openzoo 0.50.93 → 0.50.95

package/bin/claude-zoo.js

@@ -6,7 +6,7 @@
  * the local openzoo proxy on :8402 (x402 per-call payment, no Anthropic
  * subscription, no login):
  *
- *   - starts the proxy if it is not already THIS version on :8402 (steals stale)
+ *   - starts the proxy if it is not already listening
  *   - applies claudeZooEnv(): ANTHROPIC_BASE_URL=localhost:PORT/v1,
  *     AUTH_TOKEN=sk-openzoo, ANTHROPIC_API_KEY deleted, compaction disabled
  *     (the proxy binds the prefix), 1M-token ceiling restored
@@ -16,8 +16,7 @@
  * `claude-code-cli` (same directory, symlinked to occ).
  */
 import { spawn } from 'node:child_process';
-import { existsSync, readdirSync as fsReaddir, readFileSync } from 'node:fs';
-import { execSync } from 'node:child_process';
+import { existsSync, readdirSync as fsReaddir } from 'node:fs';
 import { homedir, platform } from 'node:os';
 import { dirname, join, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -51,34 +50,10 @@ if (!occ) {
 const PROXY_PORT = Number(process.env.OPENZOO_PROXY_PORT || 8402);
 const PROXY_URL = `http://localhost:${PROXY_PORT}/v1`;
 
-function mineVersion() {
-  try {
-    return JSON.parse(readFileSync(join(shimRoot, 'package.json'), 'utf8')).version;
-  } catch { return ''; }
-}
-
-function stealPort(port) {
-  const n = Number(port);
-  for (const cmd of [
-    `lsof -t -iTCP:${n} -sTCP:LISTEN | xargs kill -9`,
-    `fuser -k ${n}/tcp`,
-  ]) {
-    try { execSync(cmd, { stdio: 'ignore', timeout: 2000, shell: true }); } catch { /* missing */ }
-  }
-}
-
 async function proxyUp() {
   try {
     const r = await fetch(`http://localhost:${PROXY_PORT}/v1/info`, { signal: AbortSignal.timeout(1500) });
-    if (!r.ok) return false;
-    const j = await r.json().catch(() => ({}));
-    const mine = mineVersion();
-    if (mine && String(j.version || '') !== mine) {
-      console.error(`claude: stale proxy v${j.version || '?'} on :${PROXY_PORT} — stealing for v${mine}`);
-      stealPort(PROXY_PORT);
-      return false;
-    }
-    return true;
+    return r.ok;
   } catch { return false; }
 }
 

package/bin/openzoo.js

@@ -330,7 +330,7 @@ async function main() {
     }
     case 'ask': {
       const question = process.argv[3];
-      if (!question) throw new Error('usage: openzoo ask "<question>" [--context <id>] [--model <id>] [--system <text>]');
+      if (!question) throw new Error('usage: openzoo ask "<question>" [--context <id>] [--model <id>] [--system <text>] [--web [--web-results N]]');
       const ci = process.argv.indexOf('--context');
       const mi = process.argv.indexOf('--model');
       // A BARE QUESTION IS A DIFFERENT PRODUCT FROM A BRIEFED ONE.
@@ -344,7 +344,20 @@ async function main() {
       // DHH, Hyprland and theming. Same gateway, same product, one had context.
       // A caller that knows where it is running can now say so.
       const si = process.argv.indexOf('--system');
-      const system = si !== -1 ? process.argv[si + 1] : '';
+      let system = si !== -1 ? process.argv[si + 1] : '';
+      // --web: a keyless DuckDuckGo search, top results injected into THIS
+      // call's system prompt. The x402 rail strips OpenRouter's `plugins`
+      // field, so search-then-inject has to happen here, on the caller's
+      // side. EGRESS: the question text goes to duckduckgo.com. Also on with
+      // OPENZOO_ASK_WEB=1; --web-results N caps the count (default 5).
+      const wantWeb = process.argv.includes('--web') || process.env.OPENZOO_ASK_WEB === '1';
+      if (wantWeb) {
+        const wi = process.argv.indexOf('--web-results');
+        const n = wi !== -1 ? Number(process.argv[wi + 1]) || 5 : 5;
+        const { webSearch, formatWebResults } = await import('../lib/websearch.js');
+        const hits = await webSearch(question, n).catch((e) => { console.error(`web search failed: ${e.message}`); return []; });
+        if (hits.length) system = (system ? system + '\n\n' : '') + formatWebResults(question, hits);
+      }
       const { PayClient } = await import('../lib/pay.js');
       const { config } = await import('../lib/config.js');
       const client = new PayClient();
@@ -389,6 +402,17 @@ async function main() {
     case '-h':
       console.log(HELP);
       break;
+    case 'version':
+    case '--version':
+    case '-v':
+    case '-V': {
+      // Every installer, mise shim and shell script that probes a CLI asks
+      // this first; answering "unknown command" to it failed real installs.
+      const { readFileSync } = await import('fs');
+      const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+      console.log(pkg.version);
+      break;
+    }
     default:
       console.error(`unknown command: ${cmd}\n`);
       console.log(HELP);

package/lib/aoe.js

@@ -287,15 +287,9 @@ export async function setupAoe(argv = []) {
 
   const base = `http://localhost:${config.port}/v1`;
   if (!flags.has('--no-proxy')) {
-    const { oursOn, packageVersion, killListen } = await import('./proxy.js');
-    if (await oursOn(config.port)) {
-      console.error(`openzoo: proxy v${packageVersion()} already on ${base}`);
+    if (await proxyUp(base)) {
+      console.error(`openzoo: proxy already up on ${base}`);
     } else {
-      if (await proxyUp(base)) {
-        console.error(`openzoo: stale proxy on ${base} — stealing :${config.port}`);
-        killListen(config.port);
-        await new Promise((r) => setTimeout(r, 400));
-      }
       const { pid, logPath } = startDetachedProxy({ tunnel: flags.has('--tunnel') });
       let up = false;
       for (let i = 0; i < 40 && !up; i++) {

