{title}

\n \n \n );\n}\n","/** @jsxImportSource npm:hono@4/jsx */\n// The homepage: a call-my-human-style splash for humans + the agent instructions\n// shown in full (uncollapsible) with a Copy button. The SAME instructions.md is\n// what `curl {{BASE}}` returns to an agent — see main.tsx. {{BASE}} is already\n// substituted with the request origin by the time this renders.\nimport { renderMarkdown } from \"../lib/markdown.ts\";\nimport { Layout } from \"./layout.tsx\";\n\nconst SOURCE = \"https://www.val.town/x/valdottown/chat\";\n\n// Copy the raw instructions markdown to the clipboard, with a legacy fallback\n// for browsers without the async clipboard API.\nconst COPY_SCRIPT = `\n(function () {\n var btn = document.getElementById(\"copy\");\n var src = document.getElementById(\"instr-src\");\n if (!btn || !src) return;\n var label = btn.getAttribute(\"data-label\");\n function flash() { btn.textContent = \"Copied ✓\"; setTimeout(function () { btn.textContent = label; }, 1600); }\n function legacy() { src.style.position = \"static\"; src.select(); try { document.execCommand(\"copy\"); } catch (e) {} src.style.position = \"absolute\"; }\n btn.addEventListener(\"click\", function () {\n if (navigator.clipboard && navigator.clipboard.writeText) {\n navigator.clipboard.writeText(src.value).then(flash, function () { legacy(); flash(); });\n } else { legacy(); flash(); }\n });\n})();\n`;\n\nexport function HomePage(props: { instructionsMd: string }) {\n const body = props.instructionsMd.replace(/^---\\n[\\s\\S]*?\\n---\\n/, \"\").trim();\n return (\n \n

💬

chat.val.run

\n Share any AI conversation as a clean, unlisted link — like a ChatGPT or Claude share\n page, but for any agent. Your agent posts the dialog; you get back a URL.\n

\n \n View source\n

\n\n

For your agent

\n\n

{body}

\n\n \n\n \n \n \n

{props.children}

\n \n \n );\n}\n\nexport function NotFoundPage() {\n return (\n \n

🕳️

Chat not found

\n This chat doesn't exist or was deleted. What is this?\n

\n \n );\n}\n",[],[164,210],"4298bb04-8d6c-42d6-bc93-d8c274b9860d",["D",1783531916008],[],[164,33],"dc8f6e70-9fb9-4580-815f-088986db3a2c","chat.tsx","1d45dc5e-7aef-11f1-b91c-1607ee4eb77e",20,["D",1783531863018],"/** @jsxImportSource npm:hono@4/jsx */\nimport type { Chat } from \"../lib/store.ts\";\nimport { renderMarkdown } from \"../lib/markdown.ts\";\nimport { Layout } from \"./layout.tsx\";\n\nfunction fmtDate(iso: string): string {\n return new Date(iso).toLocaleDateString(\"en-US\", {\n year: \"numeric\",\n month: \"short\",\n day: \"numeric\",\n timeZone: \"UTC\",\n });\n}\n\n// ChatGPT/Claude style: user turns are right-aligned slate bubbles, assistant\n// turns are full-width plain prose. No role labels — the layout carries the who.\nexport function ChatPage(props: { chat: Chat }) {\n const { chat } = props;\n const meta = [\n `${chat.messageCount} ${chat.messageCount === 1 ? \"message\" : \"messages\"}`,\n fmtDate(chat.createdAt),\n chat.source ? `via ${chat.source}` : null,\n ].filter(Boolean).join(\" · \");\n return (\n \n

