openzoo 0.9.5 → 0.9.7

package/lib/models.js

@@ -137,12 +137,27 @@ export const ALIAS_IDS = [
   'deepseek-chat', 'deepseek-reasoner', 'qwen-max', 'llama-3.3-70b',
 ];
 
-/** Merge alias rows into a /v1/models payload without duplicating real ids. */
+/**
+ * Merge alias rows into a /v1/models payload without duplicating real ids.
+ * Each alias inherits context_length and pricing from the model it RESOLVES
+ * to — a harness sizing its corpus off "gpt-4o" gets the real ceiling of the
+ * model that will actually serve it, not a blank.
+ */
 export function augmentModelList(payload) {
   const data = Array.isArray(payload?.data) ? payload.data : [];
   const have = new Set(data.map((m) => m.id));
-  const aliases = ALIAS_IDS.filter((id) => !have.has(id))
-    .map((id) => ({ id, object: 'model', owned_by: 'openzoo-alias' }));
+  const ids = data.map((m) => m.id);
+  const aliases = ALIAS_IDS.filter((id) => !have.has(id)).map((id) => {
+    const target = data.find((m) => m.id === resolveModel(id, ids));
+    return {
+      id,
+      object: 'model',
+      owned_by: 'openzoo-alias',
+      ...(target?.context_length ? { context_length: target.context_length, context_window: target.context_window ?? target.context_length } : {}),
+      ...(target?.pricing ? { pricing: target.pricing } : {}),
+      ...(target ? { served_by: target.id } : {}),
+    };
+  });
   return { ...payload, object: payload?.object || 'list', data: [...data, ...aliases] };
 }
 

package/lib/proxy.js

@@ -271,12 +271,37 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     }
     if (viaTunnel) {
       const got = (req.headers.authorization || '').replace(/^Bearer\s+/i, '').trim();
-      if (got !== tunnelGate.token) {
-        log(`public url: 401 ${req.method} ${req.url}`);
-        jsonErr(res, 401, 'unauthorized: this openzoo public URL requires the api key printed at startup');
-        return;
+      const authed = got === tunnelGate.token;
+      const p = (req.url || '').split('?')[0];
+      // DISCOVERY IS FREE. An agent probing this URL cold should be able to
+      // work out what it is and what to ask its operator for — a bare 401 on
+      // every path just sends it spelunking through the operator's machine.
+      // Reads that cost nothing and leak nothing (the catalog is public on
+      // the zoo anyway) go through without the key; money paths stay gated.
+      if (!authed) {
+        if (req.method === 'GET' && (p === '/' || p === '/v1' || p === '/v1/info')) {
+          res.writeHead(200, { 'content-type': 'application/json' });
+          res.end(JSON.stringify({
+            name: 'openzoo proxy (public tunnel)',
+            what: 'OpenAI-compatible pay-per-call proxy — the operator\'s wallet pays per request via x402; no account, no signup.',
+            authentication: 'All POST endpoints require `Authorization: Bearer <api key>`. The key is printed in the operator\'s terminal at proxy startup — ask them for it. It is NOT guessable.',
+            endpoints: {
+              'GET /v1/models': 'model catalog with pricing + context_length — no key needed',
+              'GET /v1/models/{id}': 'single-model probe — no key needed',
+              'POST /v1/chat/completions': 'chat (streaming supported, any model id — unknown ids are matched to the nearest served model) — key required',
+            },
+            docs: 'https://openzoo.fun · https://www.npmjs.com/package/openzoo',
+          }, null, 2));
+          return;
+        }
+        const freeRead = req.method === 'GET' && (p === '/v1/models' || p.startsWith('/v1/models/'));
+        if (!freeRead) {
+          log(`public url: 401 ${req.method} ${req.url}`);
+          jsonErr(res, 401, 'unauthorized: this openzoo public URL requires the api key printed at the operator\'s proxy startup — GET / for discovery, GET /v1/models is open');
+          return;
+        }
       }
-      if (tunnelSpent >= tunnelGate.sessionMaxUsd) {
+      if (authed && tunnelSpent >= tunnelGate.sessionMaxUsd) {
         jsonErr(res, 402, `openzoo public-URL session cap reached ($${tunnelGate.sessionMaxUsd}) — restart the proxy or raise OPENZOO_TUNNEL_MAX_USD`);
         return;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.9.5",
+  "version": "0.9.7",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",