Releases

Changelog

Every X-Eye resource update, newest first. Written in English.

  1. August 31, 2026

    v2.0.1

    Pick FiveGuard from started resources

    • The FiveGuard resource is chosen from the FX list of started (ensure) resources. Search the list and click a name — there is no free-text field.
    • Heartbeat sends only started resources and applies the name you picked on the panel. Optional fallback: set xeye_fiveguard "ResourceName".

  2. August 31, 2026

    v2.0.0

    Panel on x-eye.eu (HTTPS)

    • The panel is https://x-eye.eu. Heartbeat and ingest now use that host instead of the raw VPS IP.
    • HTTP on the IP was redirected to the website, which broke FiveM POSTs (heartbeat stayed unknown). 2.0.0 rewrites an old http://IP ingest to https://x-eye.eu. Optional: set xeye_ingest "https://x-eye.eu".

  3. August 31, 2026

    v1.2.5

    Verify link bound to the connect PC

    • The verify page only accepts Continue from a desktop browser on the same public IP as the FiveM connect, with a one-time JS unlock code from the checkbox (nonce + canvas + WebGL + audio). A POST without that code, a phone, a VPS, or a friend on another IP is rejected; the session stays pending.
    • The resource sends the player IP from ip: / GetPlayerEndpoint so the panel can bind the link. If the game and the browser use different IP families (IPv4 vs IPv6), the bind is skipped.

  4. August 31, 2026

    v1.2.4

    Cfx hardware token matching

    • On connect and ban, the resource now sends the full GetPlayerToken set (Cfx HWIDs) with the usual identifiers.
    • The graph stores each token as a hashed signal. A reconnect with two or more of the same tokens as a banned identity is blocked as spoofing, even with a new license, Steam, or Discord. A single shared token is not enough.
    • txAdmin bans copy targetHwids when the event includes them.

  5. August 31, 2026

    v1.2.3

    Fix staged update write

    • SaveResourceFile from the HTTP callback could not create resource.bin.pending. The write now runs on the next server tick, falls back to io.open, and the zip ships an empty pending file so FXServer overwrites instead of creating.

  6. August 31, 2026

    v1.2.2

    txAdmin ban sync

    • txAdmin bans copy license/Steam/Discord/Cfx identifiers into the X-Eye graph so spoof reconnects stay blocked.
    • Unban via txAdmin:events:playerUnbanned or actionRevoked (ban) lifts only the txAdmin-sourced graph row. Spoof and staff bans stay.
    • Uses server AddEventHandler, not RegisterNetEvent, so clients cannot fake a ban.

  7. August 31, 2026

    v1.2.1

    Fix auto-update hex check

    • Lua base64 decode used sub(i, 1), which in Lua means 'from i down to index 1', not 'one character'. Every update decoded to junk and failed with payload is not hex.
    • Decoder now uses sub(i, i). Hex payloads are accepted without base64 as a fallback.

  8. August 31, 2026

    v1.2.0

    License countdown, public changelog, auto-update test

    • License management shows remaining days on each key, in the account language.
    • Public changelog page at /changelog. Every resource release is listed here.
    • Resource bump to verify staged auto-update through resource.bin.pending on Linux FXServer.

  9. August 31, 2026

    v1.1.9

    Staged payload updates

    • Updates write resource.bin.pending with a SHA-256 check instead of overwriting the live payload.
    • The loader decrypts the pending file first and promotes it on the next resource start.

  10. August 30, 2026

    v1.1.8

    In-place resource.bin updates

    • Tried to overwrite resource.bin while the resource was running. FXServer rejects that write on Linux and Windows.