@venturewild/workspace 0.6.0 → 0.6.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@venturewild/workspace",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Claude Code Web — Replit/Lovable-style chat-first browser UI that wraps the AI agent already installed on your machine.",
   "license": "MIT",
   "bin": {

package/server/src/index.mjs

@@ -89,9 +89,17 @@ import { nanoid } from 'nanoid';
 const __filename = url.fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-// How often an open /ws/activity session re-touches presence so peers keep seeing a
-// fresh "online" signal (must be comfortably under workspace-presence's window).
-const PRESENCE_HEARTBEAT_MS = 45 * 1000;
+// Presence tuning knobs — sensible defaults, env-overridable so they can be tuned from
+// field feel without a code change (these are UX-feel, not benched). The heartbeat is how
+// often an open /ws/activity session re-touches presence so peers keep seeing a fresh
+// "online" signal; the window is how long a signal counts as "active now". Heartbeat must
+// stay comfortably under the window — clamped to ≤ window/2 so a misconfig can't make
+// everyone blink offline.
+const PRESENCE_WINDOW_MS = Math.max(10_000, Number(process.env.WILD_WORKSPACE_PRESENCE_WINDOW_MS) || 2 * 60 * 1000);
+const PRESENCE_HEARTBEAT_MS = Math.min(
+  Math.max(5_000, Number(process.env.WILD_WORKSPACE_PRESENCE_HEARTBEAT_MS) || 45 * 1000),
+  Math.floor(PRESENCE_WINDOW_MS / 2),
+);
 
 // --- structured logging ---------------------------------------------------
 // Single helper used everywhere so log lines are uniformly tagged + timestamped.
@@ -175,7 +183,7 @@ export async function createServer(overrides = {}) {
   // email — the sync_credential bridge). Powers the lit/dim roster avatars. Honest:
   // only marks a member online on a real recent signal; otherwise dim.
   const workspacePresence =
-    overrides.workspacePresence || createWorkspacePresence({ activityBus });
+    overrides.workspacePresence || createWorkspacePresence({ activityBus, windowMs: PRESENCE_WINDOW_MS });
   // Persist the revocation list so a revoked share token stays revoked across a
   // server restart (concern C8). Lives in the gitignored .wild-workspace dir.
   const tokenRegistry = new TokenRegistry({
@@ -2586,9 +2594,11 @@ export async function createServer(overrides = {}) {
     });
     return c.json(res);
   });
-  // Report a pool theme to the ops inbox (the GLM day-one must-have). Routes to the
-  // rails (bmo-sync /api/listings/report). chatWrite-gated. Degrade-never: with no
-  // rails / logged out it's a quiet no-op the UI treats as "thanks, noted".
+  // Report a pool listing to the ops inbox (the GLM day-one must-have). Despite the
+  // `/themes/` path (kept for back-compat), this is KIND-AGNOSTIC — `listingsRails.report`
+  // reports any listing id, so it's also the takedown lever for a cross-user RECIPE whose
+  // intent a scan can't judge. Routes to the rails (bmo-sync /api/listings/report).
+  // chatWrite-gated. Degrade-never: with no rails / logged out it's a quiet no-op.
   app.post('/api/bazaar/themes/:id/report', async (c) => {
     const forbidden = require(c, 'chatWrite');
     if (forbidden) return forbidden;