openzoo 0.51.4 → 0.51.6

package/README.md

@@ -25,7 +25,18 @@ paid $0.002137 (9.5× cheaper than direct) · rail solana · tx 5Kd…
 
 **Claude Code / grokui Auto** — `openzoo claude` sets the Anthropic API key + base URL to the local OpenZoo proxy (x402 pay-per-call). You do **not** need to authenticate Claude first. grokui orange Auto is this harness, not a `RUN:` text parser. PATH `~/.local/bin` is required on Mac so `claude` is found.
 
-**ChatGPT desktop (official Linux/macOS/Windows app)** — `openzoo chatgpt` puts the zoo in as the Codex provider in `~/.codex/config.toml`, starts a proxy if none is up, and launches the app; choose **sign in with API key** (any key) and the Codex / agent side pays x402 per turn. The plain ChatGPT chat tab still talks to chatgpt.com — it is not API-shaped. On Arch or anything without dpkg, `openzoo chatgpt --deb ~/Downloads/chatgpt_amd64.deb` unpacks the official .deb into `~/.openzoo/apps/chatgpt` and runs it from there (a `chatgpt*.deb` in `~/Downloads` is found automatically). `--no-launch` writes config only; `--print` shows the block.
+**ChatGPT desktop (official macOS/Windows/Linux app)** — `openzoo chatgpt` configures the zoo, reuses an installed Codex-enabled ChatGPT app or downloads and installs the current official build for your platform/architecture, starts a background proxy, and launches the app. No TryOmarchy dependency. Choose **sign in with API key** (`sk-openzoo`) if prompted. The Codex side pays x402 per turn from your OpenZoo wallet; ordinary ChatGPT chats still use chatgpt.com.
+
+- **macOS (Apple Silicon / Intel):** installs the official DMG into `~/Applications/ChatGPT.app`, verifies its signature, then launches through macOS LaunchServices. Requires a supported macOS version (currently 14+).
+- **Windows (ARM64 / x64):** installs the current official Store-signed MSIX using PowerShell `Add-AppxPackage`, then discovers its executable from the installed package manifest. Windows app-installation policies and package prerequisites still apply.
+- **Linux (ARM64 / x64):** downloads the official `.deb` and unpacks it under `~/.openzoo/apps/chatgpt`, without sudo or dpkg. Requires `bsdtar` or `ar`, plus `tar` and the desktop runtime libraries required by ChatGPT. Ubuntu/Debian/Fedora are upstream-supported; other distributions depend on compatible libraries. `--deb <file>` uses a local package when no app is installed.
+
+Configuration defaults to `~/.openzoo/chatgpt/config.toml`, with a separate desktop profile. `CODEX_HOME` overrides that location; `--config /path/to/config.toml` also sets the home used at launch. Unrelated config tables are retained, and the first existing config is saved as `config.toml.openzoo-backup`. Installed apps are reused, not upgraded by this command. Use the app's updater for later updates.
+
+`--model <id>` overrides `deepseek-v4-flash`; `--bearer` stores the non-secret placeholder token instead of requiring an environment variable. `--no-launch` writes config only (no download, install, proxy, or launch); `--no-proxy` skips proxy startup; `--print` previews without side effects. Pass app flags after `--`, for example `openzoo chatgpt -- --ozone-platform=wayland`. `OPENZOO_CHATGPT_BIN` selects an explicit executable. Failed downloads, installation, or launch commands return an error.
+
+Installer references: [ChatGPT downloads](https://chatgpt.com/download/), [Windows MSIX deployment](https://learn.chatgpt.com/docs/enterprise/windows-deployment), [Linux packages](https://learn.chatgpt.com/docs/linux/linux-app).
+
 
 **Agent of Empires** (tmux session manager for coding agents, [agent-of-empires](https://github.com/agent-of-empires/agent-of-empires)) — `openzoo aoe` registers an `openzoo` agent in aoe's `config.toml` (`[session.custom_agents] openzoo = "openzoo claude"`, detected as `claude` so status hooks, resume and fork all work), starts a background proxy if none is listening (no public tunnel unless `--tunnel`), then runs `aoe`. `openzoo aoe add . -l` creates and launches one session in the current directory; in the TUI pick **openzoo** from the agent picker. `Alt+z` opens a tool session with the wallet balance and the live receipts log. Terminal view only: aoe's structured view runs `claude-agent-acp` itself, which bills Anthropic, not the zoo. `--override-claude` additionally makes aoe's built-in `claude` agent launch through openzoo; `--no-launch` writes config only.
 

