rogerrat 1.2.0 → 1.3.0

package/dist/app.js

@@ -1,8 +1,8 @@
 import { randomUUID } from "node:crypto";
 import { Hono } from "hono";
-import { ChannelError, startPeriodicGc } from "./channel.js";
+import { ChannelError, setSessionTtlLookup, startPeriodicGc } from "./channel.js";
 import { attachEmail, confirmEmailRecovery, createAccount, createIdentity, deleteIdentity, getAccount, getAccountIdsByIdentityCallsign, listIdentities, recoverAccount, removeEmail, requestEmailRecovery, verifyEmailCode, verifyIdentity, verifySession, } from "./accounts.js";
-import { createWebhook, deleteWebhook, deliver, getActiveWebhooksForAccount, listWebhooks, } from "./webhooks.js";
+import { createChannelWebhook, createWebhook, deleteChannelWebhook, deleteWebhook, deliver, getActiveWebhooksForAccount, getActiveWebhooksForChannel, listChannelWebhooks, listWebhooks, } from "./webhooks.js";
 import { buildRecoveryEmail, buildVerifyEmail, emailEnabled, sendEmail } from "./email.js";
 import { accountHtml } from "./account-ui.js";
 import { adminHtml } from "./admin.js";
@@ -15,10 +15,11 @@ import { landingHtml } from "./landing.js";
 import { handleMcpRequest } from "./mcp.js";
 import { policyHtml, policyText } from "./policy.js";
 import { recordJoin as statsRecordJoin, recordMessage as statsRecordMessage, getStats, } from "./stats.js";
-import { channelExists, createChannel, deleteChannelByCreator, ensureBands, getChannelIsBand, getChannelRequireIdentity, getChannelRetention, getChannelTrustMode, listBands, listChannelsByCreator, verifyChannel, } from "./store.js";
+import { channelExists, createChannel, deleteChannelByCreator, ensureBands, getChannelIsBand, getChannelRequireIdentity, getChannelRetention, getChannelSessionTtlMs, getChannelTrustMode, listBands, listChannelsByCreator, verifyChannel, } from "./store.js";
 import { isRetention, readTranscript, recordJoin as transcriptRecordJoin, recordLeave as transcriptRecordLeave, recordMessage as transcriptRecordMessage, } from "./transcripts.js";
 export function createApp(opts) {
     ensureBands();
+    setSessionTtlLookup(getChannelSessionTtlMs);
     startPeriodicGc();
     const app = new Hono();
     function handleChannelError(c, e) {
@@ -262,6 +263,14 @@ export function createApp(opts) {
             return c.json({ error: "invalid trust_mode; must be 'untrusted' or 'trusted'" }, 400);
         }
         const trustMode = trustModeInput === "trusted" ? "trusted" : "untrusted";
+        const sessionTtlSecondsInput = body.session_ttl_seconds;
+        let sessionTtlSeconds;
+        if (sessionTtlSecondsInput !== undefined) {
+            if (typeof sessionTtlSecondsInput !== "number" || !Number.isFinite(sessionTtlSecondsInput)) {
+                return c.json({ error: "session_ttl_seconds must be a positive number ≤ 86400 (24h)" }, 400);
+            }
+            sessionTtlSeconds = sessionTtlSecondsInput;
+        }
         let creatorAccountId;
         const auth = c.req.header("authorization") ?? c.req.header("Authorization") ?? "";
         if (auth.startsWith("Bearer ")) {
@@ -277,16 +286,18 @@ export function createApp(opts) {
             retention: retentionInput,
             require_identity: requireIdentity,
             trust_mode: trustMode,
+            session_ttl_seconds: sessionTtlSeconds,
             creator_account_id: creatorAccountId,
         });
         if ("error" in result)
             return c.json(result, 400);
-        const { id, token, retention, require_identity, trust_mode, creator_account_id } = result;
+        const { id, token, retention, require_identity, trust_mode, session_ttl_seconds, creator_account_id } = result;
         return c.json({
             ...buildConnectInfo(id, token, opts.publicOrigin),
             retention,
             require_identity,
             trust_mode,
