openzoo 0.50.96 → 0.50.98

package/bin/cursor-backend.js

@@ -45,5 +45,5 @@ process.on('unhandledRejection', (e) => {
   log(`cursor-backend: UNHANDLED REJECTION ${e && e.message ? e.message : e}`);
 });
 
-startCursorBackend({ port, models, log });
+await startCursorBackend({ port, models, log });
 log(`cursor-backend: standalone up on :${port} (${models.length} models)`);

package/bin/openzoo.js

@@ -96,7 +96,16 @@ usage:
                               After a reboot the login item comes back without
                               that env — bot bounces it so send works. Already-
                               hijacked sessions are left alone.
+                              Missing Grok Bot is fetched from the grokbot-v*
+                              multiarch GitHub release (vendor feed fallback).
                               --quit force bounce · --no-quit never bounce
+                              --no-fetch  do not download Grok Bot if missing
+                              --daemon / -d  fork the sidecar to background
+                                         (pid ~/.openzoo/bot.pid, log bot.log)
+                                         then launch Grok Bot. Needed from the
+                                         OpenZoo Bot AppImage so this process
+                                         is not the GUI.
+                              --stop  kill the --daemon sidecar
                               --verbose  print every request the app makes
                                          (default is quiet: milestones + problems)
                               --web serve the renderer in a browser instead of
@@ -330,7 +339,7 @@ async function main() {
     }
     case 'ask': {
       const question = process.argv[3];
-      if (!question) throw new Error('usage: openzoo ask "<question>" [--context <id>] [--model <id>] [--system <text>]');
+      if (!question) throw new Error('usage: openzoo ask "<question>" [--context <id>] [--model <id>] [--system <text>] [--web [--web-results N]]');
       const ci = process.argv.indexOf('--context');
       const mi = process.argv.indexOf('--model');
       // A BARE QUESTION IS A DIFFERENT PRODUCT FROM A BRIEFED ONE.
@@ -344,7 +353,20 @@ async function main() {
       // DHH, Hyprland and theming. Same gateway, same product, one had context.
       // A caller that knows where it is running can now say so.
       const si = process.argv.indexOf('--system');
-      const system = si !== -1 ? process.argv[si + 1] : '';
+      let system = si !== -1 ? process.argv[si + 1] : '';
+      // --web: a keyless DuckDuckGo search, top results injected into THIS
+      // call's system prompt. The x402 rail strips OpenRouter's `plugins`
+      // field, so search-then-inject has to happen here, on the caller's
+      // side. EGRESS: the question text goes to duckduckgo.com. Also on with
+      // OPENZOO_ASK_WEB=1; --web-results N caps the count (default 5).
+      const wantWeb = process.argv.includes('--web') || process.env.OPENZOO_ASK_WEB === '1';
+      if (wantWeb) {
+        const wi = process.argv.indexOf('--web-results');
+        const n = wi !== -1 ? Number(process.argv[wi + 1]) || 5 : 5;
+        const { webSearch, formatWebResults } = await import('../lib/websearch.js');
+        const hits = await webSearch(question, n).catch((e) => { console.error(`web search failed: ${e.message}`); return []; });
+        if (hits.length) system = (system ? system + '\n\n' : '') + formatWebResults(question, hits);
+      }
       const { PayClient } = await import('../lib/pay.js');
       const { config } = await import('../lib/config.js');
       const client = new PayClient();
@@ -389,6 +411,17 @@ async function main() {
     case '-h':
       console.log(HELP);
       break;
+    case 'version':
+    case '--version':
+    case '-v':
+    case '-V': {
+      // Every installer, mise shim and shell script that probes a CLI asks
+      // this first; answering "unknown command" to it failed real installs.
+      const { readFileSync } = await import('fs');
+      const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+      console.log(pkg.version);
+      break;
+    }
     default:
       console.error(`unknown command: ${cmd}\n`);
       console.log(HELP);

package/lib/cursorapi.js

@@ -305,3 +305,68 @@ export function connectFrame(payload) {
   head.writeUInt32BE(payload.length, 1);
   return Buffer.concat([head, payload]);
 }
+
+/**
+ * Fake Cursor login. Grok Bot polls GET /auth/poll until the JSON has
+ * accessToken + refreshToken (asar SandBackendLoginManager.waitForResult).
+ * empty-ok `{}` is a 200 without those keys → login fails → "Log in with Cursor".
+ * accessToken is JWT-decoded for sub/email/exp (createLoggedInStatus).
+ */
+export function fakeCursorJwt({
+  sub = 'openzoo-user',
+  email = 'user@openzoo.local',
+  name = 'openzoo',
+  now = Math.floor(Date.now() / 1000),
+} = {}) {
+  const b64url = (obj) => Buffer.from(JSON.stringify(obj)).toString('base64url');
+  return `${b64url({ alg: 'none', typ: 'JWT' })}.${b64url({
+    sub, email, name, exp: now + 365 * 86400, iat: now,
+  })}.oz`;
+}
+
+export function fakeCursorTokens() {
+  const accessToken = fakeCursorJwt();
+  const refreshToken = fakeCursorJwt();
+  return { accessToken, refreshToken, authId: 'openzoo-user' };
+}
+
+const LOGIN_DEEP_HTML = `<!doctype html>
+<html lang="en"><head>
+<meta charset="utf-8">
+<meta http-equiv="refresh" content="0;url=about:blank">
+<title></title>
+</head>
+<body data-component="oz-fake-login">
+<script>
+try { window.open('', '_self'); } catch (e) {}
+try { window.close(); } catch (e) {}
+try { location.replace('about:blank'); } catch (e) {}
+</script>
+</body></html>
+`;
+
+/** Path without query. Returns a reply descriptor or null. */
+export function fakeCursorAuthReply(urlPath, { passthrough = false } = {}) {
+  if (passthrough) return null;
+  const path0 = String(urlPath || '').split('?')[0];
+  const tok = fakeCursorTokens();
+  if (path0 === '/auth/poll') {
+    return { kind: 'poll', contentType: 'application/json', body: JSON.stringify(tok) };
+  }
+  if (path0 === '/oauth/token') {
+    return {
+      kind: 'oauth',
+      contentType: 'application/json',
+      body: JSON.stringify({
+        access_token: tok.accessToken,
+        refresh_token: tok.refreshToken,
+        token_type: 'Bearer',
+        expires_in: 365 * 86400,
+      }),
+    };
+  }
+  if (path0 === '/loginDeepControl') {
+    return { kind: 'login-page', contentType: 'text/html; charset=utf-8', body: LOGIN_DEEP_HTML };
+  }
+  return null;
+}