package/lib/cursorbackend.js

@@ -3075,22 +3075,17 @@ async function zooComplete(prompt, log, agentId, parsed = {}, opts = {}) {
     if (r.status === 402) {
       const raw = zooTextFromMessage(data?.choices?.[0]?.message, data)
         || data?.error?.message
-        || 'openzoo payment required (HTTP 402).';
-      data.error = data.error || {};
-      data.error.message = raw;
+        || 'openzoo wallet underfunded.';
       try {
-        const { withOnrampLink, isFundInstruction } = await import('./stripeOnramp.js');
-        // Settle/upstream 402s keep the real message. Whop copy-paste only
-        // when this is a genuine empty-wallet / fund-me instruction.
-        if (isFundInstruction(raw)) {
-          const { loadOrCreateWallet } = await import('./wallet.js');
-          const w = loadOrCreateWallet();
-          const usd = Number(String(raw).match(/≈\$([0-9.]+)/)?.[1]);
-          data.error.message = await withOnrampLink(raw, {
-            solana: w.keypair.publicKey.toBase58(),
-            usd,
-          });
-        }
+        const { withOnrampLink } = await import('./stripeOnramp.js');
+        const { loadOrCreateWallet } = await import('./wallet.js');
+        const w = loadOrCreateWallet();
+        const usd = Number(String(raw).match(/≈\$([0-9.]+)/)?.[1]);
+        data.error = data.error || {};
+        data.error.message = await withOnrampLink(raw, {
+          solana: w.keypair.publicKey.toBase58(),
+          usd,
+        });
       } catch { /* keep proxy copy */ }
     }
     return { r, data };

package/lib/launch.js

@@ -164,7 +164,30 @@ export function claudeZooEnv(baseEnv = process.env, { base, port } = {}) {
   // Correct here for the same reason as everything else in this block: the
   // proxy binds the prefix and forwards a bounded tail, so the request that
   // leaves this machine stays small no matter how long the conversation runs.
-  if (baseEnv.OPENZOO_KEEP_COMPACT !== '1') {
+  //
+  // OPT-IN NOW, BECAUSE THE PRECONDITION IS NOT REAL.
+  //
+  // Everything above is correct ONLY IF something bounds the body that leaves
+  // this machine. Two comments here named that something — `spillTranscript`,
+  // and the knobs `OPENZOO_TAIL_MAX_CHARS` / `OPENZOO_KEEP_TAIL_MSGS`. None of
+  // the three exists: `grep -rn spillTranscript` matches nothing but these
+  // comments, in this package and in the gateway. Checked 2026-09-03.
+  //
+  // So the shipped behaviour was: compaction off, ceiling raised to 1M, and
+  // NOTHING trimming the transcript — Claude Code accumulates without limit and
+  // re-sends the whole thing every turn. The gateway's leCore cannot rescue it
+  // either: an agent body is few-and-huge, so `msgs.length <= KEEP_TAIL` leaves
+  // nothing "older than the live window", and what bulk there is sits in the
+  // system block and first user turn, both deliberately never spilled.
+  //
+  // MEASURED on a user's session: 20 calls, $13.86, `spilled 0/20`, 1.0159x vs
+  // direct — paying almost exactly retail to send an ever-growing transcript.
+  //
+  // Until a real bound ships, default to Claude Code's own behaviour, which is
+  // bounded and known-good. OPENZOO_UNBOUNDED_CONTEXT=1 restores the old
+  // settings for anyone who wants them back.
+  const unboundedContext = baseEnv.OPENZOO_UNBOUNDED_CONTEXT === '1';
+  if (unboundedContext && baseEnv.OPENZOO_KEEP_COMPACT !== '1') {
     env.DISABLE_COMPACT = baseEnv.DISABLE_COMPACT || '1';
     env.DISABLE_AUTO_COMPACT = baseEnv.DISABLE_AUTO_COMPACT || '1';
   }
@@ -177,9 +200,9 @@ export function claudeZooEnv(baseEnv = process.env, { base, port } = {}) {
   // sent. Disabling auto-compact WITHOUT raising this made it worse: it used to
   // compact and carry on, and instead it just stopped.
   //
-  // Safe only because spillTranscript is real: OPENZOO_TAIL_MAX_CHARS bounds what
-  // leaves this machine however long the conversation gets.
-  if (baseEnv.OPENZOO_KEEP_COMPACT !== '1' && !baseEnv.CLAUDE_CODE_MAX_CONTEXT_TOKENS) {
+  // WAS justified by `spillTranscript` / OPENZOO_TAIL_MAX_CHARS — neither of
+  // which exists. Now gated behind OPENZOO_UNBOUNDED_CONTEXT; see below.
+  if (unboundedContext && baseEnv.OPENZOO_KEEP_COMPACT !== '1' && !baseEnv.CLAUDE_CODE_MAX_CONTEXT_TOKENS) {
     env.CLAUDE_CODE_MAX_CONTEXT_TOKENS = baseEnv.OPENZOO_CLAUDE_CONTEXT_TOKENS || '1000000';
   }
   return env;
@@ -190,21 +213,18 @@ export function claudeZooEnv(baseEnv = process.env, { base, port } = {}) {
  * DEFAULT is the desktop app; `--terminal` (or `-t`) runs the Claude Code CLI.
  * Both get ANTHROPIC_BASE_URL so inference pays x402.
  */
-
-
 export async function launchClaude(argv) {
-  // NEVER hop. :8402 is the product. startProxy steals a stale listener.
+  // let, not const: startProxy can heal onto a different port and every URL
+  // below must follow the port we actually bound.
   let base = `http://localhost:${config.port}/v1`;
-  // AUTO-START THE PROXY. One command should just work — if nothing is listening
-  // (or a leftover npx cache is), boot THIS version on :8402 in this process.
+  // AUTO-START THE PROXY. One command should just work — if nothing is listening,
+  // boot the proxy in THIS process (it stays alive because claude runs in the
+  // foreground below), rather than making the user run `npx openzoo` first.
   let up = false;
-  const { startProxy, oursOn, packageVersion } = await import('./proxy.js');
-  const mine = packageVersion();
-  if (await oursOn(config.port)) {
-    up = true;
-  } else {
-    process.stderr.write(`openzoo: claiming :${config.port} for v${mine}\n`);
-  }
+  // /info, not /models — see the poll below. "Is a proxy already listening" must
+  // not be answered by an endpoint that needs the gateway, or a user whose
+  // upstream is flaky gets told to start a proxy that is already running.
+  try { up = (await fetch(`${base}/info`, { signal: AbortSignal.timeout(3000) })).ok; } catch { up = false; }
   if (!up) {
     // NEVER GO SILENT DURING STARTUP. silent:true routes the proxy's own lines
     // to ~/.openzoo/proxy.log so payment receipts cannot corrupt Claude Code's
@@ -221,6 +241,7 @@ export async function launchClaude(argv) {
     tick.unref?.();
     const done = (msg) => { clearInterval(tick); process.stderr.write(`\r\x1b[2Kopenzoo: ${msg}\n`); };
     try {
+      const { startProxy } = await import('./proxy.js');
       await startProxy({ silent: true, autoTunnel: true });
     } catch (err) {
       // An exception here used to surface as an eternal spinner. Say what broke.
@@ -229,6 +250,9 @@ export async function launchClaude(argv) {
       console.error('  try: OPENZOO_NO_TUNNEL=1 npx openzoo claude   (skips the cloudflared download)');
       process.exit(1);
     }
+    // The proxy may have healed onto a different port (8402 busy). config.port
+    // is the one it ACTUALLY bound, so re-derive every URL from it — the old
+    // code kept polling the port it wished for and timed out on a live proxy.
     base = `http://localhost:${config.port}/v1`;
     // PROBE /v1/info, NOT /v1/models. `models` is PROXIED UPSTREAM, so on a
     // network with a bad path to the gateway the local proxy is listening and
@@ -360,7 +384,15 @@ export async function launchClaude(argv) {
         // side by side is the only way the markup is visible while it is happening.
         + 'const ac=j.actual||{};'
         + 'const real=(ac.calls>0)?("  \\u00b7 $"+Number(ac.upstreamUsd||0).toFixed(4)+" real"+(ac.markupX?(" ("+ac.markupX+"x)"):"")):"";'
-        + 'process.stdout.write("\\x1b[38;5;208m\\u25cf\\x1b[0m openzoo  $"+(Number(j.spendUsd)||0).toFixed(4)+"  "+(j.paidCalls||0)+" call"+((j.paidCalls||0)===1?"":"s")+save+real+spill+cr+"  \\u00b7 x402")}'
+        // TWO NUMBERS, NEVER ONE. `spent` is cumulative across every session on
+        // this machine (restored from ~/.openzoo/session.json); `wallet` is what
+        // is left to pay with. Shown unlabelled, the first was read as the
+        // second — "$13.86" on screen while the wallet held $0.18 and every call
+        // 402'd underfunded. The words `spent` and `wallet` are the whole fix.
+        + 'const wu=Number(j.walletUsd);'
+        + 'const wcol=(!isFinite(wu)||wu<=0)?"\\x1b[31m":(wu<0.5?"\\x1b[33m":"\\x1b[90m");'
+        + 'const wal=isFinite(wu)?("  \\u00b7 "+wcol+"wallet $"+wu.toFixed(2)+"\\x1b[0m"):"";'
+        + 'process.stdout.write("\\x1b[38;5;208m\\u25cf\\x1b[0m openzoo  spent $"+(Number(j.spendUsd)||0).toFixed(4)+" all-time"+wal+"  \\u00b7 "+(j.paidCalls||0)+" call"+((j.paidCalls||0)===1?"":"s")+save+real+spill+cr+"  \\u00b7 x402")}'
         + 'catch{process.stdout.write("\\x1b[38;5;208m\\u25cf\\x1b[0m openzoo  \\u00b7 x402")}})\'\n');
       fs.chmodSync(scriptPath, 0o755);
       const settingsPath = path.join(os.homedir(), '.claude', 'settings.json');
@@ -579,12 +611,17 @@ export async function launchClaude(argv) {
 }
 
