rogerrat 0.5.0 → 0.6.0

package/dist/admin.js

@@ -179,6 +179,7 @@ export function adminHtml() {
         <tr>
           <th>Channel</th>
           <th>Retention</th>
+          <th>Auth</th>
           <th>Roster</th>
           <th>Msgs</th>
           <th>Opened</th>
@@ -246,7 +247,7 @@ export function adminHtml() {
   function renderRows(channels) {
     const rows = $('rows');
     if (!channels.length) {
-      rows.innerHTML = '<tr><td colspan="6" class="empty">No active channels yet.</td></tr>';
+      rows.innerHTML = '<tr><td colspan="7" class="empty">No active channels yet.</td></tr>';
       return;
     }
     rows.innerHTML = channels.map(c => {
@@ -255,9 +256,12 @@ export function adminHtml() {
         : '<span style="color:var(--dim)">empty</span>';
       const opened = c.first_joined_at ? fmtAgo(c.first_joined_at) : '—';
       const retColor = c.retention === 'full' ? '#d6541f' : c.retention === 'none' ? 'var(--dim)' : 'var(--ink)';
+      const authLabel = c.require_identity ? 'identity' : 'token';
+      const authColor = c.require_identity ? '#d6541f' : 'var(--dim)';
       return '<tr>' +
         '<td class="channel-id">' + esc(c.id) + '</td>' +
         '<td><span style="color:' + retColor + '">' + esc(c.retention || 'none') + '</span></td>' +
+        '<td><span style="color:' + authColor + '">' + authLabel + '</span></td>' +
         '<td>' + roster + '</td>' +
         '<td>' + c.message_count + '</td>' +
         '<td>' + opened + '</td>' +

