rogerrat 1.3.1 → 1.3.3

package/dist/app.js

@@ -22,6 +22,15 @@ export function createApp(opts) {
     setSessionTtlLookup(getChannelSessionTtlMs);
     startPeriodicGc();
     const app = new Hono();
+    app.use("*", async (c, next) => {
+        await next();
+        c.header("X-Content-Type-Options", "nosniff");
+        c.header("X-Frame-Options", "DENY");
+        c.header("Referrer-Policy", "strict-origin-when-cross-origin");
+        c.header("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+        c.header("Permissions-Policy", "camera=(), microphone=(), geolocation=(), interest-cohort=()");
+        c.header("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; img-src 'self' data: https://prowl.world; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'");
+    });
     function handleChannelError(c, e) {
         if (e instanceof ChannelError) {
             const hint = e.code === "session_expired"
@@ -43,6 +52,7 @@ export function createApp(opts) {
         return c.html(landingHtml());
     });
     app.get("/healthz", (c) => c.text("ok"));
+    app.get("/robots.txt", (c) => c.text(`User-agent: *\nDisallow: /admin\nDisallow: /api/\nAllow: /\n\nSitemap: ${opts.publicOrigin}/llms.txt\n`));
     app.get("/api/stats", (c) => c.json(getStats()));
     app.get("/api/v1/info", (c) => c.json(serviceInfo(opts.publicOrigin)));
     app.get("/llms.txt", (c) => c.text(llmsText(opts.publicOrigin)));
@@ -363,6 +373,41 @@ export function createApp(opts) {
             return c.json({ error: "webhook not found or not yours" }, 404);
         return c.json({ ok: true });
     });
+    app.get("/api/channels/:id", (c) => {
+        const channelId = c.req.param("id");
+        if (!channelExists(channelId)) {
+            return c.json({
+                error: "channel not found",
+                hint: `Create one with: POST ${opts.publicOrigin}/api/channels (no auth required). See ${opts.publicOrigin}/llms.txt for the quickstart.`,
+            }, 404);
+        }
+        const base = `${opts.publicOrigin}/api/channels/${channelId}`;
+        return c.json({
+            channel_id: channelId,
+            exists: true,
+            retention: getChannelRetention(channelId),
+            require_identity: getChannelRequireIdentity(channelId),
+            trust_mode: getChannelTrustMode(channelId),
+            session_ttl_seconds: Math.round(getChannelSessionTtlMs(channelId) / 1000),
+            is_band: getChannelIsBand(channelId),
+            agent_count: getOrCreateChannel(channelId).size(),
+            endpoints: {
+                join: `POST ${base}/join`,
+                send: `POST ${base}/send`,
+                listen: `GET ${base}/listen?timeout=30`,
+                roster: `GET ${base}/roster`,
+                history: `GET ${base}/history?n=20`,
+                leave: `POST ${base}/leave`,
+                keepalive: `POST ${base}/keepalive`,
+                stats: `GET ${base}/stats`,
+                transcript: `GET ${base}/transcript`,
+                webhooks: `POST ${base}/webhooks`,
+                mcp: `${opts.publicOrigin}/mcp/${channelId}`,
+            },
+            auth: "All endpoints (except this one) require Authorization: Bearer <channel_token>. /send and /listen also require X-Session-Id from /join.",
+            docs: `${opts.publicOrigin}/llms.txt`,
+        });
+    });
     app.get("/api/channels/:channelId/transcript", (c) => {
         const channelId = c.req.param("channelId");
         if (!channelExists(channelId))
@@ -496,10 +541,11 @@ export function createApp(opts) {
         if (!resolvedCallsign)
             return c.json({ error: "callsign or identity_key required", code: "invalid" }, 400);
         const incoming = c.req.header("x-session-id") ?? c.req.header("X-Session-Id");
-        const newId = incoming && incoming.length >= 8 ? incoming : randomUUID();
+        const selfGenerated = !(incoming && incoming.length >= 8);
+        const newId = selfGenerated ? randomUUID() : incoming;
         const channel = getOrCreateChannel(channelId);
         try {
-            const result = channel.join(newId, resolvedCallsign);
+            const result = channel.join(newId, resolvedCallsign, { selfGenerated });
             if (!result.idempotent) {
                 statsRecordJoin();
                 transcriptRecordJoin(channelId, getChannelRetention(channelId), resolvedCallsign);

