Changelog

2.7.0

Added

• Moderators no longer have to hold every power at once. Moderator access used to be a single switch: promoting someone handed them kicking, banning, the Admin Menu, player notes and control of the run, all together, and the only way to withhold one was to withhold all of them. The host can now turn the six off individually — kick, ban, persistent ban, Admin Menu, notes (add and delete only), and run control — from the moderator's row on the Members tab. A new promotion still starts with all six, so promoting someone is exactly what it was; the switches exist to take a power away rather than to hand one out. A change applies immediately on that moderator's screen, survives them reconnecting, and is recorded in History with what changed. The Access tab lists a grant's permissions beside its token when they are restricted, and your own are shown in Settings > Diagnostics.

  The host decides every action either way — permissions are checked on the host's machine, not on the moderator's — so a moderator running an older version of the mod is held to the same limits. Their screen just won't know to grey the buttons out, and a withheld action will quietly do nothing.

  A version downgrade can undo a restriction the other way too: if the host rolls its own install back to a build from before this feature, that build's next save of the moderator list keeps the token but not what it was trimmed to, so the grant silently reopens to all six. There is no on-screen warning for it — the Access tab will simply show the grant as unrestricted again the next time it is checked.

• Bans can now be reviewed and lifted from inside the mod, not just added. Until now SharePermissions could only add to the host's BanEnforcer list; undoing one meant the host opening BanEnforcer's own panel by hand, and nothing recorded that it happened. The Access tab now has a Banned players section showing it to the host and every moderator — viewing needs no permission, since History already shows moderators the ban events that produced the list. Lifting one does: anyone holding persistent ban gets a Lift ban action, and every lift is written to History with the name of whoever did it.

  The list is the host's own — BanEnforcer stores its bans locally on each machine, so a lift here only undoes the ban on that host, never on any other host that separately banned the same player. When the host has no BanEnforcer installed, the section says so plainly instead of showing an empty list — an empty list and a missing integration are different claims. A very long list is also shortened, and the section says so rather than presenting a partial list as complete.

• The mod's own interface can now be shown in Russian. Every panel, toast and popup the mod puts on your screen can render in Russian, with one exception: the Access tab's may: ... capability list beside a restricted grant stays English, since it shares that vocabulary with Diagnostics and the audit log (see below). English stays the default. The setting is a button at the top of the Settings tab that cycles the language and names the current one in that language (Language: English, click, Язык: Русский). On first run the mod guesses once, from the game's own selected language and then your system language, and records that it guessed so it never overrides a choice you make afterwards. This translates the mod, not R.E.P.O. — the game's own text is unaffected. Changing the language re-labels the button immediately, but the rest of the panel only picks it up the next time you open it.

  History's stored records, and everything moderators exchange to keep History in sync, stay English in every language, on purpose — that keeps an entry comparable across a mixed-language moderation team and useful pasted into a bug report, which is also why the History tab's own titles and filters are translated while the record text underneath is not. Diagnostics, its log dump, sharepermissions.log and the config file's own descriptions stay English for a related reason: they exist to be read by whoever is troubleshooting the report, not the player who filed it.

Changed

• The private channel's tab is now a microphone instead of a +. The tab was captioned + back when it was a catch-all for anything that did not belong on the other four; it holds one feature now, so it says so. The icon is drawn rather than typed — a microphone character would depend on glyph coverage in the game's font, and a font that lacks a character does not fall back to anything visible, it draws nothing.
• The Banned players list shows the ten most recent bans, with a Show all row under them. A host that has been running for a while accumulates bans indefinitely, and the whole Access tab sits in one scroll view — so the two sections above it ended up buried under a list nobody had asked to read in full. Click Show all to expand it and Show only the last 10 to fold it back; the section heading still counts every record either way, so the total is never hidden. This is a display choice, and it is kept separate from the "list was shortened" note, which still means something was genuinely dropped and needs the panel reopened.
• The History pager keeps < Prev and Next > on screen at the first and last page. They used to disappear there, which re-spread the whole bottom row under the cursor at exactly the end of a run of page turns — the button you were clicking slid sideways or vanished from under the pointer. They now stay put and render as unavailable, and clicking one gives the game's own "nothing there" click.

Removed

• Announcements. The host's message field and its Send announcement button are gone from the mod, along with the toast they put on every player's screen. Announcement records already written to your History stay readable exactly as they were — they still carry their own title and colour — but no new ones can be made. A host still running an older version can no longer announce to this build; nothing breaks, the message is simply ignored.

