ANetBBS Changelog

Current release: v1.1.3 (September 2026). This file covers v1.0.0
onward, which follows standard semantic versioning — patch releases are
v1.0.1, v1.0.2, and so on. The full internal beta build-number
history (v1.0a1.1 through v1.0b2.239) that got the project to this
release is preserved in
CHANGELOG-beta.md.

v1.1.3 — Sysop-controlled password recovery; MSP directory in the terminal; MRC mentions fixed in every theme (September 2026)

Password recovery is no longer a fixed, mandatory 3-security-question step. A sysop can now edit or retire individual questions, add new ones, and turn the whole security-question step on or off from Admin → Users → Password Recovery in the web UI — and that same control has also been added to the anetbbs-cfg terminal admin tool (Users & Security → Security Questions / Password Recovery Settings), so it's no longer a web-only capability. Email-based recovery already existed underneath (a reset link is sent automatically whenever SMTP is configured), but is now shown explicitly as its own recovery method on that same settings page, alongside the security-question toggle. Turning the security-question step off skips it entirely at registration and during a password-reset request, landing straight on a neutral "check your email" confirmation — the exact same page and wording whether or not the entered account actually exists, preserving the anti-enumeration protection that recovery flow already relied on.

Native SSH/telnet users can now browse the InterBBS (MSP) directory of known BBSes — a new V) BBS Directory entry on the main menu, using the same scrollable lightbar list already used throughout the rest of the terminal UI. Selecting an entry shows a full detail screen (sysop, location, software and version, MSP/SYSTAT ports, last seen, and any notes) rather than jumping straight into composing a message; sending a message still has its own directory picker built in. Previously this was only browsable from the web UI.

Fixed the terminal MRC chat mentions counter staying stuck at 00 in every theme except the default one (original/minimal/bitchx/2leet4u/least — the five "Mystic BBS"-style layouts). Those themes render through a separate status-bar drawing path that never actually wrote the live count into the screen position their own bundled art reserves for it, so it displayed whatever the static border art happened to bake in there and never changed no matter how many real mentions came in.

v1.1.2 — Security/audit pass on the new umrc-client support; install docs reorganized (September 2026)

A full review of the native umrc-client support added over the last couple of releases found and fixed two real gaps in its raw-TCP listener: the newline-delimited packet read loop had no cap on buffered bytes while waiting for a line terminator (the same unbounded-buffer bug class already closed elsewhere in this project — BinkP, the MRC↔IRC bridge, both IRC clients, QWK — just missed here since this listener is brand new), and the notice-expiry task added in the previous release wasn't tracked or cancelled on disconnect the way every other background task in that code already is. Both fixed and covered by dedicated regression tests. Neither was reachable by anything beyond the local box under this feature's loopback-only default.

Documentation pass alongside the review: docs/PORTS.md, docs/SECURITY.md, and the Docker Compose walkthrough now cover the umrc-client listener's port and security posture, which had been missed when that feature first landed; a stale "untested" note on TradeWars support was corrected (it's been launch-confirmed for a while); and a few lingering "nothing's published to a registry yet" lines were cleaned up in the Docker docs — pre-built images have actually been published on every release for a long time.

Also reorganized how the README and Quick Start guide present install options — a short table up top now points straight at whichever path fits (Linux with sudo, Linux without root, Docker, or Windows) instead of only surfacing the Linux path by default.

v1.1.1 — MRC login/logout alert no longer sticks on screen inside chat (September 2026)

Fixed a bug where the classic " X just logged in/out " alert (shown wherever a caller currently is in the BBS when someone else logs in or out) could stay on screen indefinitely once shown inside terminal MRC chat, instead of clearing on its own. Root cause: that alert writes directly into whatever the caller's screen is currently showing, but MRC chat manages its own fixed status-bar/scroll-region layout — the raw write landed somewhere MRC's own screen-drawing logic didn't know about, so it only ever got papered over by the next unrelated bit of chat activity, which during a quiet room could take a while. Now integrated into MRC chat's own display properly and auto-clears itself 30 seconds after it appears, regardless of how quiet the room is.

