Guest Chat

Offer disposable text conversations without creating accounts or saved chat history

Guest Chat lets visitors try one inexpensive text model at /. The browser keeps its session binding and credential only in memory. Reloading, choosing New chat, or signing in does not transfer the conversation into an account.

Installation

bunx chat-js@alpha add guest-chat

Configure the shared EVE runtime and apply your generated database migration. Guests request native EVE retention 0 on every backend. ChatJS expires access and ends sessions. The selected Workflow World owns payload retention. Guest admission does not require PostgreSQL purge fences.

PostgreSQL World 5.1.1 clears run payloads on completion for retention 0. Vercel enforces its own retention policy. Successful ChatJS cleanup reports session retirement and credential-policy completion. Payload erasure is handled by the provider.

On Vercel, admission uses the verified x-vercel-forwarded-for header. Elsewhere, set TRUSTED_CLIENT_IP_HEADER to a header your reverse proxy overwrites with one validated client IP. Missing or malformed addresses reject admission. Development uses the loopback address.

Schedule the protected /api/cron/cleanup endpoint and monitor unsuccessful sweeps. bun cleanup drains batches that make progress. Local development starts a cleanup timer only for a local PostgreSQL database and a local workflow database and worker.

Behavior and limits

Guests and accounts use the same EVE agent. The plugin authenticates signed credentials against its persisted policy and binds each credential to one native session. Reconnecting with a different identity cannot change the session’s original capabilities.

Limit	Default
Model	GPT-5 nano, using the selected gateway’s model ID
Messages per IP	5 per minute
New sessions per IP	5 per hour
Credential lifetime	1 hour
Message length	4,000 characters
Cumulative user input	24,000 characters
Serialized provider prompt	24,000 characters
Output	512 tokens with a bounded stream and timeout
Session cleanup target	24 hours, plus scheduling delay and retries

There is no per-session message-credit balance. Failed or ambiguous sends still consume admission capacity. Guests cannot use tools, files, projects, comparisons, account APIs, or account billing. Provider middleware also rejects non-text inputs and tool output, independently of the UI.

Retirement on unload and New chat is best effort. Scheduled cleanup verifies native session ending or explicit expiry and revokes its local policy. It reports retiredCount on both backends and never claims payload deletion. Local policy metadata remains for retries. Rate buckets expire after two days. Guest cleanup no longer performs PostgreSQL queue/payload purge or installs late-write fences. Account deletion keeps its existing safeguards.

The plugin installs agent/instrumentation/guest-retention.ts to omit guest input/output trace capture, including in development. EVE derives retention 0 from that policy. Non-guest trace policy and retention are unchanged. If you customize EVE instrumentation, keep a single otel() declaration and preserve this guest rule. An agent-wide retention override takes precedence.

Source and customization

The plugin implementation lives in chatjs/plugins/guest-chat/:

Module	Responsibility
`signed-out.tsx`	Guest screen and memory-only conversation binding
`routes/create-session.ts`	Same-origin bootstrap and session binding
`session-profile.ts`	Native authentication, bounded model, and instructions
`guest-retention.ts`	Guest-only native retention selection through trace policy
`guest-policy.ts`	Model, rate, input, output, and expiry policy
`guest-schema.ts`, `guest-queries.ts`	Durable admission, isolation, and cleanup inventory
`cleanup.ts`, `guest-cleanup.ts`	Bounded native session retirement and local policy completion
`server-plugin.ts`, `guest-scheduler.ts`	Local development cleanup registration

app/api/eve-guest/route.ts is a thin adapter. Core imports generated registrations, not this implementation. Account tools and hooks require the registered account authenticator. Unknown or removed session profiles cannot fall back to account capabilities.

Edit the installed source to change policy. The provider prompt includes assistant replies and framing, so a conversation can reach that bound before its user-input allowance. Changes to persisted policy semantics should invalidate or explicitly handle existing credentials.

Without Guest Chat

A new installation without this plugin redirects signed-out chat visitors to /login. It has no guest bootstrap route, authenticator, cleanup task, retention instrumentation, or guest tables. Account chat continues to use the same agent.

To remove the plugin from an existing deployment, stop guest admission and drain its sessions before removing its cleanup contribution and schema. Removing a plugin does not itself purge existing runtime payloads.

The reference repository’s migration 0022 removes the obsolete account-shaped guest tables. It refuses to run while those tables still own undeleted conversations. Purge those conversations using the previous release before upgrading. Current disposable guest tables and sessions retain their names and data.

See the Plugin API for the signed-out screen, session profile, and cleanup contracts.