What’s New

• Added new skybox
• Added new triangle room
• Added new avatar menu
• Added air hockey
• Added rain
• Added faucets with working water.
• Added and a lot more.

Bug Fixes

• Fixed Lighting
• Fixed Skybox
• Fixed file size
• and more

What’s New

• Added new skybox
• Added rain
• Added and a lot more.
• Added new lighting
• Moved the base to v3 from v2

Bug Fixes

• Fixed Lighting
• Fixed Skybox
• Fixed file size
• and more

What’s New

• Added Clock Crescent
• Added Hot Tub
• Improved performance
• New Bakery Lighting
• New Bakery Light Maps
• New HQ Lighting
• New Ricochet OS
• New Skybox
• Added Portal picker
• Added new sofas
• Added new chairs
• Added new deck of cards
• and more

Bug Fixes

• Fixed Lighting
• Fixed Skybox
• Fixed file size
• and more

What’s New

• Added new features
• Fixed bugs
• Improved performance
• New Bakery Lighting
• New Bakery Light Maps
• New HQ Lighting
• New Menu
• Rollback to v2.0 base
• Removed Portal picker
• Source cleanup
• new water lighting
• Pre 2027 v4
• and more

Bug Fixes

• Bug Fixes & Clean up

What’s New

• Fixed bugs
• Improved performance
• New lighting

Bug Fixes

• Fixed issue with terrain lighting not working properly

Initial release

Ricochet-Auth v10.0.0

Release date: July 27, 2026

Ricochet-Auth v10 is a complete web-interface and database-startup overhaul. The dashboard now shares the LuciRift Store visual language, uses Eta templates, supports responsive dark and light themes, and starts only after MongoDB is ready.

This changelog applies to Ricochet-Auth only. It does not describe changes to Ricochet Store or other Ricochet Network projects.

Highlights

• Rebuilt all 17 public, setup, documentation, dashboard, list, and editor pages.
• Replaced EJS with Eta 4.6.
• Added a LuciRift-inspired responsive design system with complete dark and light themes.
• Added an accessible mobile dashboard drawer and touch-friendly layouts.
• Reworked MongoDB startup, retry, session storage, and setup-wizard validation.
• Added automated database and template-rendering tests.

New web experience

Public pages

• Redesigned the landing page, Discord login, setup wizard, developer documentation, and 404 page.
• Added real LuciRift branding and logo assets.
• Preserved Discord-only authentication; no additional login providers were introduced.
• Removed the browser-hosted Tailwind CDN dependency in favor of locally built assets.

Dashboard

• Rebuilt the overview, statistics, personal licenses, downloads, products, licenses, users, roles, and download-panel settings pages.
• Rebuilt the license, product, and role creation/editing experiences.
• Added a shared sidebar and topbar shell based on the LuciRift Store dashboard.
• Preserved existing charts, filters, uploads, forms, modal actions, API calls, CSRF handling, and field names.
• Preserved visibility and authorization boundaries for user, support, developer, admin, and owner roles.

Responsive and accessible design

• Added mobile-first layouts for phone, tablet, laptop, and desktop sizes.
• Added consistent responsive behavior at 640px, 768px, 1024px, and 1280px.
• Added an accessible mobile navigation drawer with a backdrop, Escape-key support, focus handling, and automatic route-close behavior.
• Improved tables with mobile-safe scrolling or card presentations.
• Added 44px minimum touch targets, fluid content widths, readable typography, and overflow protection.
• Improved modal sizing and editor usability at widths as small as 375px.
• Added skip navigation, visible keyboard focus states, and reduced-motion support.

Eta template migration

• Replaced every .ejs view and partial with .eta.
• Added a shared Express-compatible Eta rendering adapter for both the setup and main servers.
• Updated partials to use Eta raw includes.
• Removed the ejs dependency and added eta.
• Updated the production asset-copy process to clean and copy the Eta-based src/web tree into dist/web.
• Added rendering smoke tests for all views to detect invalid includes, missing locals, and escaping regressions.

Migration note

Custom EJS templates from earlier releases are not compatible with v10. Convert custom templates to Eta before deploying them. Production packages must include the new .eta files from dist/web.

Database and session reliability

• Added one MongoDB URI resolver with the following precedence:

  1. RICOCHET_MONGODB_URI
  2. DatabaseSettings.Uri in config/config.yml

• Added URI trimming and validation for complete mongodb:// and mongodb+srv:// connection strings.

