openzoo 0.51.16 → 0.51.17

package/lib/chatgpt-install.js

@@ -20,7 +20,7 @@ export function installerAsset(platform = process.platform, arch = process.arch)
 
 export function runCommand(command, args, options = {}) {
   return new Promise((resolve, reject) => {
-    const child = spawn(command, args, { stdio: ['ignore', 'pipe', 'pipe'], ...options });
+    const child = spawn(command, args, { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true, ...options });
     let stdout = '', stderr = '';
     child.stdout?.on('data', b => { stdout = (stdout + b).slice(-1024 * 1024); });
     child.stderr?.on('data', b => { stderr = (stderr + b).slice(-8192); });

package/lib/chatgpt.js

@@ -11,6 +11,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { config } from './config.js';
+import { launchWindowsPackage } from './windows-chatgpt.js';
 import { startChatGptSpend } from './chatgpt-spend.js';
 import { installChatGpt, windowsChatGptApp, runCommand } from './chatgpt-install.js';
 
@@ -222,7 +223,7 @@ async function ensureProxy({ tunnel }) {
   const fd = fs.openSync(logPath, 'a');
   const env = { ...process.env };
   if (!tunnel && !env.OPENZOO_NO_TUNNEL) env.OPENZOO_NO_TUNNEL = '1';
-  const child = spawn(process.execPath, [process.argv[1], 'proxy'], { detached: true, stdio: ['ignore', fd, fd], env });
+  const child = spawn(process.execPath, [process.argv[1], 'proxy'], { detached: true, windowsHide: true, stdio: ['ignore', fd, fd], env });
   child.unref();
   fs.closeSync(fd);
   process.stderr.write(`openzoo: starting the proxy (v${packageVersion()}) in the background, log ${logPath}`);
@@ -231,8 +232,7 @@ async function ensureProxy({ tunnel }) {
     await new Promise((r) => setTimeout(r, 1000));
     process.stderr.write('.');
     try {
-      const r = await fetch(`http://localhost:${config.port}/v1/info`);
-      if (r.ok) { process.stderr.write('\n'); return { started: true, logPath }; }
+      if (await oursOn(config.port)) { process.stderr.write('\n'); return { started: true, logPath }; }
     } catch { /* not yet */ }
   }
   process.stderr.write('\n');
@@ -334,6 +334,10 @@ export async function setupChatGpt(argv = [], dependencies = {}) {
 
 /** LaunchServices handles app bundles on macOS; detect early failures elsewhere. */
 export async function launchChatGpt(app, args, { env, platform = process.platform, run = runCommand, spawnImpl = spawn } = {}) {
+  if (platform === 'win32' && /[\\/]WindowsApps[\\/]/i.test(app)) {
+    await launchWindowsPackage(app, args, { env, run });
+    return;
+  }
   if (platform === 'darwin' && app.endsWith('/Contents/MacOS/ChatGPT')) {
     await run('open', ['-n', '--env', `CODEX_HOME=${env.CODEX_HOME}`,
       '--env', `CODEX_ELECTRON_USER_DATA_PATH=${env.CODEX_ELECTRON_USER_DATA_PATH}`,

package/lib/funding-status.js

@@ -1,16 +1,19 @@
 /** Coalesce live reads, retain unknowns, and never cache an empty balance for a minute. */
 export function liveBalance(read, { ttlMs = 3000, now = Date.now } = {}) {
-  let value = null, at = 0, inflight;
+  let value = null, at = 0, inflight, generation = 0;
   return {
+    reset() { generation++; value = null; at = 0; inflight = undefined; },
     get value() { return value; },
     get checkedAt() { return at || null; },
     async refresh(force = false) {
       if (inflight) return inflight;
       if (!force && at && now() - at < ttlMs) return value;
+      const readGeneration = generation;
       inflight = Promise.resolve().then(read).then(next => {
         if (typeof next !== 'number' || !Number.isFinite(next) || next < 0) throw new Error('Balance unavailable');
+        if (readGeneration !== generation) return value;
         value = next; at = now(); return value;
-      }).catch(() => value).finally(() => { inflight = null; });
+      }).catch(() => value).finally(() => { if (readGeneration === generation) inflight = null; });
       return inflight;
     },
   };

package/lib/info.js

@@ -257,10 +257,10 @@ export { priceHoldings, formatHoldingMoney } from './livestatus.js';
 /** Current prepaid credit for this wallet's namespace. */
 export { CREDIT_TIMEOUT_MS };
 
