Allay Server 6.7.0

For Allay 6.5, which registers its server; older plugins show up by their id, as before.

• 🏷️ Servers have names. PUT /api/v2/server registers a server at the plugin's start with the name its owner set (server.name), its MOTD, address, and versions. A name belongs to one server on the backend: another tenant's server gets 409 NAME_TAKEN, and a server of the same tenant takes the name over, as after a reinstall. A server without a name shows its random id.
• 🪧 Headings read like a server list. The Servers page, the licenses, and a license's page head each server with its name, then its domain or IP past a middle dot, and its MOTD a line below in smaller type. Registered servers show before their first question, and the Servers page's last column says when each was last seen.

docker pull ghcr.io/allay-ai/server:6.7.0

Allay Server 6.6.0

• 🌐 Servers show where they are. The Servers page and a license's page show each server's join address and game port (from Allay 6.4's server.address), the game software and version, the plugin's version, and when it first asked. Admins also see the address each server connects from, marked internal when it shares a private network with the backend. A server on a license shows the license's name. Kept 400 days after the server's last question.

docker pull ghcr.io/allay-ai/server:6.6.0

Allay Server 6.5.0

For Allay 6.3, which adds the full privacy switch; older plugins work as before.

• 🕶️ Full privacy. A question with player.private keeps the player's name, UUID, and face out of the admin panel, and forgets what the panel had; PUT /api/v2/users/{id}/privacy with { "full": true } does it at once when the player flips the switch. Memories, the session, and traces work as before.
• 🙂 Steve for the unknown. Players the panel can't name (before 6.4, or with full privacy on) show Steve's head instead of a blank figure.

docker pull ghcr.io/allay-ai/server:6.5.0

Allay Server 6.4.0

• 🏷️ The panel names players. Each question from the plugin notes the player's name, UUID, and operator status per server in a directory, so the Players page, runs, the dashboard, and a player's page show names instead of pseudonyms. Players from before 6.4 keep their pseudonym until their next question. A rename shows everywhere at once, and an erasure takes the name off every run. The directory lives 400 days after a player's last question, a player's export includes their name, and the audit log still keeps pseudonyms only.
• 🙂 Faces. The Players page opens with a “Skin” column, and names carry the player's head in runs, the dashboard, and the erase picker. The backend fetches heads from mc-heads.net (by UUID, or by name on offline-mode servers) and caches them for 6 hours, so the panel's CSP stays 'self' and the viewer's browser never calls a third party.
• 🔎 Find and erase by name. The Players search takes a name's start, a UUID, or a pseudonym. “Erase a player” picks the player from a drop-down of that server's players, with face and UUID, and still takes a UUID or a pseudonym typed in; a name typed in whole works too, unless two players on the server shared it.
• 📊 More numbers. The Players table adds servers, errors, tokens, average answer time, and the first question. A player's page shows their name, UUID, pseudonym, operator status, and servers, eight tiles (questions, cost, error rate, typical and slowest time, tokens, tool calls, cancellations), questions by day and by hour, and their kinds of runs, models, and tools. A run's page adds the player's UUID, the license's name, the payment, web searches, spans in its trace, the error code, time per step, cost per 1000 tokens, and output speed; the runs table shows tokens and tool calls.
• 📈 More charts. The dashboard adds failed and cancelled questions stacked, tokens read and written, the typical answer time, the cost of a question, web searches, and the busiest players of the period.
• 🗑️ Delete a license. A license nobody paid for, or one refunded, deletes after one confirmation, with its budget windows; its payments stay as the record of money that moved. A paid license without a refund sends you to “Refund and revoke” first. An owner may delete it anyway after a warning about the payer's rights and a second agreement, and the audit log records the unrefunded Stars. DELETE /api/admin/licenses/{id} answers 409 PAID without { "force": true }, and 403 for a forced delete by anyone but an owner.
• 🪪 Name players from before 6.4. migrate players <name>=<uuid> … inside the container fills the directory for players who haven't asked since: their runs give the servers and the first and last question. A UUID without runs changes nothing, and a name from a newer question stays.
• 🔬 Every run traced by default. TRACE_SAMPLE defaults to 1 on hosted backends too, so the Traces page fills from the first question. A value saved in the panel or set in the environment still wins.

docker pull ghcr.io/allay-ai/server:6.4.0

Allay Server 6.3.0

• 💸 Refund a license and revoke it. “Refund and revoke” on a license's page in the panel returns every payment that isn't refunded yet through the bot, stops the subscription, and tells the payer in their language. The license is revoked for good: its key answers LICENSE_INVALID, its claim code and invoices stop working, and the bot leaves it out of /status, so the server takes a new license with /allay link and pays again or uses its own key. When Telegram refuses one payment, the license stays and a second try returns the rest. Telegram refunds only whole payments, so a refund is always full.
• 🔓 Unblock unblocks. On MongoDB, unblocking a license and resuming renewal in the bot left the old date behind, so a blocked license stayed blocked. Clearing a field now removes it.

docker pull ghcr.io/allay-ai/server:6.3.0

Allay Server 6.2.1

• 🧹 Erase a player by pseudonym. “Erase a player” takes the pseudonym from the list as well as a UUID, so an admin who never saw the player's id can still erase them. A player nothing on the server names (no consent, no memories) loses what's left of them, their runs' ties and traces, instead of the button staying grey.

docker pull ghcr.io/allay-ai/server:6.2.1

Allay Server 6.2.0

For Allay 6.2, which tells a blocked player why; older plugins show a general error.

