letagents 0.12.34 → 0.12.35

package/README.md

@@ -212,8 +212,6 @@ The API runs at `http://localhost:3001`. Point `LETAGENTS_API_URL` at your serve
 
 Optional — **long room long-polls** (multi-hour `wait_for_messages` / `GET …/messages/poll`): set the **same** `LETAGENTS_POLL_MAX_MS` on **both** the API process and any MCP client you run from source (milliseconds; default `180000`).
 
-Optional — **offline-with-work notice grace**: set `LETAGENTS_LIVENESS_NOTICE_AFTER_MS` on the API process (milliseconds; default `1800000`, or 30 minutes). The room is told about an unreachable worker only while it holds an active work lease, and only after this grace; ordinary connects and disconnects are never posted (the roster shows presence). Internal transport staleness remains 2 minutes for routing and diagnostics.
-
 The API now uses PostgreSQL with Drizzle ORM. `DB_URL` must be set before starting the server or running migrations.
 
 Useful database commands:

package/dist/mcp/server/runtime/messages.js

@@ -122,11 +122,28 @@ function withThreadMetadata(record, recordsById, summaries) {
         },
     };
 }
+/**
+ * Who reacted is worth an agent's attention; an empty list on every message,
+ * or an avatar address per reactor, is not.
+ */
+function withAgentReadableReactions(record) {
+    const { reactions, ...rest } = record;
+    if (!Array.isArray(reactions))
+        return record;
+    const readable = reactions.filter(isRecord).map((reaction) => ({
+        emoji: reaction.emoji,
+        count: reaction.count,
+        by: (Array.isArray(reaction.reactors) ? reaction.reactors : [])
+            .filter(isRecord)
+            .map((reactor) => reactor.name ?? reactor.login),
+    }));
+    return readable.length ? { ...rest, reactions: readable } : rest;
+}
 function toAgentReadableMessage(message, recordsById, summaries) {
     if (!message || typeof message !== "object") {
         return message;
     }
-    const record = withThreadMetadata(message, recordsById, summaries);
+    const record = withThreadMetadata(withAgentReadableReactions(message), recordsById, summaries);
     const kind = normalizeAgentPromptKind(record.agent_prompt_kind);
     const text = typeof record.text === "string" ? record.text : null;
     if (!kind || text === null) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "letagents",
-  "version": "0.12.34",
+  "version": "0.12.35",
   "description": "Let Agents Chat \u2014 MCP server for AI agent communication",
   "type": "module",
   "main": "dist/mcp/server.js",