package/bin/openzoo.js

@@ -146,16 +146,17 @@ usage:
                          voice login / voice watch      PREHOOK your own outgoing Telegram
                                messages: type raw, the watcher revises in place (userbot;
                                "." prefix sends raw). X has no edit API — no equivalent.
-  npx openzoo chatgpt    OpenAI's ChatGPT desktop app on the zoo. Writes the zoo as
-                         the Codex provider in ~/.codex/config.toml (other tables kept,
-                         old file backed up), starts a background proxy if none is up,
-                         and launches the app — the Codex / agent side pays x402 per
-                         turn; pick "sign in with API key" (any key). The plain chat
-                         tab still talks to chatgpt.com.
-                         Arch / no dpkg: --deb ~/Downloads/chatgpt_amd64.deb unpacks it
-                         (a chatgpt*.deb in ~/Downloads is picked up automatically)
-                         --model <id> (claude-opus-5) --wire responses|chat --bearer
+  npx openzoo chatgpt    Configure, install if missing, and launch official ChatGPT
+                         on macOS / Windows / Linux (x64 / ARM64), no TryOmarchy.
+                         Downloads current official DMG / MSIX / .deb as needed.
+                         Uses ~/.openzoo/chatgpt/config.toml (or CODEX_HOME), keeps
+                         other tables and the original backup, starts a local proxy.
+                         Codex / agent mode pays x402; plain chat uses chatgpt.com.
+                         Choose "sign in with API key" (sk-openzoo) if prompted.
+                         --deb <file> (Linux) --config /path/to/config.toml
+                         --model <id> (deepseek-v4-flash) --wire responses|chat --bearer
                          --no-launch (config only) --no-proxy --tunnel --print
+                         -- <app flags>
   npx openzoo openclaw   write the zoo into ~/.openclaw/openclaw.json as a model
                          provider WITH REAL PRICES (OpenClaw's own custom-provider
                          path hard-codes $0.00 and ignores /v1/models pricing)
@@ -179,23 +180,12 @@ usage:
   npx openzoo contexts --forget <hash|all>   drop manifest entries
   npx openzoo balance    wallet balance on every rail — Solana (USDC/TOKEN/SOL),
                          Base (USDC/ETH), Robinhood Chain (USDG/memecoins/ETH)
-  npx openzoo build [dir]     transmute a Vercel-shaped app (Next.js pages/api,
-                              app/**/route, Vite + api/*) for Solana. Default
-                              --target shared: bytecode for the shared zoo-vm
-                              runtime, no Rust toolchain, a site is data accounts
-                              (~0.03-0.1 SOL). --target program: own Pinocchio
-                              program per site (--arch v0|v3, ~1 SOL+)
-  npx openzoo deploy [dir]    deploy the site to Solana accounts (--cluster mainnet,
-                              --runtime <zoo-vm id> or OPENZOO_VM_PROGRAM, --yes to
-                              accept the rent estimate; burner wallet)
-  npx openzoo serve [site]    local gateway/explorer for a deployed site (--runtime,
-                              --cluster, --port 4402); /api/* reads are free
-                              simulations, writes are signed by the burner
-  npx openzoo runtime deploy  deploy the shared zoo-vm runtime once per cluster
-  npx openzoo inspect [dir]   print the app in Vercel terms + eligibility report
-  npx openzoo hub             hosted explorer for every transmuted site on the
-                              cluster (what sites.openzoo.fun runs)
   npx openzoo address    print both funding addresses (Solana + EVM)
+  npx openzoo model [id] pin the model every chat uses, whatever the app sends
+                         (no id = show it · reset|off = clear). Same override the
+                         chat command \`/model <id>\` sets from inside ChatGPT,
+                         Cursor or Claude Code — a running proxy picks it up
+                         without a restart.
   npx openzoo help       this text
 
 point any OpenAI-compatible harness at:
@@ -433,30 +423,15 @@ async function main() {
       if (bal <= 0) console.log('buy some with:  npx openzoo topup 10');
       break;
     }
-    case 'build':
-    case 'deploy':
-    case 'serve':
-    case 'inspect':
-    case 'hub':
-    case 'runtime':
-    case 'transmute': {
-      // VERCEL-SHAPED APP -> SOLANA MAINNET. `openzoo build|deploy|serve` hand
-      // the argv to openzoo-transmute (a sibling npm package): it reads the
-      // app the way `vercel build` would (pages/api, app/**/route, api/*,
-      // .vercel/output), transmutes each Lambda into a Pinocchio Rust program
-      // route, stores the static build in asset accounts, deploys with the
-      // burner wallet at ~/.openzoo/wallet.json, and `serve` runs the local
-      // gateway/explorer that maps http://localhost:4402/... onto the program.
-      const argv = process.argv.slice(2).map((a, i) => (i === 0 && a === 'transmute' ? 'help' : a));
-      // The transmuter ships inside this package (transmute/): lib/cli.js, the
-      // compiler, the gateway + hub and the on-chain runtime crate
-      // (transmute/runtime/zoo-host) all travel with npm — no second install.
-      await (await import('../transmute/lib/cli.js')).run(argv);
-      break;
-    }
     case 'address':
       (await import('../lib/info.js')).printAddress();
       break;
+    // Same override file the in-chat `/model` command writes. Two doors on one
+    // switch: a harness with no model picker (ChatGPT/Codex) uses the chat
+    // command, everyone else can just type it here.
+    case 'model':
+      await (await import('../lib/modelcommand.js')).cliModel(process.argv[3]);
+      break;
     case 'help':
     case '--help':
     case '-h':

