openzoo 0.50.39 → 0.50.41

package/lib/cursorbackend.js

@@ -46,6 +46,9 @@ import { prefixVisitorRichText } from './grokbotweb.js';
 import {
   ingestUpload, lookupUpload, readUploadChunk, readUploadImage, readUploadText,
 } from './grokbotUploads.js';
+import {
+  desktopAction, displayBounds, imageSize, noteShotMeta, resolveAppName,
+} from './grokbotDesktop.js';
 
 const TLS_DIR = path.join(os.homedir(), '.openzoo', 'cursor-tls');
 const CURSOR_HOSTS = ['api2.cursor.sh', 'api3.cursor.sh', 'api4.cursor.sh', 'repo42.cursor.sh'];
@@ -1129,12 +1132,102 @@ function appendLine(agentId, role, text, extra = {}) {
       timestampMs: ts,
       requestId,
       ...(extra.author && typeof extra.author === 'object' ? { author: extra.author } : {}),
+      ...(extra.ephemeral ? { ephemeral: true } : {}),
     };
   }
   t.entries.push(e);
   saveTranscripts();
   return e;
 }
+
+/** One zooComplete per agent. A new sendPrompt (or Stop) aborts the previous
+ *  loop so "try again" does not stack 32-step exec storms with an empty canvas. */
+export function createZooTurnQueue() {
+  const inflight = new Map();
+  return {
+    begin(agentId, nonce) {
+      const id = String(agentId || '');
+      const prev = inflight.get(id);
+      if (prev && prev.nonce !== nonce) {
+        try { prev.abort.abort(new Error('superseded')); } catch { /* */ }
+      }
+      const abort = new AbortController();
+      inflight.set(id, { nonce, abort });
+      return abort;
+    },
+    isCurrent(agentId, nonce) {
+      return inflight.get(String(agentId || ''))?.nonce === nonce;
+    },
+    end(agentId, nonce) {
+      const id = String(agentId || '');
+      const cur = inflight.get(id);
+      if (cur && cur.nonce === nonce) inflight.delete(id);
+    },
+    abort(agentId) {
+      const id = String(agentId || '');
+      const prev = inflight.get(id);
+      if (!prev) return 0;
+      try { prev.abort.abort(new Error('interrupted')); } catch { /* */ }
+      inflight.delete(id);
+      return 1;
+    },
+  };
+}
+const zooTurns = createZooTurnQueue();
+
+export function formatZooProgress({ step, maxSteps, names, command } = {}) {
+  const tools = Array.isArray(names) ? names.filter(Boolean).join(', ') : String(names || 'tools');
+  const cmd = command ? ` ${JSON.stringify(String(command).slice(0, 80))}` : '';
+  return `Working on your Mac (step ${Number(step) + 1}/${maxSteps || '?'}): ${tools}${cmd}`;
+}
+
+/** One canvas line per tool. Asar ingest is append-only — mutating a working
+ *  bubble is still silence. Keep it short; the model history skips ephemeral. */
+export function formatZooToolLine({ name, args = {}, result } = {}) {
+  const detail = args.command || args.path || args.name || args.window
+    || args.query || args.url || args.key || args.app
+    || (args.x != null && args.y != null ? `${args.x},${args.y}` : '')
+    || (args.text != null ? String(args.text).slice(0, 80) : '');
+  const head = detail
+    ? `${name} ${JSON.stringify(String(detail).slice(0, 90))}`
+    : String(name || 'tool');
+  let tail = String(result || '').replace(/\s+/g, ' ').trim();
+  if (tail.startsWith('{')) {
+    try {
+      const o = JSON.parse(String(result));
+      if (o && typeof o === 'object') {
+        tail = [o.path, o.id, o.name, o.bytes != null ? `${o.bytes}b` : '', o.ok === true ? 'ok' : '']
+          .filter(Boolean).join(' ') || tail;
+      }
+    } catch { /* raw */ }
+  }
+  tail = tail.slice(0, 160);
+  return `→ ${head}${tail ? `\n${tail}` : ''}`;
+}
+
+export function combinedAbortSignal(a, b) {
+  if (!a) return b;
+  if (!b) return a;
+  if (typeof AbortSignal.any === 'function') return AbortSignal.any([a, b]);
+  const c = new AbortController();
+  const on = () => { try { c.abort(); } catch { /* */ } };
+  if (a.aborted || b.aborted) { on(); return c.signal; }
+  a.addEventListener('abort', on, { once: true });
+  b.addEventListener('abort', on, { once: true });
+  return c.signal;
+}
+
+export function isSupersededError(e) {
+  const m = String(e?.message || e || '');
+  return /superseded|interrupted/i.test(m);
+}
+
+function paintChatUpdate(agentId, note, extra = {}) {
+  const line = fanoutLine(agentId, 'assistant', note, { ...extra, ephemeral: true });
+  ssePush('transcript', { ...gatewayEntry(line), agentId });
+  bumpAgent(agentId, { preview: note, notify: false });
+  return line;
+}
 function fanoutLine(primaryId, role, text, extra = {}) {
   // Only the addressed agent. Writing to every tailedAgents id mixed canvases
   // so a new/empty chat showed someone else's thread.
