('cursor-backend:      local-exec sse closed'); });
+    log(`cursor-backend:      -> local-exec /requests sse n=${localExecSse.size}`);
+    return true;
+  }
+  if (/\/responses$/.test(path0)) {
+    let parsed = {};
+    try { parsed = JSON.parse(String(body || '{}')); } catch { parsed = {}; }
+    handleLocalExecFrames(parsed.frames, log);
+    jsonSend(res, { ok: true });
+    log(`cursor-backend:      -> local-exec /responses n=${(parsed.frames || []).length} kinds=${(parsed.frames || []).map((f) => f?.kind).join(',')}`);
+    return true;
+  }
+  jsonSend(res, { ok: true });
+  return true;
+}
+function extractLocalPaths(text) {
+  const out = [];
+  const re = /(?:~\/|\/Users\/)[^\s,;:!?()[\]{}"'`]+/g;
+  let m;
+  while ((m = re.exec(String(text || '')))) {
+    out.push(m[0].replace(/[.,;:]+$/, ''));
+  }
+  return [...new Set(out)];
+}
+function expandUserPath(p) {
+  if (p.startsWith('~/')) return path.join(os.homedir(), p.slice(2));
+  return p;
+}
+
+/** Per-agent transcript. sendPrompt is async: accept immediately, zooComplete
+ *  fills this, getAgentTranscriptTail is what the UI actually polls.
+ *
+ *  Gateway `isValidTranscriptEntry` (asar Fgi/RC) DROPS anything that is not
+ *  `{id, kind:"message", content}` / `{id, kind:"send-message", message}` —
+ *  proto wrappers with entryKind/body were counted n=2/2 here and painted
+ *  as zero on the client, so overlay timed out → "Failed to send". */
+const transcripts = new Map();
+const tailedAgents = new Set();
+let lastSendEchoId = `oz-${Date.now()}`;
+function agentTranscript(id) {
+  let t = transcripts.get(id);
+  if (!t) { t = { seq: 0, entries: [] }; transcripts.set(id, t); }
+  return t;
+}
+function appendLine(agentId, role, text, extra = {}) {
+  const t = agentTranscript(agentId);
+  t.seq += 1;
+  const nonce = extra.clientNonce ? String(extra.clientNonce) : undefined;
+  const ts = Date.now();
+  const requestId = extra.requestId || nonce || `oz-req-${t.seq}`;
+  let e;
+  if (role === 'user') {
+    // Live cursorvm getAgentTranscriptTail (2026-08-29): user echo is
+    // kind:"message" + role:"user" + clientNonce. Assistant is kind:"send-message".
+    e = {
+      seq: t.seq,
+      kind: 'message',
+      id: extra.id || `t${t.seq}u`,
+      role: 'user',
+      content: String(text || ''),
+      richText: extra.richText || JSON.stringify({ type: 'doc', content: [{ type: 'paragraph', content: [{ type: 'text', text: String(text || '') }] }] }),
+      isStreaming: false,
+      timestampMs: ts,
+      ...(nonce ? { clientNonce: nonce } : {}),
+      requestId,
+    };
+  } else {
+    e = {
+      seq: t.seq,
+      kind: 'send-message',
+      id: extra.id || `t${t.seq}s0`,
+      message: { type: 'text', content: String(text || '') },
+      timestampMs: ts,
+      requestId,
+    };
+  }
+  t.entries.push(e);
+  return e;
+}
+function fanoutLine(primaryId, role, text, extra = {}) {
+  const ids = new Set([primaryId, ...tailedAgents]);
+  let last = null;
+  for (const id of ids) last = appendLine(id, role, text, extra);
+  return last;
+}
+function gatewayEntry(e) {
+  const { seq, ...rest } = e;
+  return rest;
+}
+
+function promptFromSendBody(raw) {
+  let obj = raw;
+  if (Buffer.isBuffer(raw) || typeof raw === 'string') {
+    try { obj = JSON.parse(String(raw)); } catch { return String(raw || ''); }
+  }
+  if (!obj || typeof obj !== 'object') return '';
+  const pick = (v) => (typeof v === 'string' && v.trim() ? v : '');
+  let fromMsgs = '';
+  if (Array.isArray(obj.messages)) {
+    for (let i = obj.messages.length - 1; i >= 0; i--) {
+      const m = obj.messages[i];
+      fromMsgs = pick(m?.content) || pick(m?.text) || pick(m?.prompt);
+      if (fromMsgs) break;
+    }
+  }
+  return pick(obj.prompt) || pick(obj.text) || pick(obj.message)
+    || pick(obj.content) || pick(obj.input)
+    || pick(obj.message?.content) || pick(obj.message?.text)
+    || fromMsgs
+    || '';
+}
+
+let walletUsdCache = { usd: null, at: 0 };
+async function walletUsdCached() {
+  if (walletUsdCache.usd != null && Date.now() - walletUsdCache.at < 60_000) return walletUsdCache.usd;
+  try {
+    const { affordableUsd } = await import('./info.js');
+    const n = await Promise.race([
+      affordableUsd(),
+      new Promise((_, rej) => setTimeout(() => rej(new Error('balance timeout')), 4000)),
+    ]);
