openzoo 0.50.66 → 0.50.68

package/lib/cursorbackend.js

@@ -2332,6 +2332,22 @@ const LOCAL_TOOLS = [
       },
     },
   },
+  {
+    type: 'function',
+    function: {
+      name: 'x_open',
+      description: 'Open YOUR OWN tab in the given browser (chrome|brave) at a URL and pin it to you: every later chrome-devtools__/brave-devtools__ call you make is routed to that tab automatically, so other bots cannot stomp on it. Call this first, before evaluate_script/x_compose. Returns the page text length.',
+      parameters: { type: 'object', properties: { browser: { type: 'string', enum: ['chrome', 'brave'] }, url: { type: 'string' } }, required: ['browser', 'url'] },
+    },
+  },
+  {
+    type: 'function',
+    function: {
+      name: 'x_close',
+      description: 'Close the tab x_open pinned to you (do this at the end of every turn).',
+      parameters: { type: 'object', properties: { browser: { type: 'string', enum: ['chrome', 'brave'] } }, required: ['browser'] },
+    },
+  },
 ];
 
 export const LOCAL_TOOL_NAMES = LOCAL_TOOLS.map((t) => t.function.name);
@@ -2419,6 +2435,35 @@ async function deliverAgentMessage({ fromId, to, text, parsed = {}, log }) {
   }
 }
 