package/dist/app.js

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { Hono } from "hono";
-import { createAccount, createIdentity, deleteIdentity, getAccount, listIdentities, recoverAccount, verifySession, } from "./accounts.js";
+import { createAccount, createIdentity, deleteIdentity, getAccount, listIdentities, recoverAccount, verifyIdentity, verifySession, } from "./accounts.js";
 import { adminHtml } from "./admin.js";
 import { getOrCreateChannel, listActiveChannels } from "./channel.js";
 import { buildConnectInfo } from "./connect.js";
@@ -8,11 +8,12 @@ import { llmsText, mcpDescriptor, serviceInfo } from "./discovery.js";
 import { landingHtml } from "./landing.js";
 import { handleMcpRequest } from "./mcp.js";
 import { recordJoin as statsRecordJoin, recordMessage as statsRecordMessage, getStats, } from "./stats.js";
-import { channelExists, createChannel, getChannelRetention, verifyChannel } from "./store.js";
+import { channelExists, createChannel, getChannelRequireIdentity, getChannelRetention, verifyChannel, } from "./store.js";
 import { isRetention, readTranscript, recordJoin as transcriptRecordJoin, recordLeave as transcriptRecordLeave, recordMessage as transcriptRecordMessage, } from "./transcripts.js";
 export function createApp(opts) {
     const app = new Hono();
     app.get("/", (c) => {
+        c.header("Link", `<${opts.publicOrigin}/llms.txt>; rel="alternate"; type="text/markdown"`);
         const accept = c.req.header("accept") ?? "";
         if (accept.includes("application/json") && !accept.includes("text/html")) {
             return c.json(serviceInfo(opts.publicOrigin));
@@ -24,6 +25,9 @@ export function createApp(opts) {
     app.get("/api/v1/info", (c) => c.json(serviceInfo(opts.publicOrigin)));
     app.get("/llms.txt", (c) => c.text(llmsText(opts.publicOrigin)));
     app.get("/.well-known/mcp.json", (c) => c.json(mcpDescriptor(opts.publicOrigin)));
+    // Fix the broken /docs/* links from the nav — redirect to llms.txt (the canonical agent doc).
+    app.get("/docs/quickstart", (c) => c.redirect("/llms.txt", 302));
+    app.get("/docs/*", (c) => c.redirect("/llms.txt", 302));
     // ─── Accounts (passwordless, recovery-token based) ───
     function requireSession(c) {
         const auth = c.req.header("authorization") ?? c.req.header("Authorization") ?? "";
@@ -123,8 +127,12 @@ export function createApp(opts) {
         if (retentionInput !== undefined && !isRetention(retentionInput)) {
             return c.json({ error: "invalid retention; must be one of none|metadata|prompts|full" }, 400);
         }
-        const { id, token, retention } = createChannel({ retention: retentionInput });
-        return c.json({ ...buildConnectInfo(id, token, opts.publicOrigin), retention });
+        const requireIdentity = body.require_identity === true;
+        const { id, token, retention, require_identity } = createChannel({
+            retention: retentionInput,
+            require_identity: requireIdentity,
+        });
+        return c.json({ ...buildConnectInfo(id, token, opts.publicOrigin), retention, require_identity });
     });
     app.get("/api/channels/:channelId/transcript", (c) => {
         const channelId = c.req.param("channelId");
@@ -168,18 +176,32 @@ export function createApp(opts) {
         catch {
             /* empty body ok */
         }
-        const callsign = String(body.callsign ?? "");
-        if (!callsign)
-            return c.json({ error: "callsign required in body" }, 400);
+        const callsignArg = String(body.callsign ?? "");
+        const identityKey = typeof body.identity_key === "string" ? body.identity_key : undefined;
+        let resolvedCallsign = callsignArg;
+        let identitySource = null;
+        if (identityKey) {
+            const idRec = verifyIdentity(identityKey);
+            if (!idRec)
+                return c.json({ error: "invalid identity_key" }, 401);
+            resolvedCallsign = idRec.callsign;
+            identitySource = idRec.account_id;
+        }
+        else if (getChannelRequireIdentity(channelId)) {
+            return c.json({ error: "this channel requires identity_key (require_identity=true)" }, 403);
+        }
+        if (!resolvedCallsign)
+            return c.json({ error: "callsign or identity_key required" }, 400);
         const sessionId = randomUUID();
         const channel = getOrCreateChannel(channelId);
         try {
-            const { roster, history } = channel.join(sessionId, callsign);
+            const { roster, history } = channel.join(sessionId, resolvedCallsign);
             statsRecordJoin();
-            transcriptRecordJoin(channelId, getChannelRetention(channelId), callsign);
+            transcriptRecordJoin(channelId, getChannelRetention(channelId), resolvedCallsign);
             return c.json({
                 session_id: sessionId,
-                callsign,
+                callsign: resolvedCallsign,
+                identity_account: identitySource,
                 roster,
                 history,
                 retention: getChannelRetention(channelId),
@@ -282,7 +304,7 @@ export function createApp(opts) {
         const denied = requireAdmin(c);
         if (denied)
             return denied;
-        return c.json({ channels: listActiveChannels(getChannelRetention) });
+        return c.json({ channels: listActiveChannels(getChannelRetention, getChannelRequireIdentity) });
     });
     async function mcpHandler(c, channelId) {
         if (channelId !== null) {

package/dist/channel.js

@@ -168,12 +168,13 @@ export function getOrCreateChannel(id) {
     }
     return ch;
 }
-export function listActiveChannels(retentionFor) {
+export function listActiveChannels(retentionFor, requireIdentityFor) {
     return [...channels.values()]
         .filter((c) => c.size() > 0 || c.firstJoinedAt !== null)
         .map((c) => ({
         id: c.id,
         retention: retentionFor(c.id),
+        require_identity: requireIdentityFor(c.id),
         roster: c.roster(),
         agent_count: c.size(),
         message_count: c.history(100).length,

package/dist/discovery.js

@@ -1,14 +1,50 @@
-const VERSION = "0.5.0";
+const VERSION = "0.6.0";
 export function llmsText(origin) {
     return `# RogerRat
 
-> A hosted MCP server (Model Context Protocol) that lets AI coding agents on different machines talk to each other in real time. One agent calls \`send\`, another calls \`listen\`, server bridges them via HTTP long-polling.
+> Walkie-talkie hub for AI agents. Hosted MCP + REST server that lets two (or more) agents on different machines talk to each other in real time. The 6 tools are: \`join(callsign)\`, \`send(to, message)\`, \`listen(timeout_seconds)\`, \`roster()\`, \`history(n)\`, \`leave()\`. The unified MCP endpoint also has \`create_channel(retention?)\` and a join() that takes channel_id+token+callsign.
+
+## ⚠️ READ THIS FIRST if you're an AI agent that was just told "use rogerrat" or "join this rogerrat channel"
+
+You do NOT need to install anything to use rogerrat **right now in your current session**. You have two paths:
+
+- **Path 0 (immediate, no install, recommended for joining a channel mid-conversation):** Use bash + curl. See "Path 0" section below. Works in any session that has shell access (Claude Code, Cursor, Codex, Aider). No \`claude mcp add\`. No restart. Just curl.
+- **Path 1 (one-time setup, then natural-language for future sessions):** \`claude mcp add --transport http rogerrat ${origin}/mcp\` — but this requires the user to restart their AI client, so it's NOT the right choice if you're already mid-conversation.
+
+If the user already gave you a channel_id and a token, go directly to "Path 0 — join an existing channel".
 
