openzoo 0.50.9 → 0.50.11

package/lib/pay.js

@@ -125,17 +125,28 @@ export function resetRailMemory() {
 
 export class PayClient {
   /**
-   * Always this machine's ~/.openzoo/wallet.json. The constructor used to take
-   * a per-user derived burner so the X bot could make each asker pay their own
-   * way; that bot is gone and nothing else ever passed one, so the override was
-   * a second wallet path with no caller and no test.
+   * This machine's ~/.openzoo/wallet.json, OR a derived burner passed in.
+   *
+   * The override was removed once with the note "that bot is gone and nothing
+   * else ever passed one" — THE BOT WAS NOT GONE. xbot.js kept calling
+   * `new PayClient(burner)`, the argument was silently swallowed, and every
+   * "asker pays" answer settled from the OPERATOR's shared wallet instead:
+   * measured live 2026-08-27 as gateway `paid_200 payer:0x640944…` (the
+   * machine EVM key) for calls the log attributed to a per-asker burner. The
+   * paid lane's entire economics ran backwards and nothing errored.
+   *
+   * A burner carries BOTH keys (Solana + EVM from one HMAC), so an override
+   * must never fall back to the machine wallet for either rail — an
+   * underfunded burner is the FUNDING REPLY path, not "bill the operator".
    */
-  constructor() {
-    const w = loadOrCreateWallet();
+  constructor(wallet) {
+    const w = wallet?.keypair ? wallet : loadOrCreateWallet();
     this.keypair = w.keypair;
-    this.evmPrivateKey = w.evmPrivateKey;
-    this.walletCreated = w.created;
-    this.walletPath = w.path;
+    // ?? null, NOT || machine key: a burner without an EVM key must fail
+    // underfunded on EVM rails rather than quietly spending the operator's.
+    this.evmPrivateKey = w.evmPrivateKey ?? null;
+    this.walletCreated = w.created ?? false;
+    this.walletPath = w.path ?? (w.xUserId ? `derived burner for X user ${w.xUserId}` : 'passed-in wallet');
     this.connection = new Connection(config.rpcUrl, 'confirmed');
     this.receipts = []; // last paid calls, newest last
     // EVERY OFFERED RAIL IS A FALLBACK, INCLUDING ROBINHOOD.
@@ -335,6 +346,11 @@ export class PayClient {
     const receipt = {
       at: new Date().toISOString(),
       line: receiptLine(accept, settle),
+      // The settle SIGNATURE as its own field, not only baked into `line`.
+      // The xbot printed a burner ADDRESS prefix in its PAID log and the
+      // operator spent an evening searching Solscan for it as a tx hash —
+      // an id a machine can log must be one a human can look up.
+      tx: settle?.transaction || settle?.txHash || settle?.signature || null,
       rail: railOf(accept),
       billedUsd: accept.extra?.billedUsd,
       directUsd: accept.extra?.directUsd,

package/lib/proxy.js

@@ -752,6 +752,25 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
         rememberSpend();
         say(`credit -> $${x.billedUsd.toFixed(6)}  ·  session $${sessionSpent.toFixed(6)}`);
       };
+      // A 402 AFTER we attempted payment is a SETTLEMENT failure, not a quote —
+      // the client-side balance check is advisory, so a wallet that looks
+      // fundable can still fail on-chain, and the gateway answers the paid
+      // retry with a fresh 402. Relaying that raw meant Claude Code printed a
+      // half-kilobyte accepts[] blob at the user instead of the one thing they
+      // need: the price, what the wallet holds, and where to send funds.
+      if (response.status === 402) {
+        let quoted = '';
+        try {
+          const q = await response.clone().json();
+          const usd = Number(q?.accepts?.[0]?.extra?.billedUsd);
+          if (Number.isFinite(usd)) quoted = ` This call needs ≈$${usd.toFixed(4)}.`;
+        } catch { /* body was not the quote after all */ }
+        jsonErr(res, 402,
+          `openzoo wallet underfunded — payment did not settle.${quoted} `
+          + `Fund it and retry: send USDC (or TOKEN/LEOS for half price) to ${client.address} on Solana, `
+          + `or USDC to ${client.evmAddress} on Base. Check with: openzoo balance`);
+        return;
+      }
       await relay(res, response, meterStreamed);
     } catch (err) {
       if (err instanceof QuoteTooHighError) {

package/lib/xbot.js

@@ -1258,7 +1258,12 @@ export async function askZooPaid(question, { burner, thread = '', maxTokens = AN
     // Same shared context as the free lane — a paid asker should recall
     // everything the bot has read, not start from an empty corpus.
     call: async (body) => (await pay.chat(body, { headers: contextId ? { 'x-hrr-context': contextId } : {} })).data,
-  });
+  }).then((result) => ({
+    ...result,
+    // Every on-chain settle signature this answer paid with, so the PAID log
+    // can print something Solscan actually finds.
+    txSigs: pay.receipts.map((r) => r.tx).filter(Boolean),
+  }));
 }
 
 /**
@@ -2604,9 +2609,19 @@ export async function runXBot({ once = false, intervalMs = POLL_MS, dryRun = fal
           // Print the SAME comparison the free lane does. This showed billed
           // alone, so a paid answer gave no way to see whether the asker beat
           // buying direct — the one thing the receipt exists to demonstrate.
-          console.error(`  ${t.id} @${t.author_id}: PAID ${burner.address.slice(0, 8)}… ${result.routedModel} ${usd(result.billedUsd)}`
+          // The tx SIGNATURE, or an explicit REPLAYED marker — never a bare
+          // "PAID" that might not have settled. The 8-char burner prefix here
+          // was read as a tx hash and hunted on Solscan for an evening; and a
+          // restart re-asking answered questions got cached 200s whose echoed
+          // receipts printed as fresh payments. Both lies die here: label the
+          // wallet as a wallet, print the settle sig when one exists, and say
+          // REPLAYED when none does.
+          const sigs = Array.isArray(result.txSigs) ? result.txSigs : [];
+          console.error(`  ${t.id} @${t.author_id}: ${sigs.length ? 'PAID' : 'REPLAYED (no new settlement)'}`
+            + ` payer ${burner.address.slice(0, 8)}… ${result.routedModel} ${usd(result.billedUsd)}`
             + (result.directUsd > 0 ? ` (direct ${usd(result.directUsd)})` : '')
-            + (result.actualUsd > 0 ? ` [cost ${usd(result.actualUsd)}]` : ''));
+            + (result.actualUsd > 0 ? ` [cost ${usd(result.actualUsd)}]` : '')
+            + (sigs.length ? `\n   tx ${sigs[sigs.length - 1]}` : ''));
           await postAndLog({ creds, text, inReplyTo: t.id, state, dryRun, tag: 'paid', conversationId: t.conversation_id });
           state.answered[t.id] = 'paid';
         } catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.50.9",
+  "version": "0.50.11",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",