Fixed

• Scrolling to the end of a tab no longer leaves a blank strip under the last row. The real cause was that the panels were measuring themselves as far taller than they are. Rows off the top or bottom of the view are switched off to save work, and a switched-off row never got around to applying the compact height the mod asks for — so it sat in the layout at the full height of its own text instead. On a long tab that is most of the rows at any moment, and all that phantom height went into the scroll range: you could scroll well past the last row into empty space. Row heights are now set the moment a row is built, so a row that is never on screen still measures correctly. Two smaller faults in the same area went with it — the mod's scrolling had lost the bounds check that stops the wheel running past the end (which also left a dead zone, where every notch past the end had to be scrolled back before anything moved), and the scroll range was derived from one measurement of the scrollbar while the code using it read another. And as a backstop for all of it, the view is now simply held to where the content actually ends, so it cannot scroll past the last row however the scrollbar underneath it is behaving. The strip grew with the number of rows, which is why Access and Settings showed it worst.
• The bottom row of the moderation panel lines up. < Prev, Page X/Y, Next > and Close did not sit on one line. The row had been trusting a rule — that a caption always sits a fixed height above its control, so controls sharing a bottom edge line up on their own — which turns out not to hold: the mod's labels and buttons are built from different templates and shaped by different code, and even the buttons disagreed with each other — each caption's text box is built to fit its own text, and each one centres inside its own box, so no two captions of different text ever sat at the same height, and the page counter's box was positioned differently again. The row now gives every control one shared height and one text alignment, then measures the rendered baselines and nudges out anything still out of line. It also re-checks itself for a frame or two after opening: the first render happened before some of the controls had finished setting themselves up, which is why the footer looked wrong until you changed page and right from then on.
• Rows no longer go missing from the upper part of a panel. Rows scrolled out of view are switched off to save work, and the check deciding which ones are off-screen was comparing two measurements taken in different units — so on the menu's own scale it kept only a thin strip near the bottom alive and switched off rows that were fully in view. The panel showed a few rows at the bottom and blank space above them, until some unrelated interaction happened to re-run the check. The mod now leaves those rows alone: only the tab you are looking at is built into the view at all, so there was never much to save.
• One notch of the wheel now scrolls the same distance on every tab. The step the game falls back to is derived from a content height measured once, when the panel is built and before any tab has been chosen — so it was computed from all five tabs' contents at once and never revisited, while the distance that step actually travelled depended on how much the current tab happens to hold. The result was a wheel that felt fast on a long tab and sluggish on a short one. The panels now set their own step: two rows per notch, everywhere.

2.6.0

Never published to Thunderstore — it was packaged but not uploaded, so everything below reached players as part of 2.7.0 instead. Kept as its own section because that is when the work was done.

Added

• The channel's list shows who actually turned up. Being put on the private channel and arriving on it are two different things, and until now they looked identical: a moderator whose client never connected — because it is running a version from before the channel existed, or because the connection simply failed — appeared on the corner list like everyone else, just permanently quiet. Members now confirm they reached the channel, and anyone who has not is shown in grey, both on the corner list and on the host's 1 on 1 rows ((not on the channel)). Grey is deliberately not the red used for muted: a muted member is present and can hear you, an absent one is neither. A host running an older version reports nothing, in which case no markers are shown at all — "we cannot tell" is not the same claim as "something is wrong".
• A Diagnostics section at the bottom of the Settings tab. A live readout of the things worth knowing when something misbehaves: your version, your role, whether your moderator token was accepted, what the host advertised it can do, the private channel's state and epoch, whether your link to it is connected, how many members are missing, your microphone's capture format, whether the game's audio processing was mirrored onto the private stream, and every mod user with the version they announced. Write diagnostics to log puts the same block into sharepermissions.log in one piece, for pasting into a bug report. The channel's room name is never shown or written — it is a credential, so only a short fingerprint of it appears.
• Mod version is announced between clients. Each client now tells the host which version it is running, and the host passes that on, so moderators see it too. A Members row shows a version only when it differs from your own — the row is width-constrained, and a mismatch is the case that actually explains why someone cannot use a feature the rest of the team has. The full list is in Diagnostics.

Fixed

• Leaving the lobby no longer keeps you on the private channel. The channel's room name is its only credential, and it was re-rolled when a moderator was demoted but not when one simply walked out — so a member who left the lobby kept a working key and could go on listening. A member leaving now re-keys the channel. Departures are coalesced over a couple of seconds, so a whole lobby emptying at once costs the remaining members one reconnect rather than one per person. (A 1-on-1 was never affected: losing the partner already closes it outright.)

Changed

• The README's private-channel limitations no longer claim the channel carries raw microphone audio with the game's echo cancellation, noise suppression and gain control bypassed. That stopped being true in 2.4.1, when the game's audio processing began being mirrored onto the private stream.

