openzoo 0.9.5 → 0.9.6

package/lib/proxy.js

@@ -271,12 +271,37 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     }
     if (viaTunnel) {
       const got = (req.headers.authorization || '').replace(/^Bearer\s+/i, '').trim();
-      if (got !== tunnelGate.token) {
-        log(`public url: 401 ${req.method} ${req.url}`);
-        jsonErr(res, 401, 'unauthorized: this openzoo public URL requires the api key printed at startup');
-        return;
+      const authed = got === tunnelGate.token;
+      const p = (req.url || '').split('?')[0];
+      // DISCOVERY IS FREE. An agent probing this URL cold should be able to
+      // work out what it is and what to ask its operator for — a bare 401 on
+      // every path just sends it spelunking through the operator's machine.
+      // Reads that cost nothing and leak nothing (the catalog is public on
+      // the zoo anyway) go through without the key; money paths stay gated.
+      if (!authed) {
+        if (req.method === 'GET' && (p === '/' || p === '/v1' || p === '/v1/info')) {
+          res.writeHead(200, { 'content-type': 'application/json' });
+          res.end(JSON.stringify({
+            name: 'openzoo proxy (public tunnel)',
+            what: 'OpenAI-compatible pay-per-call proxy — the operator\'s wallet pays per request via x402; no account, no signup.',
+            authentication: 'All POST endpoints require `Authorization: Bearer <api key>`. The key is printed in the operator\'s terminal at proxy startup — ask them for it. It is NOT guessable.',
+            endpoints: {
+              'GET /v1/models': 'model catalog with pricing + context_length — no key needed',
+              'GET /v1/models/{id}': 'single-model probe — no key needed',
+              'POST /v1/chat/completions': 'chat (streaming supported, any model id — unknown ids are matched to the nearest served model) — key required',
+            },
+            docs: 'https://openzoo.fun · https://www.npmjs.com/package/openzoo',
+          }, null, 2));
+          return;
+        }
+        const freeRead = req.method === 'GET' && (p === '/v1/models' || p.startsWith('/v1/models/'));
+        if (!freeRead) {
+          log(`public url: 401 ${req.method} ${req.url}`);
+          jsonErr(res, 401, 'unauthorized: this openzoo public URL requires the api key printed at the operator\'s proxy startup — GET / for discovery, GET /v1/models is open');
+          return;
+        }
       }
-      if (tunnelSpent >= tunnelGate.sessionMaxUsd) {
+      if (authed && tunnelSpent >= tunnelGate.sessionMaxUsd) {
         jsonErr(res, 402, `openzoo public-URL session cap reached ($${tunnelGate.sessionMaxUsd}) — restart the proxy or raise OPENZOO_TUNNEL_MAX_USD`);
         return;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.9.5",
+  "version": "0.9.6",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",