package/shared/code-block.css

@@ -0,0 +1,193 @@
+/* ─── Shared Fenced Code Block & Syntax Highlighting Styles ─── */
+
+.fenced-code-block {
+  position: relative;
+  max-width: 100%;
+  margin: 0.75em 0;
+  padding: 0;
+  overflow: hidden;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-md, 8px);
+  background: var(--code-bg, color-mix(in srgb, var(--bg) 88%, transparent));
+  color: var(--code-text, var(--text));
+  font-family: var(--font-mono);
+  font-size: 0.82rem;
+  line-height: 1.55;
+}
+
+.fenced-code-block-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 6px 12px;
+  background: var(--code-header-bg, color-mix(in srgb, var(--text) 4%, transparent));
+  border-bottom: 1px solid var(--border);
+  user-select: none;
+  font-family: var(--font-sans);
+  font-size: 0.75rem;
+  line-height: 1.2;
+}
+
+.fenced-code-block-lang {
+  color: var(--code-lang, var(--text-secondary));
+  font-weight: 500;
+  text-transform: lowercase;
+}
+
+.fenced-code-block-lang[data-lang]::before {
+  content: attr(data-lang);
+}
+
+.fenced-code-block-copy {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  margin-left: auto;
+  padding: 3px 8px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm, 4px);
+  background: var(--code-copy-bg, transparent);
+  color: var(--code-copy-text, var(--text-secondary));
+  font-family: var(--font-sans);
+  font-size: 0.72rem;
+  font-weight: 500;
+  line-height: 1.2;
+  cursor: pointer;
+  transition: color var(--duration-fast, 150ms) var(--ease-out, ease),
+              background var(--duration-fast, 150ms) var(--ease-out, ease),
+              border-color var(--duration-fast, 150ms) var(--ease-out, ease);
+}
+
+@media (hover: hover) and (pointer: fine) {
+  .fenced-code-block-copy:hover {
+    background: var(--accent-hover, rgba(255, 255, 255, 0.08));
+    color: var(--text);
+    border-color: var(--border-strong);
+  }
+}
+
+.fenced-code-block-copy:focus-visible {
+  outline: 2px solid var(--blue, #3b82f6);
+  outline-offset: 1px;
+}
+
+.fenced-code-block-copy::before {
+  content: "Copy";
+}
+
+.fenced-code-block-copy[data-copied="true"] {
+  color: var(--green-text, #4ade80);
+  border-color: color-mix(in srgb, var(--green-text, #4ade80) 40%, transparent);
+}
+
+.fenced-code-block-copy[data-copied="true"]::before {
+  content: "Copied";
+}
+
+.fenced-code-block-copy[data-copied="error"] {
+  color: var(--red-text, #f87171);
+  border-color: color-mix(in srgb, var(--red-text, #f87171) 40%, transparent);
+}
+
+.fenced-code-block-copy[data-copied="error"]::before {
+  content: "Failed";
+}
+
+/*
+ * Eleven different surfaces across desktop and web (e.g. chat messages, long message reader,
+ * board task inspector, thread panel, events view, markdown editor preview, agent inspector)
+ * define conflicting styles for `pre` with varying selector specificity.
+ * The `!important` declarations below ensure the fenced code block pre maintains a clean,
+ * borderless, transparent container with standard monospace sizing across all surfaces.
+ */
+.fenced-code-block pre {
+  margin: 0 !important;
+  padding: 10px 14px !important;
+  overflow-x: auto !important;
+  border: none !important;
+  border-radius: 0 !important;
+  background: transparent !important;
+  line-height: 1.55;
+  font-family: var(--font-mono);
+  font-size: 0.82rem;
+  white-space: pre;
+}
+
+.fenced-code-block code.fenced-code-block-content {
+  display: block;
+  padding: 0;
+  overflow-x: visible;
+  background: transparent;
+  color: inherit;
+  font-family: inherit;
+  font-size: inherit;
+  line-height: inherit;
+  white-space: pre;
+}
+
+/* ─── Syntax Highlighting Token Mappings ─── */
+.hljs-comment,
+.hljs-quote {
+  color: var(--code-comment, var(--text-secondary));
+  font-style: italic;
+}
+
+.hljs-keyword,
+.hljs-selector-tag,
+.hljs-subst {
+  color: var(--code-keyword, var(--task-assigned));
+}
+
+.hljs-string,
+.hljs-doctag,
+.hljs-regexp {
+  color: var(--code-string, var(--green-text));
+}
+
+.hljs-number,
+.hljs-literal {
+  color: var(--code-number, var(--amber-text));
+}
+
+.hljs-title,
+.hljs-title.function_,
+.hljs-title.class_,
+.hljs-section {
+  color: var(--code-function, var(--blue-text));
+}
+
+.hljs-variable,
+.hljs-template-variable,
+.hljs-attr,
+.hljs-attribute {
+  color: var(--code-variable, var(--task-in-review));
+}
+
+.hljs-type,
+.hljs-built_in,
+.hljs-name {
+  color: var(--code-type, var(--red-text));
+}
+
+.hljs-meta,
+.hljs-tag {
+  color: var(--code-comment, var(--text-secondary));
+}
+
+.hljs-addition {
+  color: var(--code-string, var(--green-text));
+  background-color: var(--green-dim, rgba(34, 197, 94, 0.12));
+}
+
+.hljs-deletion {
+  color: var(--code-type, var(--red-text));
+  background-color: var(--red-dim, rgba(239, 68, 68, 0.12));
+}
+
+.hljs-emphasis {
+  font-style: italic;
+}
+
+.hljs-strong {
+  font-weight: bold;
+}

