let-them-talk 3.3.0 → 3.3.2

package/CHANGELOG.md

@@ -0,0 +1,131 @@
+# Changelog
+
+## [3.3.1] - 2026-03-14
+
+### Changed
+- License changed from MIT to Business Source License 1.1 (BSL)
+- Added SECURITY.md with vulnerability disclosure policy
+- Added CHANGELOG.md to published npm package
+- Added .npmignore for cleaner package distribution
+- Version synced across all files (server, CLI, dashboard)
+
+## [3.0.0] - 2026-03-14
+
+### Added — Agent Profiles
+- New tool: `update_profile` (display_name, avatar, bio, role)
+- 12 built-in SVG robot avatar icons with hash-based defaults
+- Profiles auto-created on register, persist across restarts
+- Profile data shown in dashboard (avatars, role badges, profile popup)
+
+### Added — Agent Workspaces
+- 3 new tools: `workspace_write`, `workspace_read`, `workspace_list`
+- Per-agent key-value storage (50 keys max, 100KB per value)
+- Agents can read anyone's workspace, write only their own
+- Dashboard "Workspaces" tab with collapsible accordion UI
+
+### Added — Workflow Automation
+- 3 new tools: `create_workflow`, `advance_workflow`, `workflow_status`
+- Multi-step pipelines with auto-handoff to step assignees
+- Dashboard "Workflows" tab with horizontal pipeline visualization
+- Dashboard can advance/skip workflow steps
+
+### Added — Conversation Branching
+- 3 new tools: `fork_conversation`, `switch_branch`, `list_branches`
+- Fork at any message point with isolated branch history
+- All message tools branch-aware (backward compatible — main branch uses existing files)
+- Branch tabs in dashboard
+
+### Added — Plugin System
+- Dynamic tool loading from `plugins/*.js` files
+- Sandboxed execution with 30s timeout
+- CLI: `npx let-them-talk plugin add/list/remove/enable/disable`
+- Dashboard plugin cards with enable/disable toggles
+
+### Changed
+- MCP tools: 17 → 27 + dynamic plugins
+- Dashboard tabs: 2 → 4 (Messages, Tasks, Workspaces, Workflows)
+- Branch-aware history API (`?branch=` query param)
+- Version bump across all files (server, dashboard, CLI, package.json)
+
+## [2.5.0] - 2026-03-14
+
+### Added
+- Task management system: `create_task`, `update_task`, `list_tasks` tools
+- Kanban board in dashboard (Messages/Tasks toggle)
+- Agent stats panel (sent/received/avg response time per agent)
+- Shareable HTML export (/api/export endpoint)
+- Export dropdown (HTML + Markdown formats)
+- Conversation bookmarks (star messages, localStorage)
+- Sound notification toggle (Web Audio API)
+- Typing indicator for processing agents
+- Connection quality display (SSE latency)
+- Date separators between message groups
+- Message grouping for consecutive same-sender messages
+- Project auto-discover (scan nearby folders)
+- Copy-to-clipboard prompts in onboarding
+- Dynamic tab title with message count
+- Dashboard footer with version
+
+### Security
+- Path traversal fix in `share_file` (restricted to project dir)
+- Path traversal fix in `?project=` param (validate against registered projects)
+- 1MB message size limit on send/broadcast/handoff
+- 1MB request body limit on dashboard POST endpoints
+- XSS fix in HTML export (escape agent names)
+- CORS restricted to localhost only (was wildcard)
+- Dashboard binds to 127.0.0.1 only (was 0.0.0.0)
+- Registration guard on `reset` tool
+- Removed absolute file paths from share_file responses
+
+## [2.3.0] - 2026-03-14
+
+### Added
+- `handoff` tool for structured work delegation
+- `share_file` tool for sending file contents between agents
+- `broadcast` tool for messaging all agents at once
+- `get_summary` tool for conversation recaps
+- Server-Sent Events for real-time dashboard updates
+- `fs.watch()` on data directory with debounced SSE push
+- Graceful SSE fallback to polling
+- Handoff message rendering (purple banner)
+- File share message rendering (file icon + size)
+
+## [2.1.0] - 2026-03-14
+
+### Added
+- Multi-agent support (any name, not just A/B)
+- `list_agents` tool with alive/dead status
+- `listen` tool (blocks indefinitely, never times out)
+- Conversation threading (`reply_to` + auto `thread_id`)
+- Message acknowledgments (`ack_message` tool)
+- Heartbeat system (10s interval, `last_activity` tracking)
+- Agent status: active/sleeping/dead with idle time
+- Listening status tracking (`listening_since`)
+- Auto-compact messages.jsonl when >500 lines
+- Auto-archive conversations before reset
+- Context hints when conversation exceeds 50 messages
+- Dead recipient warnings in `send_message`
+- Message sequence numbers for ordering
+- `pending_count` and `agents_online` in delivery responses
+- 4 agent templates: pair, team, review, debate
+- CLI: `npx let-them-talk templates` command
+- CLI: `--template` flag for guided setup
+- Multi-CLI support: Claude Code, Gemini CLI, Codex CLI
+- `AGENT_BRIDGE_DATA_DIR` env var in MCP config
+
+### Fixed
+- Heartbeat timer `.unref()` to prevent zombie processes
+- Process exit cleanup (deregister agent on exit)
+- Re-registration cleanup (old name removed)
+- Stale byte offset recovery on file truncation
+
+## [2.0.0] - 2026-03-14
+
+### Added
+- Initial release
+- MCP server with stdio transport
+- 6 tools: register, send_message, wait_for_reply, check_messages, get_history, reset
+- Web dashboard with real-time monitoring
+- Message injection from dashboard
+- Dark theme UI with markdown rendering
+- `.mcp.json` project-level configuration