@@ -1254,7 +1347,7 @@ function mergeAgentLists(remote) {
   return sortAgentsByActivity(out);
 }
 function gatewayEntry(e) {
-  const { seq, pulledRemote, promptRaw, ...rest } = e;
+  const { seq, pulledRemote, promptRaw, ephemeral, ...rest } = e;
   return rest;
 }
 
@@ -1286,6 +1379,7 @@ function historyMessages(agentId, currentPrompt) {
     if (!e || typeof e !== 'object') continue;
     let role = null;
     let text = '';
+    if (e.ephemeral) continue;
     if (e.kind === 'send-message' || e.role === 'assistant' || e.kind === 'assistant') {
       text = entryPlainText(e.message ?? e.content ?? e.text);
       role = 'assistant';
@@ -1513,6 +1607,11 @@ const MODEL_ALIASES = {
   grok: 'x-ai/grok-4.6',
   'grok-4': 'x-ai/grok-4.6',
   'grok-4.6': 'x-ai/grok-4.6',
+  glm: 'zai-org/glm-5.3-flash',
+  'glm-5': 'zai-org/glm-5.3-flash',
+  'glm-5.3': 'zai-org/glm-5.3-flash',
+  'glm-5.3-flash': 'zai-org/glm-5.3-flash',
+  flash: 'zai-org/glm-5.3-flash',
 };
 function resolveModelId(raw) {
   const s = String(raw || '').trim();
@@ -1525,7 +1624,7 @@ function resolveModelId(raw) {
 function currentModel(agentId) {
   return agentModels.get(agentId)
     || process.env.OPENZOO_DEFAULT_MODEL
-    || 'x-ai/grok-4.6';
+    || 'zai-org/glm-5.3-flash';
 }
 
 const execFileAsync = promisify(execFile);
@@ -1622,9 +1721,10 @@ async function execLocal(command, cwd, log) {
     return `${out}${err}`.trim() || `(exit ${got.exitCode ?? 0})`;
   }
   log(`cursor-backend:      exec cwd=${dir} ${JSON.stringify(String(command).slice(0, 80))}`);
+  const execMs = Math.min(180000, Math.max(15000, Number(process.env.OPENZOO_EXEC_TIMEOUT_MS || 90000)));
   const { stdout, stderr } = await execFileAsync('/bin/zsh', ['-lc', command], {
     cwd: dir,
-    timeout: 30000,
+    timeout: execMs,
     maxBuffer: 2 * 1024 * 1024,
     env: process.env,
   });
@@ -1672,8 +1772,169 @@ const LOCAL_TOOLS = [
       parameters: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'] },
     },
   },
+  {
+    type: 'function',
+    function: {
+      name: 'screenshot',
+      description: 'Capture the Mac display and attach the image. Returns screen.width/height in POINTS for click x,y. Screenshot first, then click/type, then screenshot again to confirm. Do not guess at a form you have not seen this turn.',
+      parameters: {
+        type: 'object',
+        properties: {
+          window: { type: 'string', description: 'Optional window title substring; default is the full display.' },
+        },
+      },
+    },
+  },
+  {
+    type: 'function',
+    function: {
+      name: 'click',
+      description: 'Click the Mac UI. Prefer query (AX title/button text like "Submit" or "Complete form"). Or x,y in SCREEN POINTS from screenshot.screen (not image pixels). Use image_x/image_y if you measured the attached screenshot. This is how you fill and submit browser forms.',
+      parameters: {
+        type: 'object',
+        properties: {
+          x: { type: 'number' },
+          y: { type: 'number' },
+          image_x: { type: 'number', description: 'X in the attached screenshot pixels; mapped via last screenshot.' },
+          image_y: { type: 'number' },
+          query: { type: 'string', description: 'Visible name: Submit, Complete form, Compose, …' },
+          app: { type: 'string', description: 'Brave Browser, Brave, Grok Bot, …' },
+          button: { type: 'string', enum: ['left', 'right'] },
+          double: { type: 'boolean' },
+        },
+      },
+    },
+  },
+  {
+    type: 'function',
+    function: {
+      name: 'type_text',
+      description: 'Type into the focused field. Click the field first. Long text is pasted. Use this to fill form inputs.',
+      parameters: {
+        type: 'object',
+        properties: {
+          text: { type: 'string' },
+          paste: { type: 'boolean' },
+          app: { type: 'string' },
+        },
+        required: ['text'],
+      },
+    },
+  },
+  {
+    type: 'function',
+    function: {
+      name: 'key',
+      description: 'Press a key. enter/return submits, tab moves fields, escape cancels. cmd+l focuses the URL bar.',
+      parameters: {
+        type: 'object',
+        properties: {
+          key: { type: 'string', description: 'enter, tab, escape, space, a letter, or a named key' },
+          cmd: { type: 'boolean' },
+          alt: { type: 'boolean' },
+          shift: { type: 'boolean' },
+          ctrl: { type: 'boolean' },
+          app: { type: 'string' },
+        },
+        required: ['key'],
+      },
+    },
+  },
+  {
+    type: 'function',
+    function: {
+      name: 'ui_tree',
+      description: 'Dump clickable AX controls of the front window (or app) with screen x,y. Use to find Submit/text fields when the screenshot is ambiguous.',
+      parameters: {
+        type: 'object',
+        properties: {
+          app: { type: 'string' },
+          limit: { type: 'number' },
