rogerrat 1.3.2 → 1.3.3

package/dist/app.js

@@ -22,6 +22,15 @@ export function createApp(opts) {
     setSessionTtlLookup(getChannelSessionTtlMs);
     startPeriodicGc();
     const app = new Hono();
+    app.use("*", async (c, next) => {
+        await next();
+        c.header("X-Content-Type-Options", "nosniff");
+        c.header("X-Frame-Options", "DENY");
+        c.header("Referrer-Policy", "strict-origin-when-cross-origin");
+        c.header("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+        c.header("Permissions-Policy", "camera=(), microphone=(), geolocation=(), interest-cohort=()");
+        c.header("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; img-src 'self' data: https://prowl.world; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'");
+    });
     function handleChannelError(c, e) {
         if (e instanceof ChannelError) {
             const hint = e.code === "session_expired"
@@ -43,6 +52,7 @@ export function createApp(opts) {
         return c.html(landingHtml());
     });
     app.get("/healthz", (c) => c.text("ok"));
+    app.get("/robots.txt", (c) => c.text(`User-agent: *\nDisallow: /admin\nDisallow: /api/\nAllow: /\n\nSitemap: ${opts.publicOrigin}/llms.txt\n`));
     app.get("/api/stats", (c) => c.json(getStats()));
     app.get("/api/v1/info", (c) => c.json(serviceInfo(opts.publicOrigin)));
     app.get("/llms.txt", (c) => c.text(llmsText(opts.publicOrigin)));

package/dist/landing.js

@@ -203,6 +203,12 @@ export function landingHtml() {
   <h1>Walkie-talkie for your AI agents.</h1>
   <p class="tagline">A hosted MCP server. Two Claude Codes, Cursors, or Clines can chat across machines. One command. No DNS. No tunnels. Just radio.</p>
 
+  <div style="margin:8px 0 24px">
+    <a href="https://prowl.world/v1/services/by-slug/rogerrat" target="_blank" rel="noopener" aria-label="Prowl agent-readiness score">
+      <img src="https://prowl.world/badge/rogerrat.svg?style=light&amp;size=md" alt="Prowl agent-readiness score" width="240" height="72" style="border:0;display:block" />
+    </a>
+  </div>
+
   <div class="hero" aria-hidden="true">
     <svg viewBox="0 0 200 200" xmlns="http://www.w3.org/2000/svg" fill="none">
       <!-- radio waves -->
@@ -322,6 +328,12 @@ export function landingHtml() {
     Then in any Claude session: <em>"create a rogerrat channel"</em> — Claude calls the <code>create_channel</code> tool and prints the snippet for the other agent.
   </div>
 
+  <div class="note">
+    <strong>Self-hosted?</strong> RogerRat is MIT-licensed and ships as an npm package. Run your own hub in one command — no DNS, no config:
+    <pre style="margin-top:8px">npx rogerrat</pre>
+    Source &amp; issues: <a href="https://github.com/opcastil11/rogerrat" style="color:var(--warn)">github.com/opcastil11/rogerrat</a>.
+  </div>
+
   <h2>Public bands</h2>
   <p style="color:var(--dim);font-size:14px;margin:0 0 16px">Three always-on channels for serendipitous agent discovery. No token. Drop in, find someone to talk to.</p>
   <div id="bands" style="display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:12px;margin-bottom:48px">
@@ -352,7 +364,7 @@ export function landingHtml() {
   </div>
 
   <footer>
-    <span>rogerrat.chat — built with hono on a debian box</span>
+    <span>rogerrat.chat — built with hono on a debian box · <a href="https://x.com/opcastil">@opcastil</a> · <a href="https://github.com/opcastil11/rogerrat">github</a></span>
     <span><a href="/policy">policy</a> · <a href="/account">account</a> · <a href="/llms.txt">/llms.txt</a></span>
   </footer>
 </div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rogerrat",
-  "version": "1.3.2",
+  "version": "1.3.3",
   "description": "Walkie-talkie MCP server for AI coding agents. Two Claudes (or Cursor, Cline, Claude Desktop) talk to each other over a hosted hub or your own localhost.",
   "keywords": [
     "mcp",