 export async function launchHarness(cmd, args) {
-  let base = `http://localhost:${config.port}/v1`;
-  const { startProxy, oursOn, packageVersion } = await import('./proxy.js');
-  if (!(await oursOn(config.port))) {
-    process.stderr.write(`openzoo: claiming :${config.port} for v${packageVersion()}\n`);
-    await startProxy({ silent: true, autoTunnel: true });
-    base = `http://localhost:${config.port}/v1`;
+  const base = `http://localhost:${config.port}/v1`;
+  // Fail early with a clear message rather than letting the harness spew
+  // connection errors — the #1 support question would otherwise be "why won't
+  // claude connect" when the answer is "the proxy isn't up".
+  try {
+    const r = await fetch(`${base}/models`, { signal: AbortSignal.timeout(4000) });
+    if (!r.ok) throw new Error(String(r.status));
+  } catch {
+    console.error(`openzoo: no proxy reachable at ${base}`);
+    console.error('start it first in another terminal:  npx openzoo');
+    process.exit(1);
   }
 
   const env = claudeZooEnv(process.env, { base });

package/lib/models.js

@@ -168,9 +168,39 @@ const tokensOf = (id) => id.toLowerCase().split(/[^a-z0-9.]+/).filter((t) => t &
  * the id is already servable (no rewrite), otherwise the closest zoo id.
  * OPENZOO_DEFAULT_MODEL is an explicit user override, not a fallback tier.
  */
+/**
+ * UNOPENROUTER. OpenRouter is not an upstream any more (gateway, 2026-09-02):
+ * every completion is bought from an x402 door, and doors publish BARE ids
+ * (`grok-4.3`, `claude-sonnet-5`, `gemini-2.5-flash`). A harness that still
+ * sends the OpenRouter spelling (`x-ai/grok-4.3`, `anthropic/claude-sonnet-5`)
+ * is rewritten to the bare id whenever the live catalog serves that bare id.
+ *
+ *   OPENZOO_UNOPENROUTER=1  strip the vendor prefix ALWAYS, catalog or not
+ *   OPENZOO_UNOPENROUTER=0  never strip
+ *   unset                   strip when the bare id is in the catalog
+ *
+ * Router aliases and `openzoo-` twins are never touched: their slash is not a
+ * vendor.
+ */
+export function unopenrouter(requested, ids) {
+  const mode = process.env.OPENZOO_UNOPENROUTER;
+  if (mode === '0') return null;
+  const s = String(requested || '');
+  if (!s || isAutoModel(s) || /^openzoo[-/]/i.test(s)) return null;
+  const slash = s.indexOf('/');
+  if (slash <= 0) return null;
+  const bare = s.slice(slash + 1);
+  if (!bare || bare.includes('/')) return null;
+  if (mode === '1') return bare;
+  return Array.isArray(ids) && ids.includes(bare) ? bare : null;
+}
+
 export function resolveModel(requested, ids) {
   // Virtual router id — never family-match, never steal via OPENZOO_DEFAULT_MODEL.
   if (isAutoModel(requested)) return null;
+  // Vendor-prefixed OpenRouter spelling → the bare id the doors serve.
+  const bareVendor = unopenrouter(requested, ids);
+  if (bareVendor) return bareVendor;
   // Bare Anthropic / Claude Code ids are never live on Fly/OpenRouter
   // (`claude-opus-5` → 500 unknown model). Rewrite even on a catalog miss
   // or if a gateway row lists the bare name — the request must not leave

package/lib/ozSpendChip.js

@@ -14,7 +14,7 @@ import { spendChipLabel } from './spendProof.js';
 
 export const GROKBOT_CDP_PORT = Number(process.env.OZ_GROKBOT_CDP_PORT || 9444);
 