+        },
+      },
+    },
+  },
+  {
+    type: 'function',
+    function: {
+      name: 'focus_app',
+      description: 'Bring an app to the front. Use "Brave Browser" before clicking Gmail/Stripe.',
+      parameters: {
+        type: 'object',
+        properties: { app: { type: 'string' } },
+        required: ['app'],
+      },
+    },
+  },
+  {
+    type: 'function',
+    function: {
+      name: 'open_url',
+      description: 'Open an http(s) URL in Brave (or app). Prefer this over guessing at the address bar.',
+      parameters: {
+        type: 'object',
+        properties: {
+          url: { type: 'string' },
+          app: { type: 'string' },
+        },
+        required: ['url'],
+      },
+    },
+  },
+  {
+    type: 'function',
+    function: {
+      name: 'create_agent',
+      description: 'Mint another Grok Bot in the sidebar. Use this when asked to spawn bots — talking about spawning is not enough.',
+      parameters: {
+        type: 'object',
+        properties: {
+          name: { type: 'string', description: 'Sidebar label for the new bot.' },
+          select: { type: 'boolean', description: 'If true (default), switch the UI to the new bot.' },
+        },
+        required: ['name'],
+      },
+    },
+  },
 ];
 
+export const LOCAL_TOOL_NAMES = LOCAL_TOOLS.map((t) => t.function.name);
+
+async function captureScreenshot(log) {
+  const dir = path.join(os.tmpdir(), 'openzoo-screens');
+  fs.mkdirSync(dir, { recursive: true });
+  const stamp = Date.now();
+  const raw = path.join(dir, `oz-${stamp}.png`);
+  const jpg = path.join(dir, `oz-${stamp}.jpg`);
+  await execFileAsync('screencapture', ['-x', '-C', raw], { timeout: 15000 });
+  if (!fs.existsSync(raw) || fs.statSync(raw).size < 80) {
+    throw new Error('screencapture wrote nothing — Screen Recording permission may be off for Grok Bot / Terminal');
+  }
+  let screen = { width: 0, height: 0 };
+  try { screen = await displayBounds(); } catch (e) {
+    log(`cursor-backend:      displayBounds failed: ${e.message}`);
+  }
+  let out = { path: raw, mime: 'image/png', buf: fs.readFileSync(raw) };
+  try {
+    await execFileAsync('sips', [
+      '-Z', '1400', '-s', 'format', 'jpeg', '-s', 'formatOptions', '70',
+      raw, '--out', jpg,
+    ], { timeout: 15000 });
+    if (fs.existsSync(jpg) && fs.statSync(jpg).size > 80) {
+      out = { path: jpg, mime: 'image/jpeg', buf: fs.readFileSync(jpg) };
+    }
+  } catch (e) {
+    log(`cursor-backend:      sips screenshot resize failed: ${e.message}`);
+  }
+  let image = { width: 0, height: 0 };
+  try { image = await imageSize(out.path); } catch (e) {
+    log(`cursor-backend:      imageSize failed: ${e.message}`);
+  }
+  const meta = { path: out.path, mime: out.mime, buf: out.buf, screen, image };
+  noteShotMeta({ screen, image, path: out.path });
+  return meta;
+}
+
 async function runLocalTool(name, args, log) {
   try {
     if (name === 'read_file') {
@@ -1697,6 +1958,51 @@ async function runLocalTool(name, args, log) {
     if (name === 'exec') {
       return await execLocal(String(args.command || ''), args.cwd, log);
     }
+    if (name === 'screenshot') {
+      const shot = await captureScreenshot(log);
+      return JSON.stringify({
+        ok: true,
+        path: shot.path,
+        mime: shot.mime,
+        bytes: shot.buf.length,
+        screen: shot.screen,
+        image: shot.image,
+        click: 'x,y are SCREEN points (screenshot.screen). Or pass image_x,image_y from this image. Prefer click query="Submit".',
+        dataUrl: `data:${shot.mime};base64,${shot.buf.toString('base64')}`,
+      });
+    }
+    if (name === 'click') {
+      const got = await desktopAction('click', args, log);
+      return JSON.stringify(got);
+    }
+    if (name === 'type_text') {
+      const got = await desktopAction('type', args, log);
+      return JSON.stringify(got);
+    }
+    if (name === 'key') {
+      const got = await desktopAction('key', args, log);
+      return JSON.stringify(got);
+    }
+    if (name === 'ui_tree') {
+      const got = await desktopAction('tree', args, log);
+      return JSON.stringify(got);
+    }
+    if (name === 'focus_app') {
+      const got = await desktopAction('focus', { app: resolveAppName(args.app) }, log);
+      return JSON.stringify(got);
+    }
+    if (name === 'open_url') {
+      const got = await desktopAction('open_url', args, log);
+      return JSON.stringify(got);
+    }
+    if (name === 'create_agent') {
+      const agent = mintLocalAgent({
+        name: String(args.name || args.title || 'New Bot').slice(0, 80),
+      });
+      pushCreatedAgent(agent, { select: args.select !== false });
+      log(`cursor-backend:      create_agent tool id=${agent.id} name=${JSON.stringify(agent.name)}`);
+      return JSON.stringify({ ok: true, id: agent.id, name: agent.name });
+    }
     return `unknown tool ${name}`;
   } catch (e) {