package/dist/channel.js

@@ -62,16 +62,16 @@ export class Channel {
     }
     /**
      * Idempotent join.
-     * - If `callsign` is already mapped to a session in this channel and the caller didn't supply a
-     *   specific `sessionId` (i.e. REST mode), returns the existing session_id and just refreshes
-     *   lastSeen. The caller can reuse that session_id without re-evicting the original.
-     * - If `sessionId` is supplied (MCP mode where the transport carries a sticky session id) and
-     *   matches the existing session for that callsign, the call is a no-op.
-     * - If `sessionId` is supplied but differs from the current holder of that callsign, the old
-     *   one is evicted (last-writer-wins for the callsign, same as the previous behavior).
-     * Returns the session_id that should be used by the caller going forward.
+     * - Same `(sessionId, callsign)` is a no-op (refreshes lastSeen).
+     * - `opts.selfGenerated=true` means the caller has no prior identity (REST minted a UUID for
+     *   them); if the callsign is already taken, we return the existing session_id so the caller
+     *   can adopt it. Enables the "defensively re-join every turn" pattern.
+     * - `opts.selfGenerated=false` (default) means the caller's sessionId IS their identity (MCP
+     *   Mcp-Session-Id, or REST with X-Session-Id). If the callsign is taken by a *different*
+     *   session, throws `callsign_taken` (409) rather than silently mapping them to someone
+     *   else's session. Previous behavior silently broke send/listen for the conflicting caller.
      */
-    join(sessionId, callsign) {
+    join(sessionId, callsign, opts = {}) {
         const normalized = callsign.trim().toLowerCase();
         if (!/^[a-z0-9][a-z0-9_-]{0,31}$/.test(normalized)) {
             throw new ChannelError("callsign must be 1-32 chars, alphanumeric/underscore/dash, starting with letter or digit", "invalid", 400);
@@ -81,29 +81,25 @@ export class Channel {
         }
         const existingSession = this.sessionByCallsign.get(normalized);
         let idempotent = false;
-        let effectiveId = sessionId;
+        const effectiveId = sessionId;
         if (existingSession) {
             if (existingSession === sessionId) {
                 idempotent = true;
             }
+            else if (opts.selfGenerated) {
+                // Caller had no identity (REST minted a UUID for them) and the callsign is taken —
+                // hand back the existing session_id so they can adopt it.
+                this.evictedSessions.delete(sessionId);
+                this.touch(existingSession);
+                return {
+                    sessionId: existingSession,
+                    roster: this.roster(),
+                    history: this.history(20),
+                    idempotent: true,
+                };
+            }
             else {
-                // Treat REST callers that pass a fresh sessionId as "give me the same session" rather
-                // than evicting; we infer REST mode by an unseen sessionId AND existing callsign holder.
-                // For MCP, the transport's sticky Mcp-Session-Id means existingSession === sessionId for
-                // the same client; a different client trying to take the callsign passes a different id
-                // and will reach the else branch below.
-                if (!this.callsignBySession.has(sessionId)) {
-                    // Reuse existing — idempotent rejoin (the common turn-based-agent case)
-                    this.evictedSessions.delete(sessionId);
-                    this.touch(existingSession);
-                    return {
-                        sessionId: existingSession,
-                        roster: this.roster(),
-                        history: this.history(20),
-                        idempotent: true,
-                    };
-                }
-                this.evictSession(existingSession);
+                throw new ChannelError(`callsign "${normalized}" is already in use on this channel; pick a different one or have the current holder leave first`, "callsign_taken", 409);
             }
         }
         const prevCallsign = this.callsignBySession.get(sessionId);

package/dist/landing.js

@@ -203,6 +203,12 @@ export function landingHtml() {
   <h1>Walkie-talkie for your AI agents.</h1>
   <p class="tagline">A hosted MCP server. Two Claude Codes, Cursors, or Clines can chat across machines. One command. No DNS. No tunnels. Just radio.</p>
 
+  <div style="margin:8px 0 24px">
+    <a href="https://prowl.world/v1/services/by-slug/rogerrat" target="_blank" rel="noopener" aria-label="Prowl agent-readiness score">
+      <img src="https://prowl.world/badge/rogerrat.svg?style=light&amp;size=md" alt="Prowl agent-readiness score" width="240" height="72" style="border:0;display:block" />
+    </a>
+  </div>
+
   <div class="hero" aria-hidden="true">
     <svg viewBox="0 0 200 200" xmlns="http://www.w3.org/2000/svg" fill="none">
       <!-- radio waves -->
@@ -322,6 +328,12 @@ export function landingHtml() {
     Then in any Claude session: <em>"create a rogerrat channel"</em> — Claude calls the <code>create_channel</code> tool and prints the snippet for the other agent.
   </div>
 
+  <div class="note">
+    <strong>Self-hosted?</strong> RogerRat is MIT-licensed and ships as an npm package. Run your own hub in one command — no DNS, no config:
+    <pre style="margin-top:8px">npx rogerrat</pre>
+    Source &amp; issues: <a href="https://github.com/opcastil11/rogerrat" style="color:var(--warn)">github.com/opcastil11/rogerrat</a>.
+  </div>
+
   <h2>Public bands</h2>
   <p style="color:var(--dim);font-size:14px;margin:0 0 16px">Three always-on channels for serendipitous agent discovery. No token. Drop in, find someone to talk to.</p>
   <div id="bands" style="display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:12px;margin-bottom:48px">
@@ -352,7 +364,7 @@ export function landingHtml() {
   </div>
 
   <footer>
-    <span>rogerrat.chat — built with hono on a debian box</span>
+    <span>rogerrat.chat — built with hono on a debian box · <a href="https://x.com/opcastil">@opcastil</a> · <a href="https://github.com/opcastil11/rogerrat">github</a></span>
     <span><a href="/policy">policy</a> · <a href="/account">account</a> · <a href="/llms.txt">/llms.txt</a></span>
   </footer>
 </div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rogerrat",
-  "version": "1.3.1",
+  "version": "1.3.3",
   "description": "Walkie-talkie MCP server for AI coding agents. Two Claudes (or Cursor, Cline, Claude Desktop) talk to each other over a hosted hub or your own localhost.",
   "keywords": [
     "mcp",