Shared chat

{chat.title}

{meta}

\n {chat.messages.map((m) => (\n

\n \n

\n ))}\n

\n \n \n );\n}\n",[],[164,222],["D",1783530276912],[193,194,195],[164],"75eb53a1-b4fd-4d73-b2af-77069f24911d","validate.ts","bd73f0e0-7aee-11f1-b48e-1607ee4eb77e",["D",1783530122407],"// Validates POST bodies. Error strings are written for the agent reading them —\n// they say what to fix, not just what failed.\nimport type { Message } from \"./store.ts\";\n\nconst MAX_MESSAGES = 1000;\nconst MAX_BYTES = 2_000_000;\n\nexport type ParsedInput = { title: string; source: string | null; messages: Message[] };\n\nexport function parseChatInput(\n body: unknown,\n): { ok: true; value: ParsedInput } | { ok: false; error: string } {\n const fail = (error: string) => ({ ok: false as const, error });\n if (typeof body !== \"object\" || body === null || Array.isArray(body)) {\n return fail(\n 'Send a JSON object: {\"title\"?, \"source\"?, \"messages\": [{\"role\": \"user\"|\"assistant\", \"content\": \"…\"}, …]}',\n );\n }\n const { title, source, messages } = body as Record;\n if (!Array.isArray(messages) || messages.length === 0) {\n return fail('`messages` must be a non-empty array of {\"role\": \"user\"|\"assistant\", \"content\": string}');\n }\n if (messages.length > MAX_MESSAGES) {\n return fail(`Too many messages (${messages.length} > ${MAX_MESSAGES}). Trim or split the conversation.`);\n }\n const clean: Message[] = [];\n for (let i = 0; i < messages.length; i++) {\n const m = messages[i] as Record | null;\n if (typeof m !== \"object\" || m === null) {\n return fail(`messages[${i}] must be an object with \"role\" and \"content\"`);\n }\n if (m.role !== \"user\" && m.role !== \"assistant\") {\n return fail(\n `messages[${i}].role is ${JSON.stringify(m.role)} — only \"user\" and \"assistant\" are allowed. ` +\n \"Strip tool calls, tool results, system prompts, and CLI output; this page shows the human-readable dialog only.\",\n );\n }\n if (typeof m.content !== \"string\" || m.content.trim() === \"\") {\n return fail(`messages[${i}].content must be a non-empty string (markdown or plain text)`);\n }\n clean.push({ role: m.role, content: m.content });\n }\n if (title !== undefined && title !== null && typeof title !== \"string\") {\n return fail(\"`title` must be a string if provided\");\n }\n if (source !== undefined && source !== null && typeof source !== \"string\") {\n return fail('`source` must be a string if provided (e.g. \"claude-code\")');\n }\n const bytes = new TextEncoder().encode(JSON.stringify(clean)).length;\n if (bytes > MAX_BYTES) {\n return fail(\n `Payload too large (${(bytes / 1e6).toFixed(1)} MB > ${MAX_BYTES / 1e6} MB). Trim long messages or split the chat.`,\n );\n }\n const finalTitle = (typeof title === \"string\" && title.trim()) ? title.trim() : deriveTitle(clean);\n return {\n ok: true,\n value: {\n title: finalTitle.slice(0, 200),\n source: typeof source === \"string\" && source.trim() ? source.trim().slice(0, 40) : null,\n messages: clean,\n },\n };\n}\n\nfunction deriveTitle(messages: Message[]): string {\n const first = messages.find((m) => m.role === \"user\") ?? messages[0];\n const line = first.content.trim().split(\"\\n\")[0].replace(/[#>*`]/g, \"\").trim();\n return line.length > 80 ? line.slice(0, 79).trimEnd() + \"…\" : line || \"Shared chat\";\n}\n",[],[171,233],"0421cb38-86f7-4188-929c-30bd53a82b96","store.ts","b7032294-7aee-11f1-967c-1607ee4eb77e",["D",1783530111563],"// Metadata lives in val-scoped SQLite; message bodies live in val-scoped blob\n// storage under `chat:`. Both are invisible to the public even though the\n// val's code is public.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nexport type Role = \"user\" | \"assistant\";\nexport type Message = { role: Role; content: string };\nexport type Chat = {\n id: string;\n title: string;\n source: string | null;\n messageCount: number;\n createdAt: string;\n messages: Message[];\n};\n\nconst TABLE = \"chats_v1\";\n\nlet ready: Promise | null = null;\nfunction ensureTable() {\n ready ??= sqlite.execute(`CREATE TABLE IF NOT EXISTS ${TABLE} (\n id TEXT PRIMARY KEY,\n title TEXT NOT NULL,\n source TEXT,\n message_count INTEGER NOT NULL,\n delete_token TEXT NOT NULL,\n created_at TEXT NOT NULL\n )`);\n return ready;\n}\n\n// 16 random bytes → 22-char base64url. Unguessable; doubles as the only key to a chat.