package/lib/chatgpt-install.js

@@ -0,0 +1,106 @@
+/** Official current desktop installers; no third-party distribution service. */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+
+const CDN = 'https://persistent.oaistatic.com/codex-app-prod';
+export function installerAsset(platform = process.platform, arch = process.arch) {
+  if (!['x64', 'arm64'].includes(arch)) throw new Error(`ChatGPT has no installer for ${platform}/${arch}; see https://chatgpt.com/download/`);
+  if (platform === 'darwin') return { url: `${CDN}/${arch === 'x64' ? 'ChatGPT-latest-x64.dmg' : 'ChatGPT.dmg'}`, name: 'ChatGPT.dmg' };
+  if (platform === 'win32') return { url: `${CDN}/ChatGPT-${arch}.msix`, name: 'ChatGPT.msix' };
+  if (platform === 'linux') {
+    const name = `chatgpt_${arch === 'x64' ? 'amd64' : 'arm64'}.deb`;
+    return { url: `${CDN}/linux/deb/latest/${name}`, name };
+  }
+  throw new Error(`ChatGPT desktop is not available for ${platform}; see https://chatgpt.com/download/`);
+}
+
+export function runCommand(command, args, options = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, { stdio: ['ignore', 'pipe', 'pipe'], ...options });
+    let stdout = '', stderr = '';
+    child.stdout?.on('data', b => { stdout = (stdout + b).slice(-1024 * 1024); });
+    child.stderr?.on('data', b => { stderr = (stderr + b).slice(-8192); });
+    child.once('error', reject);
+    child.once('close', code => code === 0 ? resolve(stdout.trim()) : reject(new Error(`${command} exited ${code}: ${stderr.trim()}`)));
+  });
+}
+
+export async function downloadInstaller(url, file, fetchImpl = fetch) {
+  const partial = `${file}.part`;
+  try {
+    const response = await fetchImpl(url, { signal: AbortSignal.timeout(15 * 60_000) });
+    if (!response.ok || !response.body) throw new Error(`download failed (${response.status}): ${url}`);
+    if (/text\/html/.test(response.headers.get('content-type') || '')) throw new Error(`installer URL returned HTML: ${url}`);
+    await pipeline(Readable.fromWeb(response.body), fs.createWriteStream(partial, { flags: 'wx' }));
+    if (!fs.statSync(partial).size) throw new Error('downloaded installer is empty');
+    fs.renameSync(partial, file);
+  } finally {
+    fs.rmSync(partial, { force: true });
+  }
+}
+
+// Query the installed package manifest instead of guessing a versioned WindowsApps path.
+// The bundled Codex engine distinguishes the combined app from ChatGPT Classic.
+export async function windowsChatGptApp(run = runCommand) {
+  const script = `$ErrorActionPreference = 'Stop'
+Get-AppxPackage | Where-Object { $_.Name -match 'OpenAI|ChatGPT|Codex' } | ForEach-Object {
+  $pkg = $_
+  $manifest = Get-AppxPackageManifest -Package $pkg.PackageFullName
+  foreach ($entry in $manifest.Package.Applications.Application) {
+    if ($entry.Executable) {
+      $exe = Join-Path $pkg.InstallLocation $entry.Executable
+      if ((Test-Path -LiteralPath $exe) -and (Test-Path -LiteralPath (Join-Path (Split-Path $exe) 'resources/codex.exe'))) { Write-Output $exe }
+    }
+  }
+}`;
+  const output = await run('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script]);
+  return output.split(/\r?\n/).map(s => s.trim()).find(Boolean) || null;
+}
+
+export async function installChatGpt({ platform = process.platform, arch = process.arch, home = os.homedir(),
+  run = runCommand, download = downloadInstaller, unpack, findWindows = windowsChatGptApp, log = console.log } = {}) {
+  const asset = installerAsset(platform, arch);
+  const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'openzoo-chatgpt-'));
+  const file = path.join(scratch, asset.name);
+  try {
+    log(`downloading current ChatGPT for ${platform}/${arch} from ${asset.url}`);
+    await download(asset.url, file);
+    if (platform === 'linux') return unpack(file, path.join(home, '.openzoo', 'apps', 'chatgpt'));
+    if (platform === 'win32') {
+      // The path is passed through the environment, never interpolated into PowerShell code.
+      await run('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command',
+        "$ErrorActionPreference = 'Stop'; Add-AppxPackage -Path $env:OPENZOO_CHATGPT_INSTALLER"],
+      { env: { ...process.env, OPENZOO_CHATGPT_INSTALLER: file } });
+      const app = await findWindows(run);
+      if (!app) throw new Error('ChatGPT MSIX installed but its desktop executable was not found');
+      return app;
+    }
+    const mount = path.join(scratch, 'mount');
+    fs.mkdirSync(mount);
+    let mounted = false;
+    try {
+      await run('hdiutil', ['attach', '-nobrowse', '-readonly', '-mountpoint', mount, file]);
+      mounted = true;
+      const source = path.join(mount, 'ChatGPT.app');
+      // Let macOS validate the vendor signature before copying executable code.
+      await run('codesign', ['--verify', '--deep', '--strict', source]);
+      if (!fs.existsSync(path.join(source, 'Contents', 'Resources', 'codex'))) throw new Error('installer contains ChatGPT Classic, not the Codex-enabled desktop app');
+      const applications = path.join(home, 'Applications');
+      fs.mkdirSync(applications, { recursive: true });
+      const destination = path.join(applications, 'ChatGPT.app');
+      if (fs.existsSync(destination)) throw new Error(`${destination} already exists but is not usable; move it aside or set OPENZOO_CHATGPT_BIN`);
+      const staged = path.join(applications, `.openzoo-chatgpt-${process.pid}-${Date.now()}.app`);
+      try {
+        await run('ditto', [source, staged]);
+        fs.renameSync(staged, destination);
+      } finally { fs.rmSync(staged, { recursive: true, force: true }); }
+      return path.join(destination, 'Contents', 'MacOS', 'ChatGPT');
+    } finally {
+      if (mounted) await run('hdiutil', ['detach', mount]);
+    }
+  } finally { fs.rmSync(scratch, { recursive: true, force: true }); }
+}

