Changelog

2.1.1

Fixed

• Automatic RPC-flood kicks no longer fire on transient traffic bursts. Actually kicking a flooder now requires the per-player RPC rate to exceed a new, much higher AutoKickRpcPerSecond threshold (default 300) — well above the RPC storm every client emits when someone joins the lobby — while the lower RpcFloodPerSecond limit keeps dropping suspicious packets locally but never kicks on its own. Previously a join-time burst could get an innocent player auto-kicked, appearing in History as a kick "by" a moderator whose client fired the request automatically. A moderator's client also no longer auto-requests the kick of a fellow moderator. The Settings tab now has a separate "Auto-kick over" slider for the kick threshold alongside the "Drop RPCs over" (drop) slider. Hosts who had lowered RpcFloodPerSecond for aggressive kicks: that value now only controls local dropping — set AutoKickRpcPerSecond (or the "Auto-kick over" slider) to your desired kick rate.

Changed

• The host log line for a ghost-player kick now names who requested it (moderator name, Steam ID, actor number) and its origin — a manual moderator action versus an automatic RPC-flood auto-kick — so an unexpected kick can be attributed from the console instead of being anonymous.

2.1.0

Added

• Nickname colors, set by the host: one color for the host's name, one for moderators', plus a per-player color for anyone the host picks (Members > a player > Set name color). Chosen from the game's own color palette or by typing a hex value. The colors reach every player running the mod, and now show in-game on the floating name above a player's head, as well as on the escape menu's per-player volume rows and in the lobby list. The Settings toggle that used to be "Moderator name color" is now "Name colors" and covers all three surfaces; it remains your own display preference.

Changed

• Moderator promotion is now spoof-proof. The host issues each promoted player a private capability token (new PromotedTokens / MyModeratorTokens config entries, managed automatically); promoted moderators re-authorize with it on rejoin, and every privileged command is verified against the live connection instead of a claimed Steam ID (which any client can forge). Upgrading hosts: promotions stored in the old GrantedModerators list are not migrated — re-promote those players once from the Members tab (the old entry is now inert and safe to delete).
• Non-host moderators can now edit their own local Interface and History preferences in Settings (head markers, name colors, ghost rows, talk dot, history persistence) — previously view-only. Flood protection and the secret code remain host-controlled.
• History search no longer re-parses every entry on each keystroke (cached), and long-lived lobbies no longer accumulate per-actor state for players who have left.
• Hardened against a ModHello flood: an unauthenticated client can no longer loop the presence ping to amplify the host's outbound traffic and disconnect it (per-actor cooldown).
• Removed dead code, unified duplicated layout constants into ModStyle, and quieted per-send network logging.

Fixed

• Moderators had no kick button on the in-game escape menu — the game's own button is host-only and hides itself for everyone else. Moderators now get the mod's Kick/Ban button there, on the same rules as the lobby rows.
• The host's escape-menu kick banned outright, with no Kick-or-Ban choice and no History entry (it called the game's ban directly). It now goes through the mod like every other kick.
• Moderator status no longer leaks between lobbies. Leaving a room now reliably resets the mod's roster, identity and history state, and joining a room always starts clean — previously a moderator from one lobby kept seeing working-looking moderation controls in the next lobby while its host rejected every action.
• RPC-flood protection can no longer be switched off by a hostile client. The moderator exemption and the auto-kick both now key on the unforgeable connection rather than a claimed Steam ID, so a client asserting a moderator's ID can neither opt out of the flood check nor get an innocent player kicked in its place.
• A blank SecretCode now genuinely disables the mod: with no code set, the host's kick/ban buttons no longer replace the game's own — matching what the setting has always promised.
• The live moderation-event feed is delivered by connection, so a client spoofing a moderator's Steam ID can no longer receive the host's kick/ban history.
• Host migration now clears the departed host's moderator roster and re-runs the join handshake against the new host, so a client is no longer left showing moderator controls the new host rejects — and persisted grants, matching-secret grants and the "Ban (persistent)" option become active immediately instead of staying dormant until the next player joins.
• History detail showed the wrong Steam ID for any player whose name contains parentheses (e.g. "Bob (BRB)"), and a crafted name could plant a fake but valid-looking Steam ID onto the detail Steam button and the Copy-to-ban-list text. The parser now binds the genuine ID and ignores fields forged inside a player name.
• Pressing Esc to close the "Manage Member" popup could freeze the Members roster (joins, leaves, role changes and talk dots stopped updating). Esc now runs the same close handling as Close.
• Ghost lobby rows could show a dead duplicate kick "x", and could offer a Kick button on the host's or a moderator's ghost row that the host silently rejected. Ghost kicks now use the same host/moderator-target gates as real rows, and the stray button is purged.
• The persisted history file grew without bound and was fully re-read every launch; it is now compacted to the display window at startup.
• Live-synced history entries could be dated to "yesterday" under ordinary host/client clock differences; the embedded time is now read as its nearest occurrence (tolerant to ~12h skew).
• Hand-edited moderator config (the denylist, and the new token entries) was ignored at runtime and could be overwritten on the next change; edits made with a config-reload mod are now honored live.
• Head-marker materials leaked on every tier change and avatar despawn; they are now destroyed with the marker.
• Row-caption and name truncation could split a Unicode surrogate pair, leaving a broken glyph.

