Rewrite MCScript server from scratch for v2.0.0

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false

.env.example

@@ -1,2 +1,7 @@
+# Copy this file to .env to override config/server.json
 PORT=25565
-ONLINE_MODE=true
+ONLINE_MODE=true
+# PUBLIC=true
+# SERVER_NAME=My server
+# OWNERS=YourName,FriendName
+# DATABASE=sqlite

.gitattributes

@@ -0,0 +1,11 @@
+* text=auto eol=lf
+*.cw binary
+*.lvl binary
+*.dat binary
+*.png binary
+
+# left out of release archives (git archive)
+/.github export-ignore
+/test export-ignore
+/.editorconfig export-ignore
+/.gitattributes export-ignore

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,41 @@
+name: Bug report
+description: Something doesn't work the way it should
+labels: [bug]
+body:
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened?
+      description: What you did, what you expected, and what happened instead.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: How to reproduce it
+      placeholder: |
+        1. Start the server with ...
+        2. Join and run /...
+  - type: input
+    id: version
+    attributes:
+      label: MCScript version
+      description: Shown when the server starts, or in /serverinfo.
+    validations:
+      required: true
+  - type: input
+    id: node
+    attributes:
+      label: Node.js version and OS
+      placeholder: Node 24.3.0 on Ubuntu 24.04
+  - type: input
+    id: client
+    attributes:
+      label: Client
+      placeholder: ClassiCube 1.3.8 desktop / web client
+  - type: textarea
+    id: log
+    attributes:
+      label: Console output
+      description: Errors from the console or logs/. Remove IP addresses and tokens first.
+      render: text

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security problem
+    url: https://github.com/perronosaurio/MCScript/security/advisories/new
+    about: Please report security problems privately.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,15 @@
+name: Feature request
+description: A command, plugin or setting you would like to see
+labels: [enhancement]
+body:
+  - type: textarea
+    id: idea
+    attributes:
+      label: What would you like?
+      description: If MCGalaxy or another server already does this, say how it works there.
+    validations:
+      required: true
+  - type: textarea
+    id: why
+    attributes:
+      label: Why is it useful?

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly

.github/pull_request_template.md

@@ -0,0 +1,7 @@
+## What does this change?
+
+## How did you test it?
+
+- [ ] `npm run lint` and `npm test` pass
+- [ ] Tried it in game (if it changes something players see)
+- [ ] Updated README.md, docs/ or CHANGELOG.md if needed

.github/workflows/main.yml

@@ -1,17 +1,24 @@
-on: push
-name: Publish Server
+name: CI
+on:
+  push:
+  pull_request:
+permissions:
+  contents: read
 jobs:
-  FTP-Deploy-Action:
-    name: FTP-Deploy-Action
+  test:
+    name: Lint and test (Node ${{ matrix.node }})
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [22, 24, 26]
     steps:
-    - uses: actions/checkout@v2.1.0
-      with:
-        fetch-depth: 2
-    - name: FTP-Deploy-Action
-      uses: SamKirkland/FTP-Deploy-Action@3.1.1
-      with:
-        ftp-server: sftp://boron.ca.eddyn.net:2422/
-        ftp-username: waxtz.256fede4
-        ftp-password: ${{ secrets.FTP_PASSWORD }}
-        git-ftp-args: --insecure
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - run: npm ci
+      - run: npm run lint
+      - run: npm test
+      - run: npm audit --audit-level=high

.github/workflows/release.yml

@@ -0,0 +1,36 @@
+name: Release
+on:
+  push:
+    tags: ['v*']
+permissions:
+  contents: write
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npm run lint
+      - run: npm test
+      - name: Check that package.json matches the tag
+        run: |
+          test "v$(node -p "require('./package.json').version")" = "$GITHUB_REF_NAME" \
+            || { echo "package.json says $(node -p "require('./package.json').version"), tag is $GITHUB_REF_NAME"; exit 1; }
+      - name: Build the archive
+        run: |
+          git archive --format=zip --prefix="MCScript-${GITHUB_REF_NAME}/" -o "MCScript-${GITHUB_REF_NAME}.zip" "$GITHUB_REF_NAME"
+          git archive --format=tar.gz --prefix="MCScript-${GITHUB_REF_NAME}/" -o "MCScript-${GITHUB_REF_NAME}.tar.gz" "$GITHUB_REF_NAME"
+      - name: Take the release notes from CHANGELOG.md
+        run: node scripts/release-notes.js "${GITHUB_REF_NAME#v}" > notes.md
+      - name: Publish the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          flags=""
+          case "$GITHUB_REF_NAME" in *-*) flags="--prerelease" ;; esac
+          gh release create "$GITHUB_REF_NAME" MCScript-*.zip MCScript-*.tar.gz \
+            --title "MCScript ${GITHUB_REF_NAME#v}" --notes-file notes.md $flags