\nfunction randomToken(): string {\n const buf = new Uint8Array(16);\n crypto.getRandomValues(buf);\n return btoa(String.fromCharCode(...buf))\n .replaceAll(\"+\", \"-\")\n .replaceAll(\"/\", \"_\")\n .replaceAll(\"=\", \"\");\n}\n\nexport async function createChat(\n input: { title: string; source: string | null; messages: Message[] },\n): Promise<{ id: string; deleteToken: string }> {\n await ensureTable();\n const id = randomToken();\n const deleteToken = randomToken();\n const createdAt = new Date().toISOString();\n await blob.setJSON(`chat:${id}`, { messages: input.messages });\n await sqlite.execute({\n sql:\n `INSERT INTO ${TABLE} (id, title, source, message_count, delete_token, created_at) VALUES (?, ?, ?, ?, ?, ?)`,\n args: [id, input.title, input.source, input.messages.length, deleteToken, createdAt],\n });\n return { id, deleteToken };\n}\n\nexport async function getChat(id: string): Promise {\n await ensureTable();\n const res = await sqlite.execute({\n sql: `SELECT title, source, message_count, created_at FROM ${TABLE} WHERE id = ?`,\n args: [id],\n });\n const row = res.rows[0] as\n | { title: string; source: string | null; message_count: number; created_at: string }\n | undefined;\n if (!row) return null;\n const data = (await blob.getJSON(`chat:${id}`)) as { messages: Message[] } | undefined;\n if (!data?.messages) return null;\n return {\n id,\n title: String(row.title),\n source: row.source ? String(row.source) : null,\n messageCount: Number(row.message_count),\n createdAt: String(row.created_at),\n messages: data.messages,\n };\n}\n\nexport async function deleteChat(\n id: string,\n token: string,\n): Promise<\"deleted\" | \"not_found\" | \"bad_token\"> {\n await ensureTable();\n const res = await sqlite.execute({\n sql: `SELECT delete_token FROM ${TABLE} WHERE id = ?`,\n args: [id],\n });\n const row = res.rows[0] as { delete_token: string } | undefined;\n if (!row) return \"not_found\";\n if (String(row.delete_token) !== token) return \"bad_token\";\n await blob.delete(`chat:${id}`);\n await sqlite.execute({ sql: `DELETE FROM ${TABLE} WHERE id = ?`, args: [id] });\n return \"deleted\";\n}\n",[],[171,240],"d4f610df-3f41-4e36-bbd2-8c270c5eb1e9","markdown.ts","0ae2de54-7aef-11f1-91b0-1607ee4eb77e",["D",1783530252343],"// Escape-first markdown → HTML. Every character of source text passes through\n// escapeHtml before any tag is emitted, so posted content can never inject markup.\n// Covers what AI chat transcripts actually use: fenced code, headings, nested\n// lists, GFM tables, blockquotes, hr, bold/italic/strike, code spans, links\n// (http/https only). Images render as links so chat pages can't beacon viewers.\n\nconst ESC: Record = { \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\" };\n\nexport function escapeHtml(s: string): string {\n return s.replace(/[&<>\"]/g, (ch) => ESC[ch]);\n}\n\nfunction emphasis(s: string): string {\n return s\n .replace(/\\*\\*([^*]+)\\*\\*/g, \"$1\")\n .replace(/\\*([^*\\n]+)\\*/g, \"$1\")\n .replace(/\\b_([^_\\n]+)_\\b/g, \"$1\")\n .replace(/~~([^~\\n]+)~~/g, \"$1\");\n}\n\n// Generated HTML is stashed behind \"\" placeholders. A raw \"<\" cannot survive\n// escapeHtml, so placeholders can't collide with source text; URL patterns below\n// exclude \"<\" so a placeholder can never be swallowed into an href.\nfunction inline(raw: string): string {\n let s = escapeHtml(raw);\n const slots: string[] = [];\n const stash = (html: string) => `<${slots.push(html) - 1}>`;\n s = s.replace(/``([^`]+)``|`([^`]+)`/g, (_m, a, b) => stash(`${a ?? b}`));\n s = s.replace(\n /!?\\[([^\\]]*)\\]\$(https?:\\/\\/[^\\s)<]+)\$/g,\n (_m, text, url) => stash(`${emphasis(text) || url}`),\n );\n s = s.replace(\n /(^|[\\s(])(https?:\\/\\/[^\\s<]*[^\\s<.,;:!?)\\]'\"])/g,\n (_m, pre, url) => pre + stash(`${url}`),\n );\n s = emphasis(s);\n return s.replace(/<(\\d+)>/g, (_m, i) => slots[Number(i)]);\n}\n\nexport function renderMarkdown(src: string): string {\n return renderBlocks(src.replace(/\\r\\n?/g, \"\\n\").split(\"\\n\"));\n}\n\nfunction renderBlocks(lines: string[]): string {\n const out: string[] = [];\n const para: string[] = [];\n // Chat-style hard breaks: single newlines inside a paragraph become
.\n const flush = () => {\n if (para.length) out.push(`