package/lib/chatgpt.js

@@ -1,38 +1,17 @@
 /**
  * `npx openzoo chatgpt` — OpenAI's ChatGPT desktop app on the zoo.
  *
- * The Linux preview of the official app (chatgpt.com/download, August 2026)
- * ships the Codex engine inside it: `usr/lib/chatgpt/resources/codex`, and
- * `usr/bin/chatgpt` is a symlink named `codex-launcher`. That engine reads a
- * standard Codex config — `$CODEX_HOME/config.toml`, default `~/.codex` — and
- * its `[model_providers.<id>]` table is the supported way to point it at any
- * OpenAI-shaped server. MEASURED 2026-09-09 on the .deb's `codex` binary:
- * the strings `model_providers`, `env_key`, `requires_openai_auth`,
- * `experimental_bearer_token`, `responses` and `https://api.openai.com/v1`
- * (as a default, next to `ollama` and `amazon-bedrock`) are all there, and
- * a provider block pointed at :8402 answered in the app.
- *
- * What this does and does not redirect, so nobody is surprised:
- *   - the Codex / agent side of the app ("sign in with API key") → the zoo,
- *     paid per turn by x402 through the local proxy;
- *   - the plain ChatGPT conversation tab → still chatgpt.com. It talks to
- *     `chatgpt_base_url = "https://chatgpt.com/backend-api/"`, a private
- *     backend that is not API-shaped, so there is nothing to point at us.
- *   - the two auth modes are exclusive: the binary logs "ChatGPT login is
- *     required, but an API key is currently being used. Logging out." Pick
- *     API-key mode for the session that should pay x402.
- *
- * One command, end to end: write the provider into config.toml (backing up
- * the old file, keeping every other table), make sure a proxy is listening,
- * find the app — or unpack the downloaded .deb on a distro that cannot
- * install it, which is how this was first done on Arch — and launch it with
- * the env var the provider's `env_key` names.
+ * Configures an isolated Codex home, installs the current official app when
+ * missing, starts the local proxy and launches the app with that configuration.
+ * Custom provider routing applies to Codex; ordinary ChatGPT chats still use
+ * chatgpt.com. No TryOmarchy or third-party app distribution is involved.
  */
 import { spawn, spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { config } from './config.js';
+import { installChatGpt, windowsChatGptApp, runCommand } from './chatgpt-install.js';
 
 export const PROVIDER_ID = 'openzoo';
 export const API_KEY_ENV = 'OPENZOO_API_KEY';
@@ -48,8 +27,15 @@ export function codexConfigPath(env = process.env, home = os.homedir()) {
 }
 
