CaYaDev Server Manager v0.3.1 — the tests now run against the app you download

A test-harness release. No change to how the app behaves — v0.3.0 is what you get, plus the confidence that it was actually checked.

What was wrong

MSMS has eleven smoke gates that run the app end to end. They had only ever been run against the development build. Nobody had run them against the packaged binary — the thing you download — and when I finally did while verifying v0.3.0, two of them failed. They had been failing since at least v0.2.5.

Neither was a fault in the app. Both were the tests reading files that only exist in the source repository:

• four checks read the TypeScript source itself, to assert things about the code rather than about a running process — that every declared IPC channel has a handler, that the bundled Bridge plugin jar matches what it was built from, that every route in the web router appears in the documented API surface
• one rewrites the checked-in openapi.json

A packaged app has none of that. It is compiled JavaScript in an archive, extracted to a temp folder with no src in it — so those checks crashed and took their whole gate down with them, after having already passed everything they could genuinely test.

Why nobody could see it

A packaged Windows app has no console attached. Every message the gates print went nowhere, so a packaged gate could only ever report a bare exit code — no assertion name, no reason, nothing to act on.

The gates now write their transcript to msms-data/logs/smoke.log as well. That one change turned an opaque 1 into the actual defect on the first run.

What is different now

• The transcript is readable in a packaged run.
• Source-derived checks skip when there is no source tree, and say so instead of crashing — and the guard is itself guarded: it refuses to skip when a source tree is present, and fails loudly if it is standing in the repository and the file it looks for has moved. A check that silently stops running is worse than one that fails.
• npm run gates and npm run gates:packaged run all eleven, against the dev build or the built binary, printing the transcript of anything that fails. Verifying the artifact is now a command rather than an intention.

v0.3.1  dev build         11/11 pass
        packaged binary   11/11 pass     (v0.3.0: 9/11)

If you are on v0.3.0

There is no functional reason to update — the app code is identical. Take it if you would rather run a build whose full gate set has been verified end to end.

Everything in the v0.3.0 notes still applies, including the one thing that needs a manual step: if you had a website configured before v0.3.0, set "Round to (blocks)" to 0 in Website settings to publish exact player positions. That value is saved in your config and was deliberately not rewritten.

Windows x64. The portable exe keeps all its data next to itself; the setup installs normally.

CaYaDev Server Manager v0.3.0 — the map, off the main thread and staying put

Everything in this release is the map. Four separate reports, four separate causes.

Players sat next to where they actually were — on the web only

Not a placement bug. The public site and the map page round player positions for privacy and the desktop app does not, so the same player was drawn up to 32 blocks from the house they were standing in. That default was set when the public map was dots on an empty grid, where half a chunk out was invisible; against real terrain it is indistinguishable from a bug, which is how it was reported.

Exact positions are now the default. Rounding stays available for operators who want it, and the setting says what it costs instead of calling itself "Round to (blocks)".

If you already have a website configured, this does not reach you. round: 64 is saved in your site.json, and it is impossible to tell apart from a value somebody chose on purpose — so nothing was rewritten. Set Round to (blocks) to 0 in Website settings.

Loaded ground disappeared when you looked away

The client baked a 16x16 canvas per chunk. A viewport is up to 4096 chunks, so two screens of ground meant thousands of canvas objects — and it was that object overhead, not the pixels, that forced the cache to stay small enough to lose the ground behind you.

One canvas per region holds the same pixels in a thousandth of the objects.

	before	after
ground held before anything is dropped	~2 million blocks	~12.6 million blocks
drawImage calls per frame	up to 4096	at most 9

That is also the answer to the web map getting slow once a lot was loaded: every redraw used to walk every held chunk and issue a draw call for each one. Areas you have loaded now stay for the session, and a region of nothing but unexplored ocean no longer takes a slot from ground you actually read.

The map read the world on the thread everything else uses

Parsing a region is about 1.4 seconds, and it was happening on the thread that answers the interface, serves the web panel and reads the server console. Slicing it up made that interruptible, not absent.

Regions are now parsed on worker threads — several at once, and the interface does not stop.

It waited until you looked before reading anything

Nothing was parsed until somebody opened the map, so the first look at a world was always the slow one: ~1.4 s a region against ~13 ms once cached, across four to nine regions.

MSMS now reads the world into its cache in the background, outward from spawn, when nothing else is waiting. It stands aside the moment you open the map, does nothing if you have turned the cache off, and stops when the cache is full rather than deleting the area around spawn to make room.