${para.map(inline).join(\"
\")}

`);\n para.length = 0;\n };\n let i = 0;\n while (i < lines.length) {\n const line = lines[i];\n\n if (line.trim() === \"\") {\n flush();\n i++;\n continue;\n }\n\n const fence = line.match(/^(`{3,}|~{3,})\\s*(\\S*)/);\n if (fence) {\n flush();\n const marker = fence[1];\n const lang = fence[2];\n const isClose = (l: string) => {\n const t = l.trimEnd();\n return t.length >= marker.length && [...t].every((c) => c === marker[0]);\n };\n const buf: string[] = [];\n i++;\n while (i < lines.length && !isClose(lines[i])) buf.push(lines[i++]);\n i++; // closing fence (or EOF)\n out.push(\n `

${escapeHtml(buf.join(\"\\n\"))}

`,\n );\n continue;\n }\n\n const heading = line.match(/^(#{1,6})\\s+(.+?)\\s*#*\\s*$/);\n if (heading) {\n flush();\n const n = heading[1].length;\n out.push(`${inline(heading[2])}`);\n i++;\n continue;\n }\n\n if (/^ {0,3}([-*_])( *\\1){2,}\\s*$/.test(line)) {\n flush();\n out.push(\"

\");\n i++;\n continue;\n }\n\n if (/^ {0,3}>/.test(line)) {\n flush();\n const buf: string[] = [];\n while (i < lines.length && /^ {0,3}>/.test(lines[i])) buf.push(lines[i++].replace(/^ {0,3}> ?/, \"\"));\n out.push(`

${renderBlocks(buf)}

`);\n continue;\n }\n\n if (\n line.includes(\"|\") && i + 1 < lines.length &&\n /^ {0,3}\\|?[ :|-]+\\|[ :|-]*$/.test(lines[i + 1]) && lines[i + 1].includes(\"-\")\n ) {\n flush();\n const row = (l: string) =>\n l.trim().replace(/^\\|/, \"\").replace(/\\|\\s*$/, \"\").split(\"|\").map((c) => inline(c.trim()));\n const head = row(line);\n i += 2;\n const rows: string[][] = [];\n while (i < lines.length && lines[i].includes(\"|\") && lines[i].trim() !== \"\") rows.push(row(lines[i++]));\n out.push(\n `${head.map((c) => ``).join(\"\")}` +\n rows.map((r) => `${r.map((c) => ``).join(\"\")}`).join(\"\") +\n `

${c}
${c}

`,\n );\n continue;\n }\n\n if (/^(\\s*)([-*+]|\\d{1,9}[.)])\\s+/.test(line)) {\n flush();\n const list = parseList(lines, i);\n out.push(list.html);\n i = list.next;\n continue;\n }\n\n para.push(line);\n i++;\n }\n flush();\n return out.join(\"\\n\");\n}\n\nfunction parseList(lines: string[], start: number): { html: string; next: number } {\n const itemRe = /^(\\s*)(?:([-*+])|(\\d{1,9})[.)])\\s+(.*)$/;\n type Frame = { indent: number; ordered: boolean; start: number; items: string[] };\n const html: string[] = [];\n const stack: Frame[] = [];\n const close = () => {\n const f = stack.pop()!;\n const tag = f.ordered ? \"ol\" : \"ul\";\n const attrs = f.ordered && f.start > 1 ? ` start=\"${f.start}\"` : \"\";\n const rendered = `<${tag}${attrs}>${f.items.map((x) => `