-export async function creditBalance() {
+export async function creditBalance(wallet) {
   const { withNamespace } = await import('./namespace.js');
   const r = await fetch(`${config.apiBase}/v1/credits`, {
-    headers: withNamespace({}), cache: 'no-store',
+    headers: withNamespace({}, wallet), cache: 'no-store',
     signal: AbortSignal.timeout(CREDIT_TIMEOUT_MS),
   });
   if (!r.ok) throw new Error('Credit balance is temporarily unavailable');

package/lib/proxy.js

@@ -1,6 +1,8 @@
 import { receiptLedger } from './receipt-ledger.js';
 import { billingObserver, finalBilling } from './billing.js';
 import { liveBalance } from './funding-status.js';
+import { walletReloader } from './wallet-reload.js';
+import { loadOrCreateWallet } from './wallet.js';
 import { paymentError } from './payment-error.js';
 import { readFileSync, appendFileSync, mkdirSync } from 'node:fs';
 import os from 'node:os';
@@ -59,7 +61,7 @@ export function killListen(port, run = execSync, platform = process.platform) {
   };
   const tryRun = (cmd, opts = {}) => {
     try {
-      return run(cmd, { encoding: 'utf8', timeout: 2000, stdio: ['ignore', 'pipe', 'ignore'], ...opts });
+      return run(cmd, { encoding: 'utf8', timeout: 2000, windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'], ...opts });
     } catch { return ''; }
   };
   if (platform === 'win32') {
@@ -72,7 +74,7 @@ export function killListen(port, run = execSync, platform = process.platform) {
       if (Number.isInteger(pid) && pid > 0 && pid !== process.pid) seen.add(pid);
     }
     for (const pid of seen) {
-      try { run(`taskkill /PID ${pid} /F`, { stdio: 'ignore', timeout: 2000 }); } catch { /* already gone */ }
+      try { run(`taskkill /PID ${pid} /F`, { stdio: 'ignore', timeout: 2000, windowsHide: true }); } catch { /* already gone */ }
     }
     return [...seen];
   }
@@ -387,7 +389,8 @@ function replayPut(key, data, settle) {
  * default, so localhost behaviour is unchanged.
  */
 export async function startProxy({ silent = false, requireToken = null, sessionMaxUsd = null, autoTunnel = false } = {}) {
-  const client = new PayClient();
+  let client = new PayClient();
+  const currentWallet = walletReloader(client, { file: client.walletPath, load: () => new PayClient(loadOrCreateWallet({ create: false })) });
   // HOUSE OUTAGE GATE. Measured 2026-09-01: TOKEN payments settled on chain
   // (tx 3rwy5z…) and the gateway still answered 402 because ITS upstream
   // (OpenRouter) was out of credits. Paying again buys nothing, and the
@@ -496,7 +499,9 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
   let walletUsd = null;
   let walletAt = 0;
   const walletStatus = liveBalance(async () => {
-    const snap = await snapshotBalances(client);
+    const readingClient = client;
+    const snap = await snapshotBalances(readingClient);
+    if (readingClient !== client) throw new Error("Wallet changed during balance read");
     if (!snap.length) throw new Error('Balances unavailable');
     const previous = new Map((lastSnap || []).map(b => [`${b.chain}:${b.symbol}`, b]));
     for (const b of snap) {
@@ -507,14 +512,20 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     lastSnap = [...previous.values()];
     return priceHoldings(lastSnap, lastPrices).chainUsd;
   });
-  const creditStatus = liveBalance(creditBalance);
+  const creditStatus = liveBalance(() => creditBalance(client));
   const refreshWallet = async (force = false) => {
-    walletUsd = await walletStatus.refresh(force);
+    const readingClient = client;
+    const value = await walletStatus.refresh(force);
+    if (readingClient !== client) return walletUsd;
+    walletUsd = value;
     walletAt = walletStatus.checkedAt;
     return walletUsd;
   };
   const refreshCredit = async (force = false) => {
-    creditUsd = await creditStatus.refresh(force);
+    const readingClient = client;
+    const value = await creditStatus.refresh(force);
+    if (readingClient !== client) return creditUsd;
+    creditUsd = value;
     creditAt = creditStatus.checkedAt;
     return creditUsd;
   };
@@ -532,7 +543,22 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
   const walletMoney = () => priceHoldings(lastSnap || [], lastPrices);
   let tunnelError = null;
 
