Changelog

v2.6.x - Connection Limit, Attribute & Skill Point Budgets & Codebase Split - 10/7/26

Adds a server-side limit on simultaneous connections per Steam ID, enforced both at the Steam transport and by a periodic scan, adds total attribute point and skill point budget checks, and reorganizes the source into separate files. Only the host needs HAC for the connection limit and the budget checks to work.

🔗 New: Connection Limit

• Per-Steam-ID connection cap

  • While hosting, HAC now checks active connections and disconnects extras when one Steam ID holds more than the allowed number.
  • Stops multi-client "cloner" style mods from spawning several copies of one account on your server, no matter which version of that mod the client runs.
  • By default every connection of an offending Steam ID is dropped (Kick All Connections On Violation); turn it off to keep the oldest connection and drop only the newer extras.
  • A second layer runs earlier: see Accept-Time Guard below. Enable Connection Limit switches off both layers.
  • Your own (host) connection and Trusted SteamIDs are never touched.
  • Connections whose address is not a SteamID64 are skipped (and logged once), so players who share an IP are not grouped together.

• New settings (config section [11. Connection Limit], also in the EasySettings tab)

  • Enable Connection Limit - on by default.
  • Max Connections Per Steam ID - default 1 (range 1-16).
  • Kick All Connections On Violation - on by default.
  • Scan Interval (Seconds) - default 0.25 (config file only).
  • Enforce Limit At Accept - on by default. See below.
  • Log Only (Test Mode) - logs violations without disconnecting anyone (the accept guard logs the match and lets the connection through). Use it to test on your server first.

🚪 New: Accept-Time Guard

• The limit is enforced before extra connections register
  • Hooks NextServer.OnConnectionStatusChanged in FizzySteamworks. When a new connection arrives for a Steam ID that is already at Max Connections Per Steam ID (counting connections mid-connect), it is closed before NextServer accepts it, so Mirror and ATLYSS never see it. With Kick All Connections On Violation on, that Steam ID's existing connections are dropped too; with it off, the original connections are kept.
  • Targets multi-client "cloner" mods that open extra Steam connections beside the first. The transport can forget an earlier connection's Steam ID when a second one from the same account arrives, so stopping extras before they register is cleaner than cleaning up afterwards.
  • The periodic scan stays as a second layer.
  • Trusted SteamIDs are skipped. If the guard hits an error or cannot bind to the transport, it falls back to vanilla accept behaviour and logs it.

📊 New: Attribute Budget Check

• Total attribute points can't exceed what the level allows

  • Adds a player's unspent attribute points to the points already put into stats and compares the total to the game's own budget: (level - 1) * attribute points per level + 6 (exactly 6 at level 1).
  • Complements the existing attribute request check, which judges one spend at a time. This one judges the result, so it also catches points that arrived another way, such as saved data loaded at join.
  • Runs on the server after the join window and spawn grace period, right after every attribute point request, and every 2 seconds. Each violation is reported once per episode, not on every check.
  • A forged level cannot buy extra budget: the level is capped at the game's max level when the budget is worked out.
  • Trusted SteamIDs and the host (when Disable Detections for Host is on) are skipped.

• New settings (config section [7. Stats], also in the EasySettings tab)

  • Enable Attribute Budget Check - on by default.
  • Attribute Budget Action - default Log Only.
    • Log Only writes to the HAC log and does nothing else.
    • Infraction counts toward auto-punish.
    • Reset counts an infraction and resets the player's attributes to 1 with their full legitimate points refunded (a respec).
  • Attribute Budget Tolerance - default 0 (range 0-50). Extra points allowed above the budget before a player is flagged.

🎓 New: Skill Point Budget Check

• Unlocked skills can't cost more than the level has paid for

  • Adds up the skill point cost of every skill a client reports as unlocked and compares the total to what the player's level has handed out: level / 2 (rounded down) * skill points per level, because the game grants skill points on even levels.
  • The game keeps unspent skill points on the client only, so the server cannot see them. This check judges what the server can see: the skills the client reports as unlocked, each priced with its own skill point cost. Unspent points only show up once they are spent.
  • Runs on the server after the join window and spawn grace period, right after a client reports its skills (on join and after every unlock), and every 2 seconds. A violation is reported at most once every 30 seconds, not on every check.
  • A forged level cannot buy extra budget: the level is capped at the game's max level when the budget is worked out.
  • Trusted SteamIDs and the host (when Disable Detections for Host is on) are skipped. It works anywhere, not only in safe zones.
  • Casting a skill that was never unlocked is not checked.