2.5.0

Added

• 1-on-1 private channels. Besides starting the private voice channel for the whole moderator team, the host can now open it with a single chosen moderator: the + tab lists every moderator with a 1 on 1 row — one click starts the pair, clicking another name switches to them, clicking the current partner stops it. The rest of the team hears nothing and gets no notification (the shared History still records an unnamed open/close); a 1-on-1 also ends by itself when that moderator leaves or is demoted. Every start and switch re-keys the room, so nobody who just dropped out of the channel can keep listening.

Changed

• The channel's corner list shows a live volume bar and who is muted. Each member's row now carries a small level meter that moves while they speak — who is talking and how loud, at a glance — and a muted member shows up in red (name and meter both). Mute state is shared between the channel's members only, over the channel itself; it never touches ordinary players.
• The game's own mute is the private channel's only mute. The native mute key (B by default) and push-to-talk now govern the private channel exactly as they govern ordinary voice chat — one key, muted everywhere, and the mute key shows you red on the corner list (resting push-to-talk shows as an idle bar instead: it isn't a mute). Previously the channel had its own microphone mute on top, which made "am I muted?" a two-lever question.
• Private volume now defaults to 300%. The channel opens at full boost and is wound down from there, rather than up to it. A config file that already carries a saved PrivateChannelVolume keeps its saved value — move the slider (or delete the line) to pick up the new default.

Fixed

• A note's small print names the lobby, not a second person. The line under each note reads "author, lobby, date" — but the "lobby" part was the host's bare nickname (REPO rooms carry no human name of their own), so next to the author's nick it read as another person, and on a note about that very host it just repeated the player whose profile the note already sits on. Notes now record the lobby's real name — the one the server browser shows — falling back to a human-named room, and only then to "<host>'s lobby", which at least reads as a place. Old notes that stored a raw room id (a GUID or a Steam lobby number) stop showing it. The Access tab's "hosts who gave you access" lobby labels pick up the same convention from now on.

Removed

• The + tab's Microphone and Sound mute buttons, and their hotkeys. The private-channel mic mute (F4) and the channel sound mute are gone along with the [Hotkeys] config entries and the corner list's MIC OFF/SND OFF badges — the native mute covers the microphone side (see above), and the Private volume slider already reaches 0 for the listening side. Old config files keep the orphaned [Hotkeys] keys harmlessly.

2.4.2

Fixed

• Moderators stay moderators between games. A promoted moderator's token is saved and presented back to the host on every join - but the presentation ran exactly once, at an instant when the game often had not yet told the joining client who the host is. With nobody to look the token up for, the join said nothing, nothing ever retried, and the host had to promote the same people again every session. The join now simply keeps trying until the host is identified - a moment later in practice - and then presents the token, so promotions survive from game to game the way they were always meant to.
• The Access tab names the host who gave you access - from anywhere. "Hosts who gave you access" used to identify a host by name only while you stood in that host's lobby; from any other lobby, or the main menu, the row fell back to a bare Steam ID number. The host's nickname and their lobby's label are now recorded the moment a token arrives (and refreshed whenever you join them again), so every row reads as a person wherever you open it. Rows granted by older versions fill in the next time that host promotes you or you join their lobby.

2.4.1

Added

• Your own row shows your notes. Notes can be written about anyone - the host and moderators included - but nobody could open the page about themselves: clicking your own row did nothing. It now opens the notes view (for the host and moderators), so the host can finally read what the team wrote about them, delete any of it, or leave themselves a reminder.
• An overall volume control for the private channel. The + tab's "Private volume" slider runs from 0% to 300%: 100% is the level the game's own Master Volume and Proximity Voice settings deliver, below that quietens the channel, and above that genuinely amplifies it — louder than ordinary voice chat can go — for when a moderator's microphone is simply quiet. Unlike the two mutes, this one is remembered between sessions (PrivateChannelVolume in the config's new [Voice] section). It is local: it changes only what you hear from the private channel, never ordinary voice chat, and it is never sent to anyone.

