v0.6.9-alpha

SeedHost 0.6.9-alpha

Unsigned portable Windows alpha. Update the group relay and every participating hosting PC together before using
Multi-host Start: an older relay does not enforce the durable checkout fence, and an older host does not read the
replay-safe retention rules. Keep independent world backups.

This release is the fix set from the 2026-10-31 code audit, plus the earlier failed-checkout recovery work. It does not
install anything, migrate a live world, or repair a historical pending checkout.

Group hosting reliability

• Retention can no longer delete the world the relay is holding. Retrying an already-accepted handoff used to move
  the old revision back into the retention set, so cleanup could prune the current one: the group still showed a
  pending checkout while the next claim failed because the data was gone. A retry is now an acknowledgment only, the
  current revision is always kept, and retention runs under the same lock as acceptance.
• A failed claim no longer strands the group. If a PC runs out of disk before accepting ownership, the relay
  provably releases the reservation instead of leaving the group locked to that PC forever. Installation-volume checks
  now include the working copy, and a failure before authority returns a definitive decline while the member keeps
  their previous world.
• Group-owner Start and member removal can recover an abandoned pre-complete checkout after a restart; stale transfer
  streams cannot then authorize ownership. Lost acknowledgments and legacy records stay fenced — this is not a
  force-unlock.

Safety fixes

• The Minecraft port guard sees the real port. server-port is read with the same Java-properties rules as launch
  preflight (repeat keys, :/whitespace separators, escaped keys), so a public-tunnel reservation can no longer protect
  a port the server never binds.
• A library can no longer save itself into an unopenable state. Creating, importing, claiming and group-joining
  refuse before passing the size the saved-state format accepts, and saving enforces the same bound.
• Client-pack exports cannot be reported as complete while truncated. Short file writes are continued; a write that
  makes no progress fails the export and leaves no archive.
• A failed Java download stops immediately. Remaining runtime download workers are cancelled and drained before the
  download folder is removed, so nothing keeps writing (or filling a small disk) after setup reported failure.

Runtime and build

• Desktop runtime is now Electron 44.10.1, which carries the compromised-intermediate-certificate mitigation and
  embeds Undici 7.30.1 (fixes a remote crash on malformed compressed responses).
• Build tooling pins patched glob, minimatch and undici; npm audit is clean for this tree.

Known limits

• A legacy pending checkout created before this release (for example the historical jyzputin record) is still not
  auto-cleared. Unknown acceptance is not permission to host; recovery stays evidence-bound.
• Retention now prunes while holding the relay's mutation lock, so on a very large store a park or claim can wait
  behind cleanup.
• Public-provider allocation, different-network handover and authenticated Minecraft gameplay are not certified by the
  automated process/socket tests.

Full audit and remediation evidence: docs/audit-fixes.md.

SeedHost v0.6.8-alpha — Group hosting polish

SeedHost v0.6.8-alpha — Group hosting polish

Unsigned portable Windows x64 alpha. Keep independent world backups. Update participating hosting PCs and the group relay together before testing. Publishing this release does not install it or modify existing profiles/worlds.

Changes

• Installed mods first: separate server/client installed lists with case-insensitive filtering; online discovery and guarded install/repair operations remain available.
• Quick setup can be cancelled: X/Escape no longer force creation of an uncreated server. Explicit stage selection saves draft progress; an in-flight creation stays guarded.
• Group roles: only the appointed owner can disband; members can leave a downloaded/bound group with a pinned-relay receipt and durable local readback. Failure or uncertain removal is not reported as success.
• Canonical server name: the appointed owner's title follows the group when another member downloads/hosts it, without replacing unrelated worlds or trusting received launch commands. Metadata publication follows local safety fences and relay reachability checks.
• Automatic revision retention: Save backup and successful Stop keep the latest completed ordinary backup. The predecessor and unused objects are removed only after durable verified replacement; other worlds, custody/recovery evidence and conflict branches stay protected. Unresolved state defers cleanup.
• Clearer hosting controls: remove the Multi-host Take over button and generic hosting-authority warning; group guidance points to ordinary Start server. Exclusive custody, pending admission and uncertainty fences remain enforced.
• Owner revocation restart fix: locally removing the appointed owner clears its canonical metadata in the same durable mutation, so the relay can restart and explicitly appoint a trusted replacement without resurrecting the former owner.