     return `ERROR ${e.message}`;
@@ -1718,7 +2024,7 @@ function zooTextFromMessage(msg, data) {
   return '';
 }
 
-async function zooComplete(prompt, log, agentId, parsed = {}) {
+async function zooComplete(prompt, log, agentId, parsed = {}, opts = {}) {
   const model = currentModel(agentId);
   const helper = localExecSse.size > 0;
   const visitor = visitorFromSend(parsed);
@@ -1726,8 +2032,12 @@ async function zooComplete(prompt, log, agentId, parsed = {}) {
   const spoken = visitor && !/^You are /.test(String(prompt || ''))
     ? labeledVisitorPrompt(visitor, prompt)
     : prompt;
+  const throwIfAborted = () => {
+    if (opts.signal?.aborted) throw new Error('superseded');
+  };
   await ensureTranscriptHydrated(agentId, log);
   log(`cursor-backend:      zoo POST :8402 model=${model} helper=${helper ? localExecSse.size : 0} hist=${historyMessages(agentId, spoken).length}${chatOnly ? ` visitor=${visitor.shortname} chat-only` : ''} ${JSON.stringify((spoken || '').slice(0, 60))}`);
+  if (typeof opts.onProgress === 'function') opts.onProgress('Working on your Mac…');
 
   const images = [];
   const textFiles = [];
@@ -1783,10 +2093,14 @@ async function zooComplete(prompt, log, agentId, parsed = {}) {
         : [
           `You are ${model} served through openzoo inside Grok Bot.`,
           `You HAVE local tools on the user's computer via ${via}.`,
-          'Tools: read_file, write_file, exec, list_dir. USE THEM. Write files to disk instead of pasting giant HTML into chat.',
+          'Tools: read_file, write_file, exec, list_dir, screenshot, click, type_text, key, ui_tree, focus_app, open_url, create_agent.',
+          'create_agent mints a new Grok Bot in the sidebar. When asked to spawn bots, call it — do not only describe spawning.',
+          'You CAN click the Mac and fill/submit browser forms. That is required when the user asks. Do not write a markdown briefing instead of clicking. Do not tell the user to click.',
+          'Form loop: focus_app Brave Browser → screenshot → click the field (query or x,y) → type_text → screenshot to confirm → click Submit / key enter. screenshot.screen is click coordinate space. Prefer click query="Submit".',
+          'screenshot captures the display and attaches the image. For any on-screen form, dashboard, or click target, screenshot first this turn. Do not guess at UI you have not seen.',
           'Pasted images arrive as attachments — you can see them when present. Do not claim you cannot see images if they are in this turn.',
           'Never claim you lack filesystem access or local-exec. If a tool errors, report the error.',
-          'After using tools you MUST still write a normal chat reply: what you did, file paths written, and what to open. Empty content is a bug.',
+          'After using tools you MUST still write a normal chat reply: what you did, file paths written, and what to open. Empty content is a bug. A new user message cancels this turn — leave a visible reply before that happens.',
           'Do not stop mid-task. Do not write "Stopped on research", "nothing to open yet", "no app files written this turn", or "say go again". Keep using tools until the files the user asked for exist on disk THIS turn. Summarize only after those writes succeed.',
           'A spend footer is appended after your reply by the host — ignore it.',
           'Prior turns of THIS Grok Bot chat are in the messages below. Do not claim the thread starts blank or that earlier questions did not arrive.',
@@ -1823,12 +2137,13 @@ async function zooComplete(prompt, log, agentId, parsed = {}) {
   const usedTools = [];
   const KEEP_GOING = 'Do not stop. Do not wait for another message. Write the files to disk now with write_file / exec. Keep going until the requested paths exist. A summary is only allowed after the files are written.';
   const zooPost = async (payload) => {
+    throwIfAborted();
     const ms = Number(process.env.OPENZOO_ASK_TIMEOUT_MS || 10 * 60_000);
     const post = () => fetch('http://127.0.0.1:8402/v1/chat/completions', {
       method: 'POST',
       headers: { 'content-type': 'application/json', authorization: 'Bearer sk-openzoo' },
       body: JSON.stringify(payload),
-      signal: AbortSignal.timeout(ms),
+      signal: combinedAbortSignal(opts.signal, AbortSignal.timeout(ms)),
     });
     let r;
     let lastErr;
@@ -1872,7 +2187,9 @@ async function zooComplete(prompt, log, agentId, parsed = {}) {
     return { r, data };
   };
   let keepGoingNudge = 0;
+  const pendingVision = [];
   for (let step = 0; step < maxSteps; step++) {
+    throwIfAborted();
     const payload = { model, messages, max_tokens: maxTok };
     if (!chatOnly) {
       payload.tools = LOCAL_TOOLS;
@@ -1896,25 +2213,49 @@ async function zooComplete(prompt, log, agentId, parsed = {}) {
         }
         continue;
       }
-      log(`cursor-backend:      zoo tools step=${step} n=${calls.length} ${calls.map((c) => c.function?.name || c.name).join(',')}`);