+    if (Number.isFinite(n)) {
+      walletUsdCache = { usd: Number(n), at: Date.now() };
+      return walletUsdCache.usd;
     }
-    log(`cursor-backend:      ${req.method} ${full} -> REAL ${host} (${status}, ${buf.length}b)`);
+  } catch { /* keep last */ }
+  return walletUsdCache.usd;
+}
+
+async function zooSpendOverlay(data) {
+  const x = data?.x402 || {};
+  let info = {};
+  try {
+    const r = await fetch('http://127.0.0.1:8402/v1/info', { signal: AbortSignal.timeout(1500) });
+    if (r.ok) info = await r.json();
+  } catch { /* */ }
+  let session = {};
+  try {
+    session = JSON.parse(fs.readFileSync(path.join(os.homedir(), '.openzoo', 'session.json'), 'utf8'));
+  } catch { /* */ }
+  const spent = Number(info.spendUsd ?? session.spentUsd ?? x.billedUsd ?? 0);
+  const would = Number(info.directUsd ?? session.directUsd ?? x.directUsd ?? 0);
+  const saved = Number(info.savedUsd ?? Math.max(0, would - spent));
+  const pct = would > 0 ? (100 * saved / would) : 0;
+  const credit = Number(info.creditUsd);
+  const wallet = await walletUsdCached();
+  const bal = Number.isFinite(wallet) && wallet > 0.004
+    ? wallet
+    : (Number.isFinite(credit) && credit > 0.004 ? credit : null);
+  const lines = ['', ''];
+  if (x.billedUsd != null) {
+    lines.push(`this call $${Number(x.billedUsd).toFixed(6)} · OpenRouter $${Number(x.directUsd || 0).toFixed(6)}`);
+  }
+  const balTxt = bal != null ? ` · balance $${bal.toFixed(2)}` : '';
+  lines.push(`spent $${spent.toFixed(4)}${balTxt} · OpenRouter would $${would.toFixed(4)} · saved $${saved.toFixed(4)} (${pct.toFixed(0)}%)`);
+  return lines.join('\n');
+}
+
+const MODELS_PATH = path.join(os.homedir(), '.openzoo', 'grokbot-models.json');
+function loadAgentModels() {
+  try {
+    return new Map(Object.entries(JSON.parse(fs.readFileSync(MODELS_PATH, 'utf8'))));
+  } catch { return new Map(); }
+}
+function saveAgentModels() {
+  try {
+    fs.mkdirSync(path.dirname(MODELS_PATH), { recursive: true });
+    fs.writeFileSync(MODELS_PATH, JSON.stringify(Object.fromEntries(agentModels)));
+  } catch { /* */ }
+}
+const agentModels = loadAgentModels();
+const MODEL_ALIASES = {
+  fable: 'anthropic/claude-fable-5',
+  'fable-5': 'anthropic/claude-fable-5',
+  'claude-fable-5': 'anthropic/claude-fable-5',
+  opus: 'anthropic/claude-opus-5',
+  'opus-5': 'anthropic/claude-opus-5',
+  sonnet: 'anthropic/claude-sonnet-5',
+  grok: 'x-ai/grok-4.6',
+  'grok-4': 'x-ai/grok-4.6',
+  'grok-4.6': 'x-ai/grok-4.6',
+};
+function resolveModelId(raw) {
+  const s = String(raw || '').trim();
+  if (!s) return null;
+  const lower = s.toLowerCase().replace(/^\/+/, '');
+  if (MODEL_ALIASES[lower]) return MODEL_ALIASES[lower];
+  if (s.includes('/')) return s;
+  return null;
+}
+function currentModel(agentId) {
+  return agentModels.get(agentId)
+    || process.env.OPENZOO_DEFAULT_MODEL
+    || 'x-ai/grok-4.6';
+}
+
+const execFileAsync = promisify(execFile);
+const IMAGE_EXT = /\.(png|jpe?g|gif|webp|bmp|heic|svg)$/i;
+const IMAGE_MAGIC = [
+  [Buffer.from([0x89, 0x50, 0x4e, 0x47]), 'image/png'],
+  [Buffer.from([0xff, 0xd8, 0xff]), 'image/jpeg'],
+  [Buffer.from('GIF8'), 'image/gif'],
+  [Buffer.from('RIFF'), 'image/webp'],
+];
+function mimeFromBytes(buf, p = '') {
+  if (IMAGE_EXT.test(p)) {
+    const ext = path.extname(p).toLowerCase();
+    return { 'png': 'image/png', '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.gif': 'image/gif', '.webp': 'image/webp', '.bmp': 'image/bmp', '.heic': 'image/heic', '.svg': 'image/svg+xml' }[ext] || 'image/png';
+  }
+  for (const [magic, mime] of IMAGE_MAGIC) {
+    if (buf.length >= magic.length && buf.subarray(0, magic.length).equals(magic)) return mime;
+  }
+  return null;
+}
+function dataUrlsFromRichText(rt) {
+  const s = String(rt || '');
+  const out = [];
+  const re = /data:image\/[a-zA-Z0-9.+-]+;base64,[A-Za-z0-9+/]+=*/g;
+  let m;
+  while ((m = re.exec(s))) out.push(m[0]);
+  return out;
+}
+function attachmentList(parsed, prompt) {
+  const out = [];
+  const seen = new Set();
+  const add = (raw, name) => {
+    if (!raw || seen.has(raw)) return;
+    seen.add(raw);
+    out.push({ raw, name });
+  };
+  const paths = parsed?.attachmentPaths;
+  const names = parsed?.attachmentNames;
+  if (Array.isArray(paths)) {
+    for (let i = 0; i < paths.length; i++) add(String(paths[i]), names?.[i]);
