Surface raw RCON reply bytes + Probe RCON button

"unparseable reply (34 bytes)" told us Plutonium answered but hid the
actual bytes, forcing another guess-and-check round. rconStatusResult
now emits a formatRawReply() hex + ASCII dump of the raw UDP payload on
every bad-reply, persisted in a new last_reply_snippet column so it
survives page loads.

Wrong-password detection widens beyond the "bad rcon" phrasing to
"(bad|invalid|wrong)…(rcon|password|pass)"; print-body replies that
don't match get their first non-header line surfaced verbatim so at
least *some* server-supplied text reaches the UI.

Probe RCON button (POST /api/servers/[name]/probe-rcon) fires the same
code path as the periodic sweep on demand, cuts the RCON iteration loop
from 30s per attempt to sub-second, and refreshes the header/roster/
health when it succeeds. Snippet <details> auto-opens on bad-reply so
the bytes are one glance away.

migrateServers() picks up the new column automatically via the
introspection path added last commit.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/lib/server/db/index.ts

@@ -24,7 +24,8 @@ const SERVERS_COLUMNS: Array<{ name: string; ddl: string }> = [
     { name: 'last_gametype', ddl: 'ALTER TABLE servers ADD COLUMN last_gametype TEXT' },
     { name: 'last_roster', ddl: 'ALTER TABLE servers ADD COLUMN last_roster TEXT' },
     { name: 'last_seen_at', ddl: 'ALTER TABLE servers ADD COLUMN last_seen_at TEXT' },
-    { name: 'last_error', ddl: 'ALTER TABLE servers ADD COLUMN last_error TEXT' }
+    { name: 'last_error', ddl: 'ALTER TABLE servers ADD COLUMN last_error TEXT' },
+    { name: 'last_reply_snippet', ddl: 'ALTER TABLE servers ADD COLUMN last_reply_snippet TEXT' }
 ];
 
 function migrateServers(handle: Database.Database): void {

src/lib/server/db/schema.sql

@@ -18,6 +18,7 @@ CREATE TABLE IF NOT EXISTS servers (
     last_roster      TEXT,                                -- JSON array of RconPlayer
     last_seen_at     TEXT,                                -- ISO ts of last successful RCON reply
     last_error       TEXT,                                -- last RCON failure reason (cleared on success)
+    last_reply_snippet TEXT,                              -- hex+ASCII of last bad-reply UDP payload
     created_at       TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
 );
 

src/lib/server/fleet/servers.ts

@@ -76,6 +76,7 @@ export interface ServerRow {
     last_roster: string | null;       // JSON array of RconPlayer, or null
     last_seen_at: string | null;      // last successful RCON reply
     last_error: string | null;        // cleared on success
+    last_reply_snippet: string | null; // hex+ASCII of last bad-reply payload
     created_at: string;
 }
 
@@ -126,7 +127,8 @@ export function setServerField(
         'last_gametype',
         'last_roster',
         'last_seen_at',
-        'last_error'
+        'last_error',
+        'last_reply_snippet'
     ];
     if (!allowed.includes(field)) throw new Error(`refusing to set ${field}`);
     db().prepare(`UPDATE servers SET ${field} = ? WHERE name = ?`).run(value, name);

src/lib/server/integrations/rcon.ts

@@ -231,7 +231,37 @@ export interface RconStatus {
 
 export type RconStatusResult =
     | { ok: true; endpoint: RconEndpoint; status: RconStatus }
-    | { ok: false; endpoint: RconEndpoint | null; reason: RconFailure; detail: string };
+    | {
+          ok: false;
+          endpoint: RconEndpoint | null;
+          reason: RconFailure;
+          detail: string;
+          // Present on bad-reply: printable hex + ASCII dump of the raw UDP
+          // payload so the operator can see what the server actually said
+          // (wrong password body, unexpected dialect, etc).
+          rawReply?: string;
+      };
+
+const RAW_REPLY_LIMIT = 512;
+
+/**
+ * Render a Buffer as a short hex + printable-ASCII snippet — same layout as
+ * `hexdump -C`, capped at RAW_REPLY_LIMIT bytes so it fits in the UI panel.
+ */
+export function formatRawReply(buf: Buffer): string {
+    const bytes = buf.subarray(0, RAW_REPLY_LIMIT);
+    const lines: string[] = [];
+    for (let i = 0; i < bytes.length; i += 16) {
+        const chunk = bytes.subarray(i, i + 16);
+        const hex = Array.from(chunk).map((b) => b.toString(16).padStart(2, '0')).join(' ');
+        const ascii = Array.from(chunk).map((b) => (b >= 0x20 && b < 0x7f ? String.fromCharCode(b) : '.')).join('');
+        lines.push(`${i.toString(16).padStart(4, '0')}  ${hex.padEnd(47, ' ')}  ${ascii}`);
+    }
+    if (buf.length > RAW_REPLY_LIMIT) {
+        lines.push(`… (${buf.length - RAW_REPLY_LIMIT} more bytes)`);
+    }
+    return lines.join('\n');
+}
 