Together with v0.2.4 and v0.2.5

	two releases ago	now
one region, cold	14.0 s	1.4 s
four regions, as the map asks for them	38.3 s	~1.5 s, in parallel and off-thread
longest the interface can freeze	584 ms	0 ms — it is not on that thread
a region already cached	16 ms	13 ms

Your existing tile cache stays valid — the rendered output has not changed since v0.2.5.

Notes

• Zoomed a long way out the map still draws only what it holds rather than requesting tens of thousands of chunks. It now holds a great deal more. Proper downsampled zoom levels remain a separate piece of work.
• MSMS_NO_TILE_WORKERS=1 forces the old on-thread parsing if worker threads are a problem on your machine.

Verification. Every new check in this release was deliberately broken and watched to fail before being trusted — including the one that matters most here: a worker thread starts with an empty block-colour table, and a worker that parsed without it would have written wrong colours into your cache, where they would outlive the process. The worker refuses to parse without the table, its output is compared byte for byte against the main thread over every column of every chunk, and both halves fail the gate when removed. The packaged binary in this release was run through the smoke, and its worker threads were confirmed to start from inside the packaged archive rather than silently falling back.

Windows x64. The portable exe keeps all its data next to itself; the setup installs normally.

CaYaDev Server Manager v0.2.5 — the map, actually fast

The map was taking up to a minute to appear on a big world, and then losing what it had drawn the moment you panned away. Both are fixed, and both were measured rather than guessed at.

A region took 14 seconds, not 180 milliseconds (#157)

Every comment in the tile reader said a region cost about 180 ms. Measured against a realistic 4 MB region of 1024 fully-generated chunks:

inflate                    83 ms   0.6%
nbt.parseUncompressed     515 ms   3.7%
tileFromChunk           13305 ms  95.7%   <- nobody had measured this

The 180 ms was the decompress and the NBT parse. The surface extraction — the other 96% — had never been timed.

It was doing all per-name work per block position instead of per palette entry: a regex to strip the namespace, a lookup for air, a foliage check that ends in ten string comparisons, and a colour lookup with a second regex inside it. 4096 times per section, for a palette of at most a few dozen entries. Above the surface a chunk is about fifteen sections of pure air, and each one walked all 4096 positions to rediscover that air is air — roughly 53 000 string operations per chunk.

That is why it was worse on a big world and worse on a slower machine: both mean more generated regions, each costing 14 seconds, processed one at a time.

Now resolved once per palette entry, with an all-air section skipped before anything is unpacked or allocated. Index decoding also moved off arbitrary-precision arithmetic onto plain 32-bit integers, and only unpacks the layers the scan actually reads.

	before	after
one region, cold	13 962 ms	1 442 ms
four regions, as they are queued	38 348 ms	6 129 ms
longest the interface can freeze	584 ms	43 ms
a region already in the cache	16 ms	13 ms

Your existing tile cache stays valid. The rendered output is unchanged — verified by rendering 6144 chunks through both the old and the new code and comparing them byte for byte — so there is no re-parse after updating.

It threw away the ground you had just looked at (#159)

The desktop map kept the current viewport and deleted everything else, so panning one screen away deleted the screen you came from and panning back re-fetched all of it. The web map kept an 8-chunk margin, which only moved the edge. The cache limit was also smaller than a single viewport, so a wide view could evict tiles it had only just fetched.

Now nothing is dropped until the cache is genuinely full, and then the tiles farthest from where you are looking go first — what survives is a ring of the ground you have recently been over.

Two more things behind "it loads piece by piece":

• Requests were 64 chunks at a time, one at a time — 64 sequential round trips to fill one view. Now 512, so eight.
• It kept re-asking for chunks it was already waiting on. The view is walked in order, so the chunks still being read were always at the front of the next request; the map spun on one band while the rest stayed blank. Those now step aside and let the rest of the view load first.

Notes

• Zoomed a long way out the map still only draws what it already holds rather than requesting tens of thousands of chunks — but after this it holds far more than it used to. Proper downsampled zoom levels are a separate piece of work.
• Everything above ships behind the same map performance settings you already had; none of them changed meaning.

Verification: every new check in this release was deliberately broken first and watched to fail before being trusted — including a smoke gate that had been passing for months against a fixture with no terrain in it, and which fails at 661 ms on the previous release. Gates green by exit code across the spine, worlds, region-decoding, web, analysis and audit suites, and the packaged build in this release passes the full smoke.

Windows x64. The portable exe keeps all its data next to itself; the setup installs normally.

CaYaDev Server Manager v0.2.4 — the map loads once, then stays fast

A map performance release. The same world should not be parsed and transferred again for every page, tab, or visitor.