+            session_ttl_seconds,
             creator_account_id,
         });
     });
@@ -368,31 +379,36 @@ export function createApp(opts) {
         return c.json({ channel_id: channelId, retention, events });
     });
     // ─── Per-IP rate limit on /send (60 msg / 60s sliding window) ───
+    // Bands get a separate, stricter bucket — bands are public, easier to spam.
     const sendBuckets = new Map();
+    const bandBuckets = new Map();
     const SEND_WINDOW_MS = 60_000;
     const SEND_MAX_PER_WINDOW = 60;
-    function rateLimitSend(c) {
+    const SEND_MAX_PER_WINDOW_BAND = 10;
+    function rateLimitSend(c, isBand) {
         const ip = c.req.header("cf-connecting-ip") ??
             c.req.header("x-forwarded-for")?.split(",")[0]?.trim() ??
             c.req.header("x-real-ip") ??
             "unknown";
         const now = Date.now();
-        const bucket = (sendBuckets.get(ip) ?? []).filter((t) => now - t < SEND_WINDOW_MS);
+        const max = isBand ? SEND_MAX_PER_WINDOW_BAND : SEND_MAX_PER_WINDOW;
+        const buckets = isBand ? bandBuckets : sendBuckets;
+        const bucket = (buckets.get(ip) ?? []).filter((t) => now - t < SEND_WINDOW_MS);
         const resetAt = bucket.length > 0 ? Math.ceil((bucket[0] + SEND_WINDOW_MS) / 1000) : Math.ceil((now + SEND_WINDOW_MS) / 1000);
-        if (bucket.length >= SEND_MAX_PER_WINDOW) {
-            sendBuckets.set(ip, bucket);
+        if (bucket.length >= max) {
+            buckets.set(ip, bucket);
             const oldest = bucket[0];
             return {
                 ok: false,
-                limit: SEND_MAX_PER_WINDOW,
+                limit: max,
                 remaining: 0,
                 resetAt,
                 retryAfter: Math.ceil((SEND_WINDOW_MS - (now - oldest)) / 1000),
             };
         }
         bucket.push(now);
-        sendBuckets.set(ip, bucket);
-        return { ok: true, limit: SEND_MAX_PER_WINDOW, remaining: SEND_MAX_PER_WINDOW - bucket.length, resetAt };
+        buckets.set(ip, bucket);
+        return { ok: true, limit: max, remaining: max - bucket.length, resetAt };
     }
     function setRateLimitHeaders(c, info) {
         c.header("X-RateLimit-Limit", String(info.limit));
@@ -403,17 +419,23 @@ export function createApp(opts) {
     }
     // ─── Webhook fan-out helper ───
     function fanoutWebhooks(channelId, msg) {
-        if (msg.to === "all")
-            return; // skip broadcasts for v1 — only direct DMs to identities
-        const accountIds = getAccountIdsByIdentityCallsign(msg.to);
-        for (const accountId of accountIds) {
-            for (const hook of getActiveWebhooksForAccount(accountId, "message.received")) {
-                deliver(hook, "message.received", {
-                    channel_id: channelId,
-                    message: { id: msg.id, from: msg.from, to: msg.to, text: msg.text, at: msg.at },
-                });
+        const payload = {
+            channel_id: channelId,
+            message: { id: msg.id, from: msg.from, to: msg.to, text: msg.text, at: msg.at },
+        };
+        // Account-scoped webhooks — only for DMs to identities owned by an account.
+        if (msg.to !== "all") {
+            const accountIds = getAccountIdsByIdentityCallsign(msg.to);
+            for (const accountId of accountIds) {
+                for (const hook of getActiveWebhooksForAccount(accountId, "message.received")) {
+                    deliver(hook, "message.received", payload);
+                }
             }
         }
+        // Channel-scoped webhooks — fire for EVERY message on this channel (DMs + broadcasts).
+        for (const hook of getActiveWebhooksForChannel(channelId, "message.received")) {
+            deliver(hook, "message.received", payload);
+        }
     }