package/LICENSE

@@ -1,21 +1,75 @@
-MIT License
-
-Copyright (c) 2024-2026 Dekelelz
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+Business Source License 1.1
+
+License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+Parameters
+
+Licensor:             Dekelelz
+Licensed Work:        Let Them Talk v3.3.1
+                      The Licensed Work is (c) 2024-2026 Dekelelz.
+Additional Use Grant: You may make use of the Licensed Work, provided that
+                      you may not use the Licensed Work for a Commercial
+                      Hosted Service. A "Commercial Hosted Service" is a
+                      service offered to third parties on a hosted or
+                      managed basis that provides substantially the same
+                      functionality as the Licensed Work, or any modified
+                      version thereof, as a commercial offering.
+
+                      For clarity, the following uses are always permitted:
+                      - Self-hosting for personal or internal business use
+                      - Using as a development tool in any project
+                      - Integrating into non-competing products
+                      - Academic and research use
+                      - Non-commercial use of any kind
+
+Change Date:          2028-03-14
+Change License:       Apache License, Version 2.0
+
+For information about alternative licensing arrangements for the Licensed Work,
+please contact: dekelelz@gmail.com
+
+Notice
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited production
+use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under the
+terms of the Change License, and the rights granted in the paragraph above
+terminate.
+
+If your use of the Licensed Work does not comply with the requirements currently
+in effect as described in this License, you must purchase a commercial license
+from the Licensor, its affiliated entities, or authorized resellers, or you must
+refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works of
+the Licensed Work, are subject to this License. This License applies separately
+for each version of the Licensed Work and the Change Date may vary for each
+version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy of
+the Licensed Work. If you receive the Licensed Work in original or modified form
+from a third party, the terms and conditions set forth in this License apply to
+your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other versions
+of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of Licensor
+or its affiliates (provided that you may use a trademark or logo of Licensor as
+expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON AN
+"AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS, EXPRESS
+OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND TITLE.

package/README.md

@@ -1,7 +1,8 @@
 # Let Them Talk
 
 [![npm version](https://img.shields.io/npm/v/let-them-talk.svg)](https://www.npmjs.com/package/let-them-talk)
-[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+[![License: BSL 1.1](https://img.shields.io/badge/License-BSL%201.1-orange.svg)](https://github.com/Dekelelz/let-them-talk/blob/master/LICENSE)
+[![Discord](https://img.shields.io/discord/1482478651000885359?color=5865F2&label=Discord&logo=discord&logoColor=white)](https://discord.gg/6Y9YgkFNJP)
 
 **MCP server + web dashboard that lets AI CLI agents talk to each other.**
 
@@ -239,4 +240,4 @@ Plugins run with full Node.js access. Only install plugins you trust. This is th
 
 ## License
 
-MIT
+[Business Source License 1.1](LICENSE) — Free to use, self-host, and modify. Cannot be offered as a competing commercial hosted service. Converts to Apache 2.0 on March 14, 2028.