• New settings (config section [7. Stats], also in the EasySettings tab)

  • Enable Skill Point Budget Check - on by default.
  • Skill Point Budget Action - default Log Only.
    • Log Only writes to the HAC log and does nothing else.
    • Infraction counts toward auto-punish.
    • Reset counts an infraction and runs the game's own skill point reset (the one used on class change): the player's client locks every skill and refunds all of their legitimate points. It also clears their active status conditions. The reset is carried out by the player's own client, so a modified client can ignore it; such a player keeps being reported until auto-punish steps in.
  • Skill Point Budget Tolerance - default 0 (range 0-50). Extra skill points allowed above the budget before a player is flagged.

🧹 Codebase Reorganization

• Main.cs was split into a partial class Main spread across focused files (Config/, Core/, Networking/, Models/, Patches/). No detection logic was changed; code was moved, not rewritten.
• New modules: Core/ConnectionLimiter.cs, Patches/AcceptGuard.cs, Patches/AttributeBudget.cs, Patches/SkillBudget.cs.

⚙️ Config Notes

• The new section is added automatically on first run. Existing configs remain compatible, no migration needed.
• If a player is dropped while rejoining quickly (their old connection had not timed out yet), raise Max Connections Per Steam ID to 2, or turn Kick All Connections On Violation off.
• Building now needs a reference to FizzySteamworks.dll (ATLYSS_Data/Managed).
• The attribute and skill point budget checks default to Log Only so you can compare their logged totals against known-good characters before enforcing. Switch to Infraction or Reset once the numbers look right.

---

Old Updates

v2.5.x - Thunderstore Polish & Reliability Patch - 5/13/26

A focused reliability update fixing Thunderstore integration, improving log clarity, and hardening case-insensitive matching.

🔧 Fixes & Improvements

• Thunderstore JSON Parsing Fixed

  • Added [JsonIgnore] to latest field in ThunderstorePackageV1 to prevent Unexpected character '{' deserialization crashes.
  • Switched API search parameter from ?namespace= to ?search= for accurate mod lookups.
  • Added ThunderstoreSearchResponse wrapper to correctly parse paginated {"next": "...", "results": [...]} responses.

• Human-Readable Mod Details in Logs

  • Kick messages now display: ModName (GUID) vVersion instead of raw GUIDs.
  • Example: CheatMenu_Public (0a26c5bd-f173-47f8-8f50-006dd6806ce6) v1.4.2
  • Background verification logs now show full details: Verified and cached ModName (GUID) vVersion on Thunderstore.

• Case-Insensitive GUID Matching

  • ParseBlacklistedMods(), ParseWhitelistedMods(), and ParseRequiredMods() now normalize all entries to .ToLower().
  • Com.MyMod = com.mymod = COM.MYMOD — all match reliably.

• Vanilla Client Support Hardened

  • Handshake timeout now explicitly auto-authorizes vanilla clients when no required mods are configured.
  • No more false kicks for legitimate players without mods.

• Server Broadcast Messages

  • Kick/ban announcements now appear in cyan chat for all players via [HAC] prefix.
  • Messages are safely truncated and HTML-stripped to survive the game's chat filter.

• Background Verification Optimization

  • Unknown mods are authorized first, then verified silently in the background—no handshake timeouts.
  • Pre-warmed Thunderstore cache on server start enables instant verification (<50ms).

⚙️ Config Notes

• All new Thunderstore settings (Enable Thunderstore Whitelist, Community Identifier, etc.) are optional and default to off.
• Existing configs remain fully backwards-compatible—no migration needed.