package/shared/code-highlighting.d.mts

@@ -0,0 +1,109 @@
+export type CanonicalLanguage =
+  | 'javascript'
+  | 'typescript'
+  | 'python'
+  | 'bash'
+  | 'json'
+  | 'yaml'
+  | 'xml'
+  | 'css'
+  | 'sql'
+  | 'diff'
+  | 'rust'
+  | 'go'
+  | 'c'
+  | 'cpp'
+  | 'java'
+  | 'csharp'
+  | 'dockerfile'
+  | 'ruby'
+  | 'php'
+  | 'swift'
+  | 'kotlin'
+  | 'ini';
+
+export type LanguageAlias =
+  | 'js'
+  | 'jsx'
+  | 'mjs'
+  | 'cjs'
+  | 'ts'
+  | 'tsx'
+  | 'mts'
+  | 'cts'
+  | 'py'
+  | 'sh'
+  | 'zsh'
+  | 'shell'
+  | 'yml'
+  | 'html'
+  | 'xhtml'
+  | 'svg'
+  | 'rs'
+  | 'golang'
+  | 'c++'
+  | 'cc'
+  | 'hpp'
+  | 'h'
+  | 'cs'
+  | 'docker'
+  | 'rb'
+  | 'kt'
+  | 'kts'
+  | 'toml';
+
+export type CodeHighlightLanguage = CanonicalLanguage;
+
+export interface ResolvedLanguage {
+  canonical: CanonicalLanguage;
+  label: string;
+}
+
+export interface CodeHighlighterOptions {
+  highlight: (code: string, canonicalLanguage: CanonicalLanguage) => string;
+  now?: () => number;
+  maxBudgetMs?: number;
+  windowMs?: number;
+}
+
+export interface CodeHighlighter {
+  renderCodeBlock(code: string, rawTag?: string): string;
+  cache: CodeHighlightCache;
+  resolveLanguage(rawTag?: string): ResolvedLanguage | null;
+}
+
+export const CANONICAL_LANGUAGES: readonly CanonicalLanguage[];
+export const LANGUAGE_ALIASES: ReadonlyMap<string, CanonicalLanguage>;
+
+export const MAX_HIGHLIGHT_CHARS: number;
+export const MAX_HIGHLIGHT_LINES: number;
+export const MAX_HIGHLIGHT_LINE_LENGTH: number;
+export const MAX_CACHE_ENTRIES: number;
+export const MAX_CACHE_CHARS: number;
+
+export const DEFAULT_TIME_BUDGET_MS: number;
+export const DEFAULT_TIME_WINDOW_MS: number;
+
+export function escapeHtml(value: unknown): string;
+export function escapeAttribute(value: unknown): string;
+export function resolveLanguage(rawTag?: string): ResolvedLanguage | null;
+
+export class CodeHighlightCache {
+  constructor(maxEntries?: number, maxChars?: number);
+  get(key: string): string | undefined;
+  set(key: string, value: string): void;
+  clear(): void;
+  readonly size: number;
+  readonly totalChars: number;
+}
+
+export function createCodeHighlighter(options: CodeHighlighterOptions): CodeHighlighter;
+export function executeCodeBlockCopy(
+  button: HTMLButtonElement,
+  textToCopy: string | null,
+  copyFn: (text: string) => Promise<boolean> | boolean,
+  copyTimers?: WeakMap<HTMLButtonElement, number>
+): Promise<{ success: boolean; timerId: number | null }>;
+export function setupCodeBlockCopyListener(
+  copyFn: (text: string) => Promise<boolean> | boolean
+): () => void;

