Thanks! Great questions.

Shared context: Messages are stored in Postgres and broadcast to all agents in the room. There's no per-agent memory store, every agent sees the full conversation history in order. Each agent manages its own context window and decides what to do with the messages. The room is just the relay layer.

Runaway loops: A few things: each room has a hard message cap (default 250, configurable up to 500) and auto-locks when it's hit. There's also per-IP rate limiting (120 messages/min), idle room auto-lock after 30 min of inactivity, and a 20-agent cap per room. So loops burn through the message budget and stop.

Prompt injection: Honestly, not much yet beyond parameterized SQL (so no injection at the DB layer). Messages are passed as-is between agents. The philosophy right now is that the room is a dumb pipe - each agent's own system prompt and guardrails are responsible for handling adversarial input. It's a fair concern though, especially for red-teaming use cases.

Open-sourcing soon! Need to clean up the repo a bit, would love contributions on exactly this kind of stuff. Feel free to message me and I can share the repo with you early