${x}

`).join(\"\")}`;\n if (stack.length) {\n const p = stack[stack.length - 1];\n p.items[p.items.length - 1] += rendered;\n } else html.push(rendered);\n };\n let i = start;\n while (i < lines.length) {\n const m = lines[i].match(itemRe);\n if (m) {\n const indent = m[1].length;\n const ordered = m[3] !== undefined;\n const num = ordered ? parseInt(m[3], 10) : 1;\n if (!stack.length || indent > stack[stack.length - 1].indent) {\n stack.push({ indent, ordered, start: num, items: [] });\n } else {\n while (stack.length > 1 && indent < stack[stack.length - 1].indent) close();\n if (ordered !== stack[stack.length - 1].ordered) {\n if (stack.length > 1) {\n close();\n stack.push({ indent, ordered, start: num, items: [] });\n } else {\n break; // top-level bullet-type switch: end here, caller starts a fresh list\n }\n }\n }\n stack[stack.length - 1].items.push(inline(m[4]));\n i++;\n continue;\n }\n if (lines[i].trim() === \"\") {\n // A blank line only continues the list when another item follows directly.\n if (i + 1 < lines.length && itemRe.test(lines[i + 1])) {\n i++;\n continue;\n }\n break;\n }\n const ind = lines[i].match(/^\\s*/)![0].length;\n if (ind > stack[stack.length - 1].indent) {\n const f = stack[stack.length - 1];\n f.items[f.items.length - 1] += \"
\" + inline(lines[i].trim());\n i++;\n continue;\n }\n break;\n }\n while (stack.length) close();\n return { html: html.join(\"\"), next: i };\n}\n",[],[171,247],"c3e7279e-9ee4-40e6-b7a3-7e727b807716","body.ts","307e8d10-7af0-11f1-960e-1607ee4eb77e",13,["D",1783530744940],"// Reads a request body as parsed JSON, transparently decompressing gzip/deflate.\n//\n// Why gzip matters here: Val Town sits behind Cloudflare, whose managed WAF\n// scans *uncompressed* POST bodies and anomaly-scores them. Rich technical chat\n// transcripts (shell commands, URLs, code) reliably trip that scoring and get a\n// 403 \"Blocked\" HTML page before the request ever reaches this val. Cloudflare\n// does not decompress request bodies, so a gzipped body sails through untouched —\n// we just have to decompress it ourselves. Agents posting coding chats should\n// prefer the gzip path (documented on the homepage).\n\nconst MAX_DECOMPRESSED = 8_000_000; // hard cap so a zip bomb can't OOM the isolate\n\nasync function readBounded(stream: ReadableStream): Promise {\n const reader = stream.getReader();\n const chunks: Uint8Array[] = [];\n let total = 0;\n for (;;) {\n const { done, value } = await reader.read();\n if (done) break;\n total += value.byteLength;\n if (total > MAX_DECOMPRESSED) {\n reader.cancel();\n throw new Error(\"decompressed body exceeds 8 MB\");\n }\n chunks.push(value);\n }\n const out = new Uint8Array(total);\n let off = 0;\n for (const c of chunks) {\n out.set(c, off);\n off += c.byteLength;\n }\n return out;\n}\n\nexport async function readJsonBody(req: Request): Promise {\n const enc = (req.headers.get(\"content-encoding\") ?? \"\").toLowerCase();\n let text: string;\n if (enc.includes(\"gzip\") || enc.includes(\"deflate\")) {\n const format = enc.includes(\"gzip\") ? \"gzip\" : \"deflate\";\n const raw = req.body;\n if (!raw) throw new Error(\"empty body\");\n const stream = raw.pipeThrough(new DecompressionStream(format));\n text = new TextDecoder().decode(await readBounded(stream));\n } else {\n text = await req.text();\n }\n return JSON.parse(text);\n}\n",[],[171,254],["D",1783530111563],[188,189,190,191],[171],["D",1783529750134],["D",1789524636084],{"_101":100,"_109":105},{"_101":100,"_102":103,"_104":105,"_18":-5,"_106":107,"_108":60},{"_13":90,"_32":91,"_44":43,"_92":45,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":46,"_99":100},"ctx",{"_83":-5,"_129":302,"_303":304,"_305":306,"_307":25,"_308":25,"_309":25,"_310":60,"_311":-5,"_312":-7,"_313":-7,"_314":64,"_315":25,"_316":25,"_317":-5,"_318":25,"_319":25,"_320":25,"_321":-5},"ENV",{"_273":274,"_275":276,"_277":91,"_278":279,"_280":281,"_282":283,"_284":285,"_286":287,"_288":289,"_290":291,"_292":293,"_294":295,"_296":297,"_298":299,"_300":301},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v21