Also confirmed both Windows install paths in docs/INSTALL-WINDOWS.md (WSL2 and Docker Desktop) end-to-end on a real Windows machine — that page no longer carries its earlier "unconfirmed" caveat.

v1.1.0 — Web MRC multi-line sending; uMRC live-testing fixes (September 2026)

The web MRC chat client can now send messages longer than the old ~140-character single-line limit. Instead of silently blocking the Enter key or refusing to send ("Message too long"), a long message is now automatically split into multiple word-boundary "(1/3) ..." chunks and sent in sequence, matching how the terminal MRC client and uMRC itself have always handled this. Covers both web MRC clients that ship with ANetBBS. Join-rejection and similar chat errors also now show a brief on-screen notice instead of failing silently.

Fixed a bug where joining chat through the web client could show a duplicate "has arrived" line for the same caller and appear to join a room, immediately demand /identify, then silently rejoin — all from one connection. Root cause was a packet-ordering mismatch against real uMRC client behavior: the bridge was requesting room data before telling the network the caller's IP, instead of after. Also fixed a related case where the room's message-of-the-day and current-user list could be shown twice (or three times) for a single join, and made a manual /join naming the room you're already in a true no-op instead of silently leaving and rejoining it. Installs running their own separately-managed nginx reverse proxy (uncommon, but the original ANetBBS install itself is set up this way) could also show a falsely-optimistic "joined" state before the network actually confirmed it; fixed.

Confirmed room names on the real MRC network are case-sensitive — a sysop's custom rooms that differ only by capitalization ("Lobby" vs. "lobby") are genuinely separate rooms, same as they've always been. The one real related bug: the web client's own default room selection didn't match the network's own lowercase name for that specific well-known default room, so joining with nothing typed could land in the wrong room; fixed at that one narrow spot.

v1.0.99 — Native uMRC (umrc-client) support on the MRC bridge (September 2026)

Added the option for ANetBBS's own MRC chat bridge to also accept direct connections from uMRC's umrc-client door, so a sysop running both no longer needs a separate umrc-bridge process alongside it — one shared bridge now serves ANetBBS's own terminal/web MRC clients and uMRC callers together, with correct private messaging between all of them, and no changes required to uMRC itself. Also adds optional support for the small local stats file umrc-client's own menu reads, populated from the real MRC network's own live BBS/room/user counts. Off by default; see docs/27-mrc-chat.md for full setup, including a couple of easy-to-hit misconfigurations (now with a startup warning for one of them) worked out during testing.

Also fixed, found along the way: mrc/bridge/config.json's log_level setting never actually had any effect, on any install — editing it and restarting silently did nothing. In-chat latency now reaches umrc-client sessions too, not just the web/terminal clients (it was silently never sent to them at all). A join-time server banner could get sent to every other locally connected chat session instead of just the person joining, most noticeable with two or more people in chat at once — not specific to uMRC, an existing gap this testing happened to surface. The terminal MRC client's bell also used to keep ringing every time a mentioned/DM line got redrawn (a resize, a scroll, another new message) instead of only once when it arrived; fixed, and a new /sound on|off preference lets a caller turn the bell off entirely, mirroring uMRC's own "Use sound" setting.

Bigger fix from the same round of testing: callers could need to re-/identify far more often than expected, even though MRC Trust is meant to last weeks. Root cause was a reconnect-ordering bug — the bridge announced itself ready to the rest of the app (which re-announces every previously-active caller to the room) before it had actually told the upstream MRC network which BBS it even was, so those re-announcements arrived before the network had anything to recognize the caller's trust against. Fixed by finishing the bridge's own handshake first.

v1.0.98 — Codebase-wide audit for the dead-connection freeze/hang bug class (September 2026)

Following the previous two releases' fixes for a dead-connection freeze/spin bug, did a full audit pass across the rest of the codebase (door games, echomail/BinkP, MRC chat, IRC, finger, rlogin/SSH/telnet) for the same underlying shape. Found and fixed a handful of places where output could still hang indefinitely on a connection that stopped responding without actually closing: several screen/animation-drawing paths and the telnet protocol-negotiation reply in the terminal session layer, the finger service's reply, and the MRC bridge's connection to its upstream chat server (the last of these is a single connection shared by every locally connected chat user, so a hang there could have silently affected more than one person at a time). Everything else checked came back clean. Each fix has dedicated regression coverage proving the affected code now recovers with a bounded timeout instead of hanging.

v1.0.97 — 3 more dead-connection freeze/spin gaps closed (September 2026)