2.0.0

Everything since 1.2.0, collapsed — the versions in between were never released.

Added

• In-game moderation UI: a blue "Mod" button in the lobby and pause menus opens a panel with Members | History | Settings tabs, and each lobby row gets a Kick/Ban button for the host and moderators (kept in sync live as rights change). Moderators also get the game's own Start button and a confirm-gated "< Lobby" return button (mid-run only).
• Members tab: every connected player with their role (Host / Moderator / Mod user / No mod) and a talk indicator. The host promotes and demotes moderators here; grants and demotions persist across sessions, and a demotion sticks even if the player has a matching SecretCode.
• History tab: a paginated, searchable, filterable log of moderation events (kicks, bans, floods, moderator changes, start/lobby requests) with severity colors and a detail view with labeled fields and a Copy button. Persists across sessions and syncs to moderators; the plain-text forensic log (sharepermissions.log) has its own toggle.
• Settings tab: flood-protection thresholds, interface toggles (head markers, ghost rows, talk dot, moderator name color), history settings with a confirm-gated "Clear history", countdown length and back-to-lobby confirmation, and in-game SecretCode change.
• On-screen notifications: the host and moderators get a toast for every moderation event (lobby, truck, and in-level), and players promoted or demoted mid-session get a personal notice. On/off and time on screen in Settings.
• Run-start countdown: starting a run counts down on the Start button so everyone gets a moment to ready up; the host and moderators cancel it with a single click, and it auto-cancels while someone is joining. Lobby / StartCountdownSeconds (default 5; 0 = instant start).
• RPC-flood protection: a player spamming RPCs — too many per second or a single oversized one (RpcMaxBytes) — has their traffic dropped on every modded client and is auto-kicked by the host. Lobby-only, enforcing by default, moderators exempt; a flooded client keeps its connection alive long enough for the kick to land, and a flooded moderator's client asks the host for the kick.
• Ghost rows: connected players with no avatar yet show as kickable "[GHOST]" lobby rows that behave like real rows — silhouette avatar, talk wobble and light-up, eye tracking, their own ping. Off by default (enable in Settings); members whose name has no visible characters (join/leave artifacts) are never shown.
• Role head markers in the lobby and truck: gold crown (host), blue gem (moderator), small dim diamond (anyone else running the mod) — replacing the old moderator sphere; nothing shows during levels.
• BanEnforcer integration: with Omniscye-BanEnforcer v4+ on the host, the player-action popups and the Members tab gain Ban (persistent) — writes the target to the host's persistent ban list and removes them from the room; moderators can request it. Detected at runtime, not a dependency.
• Companion mod LoadingWidget (separate install; it depends on SharePermissions): the loading-screen moderation panel — per-player load state, who's talking, per-player local voice volume, Kick/Ban, and a "Lobby" / host-only "Force" rescue for stuck loads — built on the public SharePermissions.Api.LoadingWidgetBridge.

Changed

• An unset or empty SecretCode now disables the mod for you (previously it silently granted moderation to anyone running the mod with default settings). A matching code still grants moderator automatically on join, and the host can also promote players from the Members tab without sharing any code.

Removed

• Per-player mute and its menu actions.
• The separate "Mod" menu and the loading-screen voice-activity overlay (superseded by the in-lobby moderation UI and LoadingWidget).

1.2.0

Changed

• Start game and Back to lobby follow the current game's own flow (fixes wrong save slot / level and properly locks the lobby on start).
• Only validated moderators get the [M] marker and head sphere; the host is no longer specially decorated.

Added

• The host can kick or ban a moderator (with an extra confirm).

Removed

• The "spoofed player" Mod-menu section (invalid avatars are simply hidden; ghosts are still listed and kickable).

Fixed

• Ghost-player kicking now uses the game's own kick/ban events — removal works like a normal host kick, and Ban actually bans.

1.1.0

Fixed

• Works again on current R.E.P.O. and MenuLib 2.5.4.
• Muting the host no longer blocks the host's kick messages.
• The host no longer crashes on malformed/hostile mod messages.
• Mute takes effect even before a player's character has spawned.
• Player names can no longer inject formatting into the kick/ban popups.
• The voice indicator icon no longer renders as "??".
• The Mod menu recovers if it was open during a level change.

Improved

• Large performance cleanup: no per-voice-packet player scans, per-frame menu scans, or GUI allocations during loading screens.

1.0.0

• Initial release: share kick/ban/start-game/return-to-lobby permissions with trusted players via a shared secret; ghost/spoofed player detection; per-player mute; voice activity overlay during loading.