🐛 Bug Fixes

• Fixed case-sensitivity mismatch causing valid GUIDs to bypass blacklist/whitelist checks.
• Fixed Thunderstore API search returning 0 results due to incorrect query parameter.
• Fixed JSON deserialization crash when latest field contained an object instead of string.
• Fixed handshake timeout incorrectly kicking vanilla clients when no required mods were set.
• Fixed background verification logging to show full mod details instead of just GUID.

hotbug fixes

• Asynchronous Logging: LogInfraction now offloads disk writes to a background task so the game thread never freezes.
• XP Progress Capping: Instead of resetting XP to 0 and returning false, the code now caps the gain to the maximum allowed and returns true, ensuring you always make progress.
• O(1) XP Calculation: Replaced the expensive .Sum() loop with a running total dictionary to prevent frame drops in high-density areas like Crescent Grove.
• Generous Defaults: Increased default XP thresholds in Awake to better support modded maps.
• Generous EasyAnticheat Verification: plvsmvwvre came back around and somehow managed to slip through, this is tested throughly to see if stuff like that is actually verificated and public on thunderstore.

v2.4.x - Menu Overhaul - 3/16/26

• Changed Enable Mod Blacklist to false by default.

• Added the Nessie.ATLYSS.EasySettings soft dependency.

• Implemented the AddSettings UI so you can configure everything in-game (including text fields for SteamIDs and blacklists, and dropdowns for punishment types).

• Updated README.md fully.

• Bug Fixes: - Should fix the bug where the menu is straight up not appearing - Prepared for qa-branch

v2.3.x - The Stability & Behavioral Overhaul - 1/18/26

Major Networking & Logic Rewrite

• Fixed Connection Issues: Switched handshake networking to Binary P2P (SteamNetworkingMessages). This resolves the k_EResultInvalidParam errors and prevents players from timing out while loading into the server.
• Integrity Logic Change: Removed "Strict Hashing" integrity checks which were causing false positives for vanilla players or those with different mod versions.
• New Mod Enforcement: Switched to a Blacklist System. The server now accepts all mods by default and only kicks clients if they have a specific GUID listed in the BlacklistedModGUIDs config.
• New Behavioral Detections:
• Infinite Stamina: Detects players sprinting without losing stamina.
• Consumable Spam: Prevents using items faster than humanly possible (Macro detection).
• Weapon Swap Spam: Prevents animation canceling via rapid weapon switching.
• Parry Botting: Detects inhuman block input speeds.
• Crash Fixes: Resolved NullReferenceException errors in the movement validation patch.
• Stability: Added a safety delay to the handshake to ensure the player object is fully initialized before checking.
• Bug Fixes:
  • fixed a bug that was lingering like a fly, server reinit re registration
  • Updated Readme for more clarification (2/14)

Public Test Updates (Pre-v2.3.0)

• Codetalker Update: Updated dependencies to latest version - 1/17/26
• Validation Improvements: Made validation abide by Thunderstore policy (reading names + GUIDs) - 11/22/25
• Game Update: Updated compatibility for latest game patch - 1/11/26
• Fixes: Fixed missing detections and extended verification length - 10/14/25
• SteamID: Added Whitelist/Blacklist for SteamIDs - 10/12/25

v2.2.0 - Refactory

• Fixed "Players getting railed on skill init" bug.
• Fixed fly/movement checks and host boolean logic.
• Added logging configuration choices.
• Patched Teleportation by call.
• Airborne Check: Added height limiting check.
• Revive Fix: Fixed revive detection logic (Angela's Tears requirement).
• Currency: Added Currency Add Check back.
• Syncing: Added CodeTalker Anti-Cheat Syncing.

v1.0.7 - Bugfix

• Fixed skill initialization issues.

v1.0.6 - Stability & Feedback

• Fixed Critical Initialization Bug: Dynamic Haste ID detection moved to correct loading point.
• Log Archiving: Added automatic log archiving to prevent massive file sizes.
• Announcements: Added public punishment announcements to chat.
• Confirmation: Added server start confirmation message.

v1.0.5 - Lag Compensation Fix

• Movement: Overhauled movement detection to be tolerant of lag.
• Config: Added Max Effective Speed, Grace Buffer, and Time Threshold configs.
• Speed Hack: Improved detection using dynamic baseline recording.
• Vulnerability Fix: Corrected cast time validation for instant-cast skills.
• Paths: Standardized log file paths.

v1.0.4

• Intelligent Skill cooldown check improvement.
• Flagged speedhack properly.

v1.0.3

• General bug fixes.

v1.0.2

• Airborne check re-enabled.

v1.0.0

• Initial release.