ConsoleDiscord

[1.5.0] - 2026-07-11 — Security, Stability & Feature Release

Backport of the v2.1.0 changes from the Minecraft 26.x line: a full security and code review (fixes three attack vectors, five functional bugs and a packaging issue) plus a set of new quality-of-life features.

Breaking Change

- Empty whitelists now mean deny-all. Previously an empty allowed-user-ids list allowed every Discord user in every server the bot was in to run console commands — with only op/deop blocked, anyone could run stop, ban, whitelist add, etc. Commands are now disabled until at least one Discord user ID (or role ID, see below) is whitelisted; a clear warning is logged on startup. Migration: add your Discord user ID to allowed-user-ids in config.yml.

New Features

- Command output replies: /mc and !mc now reply with the actual command output (captured via Paper's feedback sender) instead of a generic "executing" note — e.g. /mc list shows the real player list in Discord. Configurable via command-feedback (enabled + collect window). - Role-based whitelist: allowed-role-ids allows everyone holding one of the configured Discord roles to run commands — easier to manage for teams than individual user IDs. - `/cdr status`: shows plugin version, server type, Discord connection state, configured channels (validated live), pending log queue size, whitelist counts and available updates. - `/cdr cleanup`: manually triggers the message cleanup (the existing cleanupNow() logic was previously unreachable). - Tab completion for all /cdr subcommands, filtered by permission. - Token via environment: the bot token can be provided through the CONSOLEDISCORD_BOT_TOKEN environment variable, which takes precedence over config.yml — keeps the token out of config backups and support pastes. - Periodic update check: the Modrinth check now repeats every update-checker.interval-hours (default 24, 0 = startup only) so long-running servers get notified too. - Audit log rotation: command-audit.max-file-size-mb (default 10) rotates audit.log to audit.log.old so it no longer grows unbounded. - Startup notification is now sent when the Discord connection is actually established instead of after a fixed 5-second delay (which silently skipped it on slow logins). - LICENSE file added (MIT) — the README referenced it, but it didn't exist.

Security

- Blocked-command checks can no longer be bypassed via plugin namespaces: all namespaced commands (minecraft:op, essentials:op, anyplugin:cmd, ...) are rejected. Previously only minecraft:, bukkit:, spigot: and paper: were caught, so essentials:op slipped past the op block. - Leading slashes are stripped before the security check, so /op cannot bypass the op blocklist entry. - !mc commands are ignored in direct messages — console access is only possible in guild channels where the channel restriction can apply. - Default blocklist extended to op, deop, stop, restart, reload, ban-ip (existing configs keep their own list).

Bugfixes

- Config validation no longer runs before JDA is connected — the channel cache was still empty right after startup, producing false "invalid channel-id" warnings on every start/reload. Validation now runs once the connection is established. - Fixed a thread leak on /cdr reload: the previous AuditLogger writer thread is now shut down before a new one is created, and disabling the audit log via reload actually deactivates it. - Fixed command aliases with a missing/non-string target being loaded as the literal command "null"; invalid aliases are now skipped with a warning. Alias keys are also normalized to lowercase so aliases with capital letters match. - Fixed the shutdown notification potentially hanging onDisable() forever — complete() has no timeout and retries rate limits indefinitely; replaced with a hard 5-second timeout. - Fixed oversized log lines producing an empty code block in Discord; overlong lines are now truncated instead of silently dropped.

Improvements

- Watchdog reconnects no longer run on the main server thread — stopDiscordStuff() waits up to ~7s on JDA shutdown, which previously caused lag spikes on every reconnect attempt. - A blocked command no longer consumes rate-limit quota (security check now runs before the rate limiter). - lastConnected/restartBackoffSec are now volatile (written by the JDA event thread, read by the watchdog thread). - Bulk message cleanup uses a 13-day boundary so messages close to Discord's 14-day bulk-delete limit don't fail while requests are queued. - Test suite extended from 21 to 41 tests: new coverage for LogFilter (level/pattern/category filtering) and LogFormatter (Discord message/embed limits), plus new CommandSecurity bypass tests.

Build

- All shaded JDA transitive dependencies (okhttp, okio, kotlin-stdlib, jackson, nv-websocket, commons-collections4, trove, tink, protobuf) are now relocated into the plugin's own namespace — previously they were shaded unrelocated and could clash with other plugins bundling the same libraries. slf4j and annotation-only artifacts are excluded from the JAR entirely. Build: Java 21 | Paper 1.21.4 | JDA 6.1.0 | Folia supported Migration: Swap the JAR and add your Discord user ID to `allowed-user-ids` (see Breaking Change above).

[2.1.0] - 2026-07-10 — Security, Stability & Feature Release

Full security and code review of the plugin (fixes three attack vectors, five functional bugs and a packaging issue) plus a set of new quality-of-life features.

Breaking Change

- Empty whitelists now mean deny-all. Previously an empty allowed-user-ids list allowed every Discord user in every server the bot was in to run console commands — with only op/deop blocked, anyone could run stop, ban, whitelist add, etc. Commands are now disabled until at least one Discord user ID (or role ID, see below) is whitelisted; a clear warning is logged on startup. Migration: add your Discord user ID to allowed-user-ids in config.yml.