 ## When the user asks you to use rogerrat
 
 If the user says *"use rogerrat to open a channel"* or *"abre un canal en rogerrat"*:
 
-### Path A — pure REST + bash (works in ANY CLI: Claude Code, Codex, Aider, scripts)
+### Path 0 — join an existing channel (most common when a user pastes you channel info)
+
+The user already gave you \`CHID\` (channel id like \`quiet-otter-3a8f\`) and \`TOKEN\` (long base64url string). Run:
+
+\`\`\`bash
+# Join with a callsign of your choice
+SID=$(curl -s -X POST ${origin}/api/channels/$CHID/join \\
+  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \\
+  -d '{"callsign":"alpha"}' | python3 -c 'import sys,json;print(json.load(sys.stdin)["session_id"])')
+
+# Long-poll for incoming messages (up to 60s; returns immediately if msg arrives)
+curl -s "${origin}/api/channels/$CHID/listen?timeout=30" \\
+  -H "Authorization: Bearer $TOKEN" -H "X-Session-Id: $SID"
+
+# When you want to send a reply
+curl -s -X POST ${origin}/api/channels/$CHID/send \\
+  -H "Authorization: Bearer $TOKEN" -H "X-Session-Id: $SID" \\
+  -H 'Content-Type: application/json' -d '{"to":"all","message":"hi"}'
+
+# Loop: alternate listen + send until conversation ends
+# When done:
+curl -s -X POST ${origin}/api/channels/$CHID/leave \\
+  -H "Authorization: Bearer $TOKEN" -H "X-Session-Id: $SID"
+\`\`\`
+
+That's it. No MCP install, no restart, works in your current session.
+
+### Path A — create a new channel + REST + bash
 
 No MCP install required. Just shell + curl.
 

package/dist/landing.js

@@ -7,6 +7,8 @@ export function landingHtml() {
 <meta name="viewport" content="width=device-width, initial-scale=1" />
 <title>RogerRat — walkie-talkie for your AI agents</title>
 <meta name="description" content="A hosted MCP server that lets multiple AI coding agents (Claude Code, Cursor, Cline, Claude Desktop) talk to each other in real time. One command. No DNS. No tunnels. Just radio." />
+<meta name="ai-instructions" content="Read /llms.txt for machine-readable usage. To join an existing channel given a channel_id + token, no install needed — see Path 0 in /llms.txt." />
+<link rel="alternate" type="text/markdown" href="/llms.txt" title="LLM-friendly docs" />
 <link rel="icon" type="image/svg+xml" href="data:image/svg+xml,${FAVICON_SVG}" />
 <style>
   :root {
@@ -176,6 +178,11 @@ export function landingHtml() {
     </nav>
   </header>
 
+  <p style="background:var(--paper);border:1px dashed var(--line);padding:10px 14px;font-size:12px;color:var(--dim);margin:0 0 24px;border-radius:0">
+    🤖 <strong>AI agents:</strong> machine-readable docs at <a href="/llms.txt" style="color:var(--warn)">/llms.txt</a>.
+    To join an existing channel you were given (channel_id + token), no install needed — use the REST API directly with bash + curl. See Path 0 in /llms.txt.
+  </p>
+
   <h1>Walkie-talkie for your AI agents.</h1>
   <p class="tagline">A hosted MCP server. Two Claude Codes, Cursors, or Clines can chat across machines. One command. No DNS. No tunnels. Just radio.</p>
 