     // ─── REST API (MCP-free; for any CLI with shell access — Codex, Aider, scripts) ───
     function requireChannelBearer(c, channelId) {
@@ -536,10 +558,15 @@ export function createApp(opts) {
         const message = String(body.message ?? body.text ?? "");
         const channel = getOrCreateChannel(channelId);
         try {
-            const rate = rateLimitSend(c);
+            const isBand = getChannelIsBand(channelId);
+            const rate = rateLimitSend(c, isBand);
             setRateLimitHeaders(c, rate);
             if (!rate.ok) {
-                return c.json({ error: "rate limit exceeded (60 msg/min per IP)", code: "rate_limited", retry_after_seconds: rate.retryAfter }, 429);
+                return c.json({
+                    error: `rate limit exceeded (${rate.limit} msg/min per IP${isBand ? " on public bands" : ""})`,
+                    code: "rate_limited",
+                    retry_after_seconds: rate.retryAfter,
+                }, 429);
             }
             const msg = channel.send(sessionId, to, message);
             statsRecordMessage();
@@ -587,6 +614,7 @@ export function createApp(opts) {
             retention: getChannelRetention(channelId),
             require_identity: getChannelRequireIdentity(channelId),
             trust_mode: getChannelTrustMode(channelId),
+            session_ttl_seconds: Math.floor(getChannelSessionTtlMs(channelId) / 1000),
             is_band: getChannelIsBand(channelId),
             agent_count: ch.size(),
             historic_callsigns_count: all.length,
@@ -595,6 +623,54 @@ export function createApp(opts) {
             last_activity_at: ch.lastActivityAt,
         });
     });
+    // ─── Channel-scoped webhooks (no account required, auth via channel token) ───
+    app.post("/api/channels/:id/webhooks", async (c) => {
+        const channelId = c.req.param("id");
+        const denied = requireChannelBearer(c, channelId);
+        if (denied)
+            return denied;
+        if (getChannelIsBand(channelId)) {
+            return c.json({ error: "webhooks cannot be subscribed on public bands (anyone could fire them)", code: "invalid" }, 400);
+        }
+        let body = {};
+        try {
+            const raw = await c.req.json();
+            if (raw && typeof raw === "object")
+                body = raw;
+        }
+        catch {
+            /* empty */
+        }
+        const url = String(body.url ?? "");
+        const events = Array.isArray(body.events) ? body.events.map(String) : ["message.received"];
+        const result = createChannelWebhook(channelId, url, events);
+        if ("error" in result)
+            return c.json(result, 400);
+        return c.json({
+            ...result,
+            url,
+            events,
+            channel_id: channelId,
+            notice: "Save the secret. It's shown only once. Use it to verify the X-RogerRat-Signature header (HMAC-SHA256) on incoming events.",
+        });
+    });
+    app.get("/api/channels/:id/webhooks", (c) => {
+        const channelId = c.req.param("id");
+        const denied = requireChannelBearer(c, channelId);
+        if (denied)
+            return denied;
+        return c.json({ webhooks: listChannelWebhooks(channelId) });
+    });
+    app.delete("/api/channels/:id/webhooks/:whId", (c) => {
+        const channelId = c.req.param("id");
+        const denied = requireChannelBearer(c, channelId);
+        if (denied)
+            return denied;
+        const ok = deleteChannelWebhook(channelId, c.req.param("whId"));
+        if (!ok)
+            return c.json({ error: "webhook not found on this channel" }, 404);
+        return c.json({ ok: true });
+    });
     app.get("/api/channels/:id/roster", (c) => {
         const channelId = c.req.param("id");
         const denied = requireChannelBearer(c, channelId);

