v0.5.0

Pre-release: this is a 0.x version and may change without notice.

Added

• The desktop app's Status screen has a read-only Server tab when a status URL is set: version, uptime, relay on or off, the limits in
  force (0 shown as none), TCP refusals and UDP drop counters, and the payload the relay has carried with a bytes-per-second rate
  between two refreshes (not network bandwidth). A counter going down is shown as a server restart. A server that omits the fields
  shows each as not reported, never as 0. It changes nothing on the server.
• The release build also makes three archives of the desktop app, re-psn-app-vX.Y.Z-linux-amd64.tar.gz, -linux-arm64.tar.gz and
  -windows-amd64.zip, each with the static re-psn-app binary (no cgo, version set from the tag), LICENSE, NOTICE.md and the
  app's README, and listed in SHA256SUMS. A release now has ten assets; scripts/check-release.sh --assets, both release workflows
  and their tests expect them (v0.4.0, with seven, is still accepted by the release check). The install scripts do not install the app unless asked (see below).
• install.sh --app and install.ps1 -App install the desktop app (re-psn-app) from a release instead of the server, with the same checksum check, no sudo and no profile edits. They need a release that has the app archives (after v0.4.0) and say so when the download is missing. Without the flag the scripts behave as before.
• -lan-public-addr IP (RE_PSN_LAN_PUBLIC_ADDR, off by default, IPv4): when a player connected from a private, carrier-grade NAT or
  link-local address, players on public addresses are given IP and that player's P2P port instead of the unreachable LAN address
  (the host must forward that port). Players on private addresses and players with public addresses are unaffected.
• LAN discovery on the server, opt-in: -discover (RE_PSN_DISCOVER, off by default) answers a 64-byte DISCOVER sent to the game UDP
  port with a 52-byte DISCOVER_REPLY (TCP and UDP ports, relay flag, player count, name, version), only to private, carrier-grade NAT,
  link-local or loopback senders, under the existing UDP rate limit. -name (RE_PSN_NAME, at most 24 printable ASCII bytes) sets the
  name shown. /api/stats udp_drops gains discover_refused. With the flag off the server behaves as before. No client helper yet.
• The C client can find servers on the local network: psnr_discover(port, timeout_ms, out, max) (client/psnr.h) broadcasts one UDP request from its own temporary socket (never a title socket) and returns each server that answers. Only servers started with discovery on reply; it does not cross subnets or client-isolated Wi-Fi, so keep a manual host:port path. On Windows it broadcasts to 255.255.255.255 only; elsewhere it also tries each IPv4 interface's directed broadcast.
• /api/stats reports the server's version, whether the relay is on, the payload the relay has carried, the limits in force and
  how many TCP connections were refused (too many from one address, request rate). Aggregate only; same access rules as the rest
  of /api/stats. Older servers omit the fields.
• HEARTBEAT may carry the player's own last round trip (rtt_ms, 2 bytes). The server shows it next to each member on the status
  page and in /api/stats as reported by the player, unverified and for display only; a HEARTBEAT without it, and older servers,
  behave as before. The C client sends it once a title opts in with psnr_report_rtt(c, 1) (recommended; off by default), from the
  round trips of its own calls (psnr_rtt_ms, psnr_heartbeat). The app's Go client does the same with Conn.ReportRTT(true).
• /api/stats and the status page count verified players: each public room has verified (members whose UDP probe the server
  has accepted on this connection) and the top level has verified_players. The page shows "(N verified)" after a room's
  member count when N is above zero. The protocol is unchanged.
• client/psnr.h now says what the C client touches: only the sockets it makes itself (the server connection and relay stream connections, which the caller owns), never the title's; connecting and disconnecting are explicit and nothing reconnects by itself; the process-wide effects (WSAStartup on Windows, one global connect-error value, plain send() so a closed connection can raise SIGPIPE, IPv4 only). A comment only; no code changes.
• A test checks that no secret reaches the log: it drives a session at debug level, in both log formats, and looks for each player's UDP token, a room's invite code (right and wrong), a peer key and the status token (right and wrong). The server's behaviour is unchanged.
• Peer keys, for players who connect directly: a client may send PEER_AUTH (0x03, after HELLO, when HELLO_ACK's flag bit 2 says the server issues keys), and then each pair of members who both asked gets one new random 16-byte key from the server in a PEER_KEY push (0xA8) when they share a room. It is the groundwork for tagging packets between peers; no client uses it yet. A client that does not ask is unaffected, and the keys are not confidential on the wire (they travel over the plain TCP connection). HELLO_ACK's flags gain bit 2.
• -relay-force (RE_PSN_RELAY_FORCE, off by default, needs -relay): every stream goes through the relay, even between players
  who could connect directly, so the relay can be tested from one network. The server logs a warning at start and refuses to
  start with it and without -relay. It sets the existing ROUTE flag, so clients need no change; datagrams (UDP RELAY) are not
  forced. For testing only: it uses the host's bandwidth.
• The desktop app can find servers on the local network: Find on LAN (f in Settings, Ctrl+F while typing the server, also on the
  first start) broadcasts one 64-byte UDP datagram (PSNR, type 0x04, a random nonce) from a temporary socket, lists the replies
  (name, address:port, players, relay, version) and puts the chosen address in the server field; typing host:port still works.
  The Go client package has Discover for it. A server answers only when it was started with -discover, and only inside its own subnet; otherwise the list says none found.

