horizon-bots is a load client on horizon-protocol for any 26.3 server: offline login, configuration,
keep-alives, pings, teleports, chunk-batch acknowledgements, and movement at 20 Hz. The bots play in
creative and fly above their spawn point, so they need no world of their own and no server refuses their
moves; idle, walk, explore and mixed behaviours are deterministic from a seed.
tools/server_bench.py runs the same bots on Horizon's server (horizon-server run) and on the pinned vanilla
jar, each fresh from the same server.properties, and measures MSPT from each server's own /tick query,
RSS and CPU of the process tree, the chunks the bots receive, and the start time.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`backup [NAME]` zips the world and the settings into backups/; on a running server it turns saving
off, flushes, zips and turns saving back on, so the game stays up. `restore BACKUP` puts a backup's
world in place and keeps the current one in backups/replaced-<time>/; a running server restarts with
it. `[backups] every = "6h"`, `keep = 12` in server.toml back up on a schedule and prune the
automatic backups only. The control API gains GET/POST /api/v1/backups and POST /api/v1/restore.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The supervisor serves a small HTTP API on 127.0.0.1 (a token in .horizon/api.json, mode 0600, and a
Host check): status, logs, console commands, stop and restart. `start` runs the server in the
background and returns once the game is up; `restart` and `cmd` wait for it too. A sampler reads the
game's tick rate, tick times, players and chunks every second over the existing control endpoint
(`--control-socket`), and RAM and CPU from the system.
The dedicated loop now records its tick times in the game clock, so `/tick query` reports real
numbers on a dedicated server, as it does in single player. The changes to game/dedicated.rs are
additive: the log capture for command replies, the tick counter and the control requests
(game/dedicated/status.rs).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The first part of hosting a Horizon server with one small program
(docs/server.md). horizon-server is a new 1.3 MB binary with no window,
GPU, audio or controller code; it runs the game headless
(horizon-client --dedicated) as its engine.
- horizon-server-files: server.properties, eula.txt and the user lists,
moved out of horizon-client unchanged so both programs share vanilla's
exact reading and writing; horizon_client::server re-exports it.
- server.toml: typed settings for what owners change, [properties] for
any other vanilla key, vanilla 26.3's defaults (a test checks them
against ServerProperties). It is written into server.properties before
every start; keys the game changes there itself (/whitelist on) are
copied back afterwards, keeping the owner's comments (toml_edit).
`import` turns a vanilla server.properties into server.toml.
- init: the EULA (only a yes writes eula=true), world, seed, port (checked
free), whitelist and first operator; every question has a flag, so it
also runs unattended.
- run: the console on stdin, a clean `stop` on Ctrl-C, SIGTERM or SIGHUP
(the game runs in its own process group), and a restart when the game
crashes: 5 s, doubling to 5 min, giving up after 5 crashes in 10 min.
One supervisor per folder (a file lock).
- op, deop and whitelist for a stopped server, with vanilla's messages.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
carry <work> [<mod id>...] turns each content mod with a jar into a folder
content mod (API 0.2) in <work>/mods/<id>/carry/, for local use:
- assets/<id>/, data/<id>/ and data/minecraft/tags/ are copied; other
namespaces and vanilla data go to outside/ for review; no class file is
copied.
- Vanilla-type recipes get 26.3 ingredients ("id", "#tag", lists);
custom types and NeoForge conditions are kept and listed.
- Item models get the items/ client definitions 1.21.4 introduced.
- Each block is declared from a vanilla template guessed from its
blockstate properties; unknown property sets are listed. Items
without a block are declared from minecraft:stick.
The test builds a small NeoForge jar, carries it over, and reads the
result with horizon-mods' own Content reader.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A CLI for the first steps of docs/modpacks.md's pipeline:
- import: a Modrinth .mrpack, a CurseForge zip or a Prism / MultiMC
instance (or a folder of jars) to pack.json: Minecraft and loader
versions, each file with its hash and sides, and the overrides.
