openzoo 0.51.18 → 0.51.19

package/README.md

@@ -230,6 +230,14 @@ Pin the key with `OPENZOO_TUNNEL_TOKEN` if your IDE stores it. Keys never leave
 
 **MCP clients don't need any of this.** If your tool speaks MCP, use the hosted server at `https://mcp.openzoo.fun/mcp` — cloud-reachable, no local process, mint a wallet with `zoo_wallet`.
 
+## Memory authentication
+
+Every memory request uses a wallet-signed namespace. Signing errors stop the request; unsigned requests and the shared default bucket are rejected by the gateway. Voice and Sonar now use that same gateway, including scored recall. Re-ingest contexts previously stored in a local daemon or the old shared bucket.
+
+The gateway signs each storage request over its exact payload, route, timestamp, tenant and context. The backing store verifies that proof and retains signed receipts with saved contexts or the tenant's memory notes. Signing authenticates access and integrity; it does not encrypt uploaded text. Never include private keys in an uploaded corpus.
+
+Public proxy tunnels require the configured token for memory and inference. Arbitrary first-use tokens and anonymous binds are no longer accepted. Quote discovery uses an unfunded signing identity so it cannot consume the operator's credit.
+
 ## The wallet model
 
 - **Burner, local, yours.** A keypair in `~/.openzoo/wallet.json`, created on first run, chmod 600. Keys never leave your machine — the zoo only ever sees signed transfers.

package/lib/config.js

@@ -207,9 +207,10 @@ export function unfundableRails(liveRailNames) {
  * currently offering are reported separately so nobody funds a dead lane.
  */
 export async function liveRails() {
+  const { withQuoteNamespace } = await import('./namespace.js');
   const r = await fetchHeaders(`${config.apiBase}/v1/chat/completions`, {
     method: 'POST',
-    headers: { 'content-type': 'application/json' },
+    headers: withQuoteNamespace({ 'content-type': 'application/json' }),
     body: JSON.stringify({ model: 'nvidia/nemotron-3.5-lightning', messages: [{ role: 'user', content: 'ping' }], max_tokens: 1 }),
   });
   if (r.status !== 402) { await r.text().catch(() => {}); return null; }

package/lib/demo.js

@@ -1,3 +1,4 @@
+import { withNamespace } from './namespace.js';
 import { config, fundingLine } from './config.js';
 import { PayClient, UnderfundedError } from './pay.js';
 import { parse402, pickAccept, tokenBalance } from './x402.js';
@@ -38,7 +39,7 @@ async function quoteFor(bodyObj, headers = {}) {
   const spin = startSpinner(big ? `uploading ${mb}MB body` : 'asking the zoo for a live quote');
   try {
     const r = await postWithUploadSignal(`${config.apiBase}/v1/chat/completions`, body, {
-      headers,
+      headers: withNamespace(headers),
       onUploaded: () => { if (big) spin.update(`zoo pricing ~${approxTokens}k tokens`); },
     });
     if (r.status !== 402) throw new Error(`expected 402 quote, got HTTP ${r.status}: ${(await r.text()).slice(0, 300)}`);

package/lib/info.js

@@ -62,10 +62,11 @@ export async function quotedPrices() {
     // that number.
     //
     // The chat challenge prices each asset at its real spot (DexScreener), and
-    // needs no namespace signature, so it is both correct and simpler.
+    // uses an unfunded signing identity so discovery cannot spend wallet credit.
+    const { withQuoteNamespace } = await import('./namespace.js');
     const r = await fetchHeaders(`${config.apiBase}/v1/chat/completions`, {
       method: 'POST',
-      headers: { 'content-type': 'application/json' },
+      headers: withQuoteNamespace({ 'content-type': 'application/json' }),
       body: JSON.stringify({ model: config.defaultModel || 'anthropic/claude-sonnet-5', max_tokens: 1, messages: [{ role: 'user', content: 'x' }] }),
     });
     if (r.status !== 402) return out;

package/lib/namespace.js

@@ -1,4 +1,5 @@
 import crypto from 'node:crypto';
+import { Keypair } from '@solana/web3.js';
 import { loadOrCreateWallet } from './wallet.js';
 