.gitignore

@@ -1,64 +1,18 @@
-# Logs
-logs
-*.log
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-
-# Runtime data
-pids
-*.pid
-*.seed
-*.pid.lock
-
-# Directory for instrumented libs generated by jscoverage/JSCover
-lib-cov
-
-# Coverage directory used by tools like istanbul
-coverage
-
-# nyc test coverage
-.nyc_output
-
-# Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
-.grunt
-
-# Bower dependency directory (https://bower.io/)
-bower_components
-
-# node-waf configuration
-.lock-wscript
-
-# Compiled binary addons (https://nodejs.org/api/addons.html)
-build/Release
-
-# Dependency directories
 node_modules/
-jspm_packages/
-
-# TypeScript v1 declaration files
-typings/
-
-# Optional npm cache directory
-.npm
-
-# Optional eslint cache
-.eslintcache
-
-# Optional REPL history
-.node_repl_history
-
-# Output of 'npm pack'
-*.tgz
-
-# Yarn Integrity file
-.yarn-integrity
-
-# dotenv environment variables file
+npm-debug.log*
 .env
-
-# next.js build output
-.next
-levels/*.dat
-levels/level.dat
-*.dat
+*.tgz
+coverage/
+
+# created when the server runs
+config/
+data/
+logs/
+levels/
+plugins/.removed/
+
+# editors and OS files
+.vscode/
+.idea/
+.DS_Store
+Thumbs.db

CHANGELOG.md

@@ -0,0 +1,47 @@
+# Changelog
+
+## Unreleased
+
+## 2.0.0
+
+MCScript is back after seven years. The server was rewritten from scratch; none of the 1.x code (`src/`,
+`client.js`) is left, but an old `levels/level.dat` is still converted on the first start.
+
+### Added
+- Own Classic protocol 7 and CPE layer with 38 extensions, including BlockDefinitions, ExtendedBlocks,
+  ExtEntityPositions, CustomModels and CustomParticles.
+- The ClassiCube web client can connect on the same port.
+- Several levels loaded at once, ClassicWorld (`.cw`) files, MCGalaxy `.lvl` import and seven generators.
+- MCGalaxy style ranks, command and block permissions.
+- A plugin system with events, hot reloading and per-plugin config and data, plus `/pinstall`.
+- Bundled plugins: essentials, moderation, worlds, building, custom blocks, warps, zones, portals, bots,
+  physics, economy, minigames, effects, custom models, announcer, IRC and Discord relays, and a web panel.
+- Optional SQLite player database.
+- `/pdisable` and `/penable` (also on the web panel) turn bundled or installed plugins off and on, and the
+  choice is kept after a restart.
+- The web panel got a new look based on the ClassiCube forum.
+- The server checks GitHub for a newer release when it starts (`checkForUpdates`).
+
+### Changed
+- Needs Node.js 22.13 or newer. No runtime dependencies.
+- Settings moved to `config/server.json`, with `.env` overrides.
+- Licensed under the MIT License.
+
+### Fixed
+- Every player was treated as an operator.
+- `/kick` without a reason crashed the server.
+- The level was sent before the player was verified.
+- Entity ids overflowed after many logins.
+
+### Security
+- Player names and plugin data keys like `__proto__` can no longer pollute object prototypes.
+- Limit on connections per IP address (`maxConnectionsPerIp`), stricter WebSocket frame handling, and an
+  error in a packet handler now kicks that player instead of stopping the server.
+- Name verification now works on servers that are not public (the heartbeat still registers the salt).
+- `/pinstall` only downloads over HTTPS, caps the download size and validates npm package names.
+- New installs no longer make the original authors owners, and servers are not listed publicly until you
+  turn it on.
+
+## 1.0.1
+
+The original MCScript.

CONTRIBUTING.md

@@ -0,0 +1,43 @@
+# Contributing
+
+Bug reports, fixes and new plugins are welcome.
+
+## Setting up
+
+You need Node.js 22.13 or newer and git.
+
+```bash
+git clone https://github.com/perronosaurio/MCScript.git
+cd MCScript
+npm install
+npm test
+npm start
+```
+
+Join with the ClassiCube client at `127.0.0.1:25565` (local connections skip name verification).
+
+## Before opening a pull request
+
+- `npm run lint` passes. The project uses [JavaScript Standard Style](https://standardjs.com).
+- `npm test` passes, and new behavior comes with a test. Integration tests in `test/server.test.js` start a real
+  server with simulated clients, see `test/helpers/`.
+- If you changed packets or anything the client sees, try it with the real ClassiCube client as well.
+- Keep pull requests focused: one fix or feature each.
+- Update `README.md`, `docs/` and `CHANGELOG.md` when you change how something is used.
+
+## Code layout
+
+- `lib/` is the core: protocol, levels, players, commands and the plugin system. Changes here affect every
+  plugin, so be careful with the public API described in `docs/PLUGINS.md`.
+- `plugins/` holds the bundled plugins. Most new features belong here, not in `lib/`.
+- The server has no runtime dependencies and that should stay that way. If you need a library, write a plugin
+  that users install on their own.
+
+## Commit messages
+
+A short summary in the imperative ("Fix /undo for pasted blocks"), then a blank line and a longer explanation
+if it helps.
+
+## License
+
+By contributing you agree that your contribution is released under the [MIT License](LICENSE).

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2019-2026 perronosaurio (Waxtz) and MCScript contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.