+  }
+  for (const p of extractLocalPaths(prompt)) {
+    if (/[*?]/.test(p)) continue;
+    add(p);
+  }
+  const rt = String(parsed?.richText || '');
+  const srcRe = /(?:src|path|filePath|url)"?\s*[:=]\s*"((?:file:\/\/|\/(?:var|tmp|private|Users)|~\/)[^"]+\.(?:png|jpe?g|gif|webp|bmp|heic))"/gi;
+  let sm;
+  while ((sm = srcRe.exec(rt))) {
+    add(sm[1].replace(/^file:\/\//, ''));
+  }
+  return out;
+}
+
+async function readLocalBytes(abs, log) {
+  if (localExecSse.size > 0) {
+    log(`cursor-backend:      local-exec download ${abs}`);
+    const got = await localExecAsk({ kind: 'download', path: abs });
+    return got.bytes || Buffer.from(got.text || '', 'utf8');
+  }
+  return fs.readFileSync(abs);
+}
+async function writeLocalBytes(abs, bytes, log) {
+  const buf = Buffer.isBuffer(bytes) ? bytes : Buffer.from(String(bytes ?? ''), 'utf8');
+  if (localExecSse.size > 0) {
+    log(`cursor-backend:      local-exec upload ${abs} ${buf.length}b`);
+    await localExecAsk({
+      kind: 'upload',
+      path: abs,
+      bytesBase64: buf.toString('base64'),
+    });
+    return `wrote ${abs} (${buf.length} bytes) via local-exec`;
+  }
+  fs.mkdirSync(path.dirname(abs), { recursive: true });
+  fs.writeFileSync(abs, buf);
+  return `wrote ${abs} (${buf.length} bytes)`;
+}
+async function execLocal(command, cwd, log) {
+  const dir = cwd ? expandUserPath(cwd) : os.homedir();
+  if (localExecSse.size > 0) {
+    log(`cursor-backend:      local-exec exec ${JSON.stringify(command).slice(0, 80)}`);
+    const got = await localExecAsk({
+      kind: 'exec',
+      serverMessage: { command, cwd: dir, workingDirectory: dir },
+    }, 60000);
+    const out = got.stdout || got.message || '';
+    const err = got.stderr ? `\nstderr:\n${got.stderr}` : '';
+    return `${out}${err}`.trim() || `(exit ${got.exitCode ?? 0})`;
+  }
+  const { stdout, stderr } = await execFileAsync('/bin/zsh', ['-lc', command], {
+    cwd: dir,
+    timeout: 30000,
+    maxBuffer: 2 * 1024 * 1024,
+    env: process.env,
+  });
+  return `${stdout || ''}${stderr ? `\nstderr:\n${stderr}` : ''}`.trim() || '(no output)';
+}
+
+const LOCAL_TOOLS = [
+  {
+    type: 'function',
+    function: {
+      name: 'read_file',
+      description: 'Read a file on the user\'s Mac. Use this for any local path.',
+      parameters: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'] },
+    },
+  },
+  {
+    type: 'function',
+    function: {
+      name: 'write_file',
+      description: 'Write a file on the user\'s Mac. Put HTML/games/code on disk — do not dump huge files in chat.',
+      parameters: {
+        type: 'object',
+        properties: { path: { type: 'string' }, content: { type: 'string' } },
+        required: ['path', 'content'],
+      },
+    },
+  },
+  {
+    type: 'function',
+    function: {
+      name: 'exec',
+      description: 'Run a shell command on the user\'s Mac (zsh -lc). Use for npm, curl, ls, git, installing MCP, etc.',
+      parameters: {
+        type: 'object',
+        properties: { command: { type: 'string' }, cwd: { type: 'string' } },
+        required: ['command'],
+      },
+    },
+  },
+  {
+    type: 'function',
+    function: {
+      name: 'list_dir',
+      description: 'List a directory on the user\'s Mac.',
+      parameters: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'] },
+    },
+  },
+];
+
+async function runLocalTool(name, args, log) {
+  try {
+    if (name === 'read_file') {
+      const buf = await readLocalBytes(expandUserPath(args.path), log);
+      if (buf.length > 180000) return `file ${args.path} is ${buf.length} bytes; first 180000:\n${buf.subarray(0, 180000).toString('utf8')}`;
+      return buf.toString('utf8');
+    }
+    if (name === 'write_file') {
+      return await writeLocalBytes(expandUserPath(args.path), args.content ?? '', log);
+    }
+    if (name === 'list_dir') {
+      const abs = expandUserPath(args.path || os.homedir());
+      if (localExecSse.size > 0) {
+        const got = await localExecAsk({ kind: 'exec', serverMessage: { command: `ls -la ${JSON.stringify(abs)}`, cwd: os.homedir() } });
+        return got.stdout || got.message || '';
+      }
+      return fs.readdirSync(abs, { withFileTypes: true })
+        .map((e) => `${e.isDirectory() ? 'd' : '-'} ${e.name}`)
+        .join('\n');
+    }