---

🗺️ Region files are read once per request

Map requests are now grouped by Minecraft .mca region before the cache is checked. A viewport that asks for dozens of chunks from the same region no longer performs repeated filesystem checks for every chunk.

On Windows, one 64-chunk request could previously hit the same region file more than a hundred times before useful parsing began. It now checks that region once and serves every requested chunk from the same cached entry.

⚙️ Duplicate region work is removed from the queue

The parser queue is now deduplicated by region rather than by individual chunk.

When the desktop app, control panel, public map, or multiple visitors request the same area together, MSMS starts one region parse and shares the result. The same .mca file is no longer queued repeatedly under different chunk coordinates.

🚀 Completed map responses are cached and compressed

Completed tile responses now include an ETag, allowing browsers to reuse unchanged map data instead of downloading the full JSON again. Large responses are also sent with gzip compression when the client supports it.

Responses that are still being prepared remain no-store, so a browser cannot get stuck with an incomplete map.

📦 Version metadata

The application and lockfile versions are now aligned at 0.2.4.

---

⚠️ Notes

• The first visit to a completely uncached region still depends on world size, disk speed, and the number of region files that must be parsed.
• The web panel does not provide HTTPS by itself. Do not expose it directly to the Internet.
• Windows may show a SmartScreen warning on first run depending on local reputation checks.

📦 Download

CaYaDev Server Manager-0.2.4-portable.exe — put it in the folder you want as your MSMS root. Everything it keeps lives in msms-data/ beside it.

CaYaDev Server Manager-0.2.4-setup.exe — the optional Windows installer for users who prefer an installed application.

Full changelog: v0.2.3...v0.2.4

CaYaDev Server Manager v0.2.3 — handlers that were never there, and a safer exit

A fix release. One of these means named roles have never worked.

---

🐛 Four IPC channels were never registered

Error invoking remote method 'rbac:list-roles':
No handler registered for 'rbac:list-roles'

rbac:list-roles, rbac:upsert-role, rbac:delete-role and web:user-roles were declared, exposed to the interface and called by it — and none of them had a handler. Every one has answered "no handler registered" since the day it was written, so named roles have never worked at all.

It stayed hidden because the panel loaded them in a chain that swallowed the error. Fixing that in v0.2.2 is what made this visible — which is the whole argument for showing errors instead of eating them.

There is now a test for the class: every channel the interface can call must have a handler. It found a second one nobody had reported.

🛑 MSMS no longer closes while a server is running

It refuses, names the servers that are up, and asks.

Confirmed, it stops them the way you would: the configured countdown is broadcast to players and the world gets time to save. Before, quitting killed every server instantly — no countdown, no warning, no chance to say no. Anything still up after 45 seconds is killed rather than left orphaned holding the world files.

📖 API keys: where to read more

The key panel now links to the route reference this install serves itself — so it always matches the version you are running — and to the repository for the written documentation and the source. On both the desktop app and the web panel.

📄 README

Brought up to date: the new shutdown behaviour, touch support on the map, named roles, and the map page taking your website's colours.

---

⚠️ Notes

• The web panel does not provide HTTPS by itself. Do not expose it directly to the Internet.
• The portable .exe is unsigned; Windows SmartScreen will warn on first run.

📦 Download

CaYaDev Server Manager-0.2.3-portable.exe — put it in the folder you want as your MSMS root. Everything it keeps lives in msms-data/ beside it.

Full changelog: v0.2.2...v0.2.3

CaYaDev Server Manager v0.2.2 — the map page draws again

A fix release. One of these stopped the map page working at all.

---

🐛 The map page threw as soon as structures were on

Uncaught (in promise) ReferenceError: MAP_ICONS is not defined
    at mapDraw

The map page is the fourth surface using the shared map engine, and it was given only half of what that engine asks for. With structures enabled, the draw threw and took everything after it down with it — so the map simply stopped updating, on the page whose only purpose is the map.

It shipped because the automated tests ran the panel's page script and the website's, and never this one. They run all three now, with every layer switched on.

📍 The coordinate readout was hidden behind the legend

Three things were pinned to the same bottom-left corner — the legend, the structure key and the mouse coordinates — and drew on top of each other. They now stack, at offsets measured from their real heights rather than guessed, because each of them wraps at some width.

🎨 The map page uses your website's colours

It had its own hardcoded palette. If you picked an accent for your site, the map page was a different red — which reads as somebody else's product. It now takes accent, bg, card and text from the same theme.

🔑 Created API keys are listed again

The desktop panel loaded status, users, roles and keys as one chain with the keys last, and swallowed any failure. Anything going wrong earlier left the key list empty with nothing said.

