openzoo 0.50.27 → 0.50.29

package/lib/cursorbackend.js

@@ -1136,6 +1136,48 @@ function gatewayEntry(e) {
   const { seq, pulledRemote, ...rest } = e;
   return rest;
 }
+
+function stripSpendFooter(s) {
+  return String(s || '').replace(/\n{2,}this call \$[\d.]+[\s\S]*$/i, '').trimEnd();
+}
+
+/** Prior turns for zooComplete. sendPrompt used to POST only the latest user
+ *  line, so the model said each thread starts blank while the UI still showed
+ *  the canvas. Skip the last user echo of `currentPrompt` (already appended). */
+function historyMessages(agentId, currentPrompt) {
+  const entries = agentTranscript(agentId).entries || [];
+  const cur = String(currentPrompt || '').trim();
+  const out = [];
+  for (const e of entries) {
+    if (!e || typeof e !== 'object') continue;
+    let role = null;
+    let text = '';
+    if (e.kind === 'send-message' || e.role === 'assistant') {
+      const m = e.message;
+      text = typeof m === 'string' ? m : String(m?.content || m?.text || '');
+      role = 'assistant';
+      text = stripSpendFooter(text);
+    } else if (e.kind === 'message' || e.role === 'user') {
+      text = String(e.content || e.message?.content || e.message?.text || '');
+      role = 'user';
+    }
+    text = String(text || '').trim();
+    if (!role || !text) continue;
+    out.push({ role, content: text });
+  }
+  while (out.length && out[out.length - 1].role === 'user' && String(out[out.length - 1].content).trim() === cur) {
+    out.pop();
+  }
+  let chars = 0;
+  const kept = [];
+  for (let i = out.length - 1; i >= 0; i--) {
+    chars += String(out[i].content).length;
+    if (chars > 80_000 && kept.length) break;
+    kept.push(out[i]);
+  }
+  kept.reverse();
+  return kept;
+}
 async function podJson(path0, bodyObj, log) {
   if (!realPod?.agent) return null;
   let agent;
@@ -1520,9 +1562,11 @@ async function zooComplete(prompt, log, agentId, parsed = {}) {
         'Never claim you lack filesystem access or local-exec. If a tool errors, report the error.',
         'After using tools you MUST still write a normal chat reply: what you did, file paths written, and what to open. Empty content is a bug.',
         'A spend footer is appended after your reply by the host — ignore it.',
+        'Prior turns of THIS Grok Bot chat are in the messages below. Do not claim the thread starts blank or that earlier questions did not arrive.',
       ].join(' '),
     },
   ];
+  for (const m of historyMessages(agentId, prompt)) messages.push(m);
   if (textFiles.length) {
     const bits = textFiles.map((a) => (
       a.error