Continuing v1.0.96's fix: a dead connection (network drop, a client left open and unreachable) could still cause a freeze or a silent, indefinite CPU/resource drain in three other places that share the same underlying cause. A menu-navigation keystroke read could raise an uncaught low-level error instead of ending the session cleanly. The idle-warning/screensaver sequence could loop forever once a session reached it on a connection that had already died, since neither its write attempts nor its own keystroke-poll recognized the connection was gone. And the built-in IRC client's connection to the remote IRC server could get stuck retrying a keepalive against a server connection that had already failed, instead of ending that connection. All three are fixed, each with regression coverage proving the affected code now ends cleanly instead of looping or raising an unexpected error.

v1.0.96 — Critical: a dead connection inside ANEView could freeze the whole BBS (September 2026)

Fixed a critical bug where a client connection that died without a clean close (a network drop, a client left open and unreachable overnight) while inside ANEView, the read-only echomail message viewer, could spin the server's main thread at effectively 100% CPU indefinitely — starving every other session, growing memory usage without bound, and flooding the system log, until the service was manually restarted. Traced to two issues: a broad exception handler that treated a dead connection the same as "no key pressed yet" and kept retrying instead of ending the session, and a related gap that made it hard to tell a genuinely expired wait apart from a connection that had already failed with a real error, causing the retry to also repeatedly attempt (and fail) a write on every pass. Both are fixed, with regression coverage proving the affected code path now ends the session immediately and cleanly instead of looping.

v1.0.95 — New-account password-confirmation fix over telnet/PuTTY; Docker admin-account docs (September 2026)

Fixed a bug where creating a new account (or changing a password) over
telnet with a client that sends \r\n for Enter — PuTTY, plain
telnet, most terminal emulators — always failed at the "Confirm
password" step with "Passwords don't match," even when typed
identically both times. SyncTERM and similar clients that send a bare
\r were unaffected, which is why this depended on which client was
used to connect.

Also documented how to find/log in with the auto-created initial admin
account on the Docker install paths (docs/22-containers.md) — it was
never obvious from a container that one gets created at all, or where
to find its password.

v1.0.94 — Native uMRC (umrc-client) support on the MRC bridge (September 2026)

Added the option for ANetBBS's own MRC chat bridge to also accept
direct connections from uMRC's umrc-client door, so a sysop running
both no longer needs a separate umrc-bridge process alongside it —
one shared bridge now serves ANetBBS's own terminal/web MRC clients and
uMRC callers together, with correct private messaging between all of
them, and no changes required to uMRC itself. Off by default; opt in
via mrc_tcp_enabled/mrc_tcp_listen_host/mrc_tcp_listen_port in
mrc/bridge/config.json. See docs/27-mrc-chat.md for setup.

Not yet tested against a real umrc-client/fresh install — held back
from the normal release train until that verification happens.

v1.0.93 — Who's Online showed a raw game id/slug instead of the door's name (September 2026)

Fixed a bug where launching a door directly from a numbered/slug menu
item (rather than through the Game Center's category browser) showed
its raw id or slug in Who's Online instead of the door's actual name,
for the entire session.

v1.0.92 — Single-container Docker quick start was missing the MRC bridge config mount (September 2026)

Fixed the single-container Docker "quick start" instructions, which
never mounted the MRC chat bridge's own config file — it silently fell
back to placeholder BBS/sysop name values regardless of what was set
in .env. Also added a startup warning in that container if the file
still isn't mounted.

v1.0.91 — Door dropfiles now report the real terminal size (September 2026)

Fixed a bug where CHAIN.TXT and BBSDEV.DRP dropfiles always reported an
80x24 screen size regardless of the actual session's terminal
dimensions, so doors reading those formats never saw a wider/taller
terminal even when the rest of the session correctly used it.

v1.0.90 — IRC disconnect CPU/memory fix, SSH keepalive tuning (September 2026)

Fixed a bug where a dropped connection to the built-in IRC client could
spike CPU usage and grow memory indefinitely instead of ending the
session cleanly. Also loosened SSH keepalive timing to tolerate a
client that's intermittently unresponsive rather than fully gone, and
added clearer logging for why an SSH connection actually ended.

v1.0.89 — Reduced background monitoring overhead / quieter disconnect logging (September 2026)

Reduced how often the sysop dashboard's per-service monitoring spawns
external processes to check service status, cutting continuous system
overhead that could compound under load. Also quieted some redundant
error logging when a client disconnects at specific points during
session teardown.