openzoo 0.50.64 → 0.50.66

package/lib/cursorbackend.js

@@ -55,6 +55,7 @@ import {
 } from './grokbotDesktop.js';
 import { startHostMcps, hostMcpTools, hostMcpHas, callHostMcp, hostMcpServers, chromeStatus, reattachChrome } from './mcpbridge.js';
 import * as ship from './ship.js';
+import * as xclaims from './xclaims.js';
 
 const TLS_DIR = path.join(os.homedir(), '.openzoo', 'cursor-tls');
 const CURSOR_HOSTS = ['api2.cursor.sh', 'api3.cursor.sh', 'api4.cursor.sh', 'repo42.cursor.sh'];
@@ -2287,6 +2288,50 @@ const LOCAL_TOOLS = [
       },
     },
   },
+  {
+    type: 'function',
+    function: {
+      name: 'x_claim',
+      description: 'X reply lock: claim a tweet (status URL or id) before drafting a reply. ok:false means another bot has it or it was already answered — pick a different tweet. Lease 20m.',
+      parameters: { type: 'object', properties: { tweet: { type: 'string' } }, required: ['tweet'] },
+    },
+  },
+  {
+    type: 'function',
+    function: {
+      name: 'x_done',
+      description: 'X reply lock: mark a claimed tweet as replied, permanently, with the URL of our reply. Also appends to openzoobot-posted.json.',
+      parameters: { type: 'object', properties: { tweet: { type: 'string' }, url: { type: 'string' }, lane: { type: 'string' } }, required: ['tweet', 'url'] },
+    },
+  },
+  {
+    type: 'function',
+    function: {
+      name: 'x_release',
+      description: 'X reply lock: give a claimed tweet back (you decided not to reply).',
+      parameters: { type: 'object', properties: { tweet: { type: 'string' } }, required: ['tweet'] },
+    },
+  },
+  {
+    type: 'function',
+    function: {
+      name: 'x_claims',
+      description: 'X reply lock: list tweet ids already answered plus live claims by other bots, so you can skip them before reading.',
+      parameters: { type: 'object', properties: {} },
+    },
+  },
+  {
+    type: 'function',
+    function: {
+      name: 'x_compose',
+      description: 'Type reply text into the X composer on the current page of the given browser, LINE BY LINE with real Enter keys so newlines survive (fill flattens them). Click/focus the reply box first (or open the tweet). Then click the Reply button yourself. browser: chrome or brave.',
+      parameters: {
+        type: 'object',
+        properties: { browser: { type: 'string', enum: ['chrome', 'brave'] }, text: { type: 'string' } },
+        required: ['browser', 'text'],
+      },
+    },
+  },
 ];
 