Verification

Release commit: 4b29e49ba1a7cc770907fb2c837994326774fc1b (includes feature commit a386285).

• Final npm run package:windows: 1,127 tests; 1,126 passed, 0 failed, 0 cancelled, 1 skipped; exit 0.
• All 296 tracked files matched the frozen release tree before and after the gate and release commit.
• 126 app/emitted resources hash-matched the exact package; private/development packaging exclusions passed.
• Exact packaged executable: version matched package metadata, Electron, backend IPC, footer and updater. Real isolated visible Electron checks passed cancelled import, guarded file access, mods/navigation, pinned TLS A→B→A handoff, explicit fixture process Start/clean Stop, inline consent and Delete cancellation, with a 90-second final inspection hold.
• All 1,307 archive files were read and hash-compared against the tested package; archive inventory, version, paths and checksum asset validated.
• Independent static review found an owner-untrust defect; a failing-before/passing-after regression and the minimal correction passed independent re-review.

Known limits

• A strict one-copy storage bound is unsafe when recovery/custody/conflict evidence must survive. Such revisions can remain, and unresolved state defers pruning.
• Scheduled backup-only actions, profile-update backups and old materialized server folders are outside automatic revision retention. Ordinary replaced revisions are no longer restore choices; protected retained history remains available.
• Pending/serverless memberships do not yet have a Leave control in the UI.
• The optional always-on player gateway remains the shared persistent-address mechanism. Playit still requires its first-time account approval; this release adds no account-free provider provisioning or transferable agent credentials.
• Automated process/socket checks and isolated desktop QA are not different-network handover, public-provider allocation or authenticated Minecraft gameplay certification.

Assets

• SeedHost-0.6.8-alpha-win32-x64.zip — 160,006,914 bytes.
• SHA256SUMS.txt — checksum used by the in-app updater.

ZIP SHA-256:

dffc42b77202891536368acebba61462dfed19651059a516a696ea60838427ec

SeedHost v0.6.7-alpha — verified cross-PC hosting and recovery

SeedHost v0.6.7-alpha

Unsigned Windows prerelease. Update both hosting desktops, preserve independent world backups, and wait for Stop publication before moving hosts.

Changes

• Group Start obtains the latest saved revision, acquires exclusive hosting authority and launches locally. Competing Starts remain refused.
• Bounded transfer-frame budgets address slow transfer writes and reads without treating a lost acknowledgment as proof of unchanged custody.
• Durable admission evidence and explicit authenticated recovery preserve uncertain operations and exact retry identity across restart. Legacy states without sufficient evidence remain fenced; this is not automatic takeover.
• Launch port preflight checks configured bind scopes without stopping other services or changing ports. Linux link-local IPv6 probes retain their interface zones.
• Public setup follows the selected hosting world. Address displays distinguish allocation from recent verified Minecraft reachability, with current-host endpoint telemetry for group members.
• Recovery and copy actions validate the captured world and fresh state rather than reusing stale UI evidence.

Verified scope

• Release tree: 1,095 tests passed, 0 failed, 1 skipped (1,096 total).
• Disposable real Vanilla 1.21.1 Windows -> Linux Omarchy -> Windows over Tailscale: actual Minecraft status replies, console scoreboard values 101 -> 202 -> 303, graceful Stop and publication, exact pre-launch saved-file hashes, persisted scoreboard values, and competing-host refusals.
• The Linux scoped-IPv6 defect was reproduced on the actual second PC, fixed, regression-tested and independently reviewed.