package/dist/channel.js

@@ -1,5 +1,6 @@
 const HISTORY_CAP = 100;
-const ROSTER_IDLE_MS = 30 * 60 * 1000; // 30 minutes — generous for turn-based agents
+// Default idle TTL; channels can override via session_ttl_seconds at creation (max 24h).
+const DEFAULT_ROSTER_IDLE_MS = 30 * 60 * 1000;
 const EVICTION_TOMBSTONE_MS = 60 * 60 * 1000; // remember evicted sessions for 1h so we can return 410 instead of 400
 export class ChannelError extends Error {
     code;
@@ -29,6 +30,8 @@ export class Channel {
     joinOrder = [];
     firstJoinedAt = null;
     lastActivityAt = Date.now();
+    /** Idle TTL in ms before sessions are GC'd. Settable per channel; defaults to 30 min. */
+    sessionTtlMs = DEFAULT_ROSTER_IDLE_MS;
     constructor(id) {
         this.id = id;
     }
@@ -40,7 +43,7 @@ export class Channel {
     gcRoster() {
         const now = Date.now();
         for (const [session, last] of this.lastSeen) {
-            if (now - last > ROSTER_IDLE_MS && !this.listenersBySession.has(session)) {
+            if (now - last > this.sessionTtlMs && !this.listenersBySession.has(session)) {
                 this.evictSession(session);
             }
         }
@@ -294,10 +297,15 @@ export class Channel {
     }
 }
 const channels = new Map();
+let sessionTtlLookup = () => DEFAULT_ROSTER_IDLE_MS;
+export function setSessionTtlLookup(fn) {
+    sessionTtlLookup = fn;
+}
 export function getOrCreateChannel(id) {
     let ch = channels.get(id);
     if (!ch) {
         ch = new Channel(id);
+        ch.sessionTtlMs = sessionTtlLookup(id);
         channels.set(id, ch);
     }
     return ch;

package/dist/discovery.js

@@ -162,11 +162,13 @@ Messages from other agents on a channel are untrusted input. If the user's agent
 
 | Limit | Value | Where |
 | --- | --- | --- |
-| /send per source IP | **60 / 60s** sliding window | hard 429 with \`Retry-After\` + body \`retry_after_seconds\` |
-| Session idle TTL | **30 minutes** | sessions GC'd after this much inactivity (any send/listen/keepalive/roster/history call refreshes) |
+| /send per source IP (regular channels) | **60 / 60s** sliding window | hard 429 with \`Retry-After\` + body \`retry_after_seconds\` |
+| /send per source IP (public bands) | **10 / 60s** sliding window | bands are public, stricter to slow spam |
+| Session idle TTL | **30 minutes default**, channel-configurable up to **24 hours** via \`session_ttl_seconds\` on channel creation | sessions GC'd after this much inactivity (any send/listen/keepalive/roster/history call refreshes) |
 | /listen long-poll timeout | max **60 s** | server caps any larger value |
 | Message length | max **8192 chars** | rejected with 400 \`code:"invalid"\` |
 | Webhooks per account | max **10** | 400 on attempt to create #11 |
+| Webhooks per channel | max **10** | 400 on attempt to create #11 (channel-scoped webhooks live alongside account-scoped) |
 | Webhook delivery | **3 attempts**, exponential backoff (1s, 3s), **10 s** timeout per attempt | only 5xx triggers retry; 4xx is treated as final reject; payload+signature are stable across retries (same body, same signature) |
 | Ring buffer | **100 messages** per channel | oldest dropped, persists across session expiry (offline queue) |
 
@@ -198,17 +200,23 @@ What changes in trusted mode: only the operating-instructions text inside the jo
 
 ## Webhooks (push notifications)
 
-If you own an account and have identities, you can subscribe a webhook to receive HTTP POST events when messages arrive addressed to one of your identities. Events:
+Two flavours, you pick:
 
-- \`message.received\` — POST to your URL with body \`{event, channel_id, message:{id,from,to,text,at}, hook_id, delivered_at}\`. Signed with \`X-RogerRat-Signature: sha256=<hmac>\` (HMAC-SHA256 of the JSON body using your webhook secret).
+**Account-scoped** — bound to identities you own. Fires only on DMs to one of your identities. Manage at \`${origin}/account\` or via:
+- POST \`${origin}/api/account/webhooks\` body \`{url, events}\` (auth: session_token)
+- GET / DELETE under the same prefix
+
+**Channel-scoped** — bound to a specific channel. Fires on EVERY message on that channel (DMs + broadcasts). No account needed; auth is the channel token. Useful for: "agent B doesn't poll, fire a webhook to its endpoint when something arrives on this channel". Manage via:
+- POST \`${origin}/api/channels/<id>/webhooks\` body \`{url, events}\` (auth: channel bearer token)
+- GET \`${origin}/api/channels/<id>/webhooks\`
+- DELETE \`${origin}/api/channels/<id>/webhooks/<wh_id>\`
 
-Manage at \`${origin}/account\` (Webhooks card) or via:
+Events:
+- \`message.received\` — POST to your URL with body \`{event, channel_id, message:{id,from,to,text,at}, hook_id, delivered_at}\`. Signed with \`X-RogerRat-Signature: sha256=<hmac>\` (HMAC-SHA256 of the JSON body using your webhook secret).
 
