release: the public demo's module-side locks and seed hook (v0.6.0, MODULE_API 1.19.0) #64

wtclaude · 2026-10-26T11:57:40-05:00

wtclaude commented

2026-10-26 11:57:40 -05:00

Cuts edge over to main so the demo site (website#222, docs/website/DEMO_MODE.md §10 step 5) can install a module that has the demo code. The org lead approved the cutover on 2026-10-26.

What lands on main

#62 feat(demo): demoLocks in module.json; the console-command deny list (§3.4) at save (demoRefuses, DM18) and at run, behind ctx.demoMode; the config-editor rules (§3.5: the bridge's config can be neither read nor written, other plugins' secrets are redacted, raw-JSON saves are refused); the onDemoSeed hook (modules.rust.{servers,links}); protocol in the release's install manifest (§7.5).
#63 chore(ci): ci/core-ref.json pinned to website main 69998ec (#224's merge, MODULE_API 1.19.0).

Release. feat(demo) is a minor, so CI releases v0.6.0: coreApi ^1.19.0, and the install manifest carries protocol: 14, matching the Rust bundle 2026.10.22. The demo's wipe chooses a module release by that field (DM12). A site on core < 1.19.0 refuses to load this module, as it should.

Outside the demo nothing changes: every new path runs only when the core reports demoMode.

AI-assisted: Claude Code (Claude Opus 5.5)

🤖 Generated with Claude Code

https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

Cuts `edge` over to `main` so the demo site (website#222, `docs/website/DEMO_MODE.md` §10 step 5) can install a module that has the demo code. The org lead approved the cutover on 2026-10-26. **What lands on main** - #62 `feat(demo)`: `demoLocks` in `module.json`; the console-command deny list (§3.4) at save (`demoRefuses`, DM18) and at run, behind `ctx.demoMode`; the config-editor rules (§3.5: the bridge's config can be neither read nor written, other plugins' secrets are redacted, raw-JSON saves are refused); the `onDemoSeed` hook (`modules.rust.{servers,links}`); `protocol` in the release's install manifest (§7.5). - #63 `chore(ci)`: `ci/core-ref.json` pinned to website `main` 69998ec (#224's merge, MODULE_API 1.19.0). **Release.** `feat(demo)` is a minor, so CI releases **v0.6.0**: `coreApi ^1.19.0`, and the install manifest carries `protocol: 14`, matching the Rust bundle `2026.10.22`. The demo's wipe chooses a module release by that field (DM12). A site on core < 1.19.0 refuses to load this module, as it should. Outside the demo nothing changes: every new path runs only when the core reports `demoMode`. - [x] AI-assisted: Claude Code (Claude Opus 5.5) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

wtclaude added 4 commits 2026-10-26 11:57:42 -05:00

feat(demo): the public demo's module-side locks and seed hook

PR Checks / client-build (pull_request) Successful in 54s

Details

PR Checks / server-tests (pull_request) Successful in 1m0s

Details

PR Checks / frozen-manifest (pull_request) Successful in 1m19s

Details

7a0d0842ba

website/DEMO_MODE.md §3.2, §3.4, §3.5, §7.3 and §7.5 (step 2 of §10).
Nothing changes off the demo; everything below sits behind ctx.demoMode.

- demoLocks in module.json: PUT and DELETE /admin/rust/servers/:id.
- The console-command deny list (DM11): quit, restart, oxide.unload,
  oxide.reload, rcon.*, fps.limit and server.tickrate, by first word,
  with global. stripped and o. read as oxide. Refused at save through
  core's demoRefuses (MODULE_API 1.19.0, DM18) and again at run, with
  retry: false, before the rig is asked. Teardown commands too.
- The config editor (DM14): the bridge's files are left out of the
  list and refused for reading, writing and in the write history, by
  name (canonicalised) and by the catalogue's self. Other plugins'
  credential fields are redacted in the text and the form and made
  read-only; raw-JSON saves are refused; a file that does not parse is
  withheld. The admin server list leaves out the sidecar URL.
- onDemoSeed (DM15): upserts the rig's server row with an encrypted
  token and demo-player's stand-in Steam link.
- The release's install manifest carries protocol, read from
  PROTOCOL_VERSION, for the wipe's bundle match (DM12).

coreApi is ^1.19.0; ci/core-ref.json pins website#224's head.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

Merge pull request 'feat(demo): the public demo's module-side locks and seed hook' (#62 ) from feat/demo-mode into edge c61f9f29ec

Reviewed-on: #62

chore(ci): pin core-ref to website#224's merge on main

PR Checks / client-build (pull_request) Successful in 1m2s

Details

PR Checks / server-tests (pull_request) Successful in 1m8s

Details

PR Checks / frozen-manifest (pull_request) Successful in 1m35s

Details

791f13235e

website#224 (MODULE_API 1.19.0, demoRefuses) merged as 69998ec on main.
The merge tree equals the branch head the pin held (cee4ab8), so
routes.manifest.json does not change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

Merge pull request 'chore(ci): pin core-ref to website#224's merge on main' (#63 ) from chore/core-ref-224-merge into edge

PR Checks / server-tests (pull_request) Successful in 41s

Details

PR Checks / client-build (pull_request) Successful in 47s

Details

PR Checks / frozen-manifest (pull_request) Successful in 58s

Details

0cdb046d30

Reviewed-on: #63

whitlocktech merged commit 228e178475 into main

2026-10-27 12:32:03 -05:00

whitlocktech referenced this issue from a commit

2026-10-27 12:32:04 -05:00

Merge pull request 'release: the public demo's module-side locks and seed hook (v0.6.0, MODULE_API 1.19.0)' (#64) from edge into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: RunicGateway/Module-Rust#64