- inventory: Modrinth metadata by SHA-1 (cached in modrinth.json, so
reruns work offline), and the jars when the user's instance has them
(neoforge.mods.toml / mods.toml / fabric.mod.json and a file census,
without decompiling). Each mod gets a class and API tier from the
reviewed ATM10 table, then rules on categories, sides and the census,
and a dependency layer. Writes inventory.json and inventory.csv.
Only metadata is downloaded; jars are never fetched.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A .hmod may carry assets/ and data/ beside mod.wasm, or instead of it. The
manifest needs api = "0.2" and the new registries capability ("add blocks
and items to your worlds"). Content mods have no WIT interface: code still
links API 0.1.
horizon_mods::content::Content reads a mod's content and checks it:
- plain resource paths only;
- 65,536 files, 16 MiB each, 512 MiB in all;
- files in the mod's own namespace, plus additions to vanilla tags;
- blocks and items declared in data/<id>/horizon/{block,item}/*.json, each
copying a vanilla template with typed overrides (hardness, resistance,
light, tool, friction, map colour, sounds; stack size, rarity), unknown
keys refused.
Mods::load refuses an enabled mod whose content fails these checks, with
the reason on its row. A content-only mod is on with no engine and no hooks.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A folder holding shaders/, or a .zip, in shaderpacks/ now loads from the
Shader Packs screen: every planned begin, prepare, deferred, composite
and final pass is translated and drawn each frame over Horizon's world,
with Iris's formats, clears and buffer flips.
The targets keep OpenGL's layout (the translator flips gl_Position and
remaps its depth), the world enters as OpenGL depth, and the pack gets
OpenGL matrices. Textures share four samplers by kind (Metal allows 16
per stage), and isnan/isinf test bits (Metal's fast math folds x != x).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The legaliser of docs/shader-packs.md step 1, on a syntax tree (glsl-lang)
instead of the spike's tokens: attribute/varying to located in/out with
matrix and array varyings split, loose uniforms in one std140 block that
extends across a pass, combined samplers split into texture + sampler
bindings (through function parameters, respecting locals that hide them),
compatibility built-ins and Iris's core-profile names declared, legacy
texture and shadow calls, hoisted global initialisers, sized unsized
arrays, isnan/isinf/modf helpers, and dead code after a jump dropped (the
spike's 'naga constructor bug' in BSL was code after discard). naga then
parses, validates and writes WGSL. The programs of one pass share a Link
so locations, bindings and the uniform layout agree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A new crate for the OptiFine/Iris translation (docs/shader-packs.md, order
step 1, first half): open a pack folder or zip (shaders/ found as Iris finds
it), list its programs per dimension folder, build the #include graph,
discover options per include component (OptionAnnotatedSource rules: boolean
defines referenced by #ifdef, value defines and configurable consts with a
[...] list, conflicting defaults dropped), write the player's values into
the lines, and expand Iris's standard macros with pp-rs, keeping line
numbers so errors name file:line.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Each rumble event plays a short shape instead of one flat block: a hit
starts at full strength and dies away, an explosion rolls on, a totem
swells, a broken block is a tick. They drive the motors' emulation in the
HID report.
On USB the pad is also a four-channel audio device whose channels 3 and 4
drive its actuators: with HORIZON_DUALSENSE_HAPTICS=1 the shapes play there
as waveforms (80 Hz and 200 Hz tones for the heavy and light parts),
channels 1 and 2 silent, until that path is confirmed on a real pad.