+    if (name === 'exec') {
+      return await execLocal(String(args.command || ''), args.cwd, log);
+    }
+    return `unknown tool ${name}`;
   } catch (e) {
-    res.writeHead(502, { 'content-type': 'application/json' });
-    res.end(JSON.stringify({ type: 'error', error: { type: 'api_error', message: `passthrough failed: ${e.message}` } }));
-    log(`cursor-backend:      passthrough ${full} FAILED: ${e.message}`);
+    return `ERROR ${e.message}`;
+  }
+}
+
+function zooTextFromMessage(msg, data) {
+  let c = msg?.content;
+  if (Array.isArray(c)) {
+    c = c.map((p) => (typeof p === 'string' ? p : (p?.text || p?.content || ''))).join('');
   }
+  if (typeof c === 'string' && c.trim()) return c;
+  if (typeof data?.error?.message === 'string' && data.error.message) return data.error.message;
+  return '';
+}
+
+async function zooComplete(prompt, log, agentId, parsed = {}) {
+  const model = currentModel(agentId);
+  const helper = localExecSse.size > 0;
+  log(`cursor-backend:      zoo POST :8402 model=${model} helper=${helper ? localExecSse.size : 0} ${JSON.stringify((prompt || '').slice(0, 60))}`);
+
+  const images = [];
+  const textFiles = [];
+  for (const { raw, name } of attachmentList(parsed, prompt)) {
+    const abs = expandUserPath(raw);
+    try {
+      const buf = await readLocalBytes(abs, log);
+      const mime = mimeFromBytes(buf, name || raw);
+      if (mime) {
+        images.push({ path: raw, mime, dataUrl: `data:${mime};base64,${buf.toString('base64')}` });
+        log(`cursor-backend:      attached image ${raw} ${mime} ${buf.length}b`);
+      } else {
+        textFiles.push({ path: raw, abs, text: buf.toString('utf8') });
+      }
+    } catch (e) {
+      textFiles.push({ path: raw, abs, error: e.message });
+    }
+  }
+  for (const url of dataUrlsFromRichText(parsed.richText)) {
+    images.push({ path: '(richText)', mime: 'image', dataUrl: url });
+  }
+
+  const via = helper ? 'Grok Bot Helper local-exec SSE' : 'this Mac (hijack process; Helper SSE not connected yet)';
+  const messages = [
+    {
+      role: 'system',
+      content: [
+        `You are ${model} served through openzoo inside Grok Bot.`,
+        `You HAVE local tools on the user's computer via ${via}.`,
+        'Tools: read_file, write_file, exec, list_dir. USE THEM. Write files to disk instead of pasting giant HTML into chat.',
+        'Pasted images arrive as attachments — you can see them when present. Do not claim you cannot see images if they are in this turn.',
+        'Never claim you lack filesystem access or local-exec. If a tool errors, report the error.',
+        'A spend footer is appended after your reply by the host — ignore it.',
+      ].join(' '),
+    },
+  ];
+  if (textFiles.length) {
+    const bits = textFiles.map((a) => (
+      a.error
+        ? `FILE ${a.path} ERROR: ${a.error}`
+        : `FILE ${a.path} (${a.abs})\n${String(a.text).slice(0, 180000)}`
+    ));
+    messages.push({ role: 'user', content: bits.join('\n\n') });
+  }
+
+  const userContent = [];
+  for (const img of images) {
+    userContent.push({ type: 'image_url', image_url: { url: img.dataUrl } });
+  }
+  userContent.push({ type: 'text', text: prompt || (images.length ? '(see attached image)' : 'hello') });
+  messages.push({
+    role: 'user',
+    content: userContent.length === 1 && userContent[0].type === 'text'
+      ? userContent[0].text
+      : userContent,
+  });
+
+  const maxTok = Number(process.env.OPENZOO_ASK_MAX_TOKENS || 4096);
+  let lastData = {};
+  let text = '';
+  for (let step = 0; step < 8; step++) {
+    const payload = {
+      model,
+      messages,
+      tools: LOCAL_TOOLS,
+      tool_choice: 'auto',
+      max_tokens: maxTok,
+    };
+    const post = () => fetch('http://127.0.0.1:8402/v1/chat/completions', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', authorization: 'Bearer sk-openzoo' },
+      body: JSON.stringify(payload),
+      signal: AbortSignal.timeout(120000),
+    });
+    let r = await post();
+    if (r.status === 402) {
+      log('cursor-backend:      x402 402 — dwell/retry');
+      await new Promise((ok) => setTimeout(ok, 2500));
+      r = await post();
+    }
+    const data = await r.json();
+    lastData = data;
+    const msg = data.choices?.[0]?.message || {};
+    const calls = Array.isArray(msg.tool_calls) ? msg.tool_calls : [];
