NovaSync

NovaSync 2.17.146 — Launch-readiness auth/HTTP sweep

Final pre-launch hardening pass over the publicly-exposed dashboard + HTTP API surface, driven by a cross-vendor trio review (DeepSeek V4-Pro + Gemini 3.1-Pro + java-plugin specialist agent). Four findings landed; ~15 lower-severity items were triaged into a follow-up hardening sprint.

What changed

- Role-delete now refuses on active members. RoleApiHandler previously had dead-code: the active-member guard always evaluated false, so any role — including built-in or admin-occupied roles — could be deleted in one click. Replaced with a real SELECT COUNT(*) FROM dashboard_admins WHERE role = ? COLLATE NOCASE and HTTP 409 with the count when non-zero. - Constant-time api-key compare on Java HTTP routes. /api/command, /api/health, and /api/block-lookup were comparing authHeader.equals(finalApiKey). Replaced with MessageDigest.isEqual on UTF-8 bytes across all three. Closes a remote timing oracle on the shared HTTP API key. - Double-submit CSRF check on `/api/command` session-cookie path. Previously the endpoint accepted any same-origin POST with a valid nova-session cookie, with no X-Dashboard-Token validation. A malicious cross-origin page could drive arbitrary server commands as the logged-in admin. The api-key path (used by the Nova mod) is unaffected — it never sets the session cookie. - `evtBadge()` XSS fix. The activity-feed badge was interpolating server-controlled e.type straight into innerHTML. Wrapped through the canonical esc() helper that already guards every other dynamic-HTML insertion in the dashboard.

Verification

- Cross-vendor trio review (Gemini 3.1-Pro + DeepSeek V4-Pro) confirmed all four fixes; two single-vendor "ship-block" findings were caught as false positives by reading the actual code paths before fixing. - Full nuke + reinstall of the EU node from the public install.nova-ai.online | bash path: cold-boot succeeded in 17.3 s, owner-setup wizard reachable, dashboard login + role page + command endpoint all healthy. - Live on SA Hyperlayer + EU Hetzner + laptop test node; Fast and Slow website channels both point at 2.17.146.

Continuity with 2.17.145

This release sits on top of the full 2.17.134 → 2.17.145 Mojang-route resilience series (MojangRetryProxy v2, MojangPublicKeysCache, Geyser cooldown-type patch, BedrockSkinFix is_steve boolean parse). All of that is included — no behavior changes vs 2.17.145 outside the four auth/HTTP fixes above. Tested on Paper 1.21.11 + Java 21 with Geyser-Spigot 2.10.0 and Floodgate 2.2.5.

NovaSync 2.17.145 — Mojang-route resilience + Bedrock skin path fixes

Patch series 2.17.134 → 2.17.145 shipped in one day after a Hyperlayer SA → Mojang routing degradation broke player joins. End-to-end hardening of every outbound Mojang/Microsoft/Geyser endpoint NovaSync depends on.

MojangRetryProxy (compat shim)

- Multi-host coverage now wraps every flaky Mojang/Microsoft/Geyser endpoint that affects auth, secure-profile, Bedrock discovery, OpenID issuer, profile lookup, and skin textures: api.minecraftservices.com, *.minecraft-services.net, sessionserver.mojang.com, api.mojang.com, textures.minecraft.net, api.geysermc.org. - Per-host wildcard matching (*.minecraft-services.net) covers the full Cloudburst discovery → issuer → jwks → token chain. - Handshake-retry: setSoTimeout(handshakeMs) before startHandshake() plus a 6-attempt retry loop sharing the same budget as read-retries. JDK-clean way to interrupt a stuck TLS handshake (replaces the prior watchdog-thread approach that raced on the inner-socket field). - Install hook moved from onEnable to onLoad so the shim is the JVM-wide default SSLSocketFactory before authlib's YggdrasilServicesKeyInfo class init runs its first publickeys fetch (~5s after ServerMain). - JVM-wide sun.net.client.defaultConnectTimeout=8000 + defaultReadTimeout=10000 + http.keepAlive=false set at install (when not already operator-configured). - SEVERE log on install failure so admins see when the shim is INACTIVE.

MojangPublicKeysCache (new)

- Disk-cache for /publickeys at plugins/NovaSyncPlugin/cache/mojang-publickeys.json. One successful fetch buys months of resilience (keys rotate rarely). - On retry exhaustion, splices a synthesized HTTP/1.1 200 OK response (SequenceInputStream of headers + body) into RetryingSSLSocket.getInputStream() so the application-layer HTTP parser inside authlib's MinecraftClient reads cached bytes seamlessly. - Atomic CacheEntry record so body + timestamp can never tear under concurrent reads. - Strict JSON shape validation before save (requires {...}/[...] wrapping + publicKey/BEGIN substring + Content-Length-delimited body) — prevents a truncated upstream response from poisoning the cache for 90 days. - Async file I/O dispatched to a daemon executor so saves don't block the auth hot-path. - Early cache fallback once two upstream retries have failed AND the cache is warm — keeps total elapsed under Paper's ~30 s login window. - Boot-time warmAsync() pre-fetches the cache in the background.