package/lib/moonpayOnramp.js

@@ -0,0 +1,80 @@
+/**
+ * MoonPay-hosted fiat→USDC onramp for the x402 402 path.
+ *
+ * Unlike Stripe, there is no session POST: we build
+ * https://buy.moonpay.com/?apiKey=pk_…&currencyCode=usdc_sol&walletAddress=…
+ * and HMAC-SHA256 sign the query string with the secret. The dest is locked
+ * because walletAddress + currencyCode + signature are required together —
+ * the widget does not prompt for another address.
+ *
+ * Keys are NEVER in the repo: MOONPAY_PUBLISHABLE_KEY + MOONPAY_SECRET_KEY,
+ * else ~/moonpay.json `{publishableKey,secretKey}`, else ~/moonpay.pk +
+ * ~/moonpay.key. No keys → caller keeps the send-to-address copy.
+ *
+ * Do NOT set allowedIpAddress. Live IP matching would bind the URL to the
+ * shim/gateway IP; the 402 is opened on the user's machine (or phone).
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const HOME = os.homedir();
+
+function readTrim(p) {
+  try { return fs.readFileSync(p, 'utf8').trim(); } catch { return ''; }
+}
+
+export function moonpayKeys() {
+  const jsonPath = process.env.MOONPAY_KEY_FILE || path.join(HOME, 'moonpay.json');
+  let filePk = '';
+  let fileSk = '';
+  try {
+    const j = JSON.parse(fs.readFileSync(jsonPath, 'utf8'));
+    filePk = String(j.publishableKey || j.pk || j.apiKey || '').trim();
+    fileSk = String(j.secretKey || j.sk || j.secret || '').trim();
+  } catch { /* no json */ }
+  const pk = String(process.env.MOONPAY_PUBLISHABLE_KEY || process.env.MOONPAY_API_KEY || '').trim()
+    || filePk
+    || readTrim(process.env.MOONPAY_PK_FILE || path.join(HOME, 'moonpay.pk'));
+  const sk = String(process.env.MOONPAY_SECRET_KEY || '').trim()
+    || fileSk
+    || readTrim(process.env.MOONPAY_SECRET_FILE || path.join(HOME, 'moonpay.key'));
+  if (!pk || !sk) return null;
+  return { pk, sk };
+}
+
+function dollars(usd) {
+  const n = Number(usd);
+  // MoonPay USDC min is typically ~$20–30, not Stripe's $5.
+  if (!Number.isFinite(n) || n <= 0) return 30;
+  return Math.max(30, Math.ceil(n));
+}
+
+/** HMAC-SHA256 of `url.search` (includes leading `?`), then URL-encode. */
+export function signMoonPayUrl(unsignedUrl, secret) {
+  const u = new URL(unsignedUrl);
+  const signature = crypto.createHmac('sha256', secret).update(u.search).digest('base64');
+  return `${unsignedUrl}${u.search ? '&' : '?'}signature=${encodeURIComponent(signature)}`;
+}
+
+/**
+ * Signed widget URL that buys USDC on Solana into `solana`. Sync — no network.
+ * Returns null if keys are missing.
+ */
+export function moonpayUsdcOnrampLink({ solana, usd } = {}) {
+  const addr = String(solana || '').trim();
+  if (!addr) return null;
+  const keys = moonpayKeys();
+  if (!keys) return null;
+  const live = keys.pk.startsWith('pk_live_');
+  const host = live ? 'https://buy.moonpay.com' : 'https://buy-sandbox.moonpay.com';
+  const params = new URLSearchParams();
+  params.set('apiKey', keys.pk);
+  params.set('currencyCode', 'usdc_sol');
+  params.set('walletAddress', addr);
+  params.set('baseCurrencyCode', 'usd');
+  params.set('baseCurrencyAmount', String(dollars(usd)));
+  const unsigned = `${host}/?${params.toString()}`;
+  return signMoonPayUrl(unsigned, keys.sk);
+}

package/lib/proxy.js

@@ -773,7 +773,7 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
           + `or USDC to ${client.evmAddress} on Base. Check with: openzoo balance`,
           { solana: client.address, usd },
         );
-        log(msg.includes('crypto.link.com') ? 'onramp: attached crypto.link.com' : 'onramp: no hosted URL');
+        log(/ties to your account/i.test(msg) ? 'onramp: whop + copy-paste solana' : 'onramp: no fund blurb');
         jsonErr(res, 402, msg);
         return;
       }

package/lib/stripeOnramp.js

@@ -12,6 +12,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
+
 const STRIPE_VERSION = '2026-06-24.dahlia';
 const TTL_MS = 10 * 60 * 1000;
 const cache = new Map(); // key -> { url, at }
@@ -83,10 +84,29 @@ export async function stripeUsdcOnrampLink({ solana, usd } = {}) {
   }
 }
 
+const DEFAULT_WHOP_CHECKOUT = 'https://whop.com/staccoverflow/openzoo';
+
+/** Whop product / checkout. OPENZOO_WHOP_CHECKOUT overrides the default product URL. */
+export function whopBuyUrl() {
+  return String(process.env.OPENZOO_WHOP_CHECKOUT || process.env.OPENZOO_WHOP_URL || DEFAULT_WHOP_CHECKOUT).trim();
+}
+
+export function whopFundBlurb(solana) {
+  const addr = String(solana || '').trim();
+  if (!addr) return '';
+  const url = whopBuyUrl();
+  return [
+    `Hey — buy this: ${url}`,
+    '',
+    'Copy-paste THIS Solana address into "what is your Solana address?" so it ties to your account:',
+    addr,
+  ].join('\n');
+}
+
 export async function withOnrampLink(text, dest) {
-  const url = await stripeUsdcOnrampLink(dest);
   const body = String(text || '').trim();
-  if (!url) return body;
-  if (body.includes(url) || /crypto\.link\.com/i.test(body)) return body;
-  return `Buy USDC: ${url}\n\n${body}`;
+  const blurb = whopFundBlurb(dest?.solana);
+  if (!blurb) return body;
+  if (/ties to your account/i.test(body) && body.includes(String(dest.solana))) return body;
+  return `${blurb}\n\n${body}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.50.27",
+  "version": "0.50.29",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",