 /**
  * Full RCON status probe with structured diagnostics. Callers get either
@@ -275,18 +305,32 @@ export async function rconStatusResult(server: string): Promise<RconStatusResult
             ok: false,
             endpoint: ep,
             reason: 'bad-reply',
-            detail: 'reply missing 0xff prefix — wrong port or non-Plutonium listener?'
+            detail: `reply missing 0xff prefix (${send.buf.length} bytes) — wrong port or non-Plutonium listener?`,
+            rawReply: formatRawReply(send.buf)
         };
     }
     const info = parseInfoLine(text);
     const players = parsePlayerCount(text);
     if (players === null) {
         // Reply arrived but neither the print separator nor an info line
-        // showed up — usually a wrong-password `print` body ("Bad rcon…").
-        const detail = text.trim().startsWith('print') && /bad\s+rcon/i.test(text)
-            ? 'wrong RCON password'
-            : `unparseable reply (${text.length} bytes)`;
-        return { ok: false, endpoint: ep, reason: 'bad-reply', detail };
+        // showed up. Common wrong-password wordings vary across Plutonium
+        // builds ("Bad rcon_password", "Invalid password", "Bad password").
+        const trimmed = text.trim();
+        const looksLikePrint = trimmed.startsWith('print');
+        const suggestsPassword = /(bad|invalid|wrong).{0,20}(rcon|password|pass)/i.test(text);
+        let detail: string;
+        if (looksLikePrint && suggestsPassword) {
+            detail = 'wrong RCON password';
+        } else if (looksLikePrint) {
+            // print body but we couldn't classify — show the first line
+            const firstLine = trimmed.split(/\r?\n/)[1]?.trim() ?? '';
+            detail = firstLine
+                ? `print reply not recognized: "${firstLine.slice(0, 100)}"`
+                : `unparseable print reply (${text.length} bytes)`;
+        } else {
+            detail = `unparseable reply (${send.buf.length} bytes) — see snippet below`;
+        }
+        return { ok: false, endpoint: ep, reason: 'bad-reply', detail, rawReply: formatRawReply(send.buf) };
     }
     return {
         ok: true,

src/lib/server/pipeline/bus.ts

@@ -17,6 +17,7 @@ export interface ServerStatusEntry {
     lastError: string | null;
     endpoint: RconEndpoint | null;
     reason: RconFailure | null;
+    replySnippet: string | null;
 }
 
 export type PipelineEvent =

src/lib/server/pipeline/worker.ts

@@ -49,7 +49,8 @@ async function fanoutStatus(): Promise<void> {
                 ok: false as const,
                 endpoint: null,
                 reason: 'send-error' as RconFailure,
-                detail: (err as Error).message
+                detail: (err as Error).message,
+                rawReply: undefined as string | undefined
             }));
             const now = new Date().toISOString();
 
@@ -62,6 +63,7 @@ async function fanoutStatus(): Promise<void> {
                 setServerField(srv.name, 'last_seen_at', now);
                 setServerField(srv.name, 'last_checked_at', now);
                 setServerField(srv.name, 'last_error', null);
+                setServerField(srv.name, 'last_reply_snippet', null);
                 entries[i] = {
                     server: srv.name,
                     players: result.status.players,
@@ -72,14 +74,17 @@ async function fanoutStatus(): Promise<void> {
                     lastSeenAt: now,
                     lastError: null,
                     endpoint: result.endpoint,
-                    reason: null
+                    reason: null,
+                    replySnippet: null
                 };
             } else {
                 // RCON unreachable — leave last_seen_at alone (health decays
                 // to offline naturally), record the structured failure.
                 const encoded = encodeError(result.reason, result.detail);
+                const snippet = result.rawReply ?? null;
                 setServerField(srv.name, 'last_checked_at', now);
                 setServerField(srv.name, 'last_error', encoded);
+                setServerField(srv.name, 'last_reply_snippet', snippet);
                 entries[i] = {
                     server: srv.name,
                     players: srv.last_players,
@@ -90,7 +95,8 @@ async function fanoutStatus(): Promise<void> {
                     lastSeenAt: srv.last_seen_at,
                     lastError: encoded,
                     endpoint: result.endpoint,
-                    reason: result.reason
+                    reason: result.reason,
+                    replySnippet: snippet
                 };
             }
         }