 /**
@@ -59,22 +60,16 @@ import { loadOrCreateWallet } from './wallet.js';
  * requests across time. A value every caller sends identically discloses
  * nothing at all.
  *
- * BREAKING: corpora bound under the old per-wallet namespace live in a
- * different tenant and will not be found. The gateway's tenantsToTry fallback
- * reaches pre-existing context ids by id, but anything relying on the old
- * namespace should be re-bound.
+ * BREAKING: old namespaces stay isolated. Re-bind their corpora under the
+ * authenticated namespace; there is no shared-memory fallback.
  */
 export const STACC_NAMESPACE = 'stacc';
 
 export function namespaceHeaderValue(wallet) {
-  try {
-    // Still require a wallet: the namespace is meaningless without a signer to
-    // prove it, and sending one unsigned drops you into the SHARED tenant.
-    if (!wallet?.keypair) loadOrCreateWallet();
-    return STACC_NAMESPACE;
-  } catch {
-    return ''; // no wallet (read-only use): fall back to the shared tenant
-  }
+  // A failed signer must fail the operation; never send an unsigned request.
+  if (wallet !== undefined && !wallet?.keypair) throw new Error('The supplied wallet cannot sign.');
+  if (!wallet?.keypair) loadOrCreateWallet();
+  return STACC_NAMESPACE;
 }
 
 /**
@@ -121,11 +116,14 @@ function signNamespace(namespace, wallet) {
 /** Merge the namespace header — and its proof — into any headers object. */
 export function withNamespace(headers = {}, wallet) {
   const ns = namespaceHeaderValue(wallet);
-  if (!ns) return headers;
-  // No unsigned fallback. The gateway REQUIRES the signature, so a bare
-  // namespace buys nothing — it would just be silently demoted to the shared
-  // tenant, which looks like "my corpus vanished" instead of a clear failure.
-  return { ...headers, 'x-openzoo-namespace': ns, ...signNamespace(ns, wallet) };
+  if (!ns) throw new Error('A wallet-signed namespace is required; shared memory is disabled.');
+  // The gateway rejects an unsigned namespace. Signing failure must stop
+  // the operation locally instead of sending an unauthenticated request.
+  const clean = Object.fromEntries(new Headers(headers).entries());
+  for (const name of Object.keys(clean)) {
+    if (name === 'x-openzoo-session' || name.startsWith('x-openzoo-namespace')) delete clean[name];
+  }
+  return { ...clean, 'x-openzoo-namespace': ns, ...signNamespace(ns, wallet) };
 }
 
 // Bitcoin-alphabet base58, matching what the gateway's bs58 decode expects.
@@ -147,3 +145,8 @@ function base58encode(bytes) {
   for (let i = digits.length - 1; i >= 0; i--) out += B58[digits[i]];
   return out;
 }
+
+/** Price discovery must never consume the operator's existing gateway credit. */
+export function withQuoteNamespace(headers = {}) {
+  return withNamespace(headers, { keypair: Keypair.generate() });
+}

package/lib/pay.js

@@ -426,7 +426,7 @@ export class PayClient {
     onStage?.('paying');
     let response = await fetchHeaders(url, {
       ...init,
-      headers: { ...stripAuthorization(init.headers || {}), ...paymentHeaders(payment.header) },
+      headers: withNamespace({ ...stripAuthorization(init.headers || {}), ...paymentHeaders(payment.header) }, { keypair: this.keypair }),
     });
 
