| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| | |
|
| | |
|
| |
|
|
| |
Adds robots.txt with Disallow: / plus noindex/X-Robots-Tag on the site and app. The v5 server treats an HTTP request as a malformed frame, closes silently before HELLO, and suppresses the common TLS scanner noise. Deploy now verifies robots.txt.
|
| |
|
|
|
|
| |
The browser now uses the desktop's full-width game split: no extra game header or card frame, a full-height sidebar with a pinned action block, and the same lobby grid, topbar account/balance blocks, and bottom-left notices. Slots uses the desktop symbol colours and gold win border; roulette gets the flat felt, column bets under the dozens, the wheel, circular chips, and a LAST line; blackjack gets a centred dealer/player table and divider; crash gets the chart panel, phase label and empty ready state.
Also drops every play-money/real-money disclaimer from the page copy.
|
| | |
|
| |
|
|
| |
scripts/dev-web.sh builds the server, gateway and app, creates target/dev-web/identity, and runs the game server, webd and a loopback static server. The app accepts a ?ws= override only on loopback so the page and gateway can sit on different local ports; production stays same-origin at /ws.
|
| |
|
|
| |
The browser footer links the public repository. ZAGAN_WEB_ORIGIN is lowercased for origin matching, and the pinned fingerprint accepts the colon-separated form operators often copy.
|
| |
|
|
| |
Also documents the __Host- cookie prefix used on HTTPS.
|
| |
|
|
| |
The gateway hello now carries the core's last known balance alongside the user, so a refresh on a non-game view does not blank the header before the next INFO reply.
|
| |
|
|
|
|
| |
The Rust SlotsView serializes reels as an array of chars, so the browser joins it instead of String(array). The crash chart, reel animation and roulette observer now stop when another screen takes over, and a returning crash screen rebuilds its detached canvas. Action buttons ignore a double click before the server view arrives.
Also tightens the gateway session registry with a generation token, caps WebSocket messages at 64 KiB, uses the __Host- cookie prefix on HTTPS, and ships the systemd unit.
|
| |
|
|
|
|
|
|
|
|
| |
Protocol v5 replaces newline lines with bounded [u32 len][text] frames and REQ/RES/EVT envelopes. Requests carry correlation ids and the server replays the last 256 replies per connection, so a gateway retry cannot double-debit and a late reply cannot clobber a newer request. HELLO/PONG carry server time; crash rounds announce started_at and push coalesced 10 Hz ticks. Crash now commits sha256(seed) before a round and reveals the seed when it ends, so clients recompute the crash point.
Adds the webd/ gateway: one blocking thread, one ClientCore and one pinned upstream TLS connection per session, an HttpOnly session cookie, takeover, and a 60-second grace window. The browser sends Command JSON and renders View JSON; it never speaks the game protocol or stores credentials.
Adds the vanilla TypeScript browser app at /play/ (login, lobby, all four games, history, notices, crash verification), the nginx /play and /ws routes, and the headless DOM smoke test. webd and the app stay out of the TUI/GUI/server build graph.
The client/server version moves to 5.0.0 in lockstep; v4 peers are refused at HELLO.
|
| |
|
|
| |
nginx example now routes index.php and latest.php to php-fpm, sends the newest-version feed with no-store, keeps the stable installers revalidated, and returns 404 for every other .php request so releases.php cannot be downloaded as source. Documents Debian and Arch pool sockets.
|
| |
|
|
|
|
| |
Adds web/latest.php: a plain-text feed of the newest version with each artifact's filename and SHA-256. The per-release generated installers are replaced by stable web/install.sh and web/install.ps1; both read the feed, pick the newest build, verify it, install per-user and add a launcher. Publishing a new app version no longer regenerates or versions the installers.
publish.sh drops the installer renderer and Python dependency. deploy.sh now also verifies latest.php against the local artifacts and that the served installer scripts match the repository.
|
| |
|
|
|
|
| |
Windows 10 1809 sessions with only the Microsoft display driver expose OpenGL 1.1, which egui_glow refuses. The Windows build now uses wgpu on Direct3D 12 and its adapter selector accepts WARP, the software rasterizer, after every hardware class, so a VM or Remote Desktop session still starts. Linux keeps the smaller glow renderer.
The GUI is a windows-subsystem binary now, so launching it from the Start menu does not flash a console; startup failures and --help go to a native message box. The PowerShell installer pauses before closing unless -NoPause is passed.
|
| |
|
|
|
|
| |
publish.sh builds the GUI with the gui-release profile, names it zagan-bet-gui-<version>-<platform>-<arch>, and renders a bash and a PowerShell installer next to each app. Both embed the app's SHA-256, verify the file (or fetch it), install per-user and add a launcher: a desktop entry plus an SVG icon on Linux, a Start-menu shortcut on Windows.
The download page gains a Desktop app section with the apps and installers, keeps the terminal client and server, links the public git repository for the GPL source, and lists every file in the sha256sum block. deploy.sh verifies all four artifact kinds. Publishing refuses a dirty tree so the linked history matches the binaries.
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
target triple
|
| | |
|
| | |
|
| |
|