+      const names = calls.map((c) => c.function?.name || c.name);
+      log(`cursor-backend:      zoo tools step=${step} n=${calls.length} ${names.join(',')}`);
       messages.push(msg);
       for (const c of calls) {
+        throwIfAborted();
         let args = {};
         try { args = JSON.parse(c.function?.arguments || c.arguments || '{}'); } catch { args = {}; }
         const name = c.function?.name || c.name || '';
-        const result = await runLocalTool(name, args, log);
+        let result = await runLocalTool(name, args, log);
+        if (name === 'screenshot') {
+          try {
+            const shot = JSON.parse(result);
+            if (shot?.dataUrl) {
+              pendingVision.push({ path: shot.path, dataUrl: shot.dataUrl });
+              result = `screenshot ${shot.path} ${shot.bytes}b — image attached, look at it before acting`;
+            }
+          } catch { /* keep raw */ }
+        }
         usedTools.push({
           name,
           path: args.path,
           command: args.command ? String(args.command).slice(0, 120) : undefined,
           note: String(result).slice(0, 200),
         });
+        if (typeof opts.onProgress === 'function') {
+          opts.onProgress(formatZooToolLine({ name, args, result }));
+        }
         messages.push({
           role: 'tool',
           tool_call_id: c.id,
           content: String(result).slice(0, 120000),
         });
       }
+      if (pendingVision.length) {
+        messages.push({
+          role: 'user',
+          content: [
+            ...pendingVision.map((img) => ({ type: 'image_url', image_url: { url: img.dataUrl } })),
+            { type: 'text', text: pendingVision.map((img) => `screenshot: ${img.path}`).join('\n') },
+          ],
+        });
+        pendingVision.length = 0;
+      }
       continue;
     }
     text = zooTextFromMessage(msg, data);
@@ -2081,7 +2422,7 @@ async function handleHijackedPodHttp(req, res, full, body, log) {
     'getBotTemplateExportPolicy', 'getTeachRecordingStatus', 'isGlobalSearchEnabled',
     'isEgressTunnelAvailable', 'listBoxMcpServers',
     'setWindowFocused', 'getAgentAutomations',
-    'interruptAgentRun', 'requestDiskSaverAudit',
+    'requestDiskSaverAudit',
     'setAgentUnread', 'setAgentHiddenFromSidebar', 'setAgentNotificationsEnabled',
     'setAgentNotifyOnUpdates', 'setAgentAvatarBytes', 'getAgentAvatar',
   ]);
@@ -2100,6 +2441,15 @@ async function handleHijackedPodHttp(req, res, full, body, log) {
     log(`cursor-backend:      createAgent local id=${agent.id} name=${JSON.stringify(agent.name)}`);
     return true;
   }
+  if (name === 'interruptAgentRun') {
+    let parsed = {};
+    try { parsed = JSON.parse(String(body || '{}')); } catch { parsed = {}; }
+    const id = String(parsed.id || parsed.agentId || focusedAgentId || '');
+    const n = id ? zooTurns.abort(id) : 0;
+    jsonSend(res, { ok: true, interrupted: n, id });
+    log(`cursor-backend:      interruptAgentRun id=${id || '?'} n=${n}`);
+    return true;
+  }
   if (name === 'kickstartAgent') {
     let parsed = {};
     try { parsed = JSON.parse(String(body || '{}')); } catch { parsed = {}; }
@@ -2262,6 +2612,7 @@ async function handleHijackedPodHttp(req, res, full, body, log) {
     log(`cursor-backend:      >> sendPrompt agent=${agentId} keys=${Object.keys(parsed).join(',')} attachments=${attN}${visitor ? ` visitor=${visitor.shortname}` : ''} prompt=${JSON.stringify((prompt || '').slice(0, 80))}`);
     lastSendEchoId = String(nonce);
     jsonSend(res, { accepted: true });
+    const turn = zooTurns.begin(agentId, nonce);
     const userLine = fanoutLine(agentId, 'user', uiText, {
       clientNonce: nonce,
       requestId: nonce,
@@ -2275,12 +2626,13 @@ async function handleHijackedPodHttp(req, res, full, body, log) {
     setImmediate(async () => {
       let text = '';
       let grouped = false;
+      const stillCurrent = () => zooTurns.isCurrent(agentId, nonce) && !turn.signal.aborted;
       try {
         if (modelCmd) {
           const want = modelCmd[1];
           if (!want) {
             const cur = currentModel(agentId);
-            text = `current model: ${cur}\nset with /model fable | opus | sonnet | grok | provider/id`;
+            text = `current model: ${cur}\nset with /model fable | opus | sonnet | grok | glm | provider/id`;
           } else {
             const id = resolveModelId(want) || (want.includes('/') ? want : null);
             if (!id) {
@@ -2298,15 +2650,31 @@ async function handleHijackedPodHttp(req, res, full, body, log) {
             grouped = true;
             await runGroupQueue({ agentId, humanPrompt: prompt, parsed, nonce, log });
           } else {
-            const z = await zooComplete(prompt, log, agentId, parsed);
+            const z = await zooComplete(prompt, log, agentId, parsed, {
+              signal: turn.signal,