Fixed

• The private voice channel is as loud as ordinary voice chat. It was noticeably quieter in both directions at once - you sounded quiet to the others and they sounded quiet to you. The channel copies your microphone from the game, but it was taking that copy before the game's own microphone processing ran, so the private channel sent the bare, unamplified signal while ordinary voice chat sent the same words after automatic gain control had brought them up to level. The private channel now runs your microphone through the game's own processing, with the game's own settings, so both channels sound the same. Voice-activity gating is deliberately left off for the private channel, so it still never clips the first syllable of what you say.
• Note rows fit the panel. A note on a player's page was drawn as one giant row: the caption at the menu's default button size instead of the list size, as wide as the unwrapped text (the hover highlight stuck out past the panel's edge) and with the author/date line clipped mid-way - taller still when the note was Cyrillic, which renders through the game's larger fallback font. Note text now wraps inside the panel at the same size as every other row, the row is exactly as tall as the wrapped text, and the whole row stays clickable to delete.
• Notes name the lobby by its host. Each note's "in which lobby" column stored the lobby's internal id - a 36-character serial number (REPO names every room with one), which is why a note's second line read like a licence plate. New notes record the host's nickname instead, and notes already carrying an id stop showing it.
• Cyrillic no longer collapses to an ellipsis in toasts. The game's font hands Cyrillic to its own NotoSansSC fallback, whose taller line metrics overflowed the toast row's vertical budget the moment the first Cyrillic letter joined the line - the label's ellipsis mode then cut the text right there. Toast rows and the private-channel HUD (same pipeline; a nickname starting with a Cyrillic letter would have blanked its HUD row entirely) now give the line box the vertical headroom it needs. Text position is unchanged and over-long lines still truncate at the right edge. A one-shot per-surface glyph dump with the measured font metrics ships with it, so any recurrence names itself in the log.

2.4.0

Added

• Host announcements. The Members tab gains a host-only message field: what you type appears as a toast on every player's screen and lands in History as an "Announcement" event. Only players running SharePermissions see the toast (the overlay is the mod's); capped at 120 characters with a 3-second cooldown.

• Player notes. The host and moderators can write notes about players ("griefed carts last Tuesday") that stick to the player's Steam ID, survive between sessions, and follow the moderation team across lobbies: when a moderator is promoted, their notes and the host's merge and every authorized moderator receives the combined set. Each note records who wrote it, in which lobby and when. Click a player in the Members roster to read or add notes (moderators get a notes-only page); players with notes carry a count next to their name, and a local toast reminds you when one joins. Notes go only to the host and current moderators - never to regular players. Stored in SharePermissions.Notes.json next to the config.

• A private voice channel for you and your moderators. Turn it on from the Moderation panel and you and your moderators hear each other and nobody else — at full volume, anywhere on the map, even through walls and even when one of you is dead. Everyone outside the channel simply stops hearing you, including players with no mods at all, and you stop hearing them. Talking in the channel does not attract monsters, and it never interferes with ordinary players attracting them as usual. Your ordinary microphone goes silent the instant you turn it on, so you can never be caught talking on the wrong channel by accident — the private channel itself takes a moment to connect, and the panel shows you when it's live. Switching off holds your microphone quiet for a moment longer too, so the tail end of a private sentence can't slip out into public chat. It covers microphones only: whatever you type in text chat is still visible to everyone, and it's still read aloud by everyone's own text-to-speech, exactly as before.

• See who's in the private channel at a glance. While your private voice channel is on, a small list of its members sits in the corner of the screen and lights up whoever is talking — you no longer have to open the panel to see who's on. Your own row is highlighted, and your talking dot only lights when your voice is actually going to the channel. Choose the corner, or turn the list off, on the Settings tab.

• A "+" tab for the private channel. The Moderation panel gains a fifth tab, captioned +, that owns the private voice channel's live controls — on/off, status, microphone, sound, volume — and the host's announcement field. The Members tab is a roster again. Nothing moved out of Settings.

• Mute yourself in the private channel, with a hotkey. The private channel now has its own microphone mute, separate from the game's mute key: you stay in the channel and keep hearing it, you just stop transmitting. F4 toggles it anywhere in the game (rebindable in the config's [Hotkeys] section, along with an unbound key for muting what you hear). The always-visible channel panel shows the state — MIC OFF / SND OFF in its title, and your own name dims while your microphone is muted — so a mute is never silent. Both mutes are local, never sent to anyone, and reset when the game closes.

Changed

• The player page inside the moderation panel no longer offers Kick, Ban or Ban (persistent). Those buttons duplicated what already exists elsewhere: the host's native kick and the moderator "x" in the player lists, and Kick/Ban in the Admin Menu. The page keeps Promote/Demote and the name color. Ghosts lose their ban this way ("x" is kick-only) - a returning ghost is simply kicked again.
• Ghost rows in the lobby player list are now on by default, so ghosts stay kickable there. An existing install keeps its saved ShowGhostRows value - flip "Ghost lobby rows" in Settings once if you had the old default.
• The flood auto-kick can no longer be set below 350 RPCs/second. The "Auto-kick over" slider used to start at 50/s, which sits inside the range an ordinary lobby-join burst can reach - a setting that low kicked innocent players. 350/s is now a hard floor in the config file too, not just in the panel, so an existing install (or a hand-edited .cfg) below it is raised to 350 on load. The default moves from 300 to 350; the drop limit, which only discards packets and never kicks, is unchanged.