     // A REFUSED ATOMIC ROW MUST NOT TAKE THE WHOLE CALL DOWN.
@@ -450,7 +450,7 @@ export class PayClient {
           const retry = await this.buildPaymentFor(cand, onStage, quote);
           const again = await fetchHeaders(url, {
             ...init,
-            headers: { ...stripAuthorization(init.headers || {}), ...paymentHeaders(retry.header) },
+            headers: withNamespace({ ...stripAuthorization(init.headers || {}), ...paymentHeaders(retry.header) }, { keypair: this.keypair }),
           });
           if (again.status !== 402) {
             accept = cand; payment = retry; response = again;

package/lib/proxy.js

@@ -640,7 +640,7 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     // Requests that arrived over the public quick-tunnel URL carry cloudflared's
     // headers; nothing dialing 127.0.0.1 directly does. That distinction is what
     // lets localhost stay keyless while the SAME port is safely public.
-    const viaTunnel = !requireToken && tunnelGate
+    const viaTunnel = !requireToken
       && Boolean(req.headers['cf-connecting-ip'] || req.headers['cf-ray']);
     // Auth first: refuse before reading a body, forwarding, quoting or paying.
     if (requireToken) {
@@ -709,7 +709,7 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
           upstream: config.apiBase,
           payment: 'x402 per request from the operator\'s local burner wallet - no API key, no account',
           auth: viaTunnel
-            ? 'this public URL requires the oz_… bearer for paid endpoints; /v1/models and /v1/hrr/bind are free'
+            ? 'this public URL requires the configured oz_… bearer for memory and inference; /v1/models is public'
             : 'localhost is keyless',
           shim: 'pure passthrough — request bodies are forwarded byte-for-byte; all message/model handling is on the backend',
           tools: ['zoo_bind', 'zoo_ask', 'zoo_status', 'zoo_models', 'zoo_wallet', 'zoo_contexts'],
@@ -721,21 +721,8 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
 
     if (viaTunnel) {
       const got = (req.headers.authorization || '').replace(/^Bearer\s+/i, '').trim();
-      // TRUST ON FIRST USE, so a stale key still works without weakening the
-      // tunnel to "any key forever". The printed token always works, and the
-      // FIRST other key to present itself claims the tunnel for the session.
-      // OPENZOO_TUNNEL_STRICT=1 restores exact-match only.
-      const strict = process.env.OPENZOO_TUNNEL_STRICT === '1';
-      let authed = got === tunnelGate.token;
-      if (!authed && !strict && got.length >= 8) {
-        if (!tunnelGate.adopted) {
-          tunnelGate.adopted = got;
-          log(`public url: adopted the caller's key (first-use) — later keys must match it`);
-          authed = true;
-        } else {
-          authed = got === tunnelGate.adopted;
-        }
-      }
+      // Only the configured token authorizes signing with the operator's wallet.
+      const authed = Boolean(tunnelGate?.token) && got === tunnelGate.token;
       const p = (req.url || '').split('?')[0];
       // DISCOVERY IS FREE. Reads that cost nothing and leak nothing go through
       // without the key; money paths stay gated.
@@ -759,9 +746,7 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
         // paths below stay gated; the worst a stranger can do here is spend
         // the sidecar's disk.
         const freeRead = req.method === 'GET' && (p === '/v1/models' || p.startsWith('/v1/models/'));
-        const freeBind = req.method === 'POST' && p === '/v1/hrr/bind';
-        if (freeBind) log(`public url: unauthenticated bind allowed (free endpoint) from ${req.socket.remoteAddress}`);
-        if (!freeRead && !freeBind) {
+        if (!freeRead) {
           log(`public url: 401 ${req.method} ${req.url}`);
           jsonErr(res, 401, 'unauthorized: this openzoo public URL requires the api key printed at the operator\'s proxy startup — GET / for discovery, GET /v1/models is open');
           return;

package/lib/sonar.js

@@ -38,6 +38,7 @@ import crypto from 'node:crypto';
 import { PublicKey } from '@solana/web3.js';
 import { loadDotenv } from './dotenv.js';
 import { config } from './config.js';
+import { withNamespace } from './namespace.js';
 