+
+/** agentId -> { 'chrome-devtools': pageId, 'brave-devtools': pageId }. A bot's
+ *  browser calls are preceded by select_page on its pinned tab (under the
+ *  per-browser lock) so 13 bots on one Chrome do not act on each other's tab. */
+const agentPages = new Map();
+function pinnedPage(agentId, server) { return agentPages.get(String(agentId || ''))?.[server]; }
+function pinPage(agentId, server, pageId) {
+  const m = agentPages.get(String(agentId || '')) || {};
+  if (pageId == null) delete m[server]; else m[server] = pageId;
+  agentPages.set(String(agentId || ''), m);
+}
+/** chrome-devtools-mcp prints "## Pages\n1: <url> [selected]\n2: …". */
+export function selectedPageId(text) {
+  const m = String(text || '').match(/(\d+):\s[^\n]*\[selected\]/);
+  return m ? Number(m[1]) : null;
+}
+async function callBrowserForAgent(server, tool, args, agentId) {
+  const pinned = pinnedPage(agentId, server);
+  if (pinned != null && tool === 'select_page' && Number(args?.pageId) !== Number(pinned)) {
+    // A pinned bot stays on its own tab. Answer with its tab, do not switch.
+    return callHostMcp(`${server}__select_page`, { pageId: pinned });
+  }
+  if (pinned != null && !/^(new_page|list_pages|select_page|close_page)$/.test(tool)) {
+    try { await callHostMcp(`${server}__select_page`, { pageId: pinned }); } catch { /* page gone; fall through */ }
+  }
+  const out = await callHostMcp(`${server}__${tool}`, args);
+  if (tool === 'new_page') { const pid = selectedPageId(out); if (pid != null) pinPage(agentId, server, pid); }
+  return out;
+}
 async function runLocalTool(name, args, log, ctx = {}) {
   try {
     if (name === 'read_file') {
@@ -2537,21 +2582,45 @@ async function runLocalTool(name, args, log, ctx = {}) {
       if (name === 'x_done') return JSON.stringify(xclaims.markDone({ tweet: args.tweet || args.id, by: me.id, name: me.name, url: args.url, lane: args.lane }));
       if (name === 'x_release') return JSON.stringify(xclaims.releaseTweet({ tweet: args.tweet || args.id, by: me.id }));
       if (name === 'x_claims') return JSON.stringify(xclaims.listClaims());
+      if (name === 'x_open') {
+        const server = String(args.browser || 'chrome').toLowerCase() === 'brave' ? 'brave-devtools' : 'chrome-devtools';
+        if (!hostMcpHas(`${server}__new_page`)) return JSON.stringify({ ok: false, error: `${server} not attached` });
+        const out = String(await callHostMcp(`${server}__new_page`, { url: String(args.url || 'https://x.com') }));
+        const pid = selectedPageId(out);
+        if (pid == null) return JSON.stringify({ ok: false, error: 'could not read the new page id', raw: out.slice(0, 300) });
+        pinPage(ctx.agentId, server, pid);
+        return JSON.stringify({ ok: true, browser: server, pageId: pid, note: 'pinned: your browser calls now go to this tab' });
+      }
+      if (name === 'x_close') {
+        const server = String(args.browser || 'chrome').toLowerCase() === 'brave' ? 'brave-devtools' : 'chrome-devtools';
+        const pid = pinnedPage(ctx.agentId, server);
+        if (pid == null) return JSON.stringify({ ok: true, closed: false });
+        try { await callHostMcp(`${server}__close_page`, { pageId: pid }); } catch (e) { pinPage(ctx.agentId, server, null); return JSON.stringify({ ok: false, error: e.message }); }
+        pinPage(ctx.agentId, server, null);
+        return JSON.stringify({ ok: true, closed: true, pageId: pid });
+      }
       if (name === 'x_compose') {
         const server = String(args.browser || 'chrome').toLowerCase() === 'brave' ? 'brave-devtools' : 'chrome-devtools';
-        const plan = xclaims.composePlan(args.text);
+        for (const t of ['evaluate_script', 'click_at', 'type_text', 'press_key']) {
+          if (!hostMcpHas(`${server}__${t}`)) return JSON.stringify({ ok: false, error: `${server}__${t} not attached` });
+        }
+        const probeRaw = String(await callBrowserForAgent(server, 'evaluate_script', { function: xclaims.composeProbeScript() }, ctx.agentId));
+        const probe = (() => { try { return JSON.parse(probeRaw.match(/\{[\s\S]*\}/)?.[0] || '{}'); } catch { return {}; } })();
+        if (!probe.ok) return JSON.stringify({ ok: false, error: probe.error || `composer probe failed: ${probeRaw.slice(0, 200)}` });
+        const plan = xclaims.composePlan(args.text, probe);
         let last = '';
-        for (const op of plan.ops) {
-          const tname = `${server}__${op.tool}`;
-          if (!hostMcpHas(tname)) return JSON.stringify({ ok: false, error: `${tname} not attached` });
-          last = String(await callHostMcp(tname, op.args));
-          if (op.tool === 'evaluate_script' && /"ok":\s*false/.test(last)) return JSON.stringify({ ok: false, error: last.slice(0, 300) });
+        for (const op of plan.ops) last = String(await callBrowserForAgent(server, op.tool, op.args, ctx.agentId));
+        const back = (() => { try { return JSON.parse(last.match(/\{[\s\S]*\}/)?.[0] || '{}'); } catch { return {}; } })();
+        log(`cursor-backend:      x_compose ${server} lines=${plan.lines} back=${back.lines} replyEnabled=${back.replyEnabled}`);
+        if (!back.replyEnabled) {
+          return JSON.stringify({ ok: false, browser: server, error: 'typed, but X did not register it (Reply still disabled). Click the reply box yourself with a real click (find [data-testid="tweetTextarea_0"] and use click_at on its centre), then call x_compose again.', composer: back });
         }
-        log(`cursor-backend:      x_compose ${server} lines=${plan.lines}`);
-        return JSON.stringify({ ok: true, browser: server, linesTyped: plan.lines, composer: last.slice(0, 700), next: 'verify the composer text above shows separate lines, then click the Reply button' });
+        return JSON.stringify({ ok: true, browser: server, linesTyped: plan.lines, composer: back, next: 'lines are in and Reply is enabled: click the Reply button ([data-testid="tweetButtonInline"]) now' });
       }
     }
     if (hostMcpHas(name)) {
+      const m = name.match(/^(chrome-devtools|brave-devtools)__(.+)$/);
+      if (m) return await callBrowserForAgent(m[1], m[2], args, ctx.agentId);
       return await callHostMcp(name, args);
     }
     return `unknown tool ${name}`;
@@ -2710,7 +2779,8 @@ async function zooComplete(prompt, log, agentId, parsed = {}, opts = {}) {
             return brief ? `${who} Standing brief (persisted): ${brief}` : who;
           })(),
           `You HAVE local tools on the user's computer via ${via}.`,
-          'Tools: read_file, write_file, exec, list_dir, screenshot, click, type_text, key, ui_tree, focus_app, open_url, create_agent, set_brief, list_agents, message_agent, schedule_wakeup, cancel_wakeup, ship_crew, ship_forge, ship_launch_worker, ship_status, ship_review, ship_open_pr, x_claim, x_done, x_release, x_claims, x_compose.',
+          'Tools: read_file, write_file, exec, list_dir, screenshot, click, type_text, key, ui_tree, focus_app, open_url, create_agent, set_brief, list_agents, message_agent, schedule_wakeup, cancel_wakeup, ship_crew, ship_forge, ship_launch_worker, ship_status, ship_review, ship_open_pr, x_claim, x_done, x_release, x_claims, x_compose, x_open, x_close.',
+          'Tabs: x_open {browser,url} FIRST — it pins a tab to you and every browser call you make is routed there. x_close at the end. Do not select_page other tabs.',
           'Posting on X: NEVER fill the reply box (newlines get flattened). Open the tweet, click the reply box, then x_compose {browser, text} which types line by line with Enter, then click Reply.',
           'X reply bots: x_claims first (skip those ids), x_claim the tweet BEFORE drafting (ok:false -> pick another), x_done with our reply URL after posting, x_release if you back out. Never reply to a tweet you did not claim.',
           'If no sidebar bot is named Firstmate and the human brings code or repo work, ask ONE question: which repo path to set up Grok Ship for. Then call ship_crew with that cwd. Do not start coding outside the factory.',

