let-them-talk 3.1.1 → 3.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024-2026 Dekelelz
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dashboard.html

@@ -2810,7 +2810,7 @@ function renderAgents(agents) {
     }
 
     var avatarHtml = info.avatar
-      ? '<img class="agent-avatar-img" src="' + info.avatar + '" alt="' + escapeHtml(name) + '" onerror="this.style.display=\'none\'">'
+      ? '<img class="agent-avatar-img" src="' + escapeHtml(info.avatar) + '" alt="' + escapeHtml(name) + '" onerror="this.style.display=\'none\'">'
       : '<div class="agent-avatar" style="background:' + color + '">' + initial(name) + '</div>';
     var displayName = info.display_name || name;
     var roleHtml = info.role ? '<span class="role-badge">' + escapeHtml(info.role) + '</span>' : '';
@@ -3755,7 +3755,7 @@ textarea.addEventListener('input', function() {
 function getMsgAvatar(name, color) {
   var agent = cachedAgents[name];
   if (agent && agent.avatar) {
-    return '<img class="msg-avatar-img" src="' + agent.avatar + '" alt="' + escapeHtml(name) + '" onerror="this.outerHTML=\'<div class=&quot;msg-avatar&quot; style=&quot;background:' + color + '&quot;>' + initial(name) + '</div>\'">';
+    return '<img class="msg-avatar-img" src="' + escapeHtml(agent.avatar) + '" alt="' + escapeHtml(name) + '" onerror="this.outerHTML=\'<div class=&quot;msg-avatar&quot; style=&quot;background:' + color + '&quot;>' + initial(name) + '</div>\'">';
   }
   return '<div class="msg-avatar" style="background:' + color + '">' + initial(name) + '</div>';
 }
@@ -4323,7 +4323,7 @@ function updateTypingIndicator(agents) {
     var info = agents[keys[i]];
     // Agent is alive, not listening, and was recently active (processing a message)
     if (info.alive && !info.is_listening && info.status === 'active') {
-      typing.push(info.display_name || keys[i]);
+      typing.push(escapeHtml(info.display_name || keys[i]));
     }
   }
   var bar = document.getElementById('typing-bar');
@@ -4729,7 +4729,7 @@ function doLaunch() {
   }).then(function(r) { return r.json(); }).then(function(data) {
     if (data.error) {
       resultEl.className = 'launch-result error';
-      resultEl.innerHTML = data.error;
+      resultEl.innerHTML = escapeHtml(data.error);
       return;
     }
     resultEl.className = 'launch-result success';

package/dashboard.js

@@ -3,7 +3,7 @@ const http = require('http');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const { exec } = require('child_process');
+const { exec, spawn } = require('child_process');
 
 const PORT = parseInt(process.env.AGENT_BRIDGE_PORT || '3000', 10);
 let LAN_MODE = process.env.AGENT_BRIDGE_LAN === 'true';
@@ -139,6 +139,9 @@ function getDefaultAvatar(name) {
 function apiHistory(query) {
   const projectPath = query.get('project') || null;
   const branch = query.get('branch') || null;
+  if (branch && !/^[a-zA-Z0-9_-]{1,64}$/.test(branch)) {
+    return { error: 'Invalid branch name' };
+  }
   const histFile = branch && branch !== 'main'
     ? filePath(`branch-${branch}-history.jsonl`, projectPath)
     : filePath('history.jsonl', projectPath);
@@ -615,8 +618,7 @@ function apiLaunchAgent(body) {
 
   // Try to launch terminal on Windows
   if (process.platform === 'win32') {
-    const escapedDir = projectDir.replace(/"/g, '\\"');
-    exec(`start cmd /k "cd /d "${escapedDir}" && ${cliCmd}"`, { cwd: projectDir });
+    spawn('cmd', ['/c', 'start', 'cmd', '/k', `cd /d "${projectDir}" && ${cliCmd}`], { cwd: projectDir, shell: false, detached: true, stdio: 'ignore' });
     return { success: true, launched: true, cli, project_dir: projectDir, prompt: launchPrompt };
   }
 
@@ -662,7 +664,7 @@ const server = http.createServer(async (req, res) => {
   const allowedOrigin = `http://localhost:${PORT}`;
   const reqOrigin = req.headers.origin;
   if (LAN_MODE && reqOrigin) {
-    res.setHeader('Access-Control-Allow-Origin', reqOrigin);
+    res.setHeader('Access-Control-Allow-Origin', '*');
   } else if (reqOrigin === allowedOrigin || reqOrigin === `http://127.0.0.1:${PORT}`) {
     res.setHeader('Access-Control-Allow-Origin', reqOrigin);
   }
@@ -794,6 +796,11 @@ const server = http.createServer(async (req, res) => {
     else if (url.pathname === '/api/workspaces' && req.method === 'GET') {
       const projectPath = url.searchParams.get('project') || null;
       const agentParam = url.searchParams.get('agent');
+      if (agentParam && !/^[a-zA-Z0-9]{1,20}$/.test(agentParam)) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Invalid agent name' }));
+        return;
+      }
       const dataDir = resolveDataDir(projectPath);
       const wsDir = path.join(dataDir, 'workspaces');
       const result = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "let-them-talk",
-  "version": "3.1.1",
+  "version": "3.2.0",
   "description": "MCP message broker + web dashboard for inter-agent communication. Let AI CLI agents talk to each other.",
   "main": "server.js",
   "bin": {
@@ -9,14 +9,20 @@
   },
   "scripts": {
     "start": "node server.js",
-    "dashboard": "node dashboard.js"
+    "dashboard": "node dashboard.js",
+    "test": "echo \"No tests yet\""
+  },
+  "engines": {
+    "node": ">=16.0.0"
   },
   "files": [
     "server.js",
     "dashboard.js",
     "dashboard.html",
     "cli.js",
-    "templates/"
+    "templates/",
+    "logo.png",
+    "LICENSE"
   ],
   "keywords": [
     "mcp",
@@ -33,7 +39,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "https://github.com/Dekelelz/let-them-talk.git"
+    "url": "git+https://github.com/Dekelelz/let-them-talk.git"
   },
   "homepage": "https://github.com/Dekelelz/let-them-talk",
   "bugs": {
@@ -42,6 +48,6 @@
   "author": "Dekelelz",
   "license": "MIT",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0"
+    "@modelcontextprotocol/sdk": "1.12.1"
   }
 }