+  const reloadWallet = () => {
+    const next = currentWallet();
+    if (next !== client) {
+      client = next;
+      resetBalanceCache(); resetRailMemory();
+      walletStatus.reset(); creditStatus.reset();
+      lastSnap = null; walletUsd = creditUsd = null; walletAt = creditAt = 0;
+      say(`wallet replaced · now using Solana ${client.address} · Base ${client.evmAddress}`);
+      refreshWallet(true); refreshCredit(true);
+    }
+    return client;
+  };
   const server = http.createServer(async (req, res) => {
+    // Every request keeps one client even if the file changes mid-response.
+    let client;
+    try { client = reloadWallet(); } catch (error) { jsonErr(res, 503, error.message); return; }
     // MCP on the SAME port as the proxy. One `npx openzoo` gives a harness
     // both surfaces: point base_url at /v1, or add /mcp for tools.
     if (req.method === 'GET' && (req.url || '').split('?')[0] === '/v1/session') {
@@ -1137,7 +1163,7 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
   // Funding checks run for desktop/background launches as well as terminal sessions.
   refreshBalances = () => refreshWallet(true);
   refreshWallet(); refreshCredit(); refreshPrices();
-  const fundingTimer = setInterval(() => { refreshCredit(); refreshWallet(); refreshPrices(); }, 3000);
+  const fundingTimer = setInterval(() => { try { reloadWallet(); refreshCredit(); refreshWallet(); refreshPrices(); } catch { /* request path reports an incomplete wallet replacement */ } }, 3000);
   fundingTimer.unref?.();
   server.on('close', () => clearInterval(fundingTimer));
 

package/lib/wallet-reload.js

@@ -0,0 +1,23 @@
+import fs from 'node:fs';
+import crypto from 'node:crypto';
+/** Swap whole clients, never mutate the signer of an in-flight request. */
+export function walletReloader(initial, { file, load }) {
+  const fingerprint = () => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+  let current = initial, stamp = fingerprint();
+  return () => {
+    try {
+      const next = fingerprint();
+      if (next !== stamp) {
+        const replacement = load();
+        // load may migrate the legacy array format after validating it.
+        stamp = fingerprint();
+        current = replacement;
+      }
+      return current;
+    } catch {
+      // Do not print parser errors containing secret-key bytes, or keep paying
+      // from the old wallet while a replacement is missing/partially copied.
+      throw new Error('Could not load wallet.json. Finish copying a valid OpenZoo wallet file; payments are paused until it is ready.');
+    }
+  };
+}

package/lib/wallet.js

@@ -10,7 +10,7 @@ import { config } from './config.js';
  * Legacy format (bare 64-byte array, solana-keygen style) is migrated in place.
  * Your keys never leave this machine — the zoo only ever sees signed transfers.
  */
-export function loadOrCreateWallet() {
+export function loadOrCreateWallet({ create = true } = {}) {
   const p = config.walletPath;
   let solanaBytes;
   let evmKey;
@@ -25,16 +25,20 @@ export function loadOrCreateWallet() {
       evmKey = raw.evm;
     }
   } else {
+    if (!create) throw new Error("wallet.json is missing. Finish replacing the wallet file and try again.");
     solanaBytes = Keypair.generate().secretKey;
     created = true;
   }
+  // Validate before migrating, so a partial replacement is never overwritten.
+  const keypair = Keypair.fromSecretKey(solanaBytes);
+  if (evmKey && !/^0x[0-9a-f]{64}$/i.test(evmKey)) throw new Error("Invalid EVM wallet key");
   if (!evmKey) {
     evmKey = `0x${crypto.randomBytes(32).toString('hex')}`;
     fs.mkdirSync(path.dirname(p), { recursive: true, mode: 0o700 });
     fs.writeFileSync(p, JSON.stringify({ solana: Array.from(solanaBytes), evm: evmKey }), { mode: 0o600 });
   }
   return {
-    keypair: Keypair.fromSecretKey(solanaBytes),
+    keypair,
     evmPrivateKey: evmKey,
     created,
     path: p,