-/** Session totals for the always-on HUD pill. Message chips still fold the footer. */
+/** Session totals for a floating pill when the open canvas has no footer. */
 export function sessionSpendLabel(home = os.homedir()) {
   try {
     const s = JSON.parse(fs.readFileSync(path.join(home, '.openzoo', 'session.json'), 'utf8'));
@@ -159,9 +159,7 @@ function ozEnsureSpendCss() {
   }
   s.textContent = [
     '.oz-spend{margin:.55rem 0 0;font-size:12px;color:inherit;opacity:.82;max-width:36em}',
-    '#oz-spend-hud{opacity:1}',
-    '#oz-spend-hud>summary{cursor:grab;background:rgba(28,28,30,.94);color:#f4f4f5;',
-    'border-color:rgba(255,255,255,.28);box-shadow:0 1px 8px rgba(0,0,0,.35)}',
+    '#oz-spend-float>summary{cursor:grab}',
     '.oz-spend>summary{cursor:help;list-style:none;display:inline-flex;align-items:center;gap:.35rem;',
     'padding:3px 9px;border-radius:999px;border:1px solid rgba(255,255,255,.18);white-space:nowrap;',
     'max-width:100%;overflow:hidden;text-overflow:ellipsis}',
@@ -215,19 +213,11 @@ export function stripSpendFromText(s) {
   return t;
 }
 
-function ozInComposer(el) {
-  if (!el) return false;
-  if (el.tagName === 'TEXTAREA' || el.tagName === 'INPUT' || el.isContentEditable) return true;
-  return !!(el.closest && el.closest('textarea, input, [contenteditable="true"]'));
-}
-
 function ozBlankSpendIn(root) {
-  if (ozInComposer(root)) return;
   const w = document.createTreeWalker(root, NodeFilter.SHOW_TEXT, null);
   while (w.nextNode()) {
     const tn = w.currentNode;
     if (tn.parentElement && tn.parentElement.closest && tn.parentElement.closest('.oz-spend')) continue;
-    if (ozInComposer(tn.parentElement)) continue;
     const next = stripSpendFromText(tn.nodeValue || '');
     if (next !== tn.nodeValue) tn.nodeValue = next;
   }
@@ -238,7 +228,6 @@ function ozHideSpendLeftovers() {
   for (let i = 0; i < nodes.length; i += 1) {
     const el = nodes[i];
     if (el.closest && el.closest('.oz-spend')) continue;
-    if (ozInComposer(el)) continue;
     if (el.querySelector && el.querySelector('.oz-spend')) continue;
     const vis = ozVisibleSpendText(el);
     if (!spendOnlyText(vis)) continue;
@@ -301,11 +290,10 @@ function ozCollapseSpend() {
   for (let i = 0; i < nodes.length; i += 1) {
     const el = nodes[i];
     if (el.closest && el.closest('.oz-spend')) continue;
-    if (ozInComposer(el)) continue;
     const t = ozVisibleSpendText(el);
     if (!/::oz-spend::|this call \$|spent \$/i.test(t)) continue;
     const host = ozSpendHost(el);
-    if (!host || seen.has(host) || ozInComposer(host)) continue;
+    if (!host || seen.has(host)) continue;
     seen.add(host);
     hosts.push(host);
   }
@@ -314,11 +302,10 @@ function ozCollapseSpend() {
     const vis = ozVisibleSpendText(host);
     const split = splitSpendText(vis);
     if (!split || !split.body || split.body.length < 12) continue;
-    if (split.summary) window.__OZ_SPEND_LAST__ = split.summary;
     ozEnsureSpendCss();
     if (spendOnlyText(vis)) {
       const prev = ozPreviousMessageCard(host);
-      if (prev && prev !== host && !ozInComposer(prev)) {
+      if (prev && prev !== host) {
         ozAttachSpendChip(prev, split);
         host.setAttribute('data-oz-spend-hide', '1');
         continue;
@@ -331,46 +318,18 @@ function ozCollapseSpend() {
   ozEnsureFloatSpend();
 }
 
-/** Live HUD label: latest folded chip, then a read-only canvas scan, then inject snapshot. */
-function ozFloatLabel() {
-  const pills = document.querySelectorAll('.oz-spend:not(#oz-spend-hud):not(#oz-spend-float) summary');
-  if (pills.length) {
-    const lab = String(pills[pills.length - 1].textContent || '').replace(/^ⓘ\s*/, '').trim();
-    if (lab) {
-      window.__OZ_SPEND_LAST__ = lab;
-      return lab;
-    }
-  }
-  try {
-    const nodes = document.querySelectorAll('[class*="sand-message"]');
-    for (let i = nodes.length - 1; i >= 0; i -= 1) {
-      if (ozInComposer(nodes[i])) continue;
-      const vis = ozVisibleSpendText(nodes[i]);
-      if (!/::oz-spend::|this call \$|spent \$/i.test(vis)) continue;
-      const split = splitSpendText(vis);
-      if (split && split.summary) {
-        window.__OZ_SPEND_LAST__ = split.summary;
-        return split.summary;
-      }
-    }
-  } catch (e) {}
-  if (window.__OZ_SPEND_LAST__) return String(window.__OZ_SPEND_LAST__);
-  return String(window.__OZ_SESSION_SPEND__ || '').trim();
-}
-
 function ozEnsureFloatSpend() {
-  const label = ozFloatLabel();
-  const leftover = document.getElementById('oz-spend-float');
-  if (leftover) leftover.remove();
-  let el = document.getElementById('oz-spend-hud');
-  if (!label) {
+  const label = String(window.__OZ_SESSION_SPEND__ || '').trim();
+  const msgPills = document.querySelectorAll('.oz-spend:not(#oz-spend-float)').length;
+  let el = document.getElementById('oz-spend-float');
+  if (!label || msgPills) {
     if (el) el.remove();
     return;
   }
   ozEnsureSpendCss();
   if (!el) {
     el = document.createElement('details');
-    el.id = 'oz-spend-hud';
+    el.id = 'oz-spend-float';
     el.className = 'oz-spend';
     const sum = document.createElement('summary');
     const body = document.createElement('div');
@@ -398,7 +357,7 @@ function ozPlaceFloat(el) {
   if (!el) return;
   el.style.position = 'fixed';
   el.style.zIndex = '2147483646';
-  el.style.opacity = '1';
+  el.style.opacity = '0.95';
   const saved = ozSavedFloatPos();
   if (saved) {
     el.style.left = Math.max(8, saved.left) + 'px';
@@ -457,36 +416,29 @@ function ozDragFloat(el) {
 