docs/controllers.md says what each OS and transport allows.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The horizon-dualsense crate builds the DualSense's output report (USB 0x02,
Bluetooth 0x31 with its CRC-32 seeded with 0xA2) and writes it with hidapi
from a thread. The game sends its rumble pulses through it when the active
pad is a DualSense, so vibration now works on macOS too, and falls back to
gilrs force feedback when the pad can't be opened. Quitting frees the
triggers and stops the motors.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
shader_pack.rs reads shaderpacks/<pack>/pack.toml, the player's option
values (shaderpacks/<pack>.txt) and each composite stage's WGSL, puts
the api 1 prelude (bindings, the Frame uniform, depth helpers) before
it and has naga parse and validate it, with errors pointing into the
pack's own file. Options are WGSL override constants. A file stamp
tells when the pack was edited, for hot reload. Nothing draws with it
yet. examples/shaderpacks/horizon-sample is the MIT sample pack.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Manifest and .hmod reading, capability checks against the component's imports,
fuel and memory limits per call, a trapping mod stopped alone, hot reload.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
horizon-mod-sdk wraps wit-bindgen: a Mod trait with default hooks and export_mod!.
coords-hud shows coordinates, facing and the time of day, with /where and /coords.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Horizon pause menu gains "Invite friends" beside Open to LAN. It opens
the world to LAN if it isn't (Open to LAN's defaults) and shares that port
behind an invite code through the relay; the menu shows the code with Copy
and Stop sharing, who is here and why the code changed. Closing the LAN
server ends the code; stopping sharing closes LAN again if sharing opened
it. `horizon-ctl friends host|stop|status` drives it in harnesses.
Without HORIZON_RELAY_URL (the default until a relay is deployed) the button
is disabled and says the feature isn't available yet.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Ludovic can't pay for a hosted relay, so nothing depends on one now. The
host's game finds how it can be reached on its own: its interface
addresses (LAN, VPNs such as Tailscale or ZeroTier, IPv6), a port opened
on the router for an hour at a time (PCP, then NAT-PMP, then UPnP IGD;
renewed while sharing, deleted on stop) and its public address from STUN
(Cloudflare's and Google's public servers by default, configurable). The
invite code carries those endpoints and an 80-bit secret in base32 groups
with a checksum; guests dial every endpoint at once and run the same
SPAKE2 + ChaCha20-Poly1305 handshake, no rendezvous involved. When nothing
can reach the host it says why and what to do (UPnP, the port to forward,
a relay, a VPN; CGNAT and double NAT detected).
The relay stays as something anyone can run (binary, Dockerfile, systemd
unit; Railway config removed): with one configured the host also gets a
short code, and the full code names the relay so guests fall back to it.
No relay by default.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
horizon-friends: codes (Crockford base32, nameplate + secret), the relay's
JSON-line protocol, SPAKE2 then ChaCha20-Poly1305 frames keyed off the
code's secret, direct connections (candidates, TCP simultaneous open from
a reuse-port socket) with the relay as fallback, and the host and guest
ends that carry the game's TCP stream between loopback ports.
horizon-relay: the service (codes, rendezvous, byte relay, rate limits,
bandwidth caps, idle timeouts, counts only), its Dockerfile and Railway
config. Nothing is deployed and nothing in the game uses it yet.
Design: docs/play-with-friends.md.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The game never sends anything itself; it keeps items in the outbox for the
launcher, and only for kinds the player allows:
- Crash reports: crash::deliver keeps a scrubbed copy (error, stack, thread,
Horizon version, graphics adapter and render settings; never the log, world,
server or resource packs; the world's name and folder and the server address
are scrubbed wherever they appear). Without consent crash-reports/ stays
local, as before.
- Performance: a Session records frame times while playing and the integrated
server's tick times into fixed-size Timings, with the time to the title
screen and to the world; on leaving a world or quitting, a session of a
minute or more becomes a summary (under 1 KiB) when the player allows it.
- The GPU, its driver and backend come from the wgpu adapter.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
horizon-telemetry, shared by the launcher, the game and the ingest server:
- consent.json in the game folder: four switches, all off until the player
answers, a consent version that re-asks when what is collected changes, the
answer's time, and a random install ID made at the first yes.
- Payloads: perf summaries (percentiles + 14 frame-time buckets from a
fixed-size Timings recorder), crash and bug reports, and benchmark reports
carried as docs/benchmark-report.md defines them; size caps per kind.