 // Before config.js is consulted, so OPENZOO_RPC from .env wins over the
 // public default without anyone pasting a credentialed URL onto a
@@ -1588,9 +1589,6 @@ export function vocabularyFor(combo) {
  * Every recalled name is still verified by hashing, so a bad recall costs
  * a few microseconds and never a wrong answer.
  */
-const LECORE = process.env.OPENZOO_LECORE_URL || 'http://127.0.0.1:8787';
-const LECORE_TOKEN = process.env.OPENZOO_LECORE_TOKEN || 'hrr-lab-token';
-const LECORE_TENANT = process.env.OPENZOO_LECORE_TENANT || 'claude-code';
 
 export async function bindCorpus({ log = () => {}, sample = 0 } = {}) {
   let comps = { archetypes: [] };
@@ -1616,11 +1614,10 @@ export async function bindCorpus({ log = () => {}, sample = 0 } = {}) {
   let contextId = null;
   const BATCH = 500;
   for (let i = 0; i < items.length; i += BATCH) {
-    const res = await fetch(`${LECORE}/internal/v1/hrr/bind`, {
+    const res = await fetch(`${config.apiBase}/v1/hrr/bind`, {
       method: 'POST',
-      headers: { 'content-type': 'application/json', authorization: `Bearer ${LECORE_TOKEN}` },
+      headers: withNamespace({ 'content-type': 'application/json' }),
       body: JSON.stringify({
-        tenant_id: LECORE_TENANT,
         items: items.slice(i, i + BATCH),
         ...(contextId ? { context_id: contextId } : {}),
       }),
@@ -1643,10 +1640,10 @@ export async function recallVocabulary(query, { topK = 24 } = {}) {
   const ctx = lecoreContext();
   if (!ctx) return [];
   try {
-    const res = await fetch(`${LECORE}/internal/v1/hrr/recall`, {
+    const res = await fetch(`${config.apiBase}/v1/hrr/recall`, {
       method: 'POST',
-      headers: { 'content-type': 'application/json', authorization: `Bearer ${LECORE_TOKEN}` },
-      body: JSON.stringify({ tenant_id: LECORE_TENANT, context_id: ctx, query, top_k: topK }),
+      headers: withNamespace({ 'content-type': 'application/json' }),
+      body: JSON.stringify({ context_id: ctx, query, top_k: topK }),
     });
     if (!res.ok) return [];
     const items = (await res.json()).items || [];

package/lib/voice.js

@@ -13,8 +13,7 @@
  * TIERED CONTEXTS, CASCADED RETRIEVAL (leCore's retrieval_dispatch shape):
  * the corpus binds into progressively larger tiers — cream (best few
  * thousand turns), telegram (all of it), twitter (all of it) — and every
- * bind lands TWICE: on the gateway (attachable via x-hrr-context) and on
- * the local leCore daemon (scored recall). A rewrite recalls against
+ * bind uses the authenticated gateway for both text and scored item recall. A rewrite recalls against
  * cream first; when the top-1/top-2 margin says the match is ambiguous,
  * it ESCALATES into the full tiers and fuses. Exemplars go inline; the
  * gateway context rides as x-hrr-context only when the daemon is down.
@@ -29,6 +28,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { splitIntoParts } from './bindpath.js';
 import { config } from './config.js';
+import { withNamespace } from './namespace.js';
 