Limits

This does not certify authenticated player gameplay, public Playit joining, arbitrary modpacks, different-home-network availability or power-loss recovery. The cross-PC test used isolated test worlds and the packaged core; it did not modify live worlds. Public address approval and actual reachability are separate checks. Port probes cannot guarantee Java socket parity in every OS overlap case. Older uncertain states may require exact retry or explicit evidence-backed recovery rather than a universal one-click reset.

Worlds, groups and accounts should not be deleted for this update. Keep both applications open until Stop saving/publication completes. Optional gameplay gateways and always-on hosting remain optional.

SeedHost v0.6.6-alpha — initial publication timeout fix

SeedHost v0.6.6-alpha

Unsigned portable Windows prerelease. Update both hosting PCs; keep independent world backups.

Fixes

• Initial group Start now gives the owner's safely stopped initial publication up to two minutes instead of applying the five-second control-reply deadline. Ordinary control deadlines remain unchanged. Expiry never authorizes takeover or launch on uncertain custody.
• Concurrent Playit status polling no longer mistakes a tunnel still being created for a missing or changed saved route. Completed bindings retain their route validation and cancellation safeguards.

Verified scope and limits

Real isolated pinned-TLS regressions reproduce delayed initial publication and the Playit setup/status race. The initial-publication tests verify latest bytes, a single running holder, bounded expiry and no late member launch. Playit fixtures exercise setup polling and changed-route rejection without real provider credentials.

This does not certify different-network Minecraft gameplay or arbitrary modpacks. Automatic group launch retains its validated Vanilla/Fabric JAR-layout limits. Public Playit approval and reachability remain separate checks. Worlds, friends and hosting groups do not need to be deleted for this update.

SeedHost v0.6.5-alpha — one-click group hosting

SeedHost v0.6.5-alpha — one-click group hosting

Unsigned portable Windows alpha. Both hosting members should update to this version and keep independent world backups before testing.

What changed

• Start server is the normal single action: obtain the latest safely saved world, mods, configuration and deletions, verify the complete revision, acquire exclusive authority, and start locally.
• An invited member without a matching local server can Start directly; enrollment materializes a new managed server rather than replacing an unrelated world.
• While any member hosts, competing Starts refuse without stopping that host. Simultaneous Starts have one winner. Unreachable or unknown ownership never means idle.
• Group Stop saves and publishes before another member may host, even when the legacy park-on-stop checkbox is off. Failed publication remains fenced and retryable.
• Durable pending-start reservations close admission/revocation and handoff races. Exact member/revision/lineage/reservation checks prevent unrelated cancellation.
• Explicit group binding consumes its matching pending membership; setup progress safely retries transient Windows reader-held atomic replacement failures.

Testing and limitations

The release source passed 994 tests, 0 failed, 1 skipped, with all 30 captured files unchanged during the run. Real headed Electron checks verified latest fixture bytes/deletions, A→B→A rotation, active-owner/member refusal, mandatory final-save publication, and one Java process for competing Starts. The exact versioned package and all bundled resources are checked before publishing.

These checks use real Java processes and synthetic world/mod/config files: not real Minecraft gameplay, arbitrary modpack compatibility or different-home-network certification.

Automatic group launch currently supports validated unambiguous Vanilla/Fabric JAR layouts and approved local Java. Script-based, argument-file and ambiguous modloader layouts refuse honestly; an advanced launch profile is not a group bypass. Receiving mods still entails running code from trusted group members.

A crash/restart or lost Start acknowledgment can conservatively strand a pending admission. There is no automatic lease expiry, takeover or unsafe recovery. Keep the host app open until Stop finishes saving and publishing. The separate legacy Playit agent-authentication issue is not repaired by this release.

