Better WebConsole

Added

- Added Paper 26.2 compatibility detection to the diagnostics API.

Fixed

- Batched server-stats history compaction after retention pruning, preventing a full history-file rewrite for every new point at the retention limit.

Changed

- Version bump 2.4.9. - Added grouped Paper build artifacts for Minecraft/Paper 1.21 - 1.21.11 and 26.1 - 26.1.2. - Shortened generated jar names to bwc-<version>-paper-1.21.X.jar and bwc-<version>-paper-26.X.jar. - Ignored module target directories. - Updated README build output and system-stats.history / player-activity configuration docs. - Rendered Minecraft legacy, hex and MiniMessage-style player name colors in the Players tab.

Added

- Added /api/players/offline with pagination, search and configurable page limits for offline player lists. - Added live one-point stats history samples to stats payloads so charts keep moving between persisted history loads.

Performance

- Cached heavy player activity, known-player and offline-player payloads instead of rebuilding them every stats tick. - Reduced repeated LuckPerms/offline-player work during dashboard stats broadcasts. - Reused the server stats history append writer and flushed it in small batches instead of opening the file for every stat point. - Kept live TPS/RAM/player/CPU chart samples updating from the stats stream every second while longer chart ranges load from persisted history. - Buffered player activity history writes with configurable batch flushing. - Moved offline player lists to a paged /api/players/offline endpoint instead of including them in every stats payload. - Added configurable cache and flush intervals for stats history and player activity payloads. - Split Chart.js into a lazy-loaded frontend chunk so the initial web UI bundle is smaller. Full Changelog: https://github.com/AREKKUZZERA/better-web-console/compare…

Added

- Added a fallback /api/stats polling path in the web UI so dashboard data can recover when WebSocket stats are delayed or unavailable. - Added tests for absolute session lifetime expiry behavior. - Persistent TPS/RAM/CPU/player history storage in server-stats-history.tsv. - New authenticated endpoint: GET /api/stats/history. - Dashboard range selector for 1h, 6h, 24h, and all. - Offline player roster, offline profile lookup, and last-seen display. - LuckPerms rank/prefix display via soft dependency. - Config options for stats history retention, API max points, and write interval.

Changed

- Added an absolute web session lifetime limit in addition to the idle timeout. - Added security.session-max-lifetime-minutes to config.yml and README examples. - Set the session cookie Max-Age from the absolute session lifetime so browser cookies and server-side sliding sessions stay consistent. - Matched unknown-user dummy bcrypt verification cost to real password hashes. - Updated /bwc reload messaging and docs to mention that session max lifetime changes require a server restart. - Dashboard charts now render persisted/downsampled history. - Player models support online/offline state, rank metadata, and activity counters. - Paper 26.1 grouped artifact renamed from 26.1.X to 26.X. - Project version bumped to 2.4.8.

Fixed

- Restored normal login form submit behavior for browser autofill, password managers and automation. - Cleared the password field after a successful web login. - Warned server owners when the web panel listens on all interfaces without secure cookies or an IP whitelist. - Ensured loaded persisted sessions are rejected when they exceed the absolute lifetime, even if their idle timeout has not expired. Full Changelog: https://github.com/AREKKUZZERA/better-web-console/compare…

Added

- Added Spanish (es) localization to the web UI language selector. - Added missing localized labels for sessions, audit, config, diagnostics and player profile fields across supported languages.

Changed

- Replaced OSHI-based system metrics with Java runtime and OS MXBean metrics to reduce shaded dependencies and runtime native-library issues. - Added stable name attributes to login, console, player, audit, config and modal form controls for better browser autofill and automation compatibility. - Localized remaining hardcoded player activity and profile labels.

Fixed

- Collected an initial stats snapshot when the plugin starts so the dashboard has data sooner after startup. - Loaded existing logs/latest.log lines into the web console backlog before live log capture starts.

Added

- Added searchable audit log table with filters by action, user, IP and text query. - Added audit export in JSON and CSV formats. - Added web config editor for aliases, blocked commands, logging and system stats options. - Added compatibility diagnostics for plugin version, Java, server version and supported Paper/Purpur lines. - Added recent error grouping for console ERROR/SEVERE/exception lines. - Added player profile drawer with UUID, gamemode, health, food, level, location and recent activity.

Changed

- Improved dashboard with compatibility and error summary blocks. - Improved player activity history grouping, expand/collapse behavior and mobile layout. - Improved sessions and audit tables on small screens. - Refactored the frontend from legacy bundled code into React components and shared webconsole modules.

Added

- New Audit tab for recent authentication, command and player-action audit events. - Search and refresh controls for audit history. - Built-in favicon asset.

Improved

- Web sessions are now persisted as SHA-256 token hashes instead of raw session tokens. - Existing session storage is migrated automatically on next startup. - Dashboard stats now use cached snapshots, reducing extra Bukkit main-thread work from web clients. - Chart.js is bundled with the plugin frontend instead of loaded from a CDN.

Security

- Added same-origin protection for authenticated API POST requests. - Added same-origin protection for WebSocket handshakes. - Tightened Content Security Policy for scripts and WebSocket connections. - Added HSTS automatically when security.secure-cookies is enabled. - Added login request body size limits. - Added POSIX owner-only permission hardening for users.dat, sessions.tsv and audit.log.

Fixed

- Fixed active web sessions becoming unstable after restart because refreshed session activity was not persisted. - Fixed WebSocket reconnects resetting per-session command rate limits. - Fixed invalid CIDR whitelist prefixes matching unintended IP addresses. - Fixed audit log shutdown potentially dropping queued entries. - Aligned web login username validation with /bwc adduser rules.