package/SECURITY.md

@@ -0,0 +1,58 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 3.x.x   | Yes               |
+| 2.x.x   | No                |
+| < 2.0   | No                |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in Let Them Talk, please report it responsibly.
+
+**Do NOT open a public GitHub issue for security vulnerabilities.**
+
+Instead, please email **security@dos-technology.com** or use [GitHub's private vulnerability reporting](https://github.com/Dekelelz/let-them-talk/security/advisories/new).
+
+### What to include
+
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Suggested fix (if any)
+
+### Response timeline
+
+- **Acknowledgment**: Within 48 hours
+- **Initial assessment**: Within 1 week
+- **Fix release**: As soon as possible, typically within 2 weeks
+
+## Security Model
+
+Let Them Talk is a **local message broker** — it passes text messages between CLI terminals via shared files on your local machine.
+
+### What it does NOT do
+
+- Does not give agents filesystem access (they already have it via their CLI)
+- Does not expose anything to the internet (dashboard binds to `127.0.0.1` only)
+- Does not store or transmit API keys
+- Does not run any cloud services
+- Does not execute remote code
+
+### Built-in protections
+
+- **CORS restriction** — dashboard only accepts requests from localhost
+- **XSS prevention** — all user inputs are escaped before rendering
+- **Path traversal protection** — agents cannot read files outside the project directory
+- **Symlink protection** — follows symlinks and validates the real path
+- **Origin enforcement** — POST/DELETE requests require valid localhost origin
+- **SSE connection limits** — prevents connection exhaustion
+- **Input validation** — agent names, branch names, and file paths are validated
+- **Message size limits** — 1MB max per message
+- **Plugin sandboxing** — plugins run with a 30-second timeout
+
+### LAN mode
+
+When using `--lan` mode, the dashboard is exposed to your local network only. It is never accessible from the internet.

package/cli.js

@@ -8,7 +8,7 @@ const command = process.argv[2];
 
 function printUsage() {
   console.log(`
-  Let Them Talk — Agent Bridge v3.2.0
+  Let Them Talk — Agent Bridge v3.3.1
   MCP message broker for inter-agent communication
   Supports: Claude Code, Gemini CLI, Codex CLI
 

package/dashboard.html

@@ -2308,6 +2308,7 @@
     <button class="mobile-toggle" onclick="toggleSidebar()" aria-label="Menu">&#9776;</button>
     <img src="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><rect rx='20' width='100' height='100' fill='%230d1117'/><path d='M20 30 Q20 20 30 20 H70 Q80 20 80 30 V55 Q80 65 70 65 H55 L40 80 V65 H30 Q20 65 20 55Z' fill='%2358a6ff'/><circle cx='38' cy='42' r='5' fill='%230d1117'/><circle cx='55' cy='42' r='5' fill='%230d1117'/></svg>" alt="" style="height:28px;margin-right:4px;vertical-align:middle">
     <div class="logo">Let Them Talk</div>
+    <span id="mobile-project-name" style="display:none;font-size:11px;color:var(--orange);font-weight:600;background:var(--orange-dim);padding:2px 8px;border-radius:10px"></span>
     <div class="header-stats">
       <div class="h-stat"><span class="h-stat-val" id="stat-messages">0</span> msgs</div>
       <div class="h-stat"><span class="h-stat-val" id="stat-agents">0</span> agents</div>
@@ -2471,7 +2472,7 @@
   </div>
 </div>
 <div class="app-footer">
-  <span>Let Them Talk v3.2.0</span>
+  <span>Let Them Talk v3.3.1</span>
 </div>
 <div class="profile-popup" id="profile-popup" onclick="event.stopPropagation()">
   <div class="profile-popup-header">
@@ -4095,6 +4096,7 @@ function poll() {
     fetch('/api/agents' + pq).then(function(r) { return r.json(); }),
     fetch('/api/status' + pq).then(function(r) { return r.json(); }),
   ]).then(function(results) {
+    console.log('[LTT] poll ok — history:' + results[0].length + ' agents:' + Object.keys(results[1]).length + ' project:' + (activeProject || 'default'));
     updateConnectionInfo(Date.now() - pollStart);
     var prevHistLen = cachedHistory.length;
     cachedHistory = results[0];
@@ -4140,7 +4142,7 @@ function poll() {
     if (activeView === 'workflows') fetchWorkflows();
   }).catch(function(e) {
     console.error('Poll failed:', e);
-    document.getElementById('conn-detail').textContent = ' err';
+    document.getElementById('conn-detail').textContent = ' ERR: ' + e.message;
   });
 }
 
@@ -4158,7 +4160,8 @@ function doReset() {
 // ==================== PROJECT MANAGEMENT ====================
 
 function loadProjects() {
-  fetch('/api/projects').then(function(r) { return r.json(); }).then(function(projects) {
+  return fetch('/api/projects').then(function(r) { return r.json(); }).then(function(projects) {
+    console.log('[LTT] loadProjects:', projects.length, 'projects, activeProject:', activeProject);
     var sel = document.getElementById('project-select');
     // Keep the first option (Default)
     while (sel.options.length > 1) sel.remove(1);
@@ -4168,7 +4171,24 @@ function loadProjects() {
       opt.textContent = projects[i].name;
       sel.appendChild(opt);
     }
-    if (activeProject) sel.value = activeProject;
+
+    // Auto-select: if only one project and nothing selected, use it
+    if (!activeProject && projects.length === 1) {
+      activeProject = projects[0].path;
+    }
+
+    if (activeProject) {
+      sel.value = activeProject;
+      document.getElementById('remove-project-btn').style.display = '';
+      // Update header project indicator for mobile
+      var indicator = document.getElementById('mobile-project-name');
+      if (indicator) {
+        var proj = projects.find(function(p) { return p.path === activeProject; });
+        indicator.textContent = proj ? proj.name : '';
+        indicator.style.display = proj ? '' : 'none';
+      }
+      poll(); // re-poll with correct project
+    }
 