package/lib/mcpbridge.js

@@ -213,12 +213,12 @@ export function loadHostMcpConfigs(home = os.homedir()) {
   // remote debugging it writes DevToolsActivePort like Chrome does; a second
   // chrome-devtools-mcp attaches to it by --browserUrl and its tools land as
   // brave-devtools__*. Half the X bots drive Brave, half drive Chrome.
-  const bravePort = readActivePort(path.join(home, 'Library', 'Application Support', 'BraveSoftware', 'Brave-Browser'));
-  if (bravePort && !seen.has('brave-devtools')) {
+  const brave = readActive(path.join(home, 'Library', 'Application Support', 'BraveSoftware', 'Brave-Browser'));
+  if (brave.port && !seen.has('brave-devtools')) {
     out.push({
       name: 'brave-devtools',
       command: 'npx',
-      args: ['-y', 'chrome-devtools-mcp@latest', '--browserUrl', `http://127.0.0.1:${bravePort}`],
+      args: ['-y', 'chrome-devtools-mcp@latest', ...braveAttachArgs(brave)],
       url: '',
     });
   }
@@ -277,22 +277,32 @@ export function chromeStatus() {
 }
 
 function readActivePort(dir) {
+  return readActive(dir).port;
+}
+/** DevToolsActivePort = "<port>\n<ws path>". Chrome 144+ "Allow remote debugging"
+ *  serves ONLY that websocket path (no /json/version), so a second browser must
+ *  be attached by --wsEndpoint, not --browserUrl. */
+export function readActive(dir) {
   try {
-    const first = fs.readFileSync(path.join(dir, 'DevToolsActivePort'), 'utf8').split('\n')[0].trim();
-    const n = Number(first);
-    return Number.isFinite(n) && n > 0 ? n : 0;
+    const [first, second = ''] = fs.readFileSync(path.join(dir, 'DevToolsActivePort'), 'utf8').split('\n').map((l) => l.trim());
+    const port = Number(first);
+    if (!Number.isFinite(port) || port <= 0) return { port: 0, ws: '' };
+    return { port, ws: second.startsWith('/') ? `ws://127.0.0.1:${port}${second}` : '' };
   } catch {
-    return 0;
+    return { port: 0, ws: '' };
   }
 }
+export function braveAttachArgs({ port, ws }) {
+  return ws ? ['--wsEndpoint', ws] : ['--browserUrl', `http://127.0.0.1:${port}`];
+}
 
 /** Pure: decide the chrome-devtools-mcp argv from what is observable. */
-export function chromeArgsFor(baseArgs, { chromePort = 0, bravePort = 0, openPorts = [], hasOwnBraveServer = false } = {}) {
+export function chromeArgsFor(baseArgs, { chromePort = 0, bravePort = 0, braveWs = '', openPorts = [], hasOwnBraveServer = false } = {}) {
   const args = [...(baseArgs || ['-y', 'chrome-devtools-mcp@latest'])];
   const has = (flag) => args.some((a) => String(a) === flag || String(a).startsWith(`${flag}=`));
   if (has('--browserUrl') || has('--autoConnect') || has('--wsEndpoint')) return { args, mode: 'explicit', detail: '' };
   if (chromePort) { args.push('--autoConnect'); return { args, mode: 'real-chrome', detail: `Chrome DevToolsActivePort ${chromePort}` }; }
-  if (bravePort && !hasOwnBraveServer) { args.push('--browserUrl', `http://127.0.0.1:${bravePort}`); return { args, mode: 'real-brave', detail: `Brave DevToolsActivePort ${bravePort}` }; }
+  if (bravePort && !hasOwnBraveServer) { args.push(...braveAttachArgs({ port: bravePort, ws: braveWs })); return { args, mode: 'real-brave', detail: `Brave DevToolsActivePort ${bravePort}` }; }
   const port = openPorts.find((n) => n === 9222 || n === 9333);
   if (port) { args.push('--browserUrl', `http://127.0.0.1:${port}`); return { args, mode: `attached:${port}`, detail: `browser listening on ${port}` }; }
   return { args, mode: 'own-profile', detail: '~/.cache/chrome-devtools-mcp/chrome-profile' };
@@ -361,10 +371,11 @@ async function connectOne(cfg, log) {
  */
 async function ensureBraveServer(log, home) {
   if (!started || serversUp.includes('brave-devtools')) return false;
-  const bravePort = readActivePort(path.join(home, 'Library', 'Application Support', 'BraveSoftware', 'Brave-Browser'));
+  const brave = readActive(path.join(home, 'Library', 'Application Support', 'BraveSoftware', 'Brave-Browser'));
+  const bravePort = brave.port;
   if (!bravePort || !(await portOpen(bravePort))) return false;
-  const cfg = { name: 'brave-devtools', command: 'npx', args: ['-y', 'chrome-devtools-mcp@latest', '--browserUrl', `http://127.0.0.1:${bravePort}`], url: '' };
-  log(`cursor-backend:      mcp brave-devtools Brave appeared on ${bravePort} — attaching`);
+  const cfg = { name: 'brave-devtools', command: 'npx', args: ['-y', 'chrome-devtools-mcp@latest', ...braveAttachArgs(brave)], url: '' };
+  log(`cursor-backend:      mcp brave-devtools Brave appeared on ${bravePort} — attaching (${brave.ws ? 'wsEndpoint' : 'browserUrl'})`);
   try {
     const got = await connectOne(cfg, log);
     serversUp.push(cfg.name);