- A scrubber for user folders, user names, e-mail and IP addresses, UUIDs and
caller-known private terms.
- The outbox: only allowed kinds get in, daily caps, 200 items / 2 MiB.
- zstd batches with bounded decoding; the uploader re-reads the consent and
drops withdrawn items before connecting, backs off and caps batches a day.
- tests/consent_gating.rs: a local mock server sees zero connections with the
consent missing, outdated or withdrawn.
No server is set (DEFAULT_ENDPOINT is None): nothing is sent yet.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The mark is an H whose crossbar is the horizon: a violet line edge to edge, the stems above it
and their reflection below at a third, on whole units of a 16-unit grid so it stays sharp at
16 px. docs/media/brand holds the SVG masters (square icon, macOS tile, avatars, the mark for
light and dark backgrounds), the two alternatives that were shown with it, the GitHub social
preview and the Discord banner, and a README of what goes where and how to upload what only
Ludovic's accounts can.
`cargo run -p xtask -- icons` renders the masters (rsvg-convert) and packs, in plain Rust:
packaging/icons/horizon.ico and horizon.icns, Linux's hicolor icons 16–512 and the scalable
SVG, the game's run-time window icon, the avatars and the website's favicons.
packaging/linux has .desktop entries for the launcher and the game.
On Windows, build.rs embeds the .ico as icon resource 1 in horizon-client (and its tools) and
horizon-launcher (winresource, a Windows-only build dependency); gpui loads that resource as
the launcher's window icon. The game window sets the icon itself (X11, Windows) and names
itself `horizon` on Wayland so the desktop entry matches.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Read the signed-in account from a session file (--session-file, deleted
on read), answer ClientboundHelloPacket like vanilla: shared secret, server
hash, session join through the services discovery document (authlib's
error mapping and messages), RSA-wrapped key packet, AES/CFB8 both ways.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`cargo run -p xtask -- package BINARY OUTDIR` does what package.sh did:
OUTDIR wiped and recreated, the `git archive HEAD tools
mods/horizon/src/test/java crates/horizon-prepare research-lock.json LICENSE`
tree extracted (the tar read in Rust, executables kept executable), the client,
horizon-ctl and horizon-prepare copied (.exe beside an .exe, the same error when
one is missing) and PLAY.txt. release.yml calls it; package.sh is gone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Vanilla 26.3 has no gamepad input, so this is Horizon's own, on Bedrock's
default layout (docs/controllers.md). gilrs reads the pads; the pure part
(bindings, radial deadzones, the look curve, button edges, the
horizon-controller.txt settings file) is in gamepad.rs with unit tests.
Buttons act as the vanilla key mapping they're bound to, through the same
path a rebound keyboard key takes (the keyboard's post-rebinding handling
moves into Game::mapped_key). The left stick is an analog move vector,
the right stick turns the view per frame, LB/RB step the hotbar, B and
Start leave screens and A respawns. horizon-ctl pad injects a virtual pad.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The hurt red and the white row's alphas come from overlay.rs, which
reproduces OverlayTexture's texels (checked against values printed by
the 26.3 JVM) and is prepended to entity.wgsl; a test parses and
validates the composed shader with naga.
Swelling creepers flash white as CreeperRenderer.getWhiteOverlayProgress
says (the white row's column, red winning while hurt; layers keep the
red only), and CreeperRenderer.scale's wobble uses the unclamped
swelling as vanilla does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The game writes logs/latest.log in its home like vanilla's log4j config
(client-1.21.2.xml): [HH:mm:ss] [thread/LEVEL]: message, rolled at start and
at midnight to logs/<date>-<n>.log.gz, seven a day. Messages go through the
log facade and still print their old text on stderr.