 /**
  * VOICE CALLS ARE SLOW CALLS, AND THE DEFAULT TIMEOUT ASSUMES THEY ARE NOT.
@@ -44,9 +44,6 @@ if (!process.env.OPENZOO_UPSTREAM_HEADERS_MS) {
 }
 
 const GATEWAY = config.apiBase;
-const DAEMON = process.env.OPENZOO_LECORE_URL || 'http://127.0.0.1:8787';
-const DAEMON_TOKEN = process.env.OPENZOO_LECORE_TOKEN || 'hrr-lab-token';
-const DAEMON_TENANT = process.env.OPENZOO_LECORE_TENANT || 'claude-code';
 
 const STATE_FILE = process.env.OPENZOO_VOICE_STATE || path.join(os.homedir(), '.openzoo', 'voice.json');
 const CARD_FILE = process.env.OPENZOO_VOICE_CARD || path.join(os.homedir(), '.openzoo', 'voice-card.md');
@@ -217,7 +214,7 @@ async function bindGateway(corpus, log, label) {
   for (let i = 0; i < parts.length; i++) {
     const r = await fetch(`${GATEWAY}/v1/hrr/bind`, {
       method: 'POST',
-      headers: { 'content-type': 'application/json' },
+      headers: withNamespace({ 'content-type': 'application/json' }),
       body: JSON.stringify(contextId ? { context_id: contextId, corpus: parts[i] } : { corpus: parts[i] }),
     });
     if (!r.ok) throw new Error(`gateway bind ${label} ${i + 1}/${parts.length}: HTTP ${r.status}`);
@@ -228,7 +225,9 @@ async function bindGateway(corpus, log, label) {
 }
 
 /**
- * Local daemon bind — what makes SCORED recall (and the cascade) possible.
+ * Scored item bind through the wallet-authenticated gateway.
+ * Legacy daemonCtx state fields now refer to private gateway contexts;
+ * old daemon contexts must be re-ingested.
  *
  * ONE ITEM PER TURN, deliberately: the daemon indexes discrete items, so a
  * turn stays whole and recall returns something imitable. Chunking a
@@ -247,11 +246,10 @@ async function bindDaemon(turns, log, label) {
         text: renderTurn(t),
         metadata: { source: t.source, where: t.where, when: t.when },
       }));
-      const r = await fetch(`${DAEMON}/internal/v1/hrr/bind`, {
+      const r = await fetch(`${config.apiBase}/v1/hrr/bind`, {
         method: 'POST',
-        headers: { 'content-type': 'application/json', authorization: `Bearer ${DAEMON_TOKEN}` },
+        headers: withNamespace({ 'content-type': 'application/json' }),
         body: JSON.stringify({
-          tenant_id: DAEMON_TENANT,
           items,
           ...(contextId ? { context_id: contextId } : {}),
         }),
@@ -374,10 +372,10 @@ export async function distillStyleCard(turns, log = () => {}) {
 // ---------------------------------------------------------------- recall
 
 async function daemonRecall(contextId, query, topK) {
-  const r = await fetch(`${DAEMON}/internal/v1/hrr/recall`, {
+  const r = await fetch(`${config.apiBase}/v1/hrr/recall`, {
     method: 'POST',
-    headers: { 'content-type': 'application/json', authorization: `Bearer ${DAEMON_TOKEN}` },
-    body: JSON.stringify({ tenant_id: DAEMON_TENANT, context_id: contextId, query, top_k: topK }),
+    headers: withNamespace({ 'content-type': 'application/json' }),
+    body: JSON.stringify({ context_id: contextId, query, top_k: topK }),
   });
   if (!r.ok) throw new Error(`recall HTTP ${r.status}`);
   return (await r.json()).items || [];

package/lib/xbot.js

@@ -22,6 +22,7 @@ import os from 'node:os';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { FUNDING_ASSETS } from './config.js';
+import { withNamespace, withQuoteNamespace } from './namespace.js';
 import { deriveBurner } from './xburner.js';
 
