v1.1.0 — M4 complete

NexusCore Administration Framework 1.1.0 · Minecraft 1.21.1 · Java 21 · NeoForge, Fabric and Forge

The M4-complete release. It rolls builds 1.0.1 through 1.0.5 into one artifact and verifies them together on all three loaders.

Server-side only — players join with a completely unmodified vanilla client, admin panel included.

🔒 Security

Four security defects are closed in this version. If you are running v1.0.0, upgrade — it is unsupported.

• /execute as <player> no longer borrows that player's NexusCore permissions. A vanilla level-2 operator could previously act with another player's permissions, with the audit naming the impersonated player as the actor. A substituted command source is now refused, and both the audit actor and the rate-limit subject resolve to the real issuer.
• Two confused-deputy paths are closed by the same fix. A run_command click event on a sign, or in a written book on a lectern, built a command source at permission level 2 with the clicking player as the entity — so a crafted sign could make a privileged player unwittingly run an administrative command in their own name.
• Two permission values failed open. They now fail closed.
• Any non-player command source was granted root (carried from 1.0.1). /execute as @e[…] run nexus … ran with full privileges, and operatorBootstrap=false constrained nobody.

Fixed

• /teleport genuinely exists again. For two builds it had been deleted rather than replaced, so every command block, datapack function and /execute run teleport using the canonical name failed — while the log claimed NexusCore had taken it over.
• permissions.json is genuinely re-read. Hand edits used to be ignored and silently overwritten by the next permission change, while /nexus reload reported success. The reload now reports the group count it actually loaded.
• Safe mode no longer leaves you unable to kick a griefer. It had been deleting vanilla's /kick, /ban, /banlist, /pardon and /list and installing nodes that then refused. Vanilla's nodes now stay in place in safe mode.
• The admin panel opens in safe mode instead of refusing, degrading with a barrier tile that names the unstarted module.
• A failure inside a panel button can no longer escape into vanilla's container handling. Clicks run guarded: logged with a correlation id, container closed, and the player gets the reference.
• /nexus reload no longer throws in safe mode and half-applies settings.
• /nexus help no longer claims vanilla's commands as NexusCore's, and the vanilla takeover is no longer silently gated on registerAliases.

Added

• Safe mode — start with -Dnexuscore.safemode=true to run core modules only, for recovering a server you cannot otherwise start. Deliberately a system property and not a config key, because a bad config.json is one of the things safe mode exists to recover from.
• The command reference is generated from the code (50 commands, 48 permission nodes), and /nexus help renders from the same descriptors, so the two cannot disagree.

Upgrading from v1.0.0

Replace the jar and restart. Existing servers need one operator action, because 1.0.1 closed a
defect where nobody below admin could confirm a destructive action:

/nexus permission group add default nexuscore.command.core.confirm

Without it a moderator can open a permanent ban and never complete it.

Verified

214 automated tests, 0 failures, 0 errors, 0 skipped. Eight runtime runs — normal and safe mode on each of NeoForge 21.1.235, Fabric and MinecraftForge 52.1.16 — with zero NexusCore errors, the audit chain intact after every run, and a clean shutdown. A real player exercised most of the feature set on a real dedicated server, including the admin panel rendering to an unmodified vanilla client.

All three jars are reproducible — byte-identical whether built locally or by CI from a bare checkout.

⚠️ Known issues in this version

NexusCore publishes its unfixed defects rather than hiding them. This is every High and Medium defect in the project's own list, not a selection — the remaining 13 are Low and are in IMPLEMENTATION_STATUS.md. Read these before you rely on it:

• /seen <unknown name> can stall the server. IdentityService.resolve() falls back to a blocking Mojang HTTP lookup on the server thread, so a slow or unreachable Mojang API stalls the whole server for as long as the request takes. Reachable by any ordinary player. First item scheduled for 1.1.1.
• Vanish misbehaves for onlookers. Four related faults that appear only on another player's client: chat renders as a validation error, un-vanishing does not restore the entity for clients that saw it vanish, vanish is not re-applied to players who join later, and the vanished set survives death while the invisibility flag does not.
• A second ban or mute does not deactivate the first. /unban lifts one and reports success while the player stays banned; active counts double-count, and the strictest record is not the one returned.
• audit.log never rotates. It is read fully into heap and SHA-256'd on the server thread at startup, at shutdown, and on every verify and tail — unbounded growth plus a synchronous full read.
• A transient read error can quarantine an intact permissions.json. JsonStore.read() quarantines on any IOException, so a one-off read failure moves a healthy file aside and the next boot starts from defaults.
• config.json silently loses operator keys. Loading rewrites the file from the typed object, deleting any key the schema does not know, while reporting no problems found.
• players.json is rewritten in full on every login and logout. Never pruned, and each write copies a full .bak and fsyncs twice.
• Fabric death messages lose their cause. Every styled death reads <Player> died — on Fabric only.
• /pardon and /banlist strand vanilla ban state. Pre-takeover vanilla bans become un-liftable, and /ban-ip and /pardon-ip are separate commands NexusCore never takes over, so IP bans are neither audited nor listed.
• Only one player has ever been online at a time during testing. Everything that needs a second player is unverified — including the four vanish faults above, which appear only on another player's client.

The authoritative list of every confirmed defect is IMPLEMENTATION_STATUS.md.

Not built, and not promised: economy, chat channels, jail and reports, scheduler, backups, the benchmark harness, and the custom-screen client GUI.

v1.0.0 — first release (unsupported)

First release — NeoForge, Fabric and Forge, all three at once, for Minecraft Java Edition 1.21.1.

Server-side only. Players join with a completely unmodified vanilla client, admin panel included.

What shipped

• Permissions — groups, multiple inheritance, wildcards and explicit denies, plus a check command that explains its answer instead of returning a bare yes or no.
• Moderation — kick, ban, tempban, unban, mute, unmute, warn, warnings, banlist. Punishments are never deleted; lifting one stamps who and when.
• Ban screens — full-screen and styled, with a live countdown and a configurable appeal line.
• Teleportation — homes, warps, spawn, /back (including back to where you died), /tpa and staff /tp, with real destination-safety checks that refuse with a reason instead of dropping you somewhere close enough.
• Player tools — heal, feed, fly, god, speed, vanish, playerinfo, seen, list, near.
• Audit log — append-only, SHA-256 hash-chained and tamper-evident, with IPs, passwords and tokens redacted as they are written.
• Admin panel — a vanilla chest menu: dashboard, paginated player list, per-player actions, moderation and permission overviews, server diagnostics. Permission is re-checked on every click.
• Vanilla command takeover — NexusCore owns the commands it replaces, so the command you already type gains a duration, a reason, history and an audit record. Set overrideVanillaCommands=false to opt out.
• Styled death messages on all three loaders, and every message rewordable via messages.json.

Stated as unproven at release

No real player had joined a server yet, so the admin panel, vanish, chat muting and ban-at-login were wired but unobserved. 178 automated tests, 0 failures.

---

⛔ This version is unsupported — do not deploy it

v1.0.0 has two confirmed critical defects and is marked unsupported in SECURITY.md.

• /teleport bypassed NexusCore completely. Vanilla registers teleport as the real command and tp as a redirect to it; only tp was taken over, so /teleport ran as pure vanilla with no permission check, no rate limit and no audit record.
• Any non-player command source was granted root. /execute as @e[…] run nexus … ran with full privileges, and operatorBootstrap=false constrained nobody.

Both are fixed in v1.1.0. It is published here and on Modrinth — upgrade to it.

This release is kept published only so the archive is complete and a bug report can be reproduced against the exact bytes.