How to test with a friend

1. Back up the world while Minecraft is stopped, and update both PCs to this release.
2. Keep the hosting-control endpoint reachable; account-directory access alone does not make the group's control route reachable.
3. First member clicks Start server. On the second PC, try Start while the first is running: it must refuse without interrupting gameplay.
4. Make a small disposable world change, then click Stop and wait for publication to finish.
5. Second member clicks Start server and checks the saved changes. Repeat in the opposite direction.

Download the ZIP below and verify it against SHA256SUMS.txt. This release does not itself change router/firewall/startup settings, install on existing PCs or migrate live worlds.

v0.6.4-alpha

SeedHost v0.6.4-alpha

Unsigned Windows x64 development alpha. Keep independent world backups.

This release includes the full UX batch and the previously local 0.6.3-alpha hosting-safety fixes.

What changed

• Setup-guide friend actions complete in place, with durable progress scoped to the correct world and workflow. The optional always-on role is no longer a guide stage.
• Mods discovery/search, compatibility options and installed server/client lists are visible together.
• Creation asks for a native download folder, supports quiet cancellation and retains the verified source while making a separate managed running copy. Directory-replacement and aliased configuration-file overwrite regressions are fixed.
• Routine warning popups are replaced with inline explanations. Incoming handoff still needs explicit request-scoped accept/decline and expires to refusal. Busy-quit, clean stop and ownership fences remain; server deletion keeps a Cancel-default confirmation.
• Accessible cards open with click, Enter or Space without nested copy/delete actions opening them. Unchanged hosting-group cards stay opaque and retain focus during refreshes.
• Friends shows world-associated groups and explicit pending/serverless membership, separate from social requests. Friendship alone grants no hosting or world-file access.
• Server files opens the validated managed OS folder through narrow ID-only IPC.
• Concurrent dashboard reads share probes, with bounded world/process/port freshness and honest unknown player counts. This is reduced duplicate polling, not a measured TPS or internet-ping improvement.
• New-world Playit setup is bound to the exact created world and a distinct reserved port. First-time provider approval, pending allocation and errors remain explicit; ordinary local/direct hosting works without a helper or public address.
• Includes same-group invitation replacement with fresh IDs, cross-process revocation/commit fencing, owner-first lineage, damaged-ownership startup/retry safety and atomic primary-helper reservation from the local 0.6.3-alpha batch.

Download and update

Download SeedHost-0.6.4-alpha-win32-x64.zip, verify its SHA-256 against SHA256SUMS.txt, extract the SeedHost-win32-x64 folder and run SeedHost.exe. Existing packaged builds can use Settings → App → Updates once this release is published. Nothing installs automatically; preserve the current profile and quit hosting cleanly before applying an update.

Java is not bundled. The build is unsigned; Windows may display a SmartScreen warning. Verify that the download came from this repository before choosing to run it.

Verification boundaries

• Fresh release-version canonical gate: 952 tests; 951 passed, 0 failed, 0 cancelled, 1 opt-in live-server check skipped. Before/after source manifests matched.
• Exact Windows package: 122 bundled app resources matched source; metadata, Electron, IPC, footer and updater all reported 0.6.4-alpha.
• Packaged desktop QA passed for pinned loopback TLS A → B → A handoff with inline consent, official Vanilla 1.21.1 JAR creation/source/managed-copy separation, native cancellation, and Friends/pending groups. A 90-second hosting-card observation included 101 state reads and 7 completed directory refreshes, with no replacements or focus loss.
• Release ZIP: all 1,300 file members matched the tested package. Published SHA256SUMS.txt identifies the exact archive.

Desktop handoff uses disposable process/file fixtures; official JAR creation is exercised without launching Minecraft. This release cycle does not certify Minecraft gameplay, public Playit reachability, different-network hosting or arbitrary modpacks. No live profile, world, tunnel, router/firewall/startup configuration or local installation is changed by publication. The source commit is 26935758eff1c011c79bf8b741380c39b5d1fcb6; the release verification record preserves detailed gates and the earlier desktop-test timeout/rerun history.

v0.6.2-alpha

SeedHost v0.6.2-alpha

Unsigned portable Windows alpha. Keep independent world backups.

