openzoo 0.51.29 → 0.51.31

package/README.md

@@ -191,10 +191,12 @@ Manage it:
 
 ```bash
 npx openzoo contexts                  # list bound corpora (hash, context id, age, api base)
-npx openzoo contexts --forget 60464d  # drop one by hash prefix
-npx openzoo contexts --forget all     # drop everything
+npx openzoo contexts --forget 60464d  # erase one by hash prefix (on the zoo AND locally)
+npx openzoo contexts --forget all     # erase everything you have bound
 ```
 
+**Retention.** A bound corpus is a cache of your own prompt, not a record. The zoo keeps it for **24 hours after its last use** (every recall refreshes the clock) and then deletes it — `state`, text blobs and delta chunks — from disk. `--forget` sends a wallet-signed `DELETE /v1/contexts/:id` for each matching context and only then drops it from the local manifest, so you can erase earlier than the TTL and only the wallet that bound a context can erase it. Stored text is compressed, not encrypted; see the security note below.
+
 Opt out with `OPENZOO_NO_CONTEXT_CACHE=1` (always ship the full body); tune the threshold with `OPENZOO_CONTEXT_MIN_CHARS` (default 16384 chars).
 
 ## Using openzoo from a cloud IDE (Cursor, Windsurf, hosted agents)
@@ -283,7 +285,7 @@ The rail is chosen from the 402's `accepts[]` itself (Solana first). **Steer it
 | `OPENZOO_RPC` | mainnet-beta public RPC | Solana RPC |
 | `OPENZOO_TOKEN` | (internal) | preferred 402 rail — leave unset |
 | `OPENZOO_RAIL` | (unset) | force a rail: `solana` \| `base` \| `robinhood`. Errors if the live 402 doesn't offer it |
-| `OPENZOO_BASE_RPC` | `https://mainnet.base.org` | Base RPC (balances / preflight) |
+| `OPENZOO_BASE_RPC` | `https://base-rpc.publicnode.com` | Base RPC (balances / preflight) |
 | `OPENZOO_RH_RPC` | `https://rpc.mainnet.chain.robinhood.com` | Robinhood Chain RPC (balances / preflight) |
 | `OPENZOO_WALLET` | `~/.openzoo/wallet.json` | wallet path |
 | `OPENZOO_MAX_USD_PER_CALL` | `0.5` | refuse quotes above this |

package/bin/openzoo.js

@@ -295,12 +295,17 @@ async function main() {
       await (await import('../lib/demo.js')).runDemo();
       break;
     case 'contexts': {
-      const { listContexts, forgetContexts } = await import('../lib/contexts.js');
+      const { listContexts, forgetContextsRemote } = await import('../lib/contexts.js');
       const fi = process.argv.indexOf('--forget');
       if (fi !== -1) {
         const sel = process.argv[fi + 1];
         if (!sel) throw new Error('usage: openzoo contexts --forget <hash-prefix|all>');
-        console.log(`forgot ${forgetContexts(sel)} context(s)`);
+        const r = await forgetContextsRemote(sel);
+        console.log(`forgot ${r.removed} context(s): ${r.deleted} erased on the zoo`);
+        for (const f of r.failed) {
+          console.error(`  ! ${f.context_id} @ ${f.apiBase}: HTTP ${f.status} ${f.body}`.trimEnd());
+        }
+        if (r.failed.length) process.exitCode = 1;
         break;
       }
       const all = listContexts();

package/lib/config.js

@@ -20,7 +20,7 @@ export const config = {
   // pickAccept errors clearly when the live 402 does not offer the forced rail.
   rail: (process.env.OPENZOO_RAIL || '').toLowerCase() || null,
   // EVM RPCs for balance reads / preflight checks on the Base and RH rails.
-  baseRpcUrl: process.env.OPENZOO_BASE_RPC || 'https://mainnet.base.org',
+  baseRpcUrl: process.env.OPENZOO_BASE_RPC || 'https://base-rpc.publicnode.com',
   rhRpcUrl: process.env.OPENZOO_RH_RPC || 'https://rpc.mainnet.chain.robinhood.com',
   walletPath: process.env.OPENZOO_WALLET || path.join(os.homedir(), '.openzoo', 'wallet.json'),
   // Refuse to auto-pay any single 402 quote above this many USD (extra.billedUsd).

package/lib/contexts.js

@@ -100,3 +100,41 @@ export function forgetContexts(selector) {
   if (removed) save(map);
   return removed;
 }
+
+/**
+ * Forget for real: tell each gateway to delete the bound context, THEN drop
+ * it from the local manifest. Returns { removed, deleted, failed }.
+ *
+ * `--forget` used to edit only ~/.openzoo/contexts.json, which made the next
+ * ask re-upload while the corpus sat on the zoo's sidecar untouched. That is
+ * not forgetting. DELETE /v1/contexts/:id is free and wallet-signed with the
+ * same namespace proof that bound the context, so only the owner can erase.
+ * The local entry is dropped even when the gateway call fails — the caller
+ * asked us to stop reusing it — and the failure is reported, not hidden.
+ */
+export async function forgetContextsRemote(selector, { fetchImpl = globalThis.fetch } = {}) {
+  const { withNamespace } = await import('./namespace.js');
+  const map = load();
+  const targets = [];
+  for (const [apiBase, entries] of Object.entries(map)) {
+    for (const [hash, e] of Object.entries(entries)) {
+      if (selector === 'all' || hash.startsWith(selector)) targets.push({ apiBase, hash, context_id: e.context_id });
+    }
+  }
+  let deleted = 0;
+  const failed = [];
+  for (const t of targets) {
+    try {
+      const r = await fetchImpl(`${t.apiBase}/v1/contexts/${encodeURIComponent(t.context_id)}`, {
+        method: 'DELETE',
+        headers: withNamespace(),
+      });
+      if (r.status === 200) deleted += 1;
+      else failed.push({ ...t, status: r.status, body: (await r.text().catch(() => '')).slice(0, 200) });
+    } catch (err) {
+      failed.push({ ...t, status: 0, body: String(err?.message || err) });
+    }
+  }
+  const removed = forgetContexts(selector);
+  return { removed, deleted, failed };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.51.29",
+  "version": "0.51.31",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",