Fixed

• The private voice channel actually connects now. It never did. The object holding the mod's second voice client was created during startup and destroyed by the game moments later, before any lobby existed, so every attempt to open the channel found nothing to connect with and the panel reported failed. Nobody had seen that word before, because the status line was also failing to draw its own text (fixed below) - the channel simply appeared to do nothing. Both are fixed: the client survives startup, and the panel says what state it is in.
• The private-channel status line shows its text. It was created empty and never written to, so the "live / connecting / failed" readout has been blank since it shipped.
• Toasts now render Cyrillic (and other non-Latin text). The game font is a static atlas with no Cyrillic glyphs, so Russian announcements, notes reminders and player names in notifications showed as missing-glyph boxes. Toast rows now chain a fallback font built at runtime from an installed system font (Segoe UI, Arial or Tahoma - whichever is found first): Latin text keeps the game's look, everything the game atlas lacks resolves from the system font. The game's own font assets are never modified, so native surfaces (menus, History, input fields) are unchanged.
• Name colors no longer follow you out of your own lobby. If you had hosted a lobby and picked name colors, joining someone else's lobby painted THEIR host (and any player you once gave a per-player color) with your old choices — permanently when that host does not run the mod. Colors now paint only in a room whose host actually advertised them, or on the host's own machine; in any other room the mod leaves every name exactly as the game drew it, and the Settings tab says "Not set by this host" instead of showing your leftover colors as theirs.

2.3.0

Added

• Moderators can use the R.E.P.O. Admin Menu. If you host with the Admin Menu mod installed, the players you have promoted to moderator can now open it themselves — no more relaying "spawn me a cart" through the host. It is off-limits to everyone else, exactly like the rest of the moderation UI, and a new Admin menu → Grant to moderators switch on the Settings tab turns it off again for the whole room the moment you flip it.

  Both machines need the Admin Menu mod: it draws its own menu, so there is nothing to unlock on a moderator who does not have it. Moderators in a lobby whose host does not run it (or does not grant it) see the menu stay locked, and their Settings tab says so.

  Effectively the whole menu works: the ten room toggles (infinite money, no break, weak enemies and the rest), the six per-player ones (god mode, no death, no target, no tumble, infinite stamina, force tumble), player upgrades, kill / heal / revive / crown / return-to-truck, teleport and summon, spawning items, valuables and enemies, and the map controls — level select, map enable, extraction points, level count and money.

  Things spawn where the moderator is standing, not where the host is, and "Teleport to player" moves the moderator rather than the host. Nothing about position or identity is taken from the moderator's machine: the host works it out from the connection the request arrived on.

  Kick and Ban inside the Admin Menu behave exactly like SharePermissions' own — the host still cannot be kicked, a moderator still only by the host, and it still lands in History and on the BanEnforcer list where applicable.

  Every accepted action is recorded in History as an Admin Menu event naming the moderator who did it, and written to the forensic log. They do not raise toasts — one visit to the menu can flip a dozen switches.

2.2.2

Fixed

• The escape menu's per-player voice list no longer snaps back to the vanilla column when another mod rearranges it. The mod was re-pinning every row to the stock position each frame, which undid anything a list-layout mod did to the page: with MorePlayerList installed, the row offset it applies was cancelled, its second column (players 10+) collapsed exactly onto the first so rows drew on top of each other, and scrolling the list with the arrow keys was silently reverted. Rows are now left wherever the game — or whichever mod laid the page out — put them; the game already keeps the list in one column on its own, and the moderator Kick "x" is attached to each row, so it follows. The list once again looks native: same rows, same places, plus an "x" where a kick is allowed.