 export const LOCAL_TOOL_NAMES = LOCAL_TOOLS.map((t) => t.function.name);
@@ -2486,6 +2531,26 @@ async function runLocalTool(name, args, log, ctx = {}) {
     if (name.startsWith('ship_')) {
       return await runShipTool(name, args, log, ctx);
     }
+    if (name.startsWith('x_')) {
+      const me = findAgent(ctx.agentId) || { id: String(ctx.agentId || ''), name: '' };
+      if (name === 'x_claim') return JSON.stringify(xclaims.claimTweet({ tweet: args.tweet || args.url || args.id, by: me.id, name: me.name }));
+      if (name === 'x_done') return JSON.stringify(xclaims.markDone({ tweet: args.tweet || args.id, by: me.id, name: me.name, url: args.url, lane: args.lane }));
+      if (name === 'x_release') return JSON.stringify(xclaims.releaseTweet({ tweet: args.tweet || args.id, by: me.id }));
+      if (name === 'x_claims') return JSON.stringify(xclaims.listClaims());
+      if (name === 'x_compose') {
+        const server = String(args.browser || 'chrome').toLowerCase() === 'brave' ? 'brave-devtools' : 'chrome-devtools';
+        const plan = xclaims.composePlan(args.text);
+        let last = '';
+        for (const op of plan.ops) {
+          const tname = `${server}__${op.tool}`;
+          if (!hostMcpHas(tname)) return JSON.stringify({ ok: false, error: `${tname} not attached` });
+          last = String(await callHostMcp(tname, op.args));
+          if (op.tool === 'evaluate_script' && /"ok":\s*false/.test(last)) return JSON.stringify({ ok: false, error: last.slice(0, 300) });
+        }
+        log(`cursor-backend:      x_compose ${server} lines=${plan.lines}`);
+        return JSON.stringify({ ok: true, browser: server, linesTyped: plan.lines, composer: last.slice(0, 700), next: 'verify the composer text above shows separate lines, then click the Reply button' });
+      }
+    }
     if (hostMcpHas(name)) {
       return await callHostMcp(name, args);
     }
@@ -2645,7 +2710,9 @@ async function zooComplete(prompt, log, agentId, parsed = {}, opts = {}) {
             return brief ? `${who} Standing brief (persisted): ${brief}` : who;
           })(),
           `You HAVE local tools on the user's computer via ${via}.`,
-          'Tools: read_file, write_file, exec, list_dir, screenshot, click, type_text, key, ui_tree, focus_app, open_url, create_agent, set_brief, list_agents, message_agent, schedule_wakeup, cancel_wakeup, ship_crew, ship_forge, ship_launch_worker, ship_status, ship_review, ship_open_pr.',
+          'Tools: read_file, write_file, exec, list_dir, screenshot, click, type_text, key, ui_tree, focus_app, open_url, create_agent, set_brief, list_agents, message_agent, schedule_wakeup, cancel_wakeup, ship_crew, ship_forge, ship_launch_worker, ship_status, ship_review, ship_open_pr, x_claim, x_done, x_release, x_claims, x_compose.',
+          'Posting on X: NEVER fill the reply box (newlines get flattened). Open the tweet, click the reply box, then x_compose {browser, text} which types line by line with Enter, then click Reply.',
+          'X reply bots: x_claims first (skip those ids), x_claim the tweet BEFORE drafting (ok:false -> pick another), x_done with our reply URL after posting, x_release if you back out. Never reply to a tweet you did not claim.',
           'If no sidebar bot is named Firstmate and the human brings code or repo work, ask ONE question: which repo path to set up Grok Ship for. Then call ship_crew with that cwd. Do not start coding outside the factory.',
           'Grok Ship (software factory): ship_crew sets up Firstmate + a crewmate per repo. A crewmate ships with ship_launch_worker -> ship_status until pushed -> ship_review (fresh, diff-only) -> ship_open_pr only when gate.clean. Never merge; the human does.',
           (() => {
@@ -2656,10 +2723,11 @@ async function zooComplete(prompt, log, agentId, parsed = {}, opts = {}) {
               return 'Host MCP servers (Claude/Grok chrome-devtools, brave, …) are connecting. When chrome-devtools__* tools appear, use them for web pages.';
             }
             const chrome = names.filter((n) => /chrome|devtools|browser/i.test(n));
+            const brave = names.some((n) => n.startsWith('brave-devtools__'));
             return [
               `Host MCP tools from the user's local Claude/Grok config are attached (${servers.join(', ') || 'mcp'}): ${names.slice(0, 36).join(', ')}${names.length > 36 ? '…' : ''}.`,
               chrome.length
-                ? `For any web page or HTML form, use chrome-devtools tools (navigate_page / take_snapshot / fill / click). Do NOT use osascript, Quartz, Python Foundation, or AppleScript to read Brave. screenshot/click/type_text are for native Mac UI only. On heavy pages (x.com, gmail, big SPAs) take_snapshot can hang: prefer evaluate_script that returns only the text you need, or take_screenshot; a tool that times out says so — do not repeat it. Do not re-run schedule_wakeup or list_agents every turn; once is enough. Browser mode: ${chromeStatus().mode}.${chromeStatus().hint ? ` This Chrome is NOT the human's browser: a separate profile with no logins. If the human asks for their logged-in Chrome / Google / X / "the same chrome", do NOT open pages in this one and do NOT spawn anything — reply with exactly this and stop: ${chromeStatus().hint}` : ' This is the human\'s real logged-in browser; do not log out or change its settings.'}`
+                ? `For any web page or HTML form, use chrome-devtools tools (navigate_page / take_snapshot / fill / click). Do NOT use osascript, Quartz, Python Foundation, or AppleScript to read Brave. screenshot/click/type_text are for native Mac UI only. On heavy pages (x.com, gmail, big SPAs) take_snapshot can hang: prefer evaluate_script that returns only the text you need, or take_screenshot; a tool that times out says so — do not repeat it. Do not re-run schedule_wakeup or list_agents every turn; once is enough. Browser mode: ${chromeStatus().mode}.${brave ? ' A SECOND real browser is attached: brave-devtools__* tools drive the human\'s logged-in Brave the same way; use whichever your brief names.' : ''}${chromeStatus().hint ? ` This Chrome is NOT the human's browser: a separate profile with no logins. If the human asks for their logged-in Chrome / Google / X / "the same chrome", do NOT open pages in this one and do NOT spawn anything — reply with exactly this and stop: ${chromeStatus().hint}` : ' This is the human\'s real logged-in browser; do not log out or change its settings.'}`
                 : 'Use matching MCP tools instead of inventing shell one-liners.',
             ].join(' ');
           })(),