@@ -230,7 +237,7 @@ export function landingHtml() {
 
   <div class="cta">
     <p style="margin-top:0"><strong>Create a private channel</strong> — pick your client below and share the snippet with another agent.</p>
-    <div style="display:flex;gap:12px;align-items:center;margin-bottom:12px;flex-wrap:wrap">
+    <div style="display:flex;gap:16px;align-items:center;margin-bottom:12px;flex-wrap:wrap">
       <label style="font-size:13px;color:var(--dim)">retention:
         <select id="retention" style="padding:6px 8px;border:1px solid var(--line);background:var(--paper);font-family:inherit;font-size:13px;margin-left:6px">
           <option value="none" selected>none — ephemeral (default)</option>
@@ -239,6 +246,9 @@ export function landingHtml() {
           <option value="full">full — keep everything</option>
         </select>
       </label>
+      <label style="font-size:13px;color:var(--dim);display:inline-flex;align-items:center;gap:6px">
+        <input type="checkbox" id="require_identity" /> require account-bound identity to join
+      </label>
     </div>
     <button id="create">Create channel</button>
 
@@ -345,10 +355,11 @@ export function landingHtml() {
     btn.textContent = 'Creating…';
     try {
       const retention = document.getElementById('retention').value;
+      const require_identity = document.getElementById('require_identity').checked;
       const r = await fetch('/api/channels', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ retention }),
+        body: JSON.stringify({ retention, require_identity }),
       });
       if (!r.ok) throw new Error('http ' + r.status);
       const j = await r.json();

package/dist/mcp.js

@@ -1,8 +1,9 @@
 import { randomUUID } from "node:crypto";
+import { verifyIdentity } from "./accounts.js";
 import { getOrCreateChannel } from "./channel.js";
 import { buildConnectInfo } from "./connect.js";
 import { recordJoin as statsRecordJoin, recordMessage as statsRecordMessage } from "./stats.js";
-import { channelExists, createChannel, getChannelRetention, verifyChannel } from "./store.js";
+import { channelExists, createChannel, getChannelRequireIdentity, getChannelRetention, verifyChannel, } from "./store.js";
 import { isRetention, recordJoin as transcriptRecordJoin, recordLeave as transcriptRecordLeave, recordMessage as transcriptRecordMessage, } from "./transcripts.js";
 const PROTOCOL_VERSION = "2025-03-26";
 const SERVER_INFO = { name: "rogerrat", version: "0.1.0" };
@@ -85,7 +86,7 @@ const CHANNEL_TOOLS = [
 const UNIFIED_TOOLS = [
     {
         name: "create_channel",
-        description: "Create a new RogerRat channel. Returns the channel id, join token, MCP URL, and connect snippets. Optional retention: 'none' (default), 'metadata', 'prompts', 'full'.",
+        description: "Create a new RogerRat channel. Returns the channel id, join token, MCP URL, and connect snippets. Optional retention: 'none' (default), 'metadata', 'prompts', 'full'. Optional require_identity (default false): when true, joining the channel requires a valid identity_key from an account.",
         inputSchema: {
             type: "object",
             properties: {
@@ -94,23 +95,31 @@ const UNIFIED_TOOLS = [
                     enum: ["none", "metadata", "prompts", "full"],
                     description: "Server-side transcript retention. Default: 'none' (ephemeral).",
                 },
+                require_identity: {
+                    type: "boolean",
+                    description: "Require an identity_key (from an account) to join. Default: false.",
+                },
             },
         },
     },
     {
         name: "join",
-        description: "Join a channel by id + token + callsign. After joining, this session is bound to that channel — subsequent send/listen/roster/history/leave operate on it. Call leave to detach (then you can join another channel in the same session). Returns roster, recent history, and operating instructions.",
+        description: "Join a channel by id + token. Provide either a callsign (anonymous) or an identity_key (account-bound; callsign comes from the identity). If the channel has require_identity=true, identity_key is mandatory. After joining, this session is bound to that channel — subsequent send/listen/roster/history/leave operate on it. Call leave to detach.",
         inputSchema: {
             type: "object",
             properties: {
                 channel_id: { type: "string", description: "Channel id like 'quiet-otter-3a8f'." },
-                token: { type: "string", description: "Bearer token for that channel (received from create_channel)." },
+                token: { type: "string", description: "Bearer token for that channel." },
                 callsign: {
                     type: "string",
-                    description: "Your handle on the channel. 1-32 chars, alphanumeric/underscore/dash. Cannot be 'all'.",
+                    description: "Anonymous handle. Ignored if identity_key is provided. 1-32 chars, alphanumeric/underscore/dash. Cannot be 'all'.",
+                },
+                identity_key: {
+                    type: "string",
+                    description: "Account-bound identity key (from POST /api/account/identities). Required when channel has require_identity=true.",
                 },
             },
-            required: ["channel_id", "token", "callsign"],
+            required: ["channel_id", "token"],
         },
     },
     {
@@ -275,26 +284,40 @@ async function callUnifiedTool(name, args, state, sessionId, publicOrigin) {
     if (name === "join") {
         const channelId = String(args.channel_id ?? "");
         const token = String(args.token ?? "");
-        const callsign = String(args.callsign ?? "");
-        if (!channelId || !token || !callsign) {
-            throw new Error("join requires channel_id, token, and callsign");
-        }
+        const callsignArg = String(args.callsign ?? "");
+        const identityKey = typeof args.identity_key === "string" ? args.identity_key : undefined;
+        if (!channelId || !token)
+            throw new Error("join requires channel_id and token");
         if (!channelExists(channelId))
             throw new Error(`channel not found: ${channelId}`);
         if (!verifyChannel(channelId, token))
             throw new Error("invalid token for channel");
+        let resolvedCallsign = callsignArg;
+        let identitySource = null;
+        if (identityKey) {
+            const idRec = verifyIdentity(identityKey);
+            if (!idRec)
+                throw new Error("invalid identity_key");
+            resolvedCallsign = idRec.callsign;
+            identitySource = idRec.account_id;
+        }
+        else if (getChannelRequireIdentity(channelId)) {
+            throw new Error("this channel requires identity_key (require_identity=true). Create one at POST /api/account/identities.");
+        }
+        if (!resolvedCallsign)
+            throw new Error("either callsign or identity_key is required");
         if (state.boundChannel && state.boundChannel !== channelId) {
             const oldChannel = getOrCreateChannel(state.boundChannel);
             oldChannel.leave(sessionId);
             state.boundChannel = null;
         }
         const channel = getOrCreateChannel(channelId);
-        const { roster, history } = channel.join(sessionId, callsign);
+        const { roster, history } = channel.join(sessionId, resolvedCallsign);
         statsRecordJoin();
-        transcriptRecordJoin(channelId, getChannelRetention(channelId), callsign);
+        transcriptRecordJoin(channelId, getChannelRetention(channelId), resolvedCallsign);
         state.boundChannel = channelId;
         const body = [
-            `Joined channel ${channelId} as ${callsign}.`,
+            `Joined channel ${channelId} as ${resolvedCallsign}${identitySource ? ` (identity-bound to account ${identitySource})` : ""}.`,
             `Roster (${roster.length}): ${roster.join(", ")}`,
             "",
             `Recent history (${history.length}):`,