+    if (calls.length) {
+      log(`cursor-backend:      zoo tools step=${step} n=${calls.length} ${calls.map((c) => c.function?.name || c.name).join(',')}`);
+      messages.push(msg);
+      for (const c of calls) {
+        let args = {};
+        try { args = JSON.parse(c.function?.arguments || c.arguments || '{}'); } catch { args = {}; }
+        const name = c.function?.name || c.name || '';
+        const result = await runLocalTool(name, args, log);
+        messages.push({
+          role: 'tool',
+          tool_call_id: c.id,
+          content: String(result).slice(0, 120000),
+        });
+      }
+      continue;
+    }
+    text = zooTextFromMessage(msg, data) || (step ? '(tool loop ended with empty content)' : '(empty zoo reply)');
+    log(`cursor-backend:      << zoo ${r.status} ${text.length}c model=${data.model || model} finish=${data.choices?.[0]?.finish_reason || '?'}`);
+    break;
+  }
+  try { text += await zooSpendOverlay(lastData); } catch { /* overlay must never eat the reply */ }
+  return { text, data: lastData };
+}
+
+async function handleHijackedPodHttp(req, res, full, body, log) {
+  if (sniffOn()) {
+    const waiting = (full || '').split('?')[0];
+    const podPath = waiting === '/health' || waiting === '/healthz' || waiting === '/events'
+      || waiting.startsWith('/api/') || waiting.startsWith('/webauthn/')
+      || waiting.startsWith('/cookie-origin-approval/');
+    if (waiting.startsWith('/local-exec/')) return handleLocalExecHttp(req, res, waiting, body, log);
+    if (realPod?.agent && podPath) return proxyPodHttp(req, res, full, body, log);
+    if (!podPath) return false;
+    if (waiting === '/health' || waiting === '/healthz') {
+      jsonSend(res, { ok: true, status: 'ok', ready: true });
+      return true;
+    }
+    return false;
+  }
+  const path0 = (full || '').split('?')[0];
+  if (path0 === '/health' || path0 === '/healthz') {
+    jsonSend(res, { ok: true, status: 'ok', ready: true });
+    log('cursor-backend:      -> pod /health ok');
+    return true;
+  }
+  if (path0 === '/events') {
+    res.writeHead(200, {
+      'content-type': 'text/event-stream',
+      'cache-control': 'no-cache',
+      ...CORS,
+    });
+    res.write('data: {"channel":"ping","payload":{}}\n\n');
+    sseClients.add(res);
+    const iv = setInterval(() => {
+      try { res.write('data: {"channel":"ping","payload":{}}\n\n'); } catch { clearInterval(iv); sseClients.delete(res); }
+    }, 15000);
+    req.on('close', () => { clearInterval(iv); sseClients.delete(res); });
+    log('cursor-backend:      -> pod /events sse');
+    return true;
+  }
+  if (path0.startsWith('/webauthn/') || path0.startsWith('/cookie-origin-approval/')) {
+    if (req.method === 'GET') jsonSend(res, []);
+    else jsonSend(res, { ok: true });
+    log(`cursor-backend:      -> pod ${path0}`);
+    return true;
+  }
+  if (!path0.startsWith('/api/')) return false;
+  const name = path0.slice('/api/'.length);
+  // Roster/settings come from the REAL 1340 gateway (names, avatars, trays).
+  // Chat stays local so inference is zoo. Discovered on EnsureSandBox rewrite.
+  const roster = new Set([
+    'listAgents', 'countAgents', 'searchAgents', 'getTrays', 'getHostSettings',
+    'setHostSettings', 'getAgentChannels', 'getAgentWorkflows', 'skillsCatalog',
+    'getSubagents', 'getAsyncTasks', 'getForeverBoxStatus', 'getSharingState',
+    'getBotTemplateExportPolicy', 'getTeachRecordingStatus', 'isGlobalSearchEnabled',
+    'isEgressTunnelAvailable', 'listBoxMcpServers', 'getHostStatus',
+    'setWindowFocused', 'getAgentAutomations',
+    'createAgent', 'createAgentFromTemplate', 'createGroup', 'setGroupMembers',
+    'updateAgent', 'deleteAgents', 'duplicateAgent', 'kickstartAgent',
+    'interruptAgentRun', 'requestDiskSaverAudit', 'broadcastToAgents',
+    'setAgentUnread', 'setAgentHiddenFromSidebar', 'setAgentNotificationsEnabled',
+    'setAgentNotifyOnUpdates', 'setAgentAvatarBytes', 'getAgentAvatar',
+  ]);
+  if (!sniffOn() && realPod?.agent && roster.has(name)) {
+    return proxyPodHttp(req, res, full, body, log);
+  }
+
+  // THE ACTUAL CHAT PATH. Grok Bot does not send StreamUnifiedChat on this
+  // surface — measured: POST /api/sendPrompt 374b/462b after EnsureSandBox
+  // hijack. Stubbing {ok:true} ate the prompt. Forward to the paying proxy.