ConfigMigrator (Geyser auto-patch)

- New idempotent patch for bedrock.cooldown-type: disabled. Geyser's cooldown indicator renders via a translatable component (geyser.opt.cooldown.*); when the Bedrock locale-asset cache fails to load on a degraded route, the Bedrock client cannot resolve the key and renders the raw geyser.opt.cooldown:non literal as floating HUD text on every hotbar-slot change. Disabling the indicator avoids the broken-translation render.

BedrockSkinFix

- is_steve boolean parsing fixed (was using the string-only extractJsonString helper, which always returned a substring of the next quoted field; the equality check never matched). New extractJsonBoolean is whitespace-tolerant and word-boundary terminated. - Stop overriding Floodgate's textures URL when is_steve=true. Geyser's is_steve flag reflects the player's Xbox Live persona skin, not their currently-active local Bedrock skin (Marketplace/custom). Floodgate has already uploaded the correct visual; preserve its URL.

Cross-vendor review

Findings consolidated from DeepSeek V4-Pro + Gemini 3.1-Pro (via OpenRouter) + java-plugin-specialist agent throughout the patch series. Tested live on Hyperlayer SA (Paper 1.21.11, Java 21, Geyser-Spigot 2.10.0, Floodgate 2.2.5).

2.17.133

Highlights since 2.16.208

Compatibility scanner + dashboard banner (2.17.130-132)

New boot-time + periodic compatibility scanner. Detects version drift between Paper, Geyser, Floodgate, ViaVersion/ViaBackwards, LuckPerms, CoreProtect, and voicechat. Surfaces issues via persistent dashboard banner with one-click fix buttons. Tiered notifications: BLOCKER fires WhatsApp + Discord + Email, WARN fires Discord only. Self-healing — issues auto-clear when admin fixes them. Snooze + acknowledge lifecycle for issues you can't fix immediately.

In-JVM Mojang API retry shim (2.17.133)

Wraps the JVM-wide SSLSocketFactory so HTTPS calls to api.minecraftservices.com get up to 6 transparent retries on empty/timeout reads. Fixes the silent-drop failure mode where Geyser's encryption-setup call to Mojang fails permanently for the JVM lifetime (every subsequent Bedrock login throws NoClassDefFoundError). Pure in-JVM; no certificate generation, no listening port, no routing changes. Only sockets to api.minecraftservices.com are wrapped; all other HTTPS traffic uses the unmodified default factory.

Geyser boot recovery (2.17.128-129)

Backup safety net: if MojangRetryProxy fails for any reason and Geyser logs "Unable to set up encryption", NovaSync detects within 60s and triggers an automatic Paper restart. Configurable max-attempts (default 20). Persists across restarts so an exhausted loop resets cleanly.

Bedrock plugins one-click update (2.17.123-126, 130)

Dashboard button installs/updates Geyser, Floodgate, ViaVersion, and ViaBackwards atomically from their official sources (Modrinth / GeyserMC / Hangar with fallbacks). Owner-gated, audit-logged, single restart loads all four.

Owner-tab consolidation

Plugin Manager, NovaSync Update, License Key, OpenAI Key, Security, Sync, Backups, Gamerules, Advanced, Hub, Features, NovaLink — all moved under the Owner sub-bar. Clearer permission boundary: dashboard admins can moderate players but cannot touch infrastructure unless they hold the OWNER role.

Security hardening (2.17.114-126)

Ten security fixes across multiple subsystems: constant-time API key comparison, OWNER gate on /api/admin/relaunch-via-startscript, per-IP+username rate limit on update-channel unlock-fast, audit-on-deny for privileged-action attempts.

Recommended plugins curated set

recommended-plugins.json ships with the 7 plugins NovaSync integrates with: CoreProtect, Geyser-Spigot, Floodgate, ViaVersion, ViaBackwards, LuckPerms, Simple Voice Chat. First-run setup wizard offers a one-click install of any missing ones from the dashboard.

Compatibility

- Paper 1.21.11 or compatible - Java 21+ - Drop-in: no other plugins required; LuckPerms / Voicechat / CoreProtect / Geyser / Floodgate / Via* are all optional integrations

Voice & dashboard improvements: - New full-duplex bidirectional voice between admin dashboard and Bedrock /voice (browser AEC at source) - Dashboard toggle: SVC Echo Guard (Settings -> Voice) for Java SVC mod players in case of echo loops - Cache-Control no-store on /voice and /dashboard so plugin updates take effect immediately - WebCodecs.AudioEncoder/Decoder voice path with raw 20ms Opus packets (zero container overhead) - Mobile wake-lock on /voice page so phones don't drop voice when screen dims

NovaSync 2.16.122

Rollup of the late-April → early-May iteration since the previous Modrinth release. All changes verified on the public dashboard at the EU host before tagging.