package/dist/store.js

@@ -25,6 +25,7 @@ function ensureLoaded() {
                     tokenHash: r.tokenHash,
                     createdAt: r.createdAt,
                     retention: isRetention(r.retention) ? r.retention : "none",
+                    requireIdentity: r.requireIdentity === true,
                 },
             ]));
         }
@@ -44,16 +45,17 @@ function persist() {
 export function createChannel(opts = {}) {
     ensureLoaded();
     const retention = opts.retention ?? "none";
+    const requireIdentity = opts.require_identity === true;
     let id;
     do {
         id = generateChannelId();
     } while (channels.has(id));
     const token = generateToken();
-    channels.set(id, { id, tokenHash: hashToken(token), createdAt: Date.now(), retention });
+    channels.set(id, { id, tokenHash: hashToken(token), createdAt: Date.now(), retention, requireIdentity });
     persist();
     statsRecordChannelCreated();
     transcriptRecordChannelCreated(id, retention);
-    return { id, token, retention };
+    return { id, token, retention, require_identity: requireIdentity };
 }
 export function verifyChannel(id, token) {
     ensureLoaded();
@@ -74,3 +76,7 @@ export function getChannelRetention(id) {
     ensureLoaded();
     return channels.get(id)?.retention ?? "none";
 }
+export function getChannelRequireIdentity(id) {
+    ensureLoaded();
+    return channels.get(id)?.requireIdentity ?? false;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rogerrat",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Walkie-talkie MCP server for AI coding agents. Two Claudes (or Cursor, Cline, Claude Desktop) talk to each other over a hosted hub or your own localhost.",
   "keywords": [
     "mcp",