• Added bounded retries for transient DNS, connection, timeout, and server-selection failures.

• Changed MongoDB startup failures to stop application startup after retry exhaustion instead of launching a dashboard with a broken database connection.

• Delayed settings loading and Express startup until the MongoDB connection is verified.

• Replaced the separate session database connection with a session store backed by the established Mongoose connection.

• Eliminated the duplicate MongoDB connection pool and second private-DNS lookup previously used for sessions.

• Added explicit session-store error reporting and graceful database shutdown behavior.

• Fixed the Mongoose CommonJS startup crash:

  Cannot read properties of undefined (reading 'readyState')
  

• Added safe, credential-free database error messages for private-network DNS failures, refused connections, authentication failures, and unreachable databases.

Setup wizard

• The wizard now tests the submitted MongoDB URI before saving configuration.
• Failed connection attempts no longer write an unusable configuration.
• Non-secret submitted fields are preserved after a validation failure.
• Private-network DNS errors now provide deployment-specific guidance without displaying the database URI or credentials.
• Existing YAML-based configuration remains supported.

Compatibility

• Existing HTTP routes and Discord OAuth callback paths are unchanged.
• Existing API request and response formats are unchanged.
• Existing form names, CSRF behavior, database collections, and role permissions are unchanged.
• DatabaseSettings.Uri remains supported, so an environment-variable migration is optional.
• RICOCHET_MONGODB_URI is the recommended deployment-secret configuration for hosted environments.

Upgrade notes

1. Back up config/config.yml and the MongoDB database.
2. Install the v10 dependencies with npm install.
3. Convert any custom .ejs templates to Eta.
4. Optionally move the MongoDB URI to the RICOCHET_MONGODB_URI deployment secret.
5. Run npm run build.
6. Deploy the generated application and restart Ricochet-Auth.
7. Confirm the service can resolve the MongoDB private hostname from the same project, environment, and private network.

Validation

• All 21 Eta templates render successfully in automated smoke tests.
• Database configuration and connection-failure behavior are covered by automated tests.
• The project passes its TypeScript typecheck and production build.
• The interface was checked at 375px, 414px, 768px, 1024px, and 1440px in dark and light themes.
• Browser checks covered public pages, dashboard pages, editors, documentation, themes, modals, and mobile navigation.

Version 2.0.0

• New Bakery Lighting
• New Bakery Light Maps
• New HQ Lighting
• Bug Fixes & Clean up
• New Menu
• Rollback to v1.0 base
• Removed Portal picker
• Source cleanup

Version 1.0.0

• New Bakery Lighting
• New Bakery Light Maps
• New HQ Lighting
• Bug Fixes & Clean up
• New Furality Ultra Avatar
• Fixed Lighting
• Fixed Posters lighting
• New posters
• New Reflection Probes
• New World Disclaimer
• New Resize Menu
• New Portal Picker
• New Inventory System
• New Posters
• New Spawn Points
• New Art/Banner
• New Mirrors
• Fixed Reflection Probes

New Auth

New auth

Ricochet Pro v3.0.0 — Changelog

Major Update: Professional Creator Experience

Ricochet Pro v3.0 is a complete visual, workflow, and reliability upgrade for VRChat world creators. The toolkit is now easier to navigate, safer to use, and built around clear world-readiness decisions.

New Guided Experience

• Added Simple Mode for a cleaner creator-focused workflow.
• Added the new Launch Readiness dashboard.
• Added PC and Quest readiness scores, build-risk status, backup status, and priority findings in one place.
• Added a recommended next step based on the highest-priority audit finding.
• Added creator shortcuts for running audits, applying safe fixes, creating backups, Quest checks, reports, and Advanced Mode.

Improved Navigation

• Reorganized the toolkit into clearer workflow groups:
  • Readiness
  • Optimize
  • Build
  • Tools
  • Settings
• Added grouped sidebar navigation.
• Advanced tools remain available through Advanced Mode.
• Navigation now resets the content scroll position when changing areas.

LuciRift Visual Redesign

• Rebuilt the UI with LuciRift-inspired midnight navy and electric-blue styling.
• Replaced the old gray editor canvas with consistent blue/navy surfaces.
• Updated cards, rows, sidebars, headers, toolbars, footer, search fields, dropdowns, report panels, and settings fields.
• Updated primary actions to use the Luci blue button treatment.
• Added consistent styling for:
  • Run Audit
  • Preview + Apply Safe Fixes
  • Fix Safely
  • Reset Ricochet Pro Settings
  • Empty-state audit actions
• Improved contrast, visual hierarchy, spacing, and readability across the toolkit.