2.2.1

Fixed

• A player could no longer be shielded from moderator kicks, or stripped of their own protection, by claiming someone else's Steam ID. Whether a target is a moderator — and so kickable only by the host — is now decided by the connection the host actually promoted, rather than by an identity the client asserts. Previously a modified client could make itself unkickable by every moderator, or make a real moderator kickable by their peers (including by the automatic flood kicker, with nobody clicking anything) simply by claiming their ID and then leaving.
• A moderator no longer sees a Kick button on the host's row, or on another moderator's row, while that player is still connecting. The button appeared on those rows and did nothing when clicked.
• The "Mod" button no longer overlaps the page title, or drifts away from it, when the game is not in English. Its position was measured once against whatever the title said at that instant, which could be the untranslated text; it now follows the title whenever that text changes.
• Moderators no longer see one misaligned row in the escape menu's per-player voice list. The row for the host (or for another moderator) sat 25px out of line with the rest, because the column that makes room for the kick button was being decided per row instead of once for the whole list. Hosts were never affected.
• Revoking an access token that more than one player holds (a leaked copy) now records every player it demotes. Previously only the token's recorded holder reached History, the forensic log and the moderator feed, so the other half of a credential-sharing incident left no trace.
• Revoking a token issued before 2.2.0 (one with no recorded holder) no longer files a History entry attributed to a Steam ID that does not exist. Those revocations now appear as their own Token Revoked event carrying the token's prefix.

Changed

• The Tokens tab is now the Access tab. "Token" was developer jargon on a screen meant for players: the tab is Access, its two sections are "Moderators you've promoted" and "Hosts who gave you access", and its buttons read "Revoke access" and "Forget access". Nothing about your config changed — the entries are still PromotedTokens and MyModeratorTokens.
• The Access tab reads in plain language and is mostly rows instead of mostly instructions. Both sections carry a count, as does the tab caption, and every tab in the moderation panel is now clickable across its whole column rather than only on the word.
• Rows say whether the holder is in lobby or offline and list everyone present first; your own access marks the lobby you are currently in and sorts it first.
• Access granted before 2.2.0 has no holder name. Those rows now render in gray with an explanation that they came from an older version, and they fill in the holder's name automatically the next time that player joins your lobby — no re-promoting and no config editing. A name already on record is never overwritten.
• Each row shows the first 12 characters of its key rather than a Steam ID — enough to match the row to its entry in your config file. A holder's Steam ID appears in the confirmation popup, where it is most useful. The full value is still never displayed anywhere, so the trailing "…" is deliberate.
• Revoking or forgetting access confirms inline that it worked. This matters most for forgetting your own, which previously gave no feedback at all.
• Revoking a moderator's access now uses the same orange confirmation header as demoting them from the Members tab, instead of the red reserved for deleting your own data.
• Counts beside a heading (like "History (200)") sit centred on the text instead of dropping to its baseline.

2.2.0

Removed

• The SecretCode mechanism is gone entirely. Installing the mod now enables it — there is no code to configure — and a matching code no longer grants moderator status. Moderators are host-promoted only (Members tab), carried by the private access token each promotion issues. The shared-code path meant anyone who learned the host's code silently became a moderator; every grant is now an explicit host decision. Breaking for shared-code groups: players who relied on a matching SecretCode must be promoted once from the Members tab. The old SecretCode and DeniedModerators config entries are ignored (safe to delete); demotions stick by token revocation alone.

Added

• Tokens tab in the Moderation panel. The host sees every access token it has issued — now labeled with the holder's name and Steam ID, recorded at promote time — and can revoke one with a click, which demotes the holder immediately and permanently. This also covers holders who are offline (the Members tab only lists connected players, so a departed moderator's credential previously could not be revoked in-game). Everyone additionally sees the tokens they hold from hosts that promoted them, and can forget one. Tokens are shown as short prefixes only, so a streamed screen never leaks a working credential.

Changed

• Re-promoting a player replaces their previous access token instead of accumulating a second live credential in the host's store. Tokens issued before this version are unlabeled and are not auto-replaced — they show as "(unlabeled)" on the Tokens tab, where they can be revoked. Demoting or revoking a player also fail-secure sweeps every other credential tied to them.
• PromotedTokens config entries may now carry the holder label (token:steamId:base64Name); bare legacy tokens keep working and show as "(unlabeled)" on the Tokens tab. Downgrading to an older mod version drops the labeled entries on that version's next change — re-promote after a downgrade.
• Old clients in the room log as before, but their legacy shared-code handshake (InitModerator) is now answered as an unknown command; promotion and tokens still interoperate with 2.1.x.

2.1.1

Fixed

• Automatic RPC-flood kicks no longer fire on transient traffic bursts. Actually kicking a flooder now requires the per-player RPC rate to exceed a new, much higher AutoKickRpcPerSecond threshold (default 300) — well above the RPC storm every client emits when someone joins the lobby — while the lower RpcFloodPerSecond limit keeps dropping suspicious packets locally but never kicks on its own. Previously a join-time burst could get an innocent player auto-kicked, appearing in History as a kick "by" a moderator whose client fired the request automatically. A moderator's client also no longer auto-requests the kick of a fellow moderator. The Settings tab now has a separate "Auto-kick over" slider for the kick threshold alongside the "Drop RPCs over" (drop) slider. Hosts who had lowered RpcFloodPerSecond for aggressive kicks: that value now only controls local dropping — set AutoKickRpcPerSecond (or the "Auto-kick over" slider) to your desired kick rate.