+  if (name === 'sendPrompt') {
+    let parsed = {};
+    try { parsed = JSON.parse(String(body || '{}')); } catch { parsed = {}; }
+    const prompt = promptFromSendBody(parsed);
+    const agentId = String(parsed.agentId || parsed.id || 'openzoo');
+    const nonce = parsed.clientNonce || `oz-${Date.now()}`;
+    const attN = Array.isArray(parsed.attachmentPaths) ? parsed.attachmentPaths.length : 0;
+    log(`cursor-backend:      >> sendPrompt agent=${agentId} keys=${Object.keys(parsed).join(',')} attachments=${attN} prompt=${JSON.stringify((prompt || '').slice(0, 80))}`);
+    lastSendEchoId = String(nonce);
+    const userLine = fanoutLine(agentId, 'user', prompt, {
+      clientNonce: nonce,
+      requestId: nonce,
+      richText: parsed.richText,
+    });
+    ssePush('transcript', { ...gatewayEntry(userLine), agentId });
+    jsonSend(res, { accepted: true });
+    const modelCmd = /^\s*\/model(?:\s+(\S+))?\s*$/i.exec(prompt || '');
+    setImmediate(async () => {
+      let text = '';
+      try {
+        if (modelCmd) {
+          const want = modelCmd[1];
+          if (!want) {
+            const cur = currentModel(agentId);
+            text = `current model: ${cur}\nset with /model fable | opus | sonnet | grok | provider/id`;
+          } else {
+            const id = resolveModelId(want) || (want.includes('/') ? want : null);
+            if (!id) {
+              text = `unknown model "${want}". try /model fable | opus | sonnet | grok or a full id like anthropic/claude-fable-5`;
+            } else {
+              agentModels.set(agentId, id);
+              saveAgentModels();
+              text = `model set to ${id}`;
+            }
+          }
+          try { text += await zooSpendOverlay({}); } catch { /* */ }
+        } else {
+          const z = await zooComplete(prompt, log, agentId, parsed);
+          text = z.text;
+        }
+      } catch (e) {
+        text = `openzoo error: ${e.message}`;
+        log(`cursor-backend:      sendPrompt zoo failed: ${e.message}`);
+      }
+      const line = fanoutLine(agentId, 'assistant', text, { clientNonce: nonce, requestId: nonce });
+      ssePush('transcript', { ...gatewayEntry(line), agentId });
+      log(`cursor-backend:      sendPrompt done agent=${agentId} seq=${line.seq} text=${JSON.stringify(text.slice(0, 80))}`);
+    });
+    return true;
+  }
+  if (name === 'getAgentTranscriptTail' || name === 'getAgentTranscriptWindow' || name === 'openAgentTail') {
+    let parsed = {};
+    try { parsed = JSON.parse(String(body || '{}')); } catch { parsed = {}; }
+    let id = String(parsed.id || parsed.agentId || 'openzoo');
+    tailedAgents.add(id);
+    let t = agentTranscript(id);
+    if (!t.entries.length) {
+      for (const [other, ot] of transcripts) {
+        if (ot.entries.length) { id = other; t = ot; break; }
+      }
+    }
+    const limit = Math.min(Number(parsed.limit) || 50, 200);
+    const before = parsed.beforeSeq != null ? Number(parsed.beforeSeq) : Infinity;
+    const sliced = t.entries.filter((e) => e.seq < before).slice(-limit);
+    const page = { entries: sliced.map(gatewayEntry) };
+    if (t.entries.length > sliced.length && sliced.length) page.nextBeforeSeq = sliced[0].seq;
+    // Live pod returns RAW {entries, nextBeforeSeq} — no CVr envelope
+    // (measured 1340 getAgentTranscriptTail 2026-08-29). Wrapping {status,value}
+    // made transcript-page validation fail and the canvas stayed empty.
+    jsonSend(res, page);
+    log(`cursor-backend:      -> transcript ${id} n=${sliced.length}/${t.seq}`);
+    return true;
+  }
+  if (name === 'promptAcceptanceStatus') {
+    let parsed = {};
+    try { parsed = JSON.parse(String(body || '{}')); } catch { parsed = {}; }
+    const nonce = String(parsed.clientNonce || lastSendEchoId);
+    const agentId = String(parsed.agentId || '');
+    jsonSend(res, {
+      outcome: 'found',
+      record: {
+        status: 'accepted',
+        acceptedAtMs: Date.now(),
+        echoEntryId: nonce,
+        clientNonce: nonce,
+        agentId,
+        inputDigest: '',
+      },
+    });
+    log(`cursor-backend:      -> promptAcceptanceStatus found echo=${nonce}`);
+    return true;
+  }
+
+  const stubs = {
+    getHostStatus: { status: 'ready', ready: true, state: 'ready', hostStatus: 'ready' },
+    getHostSettings: { settings: {} },
+    setHostSettings: { ok: true },
+    setBoxSecrets: { ok: true },
+    listAgents: [...new Set([...transcripts.keys(), ...tailedAgents])].map((id) => ({ id, name: id, status: 'ready' })),
+    getAgentTranscriptTail: { tail: '', lines: [], dropped: false, ok: true },
+    getTeachRecordingStatus: { recording: false },
+    getTrays: { trays: [] },
+    isGlobalSearchEnabled: { enabled: false },
+    isEgressTunnelAvailable: { available: false },
+    getSharingState: { sharing: false },
+    getBotTemplateExportPolicy: { allowed: true },
+    getAgentAutomations: { automations: [] },
+    getForeverBoxStatus: { enabled: false },
+    getSubagents: { subagents: [] },
+    getAsyncTasks: { tasks: [] },
+    getAgentWorkflows: { workflows: [] },
+    setWindowFocused: { ok: true },
+  };
+  const payload = stubs[name] !== undefined ? stubs[name] : { ok: true };
+  // Live 1340 listAgents is a RAW array, not CVr (measured 104674b 2026-08-29).
