website/DEMO_MODE.md §3.2, §3.4, §3.5, §7.3 and §7.5 (step 2 of §10).
Nothing changes off the demo; everything below sits behind ctx.demoMode.
- demoLocks in module.json: PUT and DELETE /admin/rust/servers/:id.
- The console-command deny list (DM11): quit, restart, oxide.unload,
oxide.reload, rcon.*, fps.limit and server.tickrate, by first word,
with global. stripped and o. read as oxide. Refused at save through
core's demoRefuses (MODULE_API 1.19.0, DM18) and again at run, with
retry: false, before the rig is asked. Teardown commands too.
- The config editor (DM14): the bridge's files are left out of the
list and refused for reading, writing and in the write history, by
name (canonicalised) and by the catalogue's self. Other plugins'
credential fields are redacted in the text and the form and made
read-only; raw-JSON saves are refused; a file that does not parse is
withheld. The admin server list leaves out the sidecar URL.
- onDemoSeed (DM15): upserts the rig's server row with an encrypted
token and demo-player's stand-in Steam link.
- The release's install manifest carries protocol, read from
PROTOCOL_VERSION, for the wipe's bundle match (DM12).
coreApi is ^1.19.0; ci/core-ref.json pins website#224's head.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
Stage 2 of PLAN_LAST_FIXES (docs#366).
- W7/W11: an "is it loaded" refusal is confirmed live before it is given.
New liveStatus.js asks the sidecar once (boot.refreshOne, as a poll tick
would), at most once per server per 5 s and waiting at most 3 s, then
reads the stored status again. Used by Economics (step and staff page),
Backpacks, Dangerous Treasures, Guarded Crate, RaidableBases, ZoneDomes,
TruePVE and RunicNPC.
- W3: a world call answered `already-out` (the bridge half comes in stage
3) succeeds as called 0, saying a Travelling Vendor is already out.
- W6: "A locked crate dropped by a Chinook is being hacked."
- W8: a RaidableBases profile's audit row names RaidableBases, not "@data".
- W10: the backpack sizes picker lists each size once, naming its servers.
- W13: a RaidableBases name both servers describe differently shows each
server's own description.
- W14: each RaidableBases note after the first starts its own sentence.
- W15: a staff deposit refused at Economics' limit answers 409.
- W16: a payment's failedNote explains only the reasons that happened.
- W17: the sync state counts player grants that did not land
(waitingToLand), and the Permissions page says "in sync · 1 waits for
their player to join" instead of plain "in sync".
- W18: Guarded Crate's kept note drops the "30 minutes" it could not know.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
PLAN_REDESIGNS §11.4 (D202-D208, D386-D391), protocol 14. Spec: docs
rust-link/PROTOCOL.md §20.12.
- raid.started, raid.completed, raid.purchased and raid.locked public,
raid.ended staff's; raidableBases.js reads each row per viewer (raiders'
and a buyer's names only for the presence audience, D376/D390; Steam ids,
position and a run's key only for staff). Feed lines in the World filter.
- The step rust.raidbase.spawn, "Spawn a raid base" (ledgered, budget
rust.raids): difficulty, profile and base from option sources listing each
server's own names (D386), a spot as a world call's location with a height
adjustment or an exact height, and PvP/NPCs/lock as on/off/blank. A base
the raids helper made is a world resource, so eventWorld's revert and
reconcile serve it and world.expired marks it expired; one it did not make
records nothing and the run log says it despawns on its own timer. Refused
at verify for a server that said it cannot; a dry run with a spot returns
the spot check as detail.warnings (MODULE_API 1.16.0, D391). rb-not-ready
retries in ten minutes.
- Warlord: raids_completed, title category raidscompleted, the leaderboard's
Raid bases column (sort=raidsCompleted).
- The map's raids layer (D114), public by default with its own audience; the
run's key is dropped before any viewer gets it.
- Server settings' line for RaidableBases; its profiles in Mod configuration
under a virtual path (D205).
- Swagger fragment, bundle and README.
Tests: server 684/684 (raidableBases.test.js new, every name in it invented);
client 99/99, build and externals.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
The plugin now answers a save once the files are written, with pending and
a writeId, and reports the reload later as a config.outcome event. The save
is recorded as reloading with a settle_by of two plugin ceilings plus slack
on the database's clock; ingest settles the row by (server, writeId), only
while it is still reloading, so a replay moves nothing and a late outcome
still lands. A row past settle_by reads as lost.
GET /admin/rust/config/:serverId/writes/:writeId serves the poll; the page
polls it every two seconds, holds the Save button while it waits, and says
whether a rolled-back plugin came back on its old file. config.outcome is
a staff kind: it carries the server's log tail.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
R18's two tiers: a form generated from a config file's own values, and raw JSON
for what a form cannot express. Admin → Rust mod config, one live round trip per
action, nothing cached between a browser and a game host's disk.
`configEdit.js` is the part that could not be done naively. JavaScript cannot
tell `1` from `1.0`, and both mod frameworks deserialize a config into typed C#
classes — so a read-modify-write silently rewrites every whole-numbered float as
an integer on fields nobody touched, and a plugin that then throws at load does
not come back. It never parses, mutates and re-serialises: it records the SOURCE
SPAN of every value and splices literals into them, so an untouched `1.0` is
still `1.0` and a number an admin types travels as text the whole way (D35/D36).
The bridge's own config is editable with `Host`, `Port` and `ServerId` locked,
in the form and in the raw tier, because either would cut the link carrying the
edit or strand every row this site holds (D38). Credentials render masked with a
reveal; the raw tier shows them (D37) and the audit trail never does.
`rust_config_writes` records every save including the refused and the rolled
back — an operator asking why a setting is not what they set needs to see that
somebody tried.
Three defects a browser walk found that 179 green tests did not:
* every save of the bridge's own config was refused while the page said the
opposite — a `<select>` whose value matches no `<option>` shows the first one,
so the reload guess `RunicGateway` was on the wire and "nothing" was on the
screen;
* `btn ghost` is not a class this platform defines (`.btn-ghost` is), so every
secondary button in this module has rendered as a primary one since phase 7 —
here it made the open file and the active tier indistinguishable;
* a save's refusal rendered at the top of a long form, far from the button.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PMH6bw1jXMgbyF3ZWGEzSM