package/lib/mcpbridge.js

@@ -22,6 +22,7 @@ let started = null;
 let serversUp = [];
 let chromeCfg = null;
 let lastReattachCheck = 0;
+let lastBraveCheck = 0;
 
 export function hostMcpTools() {
   return openaiTools;
@@ -208,6 +209,19 @@ export function loadHostMcpConfigs(home = os.homedir()) {
       url: '',
     });
   }
+  // BRAVE AS A SECOND BROWSER. When Brave has flipped brave://inspect
+  // remote debugging it writes DevToolsActivePort like Chrome does; a second
+  // chrome-devtools-mcp attaches to it by --browserUrl and its tools land as
+  // brave-devtools__*. Half the X bots drive Brave, half drive Chrome.
+  const bravePort = readActivePort(path.join(home, 'Library', 'Application Support', 'BraveSoftware', 'Brave-Browser'));
+  if (bravePort && !seen.has('brave-devtools')) {
+    out.push({
+      name: 'brave-devtools',
+      command: 'npx',
+      args: ['-y', 'chrome-devtools-mcp@latest', '--browserUrl', `http://127.0.0.1:${bravePort}`],
+      url: '',
+    });
+  }
   return out;
 }
 
@@ -273,12 +287,12 @@ function readActivePort(dir) {
 }
 
 /** Pure: decide the chrome-devtools-mcp argv from what is observable. */
-export function chromeArgsFor(baseArgs, { chromePort = 0, bravePort = 0, openPorts = [] } = {}) {
+export function chromeArgsFor(baseArgs, { chromePort = 0, bravePort = 0, openPorts = [], hasOwnBraveServer = false } = {}) {
   const args = [...(baseArgs || ['-y', 'chrome-devtools-mcp@latest'])];
   const has = (flag) => args.some((a) => String(a) === flag || String(a).startsWith(`${flag}=`));
   if (has('--browserUrl') || has('--autoConnect') || has('--wsEndpoint')) return { args, mode: 'explicit', detail: '' };
   if (chromePort) { args.push('--autoConnect'); return { args, mode: 'real-chrome', detail: `Chrome DevToolsActivePort ${chromePort}` }; }
-  if (bravePort) { args.push('--browserUrl', `http://127.0.0.1:${bravePort}`); return { args, mode: 'real-brave', detail: `Brave DevToolsActivePort ${bravePort}` }; }
+  if (bravePort && !hasOwnBraveServer) { args.push('--browserUrl', `http://127.0.0.1:${bravePort}`); return { args, mode: 'real-brave', detail: `Brave DevToolsActivePort ${bravePort}` }; }
   const port = openPorts.find((n) => n === 9222 || n === 9333);
   if (port) { args.push('--browserUrl', `http://127.0.0.1:${port}`); return { args, mode: `attached:${port}`, detail: `browser listening on ${port}` }; }
   return { args, mode: 'own-profile', detail: '~/.cache/chrome-devtools-mcp/chrome-profile' };
@@ -293,7 +307,7 @@ async function chromeArgs(baseArgs, home = os.homedir()) {
   if (bravePort && !(await portOpen(bravePort))) bravePort = 0;
   const openPorts = [];
   for (const port of [9222, 9333]) if (await portOpen(port)) openPorts.push(port);
-  const got = chromeArgsFor(baseArgs, { chromePort, bravePort, openPorts });
+  const got = chromeArgsFor(baseArgs, { chromePort, bravePort, openPorts, hasOwnBraveServer: true });
   chromeMode = { mode: got.mode, detail: got.detail };
   return got.args;
 }
@@ -345,8 +359,33 @@ async function connectOne(cfg, log) {
  * chrome-devtools for one attached to their real browser, no restart.