 function ozWatchSpend() {
   let t = 0;
-  const inComposer = () => ozInComposer(document.activeElement);
   const run = () => {
-    try {
-      if (inComposer()) {
-        ozEnsureSpendCss();
-        ozEnsureFloatSpend();
-      } else {
-        ozCollapseSpend();
-      }
-    } catch (e) {}
+    const a = document.activeElement;
+    if (a && (a.tagName === 'TEXTAREA' || a.tagName === 'INPUT' || a.isContentEditable)) return;
+    try { ozCollapseSpend(); } catch (e) {}
   };
-  const debounced = () => { clearTimeout(t); t = setTimeout(run, 400); };
+  const debounced = () => { clearTimeout(t); t = setTimeout(run, 600); };
   if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', run);
   else run();
   try {
     const mo = new MutationObserver(debounced);
-    const start = () => { if (document.body) mo.observe(document.body, { childList: true, subtree: true }); };
+    const start = () => { if (document.body) mo.observe(document.body, { childList: true, subtree: false }); };
     if (document.body) start();
     else document.addEventListener('DOMContentLoaded', start);
   } catch (e) {}
   try { window.addEventListener('resize', debounced); } catch (e) {}
-  try { setInterval(run, 2000); } catch (e) {}
 }
 
 export function spendChipSource() {
   return [
     '(function ozSpendChip(){',
     "'use strict';",
-    'if (window.__OZ_SPEND_CHIP__ === 13) return;',
-    'window.__OZ_SPEND_CHIP__ = 13;',
+    'if (window.__OZ_SPEND_CHIP__ === 12) return;',
+    'window.__OZ_SPEND_CHIP__ = 12;',
     chipUsd.toString(),
     labelFromSpendBody.toString(),
     spendLinesOnly.toString(),
@@ -496,13 +448,11 @@ export function spendChipSource() {
     ozSpendHost.toString(),
     ozVisibleSpendText.toString(),
     stripSpendFromText.toString(),
-    ozInComposer.toString(),
     ozBlankSpendIn.toString(),
     ozHideSpendLeftovers.toString(),
     ozPreviousMessageCard.toString(),
     ozAttachSpendChip.toString(),
     ozCollapseSpend.toString(),
-    ozFloatLabel.toString(),
     ozEnsureFloatSpend.toString(),
     ozSavedFloatPos.toString(),
     ozPlaceFloat.toString(),

package/lib/proxy.js

@@ -9,11 +9,11 @@ import {
 } from './config.js';
 import { execSync } from 'node:child_process';
 import { PayClient, QuoteTooHighError, UnderfundedError } from './pay.js';
-import { withOnrampLink, settleFailCopy, isFundInstruction } from './stripeOnramp.js';
+import { withOnrampLink } from './stripeOnramp.js';
 import { tokenBalance } from './x402.js';
 import { evmTokenBalance } from './evm.js';
 import { autoContext } from './autobind.js';
-import { modelsListForRequest, isHarnessAliasId, resolveModel, quoteableRows } from './models.js';
+import { modelsListForRequest, isHarnessAliasId, resolveModel, quoteableRows, unopenrouter } from './models.js';
 
 /**
  * Quoteable catalog ids, cached 5 minutes, for the fuzzy /v1/models/<id> probe.
@@ -38,89 +38,19 @@ import { receiptUsedCogs, receiptDirectUsd, pairActualBilled } from './racesettl
 import { fetchHeaders } from './fetch.js';
 import { attachX402Proof } from './spendProof.js';
 
-/** Kill whatever is LISTEN on this port except this process.
- *  lsof first (macOS), then fuser, then /proc (Omarchy/Arch with neither).
- *  Every openzoo subcommand that binds :8402 goes through this. Hopping to
- *  8403 was the second-burner bug. */
+/** Kill whatever is LISTEN on this port except this process. */
 export function killListen(port, run = execSync) {
-  const n = Number(port);
-  const seen = new Set();
-  const addFrom = (out) => {
-    for (const tok of String(out || '').split(/[^\d]+/)) {
-      const pid = Number(tok);
-      if (Number.isInteger(pid) && pid > 0 && pid !== process.pid) seen.add(pid);
-    }
-  };
-  const tryRun = (cmd, opts = {}) => {
-    try {
-      return run(cmd, { encoding: 'utf8', timeout: 2000, stdio: ['ignore', 'pipe', 'ignore'], ...opts });
-    } catch { return ''; }
-  };
-  addFrom(tryRun(`lsof -nP -iTCP:${n} -sTCP:LISTEN -t`));
-  addFrom(tryRun(`fuser -n tcp ${n}`));
-  if (process.platform === 'linux' && seen.size === 0) {
-    addFrom(tryRun(`python3 - ${n}`, {
-      timeout: 2500,
-      input: `import os, glob, sys
-port=int(sys.argv[1]); hx=f'{port:04X}'
-inodes=set(); pids=set()
-for path in ('/proc/net/tcp','/proc/net/tcp6'):
-    try:
-        for line in open(path):
-            p=line.split()
-            if len(p)<10: continue
-            if p[1].split(':')[-1].upper()==hx: inodes.add(p[9])
-    except FileNotFoundError:
-        pass
-for fd in glob.glob('/proc/[0-9]*/fd/[0-9]*'):
-    try: t=os.readlink(fd)
-    except OSError: continue
-    if any(ino and ino!='0' and ino in t for ino in inodes):
-        try: pids.add(int(fd.split('/')[2]))
-        except (OSError, ValueError): pass
-print('\\n'.join(str(p) for p in pids if p != os.getpid()))
-`,
-    }));
-  }
-  for (const pid of seen) {
-    try { run(`kill ${pid}`, { stdio: 'ignore', timeout: 2000 }); } catch { /* already gone */ }
-    try { run(`kill -9 ${pid}`, { stdio: 'ignore', timeout: 2000 }); } catch { /* already gone */ }
-  }
-  return [...seen];
-}
-
-/** This package.json version. Same one /v1/info and /v1/session publish. */
-export function packageVersion() {
-  return JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
-}
-
-/** True when the listener on this port is THIS openzoo version or newer.
- *  Missing / unparseable version is stale (0.49.x answered with no version).
- *  Older than us is stale. Newer we leave alone so we never downgrade. */
-export async function oursOn(port = config.port) {
-  const mine = packageVersion();
-  const parse = (v) => {
-    const m = String(v || '').trim().match(/^(\d+)\.(\d+)\.(\d+)/);
-    return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
-  };
-  const attachable = (theirs) => {
-    const a = parse(theirs), b = parse(mine);
-    if (!a || !b) return false;
-    for (let i = 0; i < 3; i++) {
-      if (a[i] > b[i]) return true;
-      if (a[i] < b[i]) return false;
+  try {
+    const pids = run(`lsof -nP -iTCP:${Number(port)} -sTCP:LISTEN -t`, {
+      encoding: 'utf8', timeout: 2000,
+    }).trim().split('\n').map(Number).filter((n) => Number.isInteger(n) && n > 0 && n !== process.pid);
+    for (const pid of pids) {
+      try { run(`kill ${pid}`, { stdio: 'ignore', timeout: 2000 }); } catch { /* already gone */ }
     }
-    return true;
-  };
-  for (const path of ['/v1/info', '/v1/session']) {
-    try {
-      const r = await fetch(`http://127.0.0.1:${Number(port)}${path}`, { signal: AbortSignal.timeout(1500) });
-      if (!r.ok) continue;
-      const j = await r.json().catch(() => ({}));
-      if (attachable(j.version)) return true;
-    } catch { /* try next */ }
+    return pids;
+  } catch {
+    return [];
   }
-  return false;
 }
 