Audit and Findings Improvements

• Added finding search.
• Added severity filtering for Critical, Warning, and Info findings.
• Improved finding rows with clearer severity and safety guidance.
• Added clear safety labels:
  • Safe — Undo available
  • Review — Preview before applying
  • Risky — Backup required
• Improved contextual actions for inspecting and resolving findings.

Safety and Reliability

• Added clearer operation summaries and persistent status feedback.
• Added audit progress feedback.
• Improved backup status reporting.
• Risky actions continue to require a backup.
• Review actions respect the backup preference.
• Improved failure feedback when actions or audits encounter errors.
• Added safe cleanup for generated UI textures when styles refresh or the window closes.
• Improved brand icon loading with a built-in fallback if the remote image cannot load.

Settings Improvements

• Added saved Simple/Advanced mode preference.
• Added saved finding search and severity filter preferences.
• Updated Settings controls to use blue-themed number fields, dropdowns, and labels.
• Updated reset messaging to clearly explain what will be restored.
• Retained existing audit thresholds, presets, export folders, and preferences.

Compatibility

• Keeps the one-file Assets/Editor installation workflow.
• Preserves existing Ricochet Pro tools, reports, exports, runtime helper generation, VRChat checks, Quest tools, ProBuilder tools, and scene utilities.
• Maintains optional integration handling for UdonSharp and ProBuilder.

Version

Ricochet Pro v3.0.0
© 2023–2026 LuciRift LLC. All rights reserved.

Changelog

v9.0.0 - 2026-07-09

Ricochet v9.0.0 brings the dashboard’s visual identity in line with the public LuciRift site, fixes a chain of authentication and API bugs that could block sign-in and every write action in the panel, rebuilds the Discord activity-log embeds, and adds production build tooling.

Added

• Adopted the “Lumen” design system from the public site (main.css / tailwind-public-config.js) across the whole dashboard: accent #00318a, Bricolage Grotesque + Instrument Sans + JetBrains Mono typefaces, layered glass surfaces, mesh-gradient backgrounds, and the full radius/shadow/glow/motion token scale. The real tailwind-public-config.js (animations, shadows, spacing) is now wired into every page instead of a small ad-hoc inline config.
• New shared Discord embed system (src/helpers/brandEmbed.ts) — branded author/footer (bot avatar + “Ricochet Auth”), emoji’d titles, semantic color coding (create/update/delete), and compact inline field layout instead of bolded blockquote walls. Applied to every web-panel audit log, license lifecycle event, and auth-channel embed.
• New first-run notice on the login page: when no owner account exists yet, a small banner explains that the next Discord sign-in becomes owner automatically.
• New motion system: page-enter transitions, staggered stat-card and feature-card entrances, origin-aware dropdown scale/opacity animation, smooth sidebar-collapse transitions, and button press feedback — all respecting prefers-reduced-motion.
• New shared primitives: .eyebrow-pill, alert variants (alert-info, alert-success, alert-warning), and tabular-nums on numeric table/stat data.
• New build tooling: copy-assets.js (copies EJS views/partials/static assets into dist/web, which tsc alone never did) and obfuscate.js (recursively obfuscates every .js file under dist/ via javascript-obfuscator — full protection preset for backend code, a lighter preset for the two browser-served scripts). npm run build now produces a complete production build; npm run obf builds and obfuscates it.

Changed

• Retokenized src/web/assets/css/ricochet.css (3,600+ lines) end to end — accent, surfaces, borders, shadows, and semantic colors now derive from the shared Lumen token set instead of the dashboard’s previously diverged “blue-glass” palette (#0b5cff / DM Sans).
• Redesigned the console shell (sidebar, topbar, active-link states), dashboard home (stat cards now lead with a real hero number instead of four visually identical boxes), auth surfaces (login, 404, landing), data views (licenses, products, users, roles), forms, and the docs/downloads/wizard/footer pages to match the new system.
• The Ricochet brand mark (SVG logo) now tracks the live --accent-color/--accent-rgb CSS variables instead of hardcoded hex values, so it stays in sync with the accent everywhere it’s used.
• Standardized card-section headers (e.g. “License Details”, “Traffic Summary”) to a consistent small-caps eyebrow style across every view.
• Simplified Discord OAuth owner bootstrap: the first account to complete sign-in is automatically made owner — no bootstrap key or extra step required.