 export function defaultModel(env = process.env) {
+  // DEEPSEEK BY DEFAULT. The person running `openzoo chatgpt` has not chosen
+  // a model and mostly will not: the default is what they pay for on every
+  // turn until they type /model. It used to be claude-opus-5, the most
+  // expensive door in the catalog, so the "much less spend" pitch shipped
+  // with the priciest setting turned on. deepseek-v4-flash is a fraction of
+  // a cent per million tokens in, carries a 1M-token window, and is a bare
+  // id the doors serve directly. Anyone who wants more says /model.
   // Bare ids are what the doors serve; the gateway resolves the rest.
-  return env.OPENZOO_DEFAULT_MODEL || 'claude-opus-5';
+  return env.OPENZOO_DEFAULT_MODEL || 'deepseek-v4-flash';
 }
 
 /**
@@ -113,7 +99,7 @@ export function mergeCodexConfig(existing, { model, port, wireApi, bearer } = {}
   });
   const head = [
     OUR_MARK,
-    `model = "${model || defaultModel()}"`,
+    `model = ${JSON.stringify(model || defaultModel())}`,
     `model_provider = "${PROVIDER_ID}"`,
   ];
   // trim blank padding so reruns do not accumulate empty lines
@@ -134,14 +120,15 @@ export function mergeCodexConfig(existing, { model, port, wireApi, bearer } = {}
 
 /** Candidate app binaries, most specific first. Exported for tests. */
 export function chatGptCandidates({ env = process.env, home = os.homedir(), platform = process.platform } = {}) {
+  const paths = platform === 'win32' ? path.win32 : path;
   const out = [];
   if (env.OPENZOO_CHATGPT_BIN) out.push(env.OPENZOO_CHATGPT_BIN);
   if (platform === 'darwin') {
     out.push('/Applications/ChatGPT.app/Contents/MacOS/ChatGPT');
     out.push(path.join(home, 'Applications', 'ChatGPT.app', 'Contents', 'MacOS', 'ChatGPT'));
   } else if (platform === 'win32') {
-    const local = env.LOCALAPPDATA || path.join(home, 'AppData', 'Local');
-    out.push(path.join(local, 'Programs', 'ChatGPT', 'ChatGPT.exe'));
+    const local = env.LOCALAPPDATA || paths.join(home, 'AppData', 'Local');
+    out.push(paths.join(local, 'Programs', 'ChatGPT', 'ChatGPT.exe'));
   } else {
     // the .deb's layout (apt install), then where THIS command unpacks it,
     // then the by-hand unpack path the first Arch run used
@@ -150,15 +137,21 @@ export function chatGptCandidates({ env = process.env, home = os.homedir(), plat
     out.push(path.join(unpackDir(home), 'usr', 'lib', 'chatgpt', 'ChatGPT'));
     out.push(path.join(home, 'apps', 'chatgpt', 'usr', 'lib', 'chatgpt', 'ChatGPT'));
   }
-  for (const dir of String(env.PATH || '').split(path.delimiter).filter(Boolean)) {
-    out.push(path.join(dir, platform === 'win32' ? 'chatgpt.exe' : 'chatgpt'));
+  for (const dir of String(env.PATH || '').split(platform === 'win32' ? ';' : ':').filter(Boolean)) {
+    out.push(paths.join(dir, platform === 'win32' ? 'chatgpt.exe' : 'chatgpt'));
   }
   return out;
 }
 
 export function resolveChatGptApp(opts = {}) {
   const exists = opts.exists || ((p) => { try { fs.accessSync(p, fs.constants.X_OK); return true; } catch { return false; } });
-  return chatGptCandidates(opts).find(exists) || null;
+  return chatGptCandidates(opts).find(p => {
+    if (!exists(p)) return false;
+    if ((opts.platform || process.platform) === 'darwin' && p.endsWith('/Contents/MacOS/ChatGPT')) {
+      return exists(path.resolve(path.dirname(p), '../Resources/codex'));
+    }
+    return true;
+  }) || null;
 }
 