package/lib/windows-chatgpt.js

@@ -0,0 +1,62 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+// CommandLineToArgvW quoting, without invoking cmd.exe or interpreting shell syntax.
+export function windowsArgument(value) {
+  return '"' + String(value).replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/g, '$1$1') + '"';
+}
+
+export function packagedLaunchScript({ app, args, env, statusFile }) {
+  const data = Buffer.from(JSON.stringify({ app, args, statusFile,
+    env: { CODEX_HOME: env.CODEX_HOME, CODEX_ELECTRON_USER_DATA_PATH: env.CODEX_ELECTRON_USER_DATA_PATH,
+      OPENZOO_API_KEY: env.OPENZOO_API_KEY } }), 'utf8').toString('base64');
+  // This initializer runs INSIDE the package identity. Explicitly set the
+  // isolated profile there instead of relying on activation-broker inheritance.
+  const child = `$ErrorActionPreference = 'Stop'
+$d = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${data}')) | ConvertFrom-Json
+try {
+  foreach ($entry in $d.env.PSObject.Properties) { [Environment]::SetEnvironmentVariable($entry.Name, [string]$entry.Value, 'Process') }
+  $p = Start-Process -FilePath $d.app -ArgumentList $d.args -WorkingDirectory (Split-Path -LiteralPath $d.app) -PassThru
+  Start-Sleep -Milliseconds 1500
+  if ($p.HasExited -and $p.ExitCode -ne 0) { throw "ChatGPT exited during launch ($($p.ExitCode))" }
+  @{ok=$true;pid=$p.Id} | ConvertTo-Json -Compress | Set-Content -LiteralPath $d.statusFile -Encoding UTF8
+} catch { @{ok=$false;error=$_.Exception.Message} | ConvertTo-Json -Compress | Set-Content -LiteralPath $d.statusFile -Encoding UTF8; exit 1 }
+`;
+  const encoded = Buffer.from(child, 'utf16le').toString('base64');
+  return `$ErrorActionPreference = 'Stop'
+$target = $env:OPENZOO_PACKAGED_APP
+$match = $null
+foreach ($pkg in (Get-AppxPackage | Where-Object { $_.Name -match 'OpenAI|ChatGPT|Codex' })) {
+  $manifest = Get-AppxPackageManifest -Package $pkg.PackageFullName
+  foreach ($entry in $manifest.Package.Applications.Application) {
+    if ($entry.Executable -and ((Join-Path $pkg.InstallLocation $entry.Executable) -eq $target)) {
+      $match = @{family=$pkg.PackageFamilyName;id=[string]$entry.Id}
+      break
+    }
+  }
+  if ($match) { break }
+}
+if (!$match) { throw 'The ChatGPT package registration could not be found. Repair ChatGPT in Windows Settings and try again.' }
+Invoke-CommandInDesktopPackage -PackageFamilyName $match.family -AppId $match.id -Command "$PSHOME\\powershell.exe" -Args '-NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand ${encoded}' -PreventBreakaway | Out-Null
+$deadline = [DateTime]::UtcNow.AddSeconds(25)
+while (!(Test-Path -LiteralPath $env:OPENZOO_LAUNCH_STATUS)) {
+  if ([DateTime]::UtcNow -gt $deadline) { throw 'ChatGPT did not confirm startup. Close ChatGPT and try Launch again.' }
+  Start-Sleep -Milliseconds 200
+}
+$result = Get-Content -LiteralPath $env:OPENZOO_LAUNCH_STATUS -Raw | ConvertFrom-Json
+if (!$result.ok) { throw $result.error }
+Write-Output $result.pid
+`;
+}
+
+export async function launchWindowsPackage(app, args, { env, run }) {
+  const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'openzoo-launch-'));
+  const statusFile = path.join(scratch, 'status.json');
+  try {
+    const commandLine = [`--user-data-dir=${env.CODEX_ELECTRON_USER_DATA_PATH}`, ...args].map(windowsArgument).join(' ');
+    await run('powershell.exe', ['-NoProfile', '-NonInteractive', '-WindowStyle', 'Hidden', '-Command',
+      packagedLaunchScript({ app, args: commandLine, env, statusFile })],
+    { windowsHide: true, env: { ...env, OPENZOO_PACKAGED_APP: app, OPENZOO_LAUNCH_STATUS: statusFile } });
+  } finally { fs.rmSync(scratch, { recursive: true, force: true }); }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.51.16",
+  "version": "0.51.17",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",