Fixed

• Discord login 404 — /auth/discord required an undocumented ?dashboardKey= query parameter to bootstrap the first owner, which the login button never sent and the setup wizard never mentioned. Every sign-in attempt on a fresh instance silently 404’d with no way to recover from the UI.
• 401 Unauthorized on every dashboard write (create/update/delete license, product, role, user) — the Developer API’s bearer-key middleware in dev.routes.ts was mounted with an unscoped router.use(...), which intercepted all traffic under /api/*, including the session-authenticated /api/web/* dashboard endpoints, and rejected them before they ever reached the real handler. Scoped the middleware to only the Developer API’s own /products and /licenses routes.
• License creation silently failing — crypto.ts read LicenseSettings.SecretKey by independently re-parsing config/config.yml from disk, but that file now only stores DatabaseSettings.Uri (all other settings moved to MongoDB in a prior release). Every encrypt()/decrypt()/hashLicense() call — i.e. every license create, view, or list — threw Cannot read properties of undefined (reading 'SecretKey') server-side, which the frontend had no way to surface. Now reads the already-loaded client.config instead.
• Product Created/Changed/Deleted and User Role Changed activity logs always attributed the action to a hardcoded name and Discord ID regardless of who actually performed it; now correctly shows the acting staff member.
• User Role Changed embed described itself as a product change (copy-paste leftover).
• Product Changed embed printed a literal || "None" string into the role field instead of resolving a real fallback.
• add-new.ejs’s “Create License” button could fail with no visible feedback if the server returned a non-JSON response (e.g. an expired session); it now validates required fields client-side, checks the response content type before parsing, and always shows a toast on failure.

Notes

• No backend route contracts, payload shapes, or role permissions changed beyond the fixes listed above.
• Existing self-hosted instances should redeploy after this update — the login and API-401 fixes in particular require the new server code to take effect.

v8.0.0 - 2026-05-17

Ricochet v8.0.0 is a full visual and UX rebuild of the web interface, focused on making the license manager feel cleaner, sharper, and more production-ready while keeping the existing backend behavior intact.

Added

• New dark security-console visual system with graphite surfaces, crimson accents, glossy panels, glow treatment, sharper borders, and compact dashboard spacing.
• New code-native Ricochet lock-and-key SVG brand mark used across the landing page, navigation, login, footer, and empty states.
• New authenticated console shell with desktop sidebar, top utility bar, mobile drawer behavior, role-aware navigation, user menu styling, and cleaner active states.
• New public shell styling for landing, login, API docs, setup, and 404 pages.
• New landing page structure with rebuilt hero, product preview treatment, feature tiles, user/admin sections, pricing card, and final call-to-action.
• New reusable CSS primitives for cards, tables, forms, buttons, badges, modals, dropdowns, code blocks, docs sections, download cards, and status states.

Changed

• Rebuilt src/web/assets/css/ricochet.css from the ground up for a more polished LuciRift-style interface.
• Redesigned the landing page to remove the old remote hero image and replace it with the inline lock-and-key brand mark.
• Tightened landing hero typography, feature card widths, and section spacing so the page feels less oversized on desktop and mobile.
• Restyled dashboard, licenses, products, users, roles, downloads, settings, login, setup, docs, and error views to use the new visual system.
• Improved product and user modal styling, including aligned icons, cleaner option cards, better role badges, and matching modal controls.
• Improved file upload input styling so native file picker buttons match the Ricochet interface.
• Refined API documentation layout, navigation, code blocks, badges, language tabs, and copy-button styling.
• Updated footer and navigation presentation to match the new brand direction.

Fixed

• Fixed docs layout overflow where the authenticated shell could visually crowd the documentation page.
• Fixed product edit form icons so they sit inside fields instead of floating above inputs.
• Fixed user role modal alignment and option-card spacing.
• Fixed missing role badge color helpers for red and green role states.
• Fixed landing feature and audience cards being too wide on large screens.
• Fixed oversized landing hero-title text.
• Fixed browser-default file upload button styling in the product update modal.
• Fixed lock mark shackle endpoint rendering so the hoop no longer shows a small extended nub.

Notes

• This release keeps the current Express/EJS architecture, backend routes, API payloads, auth behavior, role permissions, pricing, purchase links, and docs examples intact.
• No new frontend dependencies were added.