v2.0.0

v2.0.0 — 2026-01-21

Breaking changes

• Grant validation now requires action binding: _validateGrant(reqId, action) on all client handlers.
• Capabilities are only served while the menu is open (menu open window controlled by cqadmin_cap_open_window_ms).
• Server defaults now rely on server/_ctx.lua for shared helpers (no repeated locals).

ImGui / UI

• ImGui is compiled to WASM and shipped only as html/imgui.js and html/imgui.wasm.
• imgui/ source is now dev‑only (excluded from git and CI releases).
• ImGui license included (IMGUI_LICENSE.txt).
• UI: description text wraps on a new line with distinct color styling.
• UI: size adjustments now use CSS rather than scaling to avoid blur.

Security & hardening

• Action‑bound grants enforced server‑side and client‑side to prevent cross‑action replay.
• Per‑action cooldowns added for sensitive actions (spawn/delete/weapon).
• Grant capacity guardrails and handshake throttles retained and hardened.
• Open menu grant required before menu opens (client‑side validation).

Audit logging

• Full audit logging for grants, acknowledgements, action use, throttles, denies, and capability requests.
• Discord webhook batching every 30s (configurable).
• Severity levels: info / warn / error.
• Log formatting supports Discord timestamps.

Vehicle logic

• Vehicle feature/modification data now reads from the player’s current vehicle.
• Vehicle options disable when not in a vehicle; auto refresh + reload support.

Client & NUI fixes

• Fixed NUI fetch double‑read errors.
• Mouse/free control behavior stabilized.
• Misc input/drag edge cases addressed.

CI/CD

• GitHub Actions release pipeline packages a clean runtime zip.
• Release zip name: cq-admin-<version>.zip with cq-admin/ folder inside.
• Release notes auto‑generated on tag publish.

Configuration additions

• New convars for logging, capability gating, and per‑action cooldowns.
• README expanded with security notes, config examples, and CI/CD docs.