 // THE SHIM IS A FACILITATOR, NOT A MIDDLEBOX.
@@ -458,6 +388,33 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
   let creditInflight = null;
   let lastPrices = {};
   let pricesAt = 0;
+  // WALLET BALANCE, CACHED LIKE CREDIT.
+  //
+  // The HUD showed one number — cumulative spend — and a user read it as their
+  // balance: "$13.86" beside a wallet holding $0.18, then every call 402'd
+  // "underfunded" and nothing on screen explained why. Spend is a total to
+  // date; the wallet is what is left. Both, labelled, or neither is legible.
+  //
+  // Never awaited on the /v1/info path: this quotes the gateway and reads
+  // chain balances, and the statusline gives it 1s. Serve last-known, refresh
+  // behind it — the same contract refreshCredit() keeps.
+  let walletUsd = null;
+  let walletAt = 0;
+  let walletInflight = null;
+  const refreshWallet = async (force = false) => {
+    if (!force && Date.now() - walletAt < 60000 && walletUsd != null) return walletUsd;
+    if (walletInflight) return walletInflight;
+    walletInflight = (async () => {
+      try {
+        const { affordableUsd } = await import('./info.js');
+        const v = await affordableUsd();
+        if (Number.isFinite(v)) { walletUsd = v; walletAt = Date.now(); }
+      } catch { /* keep last known */ }
+      walletInflight = null;
+      return walletUsd;
+    })();
+    return walletInflight;
+  };
   const refreshCredit = async (force = false) => {
     if (!force && Date.now() - creditAt < 20000 && creditUsd != null) return creditUsd;
     if (creditInflight) return creditInflight;
@@ -578,22 +535,23 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
       const p0 = (req.url || '').split('?')[0];
       if (req.method === 'GET' && (p0 === '/v1/info' || p0 === '/info')) {
         refreshCredit();
+        refreshWallet();
         const self = viaTunnel && tunnelGate?.publicUrl
           ? `${tunnelGate.publicUrl}/v1`
           : `http://localhost:${config.port}/v1`;
         res.writeHead(200, { 'content-type': 'application/json' });
-        const { version: ozVersion } = JSON.parse(
-          readFileSync(new URL('../package.json', import.meta.url), 'utf8'),
-        );
         res.end(JSON.stringify({
           youAreTalkingTo: 'openzoo proxy',
-          version: ozVersion,
-          solana: client.address,
           yourEndpoint: self,
           reachedVia: viaTunnel ? 'public tunnel' : 'localhost',
           publicTunnel: tunnelGate?.publicUrl ? `${tunnelGate.publicUrl}/v1` : null,
           servedRequests,
+          // SPENT-TO-DATE, not a balance: restored from ~/.openzoo/session.json at
+          // startup, so it spans every session on this machine.
           spendUsd: sessionSpent,
+          spendScope: 'all-time on this machine',
+          // WHAT IS LEFT to pay with. null while the first read is in flight.
+          walletUsd,
           creditUsd,
           // WHAT THE SAME CALLS WOULD HAVE COST DIRECT. Spend on its own is a
           // bill; spend beside the counterfactual is the product.
@@ -693,10 +651,43 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     const isPaidPost = req.method === 'POST'
       && /\/(chat\/completions|completions|messages|responses)$/.test(rawPath);
     let wantsStream = false;
+    // RECEIPTS ARE OPT-OUT. `disableStats: true` in the body (or the
+    // x-openzoo-disable-stats header) means this caller does not want the x402
+    // block, so we neither attach our settle proof nor pass the gateway's
+    // receipt through. The field is deliberately FORWARDED, not stripped: the
+    // gateway reads it too and drops its own half. Absent/false keeps today's
+    // behaviour, because our own spend line reads that block.
+    let statsOff = false;
+    if (isPaidPost) {
+      try {
+        const b = JSON.parse(bodyBuf.toString('utf8'));
+        const h = req.headers['x-openzoo-disable-stats'];
+        const truthy = (v) => v === true || v === 'true' || v === '1' || v === 1;
+        statsOff = truthy(b?.disableStats) || truthy(Array.isArray(h) ? h[0] : h);
+      } catch { /* not JSON */ }
+    }
     if (isPaidPost) {
       servedRequests += 1;
       say(`\n<- request #${servedRequests} from ${(req.headers['user-agent'] || 'unknown').slice(0, 40)}`);
       try { wantsStream = JSON.parse(bodyBuf.toString('utf8'))?.stream === true; } catch { /* not JSON */ }
+      // UNOPENROUTER THE MODEL ID before anything downstream sees the body —
+      // the replay key, the outage gate, the wire. A vendor-prefixed
+      // OpenRouter spelling becomes the bare id the doors serve when the
+      // catalog lists it (OPENZOO_UNOPENROUTER=1 forces it, =0 disables).
+      // This is the one place the body is rewritten; see models.js.
+      try {
+        const parsed = JSON.parse(bodyBuf.toString('utf8'));
+        if (parsed && typeof parsed.model === 'string') {
+          let ids = [];
+          try { ids = await catalogIdsCached(`${config.apiBase}/v1/models`, upstreamHeaders(req)); } catch { /* catalog unreachable: only the forced mode rewrites */ }
+          const bare = unopenrouter(parsed.model, ids);
+          if (bare) {
+            say(`   model ${parsed.model} -> ${bare} (bare id: doors, not OpenRouter)`);
+            parsed.model = bare;
+            bodyBuf = Buffer.from(JSON.stringify(parsed));
+          }
+        }
+      } catch { /* not JSON */ }
     }
 