+              onProgress: (note) => {
+                if (!stillCurrent()) return;
+                paintChatUpdate(agentId, note, { clientNonce: nonce, requestId: nonce });
+              },
+            });
             text = z.text;
           }
         }
       } catch (e) {
+        if (!stillCurrent() || isSupersededError(e)) {
+          log(`cursor-backend:      sendPrompt superseded agent=${agentId} nonce=${nonce} ${e.message}`);
+          zooTurns.end(agentId, nonce);
+          return;
+        }
         grouped = false;
         text = `openzoo error: ${e.message}`;
         log(`cursor-backend:      sendPrompt zoo failed: ${e.message}`);
       }
+      if (!stillCurrent()) {
+        zooTurns.end(agentId, nonce);
+        log(`cursor-backend:      sendPrompt dropped stale agent=${agentId} nonce=${nonce}`);
+        return;
+      }
       if (!grouped) {
         const line = fanoutLine(agentId, 'assistant', text, { clientNonce: nonce, requestId: nonce });
         ssePush('transcript', { ...gatewayEntry(line), agentId });
@@ -2315,6 +2683,7 @@ async function handleHijackedPodHttp(req, res, full, body, log) {
       } else {
         log(`cursor-backend:      sendPrompt group done agent=${agentId}`);
       }
+      zooTurns.end(agentId, nonce);
     });
     return true;
   }

package/lib/grokbotDesktop.js

@@ -0,0 +1,95 @@
+/**
+ * Drive the Mac UI from Grok Bot tools: click, type, key, AX dump.
+ * JXA + CGEvent (no cliclick). Needs Accessibility for the node process
+ * that runs `openzoo bot` (Terminal / iTerm / Grok).
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import fs from 'node:fs';
+
+const execFileAsync = promisify(execFile);
+const JXA_PATH = path.join(path.dirname(fileURLToPath(import.meta.url)), 'grokbotDesktop.jxa');
+
+const APP_ALIASES = {
+  brave: 'Brave Browser',
+  chrome: 'Google Chrome',
+  safari: 'Safari',
+  grok: 'Grok Bot',
+  finder: 'Finder',
+};
+
+export function resolveAppName(raw) {
+  const s = String(raw || '').trim();
+  if (!s) return '';
+  const hit = APP_ALIASES[s.toLowerCase()];
+  return hit || s;
+}
+
+export function mapImageClick(imageX, imageY, meta) {
+  const iw = Number(meta?.image?.width) || 0;
+  const ih = Number(meta?.image?.height) || 0;
+  const sw = Number(meta?.screen?.width) || 0;
+  const sh = Number(meta?.screen?.height) || 0;
+  if (!iw || !ih || !sw || !sh) return null;
+  return {
+    x: Math.round((Number(imageX) / iw) * sw),
+    y: Math.round((Number(imageY) / ih) * sh),
+  };
+}
+
+let lastShotMeta = null;
+export function noteShotMeta(meta) {
+  lastShotMeta = meta && typeof meta === 'object' ? meta : null;
+  return lastShotMeta;
+}
+export function lastShot() {
+  return lastShotMeta;
+}
+
+export async function displayBounds() {
+  const { stdout } = await execFileAsync('osascript', [
+    '-e',
+    'tell application "Finder" to get bounds of window of desktop',
+  ], { timeout: 8000 });
+  const n = String(stdout).match(/-?\d+/g)?.map(Number) || [];
+  const [x0, y0, x1, y1] = n;
+  if (![x0, y0, x1, y1].every(Number.isFinite)) {
+    throw new Error(`bad display bounds: ${stdout.trim()}`);
+  }
+  return { x: x0, y: y0, width: x1 - x0, height: y1 - y0 };
+}
+
+export async function imageSize(p) {
+  const { stdout } = await execFileAsync('sips', ['-g', 'pixelWidth', '-g', 'pixelHeight', p], { timeout: 8000 });
+  const w = Number(String(stdout).match(/pixelWidth:\s*(\d+)/)?.[1]);
+  const h = Number(String(stdout).match(/pixelHeight:\s*(\d+)/)?.[1]);
+  if (!w || !h) throw new Error(`sips no size for ${p}`);
+  return { width: w, height: h };
+}
+
+export async function desktopAction(op, args = {}, log = () => {}) {
+  if (!fs.existsSync(JXA_PATH)) throw new Error(`missing ${JXA_PATH}`);
+  const payload = { op: String(op || ''), ...args };
+  if (payload.app) payload.app = resolveAppName(payload.app);
+  if (payload.image_x != null || payload.imageX != null) {
+    const mapped = mapImageClick(payload.image_x ?? payload.imageX, payload.image_y ?? payload.imageY, lastShotMeta);
+    if (mapped) {
+      payload.x = mapped.x;
+      payload.y = mapped.y;
+      payload.mappedFromImage = true;
+    }
+  }
+  log(`cursor-backend:      desktop ${payload.op} ${JSON.stringify({
+    x: payload.x, y: payload.y, query: payload.query, key: payload.key, app: payload.app,
+    n: payload.text ? String(payload.text).length : undefined,
+  })}`);
+  const { stdout, stderr } = await execFileAsync('osascript', [
+    '-l', 'JavaScript', JXA_PATH, JSON.stringify(payload),
+  ], { timeout: 20000, maxBuffer: 2 * 1024 * 1024 });
+  const raw = String(stdout || '').trim() || String(stderr || '').trim();
+  try { return JSON.parse(raw); } catch {
+    return { ok: false, error: raw || 'empty jxa' };
+  }
+}

package/lib/grokbotDesktop.jxa

@@ -0,0 +1,204 @@
+#!/usr/bin/osascript -l JavaScript
+// Grok Bot desktop driver. argv[0] is a JSON payload {op, ...}.