 /** Where `--deb` (or an auto-found download) is unpacked. */
@@ -190,27 +183,35 @@ function have(bin) {
  */
 export function unpackDeb(deb, dest = unpackDir()) {
   if (!fs.existsSync(deb)) throw new Error(`no such file: ${deb}`);
-  fs.rmSync(dest, { recursive: true, force: true });
-  fs.mkdirSync(dest, { recursive: true });
+  fs.mkdirSync(path.dirname(dest), { recursive: true });
   const outer = fs.mkdtempSync(path.join(os.tmpdir(), 'openzoo-deb-'));
+  const staged = fs.mkdtempSync(path.join(path.dirname(dest), '.chatgpt-unpack-'));
   const run = (cmd, args, cwd) => {
     const r = spawnSync(cmd, args, { cwd, stdio: ['ignore', 'ignore', 'pipe'] });
-    if (r.status !== 0) throw new Error(`${cmd} ${args.join(' ')} failed: ${String(r.stderr || '').trim().slice(0, 200)}`);
+    if (r.status !== 0) throw new Error(`${cmd} failed: ${r.error?.message || String(r.stderr || '').trim().slice(0, 200)}`);
   };
-  if (have('bsdtar')) run('bsdtar', ['-xf', deb], outer);
-  else if (have('ar')) run('ar', ['x', deb], outer);
-  else throw new Error('need bsdtar (libarchive) or ar (binutils) to unpack a .deb');
-  const data = fs.readdirSync(outer).find((n) => /^data\.tar/.test(n));
-  if (!data) throw new Error('not a .deb: no data.tar inside');
-  run('tar', ['-xf', path.join(outer, data), '-C', dest]);
-  fs.rmSync(outer, { recursive: true, force: true });
-  const app = path.join(dest, 'usr', 'lib', 'chatgpt', 'ChatGPT');
-  if (!fs.existsSync(app)) throw new Error(`unpacked, but ${app} is not there — not the ChatGPT .deb?`);
-  return app;
+  try {
+    if (have('bsdtar')) run('bsdtar', ['-xf', deb], outer);
+    else if (have('ar')) run('ar', ['x', deb], outer);
+    else throw new Error('need bsdtar (libarchive) or ar (binutils) to unpack a .deb');
+    const data = fs.readdirSync(outer).find((n) => /^data\.tar/.test(n));
+    if (!data) throw new Error('not a .deb: no data.tar inside');
+    run('tar', ['-xf', path.join(outer, data), '-C', staged]);
+    const relative = path.join('usr', 'lib', 'chatgpt', 'ChatGPT');
+    if (!fs.existsSync(path.join(staged, relative))) throw new Error('package does not contain the ChatGPT desktop executable');
+    fs.accessSync(path.join(staged, relative), fs.constants.X_OK);
+    // Do not erase a previous unpack until the replacement has been validated.
+    fs.rmSync(dest, { recursive: true, force: true });
+    fs.renameSync(staged, dest);
+    return path.join(dest, relative);
+  } finally {
+    fs.rmSync(outer, { recursive: true, force: true });
+    fs.rmSync(staged, { recursive: true, force: true });
+  }
 }
 
 async function ensureProxy({ tunnel }) {
-  const { startProxy, oursOn, packageVersion } = await import('./proxy.js');
+  const { oursOn, packageVersion } = await import('./proxy.js');
   if (await oursOn(config.port)) return { started: false };
   // DETACHED, like `openzoo aoe`: the app outlives this command, so the
   // proxy must too. No public tunnel unless asked — a detached proxy nobody
@@ -237,26 +238,27 @@ async function ensureProxy({ tunnel }) {
   throw new Error(`proxy did not answer on :${config.port} within 60s — see ${logPath}`);
 }
 
-const INSTALL_HELP = `openzoo: ChatGPT desktop app not found.
-  download it from https://chatgpt.com/download (Linux: the .deb; macOS/Windows: the installer), then:
-    Debian/Ubuntu:  sudo apt install ./chatgpt_amd64.deb
-    Fedora:         sudo dnf install ./chatgpt*.rpm
-    Arch / other:   npx openzoo chatgpt --deb ~/Downloads/chatgpt_amd64.deb   (unpacked, no dpkg needed)
-  or point OPENZOO_CHATGPT_BIN at the binary.`;
-
 /**
  * `npx openzoo chatgpt [--model <id>] [--deb <file>] [--wire responses|chat]
  *                      [--bearer] [--no-launch] [--no-proxy] [--tunnel] [--print]`
  */
-export async function setupChatGpt(argv = []) {
+export async function setupChatGpt(argv = [], dependencies = {}) {
+  const { platform = process.platform, home = os.homedir(), env: sourceEnv = process.env,
+    resolve = resolveChatGptApp, install = installChatGpt, proxy = ensureProxy,
+    launch = launchChatGpt, findWindows = windowsChatGptApp } = dependencies;
   const args = [...argv];
   const opt = { model: null, deb: null, wireApi: 'responses', bearer: false, launch: true, proxy: true, tunnel: false, print: false, configPath: null, rest: [] };
   while (args.length) {
     const a = args.shift();
-    if (a === '--model') opt.model = String(args.shift() || '').trim() || null;
-    else if (a === '--deb') opt.deb = String(args.shift() || '').trim() || null;
-    else if (a === '--wire') opt.wireApi = String(args.shift() || '').trim();
-    else if (a === '--config') opt.configPath = String(args.shift() || '').trim() || null;
+    if (a === '--') { opt.rest.push(...args); break; }
+    const value = () => {
+      if (!args.length || args[0].startsWith('--') || !args[0].trim()) throw new Error(`${a} requires a value`);
+      return args.shift().trim();
+    };
+    if (a === '--model') opt.model = value();
+    else if (a === '--deb') opt.deb = value();
+    else if (a === '--wire') opt.wireApi = value();
+    else if (a === '--config') opt.configPath = value();
     else if (a === '--bearer') opt.bearer = true;
     else if (a === '--no-launch') opt.launch = false;
     else if (a === '--no-proxy') opt.proxy = false;
@@ -266,7 +268,8 @@ export async function setupChatGpt(argv = []) {
     else opt.rest.push(a);
   }
   if (!['responses', 'chat'].includes(opt.wireApi)) throw new Error('--wire must be responses or chat');
-  const model = opt.model || defaultModel();
+  if (opt.deb && platform !== 'linux') throw new Error('--deb is only supported on Linux');
+  const model = opt.model || defaultModel(sourceEnv);
   const merge = { model, port: config.port, wireApi: opt.wireApi, bearer: opt.bearer };
 