package/shared/code-highlighting.mjs

@@ -0,0 +1,345 @@
+export const CANONICAL_LANGUAGES = Object.freeze([
+  'javascript',
+  'typescript',
+  'python',
+  'bash',
+  'json',
+  'yaml',
+  'xml',
+  'css',
+  'sql',
+  'diff',
+  'rust',
+  'go',
+  'c',
+  'cpp',
+  'java',
+  'csharp',
+  'dockerfile',
+  'ruby',
+  'php',
+  'swift',
+  'kotlin',
+  'ini',
+]);
+
+const CANONICAL_SET = new Set(CANONICAL_LANGUAGES);
+
+export const LANGUAGE_ALIASES = new Map([
+  // JavaScript
+  ['js', 'javascript'],
+  ['jsx', 'javascript'],
+  ['mjs', 'javascript'],
+  ['cjs', 'javascript'],
+  // TypeScript
+  ['ts', 'typescript'],
+  ['tsx', 'typescript'],
+  ['mts', 'typescript'],
+  ['cts', 'typescript'],
+  // Python
+  ['py', 'python'],
+  // Bash / Shell
+  ['sh', 'bash'],
+  ['zsh', 'bash'],
+  ['shell', 'bash'],
+  // YAML
+  ['yml', 'yaml'],
+  // XML / HTML / SVG
+  ['html', 'xml'],
+  ['xhtml', 'xml'],
+  ['svg', 'xml'],
+  // Rust
+  ['rs', 'rust'],
+  // Go
+  ['golang', 'go'],
+  // C / C++
+  ['c++', 'cpp'],
+  ['cc', 'cpp'],
+  ['cxx', 'cpp'],
+  ['hpp', 'cpp'],
+  ['h', 'c'],
+  // C#
+  ['cs', 'csharp'],
+  // Dockerfile
+  ['docker', 'dockerfile'],
+  // Ruby
+  ['rb', 'ruby'],
+  // Kotlin
+  ['kt', 'kotlin'],
+  ['kts', 'kotlin'],
+  // INI / TOML
+  ['toml', 'ini'],
+]);
+
+export const MAX_HIGHLIGHT_CHARS = 5_000;
+export const MAX_HIGHLIGHT_LINES = 250;
+export const MAX_HIGHLIGHT_LINE_LENGTH = 1_000;
+export const MAX_CACHE_ENTRIES = 500;
+export const MAX_CACHE_CHARS = 2_000_000;
+
+export const DEFAULT_TIME_BUDGET_MS = 250;
+export const DEFAULT_TIME_WINDOW_MS = 1_000;
+
+export function escapeHtml(value) {
+  return String(value ?? '')
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
+export function escapeAttribute(value) {
+  return String(value ?? '')
+    .replace(/&/g, '&amp;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;');
+}
+
+export function resolveLanguage(rawTag) {
+  if (!rawTag || typeof rawTag !== 'string') return null;
+  const normalized = rawTag.trim().toLowerCase();
+  if (!normalized) return null;
+
+  if (CANONICAL_SET.has(normalized)) {
+    return {
+      canonical: normalized,
+      label: normalized,
+    };
+  }
+
+  const aliasTarget = LANGUAGE_ALIASES.get(normalized);
+  if (aliasTarget && CANONICAL_SET.has(aliasTarget)) {
+    return {
+      canonical: aliasTarget,
+      label: normalized,
+    };
+  }
+
+  return null;
+}
+
+export class CodeHighlightCache {
+  constructor(maxEntries = MAX_CACHE_ENTRIES, maxChars = MAX_CACHE_CHARS) {
+    this.maxEntries = maxEntries;
+    this.maxChars = maxChars;
+    this.map = new Map();
+    this.currentChars = 0;
+  }
+
+  get(key) {
+    if (!this.map.has(key)) return undefined;
+    const value = this.map.get(key);
+    this.map.delete(key);
+    this.map.set(key, value);
+    return value;
+  }
+
+  set(key, value) {
+    const entryChars = key.length + value.length;
+    if (this.map.has(key)) {
+      const oldVal = this.map.get(key);
+      this.currentChars -= (key.length + oldVal.length);
+      this.map.delete(key);
+    }
+    this.currentChars += entryChars;
+    this.map.set(key, value);
+    while (this.map.size > this.maxEntries || this.currentChars > this.maxChars) {
+      const oldestKey = this.map.keys().next().value;
+      if (oldestKey === undefined) break;
+      const oldestVal = this.map.get(oldestKey);
+      this.currentChars -= (oldestKey.length + oldestVal.length);
+      this.map.delete(oldestKey);
+    }
+  }
+
+  clear() {
+    this.map.clear();
