From 472a8fb72b736ce33922d79609b72bc8f84501af Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 26 Jun 2026 04:30:22 +0000
Subject: [PATCH 1/2] kyber-server: fresh start option and special char safe
 .env quoting

On rerun, if ~/.local/share/maxima exists, offer to wipe it so EA login
starts completely fresh (fixes stuck/broken auth states).

Single-quote all .env values so passwords and tokens containing $, !, &,
spaces, and other shell special characters are written safely.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D8ckUJQtj1pH8jtAddBDZs
---
 services/kyber-server.sh | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/services/kyber-server.sh b/services/kyber-server.sh
index d8a82ce..5963d90 100644
--- a/services/kyber-server.sh
+++ b/services/kyber-server.sh
@@ -251,6 +251,17 @@ for a in data.get('assets', []):
         log_info "Kyber AppImage already present: $APPIMAGE_PATH"
     fi
 
+    # ── Fresh start option (clear cached EA auth) ────────────────────────────
+    local MAXIMA_DIR="$ACTUAL_HOME/.local/share/maxima"
+    if [[ -d "$MAXIMA_DIR" ]]; then
+        local _fresh=""
+        prompt_yn "Existing EA login found. Start fresh (clear cached auth)? (y/n):" "n" _fresh
+        if [[ "$_fresh" =~ ^[Yy]$ ]]; then
+            sudo -u "$ACTUAL_USER" rm -rf "$MAXIMA_DIR"
+            log_success "Cleared Maxima auth cache — EA login will be prompted fresh."
+        fi
+    fi
+
     # ── Get Kyber token ───────────────────────────────────────────────────────
     echo ""
     log_info "Getting your Kyber server token..."
@@ -347,13 +358,15 @@ services:
 EOF
 
     # Write .env with restricted permissions
+    # Values are single-quoted so special characters ($, !, &, etc.) are safe.
+    # Exception: single quotes inside a value would still break — avoid them.
     cat > "$DIR/.env" << EOF
-MAXIMA_CREDENTIALS=${EA_EMAIL}:${EA_PASSWORD}
-KYBER_TOKEN=${KYBER_TOKEN}
-KYBER_SERVER_NAME=${SERVER_NAME}
+MAXIMA_CREDENTIALS='${EA_EMAIL}:${EA_PASSWORD}'
+KYBER_TOKEN='${KYBER_TOKEN}'
+KYBER_SERVER_NAME='${SERVER_NAME}'
 KYBER_SERVER_MAX_PLAYERS=${MAX_PLAYERS}
 # Leave blank for a public server, or set a password to make it private
-KYBER_SERVER_PASSWORD=${SERVER_PASSWORD}
+KYBER_SERVER_PASSWORD='${SERVER_PASSWORD}'
 # Leave blank until you have a base64-encoded map rotation string.
 # Build one in the Kyber client HOST tab, then base64-encode it:
 #   echo -n '<rotation-json>' | base64

From 87384980da6fbd81de4d6c82df14ee79ca252380 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 26 Jun 2026 04:32:31 +0000
Subject: [PATCH 2/2] kyber-server: mount SWBF2 folder read-write not read-only

The Kyber server patches vivoxsdk.dll into the game folder at startup.
Mounting it :ro caused a loop of cp permission errors. Removed the :ro flag.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D8ckUJQtj1pH8jtAddBDZs
---
 services/kyber-server.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/kyber-server.sh b/services/kyber-server.sh
index 5963d90..d8efbc7 100644
--- a/services/kyber-server.sh
+++ b/services/kyber-server.sh
@@ -353,7 +353,7 @@ services:
     restart: unless-stopped
     env_file: .env
     volumes:
-      - ${SWBF2_PATH}:/mnt/battlefront:ro
+      - ${SWBF2_PATH}:/mnt/battlefront
       - ./logs:/logs${GPU_SECTION}${DEVICES_SECTION}${GROUP_ADD_SECTION}
 EOF