+  if (name === 'listAgents') jsonSend(res, payload);
+  else jsonApi(res, payload);
+  log(`cursor-backend:      -> pod /api/${name}`);
+  return true;
 }
 
 /**
@@ -408,6 +1415,9 @@ function respond(req, res, method, models) {
  */
 export function startCursorBackend({ port = 8443, models, log = () => {} } = {}) {
   const { cert, key } = ensureCert(log);
+  const certPem = fs.readFileSync(cert);
+  const keyPem = fs.readFileSync(key);
+  const secureContext = tls.createSecureContext({ cert: certPem, key: keyPem });
   let conns = 0;
   // SERVE BOTH h2 AND h1. An earlier build forced h1-only after concluding the
   // editor's h2 connections reset — but that log was the STALE 8443 backend the
@@ -416,13 +1426,20 @@ export function startCursorBackend({ port = 8443, models, log = () => {} } = {})
   // (ERR_SSL_NO_APPLICATION_PROTOCOL when we advertise just h1), so we must
   // negotiate both. allowHTTP1 keeps the h1 fetch() calls (stripe/updates)
   // working; ALPN h2 first satisfies the Connect gRPC client.
+  // SNICallback MUST pass the SecureContext — cb(null) with no ctx is why the
+  // Helper daemon's Node fetch never completed GET /local-exec/requests (TLS
+  // ECONNRESET, no request log). Chromium --ignore-certificate-errors hid this
+  // for the UI process.
   const server = http2.createSecureServer(
     {
-      cert: fs.readFileSync(cert),
-      key: fs.readFileSync(key),
+      cert: certPem,
+      key: keyPem,
       allowHTTP1: true,
       ALPNProtocols: ['h2', 'http/1.1'],
-      SNICallback: (servername, cb) => { log(`cursor-tls: <- ClientHello SNI=${servername}`); cb(null); },
+      SNICallback: (servername, cb) => {
+        log(`cursor-tls: <- ClientHello SNI=${servername || '?'}`);
+        cb(null, secureContext);
+      },
     },
     async (req, res) => {
       conns += 1;
@@ -494,13 +1511,38 @@ export function startCursorBackend({ port = 8443, models, log = () => {} } = {})
       {
         const path0 = full.split('?')[0];
         const oauth = /^\/oauth(\/|$)/.test(path0);
-        const needRealPod = /GrokBotService\/(EnsureSandBox|WatchSandBoxMigration)/.test(full)
-          && !process.env.OZ_HIJACK_POD;
-        if (oauth || needRealPod) {
+        // Coordinator talks to /sand-box/local-exec-daemon-credential. empty-ok
+        // here is ControlPortCallError: main-execution-failure: fetch failed.
+        const sandBox = /^\/sand-box(\/|$)/.test(path0);
+        const grokCred = /IssueGrokBotUserComputerCredential/.test(full);
+        const sniffBox = sniffOn() && /GrokBotService\/(EnsureSandBox|WatchSandBoxMigration)/.test(full);
+        const needRealPod = /GrokBotService\/EnsureSandBox/.test(full)
+          && !process.env.OZ_HIJACK_POD
+          && !sniffBox;
+        if (sniffBox) {
+          if (/WatchSandBoxMigration/.test(full) && realPod) {
+            const payload = rewrittenBox();
+            res.writeHead(200, {
+              'content-type': 'application/connect+proto',
+              'grpc-status': '0',
+              ...CORS,
+            });
+            const end = Buffer.from('{}');
+            const h = Buffer.alloc(5); h.writeUInt8(0x02, 0); h.writeUInt32BE(end.length, 1);
+            res.end(Buffer.concat([envelope(payload), h, end]));
+            log('cursor-backend:      SNIFF WatchSandBoxMigration ready (rewritten)');
+            return;
+          }
+          await sniffEnsureSandBox(req, res, body, host, full, log);
+          return;
+        }
+        if (oauth || sandBox || grokCred || needRealPod) {
           const upstream = /cursor\.sh$/.test(host) ? host : 'api2.cursor.sh';
           await passthroughToRealAnthropic(req, res, body, upstream, full, log);
           return;
         }
+        if (await handleLocalExecHttp(req, res, path0, body, log)) return;
+        if (await handleHijackedPodHttp(req, res, full, body, log)) return;
       }
       // HIJACK EnsureSandBox FIRST — before passthrough, or passthrough eats it.