  * Cheap (two stats) — called at the top of every zoo turn, throttled 5s.
  */
+async function ensureBraveServer(log, home) {
+  if (!started || serversUp.includes('brave-devtools')) return false;
+  const bravePort = readActivePort(path.join(home, 'Library', 'Application Support', 'BraveSoftware', 'Brave-Browser'));
+  if (!bravePort || !(await portOpen(bravePort))) return false;
+  const cfg = { name: 'brave-devtools', command: 'npx', args: ['-y', 'chrome-devtools-mcp@latest', '--browserUrl', `http://127.0.0.1:${bravePort}`], url: '' };
+  log(`cursor-backend:      mcp brave-devtools Brave appeared on ${bravePort} — attaching`);
+  try {
+    const got = await connectOne(cfg, log);
+    serversUp.push(cfg.name);
+    for (const tool of got.tools) {
+      registry.set(toolOpenaiName(cfg.name, tool.name), {
+        client: got.client, server: cfg.name, tool: tool.name, description: tool.description || tool.name, schema: tool.inputSchema,
+      });
+    }
+    rebuildOpenai();
+    log(`cursor-backend:      mcp brave-devtools attached tools=${got.tools.length}`);
+    return true;
+  } catch (e) {
+    log(`cursor-backend:      mcp brave-devtools attach FAIL ${e.message}`);
+    return false;
+  }
+}
+
 export async function reattachChrome({ log = () => {}, home = os.homedir() } = {}) {
   if (!chromeCfg || !started) return false;
+  const now0 = Date.now();
+  if (now0 - lastBraveCheck > 5000) { lastBraveCheck = now0; await ensureBraveServer(log, home); }
   if (/^(real-chrome|real-brave|explicit)$/.test(chromeMode.mode)) return false;
   const now = Date.now();
   if (now - lastReattachCheck < 5000) return false;
@@ -395,9 +434,22 @@ function rebuildOpenai() {
  * hangs must come back as an error string the model can route around.
  */
 export const MCP_CALL_TIMEOUT_MS = Math.max(10_000, Number(process.env.OZ_MCP_CALL_TIMEOUT_MS || 75_000));
+/** One browser, many bots: chrome-devtools calls run one at a time so two
+ *  turns cannot interleave select_page / click on the same Chrome. */
+const browserChains = new Map(); // server name -> promise chain (one per browser)
 export async function callHostMcp(name, args, { timeoutMs = MCP_CALL_TIMEOUT_MS } = {}) {
   const rec = registry.get(String(name || ''));
   if (!rec) throw new Error(`no mcp tool ${name}`);
+  if (/chrome|devtools|browser/i.test(rec.server)) {
+    const run = () => callHostMcpNow(name, rec, args, timeoutMs);
+    const prev = browserChains.get(rec.server) || Promise.resolve();
+    const p = prev.then(run, run);
+    browserChains.set(rec.server, p.catch(() => {}));
+    return p;
+  }
+  return callHostMcpNow(name, rec, args, timeoutMs);
+}
+async function callHostMcpNow(name, rec, args, timeoutMs) {
   let timer;
   const ceiling = new Promise((_, rej) => {
     timer = setTimeout(() => rej(new Error(`MCP tool ${name} timed out after ${Math.round(timeoutMs / 1000)}s. The page may be too heavy for that action. Use a narrower one: evaluate_script to pull the text you need, take_screenshot, or navigate_page to a lighter URL. Do not retry the same call.`)), timeoutMs);