• 🚫 Block a player. An admin blocks a player on one server from their page in the panel, and Allay stops answering them there with PLAYER_BLOCKED (403) until someone unblocks them. Bans are kept by pseudonym, never by id, and outlive an erasure; “Blocked players” on the Players page lists them, erased players too.
• 🧹 Clear a player's session, or erase them, from their page. The backend finds who a pseudonym is among the players who agreed to the notice or have memories there; the panel still never sees the id. Erasing by id stays for players who send theirs.
• 🎛️ The panel reads easier. “Erase a player” picks the server from a list and lines its fields up; a license's long name glides back and forth instead of being cut, in the list and on its page; Active is green, Expired amber, Blocked red; the theme menu fits “System”.
• 🗂️ A player's export says whether they're blocked there.

docker pull ghcr.io/allay-ai/server:6.2.0

Allay Server 6.1.1

• 🌐 Buttons speak the answer's language. An English question got an English answer with Russian buttons under it: the tools asked for labels “in the player's language”, which the model read as the game locale, and the prompt's examples are Russian. Now labels, button questions, mark titles, and task names follow the language of the answer, and the prompt says its Russian examples show the form only.

docker pull ghcr.io/allay-ai/server:6.1.1

Allay Server 6.1.0

For Allay 6.1, which asks each player before their first question; older plugins work as before.

• ✅ Players' consent is kept. GET, PUT, and DELETE /api/v2/users/{id}/consent read, record, and withdraw a player's agreement to the plugin's notice: which version they agreed to and when, per tenant and player like everything else. It stays until the player withdraws it or their data is erased, as proof of the agreement (GDPR art. 7(1)).
• 🗂️ Export, erasure, and moves know it. A player's export carries consent, an erasure removes it, and migrate retag moves it with the memories.

docker pull ghcr.io/allay-ai/server:6.1.0

Allay Server 6.0.0

For Allay 6.0, which sends the credentials this version wants. Breaking: Allay 5.x gets 401 from this backend; update the plugin first, then the backend. A self-hosted backend needs PLUGIN_TOKEN in its environment and the same value in the plugin's server.token.

• 🔐 Every request says who sends it. A hosted backend wants the server's license on every plugin request, a self-hosted one its new PLUGIN_TOKEN (24 characters or more, compared in constant time). Without one configured, a self-hosted backend answers no plugin instead of everyone. Only health, license creation, and Telegram's webhook stay open; a test walks the route table to keep it so.
• 🧱 Servers never see each other's players. Memories, sessions, task threads, task outcomes, and the public thread are kept per tenant (license:<id> or self) and player. Before, anyone who knew a player's UUID could read, add to, or wipe their memories through /api/v2/users, or send their user_id to /api/v2/chat and have the agent read out their memories and session; another server's public thread opened to anyone who sent its server.id.
• 🔑 BYOK needs a license as identity. It's free from POST /api/v2/license and pays for nothing. Limits count per license instead of the server.id a request claimed, all BYOK servers together take at most BYOK_ACTIVE_RUNS (100) slots so paying servers keep theirs, and a blocked license can't ask with its own key either.
• 🧰 Tool results only from the run's own server. POST /api/v2/chat/{run}/tools/{call} wants the same credentials as the question; another tenant's answer gets 404.
• 🚪 /allay init only for the backend's own plugin. POST /api/v2/admin/init wants PLUGIN_TOKEN: its recovery code resets any admin's password, and before anyone who reached the backend could ask for one.
• 🌐 Client addresses come only from trusted proxies. New settings TRUSTED_PROXIES and CLIENT_IP_HEADER: forwarding headers count only when the peer is a proxy the operator named, X-Forwarded-For is read from the right, and an IPv6 /64 counts as one address. Behind a proxy, license creation and the panel's sign-in limits no longer share one bucket, and nobody can spoof their way around them. Moonlands-style setups set TRUSTED_PROXIES to their proxy's address.
• 🕵️ Players are pseudonyms in the statistics. Runs keep a keyed digest of the player instead of their UUID and name; the panel lists and searches players by it, and finds one from a UUID an operator types. The digest's key comes from SECRETS_KEY.
• 🗑️ Export and erasure per player (GDPR). GET /api/v2/users/{id} returns everything kept about a player, DELETE erases it: memories, sessions, outcomes, agents' threads, and their traces go, runs keep only numbers. Admins erase a player from the Players page by server and UUID; the audit log keeps only the pseudonym.
• ⏳ Data doesn't stay forever. Memories go 365 days after a player's last question, audit entries after 365 days, and days older than 400 keep how many players they had, not who.
• 🧹 Less in logs and answers. Logs carry run ids and tenants, never player names, ids, or questions; errors from inside the backend reach the client as a code without the details; /api/health no longer shows the process's memory and uptime; API answers carry nosniff, DENY framing, and no-referrer; bodies are capped at 2 MB.
• 🛡️ BYOK requests can't be bounced inside. Every request to a server's own provider checks its address again and refuses redirects; NAT64, 6to4, and benchmark ranges count as private too.
• 👀 Viewers no longer see who paid. Telegram ids of payers show to admins and owners only.
• 🐳 The stock docker-compose.yaml publishes only the backend, on 127.0.0.1. MongoDB and Redis have no ports and want their passwords (MONGO_INITDB_ROOT_*, REDIS_PASSWORD); MONGODB_URI carries the user with ?authSource=admin.
• 🚚 Data moves on its own. On start, memories get their tenant (self on a self-hosted backend), runs lose players' ids and names, and sessions from before 6.0, which carry no tenant, are dropped. bun run dist/application/migrate.js retag --from self --to license:<id> moves an imported self-hosted dump to a license; status and purge-untagged help around it.

docker pull ghcr.io/allay-ai/server:6.0.0