"I made a key and it isn't listed" was not a problem with keys — it was a problem with being fourth in a queue that could stop.

The four now load independently, and a failure is reported instead of hidden.

---

⚠️ Notes

• The web panel does not provide HTTPS by itself. Do not expose it directly to the Internet.
• The portable .exe is unsigned; Windows SmartScreen will warn on first run.

📦 Download

CaYaDev Server Manager-0.2.2-portable.exe — put it in the folder you want as your MSMS root. Everything it keeps lives in msms-data/ beside it.

Full changelog: v0.2.1...v0.2.2

CaYaDev Server Manager v0.2.1 — the map, on a phone and without the stutter

A fix release for four things reported against v0.2.0, all of them about using the map on a phone or while doing something else.

---

📱 The map works with a finger now

It had mouse handlers only. On a phone it could not be moved at all, and there was no zoom whatsoever — while the hint under it read "Drag to pan · wheel to zoom" on the one device that can do neither.

• One finger pans, two pinch. On the public site, the map page and the desktop app.
• A tap shows an area's note, which is the only way to read one without a hover.
• The hint now says pinch on a touch device and wheel on a mouse.

Both halves were needed and only one is JavaScript: without touch-action: none on the canvas the browser claims the gesture as a page scroll before the listener runs, and preventDefault has nothing left to prevent.

⚡ The app no longer freezes while the map loads

Measured rather than guessed, and it was not the drawing. A region file is 1024 chunks — a decompress plus an NBT parse each — and the loop ran to completion in one synchronous block on the thread that answers every IPC call and reads the server console.

	before	after
total parse	132 ms	132 ms
longest uninterrupted block	132 ms	14 ms

The work is the same; it is now interruptible. The console keeps reading and the interface keeps responding while a region is parsed.

🏷️ Two things moved to where they belong

• The area note appeared in the bottom-right corner. On a fullscreen map that is nowhere near the area it describes, and on a phone it sat under the thumb that had just opened it. It now appears at the pointer, clamped so it cannot hang off the edge.
• The "nothing generated here" warning on the map page was hidden underneath the floating control bar. It now sits below it, at an offset measured from the bar's real height — the bar wraps, so any constant would be wrong at some width.

📐 Public site on a phone

Headings stack instead of fighting their notes for one row, side padding is no longer a tenth of the screen, and the map's control bar is one scrolling row instead of three that pushed the map itself off the screen.

---

⚠️ Notes

• The web panel does not provide HTTPS by itself. Do not expose it directly to the Internet.
• The portable .exe is unsigned; Windows SmartScreen will warn on first run.

📦 Download

CaYaDev Server Manager-0.2.1-portable.exe — put it in the folder you want as your MSMS root. Everything it keeps lives in msms-data/ beside it.

Full changelog: v0.2.0...v0.2.1

CaYaDev Server Manager v0.2.0 — four surfaces, one map

The whole of MSMS runs now. v0.1.0 was a desktop manager with a web panel marked beta; v0.2.0 is four surfaces — the desktop app, an admin web panel, a public website with a store, and a page that is nothing but a fullscreen live map — that all draw the same world and share the same rules.

101 commits since v0.1.0.

---

🗺️ The map became a map

v0.1.0 drew dots on a grid. This release renders the server's own region files.

• Real terrain, read from the .mca files the server already writes. MSMS never generates world — a map that could grow a world by being panned would be a map that can fill a disk.
• Drag to pan, wheel to zoom, anchored on the cursor, on every surface.
• Nether and End, which needed a different technique: the nether has a bedrock roof, so the scan works down from under it.
• Structures — villages, dungeons, temples, fortresses, mineshafts — with SVG glyphs and a per-kind filter, off by default because where the loot is turns a public map into a treasure map.
• Tiles cached on disk, re-parsed only when the server rewrites a region. Measured: ~180 ms to parse a region, ~1 ms to read one back.
• Performance is an operator setting — cache, regions in memory, delay between parses, cache ceiling, and whether panning keeps loading.
• One map engine in all four places. Three had drifted apart; they were unified and are now held together by a cross-check that fails if they ever disagree.

🎨 Named chunk areas

Mark a region by chunk, give it a colour, a name and a note — bu alan sahibi: CaYatur. Hovering or clicking shows them, on every surface.

Created by selecting chunks on the map, by typing coordinates (10,20 or 30,40 - 32,42), or over the API. Where two areas overlap the smallest wins, so a plot inside a town reads as the plot.