+ObjC.import('Cocoa');
+ObjC.import('CoreGraphics');
+
+function run(argv) {
+  var a = {};
+  try { a = JSON.parse(argv[0] || '{}'); } catch (e) {
+    return JSON.stringify({ ok: false, error: 'bad json: ' + e.message });
+  }
+  try {
+    return JSON.stringify(dispatch(a));
+  } catch (e) {
+    return JSON.stringify({ ok: false, error: String(e.message || e) });
+  }
+}
+
+function dispatch(a) {
+  var op = String(a.op || '');
+  if (op === 'bounds') return bounds();
+  if (op === 'focus') return focusApp(a.app);
+  if (op === 'click') return click(a);
+  if (op === 'type') return typeText(a);
+  if (op === 'key') return keyPress(a);
+  if (op === 'tree') return uiTree(a);
+  if (op === 'open_url') return openUrl(a);
+  throw new Error('unknown op ' + op);
+}
+
+function bounds() {
+  var f = $.NSScreen.mainScreen.frame;
+  // Cocoa origin is bottom-left; width/height are points (not retina pixels).
+  return {
+    ok: true,
+    width: f.size.width,
+    height: f.size.height,
+    x: f.origin.x,
+    y: f.origin.y,
+  };
+}
+
+function focusApp(name) {
+  name = String(name || '').trim();
+  if (!name) throw new Error('app required');
+  var app = Application(name);
+  app.activate();
+  delay(0.25);
+  return { ok: true, app: name };
+}
+
+function click(a) {
+  if (a.app) focusApp(a.app);
+  if (a.query) {
+    var hit = findQuery(a.query, a.app);
+    if (!hit) throw new Error('no AX match for ' + a.query);
+    a.x = hit.x + Math.floor((hit.w || 8) / 2);
+    a.y = hit.y + Math.floor((hit.h || 8) / 2);
+    a.matched = hit.title || hit.role;
+  }
+  var x = Number(a.x);
+  var y = Number(a.y);
+  if (!isFinite(x) || !isFinite(y)) throw new Error('click needs x,y or query');
+  // CGEvent uses top-left origin in global display points — same as AX position.
+  var pt = $.CGPointMake(x, y);
+  var move = $.CGEventCreateMouseEvent(null, $.kCGEventMouseMoved, pt, 0);
+  $.CGEventPost($.kCGHIDEventTap, move);
+  delay(0.04);
+  var btn = String(a.button || 'left') === 'right' ? $.kCGMouseButtonRight : $.kCGMouseButtonLeft;
+  var downType = btn === $.kCGMouseButtonRight ? $.kCGEventRightMouseDown : $.kCGEventLeftMouseDown;
+  var upType = btn === $.kCGMouseButtonRight ? $.kCGEventRightMouseUp : $.kCGEventLeftMouseUp;
+  var down = $.CGEventCreateMouseEvent(null, downType, pt, btn);
+  var up = $.CGEventCreateMouseEvent(null, upType, pt, btn);
+  $.CGEventPost($.kCGHIDEventTap, down);
+  delay(0.03);
+  $.CGEventPost($.kCGHIDEventTap, up);
+  if (a.double) {
+    delay(0.05);
+    $.CGEventPost($.kCGHIDEventTap, down);
+    delay(0.03);
+    $.CGEventPost($.kCGHIDEventTap, up);
+  }
+  return { ok: true, x: x, y: y, matched: a.matched || null, mappedFromImage: !!a.mappedFromImage };
+}
+
+function typeText(a) {
+  if (a.app) focusApp(a.app);
+  var text = String(a.text == null ? '' : a.text);
+  if (!text) throw new Error('text required');
+  var se = Application('System Events');
+  var paste = a.paste === true || (a.paste !== false && text.length > 20);
+  if (paste) {
+    var app = Application.currentApplication();
+    app.includeStandardAdditions = true;
+    app.setTheClipboardTo(text);
+    delay(0.05);
+    se.keystroke('v', { using: 'command down' });
+    return { ok: true, method: 'paste', n: text.length };
+  }
+  se.keystroke(text);
+  return { ok: true, method: 'keystroke', n: text.length };
+}
+
+var KEYCODES = {
+  enter: 36, return: 36, tab: 48, escape: 53, esc: 53, space: 49,
+  delete: 51, backspace: 51, up: 126, down: 125, left: 123, right: 124,
+};
+
+function keyPress(a) {
+  if (a.app) focusApp(a.app);
+  var key = String(a.key || '').toLowerCase();
+  if (!key) throw new Error('key required');
+  var using = [];
+  if (a.cmd || a.command || a.meta) using.push('command down');
+  if (a.alt || a.option) using.push('option down');
+  if (a.shift) using.push('shift down');
+  if (a.ctrl || a.control) using.push('control down');
+  var se = Application('System Events');