Changes

• Hosting invitations arrive in Friends. An incoming multi-host invitation is now visible and acceptable with no local server selected — previously it was only reachable from the recipient's unrelated server's Multi-host page, which made first-time acceptance a dead end.
• Friends shows your hosting groups — created and joined — including groups whose shared world is not on this PC yet, with an explicit "Download as a new server" that appends and never touches an unrelated world.
• Independent group identities per world. Creating a group for a second world no longer aliases onto the first world's relay; each group gets its own durable helper identity, store and listener.
• Recovery-safe claims. An interrupted claim (for example an app or power loss between publishing the entry and recording ownership) is journalled: on restart it either completes or rolls back to the pending group, restoring the world that was selected before the claim. A handoff nobody asked for can never take authority over a world whose local ownership record is unknown.
• Invitation context is fenced. Approval to invite someone to a specific server's group is captured before directory lookups, so a selection change mid-operation can no longer redirect the invitation to another world.
• Group control route can be configured. A group hosted on this PC can advertise an existing reachable TLS control endpoint (LAN, VPN or a raw-TCP ingress you already run). The dialog is explicit that saving an address does not create forwarding, a tunnel or a VPN, and loopback routes are labelled as same-PC-only wherever they appear.
• In-app notification centre with unread count, mark read, clear and destinations: friend requests, hosting invitations and observed server start/stop/failure events; history is per account + directory, deduplicated across polling, bounded, and stores no codes, passwords or world paths.

Verification

• Canonical build/test gate on the release tree: 915 total, 914 passed, 0 failed, 0 cancelled, 1 skipped; exit 0.
• Real visible Electron acceptance harness (real IPC, pinned TLS, disposable profiles): 10/10 stages — serverless invitation in Friends, acceptance with no local server, unrelated world untouched, explicit download appends a new server, two independent groups, persistent deduplicated notifications.
• Independent source review of the change set; its non-blocking findings were acted on and each new fix was falsification-tested (reverting the fix makes its regression test fail for the stated reason).
• Windows package and archive checked against the tested source; package excludes profiles, credentials and development dependencies. SHA-256: 6aac4971cc09555c54c2d4ee73836c1d52ae381374e6aad5b265770ab0c15fb5.
• Not a certification of cross-PC gameplay or Minecraft compatibility.

Notes for existing installs

• Invitations sent before this build pin the old control endpoint and keep failing by design; send a new invitation after updating both PCs.
• The always-on/group helper restarts with the app and reuses its persisted control port; nothing about worlds, accounts, or public player addresses changes.

Install/update

Download SeedHost-0.6.2-alpha-win32-x64.zip and verify it against SHA256SUMS.txt, or use Settings → Updates in a packaged SeedHost build. Preserve your existing profile directory. The zip contains SeedHost-win32-x64.

v0.6.1-alpha

SeedHost v0.6.1-alpha

Unsigned portable Windows alpha. Keep independent world backups.

Changes

• Independent per-server setup guides, a separate new-server draft, safe legacy migration, and stale-workflow guards.
• Accessible loading feedback for slow foreground actions without noisy background polling.
• Quiet native Create/Import/Java-profile cancellations.
• Bounded Windows snapshot-walk retries for transient delete-pending children, preserving fail-closed permission and link handling.
• Correct GiB memory display and refreshed friend lists.

Verification

• Release-version canonical build/test gate: 871 total, 870 passed, 0 failed, 0 cancelled, 1 skipped; exit 0.
• Release correction: the first asset showed an old hard-coded footer version despite correct package/updater metadata. The rebuilt asset uses Electron's installed package version; the tag and assets were updated to commit 41b0083 after regression and full-suite verification. SHA-256: a1824e8a483d2952d76df2df890e769caddb911e84943346480513cd573455ed.
• Independent source review of the feature deltas: no blockers.
• Windows package and archive checked against the tested source; packaged usability gate covers loading/cancel cleanup, per-server progress/restart isolation and actual memory samples.
• Not a certification of cross-PC gameplay or Minecraft compatibility.