Performance

- Cached dummy bcrypt verification hash for unknown-user login attempts. - Cached world/entity stats between stats collection ticks. - Limited and compacted persisted player activity history. - Cached player activity summary counters.

Added

- Added a React + Vite frontend build pipeline for the web UI. - Added a read-only web sessions metadata API and React sessions panel scaffold. - Added a Sessions tab to the current web UI. - Added vanilla/Paper player actions for message, gamemode and teleport. - Added all-time player activity storage with day-grouped history in the Players tab. - Added dashboard player activity summaries and top active players.

Changed

- Improved Players tab filtering and reduced repeated history rendering. - Switched the main web UI entrypoint from the legacy HTML resource to the Vite-built React bundle.

Performance

- Cached player activity summary counters instead of recalculating them for every stats payload. Full Changelog: https://github.com/AREKKUZZERA/better-web-console/compare…

Performance and packaging

- Reduced final plugin jar size by excluding unused JNA native binaries for unsupported/rare platforms. - Removed extra Maven/package metadata from shaded jars. - Optimized WebSocket broadcasts so stats/log JSON payloads are built once per broadcast instead of once per connected client. - Reduced small runtime allocations in stats collection, API request body reading, log export filtering, and player/reason validation.

Added

- Added visible Server Health reason badges for low TPS, session errors and high player capacity. - Added dashboard Health History for Watch/Critical state transitions with start time, duration and reasons.

Fixed

- Kept the Server Health tooltip reason text synchronized after changing the web UI language. Full Changelog: https://github.com/AREKKUZZERA/better-web-console/compare…

Added

- Added a persistent 24-hour player activity history store for join, leave and player command events. - Added player activity history to the stats API and Players tab. - Added recent player command count and activity feed updates to the dashboard overview. - Added web UI localization with language selection for English, Russian, Chinese, Polish, German and French.

Changed

- Improved dashboard overview layout and centering. - Improved Players tab responsive layout for smaller screens. - Updated README installation guidance for the new Paper build matrix.

Build

- Added separate Paper build artifacts for Minecraft/Paper 1.21 - 1.21.11 and 26.1 - 26.1.2. - Shortened generated jar names to bwc-<version>-paper-1.21.X.jar and bwc-<version>-paper-26.1.X.jar. - Ignored module target directories.

Fixed

- Protected player activity history compaction from recursive pruning. - Cleared stale activity history UI while stats are unavailable or reset. - Handled empty activity history timestamps in the web UI. - Handled unknown player capacity values in dashboard cards. - Escaped activity feed text before rendering user/server-provided content. - Limited activity history payload size returned by the stats API. - Collected API stats on the main server thread. Full Changelog: https://github.com/AREKKUZZERA/better-web-console/compare…

Added

- Added machine/system metrics to the dashboard: - host CPU load and Java process CPU load - CPU model and core/thread count - physical RAM total/used/free - JVM heap and non-heap memory - JVM uptime - server disk total/used/free - OS, Java version, process id and JVM thread count - Added system-stats config section to enable/disable system metrics, control polling interval and disk reporting.

Changed

- Reworked the dashboard desktop layout into a wider two-column admin view with grouped health, charts, machine details and analytics. - Added hover states to Machine Details cards to match KPI and chart cards.

Fixed

- Fixed repeated Players tab entrance animation loops by preventing re-animation on active-tab clicks and unchanged player lists. - Fixed OSHI configuration warning by keeping OSHI package/resource names unrelocated in the shaded jar.

Added

- Added simplified production-ready config.yml with clearer names and comments. - Added commands.blocked to block risky commands from the web console and aliases. - Added commands.aliases while keeping legacy aliases compatibility. - Added command aliases: /bwconsole, /betterconsole. - Added management subcommands: - /bwc setpassword <user> <new-password> - /bwc logoutall <user> - Added extra subcommand aliases: useradd, createuser, deluser, deleteuser, users, passwd, password, killsessions. - Added JUnit tests for config parsing, safe fallback values and blocked commands. - Added competitor audit and roadmap notes in docs/competitor-audit.md.

Changed

- Removed default destructive restart web alias from the generated config. - Moved aliases under commands.aliases for a clearer config structure. - Invalidating user sessions now happens when removing a user or changing their password. - /bwc status now shows alias and blocked-command counts. - /bwc reload message now clearly states which settings still need a server restart. - API reads the latest plugin config after reload for aliases, logging and cookie settings. - Maven compiler annotation processing is disabled to avoid noisy JDK warnings.

Security

- Web command blocking now applies both to direct commands and alias-expanded commands. - Alias chains are limited to 10 commands. - Kick/ban web actions validate player names and sanitize reasons. - logging.audit-log: false now disables all audit writes consistently. - Optional security.secure-cookies adds the Secure cookie flag for HTTPS deployments.

Fixed

- Fixed broken encoding text in source/config/docs touched by this update. - Fixed stale API config snapshot after /bwc reload. - Fixed sessions remaining active after password change or user removal. Full Changelog: https://github.com/AREKKUZZERA/better-web-console/compare…

Major improvements to security, performance, and overall stability.

---

Security Improvements

Improved authentication system stability* Enhanced session handling* Strengthened rate limiting protections* Minor fixes to CSRF validation flow* ---

Performance

Optimized WebSocket handling* Reduced latency in real-time log streaming* Improved log buffer performance* ---

Improvements

* Better command handling reliability * Improved error handling in API endpoints * More consistent console behavior ---

Bug Fixes

* Fixed issues with command execution edge cases * Resolved minor UI inconsistencies * Fixed rare connection drops ---

Internal Changes

* Codebase cleanup and refactoring * Improved maintainability for future updates