Changed

• The host log line for a ghost-player kick now names who requested it (moderator name, Steam ID, actor number) and its origin — a manual moderator action versus an automatic RPC-flood auto-kick — so an unexpected kick can be attributed from the console instead of being anonymous.

2.1.0

Added

• Nickname colors, set by the host: one color for the host's name, one for moderators', plus a per-player color for anyone the host picks (Members > a player > Set name color). Chosen from the game's own color palette or by typing a hex value. The colors reach every player running the mod, and now show in-game on the floating name above a player's head, as well as on the escape menu's per-player volume rows and in the lobby list. The Settings toggle that used to be "Moderator name color" is now "Name colors" and covers all three surfaces; it remains your own display preference.

Changed

• Moderator promotion is now spoof-proof. The host issues each promoted player a private capability token (new PromotedTokens / MyModeratorTokens config entries, managed automatically); promoted moderators re-authorize with it on rejoin, and every privileged command is verified against the live connection instead of a claimed Steam ID (which any client can forge). Upgrading hosts: promotions stored in the old GrantedModerators list are not migrated — re-promote those players once from the Members tab (the old entry is now inert and safe to delete).
• Non-host moderators can now edit their own local Interface and History preferences in Settings (head markers, name colors, ghost rows, talk dot, history persistence) — previously view-only. Flood protection and the secret code remain host-controlled.
• History search no longer re-parses every entry on each keystroke (cached), and long-lived lobbies no longer accumulate per-actor state for players who have left.
• Hardened against a ModHello flood: an unauthenticated client can no longer loop the presence ping to amplify the host's outbound traffic and disconnect it (per-actor cooldown).
• Removed dead code, unified duplicated layout constants into ModStyle, and quieted per-send network logging.

Fixed

• Moderators had no kick button on the in-game escape menu — the game's own button is host-only and hides itself for everyone else. Moderators now get the mod's Kick/Ban button there, on the same rules as the lobby rows.
• The host's escape-menu kick banned outright, with no Kick-or-Ban choice and no History entry (it called the game's ban directly). It now goes through the mod like every other kick.
• Moderator status no longer leaks between lobbies. Leaving a room now reliably resets the mod's roster, identity and history state, and joining a room always starts clean — previously a moderator from one lobby kept seeing working-looking moderation controls in the next lobby while its host rejected every action.
• RPC-flood protection can no longer be switched off by a hostile client. The moderator exemption and the auto-kick both now key on the unforgeable connection rather than a claimed Steam ID, so a client asserting a moderator's ID can neither opt out of the flood check nor get an innocent player kicked in its place.
• A blank SecretCode now genuinely disables the mod: with no code set, the host's kick/ban buttons no longer replace the game's own — matching what the setting has always promised.
• The live moderation-event feed is delivered by connection, so a client spoofing a moderator's Steam ID can no longer receive the host's kick/ban history.
• Host migration now clears the departed host's moderator roster and re-runs the join handshake against the new host, so a client is no longer left showing moderator controls the new host rejects — and persisted grants, matching-secret grants and the "Ban (persistent)" option become active immediately instead of staying dormant until the next player joins.
• History detail showed the wrong Steam ID for any player whose name contains parentheses (e.g. "Bob (BRB)"), and a crafted name could plant a fake but valid-looking Steam ID onto the detail Steam button and the Copy-to-ban-list text. The parser now binds the genuine ID and ignores fields forged inside a player name.
• Pressing Esc to close the "Manage Member" popup could freeze the Members roster (joins, leaves, role changes and talk dots stopped updating). Esc now runs the same close handling as Close.
• Ghost lobby rows could show a dead duplicate kick "x", and could offer a Kick button on the host's or a moderator's ghost row that the host silently rejected. Ghost kicks now use the same host/moderator-target gates as real rows, and the stray button is purged.
• The persisted history file grew without bound and was fully re-read every launch; it is now compacted to the display window at startup.
• Live-synced history entries could be dated to "yesterday" under ordinary host/client clock differences; the embedded time is now read as its nearest occurrence (tolerant to ~12h skew).
• Hand-edited moderator config (the denylist, and the new token entries) was ignored at runtime and could be overwritten on the next change; edits made with a config-reload mod are now honored live.
• Head-marker materials leaked on every tier change and avatar despawn; they are now destroyed with the marker.
• Row-caption and name truncation could split a Unicode surrogate pair, leaving a broken glyph.