package/lib/xclaims.js

@@ -0,0 +1,124 @@
+/**
+ * Shared tweet-id locks for the X reply bots.
+ *
+ * Thirteen bots search thirteen lanes, and lanes overlap. Before a bot spends
+ * a turn drafting a reply it CLAIMS the tweet id here; the claim is atomic
+ * on the host (one process, synchronous file write), leased for CLAIM_TTL_MS
+ * so a bot that dies mid-reply frees the tweet, and `done` makes it permanent.
+ *
+ * File: ~/.openzoo/xclaims.json  { [tweetId]: { by, name, at, until, done, url } }
+ * `done` entries are also appended to the human's ledger
+ * (~/openzoo-shim/openzoobot-posted.json) so the old "never reply twice" file
+ * keeps working for anything that reads it.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+export const CLAIM_TTL_MS = Number(process.env.OZ_XCLAIM_TTL_MS || 20 * 60_000);
+
+export function claimsPath(home = os.homedir()) {
+  return path.join(home, '.openzoo', 'xclaims.json');
+}
+
+export function tweetIdFrom(input) {
+  const s = String(input || '').trim();
+  const m = s.match(/status(?:es)?\/(\d{8,25})/) || s.match(/^(\d{8,25})$/);
+  return m ? m[1] : '';
+}
+
+export function loadClaims(home = os.homedir()) {
+  try {
+    const j = JSON.parse(fs.readFileSync(claimsPath(home), 'utf8'));
+    return j && typeof j === 'object' && !Array.isArray(j) ? j : {};
+  } catch {
+    return {};
+  }
+}
+
+export function saveClaims(home, claims) {
+  const p = claimsPath(home);
+  fs.mkdirSync(path.dirname(p), { recursive: true });
+  const tmp = `${p}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(claims, null, 2));
+  fs.renameSync(tmp, p);
+  return claims;
+}
+
+/** Atomic on the host: returns {ok:true} once per live lease, else who holds it. */
+export function claimTweet({ tweet, by, name = '', home = os.homedir(), now = Date.now(), ttlMs = CLAIM_TTL_MS } = {}) {
+  const id = tweetIdFrom(tweet);
+  if (!id) return { ok: false, error: 'no tweet id (pass the status URL or numeric id)' };
+  const claims = loadClaims(home);
+  const cur = claims[id];
+  if (cur?.done) return { ok: false, id, reason: 'already replied', by: cur.name || cur.by, url: cur.url || '' };
+  if (cur && cur.by !== by && Number(cur.until) > now) {
+    return { ok: false, id, reason: 'claimed by another bot', by: cur.name || cur.by, until: cur.until };
+  }
+  claims[id] = { by: String(by || ''), name: String(name || ''), at: now, until: now + ttlMs, done: false, url: '' };
+  saveClaims(home, claims);
+  return { ok: true, id, until: claims[id].until, renewed: !!cur };
+}
+
+export function releaseTweet({ tweet, by, home = os.homedir() } = {}) {
+  const id = tweetIdFrom(tweet);
+  const claims = loadClaims(home);
+  const cur = claims[id];
+  if (!cur) return { ok: true, id, released: false };
+  if (cur.done) return { ok: false, id, reason: 'already replied' };
+  if (cur.by !== by) return { ok: false, id, reason: 'not your claim', by: cur.name || cur.by };
+  delete claims[id];
+  saveClaims(home, claims);
+  return { ok: true, id, released: true };
+}
+
+/** Permanent. Also appends to the human's ledger so old readers still see it. */
+export function markDone({ tweet, by, name = '', url = '', lane = '', home = os.homedir(), ledgerPath, now = Date.now() } = {}) {