     // Show/hide remove button
     document.getElementById('remove-project-btn').style.display = activeProject ? '' : 'none';
@@ -4805,9 +4825,11 @@ function initSSE() {
   }
 })();
 
-loadProjects();
-poll();
-initSSE();
+// Load projects first, then poll (so auto-select works before first data fetch)
+loadProjects().then(function() {
+  poll();
+  initSSE();
+});
 // Safety-net poll at 10s (SSE handles real-time, this catches any missed updates)
 setInterval(poll, 10000);
 </script>

package/dashboard.js

@@ -6,7 +6,12 @@ const os = require('os');
 const { spawn } = require('child_process');
 
 const PORT = parseInt(process.env.AGENT_BRIDGE_PORT || '3000', 10);
-let LAN_MODE = process.env.AGENT_BRIDGE_LAN === 'true';
+const LAN_STATE_FILE = path.join(__dirname, '.lan-mode');
+let LAN_MODE = process.env.AGENT_BRIDGE_LAN === 'true' || (fs.existsSync(LAN_STATE_FILE) && fs.readFileSync(LAN_STATE_FILE, 'utf8').trim() === 'true');
+
+function persistLanMode() {
+  try { fs.writeFileSync(LAN_STATE_FILE, LAN_MODE ? 'true' : 'false'); } catch {}
+}
 
 function getLanIP() {
   const interfaces = os.networkInterfaces();
@@ -422,7 +427,7 @@ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;backgrou
 <div class="agent-chips" id="agent-chips"></div>
 </div>
 <div class="messages" id="messages"></div>
-<div class="footer">Generated by <a href="https://github.com/Dekelelz/let-them-talk" target="_blank">Let Them Talk</a> &middot; MIT License</div>
+<div class="footer">Generated by <a href="https://github.com/Dekelelz/let-them-talk" target="_blank">Let Them Talk</a> &middot; BSL 1.1</div>
 <script>
 var COLORS=['#58a6ff','#3fb950','#d29922','#f85149','#bc8cff','#f778ba','#79c0ff','#7ee787','#e3b341','#ffa198'];
 var colorMap={},ci=0;
@@ -945,6 +950,7 @@ const server = http.createServer(async (req, res) => {
       const newMode = !LAN_MODE;
       const lanIP = getLanIP();
       LAN_MODE = newMode;
+      persistLanMode();
       // Send response first
       res.writeHead(200, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ lan_mode: newMode, lan_ip: lanIP, port: PORT }));
@@ -1062,7 +1068,7 @@ server.listen(PORT, LAN_MODE ? '0.0.0.0' : '127.0.0.1', () => {
   const dataDir = resolveDataDir();
   const lanIP = getLanIP();
   console.log('');
-  console.log('  Let Them Talk - Agent Bridge Dashboard v3.0');
+  console.log('  Let Them Talk - Agent Bridge Dashboard v3.3.1');
   console.log('  ============================================');
   console.log('  Dashboard:  http://localhost:' + PORT);
   if (LAN_MODE && lanIP) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "let-them-talk",
-  "version": "3.3.0",
+  "version": "3.3.2",
   "description": "MCP message broker + web dashboard for inter-agent communication. Let AI CLI agents talk to each other.",
   "main": "server.js",
   "bin": {
@@ -22,7 +22,9 @@
     "cli.js",
     "templates/",
     "logo.png",
-    "LICENSE"
+    "LICENSE",
+    "SECURITY.md",
+    "CHANGELOG.md"
   ],
   "keywords": [
     "mcp",
@@ -46,7 +48,7 @@
     "url": "https://github.com/Dekelelz/let-them-talk/issues"
   },
   "author": "Dekelelz",
-  "license": "MIT",
+  "license": "BSL-1.1",
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.27.1"
   }

package/server.js

@@ -2021,7 +2021,7 @@ async function main() {
   loadPlugins();
   const transport = new StdioServerTransport();
   await server.connect(transport);
-  console.error('Agent Bridge MCP server v3.2.0 running (' + (27 + loadedPlugins.length) + ' tools)');
+  console.error('Agent Bridge MCP server v3.3.1 running (' + (27 + loadedPlugins.length) + ' tools)');
 }
 
 main().catch(console.error);