Skip to content

Kronos v0.2.0-alpha

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Aug 11:32
· 104 commits to main since this release
v0.2.0-alpha
2a140d9

Kronos v0.2.0-alpha — the platform release.

v0.1.0-alpha was an engine you could run. This is a platform: a real client, a real backend, real accounts, and a real way to publish to it.

Kronos Client — a proper launcher

A complete visual rebuild around a fixed shell: a left sidebar (Home / Discover / Avatar / Create / Directory / Settings), a top bar with search and profile, and a brand panel — all in a strict dark theme (charcoal #191B1D, slate #232527, sky blue #4EA8DE, action green #00B259).

  • Discover — the live catalogue, browsable signed-out, loading in 200-item batches with infinite scroll and local caching
  • Avatar — an interactive orbit/zoom 3D preview beside the item controls
  • Create — local projects plus one-click Launch Kronos Studio
  • Directory — every account with live presence and status colours
  • Friends — carousel with presence badges and direct-join

Sign in without ever typing a password into the client

The launcher has no credential fields at all. The one entry point opens your system browser, and the session comes back over a loopback callback with CSRF state that fails closed. A password that never enters the client process cannot be captured from it. Play as Guest needs no email.

Backend service

Node/Express + PostgreSQL + Redis, with 66 tests running against real databases — nothing mocked.

  • Accounts, sessions, password reset, email confirmation
  • Google ID tokens verified against Google's JWKS — RS256 pinned, issuer/audience/expiry checked
  • Friends graph, user search, account directory, live presence (offline / launcher / in studio / in game)
  • Server allocation with signed join tickets
  • Guest accounts, bans, appeals, and 30-day username recycling
  • One-click publish from Studio straight into the public catalogue

Multiplayer joins are actually enforced

Allocation now issues a signed join ticket that travels in the handshake, and the game server validates it against the backend before admitting anyone. Connecting directly to a server's address no longer gets you in.

Luau sandbox hardening

Security identities (UserScript / CoreScript / StudioPlugin), fixed at VM creation and unreachable from Lua. getfenv/setfenv/newproxy removed. A VFS-backed require() with no filesystem access. 38 adversarial tests, including the first real coverage proving the execution watchdog and memory ceiling actually stop a runaway script.

Animation & cinematics

Two-bone and FABRIK inverse kinematics with pole targets and exact bone-length preservation, plus physical camera parameters (focal length, f-stop, sensor size, ISO, shutter) driving depth of field through real thin-lens maths.

Ship-ready deployment

docker-compose.prod.yml with automatic Let's Encrypt TLS via Caddy, health-checked Postgres, persistent Redis, and one-shot migrations. Plus a fly.toml alternative and a bootstrap installer.

Fixes worth calling out

The previously published archive could not function: it shipped binaries but no assets/ or games/, so the font atlas was missing and the client started with no HUD, no animations and nothing to play. Also fixed this release:

  • Windows builds shipped no DLLs — every binary failed to start
  • Browser sign-in hung forever if the browser pre-connected before redirecting
  • Closing the sign-in tab mid-response could kill the launcher
  • Guest sign-in crashed the client on a null email
  • A failed avatar spawn crashed the entire server, dropping everyone
  • The same bug client-side was worse: release builds compile the assertion out, making it silent memory corruption

Packaging now hard-fails rather than publishing an archive that cannot run.

Downloads

kronos-v0.2.0-alpha-linux-x64.tar.gz · kronos-v0.2.0-alpha-windows-x64.zip

Each ships with a .sha256. Extract and run engine_runtime.

Alpha, and honestly so. The backend defaults to localhost:8080 — point it elsewhere with a config.json beside the executable or KRONOS_API_URL. The Windows build has not yet been run on real Windows hardware.

Assets 6
Loading