+  const id = tweetIdFrom(tweet);
+  if (!id) return { ok: false, error: 'no tweet id' };
+  const claims = loadClaims(home);
+  const cur = claims[id];
+  if (cur?.done && cur.by !== by) return { ok: false, id, reason: 'already replied by another bot', by: cur.name || cur.by };
+  claims[id] = { by: String(by || ''), name: String(name || cur?.name || ''), at: cur?.at || now, until: 0, done: true, url: String(url || ''), doneAt: now };
+  saveClaims(home, claims);
+  const ledger = ledgerPath || path.join(home, 'openzoo-shim', 'openzoobot-posted.json');
+  try {
+    let j = { posted: [] };
+    try { j = JSON.parse(fs.readFileSync(ledger, 'utf8')); } catch { /* fresh */ }
+    if (!Array.isArray(j.posted)) j.posted = [];
+    j.posted.push({ tweet: `https://x.com/i/status/${id}`, ours: String(url || ''), lane: String(lane || ''), by: String(name || by || ''), at: new Date(now).toISOString() });
+    fs.mkdirSync(path.dirname(ledger), { recursive: true });
+    fs.writeFileSync(ledger, JSON.stringify(j, null, 2));
+  } catch { /* the lock file is the source of truth; the ledger is a courtesy */ }
+  return { ok: true, id, url: String(url || '') };
+}
+
+/** Everything a bot needs to skip fast: done ids + live claims by others. */
+export function listClaims({ home = os.homedir(), now = Date.now() } = {}) {
+  const claims = loadClaims(home);
+  const done = [];
+  const live = [];
+  for (const [id, c] of Object.entries(claims)) {
+    if (c.done) done.push(id);
+    else if (Number(c.until) > now) live.push({ id, by: c.name || c.by, until: c.until });
+  }
+  return { done, live, total: Object.keys(claims).length };
+}
+
+/**
+ * X's composer is a Draft-style contenteditable: one `fill` flattens every
+ * newline (measured: "openzoo.fun/core" + "x402 · PAID…" fused into
+ * "corex402"). Real keystrokes work: type a line, press Enter, type the next.
+ * Pure planner — the host executes these against chrome-devtools / brave-devtools.
+ */
+export const X_COMPOSER_SELECTOR = '[data-testid="tweetTextarea_0"], [data-testid="tweetTextarea_0RichTextInputContainer"] [contenteditable="true"], div[role="textbox"][contenteditable="true"]';
+export function composePlan(text) {
+  const lines = String(text || '').replace(/\r\n?/g, '\n').split('\n');
+  const ops = [{ tool: 'evaluate_script', args: { function: `() => { const el = document.querySelector(${JSON.stringify(X_COMPOSER_SELECTOR)}); if (!el) return { ok: false, error: 'no composer on this page' }; el.focus(); return { ok: true }; }` } }];
+  lines.forEach((line, i) => {
+    if (i) ops.push({ tool: 'press_key', args: { key: 'Enter' } });
+    if (line) ops.push({ tool: 'type_text', args: { text: line } });
+  });
+  ops.push({ tool: 'evaluate_script', args: { function: `() => { const el = document.querySelector(${JSON.stringify(X_COMPOSER_SELECTOR)}); const t = el ? (el.innerText || el.textContent || '') : ''; return { ok: !!el, lines: t.split('\\n').filter(Boolean).length, text: t.slice(0, 600) }; }` } });
+  return { lines: lines.length, ops };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.50.64",
+  "version": "0.50.66",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",