- Panel over HTTPS on the game port (TLS handshake detected like HTTP); self-signed
certificate in data/panel_cert.pfx (fingerprint in the log) or an own PFX
(PanelCertificatePath); remote HTTP is redirected to HTTPS (not locally / behind
a proxy); cookie Secure over HTTPS; PanelHttps=false turns it off
- Panel login: also locked per user name (16 failures / 15 min), failure lists
bounded, user names in the log without control characters
- panel_users.json, panel_sessions.json, server.json, certificate: owner-only on Linux
- Players: names/chat without control or direction characters (no fake log lines),
no '<' '>' in names; '* ' system-style chat, msco.* messages (time/weather) and
MSCO_INSTALL only from admins; NaN/absurd money changes dropped (could break the
shared money for good)
- Extra headers: Permissions-Policy, Cross-Origin-Opener-Policy
- 11 new tests (165 pass)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Mods -> MSCO mod list: search the approved mods from msco.mbm.wtf/mods and add or
update one with a click. The server lists and downloads only from the official
keymaster (never from a URL in the answer), checks the SHA-256 and stores it in
data/mods like an uploaded mod. Admins only. 6 new tests (154 pass).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Bought parts (oil filter, spark plugs, fan belt, battery ...) and whether they are
installed are stored in items.txt. Without it they are missing on the car - e.g. the
finished Satsuma of a downloaded save loses oil on the server (in singleplayer an old
local items.txt hides the problem). The upload result now says so. 2 new tests (148 pass).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Polls the keymaster every 5 s for commands from the owner's launcher, runs only allowed
commands (say, kick, ban, save, backup, restart, mods reload, status, players), sends results
and the player list back
- RemoteManagement in server.json / web panel settings (on by default) to turn it off
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- ModStore: mods in data/mods (id, name, version, SHA-256), console "mods [reload]"
- ModList is sent before Welcome, files on request in 60 KB parts (once per connection)
- ModMessage relayed between players (max 64 KB)
- Heartbeat reports the mods to the keymaster (automatic "modded" tag)
- Web panel page "Mods": upload, remove, reload (DE/EN)
- Tests for list, download, checksum, relay and limits
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Late position updates from players that are being reconnected after reset-world or a new game
were stored again, so everyone spawned at their old-world position. Tracking stops for those
clients now. Test added.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The restart used to refuse when the panel was disabled, so it stayed
reachable. Now it stops the panel (also the relay on the game port);
'panel on|off' in the console turns it on/off and saves server.json.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The dot replaces the small 'new' badge; the first update check now starts as
soon as the panel asks for the update status instead of 60 s after start.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
AdminAction 9/10 (admins only) runs op/deop for the target player, same as
the console and the web panel.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
World & Backups -> Start new game (console: new-game, also when stopped):
the save is backed up and replaced by a new-game marker (also as reset
point). Joining players are told to start a new game; the server pulls the
first player's save and from then on runs normally. Reset world returns to
a new game when the reset point is one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
WorldVars and VehicleControls were only relayed; players joining later only
got them with the next save pull. They are now stored in world.json (cleared
with a new save) and appended to the world snapshot (old clients ignore it).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Tags (max. 6, normalized like the keymaster) are sent with the heartbeat;
official and featured are only given by the MSCO admins and are refused with
a note. MSCO_TAGS environment variable.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Updater checks git.mbm.wtf every 6 h (and on demand) for a newer <Version>
on main, shows the new commits and the required mod version
- Install: download the source, build it with dotnet publish into
data/app/current, warn players and restart (exit code 75 for Docker/systemd,
self-relaunch on Windows). At startup a newer installed update is loaded in
its own AssemblyLoadContext; after 3 failed starts the built-in version runs
- Panel: Update page, sidebar badge, full-screen progress overlay (download,
build, install, restart) that survives the restart and reloads the panel
- Panel sessions survive restarts (hashed tokens in data/panel_sessions.json)
- Docker image is based on the .NET SDK so it can build updates
- Version 2.9.0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The configurable LicenseGraceHours setting is gone. If the master is down or
rejects the key, a running server now only warns and keeps running until the
next restart; a (re)start still works up to 72 h after the last confirmation.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
MrMahoandClaude Opus 5.5