v0.89.0-rc2 Stay In Your Lane

The second candidate, on top of rc1: a game's account calls act as the player, a project's packages ask before they are trusted, a relay keeps its shape under load, and the last LuaJIT build is gone. Still beta — play yours on it.

A script acts as the player, not as the developer

account.* from a game reaches the player's surface — /wallet, /missions, /games/… and /me/… — and nothing else. The token behind those calls belongs to whoever is signed in to the Hub on that machine, and the developer endpoints under /cloud/… (keys, builds, usage) are not a game's to call on a player's behalf. A call to one is refused at the call site with the rule named.

A project's packages ask before they are trusted

A project that arrives with packages inside it — a folder or a zip whose packages/ carry manifests asking for Files or Network — loads them with no permissions the first time it opens, and a banner across the top of the editor names each package and what it asks for. Trust this project grants them and remembers that set of packages for that project; Keep them restricted leaves them loaded with nothing for the session. A changed manifest asks again.

A withheld API is still there: http.get in an untrusted package raises with the trust rule named, not as a package that forgot its manifest. floptle exec is not held to any of this — a script you named on your own command line is your own code.

A relay keeps its shape under load

Every relay, the one you self-host included, now refuses a few shapes: one lobby per connection, at most 4 096 lobbies and 64 clients in each, ten lobby opens and thirty joins a minute from one address, half a megabyte a second from one connection, and a lobby nobody has joined for half an hour ends unless its host is a dedicated server. A reliable message a client pushes at a host is capped at 64 KB, a host's at 128 KB — four times the largest prefab any shipped game spawns. A refusal is a sentence on the wire, and each is counted in the relay's report. floptle-relay --no-address-limits lifts the two per-address rates for a load test run from one machine.

A host now checks what a client sends on receipt, not only at the sender's queue: an RPC value past the wire's guardrails is dropped, a server-only message from a client is ignored, and both are counted.

A managed relay is verified by name. A relay reached under fopull.com has to present a certificate for that name; a self-hosted relay or a direct host:port keeps the dev-trust model, where the lobby code is the secret. Until the managed relay's certificate is live, a connection that cannot verify it goes ahead on the older model and says so once in the Console. A later release will refuse instead.

docs/multiplayer.md now says the honest thing about a game key: a stranger with it can use up your plan's players, it cannot cost you money, and rotating it is what rotation is for.

One VM

The vm-luajit escape hatch — buildable for one release after Luau became the default, as ADR-0028 scheduled — is removed. Luau is the only VM the engine embeds, native and browser alike. scripts/vm.sh still switches the code generator (luau-codegen) for benchmarking.

Upgrading

If a game calls account.get("/cloud/…"), it is refused now — that is a developer call, and the portal is where it belongs. If you open a project that carries packages asking for permissions, you will be asked once. If you run a relay and a load test from one machine, pass --no-address-limits to the relay. Nothing else needs a change; rc1's notes still apply.