       // MEASURED: with OPENZOO_PASSTHRU=1 set, EnsureSandBox went `-> REAL
@@ -508,8 +1550,44 @@ export function startCursorBackend({ port = 8443, models, log = () => {} } = {})
       // never our box. This method (and ONLY this one) must be answered locally
       // with OUR box so Grok Bot's UI wires to our sandbox; everything else
       // still passes through so the app loads normally.
-      if (/GrokBotService\/EnsureSandBox/.test(full) && process.env.OZ_HIJACK_POD) {
-        respond(req, res, method, models);   // encodeForMethod('EnsureSandBox') reads OZ_HIJACK_POD
+      if (/GrokBotService\/(EnsureSandBox|WatchSandBoxMigration)/.test(full) && process.env.OZ_HIJACK_POD) {
+        if (/WatchSandBoxMigration/.test(full) && realPod) {
+          const payload = rewrittenBox();
+          res.writeHead(200, {
+            'content-type': 'application/connect+proto',
+            'grpc-status': '0',
+            ...CORS,
+          });
+          const end = Buffer.from('{}');
+          const h = Buffer.alloc(5); h.writeUInt8(0x02, 0); h.writeUInt32BE(end.length, 1);
+          res.end(Buffer.concat([envelope(payload), h, end]));
+          log('cursor-backend:      -> WatchSandBoxMigration ready (hijack, real roster)');
+          return;
+        }
+        try {
+          process.env.OZ_SNIFF_SELF = process.env.OZ_SNIFF_SELF || 'https://127.0.0.1:8443';
+          await sniffEnsureSandBox(req, res, body, host, full, log);
+          log('cursor-backend:      -> HIJACKED EnsureSandBox -> our box (roster from real 1340)');
+          return;
+        } catch (e) {
+          log(`cursor-backend:      EnsureSandBox discover failed (${e.message}) — env box`);
+        }
+        let pod;
+        try { pod = JSON.parse(process.env.OZ_HIJACK_POD); } catch { pod = null; }
+        if (pod && /WatchSandBoxMigration/.test(full)) {
+          const payload = encodeEnsureSandBox(pod);
+          res.writeHead(200, {
+            'content-type': 'application/connect+proto',
+            'grpc-status': '0',
+            ...CORS,
+          });
+          const end = Buffer.from('{}');
+          const h = Buffer.alloc(5); h.writeUInt8(0x02, 0); h.writeUInt32BE(end.length, 1);
+          res.end(Buffer.concat([envelope(payload), h, end]));
+          log('cursor-backend:      -> WatchSandBoxMigration ready (hijack)');
+          return;
+        }
+        respond(req, res, 'EnsureSandBox', models);
         log(`cursor-backend:      -> HIJACKED EnsureSandBox -> our box`);
         return;
       }
@@ -519,6 +1597,50 @@ export function startCursorBackend({ port = 8443, models, log = () => {} } = {})
         await handleStreamChat(req, res, body, log);
         return;
       }
+      // Telegram/"Failed to send": GetGrokBotSendStatus empty proto is
+      // UNSPECIFIED. ACCEPTED=2. WatchGrokBotUserComputerRequests is a
+      // long-lived stream — empty-ok closes it and the channel looks offline.
+      if (/GetGrokBotSendStatus/.test(full)) {
+        if (sniffOn()) {
+          const fields = decodeProtoFields(body);
+          sniffDump({ kind: 'GetGrokBotSendStatus.req', fields });
+          const upstream = /cursor\.sh$/.test(host) ? host : 'api2.cursor.sh';
+          await passthroughToRealAnthropic(req, res, body, upstream, full, log);
+          return;
+        }
+        const fields = decodeProtoFields(body);
+        const echoId = String(fields[2] || lastSendEchoId);
+        lastSendEchoId = echoId;
+        const payload = encodeGetGrokBotSendStatus(echoId);
+        const reqCt = String(req.headers['content-type'] || '');
+        if (reqCt.includes('grpc-web')) {
+          res.writeHead(200, {
+            'content-type': reqCt.includes('text') ? 'application/grpc-web-text+proto' : 'application/grpc-web+proto',
+            'grpc-status': '0', ...CORS,
+          });
+          res.end(Buffer.concat([envelope(payload), grpcWebTrailer()]));
+        } else {
+          res.writeHead(200, { 'content-type': 'application/proto', ...CORS });
+          res.end(payload);
+        }
+        log(`cursor-backend:      -> GetGrokBotSendStatus ACCEPTED echo=${echoId}`);
+        return;
+      }
+      if (/WatchGrokBotUserComputerRequests/.test(full)) {
+        if (sniffOn()) {
+          const upstream = /cursor\.sh$/.test(host) ? host : 'api2.cursor.sh';
+          await passthroughPipe(req, res, body, upstream, full, log);
+          return;
+        }
+        res.writeHead(200, {
+          'content-type': 'application/connect+proto',
+          'grpc-status': '0',
+          ...CORS,
+        });
+        req.on('close', () => { try { res.end(); } catch { /* */ } });
+        log('cursor-backend:      -> WatchGrokBotUserComputerRequests held');
+        return;
+      }
       // FULL PASSTHROUGH MODE — observe, do not stub.
       //
       // Stubbing unknown methods with empty protobufs BREAKS Grok Bot: it never