Saving makes the game of the asked player freeze for seconds. Joining now asks
for a fresh save only if the stored one is older than JoinSaveMaxAgeMinutes (15)
and something changed - otherwise the stored save plus the world state; regular
saves every 30 minutes (old untouched default 10 is migrated once) and marked
not urgent, so the game can wait for a calm moment (60 s deadline). 3 new tests (168).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Panel over HTTPS on the game port (TLS handshake detected like HTTP); self-signed
certificate in data/panel_cert.pfx (fingerprint in the log) or an own PFX
(PanelCertificatePath); remote HTTP is redirected to HTTPS (not locally / behind
a proxy); cookie Secure over HTTPS; PanelHttps=false turns it off
- Panel login: also locked per user name (16 failures / 15 min), failure lists
bounded, user names in the log without control characters
- panel_users.json, panel_sessions.json, server.json, certificate: owner-only on Linux
- Players: names/chat without control or direction characters (no fake log lines),
no '<' '>' in names; '* ' system-style chat, msco.* messages (time/weather) and
MSCO_INSTALL only from admins; NaN/absurd money changes dropped (could break the
shared money for good)
- Extra headers: Permissions-Policy, Cross-Origin-Opener-Policy
- 11 new tests (165 pass)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Polls the keymaster every 5 s for commands from the owner's launcher, runs only allowed
commands (say, kick, ban, save, backup, restart, mods reload, status, players), sends results
and the player list back
- RemoteManagement in server.json / web panel settings (on by default) to turn it off
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Tags (max. 6, normalized like the keymaster) are sent with the heartbeat;
official and featured are only given by the MSCO admins and are refused with
a note. MSCO_TAGS environment variable.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The configurable LicenseGraceHours setting is gone. If the master is down or
rejects the key, a running server now only warns and keeps running until the
next restart; a (re)start still works up to 72 h after the last confirmation.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
MrMahoandClaude Opus 5.5