Install/update

Download SeedHost-0.6.1-alpha-win32-x64.zip and verify it against SHA256SUMS.txt, or use Settings → Updates in a packaged SeedHost build. Preserve your existing profile directory. The zip contains SeedHost-win32-x64.

v0.6.0-alpha

Alpha of Seed Hosting for Windows.

New in this release: in-app updates. Settings → App → Updates checks the official releases, downloads a newer version with progress, verifies it against the published SHA-256, and "Restart & update" replaces the app files after it closes and opens it again. (Once you install this build, future alphas can be installed from inside the app.)

Also new since v0.5.0-alpha:

• Local online accounts: register and sign in; ordinary friendships (send, accept, decline, remove)
• Username-only friends and hosting invitations; legacy invitation codes stay internal
• Server settings page: hardcore and more, with safe read-back; edits blocked while running
• Per-server dashboard pages: performance metrics (2 decimals), console, players, backups, scheduler, mods, files
• Per-server public Playit addresses with a direct join path
• Hosting groups bound per server; group disband with fresh-identity rotation
• Optional always-on PC role — creating a group no longer forces it
• Setup guide: send and accept friend requests inline

Assets: SeedHost-0.6.0-alpha-win32-x64.zip (extract anywhere, run SeedHost.exe) and SHA256SUMS.txt. Unsigned development alpha — verify the checksum; Windows may warn about an unknown publisher. This is not a production-ready Minecraft hosting service.

Seed Hosting v0.5.0-alpha — Remote hosting groups

Remote hosting groups

Create an account in Friends, invite your friend by username, and have them accept in their app. The configured Windows build includes the public pinned-TLS account-directory endpoint; your friend does not need to install Tailscale to access the configured public hosting group.

World files stay on your PCs, including the always-on relay PC—not in the account directory. The administrator's always-on PC and internet connection must remain available. Playit player traffic remains separate from group invitations and world handoffs.

Also included

• Owner-only, recipient/device-bound username invitations and confirmed member removal.
• Automatic verified private Java provisioning, Fabric mod/dependency selection, and one-click always-on-PC setup.
• Several local server profiles with protected switching, backups, and deletion.
• Approved Playit address management and refreshed sprout branding.
• Graceful relay startup/shutdown and recoverable Wayland minimize behavior.

Windows download

Download SeedHost-0.5.0-alpha-win32-x64.zip, extract the entire folder, and run SeedHost.exe. No Node.js installation or terminal commands are needed for the desktop app. Existing profiles remain in %APPDATA%/SeedHost; do not delete the profile or its ownership databases when updating. Back up your worlds before alpha testing.

Verification and limitations

• TypeScript build passed; production dependency audit reported zero vulnerabilities.
• Full Linux-host test run: 447 tests, 446 passed, 0 failed, 1 skipped. The skipped case requires explicit opt-in for live official Vanilla/Fabric preparation.
• Actual isolated Electron checks passed for signup, invitations, acceptance, owner-only removal, cancellation, encrypted persistence, layout, and window controls.
• Public directory TLS/pinning and rejection of an unenrolled group-membership request were checked using independently resolved public IPv4 addresses from the development PC.
• The Windows package's executable header, runtime/source correspondence, configured endpoint, private-state exclusions, and complete ZIP integrity were verified. SHA-256 is attached.
• Unsigned portable alpha, not an installer. The Windows executable was not run during this release, and Minecraft gameplay on a friend's separate remote network remains unverified. Keep independent backups; this is not a production-readiness claim.

Source commit: 22bee0743ca298d8e5e0e15e975983f31e9ee558.