What's new

- Identity tab — server icon (drag-drop, auto-resized to 64×64), display name, MOTD with live colour preview. Old MOTD/icon fields scattered across other tabs are now read-only mirrors that reflect this single source. - NovaLink Identity cascade — when you blank the NovaLink override fields, they inherit live from the Identity tab. Override wins when set; live placeholder preview via /api/identity/state. - Notifications matrix — per-channel rules (Discord, Email, WhatsApp) for every event class. Reorganised into 5 categories. New Audit sub-tab with ring buffer (/api/notifications/audit) shows what fired and where. - Public server directory filters — Open vs. whitelisted badges + filter chips + sort dropdown + URL persistence on link.nova-ai.online. Country/region chips with a "Near Me" option. Discord-CTA on detail pages. - Server Address card — prefers your friendly link.address hostname over raw IP. Separate Bedrock-host field. Dashboard URL row with Copy button. - CF / multi-CDN proxy detection — auto-detects Cloudflare / Fastly / Akamai / CloudFront fronting your Hub URL. Shows a green "Origin protected by <Provider>" confirmation instead of nudging you to enable a proxy you already have. - Live player count on the directory — PlayerJoin/Quit events trigger a debounced instant heartbeat, so link.nova-ai.online updates within ~3 seconds of join/quit. - In-dashboard bug reports — submit reports straight from the dashboard; integrated with the audit log. - Player Lookup autocomplete — type-ahead from known players via a <datalist>; free-text fallback preserved; auto-fires the profile load on pick. - Previously-Connected players — sortable by columns.

Fixes

- Roles tab no longer renders blank on first load (chart-init race + tab-switch ordering). - Notifications save was silently failing — config-key mismatch fixed; 7 missing WhatsApp + 6 missing Discord/Email keys now persist; onOpChange + onDifficultyChange route correctly through NotificationsRouter. - WhatsApp toggle gates were stuck closed — a stale final field captured at class-init was shadowing the live config. - AntiCheat duplicate Discord path removed. - NovaLink form refresh no longer overwrites your edits — !isAutoRefresh guards added to Notifications / Identity / NovaLink tabs + focus-detection belt-and-suspenders. - Settings → Nova tab cascade-hide bug — two sections were being hidden because they sat under the integrations data-sub wrapper. - Server icon dropzone now accepts PNG / JPEG / GIF / BMP (was hard-blocking on a dead PNG-magic-byte check). - CDN cache-poisoning prevented — download URLs use {version} placeholder so each release is a unique CF cache key. Cache-Control reduced to 60s on /downloads/*.{jar,txt}.

Operational

- One-click auto-update from the dashboard works node-by-node — owner clicks Update on each node, the plugin pulls from the CDN and restarts. No more manual SCP on iterative builds. - Multi-CDN IP-range fixture is bundled in the JAR (cdn-ip-ranges.json). — Tested on Paper 1.21.11 (EU + SA hosts, both with paying players online during the ramp).

v2.16.109 — Auto-update flow fix + countdown overlay + gzip dashboard

Critical fix — read this if you have 2.15.471 through 2.16.108 installed

The dashboard's "Update now" button was broken from 2.15.471 (2026-04-30) through 2.16.108 — clicking it always returned Error: unknown and never actually updated the plugin. Root cause: the install request was sent as GET to a POST-only endpoint (a JS helper function ignored the method override). The server-side method-check rejected it cleanly with no log entry, so the bug was invisible to anyone except the user clicking the button. Fixed in 2.16.109. If your auto-update is currently broken, drop this JAR in your plugins/ folder once and restart. From this version forward, auto-update permanently works and you never need to manually swap a JAR again.

Other fixes & polish

- Auto-update flow now uses the standard 60-second countdown overlay (cyan full-screen, polls /api/health, auto-reloads when server is back). Previously showed a small "Reconnecting... attempt 20" status which looked like something was failing. - Dashboard served gzipped when client accepts it. dashboard.html is ~1.2 MB raw → ~200 KB on the wire, ~5x faster page load over high-latency / metered connections. - NovaLink register substring OOB fixed — affected nodes where the generated nodeId hex happened to be <8 characters (about 1-in-8 chance per fresh install). - Diagnostic logging on the update endpoint — any future failure now logs the full stack trace + exception class name to latest.log AND returns the class name in the API response. No more "Error: unknown" with zero diagnostic trail. - Settings → Advanced → Plugin Updates section added — manual "Check for Updates" button, current/latest version display, last-checked timestamp, "Install latest now" shortcut. Auto-checks when you open the Advanced sub-tab.

Upgrade notes

- All existing config + data is preserved. - First boot after upgrade backs up config.yml to config.yml.bak-2.16.<previous> automatically. - No breaking changes to the public API or peer protocol. - Dependencies unchanged: Paper 1.21.11, optional CoreProtect / LuckPerms / voicechat / Floodgate / Geyser as before.

Thanks

Sorry to anyone who clicked Update during the last week and saw "Error: unknown" — that was a real bug, not your network. This release fixes it for good and adds enough diagnostic plumbing that the next bug will be visible the moment it happens.