+    this.currentChars = 0;
+  }
+
+  get size() {
+    return this.map.size;
+  }
+
+  get totalChars() {
+    return this.currentChars;
+  }
+}
+
+export function createCodeHighlighter(options) {
+  const highlight = options?.highlight;
+  const now = options?.now ?? (() => (typeof performance !== 'undefined' ? performance.now() : Date.now()));
+  const maxBudgetMs = options?.maxBudgetMs ?? DEFAULT_TIME_BUDGET_MS;
+  const windowMs = options?.windowMs ?? DEFAULT_TIME_WINDOW_MS;
+
+  const cache = new CodeHighlightCache();
+
+  // Sliding window execution time tracker
+  // Worst-case main-thread freeze per second:
+  // An attacker sending 200 distinct worst-case blocks in a single message can trigger
+  // at most one block that starts when spentTime < 250ms (e.g. at 249ms plus one block
+  // taking ~60ms), bounding synchronous computation to ~310ms per 1,000ms sliding window.
+  // Once the 250ms budget is reached, subsequent blocks in that window immediately
+  // fall back to plain escaped text (<0.01ms each) without caching the fallback.
+  const budgetEntries = [];
+
+  function getSpentTime(currentTime) {
+    const cutoff = currentTime - windowMs;
+    while (budgetEntries.length > 0 && budgetEntries[0].timestamp <= cutoff) {
+      budgetEntries.shift();
+    }
+    let total = 0;
+    for (let i = 0; i < budgetEntries.length; i++) {
+      total += budgetEntries[i].duration;
+    }
+    return total;
+  }
+
+  function renderCodeBlock(code, rawTag) {
+    const resolved = resolveLanguage(rawTag);
+    const codeString = String(code ?? '');
+
+    let exceedsSize = codeString.length > MAX_HIGHLIGHT_CHARS;
+    if (!exceedsSize) {
+      let lineCount = 1;
+      let currentLineLen = 0;
+      for (let i = 0; i < codeString.length; i++) {
+        const ch = codeString.charCodeAt(i);
+        if (ch === 10) {
+          lineCount++;
+          if (lineCount > MAX_HIGHLIGHT_LINES) {
+            exceedsSize = true;
+            break;
+          }
+          currentLineLen = 0;
+        } else {
+          currentLineLen++;
+          if (currentLineLen > MAX_HIGHLIGHT_LINE_LENGTH) {
+            exceedsSize = true;
+            break;
+          }
+        }
+      }
+    }
+
+    let codeHtml;
+    if (!resolved || exceedsSize || typeof highlight !== 'function') {
+      codeHtml = escapeHtml(codeString);
+    } else {
+      const cacheKey = `${resolved.canonical}:${codeString}`;
+      const cached = cache.get(cacheKey);
+      if (cached !== undefined) {
+        // Cache hit: costs nothing against the sliding time budget
+        codeHtml = cached;
+      } else {
+        const currentTime = now();
+        const spent = getSpentTime(currentTime);
+        if (spent >= maxBudgetMs) {
+          // Budget exhausted: fall back to plain escaped text, do NOT cache
+          codeHtml = escapeHtml(codeString);
+        } else {
+          const t0 = now();
+          try {
+            const highlighted = highlight(codeString, resolved.canonical);
+            codeHtml = typeof highlighted === 'string' ? highlighted : escapeHtml(codeString);
+          } catch {
+            codeHtml = escapeHtml(codeString);
+          }
+          const t1 = now();
+          const duration = Math.max(0, t1 - t0);
+          budgetEntries.push({ timestamp: t0, duration });
+          cache.set(cacheKey, codeHtml);
+        }
+      }
+    }
+
+    const headerContent = resolved
+      ? `<span class="fenced-code-block-lang" data-lang="${escapeAttribute(resolved.label)}"></span><button type="button" class="fenced-code-block-copy" data-code-copy aria-label="Copy code"></button>`