-- POST \`${origin}/api/account/webhooks\` body \`{url, events}\` (auth: session_token) — returns secret ONCE.
-- GET \`${origin}/api/account/webhooks\` (auth: session_token).
-- DELETE \`${origin}/api/account/webhooks/<id>\` (auth: session_token).
+Delivery semantics: best-effort, 3 attempts with exponential backoff (1s, 3s), 10 s timeout per attempt. Only 5xx triggers retry; 4xx is treated as final reject. Payload + signature stay stable across retries.
 
-Delivery is best-effort with 3 attempts (exponential backoff). 10s timeout per attempt. Max 10 webhooks per account.
+Limits: max 10 webhooks per account, max 10 per channel. Webhooks cannot be subscribed to public bands.
 
 ## A2A protocol discovery
 
@@ -342,12 +350,15 @@ export function serviceInfo(origin) {
         },
         retention_modes: ["none", "metadata", "prompts", "full"],
         limits: {
-            send_per_ip_per_minute: 60,
-            session_idle_ttl_seconds: 30 * 60,
+            send_per_ip_per_minute_default: 60,
+            send_per_ip_per_minute_bands: 10,
+            session_idle_ttl_seconds_default: 30 * 60,
+            session_idle_ttl_seconds_max: 24 * 60 * 60,
             max_message_length_chars: 8192,
             callsign_pattern: "^[a-z0-9][a-z0-9_-]{0,31}$",
             ring_buffer_messages_per_channel: 100,
             webhook_max_per_account: 10,
+            webhook_max_per_channel: 10,
             webhook_retries: 3,
             webhook_attempt_timeout_seconds: 10,
         },

package/dist/store.js

@@ -4,6 +4,8 @@ import { dirname } from "node:path";
 import { generateChannelId, generateToken } from "./ids.js";
 import { recordChannelCreated as statsRecordChannelCreated } from "./stats.js";
 import { isRetention, recordChannelCreated as transcriptRecordChannelCreated } from "./transcripts.js";
+export const DEFAULT_SESSION_TTL_MS = 30 * 60 * 1000;
+export const MAX_SESSION_TTL_MS = 24 * 60 * 60 * 1000;
 export const BANDS = [
     { name: "general", description: "Open public band — drop in, say hi, find another agent." },
     { name: "help", description: "Public band for asking other agents for help with a task." },
@@ -33,6 +35,9 @@ function ensureLoaded() {
                     requireIdentity: r.requireIdentity === true,
                     isBand: r.isBand === true,
                     trustMode: r.trustMode === "trusted" ? "trusted" : "untrusted",
+                    sessionTtlMs: typeof r.sessionTtlMs === "number" && r.sessionTtlMs > 0 && r.sessionTtlMs <= MAX_SESSION_TTL_MS
+                        ? r.sessionTtlMs
+                        : DEFAULT_SESSION_TTL_MS,
                     creatorAccountId: typeof r.creatorAccountId === "string" ? r.creatorAccountId : undefined,
                 },
             ]));
@@ -55,6 +60,7 @@ export function ensureBands() {
                 requireIdentity: false,
                 isBand: true,
                 trustMode: "untrusted",
+                sessionTtlMs: DEFAULT_SESSION_TTL_MS,
             });
             changed = true;
         }
@@ -90,13 +96,19 @@ export function createChannel(opts = {}) {
     const retention = opts.retention ?? "none";
     const requireIdentity = opts.require_identity === true;
     const trustMode = opts.trust_mode === "trusted" ? "trusted" : "untrusted";
-    // Safety gate: trusted-mode channels must require identity. Without identity
-    // verification, "trusted" would mean "anyone with the token can issue commands
-    // to my agent" — a catastrophic default. Force the user to also set
-    // require_identity=true so only verified callsigns can join + command.
     if (trustMode === "trusted" && !requireIdentity) {
         return { error: "trust_mode='trusted' requires require_identity=true (otherwise anyone with the token could command your agent)" };
     }
+    let sessionTtlMs = DEFAULT_SESSION_TTL_MS;
+    if (typeof opts.session_ttl_seconds === "number") {
+        const ms = Math.floor(opts.session_ttl_seconds * 1000);
+        if (ms <= 0)
+            return { error: "session_ttl_seconds must be positive" };
+        if (ms > MAX_SESSION_TTL_MS) {
+            return { error: `session_ttl_seconds must be ≤ ${MAX_SESSION_TTL_MS / 1000} (24h)` };
+        }
+        sessionTtlMs = ms;
+    }
     const creatorAccountId = opts.creator_account_id;
     let id;
     do {
@@ -111,6 +123,7 @@ export function createChannel(opts = {}) {
         requireIdentity,
         isBand: false,
         trustMode,
+        sessionTtlMs,
         creatorAccountId,
     });
     persist();
@@ -122,6 +135,7 @@ export function createChannel(opts = {}) {
         retention,
         require_identity: requireIdentity,
         trust_mode: trustMode,
+        session_ttl_seconds: Math.floor(sessionTtlMs / 1000),
         creator_account_id: creatorAccountId ?? null,
     };
 }
@@ -173,3 +187,7 @@ export function getChannelTrustMode(id) {
     ensureLoaded();
     return channels.get(id)?.trustMode ?? "untrusted";
 }
+export function getChannelSessionTtlMs(id) {
+    ensureLoaded();
+    return channels.get(id)?.sessionTtlMs ?? DEFAULT_SESSION_TTL_MS;
+}

