rgl_framework/docs/TASKS.md

Tasks & Improvements

Prioritized backlog of issues, improvements, and feature ideas.

---

Critical

No critical issues currently.

---

High

Add proper .gitignore

Current .gitignore only has more_modules. Missing:

• rust_core/target/
• *.so
• rgl_data.db
• *.log
• .DS_Store

Create build script

No Makefile or build automation exists. Need a script for:

• Cross-compile Rust for aarch64-linux-android
• Deploy .so to device via ADB
• Optional: rebuild on file change

Improve Rust error handling

50+ unwrap() calls across Rust codebase. Key areas:

• bridge.rs: mutex locks can panic on poisoning — use unwrap_or_else() with recovery
• db.rs: 30+ unwrap/unwrap_or_default — silent failures on DB errors
• server.rs: 15+ unwraps in HTTP handlers Should introduce proper error types (thiserror crate) or at minimum unwrap_or_else() with logging.

Silent JSON parse failures in db.rs

execute_batch() returns "[]" on JSON parse error without logging. Should log the error for debugging.

---

Medium

Fix BTC module global state

more_modules/btc/init.lua uses btc_visible = false as a global variable (for mimgui OnFrame). Should be moved to a proper module state mechanism to avoid global namespace pollution.

Implement WebSocket backpressure

bridge.rs broadcast channel has capacity 256. Events are silently dropped when full. Should either increase capacity, add warning logging, or implement backpressure.

Improve fallback JSON encoder

rgl_framework.lua fallback JSON decoder only handles flat {"key":"value"} — fails on nested objects, arrays, numbers, booleans. Since cjson is always expected to be present, consider making it a hard requirement instead of silently degrading.

Add integration tests

Only db.rs has tests (6 batch operation tests). Missing:

• Bridge request/response cycle
• Event system overflow/blocking
• HTTP handler edge cases
• Module loading/unloading
• Win-1251 encoding conversion

Module loading error handling

load_all_modules() uses io.popen('ls ...') which can fail if directory is deleted between listing and loading. Use pcall(io.open) instead.

Add auth/CORS for web API

Currently any network client can call all APIs. Consider at minimum:

• Bind to localhost only (or configurable)
• Basic auth token
• CORS headers for web clients

---

Low

Add rate limiting to API handlers

No protection against API spam. Could add simple per-endpoint rate limits.

Add request/response logging middleware

No HTTP access logging in Rust. Add optional access log for debugging API calls.

Optimize broadcast channel capacity

Current 256 capacity is arbitrary. Profile actual event rates and set appropriately.

Add module versioning

No way to track which version of a module is loaded. Could add M.version field and display in admin panel.

Add deployment documentation

No docs on how to deploy the .so to an Android device, set up the framework, or configure MoonLoader to load the script.

---

Feature Ideas

WebSocket command execution

Allow web clients to send commands via WebSocket instead of only HTTP POST. Would enable real-time bidirectional communication.

Module dependency system

Currently modules load independently. A dependency system would let modules declare required modules and load in order.

Persistent notification history

In-game notifications disappear after timeout. Could persist to DB and show in admin panel.

SAMemory integration module

Create a utility module that exposes player position, health, vehicle state via the web UI using the SAMemory library from ../lib.

Config file support

Use inicfg.lua or jsoncfg.lua from ../lib for human-editable configuration alongside the DB-based persistence.