   if (opt.print) {
@@ -275,54 +278,69 @@ export async function setupChatGpt(argv = []) {
   }
 
   // 1. config.toml
-  const file = opt.configPath || codexConfigPath();
+  const appHome = sourceEnv.CODEX_HOME || path.join(home, '.openzoo', 'chatgpt');
+  const file = path.resolve(opt.configPath || path.join(appHome, 'config.toml'));
+  if (path.basename(file) !== 'config.toml') throw new Error('--config must name config.toml (the filename Codex reads)');
   let existing = '';
   if (fs.existsSync(file)) {
     existing = fs.readFileSync(file, 'utf8');
-    fs.copyFileSync(file, `${file}.openzoo-backup`);
   } else {
     fs.mkdirSync(path.dirname(file), { recursive: true });
   }
   const next = mergeCodexConfig(existing, merge);
-  if (next !== existing) fs.writeFileSync(file, next);
-  console.log(`${next !== existing ? 'wrote' : 'kept'} ${file}: model_provider = "${PROVIDER_ID}" (http://localhost:${config.port}/v1, ${opt.wireApi}), model = "${model}"`);
-
-  // 2. proxy
-  if (opt.proxy) {
-    const p = await ensureProxy({ tunnel: opt.tunnel });
-    console.log(p.started ? `proxy up on :${config.port} (background)` : `proxy already on :${config.port}`);
+  if (next !== existing) {
+    if (existing && !fs.existsSync(`${file}.openzoo-backup`)) fs.copyFileSync(file, `${file}.openzoo-backup`);
+    fs.writeFileSync(file, next);
   }
+  console.log(`${next !== existing ? 'wrote' : 'kept'} ${file}: model_provider = "${PROVIDER_ID}" (http://localhost:${config.port}/v1, ${opt.wireApi}), model = "${model}"`);
 
   if (!opt.launch) {
-    console.log(`config only. launch the app with ${API_KEY_ENV}=${API_KEY_VALUE} in its environment and pick "sign in with API key".`);
+    console.log('config only; no download, installation, proxy or app launch.');
     return { file, model, launched: false };
   }
 
-  // 3. the app
-  let app = resolveChatGptApp();
-  if (!app && process.platform === 'linux') {
-    const deb = opt.deb || findDownloadedDeb();
-    if (deb) {
-      console.log(`unpacking ${deb} into ${unpackDir()} (no dpkg needed)`);
-      app = unpackDeb(deb);
-    }
-  } else if (opt.deb) {
-    app = unpackDeb(opt.deb);
-  }
-  if (!app) {
-    console.error(INSTALL_HELP);
-    process.exitCode = 1;
-    return { file, model, launched: false };
+  // Reuse an installation before attempting any download.
+  let app = resolve({ env: sourceEnv, home, platform });
+  if (!app && sourceEnv.OPENZOO_CHATGPT_BIN) throw new Error(`OPENZOO_CHATGPT_BIN is not an executable ChatGPT app: ${sourceEnv.OPENZOO_CHATGPT_BIN}`);
+  if (!app && platform === 'win32') app = await findWindows();
+  if (!app && platform === 'linux' && opt.deb) app = unpackDeb(path.resolve(opt.deb), unpackDir(home));
+  if (!app) app = await install({ platform, home, unpack: unpackDeb });
+
+  if (opt.proxy) {
+    const p = await proxy({ tunnel: opt.tunnel });
+    console.log(p.started ? `proxy up on :${config.port} (background)` : `proxy already on :${config.port}`);
   }
 