     // Retry of a body we answered seconds ago? Serve the cached completion —
@@ -867,7 +858,11 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
           say(`credit -> $${x.billedUsd.toFixed(6)}  ·  session $${sessionSpent.toFixed(6)}`);
         }
         if (data?.object === 'chat.completion') {
-          if (paid && receipt) {
+          if (statsOff) {
+            // The gateway already dropped its half; drop ours, and any block an
+            // older gateway in front of us still attached.
+            delete data.x402;
+          } else if (paid && receipt) {
             attachX402Proof(data, {
               tx: receipt.tx,
               memo: receipt.memo || accept?.extra?.memo,
@@ -904,13 +899,14 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
         rememberSpend();
         say(`credit -> $${x.billedUsd.toFixed(6)}  ·  session $${sessionSpent.toFixed(6)}`);
       };
-      // A 402 AFTER we attempted payment is a SETTLEMENT failure, not a quote.
-      // The client-side balance check is advisory, so a funded wallet can still
-      // fail on-chain / at the facilitator, and the gateway answers the paid
-      // retry with a fresh 402. Relaying that as "wallet underfunded" + Whop
-      // copy-paste blamed burners that already paid. Surface the gateway's
-      // real reason; only prepend fund-me copy on genuine insufficient_funds.
+      // A 402 AFTER we attempted payment is a SETTLEMENT failure, not a quote —
+      // the client-side balance check is advisory, so a wallet that looks
+      // fundable can still fail on-chain, and the gateway answers the paid
+      // retry with a fresh 402. Relaying that raw meant Claude Code printed a
+      // half-kilobyte accepts[] blob at the user instead of the one thing they
+      // need: the price, what the wallet holds, and where to send funds.
       if (response.status === 402) {
+        let quoted = '';
         let usd;
         let q402 = null;
         try { q402 = await response.clone().json(); } catch { q402 = null; }
@@ -927,21 +923,18 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
           return;
         }
         try {
-          usd = Number(q402?.accepts?.[0]?.extra?.billedUsd);
-          if (!Number.isFinite(usd)) usd = undefined;
-        } catch { usd = undefined; }
-        const copy = settleFailCopy(q402);
-        // paid:true → never "wallet underfunded", never Whop unless the
-        // gateway itself named insufficient_funds. UnderfundedError (empty
-        // wallet preflight) is handled in the catch below.
-        let msg = copy.message;
-        const wantOnramp = copy.code === 'insufficient_funds'
-          || (!paid && isFundInstruction(copy.reason, copy));
-        if (wantOnramp) {
-          msg = await withOnrampLink(msg, { solana: client.address, usd, code: copy.code });
-        }
-        log(/ties to your account/i.test(msg) ? 'onramp: whop + copy-paste solana' : `402: ${msg.slice(0, 140)}`);
-        jsonErr(res, paid ? copy.status : 402, msg);
+          const q = q402;
+          usd = Number(q?.accepts?.[0]?.extra?.billedUsd);
+          if (Number.isFinite(usd)) quoted = ` This call needs ≈$${usd.toFixed(4)}.`;
+        } catch { /* body was not the quote after all */ }
+        const msg = await withOnrampLink(
+          `openzoo wallet underfunded — payment did not settle.${quoted} `
+          + `Fund it and retry: send USDC (or TOKEN/LEOS for half price) to ${client.address} on Solana, `
+          + `or USDC to ${client.evmAddress} on Base. Check with: openzoo balance`,
+          { solana: client.address, usd },
+        );
+        log(/ties to your account/i.test(msg) ? 'onramp: whop + copy-paste solana' : 'onramp: no fund blurb');
+        jsonErr(res, 402, msg);
         return;
       }
       await relay(res, response, meterStreamed);
@@ -974,18 +967,11 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
   // OPENZOO_BIND=0.0.0.0 AND a tunnel token, so that port stays gated exactly
   // like the public tunnel path.
   const bindHost = process.env.OPENZOO_BIND || '127.0.0.1';
-  // SELF-HEAL :8402. Kill whoever is on THIS port, then bind it. Never hop to
-  // 8403 — that was the second-burner. Every subcommand that calls startProxy
-  // (openzoo, claude, bot, web, cursor, aoe, grok, tunnel) goes through here.
-  // Reusing a leftover listener left a stale PayClient serving $0 after a
-  // TOKEN top-up, and an old npx cache answering /v1 with no version.
-  {
-    const pids = killListen(config.port);
-    if (pids.length) {
-      say(`openzoo: killed proxy on :${config.port} (pids ${pids.join(',')})`);
-      await new Promise((r) => setTimeout(r, 400));
-    }
-  }
+  // SELF-HEAL A TAKEN PORT. Walk up to the next free port instead of dying;
+  // the caller reads config.port back out, so every URL printed afterwards is
+  // the one we actually bound. A healthy proxy already on the port is KILLED
+  // — reusing it left a stale PayClient serving $0 after a TOKEN top-up.
+  const wanted = config.port;
   for (let attempt = 0; ; attempt++) {
     try {
       await new Promise((resolve, reject) => {
@@ -995,12 +981,20 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
       });
       break;
     } catch (e) {
-      if (e?.code !== 'EADDRINUSE' || attempt >= 8) throw e;
-      const pids = killListen(config.port);
-      if (pids.length) say(`openzoo: killed proxy on :${config.port} (pids ${pids.join(',')})`);
-      await new Promise((r) => setTimeout(r, 300));
+      if (e?.code !== 'EADDRINUSE' || attempt >= 12) throw e;
+      if (attempt === 0) {
+        const pids = killListen(config.port);
+        if (pids.length) {
+          say(`openzoo: killed proxy on :${config.port} (pids ${pids.join(',')})`);
+          await new Promise((r) => setTimeout(r, 400));
+          continue;
+        }
+      }
+      config.port += 1;
+      say(`openzoo: :${config.port - 1} busy — trying :${config.port}`);
     }
   }
+  if (config.port !== wanted) say(`openzoo: listening on :${config.port} (:${wanted} was busy)`);
 
   // AUTO-PREPAY. Paying on-chain per call is where the latency lives: credit
   // is applied automatically server-side whenever a balance covers the quote,