Added

• The status page and /api/stats show known games by name: rooms and leaderboards carry a label such as
  [Killzone 3 (BCUS98234, BCES01007)], with game and serials fields, and are sorted by it. A game the table does not
  know keeps its communication ID. The table is embedded in the server (four games so far), never fetched, and the
  title field is unchanged. The protocol is unchanged.

Fixed

• deploy/re-psn.env.example now lists RE_PSN_DISCOVER, RE_PSN_NAME and RE_PSN_LAN_PUBLIC_ADDR, and the old names of those and of -relay-force, so scripts/check-deploy.sh (run by the release build) passes again. A test now runs that check, so a flag added without its example line fails in CI.
• The start log line for LAN discovery ("lan discovery on") no longer shows the server name quoted twice; the name is logged as a plain
  attribute, quoted once by the log format. A test checks it in text and JSON.
• The advice for the UDP PROBE (client/psnr.h, docs/api.md) is now concrete: send one about every 15 seconds while the title is
  online, from its own P2P socket, because some home gateways drop an idle UDP mapping after 30 seconds. Comments and docs only.
• re-psn -h no longer prints the status token. The -http-token default was read from RE_PSN_HTTP_TOKEN (or the old
  PSNR_HTTP_TOKEN), so the usage text showed it, and a pasted -h or a CI log could leak it. The flag's own default is now
  empty, as for -db, and the variable is read after the command line is parsed. The token is still taken from either
  variable or the flag, the flag still wins, and nothing else about the status page changes. If you ever ran -h with the
  token set and kept the output, rotate the token.

Files

Each archive holds one self-contained server binary (no installer, no runtime needed), LICENSE, NOTICE.md and an examples folder (settings file, systemd unit, proxy configs).
The re-psn-app archives hold the desktop app (one static binary, LICENSE, NOTICE.md and its README) for the same three platforms. install.sh --app and install.ps1 -App install the app from a release instead of the server; or unpack one by hand.
The x86_64 AppImage holds the same Linux binary and examples as one runnable file; it needs FUSE to mount, or run it with --appimage-extract-and-run. It is not signed.
install.sh (Linux) and install.ps1 (Windows) are the install scripts from this tag, listed in SHA256SUMS too: download one with SHA256SUMS, check it, read it, then run it (see docs/installing.md).
Check a download with sha256sum -c SHA256SUMS --ignore-missing.

cb3460d041455f4c23cc46b813317c4b9dff21bb54373adbfe93e4e487dccb1e  re-psn-app-v0.5.0-windows-amd64.zip
cd2c8c526aa451f6aeb68beae3345f84dd12ca35ee926f546843b93dca79b907  re-psn-v0.5.0-windows-amd64.zip
1757d27f014e4caf06f5090a9ca632a7840b825d37c46c010b329f3e4dcfa909  re-psn-app-v0.5.0-linux-amd64.tar.gz
d6b69a93b8e1cb7c2e627f2c72d50175b4c0c64f585516cb6cdf88a9676167ab  re-psn-app-v0.5.0-linux-arm64.tar.gz
be5421bd560216f3464611d139209a9d19c934c48c26c38404c3f5370a6c9f8c  re-psn-v0.5.0-linux-amd64.tar.gz
5ea9210696804237d993c5d20bb9289d85eb8621aa83f14c6593ccd2060e08b9  re-psn-v0.5.0-linux-arm64.tar.gz
6e8c0a6fb0026bcb3eab8a6652bbc14a79f469a10f5af2998bd482a0dbbe20c3  install.sh
feb30e6c91c41b62573a10a6f87b2485eb1407b4739132b392064a8e49978b81  install.ps1
f14c4a10bc5fa4135d248e31a71dd465a3037874254c53b7cdc71765561be318  re-psn-v0.5.0-x86_64.AppImage

Developed with AI agent assistance.

Next release: when ready