 const GATEWAY = process.env.OPENZOO_GATEWAY || 'https://x402-tokens.fly.dev';
@@ -214,7 +215,7 @@ async function openzooFacts() {
   try {
     const r = await fetch(`${GATEWAY}/v1/chat/completions`, {
       method: 'POST',
-      headers: { 'content-type': 'application/json' },
+      headers: withQuoteNamespace({ 'content-type': 'application/json' }),
       body: JSON.stringify({ model: 'openai/gpt-4o-mini', max_tokens: 1, messages: [{ role: 'user', content: 'hi' }] }),
     });
     const j = await r.json().catch(() => ({}));
@@ -269,7 +270,7 @@ export async function ensureSharedContext(state) {
   const facts = await openzooFacts();
   const res = await fetch(`${GATEWAY}/v1/hrr/bind`, {
     method: 'POST',
-    headers: { 'content-type': 'application/json' },
+    headers: withNamespace({ 'content-type': 'application/json' }),
     body: JSON.stringify({ corpus: `openzoobot shared corpus. Threads the bot reads are appended here.\n\n${facts}` }),
   });
   if (!res.ok) throw new Error(`bind ${res.status}: ${(await res.text()).slice(0, 160)}`);
@@ -661,7 +662,7 @@ export async function seedFromMentions(creds, contextId, { maxPages = 10 } = {})
 
     const b = await fetch(`${GATEWAY}/v1/hrr/bind`, {
       method: 'POST',
-      headers: { 'content-type': 'application/json' },
+      headers: withNamespace({ 'content-type': 'application/json' }),
       body: JSON.stringify({ context_id: contextId, corpus }),
     });
     if (b.ok) {
@@ -796,7 +797,7 @@ export async function bindThread(contextId, chain, mention) {
   try {
     const res = await fetch(`${GATEWAY}/v1/hrr/bind`, {
       method: 'POST',
-      headers: { 'content-type': 'application/json' },
+      headers: withNamespace({ 'content-type': 'application/json' }),
       body: JSON.stringify({ context_id: contextId, corpus }),
     });
     if (!res.ok) return 0;
@@ -1080,14 +1081,14 @@ export async function askZoo(question, { key, maxTokens = ANSWER_TOKENS, thread
     call: async (body) => {
       const res = await fetch(`${FREE_GATEWAY}/v1/chat/completions`, {
         method: 'POST',
-        headers: {
+        headers: withNamespace({
           'content-type': 'application/json',
           // NO x-hrr-top-k. The gateway already scales breadth to the corpus
           // (scaleTopK), and a client-sent X-HRR-Top-K "wins over everything" —
           // pinning a number replaces a curve that grows with the thread.
           ...(contextId ? { 'x-hrr-context': contextId } : {}),
           ...(key ? { authorization: `Bearer ${key}` } : {}),
-        },
+        }),
         body: JSON.stringify(body),
       });
       const json = await res.json().catch(() => ({}));
@@ -1180,7 +1181,6 @@ const TOPUP_CAP_USD = Number(process.env.OPENZOO_XBOT_TOPUP_CAP || 500);
 
 export async function ensureCredit(burner) {
   const { PayClient } = await import('./pay.js');
-  const { withNamespace } = await import('./namespace.js');
   const ns = (h) => withNamespace(h, { keypair: burner.keypair });
 
   let balance = 0;
@@ -1258,9 +1258,9 @@ export async function askZooPaid(question, { burner, thread = '', maxTokens = AN
     messages,
     maxTokens,
     allowTools: Boolean(WEB_SEARCH),
-    // Same shared context as the free lane — a paid asker should recall
-    // everything the bot has read, not start from an empty corpus.
-    call: async (body) => (await pay.chat(body, { headers: contextId ? { 'x-hrr-context': contextId } : {} })).data,
+    // The operator's archive belongs to its signer. Burner calls use only
+    // the explicitly supplied thread; they cannot attach that private context.
+    call: async (body) => (await pay.chat(body)).data,
   }).then((result) => ({
     ...result,
     // Every on-chain settle signature this answer paid with, so the PAID log

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.51.18",
+  "version": "0.51.19",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",