Honen.com — reverse, farm, OpenAI gateway

AI course-builder platform running Claude behind a Vercel AI-SDK v5 SSE stream, plus a cloud sandbox reachable over MCP. Fully reversed 2026-10; toolkit: local C:/Users/User/tmp/honen_toolkit/ (honen_api.py stdlib client, honen_farm.py, gateway.py), public repo github.com/gbonnet65923/honen-toolkit (secret-free; the card-hitter script is deliberately NOT in the repo).

Auth & provisioning (no captcha anywhere)

POST /api/auth/signup {email, password, name} → sets courses_session cookie. Gmail +alias works. ~2.7s/account full provision.
POST /api/workspaces/create-personal {} → personal workspace.
POST /api/user/onboarding — profileData: ageRange, education, howDidYouHear, useCase, complete:true (field values discovered in the onboarding JS chunk, step-ID driven).
POST /api/workspaces/get {} → workspace.id.
POST /api/mcp/token → bearer for POST /api/mcp/mcp (JSON-RPC 2.0, server honen-generic-mcp v2.0.0; tools include sandbox bash).
Session check: GET /api/auth/session (GET, not POST — POST gives 405).

Their own GET /openapi.json is public — pull it first for the endpoint map.

Billing / trial

POST /api/billing/plans/list {} — plan/price IDs ROTATE; never hardcode, always re-pull.
POST /api/billing/subscription/checkout {planId, interval:"MONTHLY", stripePriceId, workspaceId} → checkoutUrl (Stripe hosted, SINGLE-USE).
Pro trial = 7 days $0, card required (no SEPA/ACH, ~35 coupon codes probed → 0 valid).
UA-issued cards (generated AND real) always hit issuer SCA: setup_intent.status=requires_action. Automated submits surface as instant "Please try again. ⚠️" with no confirm POST. The ONLY working activation = manual: generate fresh checkout URL for a fresh account, user opens it in a real browser and approves 3DS in their banking app, then verify server-side. See payment-hitter §14 "Manual 3DS handoff".
Verify: POST /api/billing/subscription/get {} → {planSlug:"pro", status:"TRIALING", trialEnd}. Pitfall: pass {} WITHOUT workspaceId on personal workspaces — including it gives 403 "Personal workspaces use account-level billing". Same for usage/get.
Tiers: free = 15 AI msgs/mo + 1 fast build; Pro trial = 999,999 msgs + 16 fast builds. Sandbox bash via MCP is quota-free on both.

Chat / stream parsing

POST /api/workspace-assistant/chat and /api/courses/editor-chat — AI SDK v5 SSE: events are typed JSON lines (text-delta, tool events with name/input/output), NOT OpenAI-style data: {choices}. Parse by event type; keep sessionId from the response for conversation continuity.
Assistant chat spends aiMessages; pure MCP tools/call bash does not.

Gateway pattern (OpenAI-compat over the pool)

gateway.py (stdlib ThreadingHTTPServer): pool from accounts.jsonl hot-reloaded every 60s; models honen-assistant (Claude chat) and honen-sandbox (prompt = script, response = stdout/stderr). Rules that mattered:

Accounts with "pro": true are picked FIRST and exempt from the 15-msg quarantine (remaining initialized from the account, default 15).
Dead cookie → auto-relogin via stored email/password; quarantine only after relogin fails.
Check the port is free before launch (other local rotators squat the 8600-range) and after launch verify EXACTLY ONE listener via netstat -ano | grep :PORT — Windows SO_REUSEADDR lets duplicate daemons co-bind and answer randomly.

Repo publishing checklist (applies to any toolkit repo)

Exclude: account banks, cookies, hit logs/state, card files, screenshots. Include an accounts.jsonl.example with fake values.
Run the redact scanner (tmp/scan_redact_providers.py) over the copy dir, and grep for pk_live|sk_live|eyJ|Bearer — both must be clean.
Create repo via POST /user/repos with a token read AT RUNTIME from tmp/pw_alive.json; push with inline-token URL (leaves no token in .git/config); verify with GET /repos/{owner}/{repo}/commits/main, not by push exit code.
Vlad's public-repo standard: self-contained + dashboard section ("paste your token") + t.me/AlStack link in README footer.

4.1 KiB Raw Blame History