+      : `<button type="button" class="fenced-code-block-copy" data-code-copy aria-label="Copy code"></button>`;
+
+    const langClass = resolved ? ` language-${escapeAttribute(resolved.label)}` : '';
+
+    return `<div class="fenced-code-block"><div class="fenced-code-block-header">${headerContent}</div><pre><code class="fenced-code-block-content${langClass}">${codeHtml}</code></pre></div>`;
+  }
+
+  return {
+    renderCodeBlock,
+    cache,
+    resolveLanguage,
+  };
+}
+
+export async function executeCodeBlockCopy(button, textToCopy, copyFn, copyTimers = new WeakMap()) {
+  let success = false;
+  if (textToCopy !== null && typeof textToCopy === 'string') {
+    try {
+      success = Boolean(await copyFn(textToCopy));
+    } catch {
+      success = false;
+    }
+  }
+
+  // Clear previous timer AFTER the await to avoid timer races on rapid clicks
+  const prevTimer = copyTimers.get(button);
+  if (prevTimer !== undefined) {
+    clearTimeout(prevTimer);
+    copyTimers.delete(button);
+  }
+
+  if (!button.isConnected) return { success, timerId: null };
+
+  if (success) {
+    button.setAttribute('data-copied', 'true');
+    button.setAttribute('aria-label', 'Copied to clipboard');
+  } else {
+    button.setAttribute('data-copied', 'error');
+    button.setAttribute('aria-label', 'Failed to copy to clipboard');
+  }
+
+  const timerId = setTimeout(() => {
+    if (copyTimers.get(button) === timerId) {
+      copyTimers.delete(button);
+    }
+    if (button.isConnected) {
+      button.removeAttribute('data-copied');
+      button.setAttribute('aria-label', 'Copy code');
+    }
+  }, 2000);
+
+  copyTimers.set(button, timerId);
+  return { success, timerId };
+}
+
+export function setupCodeBlockCopyListener(copyFn) {
+  if (typeof document === 'undefined') return () => {};
+
+  const copyTimers = new WeakMap();
+
+  async function handleCopyClick(event) {
+    const target = event?.target;
+    const button = target && typeof target.closest === 'function' ? target.closest('[data-code-copy]') : null;
+    if (!button) return;
+
+    // Prevent default button actions, but do NOT stop propagation so outside-click
+    // listeners (e.g. popover dismissal) still see the event.
+    event.preventDefault();
+
+    const container = button.closest('.fenced-code-block');
+    const codeEl = container?.querySelector('pre code.fenced-code-block-content') || container?.querySelector('code');
+    if (!codeEl) {
+      await executeCodeBlockCopy(button, null, copyFn, copyTimers);
+      return;
+    }
+
+    const textToCopy = codeEl.textContent ?? '';
+    await executeCodeBlockCopy(button, textToCopy, copyFn, copyTimers);
+  }
+
+  document.addEventListener('click', handleCopyClick, true);
+  return () => {
+    document.removeEventListener('click', handleCopyClick, true);
+  };
+}

package/shared/codex-owner-isolation.mjs

@@ -188,7 +188,7 @@ export function assertProjectKeepsLetAgentsServer(inProject, outsideProject) {
 /**
  * Every override a LetAgents launch adds: the features, each personal skill,
  * and every MCP server but LetAgents. `cwd` is where the app-server starts and
- * `configOverrides` are the launch's own (for example project trust), used to
+ * `configOverrides` are the launch's own (for example the room's server), used to
  * list servers as the launch will see them. A launch that cannot list its
  * servers, or whose project changes the LetAgents server, fails here.
  */