package/lib/xclaims.js

@@ -106,19 +106,27 @@ export function listClaims({ home = os.homedir(), now = Date.now() } = {}) {
 }
 
 /**
- * X's composer is a Draft-style contenteditable: one `fill` flattens every
- * newline (measured: "openzoo.fun/core" + "x402 · PAID…" fused into
- * "corex402"). Real keystrokes work: type a line, press Enter, type the next.
- * Pure planner — the host executes these against chrome-devtools / brave-devtools.
+ * X's composer is a Draft-style contenteditable. Two things measured 2026-09-01:
+ *   1. one `fill` flattens every newline ("openzoo.fun/core" + "x402 · PAID…"
+ *      fused into "corex402");
+ *   2. `el.focus()` + keyboard typing puts text in the DOM but NOT in React's
+ *      state — the Reply button stays disabled and the draft is wiped on the
+ *      next render. Only a REAL mouse click on the box initialises Draft.
+ * So: probe the box's rect, click_at its centre, type line / Enter / line,
+ * then read back both the text and whether Reply is enabled.
  */
 export const X_COMPOSER_SELECTOR = '[data-testid="tweetTextarea_0"], [data-testid="tweetTextarea_0RichTextInputContainer"] [contenteditable="true"], div[role="textbox"][contenteditable="true"]';
-export function composePlan(text) {
+export const X_REPLY_BUTTON_SELECTOR = '[data-testid="tweetButtonInline"], [data-testid="tweetButton"]';
+export const composeProbeScript = () => `() => { const el = document.querySelector(${JSON.stringify(X_COMPOSER_SELECTOR)}); if (!el) return { ok: false, error: 'no composer on this page — open the tweet and click Reply first' }; el.scrollIntoView({ block: 'center' }); const r = el.getBoundingClientRect(); return { ok: true, x: Math.round(r.left + Math.min(r.width / 2, 120)), y: Math.round(r.top + Math.min(r.height / 2, 20)), w: Math.round(r.width), h: Math.round(r.height) }; }`;
+export const composeReadbackScript = () => `() => { const el = document.querySelector(${JSON.stringify(X_COMPOSER_SELECTOR)}); const b = document.querySelector(${JSON.stringify(X_REPLY_BUTTON_SELECTOR)}); const t = el ? (el.innerText || el.textContent || '') : ''; const dis = b ? (b.disabled || b.getAttribute('aria-disabled') === 'true') : true; return { ok: !!el, lines: t.split('\\n').filter(Boolean).length, replyEnabled: !dis, text: t.slice(0, 600) }; }`;
+export function composePlan(text, rect) {
   const lines = String(text || '').replace(/\r\n?/g, '\n').split('\n');
-  const ops = [{ tool: 'evaluate_script', args: { function: `() => { const el = document.querySelector(${JSON.stringify(X_COMPOSER_SELECTOR)}); if (!el) return { ok: false, error: 'no composer on this page' }; el.focus(); return { ok: true }; }` } }];
+  const ops = [];
+  if (rect && Number.isFinite(rect.x) && Number.isFinite(rect.y)) ops.push({ tool: 'click_at', args: { x: rect.x, y: rect.y } });
   lines.forEach((line, i) => {
     if (i) ops.push({ tool: 'press_key', args: { key: 'Enter' } });
     if (line) ops.push({ tool: 'type_text', args: { text: line } });
   });
-  ops.push({ tool: 'evaluate_script', args: { function: `() => { const el = document.querySelector(${JSON.stringify(X_COMPOSER_SELECTOR)}); const t = el ? (el.innerText || el.textContent || '') : ''; return { ok: !!el, lines: t.split('\\n').filter(Boolean).length, text: t.slice(0, 600) }; }` } });
+  ops.push({ tool: 'evaluate_script', args: { function: composeReadbackScript() } });
   return { lines: lines.length, ops };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.50.66",
+  "version": "0.50.68",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",