package/lib/setup.js

@@ -214,7 +214,7 @@ async function printStartupDiagnostic(base, which) {
 
   console.log('openzoo diagnostic');
   console.log(`  version    : ${version}   node ${process.version}   ${process.platform}/${process.arch}`);
-  console.log(`  port ${config.port}  : ${portBusy ? 'occupied (steal unless this exact version)' : 'free'}`);
+  console.log(`  port ${config.port}  : ${portBusy ? 'ALREADY SERVING (an older proxy may still be running — kill it if this build is newer)' : 'free'}`);
   console.log(`  editor     : ${picked ? `${picked.which} @ ${picked.cmd}` : 'NONE FOUND'}`);
   console.log(`  running    : ${picked ? (q(() => editorRunning(picked.which), false) ? 'yes — will be quit so settings stick' : 'no') : '-'}`);
   console.log(`  backend    : ${hosts}`);
@@ -245,17 +245,9 @@ export async function setupEditor(which, target) {
   // Declared out here: the tunnel-rebind hook is registered further down, well
   // outside the block that starts the proxy.
   let started = null;
-  const { startProxy, oursOn, packageVersion } = await import('./proxy.js');
-  if (await oursOn(config.port)) {
-    console.log(`proxy v${packageVersion()} already on ${base} — keeping it`);
-    try {
-      const info = await (await fetch(`${base}/info`)).json();
-      publicUrl = (info?.publicTunnel || '').replace(/\/v1$/, '') || null;
-      tunnelKey = info?.tunnelToken ?? tunnelKey;
-      if (publicUrl) console.log(`tunnel:  ${publicUrl}/v1 (from the running proxy)`);
-    } catch { /* no /info */ }
-  } else {
-    console.log(`${(await proxyUp(base)) ? 'stale proxy — stealing' : 'starting proxy on'} ${base} (+ public tunnel)...`);
+  if (!(await proxyUp(base))) {
+    console.log(`starting proxy on ${base} (+ public tunnel)...`);
+    const { startProxy } = await import('./proxy.js');
     started = await startProxy({ silent: true, autoTunnel: true });
     publicUrl = started?.publicUrl ?? null;
     tunnelKey = started?.tunnelToken ?? null;
@@ -306,6 +298,15 @@ export async function setupEditor(which, target) {
       console.log('         most common cause here: no working IPv6 route (we already force');
       console.log('         --edge-ip-version 4). check: npx openzoo tunnel   for the raw log.');
     }
+  } else {
+    console.log(`proxy already running on ${base}`);
+    // A proxy someone else started owns the tunnel; ask it for the public URL.
+    try {
+      const info = await (await fetch(`${base}/info`)).json();
+      publicUrl = (info?.publicTunnel || '').replace(/\/v1$/, '') || null;
+      tunnelKey = info?.tunnelToken ?? tunnelKey;
+      if (publicUrl) console.log(`tunnel:  ${publicUrl}/v1 (from the running proxy)`);
+    } catch { /* no /info — fall through to the localhost warning below */ }
   }
   // What the EDITOR is configured with. Localhost only as a last resort, and
   // said out loud, because it will fail with the private-networks error.

package/lib/stripeOnramp.js

@@ -103,58 +103,8 @@ export function whopFundBlurb(solana) {
   ].join('\n');
 }
 
-/**
- * Genuine empty-wallet / fund-me copy. A post-pay settle failure
- * ("payment did not settle" with a gateway reason and no underfunded
- * wording) is NOT this — those wallets are often funded; the 402 is
- * the facilitator or upstream.
- */
-export function isFundInstruction(text, extra = {}) {
-  const code = extra.code ?? extra.advice?.code;
-  if (String(code || '') === 'insufficient_funds') return true;
-  const s = String(text || '');
-  if (!s) return false;
-  if (/\b(?:wallet underfunded|empty wallet|wallet is empty|needs more than the wallet holds|insufficient[_\s]funds)\b/i.test(s)) return true;
-  if (/\bunderfunded\b/i.test(s)) return true;
-  if (/\bsend (?:usdc|a few cents)\b/i.test(s)) return true;
-  if (/\bno offered payment row is affordable/i.test(s)) return true;
-  return false;
-}
-
-function gatewayReason(q402) {
-  if (!q402 || typeof q402 !== 'object') return '';
-  const err = q402.error;
-  const advice = q402.advice;
-  if (typeof err?.message === 'string' && err.message.trim()) return err.message.trim();
-  if (typeof err === 'string' && err.trim()) return err.trim();
-  if (typeof advice?.message === 'string' && advice.message.trim()) return advice.message.trim();
-  if (typeof advice === 'string' && advice.trim()) return advice.trim();
-  if (advice && typeof advice === 'object') {
-    const bits = [advice.code, advice.reason, advice.detail].filter((x) => typeof x === 'string' && x.trim());
-    if (bits.length) return bits.join(': ');
-  }
-  return '';
-}
-
-/**
- * Copy for a 402 AFTER PayClient already signed and retried (paid:true).
- * Never "wallet underfunded" — that string is reserved for preflight
- * empty-wallet errors. Prefix stays greppable as "payment did not settle".
- */
-export function settleFailCopy(q402) {
-  const reason = gatewayReason(q402);
-  const code = q402?.advice?.code || q402?.error?.code || '';
-  const fund = isFundInstruction(reason, { code, advice: q402?.advice });
-  const message = reason
-    ? `openzoo payment did not settle: ${reason}`
-    : 'openzoo payment did not settle';
-  const upstreamish = /upstream|facilitator|internal(?: server)? error|settle(?:ment)? (?:failed|error)/i.test(reason) && !fund;
-  return { message, status: upstreamish ? 502 : 402, fund, reason, code: String(code || '') };
-}
-
 export async function withOnrampLink(text, dest) {
   const body = String(text || '').trim();
-  if (!isFundInstruction(body, dest)) return body;
   const blurb = whopFundBlurb(dest?.solana);
   if (!blurb) return body;
   if (/ties to your account/i.test(body) && body.includes(String(dest.solana))) return body;

package/lib/websearch.js

@@ -0,0 +1,31 @@
+// Keyless web search for `openzoo ask --web`: DuckDuckGo's HTML endpoint,
+// scraped for title / url / snippet. No API key, no account, one GET. The
+// only thing that leaves is the question text, to duckduckgo.com.
+const strip = (s) => String(s || '')
+  .replace(/<[^>]+>/g, '')
+  .replace(/&amp;/g, '&').replace(/&quot;/g, '"').replace(/&#x27;/g, "'").replace(/&lt;/g, '<').replace(/&gt;/g, '>')
+  .replace(/\s+/g, ' ').trim();
+
+export async function webSearch(query, max = 5) {
+  const res = await fetch('https://html.duckduckgo.com/html/?q=' + encodeURIComponent(query), {
+    headers: { 'user-agent': 'Mozilla/5.0 openzoo-ask/1.0' },
+    signal: AbortSignal.timeout(12_000),
+  });
+  if (!res.ok) throw new Error(`duckduckgo HTTP ${res.status}`);
+  const html = await res.text();
+  const out = [];
+  const re = /<a[^>]*class="result__a"[^>]*href="([^"]+)"[^>]*>([\s\S]*?)<\/a>[\s\S]*?class="result__snippet"[^>]*>([\s\S]*?)<\/a>/g;
+  let m;
+  while ((m = re.exec(html)) && out.length < Math.max(1, Math.min(10, max))) {
+    let url = m[1];
+    const redirected = url.match(/uddg=([^&]+)/);
+    if (redirected) url = decodeURIComponent(redirected[1]);
+    out.push({ title: strip(m[2]), url, snippet: strip(m[3]).slice(0, 400) });
+  }
+  return out;
+}
+
+export function formatWebResults(query, hits) {
+  const lines = hits.map((h, i) => `${i + 1}. ${h.title} — ${h.url}\n   ${h.snippet}`);
+  return `Web search results for "${query}" (DuckDuckGo, fetched just now; cite the url when you rely on one):\n${lines.join('\n')}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.50.93",
+  "version": "0.50.95",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",