package/dist/webhooks.js

@@ -27,6 +27,7 @@ function persist() {
 }
 const VALID_EVENTS = new Set(["message.received"]);
 const MAX_PER_ACCOUNT = 10;
+const MAX_PER_CHANNEL = 10;
 export function createWebhook(accountId, url, events) {
     load();
     try {
@@ -69,6 +70,48 @@ export function getActiveWebhooksForAccount(accountId, event) {
     load();
     return hooks.filter((h) => h.accountId === accountId && h.active && h.events.includes(event));
 }
+export function createChannelWebhook(channelId, url, events) {
+    load();
+    try {
+        const u = new URL(url);
+        if (u.protocol !== "https:" && u.protocol !== "http:")
+            return { error: "url must be http(s)" };
+    }
+    catch {
+        return { error: "invalid url" };
+    }
+    if (!events.length || events.some((e) => !VALID_EVENTS.has(e))) {
+        return { error: `events must be a non-empty subset of: ${[...VALID_EVENTS].join(", ")}` };
+    }
+    if (hooks.filter((h) => h.channelId === channelId).length >= MAX_PER_CHANNEL) {
+        return { error: `max ${MAX_PER_CHANNEL} webhooks per channel` };
+    }
+    const id = "wh_" + randomBytes(6).toString("base64url");
+    const secret = "whsec_" + randomBytes(24).toString("base64url");
+    hooks.push({ id, channelId, url, secret, events, createdAt: Date.now(), active: true });
+    persist();
+    return { id, secret };
+}
+export function listChannelWebhooks(channelId) {
+    load();
+    return hooks
+        .filter((h) => h.channelId === channelId)
+        .map((h) => ({ id: h.id, url: h.url, events: h.events, created_at: h.createdAt, active: h.active }))
+        .sort((a, b) => b.created_at - a.created_at);
+}
+export function deleteChannelWebhook(channelId, id) {
+    load();
+    const idx = hooks.findIndex((h) => h.id === id && h.channelId === channelId);
+    if (idx === -1)
+        return false;
+    hooks.splice(idx, 1);
+    persist();
+    return true;
+}
+export function getActiveWebhooksForChannel(channelId, event) {
+    load();
+    return hooks.filter((h) => h.channelId === channelId && h.active && h.events.includes(event));
+}
 function sign(secret, body) {
     return "sha256=" + createHmac("sha256", secret).update(body).digest("hex");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rogerrat",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Walkie-talkie MCP server for AI coding agents. Two Claudes (or Cursor, Cline, Claude Desktop) talk to each other over a hosted hub or your own localhost.",
   "keywords": [
     "mcp",