A main-thread panic or a fatal error writes
crash-reports/crash-<date>_<time>-client.txt (error, stack, Horizon and
Minecraft versions, OS, CPU, memory, GPU adapter, render settings, resource
packs, world, last 50 log lines). Development builds crash on purpose with
HORIZON_DEBUG_CRASH.
The launcher shows "Horizon crashed" when the game it started ends badly,
with Open report, Copy report, Open logs folder and Report on Discord;
Settings gets a Logs row. horizon-launcher logs and horizon-ctl logs
(--lines N, --crash) print the log's end or the newest report, and both MCP
servers have a logs tool.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A port of tools/prepare_native_client.py and the helpers it imported from
lab.py and the test_*_parity.py modules: the player's pinned game files are
imported and checked against research-lock.json, the client's assets and data
copied, the vanilla exporters compiled and run with the JDK (JAVA_HOME, the
PATH, or java_home on macOS, at the pinned java_major), and the resources and
their manifest written byte for byte as the script wrote them, with its
sha256-keyed skips. tools/compare_prepare.py checks that against the Python
preparer.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
F3 only toggled the debug overlay. 26.3 makes the debug keys rebindable
mappings (key.debug.*): the modifier (F3) held with another key runs
handleDebugKeys, released alone toggles the overlay unless it was used as
a modifier; F3+Escape pauses without the menu; F3+C held ten seconds
crashes the game.
- debug_keys: KeyboardHandler.keyPress's state (usedDebugKeyAsModifier,
the modifier's down state, debugCrashKeyTime) and tick, with the actions
in handleDebugKeys' order; unit tests replay key sequences.
- gizmos: 26.3's gizmo lines (colour, width in pixels, near-plane clip as
GizmoFeatureRenderer.buildLines), ChunkBorderRenderer's geometry and
EntityHitboxDebugRenderer's boxes, eye lines and view arrows; a coloured
line pipeline draws them, depth tested or always on top.
- game/debug_keys: the actions. F3+A rebuilds every section, B hitboxes,
C copies the location (/execute in ... run tp @s, %.2f half up), D
clears chat, G chunk borders, H advanced tooltips (options.txt), I copies
/setblock or /summon with data (Shift: client side), N toggles spectator
and the previous mode with /gamemode's feedback, P pause on lost focus,
T reloads resource packs, V dumps the version, X improved transparency;
F4 without permission says debug.gamemodes.error. Messages carry the bold
[Debug]: prefix in yellow (red for the crash countdown).
- PauseScreen(false): only "Game Paused" at the top; the
pauseOnLostFocus option now decides whether losing focus pauses.
- The clipboard through arboard; `horizon-ctl status` reports the debug
state and the text last copied.
Fixes#73
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
One theme for the launcher and the game: crates/horizon-theme holds the
palette, type scale, spacing, radii, control sizes, motion and the bundled
fonts; launcher/src/theme.rs and the game's ui_theme both read it. ui_theme
ports the launcher's components (button with hover layer and press state,
sidebar list with the sliding selection, segmented control, switch, rows)
and draws Geist and Instrument Serif through the HUD atlas.
The title is laid out like the launcher (sidebar, page header, rows) over a
live backdrop: Horizon generates an ice-spikes landscape for a fixed seed,
orbits a camera over it with falling snow, then blurs and cold-grades the
frame (post.rs). The launcher's opening (wordmark, then the interface) plays
once per session and a click or key skips it. Menu style Horizon / Classic
lives in horizon.txt, never options.txt; Classic keeps vanilla's drawing.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Rust's float functions use the platform libm, and vanilla's own Math
results differ between x86-64 (Intel stubs, close to glibc) and AArch64
(fdlibm, with sin/cos evaluated using fused multiply-adds). jmath picks
the same implementation HotSpot uses on the machine, so options, the
world border's alpha and RandomPos match vanilla on an Apple silicon Mac
as well as on Linux.
The vanilla protocol client no longer records the game-time sync sent
every 20 ticks: whether one arrives before the first chunk batch depends
on when the client joined.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Ludovic Marie
rdbtCVS