2.0.0

Everything since 1.2.0, collapsed — the versions in between were never released.

Added

• In-game moderation UI: a blue "Mod" button in the lobby and pause menus opens a panel with Members | History | Settings tabs, and each lobby row gets a Kick/Ban button for the host and moderators (kept in sync live as rights change). Moderators also get the game's own Start button and a confirm-gated "< Lobby" return button (mid-run only).
• Members tab: every connected player with their role (Host / Moderator / Mod user / No mod) and a talk indicator. The host promotes and demotes moderators here; grants and demotions persist across sessions, and a demotion sticks even if the player has a matching SecretCode.
• History tab: a paginated, searchable, filterable log of moderation events (kicks, bans, floods, moderator changes, start/lobby requests) with severity colors and a detail view with labeled fields and a Copy button. Persists across sessions and syncs to moderators; the plain-text forensic log (sharepermissions.log) has its own toggle.
• Settings tab: flood-protection thresholds, interface toggles (head markers, ghost rows, talk dot, moderator name color), history settings with a confirm-gated "Clear history", countdown length and back-to-lobby confirmation, and in-game SecretCode change.
• On-screen notifications: the host and moderators get a toast for every moderation event (lobby, truck, and in-level), and players promoted or demoted mid-session get a personal notice. On/off and time on screen in Settings.
• Run-start countdown: starting a run counts down on the Start button so everyone gets a moment to ready up; the host and moderators cancel it with a single click, and it auto-cancels while someone is joining. Lobby / StartCountdownSeconds (default 5; 0 = instant start).
• RPC-flood protection: a player spamming RPCs — too many per second or a single oversized one (RpcMaxBytes) — has their traffic dropped on every modded client and is auto-kicked by the host. Lobby-only, enforcing by default, moderators exempt; a flooded client keeps its connection alive long enough for the kick to land, and a flooded moderator's client asks the host for the kick.
• Ghost rows: connected players with no avatar yet show as kickable "[GHOST]" lobby rows that behave like real rows — silhouette avatar, talk wobble and light-up, eye tracking, their own ping. Off by default (enable in Settings); members whose name has no visible characters (join/leave artifacts) are never shown.
• Role head markers in the lobby and truck: gold crown (host), blue gem (moderator), small dim diamond (anyone else running the mod) — replacing the old moderator sphere; nothing shows during levels.
• BanEnforcer integration: with Omniscye-BanEnforcer v4+ on the host, the player-action popups and the Members tab gain Ban (persistent) — writes the target to the host's persistent ban list and removes them from the room; moderators can request it. Detected at runtime, not a dependency.
• Companion mod LoadingWidget (separate install; it depends on SharePermissions): the loading-screen moderation panel — per-player load state, who's talking, per-player local voice volume, Kick/Ban, and a "Lobby" / host-only "Force" rescue for stuck loads — built on the public SharePermissions.Api.LoadingWidgetBridge.

Changed

• An unset or empty SecretCode now disables the mod for you (previously it silently granted moderation to anyone running the mod with default settings). A matching code still grants moderator automatically on join, and the host can also promote players from the Members tab without sharing any code.

Removed

• Per-player mute and its menu actions.
• The separate "Mod" menu and the loading-screen voice-activity overlay (superseded by the in-lobby moderation UI and LoadingWidget).

1.2.0

Changed

• Start game and Back to lobby follow the current game's own flow (fixes wrong save slot / level and properly locks the lobby on start).
• Only validated moderators get the [M] marker and head sphere; the host is no longer specially decorated.

Added

• The host can kick or ban a moderator (with an extra confirm).

Removed

• The "spoofed player" Mod-menu section (invalid avatars are simply hidden; ghosts are still listed and kickable).

Fixed

• Ghost-player kicking now uses the game's own kick/ban events — removal works like a normal host kick, and Ban actually bans.

1.1.0

Fixed

• Works again on current R.E.P.O. and MenuLib 2.5.4.
• Muting the host no longer blocks the host's kick messages.
• The host no longer crashes on malformed/hostile mod messages.
• Mute takes effect even before a player's character has spawned.
• Player names can no longer inject formatting into the kick/ban popups.
• The voice indicator icon no longer renders as "??".
• The Mod menu recovers if it was open during a level change.

Improved

• Large performance cleanup: no per-voice-packet player scans, per-frame menu scans, or GUI allocations during loading screens.

1.0.0

• Initial release: share kick/ban/start-game/return-to-lobby permissions with trusted players via a shared secret; ghost/spoofed player detection; per-player mute; voice activity overlay during loading.