🖥️ A third page: the fullscreen map

Its own listener and port — which is the point: you can hand the map to people who must not reach the shop or the panel, with a firewall rule rather than with trust.

Access is open, a shared passphrase, or signed-in players only, and the gate refuses the data rather than just the page. Eleven settings control what it may show, every one enforced server-side.

🌍 Public website, store and economy — out of beta

• Player accounts verified in game, so it works on an offline-mode server too.
• Profiles with per-field publishing controls.
• A server currency, balances and a full ledger.
• Products, crates with published odds, stock and per-player limits enforced atomically.
• In-game delivery that queues while a player is offline.
• Password reset, and the cracked-server problem it exposes, handled deliberately.
• Mobile-friendly.

🔌 REST API at /api/v1

Versioned routes, an OpenAPI document, a human-readable reference the app serves itself, and live WebSocket streams.

API keys are scoped per server, shown once, and now come with ready-to-paste curl, JavaScript and Python samples built against your own install's address. A key can be disabled — reversibly, unlike revoking — from the list.

The reference documented the body field for revoke, disable and delete as id. The server has always read keyId. Anyone following it exactly got a 404 from revoke and a 200 from a delete that deleted nothing. Fixed, and the test now takes the field name from the route table so a lying document cannot sit beside a passing test.

🧱 Item icons and block colours from Mojang's own client jar

No more third-party CDN in the middle of a private server's inventory, and it works with no internet at all.

Measured on 1.21.4: a 27 MB download, sha1 verified, of which 644 item and 1039 block textures are kept — 0.4 MB on disk. One download per Minecraft version, behind a button.

🌉 MSMS Bridge

The plugin exists, installs itself from GitHub Releases on your approval, and reports through the plugin logger rather than System.out — so Paper stops nagging about it.

---

📸 Screenshots

The README now has them, and they are taken by the app of itself against throwaway demo servers, so they can be retaken after a redesign instead of quietly going stale.

⚠️ Notes

• The web panel does not provide HTTPS by itself. Do not expose it directly to the Internet — put it behind a reverse proxy that terminates TLS, or reach it over a VPN.
• The Bridge plugin is the youngest part of MSMS. It has had far less time in live servers than the desktop core.
• The portable .exe is unsigned; Windows SmartScreen will warn on first run.

📦 Download

CaYaDev Server Manager-0.2.0-portable.exe — put it in the folder you want as your MSMS root. Everything it keeps lives in msms-data/ beside it.

CaYaDev Server Manager v0.1.0

CaYaDev Server Manager v0.1.0 — first release. Portable, bilingual (EN/TR) desktop control panel for Minecraft servers.

Downloads

• ...-portable.exe — single-file portable; stores all data next to itself (recommended).
• ...-setup.exe — installer (NSIS).

Windows x64. Requires a JDK on your machine (Java 17+ for modern Minecraft). Unsigned build — Windows SmartScreen may warn ("More info → Run anyway").

Highlights

• Create servers with live versions: Vanilla, Paper, Folia, Purpur, Fabric, Forge, NeoForge, Mohist, Velocity — hash-verified downloads, EULA consent.
• Run & control: start/stop/restart/kill, live console, Aikar's-flags presets + custom args, graceful shutdown with a localized player countdown + kick.
• RCON: auto-enabled, live TPS (Paper), player list, world controls (time/weather/difficulty/save).
• Players: card grid with head avatars, detail panel (OP/whitelist/ban/kick/gamemode, position/health/XP/playtime/IP) and an inventory viewer (item icons from an online source).
• Editors: typed server.properties editor + syntax-highlighted file editor (tabs + split).
• Plugins/Mods (local + Modrinth), Backups (any drive) + restore, Scheduler (cron), Crash analyzer, live CPU/RAM/TPS stats.
• Web panel (beta): mobile-friendly browser panel with bearer-token auth and per-server permissions so friends get scoped access.
• Store/economy (beta): currency, items + animated crates, in-game delivery (queued if offline), player balances.

⚠️ Security note

The web panel is off by default and binds to 127.0.0.1. LAN/mobile access is an explicit opt-in and has no HTTPS — passwords cross your local network in cleartext. Only enable on a trusted network.

Verification

Verified end-to-end against a real Paper server (start → RCON → TPS → graceful stop) and via headless smoke tests: all UI views, file editor, properties/files/backups/scheduler/crash, web-panel RBAC (401/403 denials), store double-spend prevention, and inventory NBT parsing. The packaged build was smoke-tested.

Not yet included

A visual website/CMS design editor + posts is planned; this release ships the store/economy core. Forge/NeoForge use their official --installServer; Spigot isn't one-click (needs BuildTools).