   // 4. launch, with the env var the provider's env_key names
-  const env = { ...process.env, [API_KEY_ENV]: process.env[API_KEY_ENV] || API_KEY_VALUE };
-  if (!env.CODEX_HOME) env.CODEX_HOME = codexHome();
+  const env = { ...sourceEnv, [API_KEY_ENV]: sourceEnv[API_KEY_ENV] || API_KEY_VALUE,
+    CODEX_HOME: path.dirname(file),
+    CODEX_ELECTRON_USER_DATA_PATH: path.join(path.dirname(file), 'desktop'),
+  };
   console.log(`launching ${app}`);
   console.log(`  Codex / agent mode → the zoo, paid per turn by x402. Choose "sign in with API key" (any key).`);
   console.log('  the plain ChatGPT chat tab still talks to chatgpt.com — that half is not API-shaped.');
-  const child = spawn(app, opt.rest, { stdio: 'ignore', env, detached: true });
-  child.on('error', (e) => console.error(`openzoo: could not launch ${app}: ${e.message}`));
-  child.unref();
+  await launch(app, opt.rest, { env, platform });
   return { file, model, app, launched: true };
 }
+
+/** LaunchServices handles app bundles on macOS; detect early failures elsewhere. */
+export async function launchChatGpt(app, args, { env, platform = process.platform, run = runCommand, spawnImpl = spawn } = {}) {
+  if (platform === 'darwin' && app.endsWith('/Contents/MacOS/ChatGPT')) {
+    await run('open', ['-n', '--env', `CODEX_HOME=${env.CODEX_HOME}`,
+      '--env', `CODEX_ELECTRON_USER_DATA_PATH=${env.CODEX_ELECTRON_USER_DATA_PATH}`,
+      '--env', `${API_KEY_ENV}=${env[API_KEY_ENV]}`,
+      app.slice(0, -'/Contents/MacOS/ChatGPT'.length), '--args',
+      `--user-data-dir=${env.CODEX_ELECTRON_USER_DATA_PATH}`, ...args], { env });
+    return;
+  }
+  await new Promise((resolve, reject) => {
+    const child = spawnImpl(app, [`--user-data-dir=${env.CODEX_ELECTRON_USER_DATA_PATH}`, ...args], { stdio: 'ignore', env, detached: true });
+    const timer = setTimeout(() => { child.unref(); resolve(); }, 1500);
+    child.once('error', e => { clearTimeout(timer); reject(e); });
+    child.once('exit', (code, signal) => {
+      clearTimeout(timer);
+      if (code === 0) resolve(); // an existing instance accepted the launch
+      else reject(new Error(`ChatGPT exited during launch (${signal || code})`));
+    });
+  });
+}

package/lib/config.js

@@ -80,6 +80,40 @@ export const EVM_FUNDING_ASSETS = {
   ],
 };
 
+/**
+ * RPC endpoint BY CHAIN ID — the only lookup a 402 row can be resolved with.
+ *
+ * A row names its chain as `eip155:<id>` and nothing else. The rail NAMES
+ * above are a coarser bucket: railOf() collapses every chain that is not Base
+ * or Robinhood into the single name "evm", so a lookup keyed by rail name
+ * cannot tell Polygon from Arbitrum and answers with whatever the fallback
+ * branch happens to be.
+ *
+ * MEASURED 2026-09-09: the payment preflight did exactly that — for any
+ * non-Base EVM row it read the balance over the ROBINHOOD RPC, asked a Polygon
+ * USDC address that is not a contract there, threw, was swallowed by the
+ * preflight's catch, and signed an authorization for a chain the wallet held
+ * nothing on. The facilitator then reverted it and the caller was told
+ * "execution reverted" while 76 USDC sat on Base. Keyed by chain id, that
+ * cannot happen: either we can read the chain, or we say we cannot.
+ */
+export const EVM_RPC_BY_CHAIN = {
+  8453: () => config.baseRpcUrl,
+  4663: () => config.rhRpcUrl,
+  137: () => process.env.OPENZOO_POLYGON_RPC || 'https://polygon-rpc.com',
+  42161: () => process.env.OPENZOO_ARBITRUM_RPC || 'https://arb1.arbitrum.io/rpc',
+  10: () => process.env.OPENZOO_OPTIMISM_RPC || 'https://mainnet.optimism.io',
+  480: () => process.env.OPENZOO_WORLD_RPC || 'https://worldchain-mainnet.gateway.tenderly.co',
+};
+
+/** RPC for a row's `eip155:<id>` network, or null when we cannot read that chain. */
+export function evmRpcForNetwork(network) {
+  const m = /^eip155:(\d+)$/.exec(String(network || ''));
+  if (!m) return null;
+  const f = EVM_RPC_BY_CHAIN[Number(m[1])];
+  return f ? f() : null;
+}
+
 /** RPC endpoint for an EVM rail name. */
 export function evmRpcFor(rail) {
   // A rail with no RPC here reports NO balance at all — silently. Every entry