+  var opts = using.length ? { using: using } : {};
+  var code = KEYCODES[key];
+  if (code != null) se.keyCode(code, opts);
+  else se.keystroke(key.length === 1 ? key : key.charAt(0), opts);
+  return { ok: true, key: key, mods: using };
+}
+
+function openUrl(a) {
+  var url = String(a.url || a.href || '').trim();
+  if (!/^https?:\/\//i.test(url)) throw new Error('url must be http(s)');
+  var appName = resolveBrave(a.app);
+  var app = Application(appName);
+  app.activate();
+  delay(0.2);
+  try {
+    app.windows[0].activeTab.url = url;
+  } catch (e) {
+    app.openLocation(url);
+  }
+  return { ok: true, app: appName, url: url };
+}
+
+function resolveBrave(name) {
+  name = String(name || 'Brave Browser');
+  if (/brave/i.test(name)) return 'Brave Browser';
+  return name;
+}
+
+function uiTree(a) {
+  var se = Application('System Events');
+  var proc;
+  if (a.app) {
+    proc = se.processes.byName(String(a.app));
+  } else {
+    proc = se.processes.whose({ frontmost: true })[0];
+  }
+  var limit = Math.min(120, Math.max(10, Number(a.limit) || 60));
+  var rows = [];
+  var win;
+  try { win = proc.windows[0]; } catch (e) { throw new Error('no window for ' + (a.app || 'front app')); }
+  function walk(el, depth) {
+    if (rows.length >= limit || depth > 10) return;
+    var role = '', title = '', val = '', pos = null, size = null;
+    try { role = String(el.role()); } catch (e) {}
+    try { title = String(el.title() || el.description() || el.name() || ''); } catch (e) {}
+    try {
+      var v = el.value();
+      val = v == null ? '' : String(v);
+    } catch (e) {}
+    try { pos = el.position(); } catch (e) {}
+    try { size = el.size(); } catch (e) {}
+    var interesting = /button|text|field|link|check|pop|menu|tab|combo|scroll|heading|web/i.test(role + ' ' + title);
+    if (interesting && (title || val || /button|field|link|check/i.test(role))) {
+      rows.push({
+        role: role,
+        title: title.slice(0, 80),
+        value: val.slice(0, 80),
+        x: pos ? pos[0] : null,
+        y: pos ? pos[1] : null,
+        w: size ? size[0] : null,
+        h: size ? size[1] : null,
+      });
+    }
+    var kids = [];
+    try { kids = el.uiElements(); } catch (e) { return; }
+    for (var i = 0; i < kids.length; i++) walk(kids[i], depth + 1);
+  }
+  walk(win, 0);
+  var title = '';
+  try { title = String(win.title()); } catch (e) {}
+  var pname = '';
+  try { pname = String(proc.name()); } catch (e) {}
+  return { ok: true, app: pname, window: title, n: rows.length, rows: rows };
+}
+
+function findQuery(q, app) {
+  var tree = uiTree({ app: app, limit: 120 });
+  var want = String(q || '').toLowerCase();
+  if (!want) return null;
+  var rows = tree.rows || [];
+  for (var i = 0; i < rows.length; i++) {
+    var r = rows[i];
+    var blob = ((r.title || '') + ' ' + (r.value || '') + ' ' + (r.role || '')).toLowerCase();
+    if (blob.indexOf(want) >= 0 && r.x != null && r.y != null) return r;
+  }
+  return null;
+}

package/lib/grokbotweb-shim.js

@@ -143,7 +143,7 @@
     autoUpdateWhenIdleOptIn: false,
     autoUpdateWhenIdleGateEnabled: false,
   };
-  const DEFAULT_MODEL = { modelId: 'x-ai/grok-4.6', maxMode: true, parameters: [] };
+  const DEFAULT_MODEL = { modelId: 'zai-org/glm-5.3-flash', maxMode: true, parameters: [] };
   let defaultModel = DEFAULT_MODEL;
   try {
     const raw = localStorage.getItem('sand.p.default-model');
@@ -300,7 +300,7 @@
       setComputerUseModel: async () => null,
       getAvailableModels: async () => ({
         models: [
-          { modelId: 'x-ai/grok-4.6', maxMode: true, parameters: [] },
+          { modelId: 'zai-org/glm-5.3-flash', maxMode: true, parameters: [] },
           { modelId: 'x-ai/grok-4.5', maxMode: true, parameters: [] },
         ],
       }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.50.39",
+  "version": "0.50.41",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",