New Features

- Command output replies: /mc and !mc now reply with the actual command output (captured via Paper's feedback sender) instead of a generic "executing" note — e.g. /mc list shows the real player list in Discord. Configurable via command-feedback (enabled + collect window). - Role-based whitelist: allowed-role-ids allows everyone holding one of the configured Discord roles to run commands — easier to manage for teams than individual user IDs. - `/cdr status`: shows plugin version, server type, Discord connection state, configured channels (validated live), pending log queue size, whitelist counts and available updates. - `/cdr cleanup`: manually triggers the message cleanup (the existing cleanupNow() logic was previously unreachable). - Tab completion for all /cdr subcommands, filtered by permission. - Token via environment: the bot token can be provided through the CONSOLEDISCORD_BOT_TOKEN environment variable, which takes precedence over config.yml — keeps the token out of config backups and support pastes. - Periodic update check: the Modrinth check now repeats every update-checker.interval-hours (default 24, 0 = startup only) so long-running servers get notified too. - Audit log rotation: command-audit.max-file-size-mb (default 10) rotates audit.log to audit.log.old so it no longer grows unbounded. - Startup notification is now sent when the Discord connection is actually established instead of after a fixed 5-second delay (which silently skipped it on slow logins). - LICENSE file added (MIT) — the README referenced it, but it didn't exist.

Security

- Blocked-command checks can no longer be bypassed via plugin namespaces: all namespaced commands (minecraft:op, essentials:op, anyplugin:cmd, ...) are rejected. Previously only minecraft:, bukkit:, spigot: and paper: were caught, so essentials:op slipped past the op block. - Leading slashes are stripped before the security check, so /op cannot bypass the op blocklist entry. - !mc commands are ignored in direct messages — console access is only possible in guild channels where the channel restriction can apply. - Default blocklist extended to op, deop, stop, restart, reload, ban-ip (existing configs keep their own list).

Bugfixes

- Config validation no longer runs before JDA is connected — the channel cache was still empty right after startup, producing false "invalid channel-id" warnings on every start/reload. Validation now runs once the connection is established. - Fixed a thread leak on /cdr reload: the previous AuditLogger writer thread is now shut down before a new one is created, and disabling the audit log via reload actually deactivates it. - Fixed command aliases with a missing/non-string target being loaded as the literal command "null"; invalid aliases are now skipped with a warning. Alias keys are also normalized to lowercase so aliases with capital letters match. - Fixed the shutdown notification potentially hanging onDisable() forever — complete() has no timeout and retries rate limits indefinitely; replaced with a hard 5-second timeout. - Fixed oversized log lines producing an empty code block in Discord; overlong lines are now truncated instead of silently dropped.

Improvements

- Watchdog reconnects no longer run on the main server thread — stopDiscordStuff() waits up to ~7s on JDA shutdown, which previously caused lag spikes on every reconnect attempt. - A blocked command no longer consumes rate-limit quota (security check now runs before the rate limiter). - lastConnected/restartBackoffSec are now volatile (written by the JDA event thread, read by the watchdog thread). - Bulk message cleanup uses a 13-day boundary so messages close to Discord's 14-day bulk-delete limit don't fail while requests are queued. - Test suite extended from 21 to 41 tests: new coverage for LogFilter (level/pattern/category filtering) and LogFormatter (Discord message/embed limits), plus new CommandSecurity bypass tests.

Build

- All shaded JDA transitive dependencies (okhttp, okio, kotlin-stdlib, jackson, nv-websocket, commons-collections4, trove, tink, protobuf) are now relocated into the plugin's own namespace — previously they were shaded unrelocated and could clash with other plugins bundling the same libraries. slf4j and annotation-only artifacts are excluded from the JAR entirely. Build: Java 25 | Paper 26.1.2 | JDA 6.1.0 | Folia supported Migration: Swap the JAR and add your Discord user ID to `allowed-user-ids` (see Breaking Change above).

[2.0.1] - 2026-06-05 — Bugfix, Tests & Setup Guide

Backport of the v1.4.2 fixes to the Minecraft 26.x / Java 25 line.

Bugfixes

- Fixed Discord showing "command failed" for vanilla commands that actually ran — Bukkit.dispatchCommand()'s unreliable return value is no longer treated as success/failure; only a thrown exception counts as a failure. The audit log now records the real execution status. - Fixed the RateLimiter memory leak for good — removed the self-defeating empty-entry churn (entries were removed and immediately re-added) and added a periodic purgeExpired() that runs automatically every 100 commands, keeping the tracking map bounded on busy public servers. - Fixed HttpURLConnection not being released in ModrinthUpdateChecker — disconnect() is now called in a finally block.

Improvements

- The plugin no longer forwards its own log messages to Discord, preventing echo/feedback noise (e.g. repeated send-error warnings looping back into the log channel). - Added a JUnit 5 test suite (21 tests) covering CommandSecurity, RateLimiter and the update-checker version comparison; tests run on every build via Surefire. - Added a bundled SETUP.md guide (installation + step-by-step Discord bot creation), automatically exported next to config.yml on first start.

[1.4.2] - 2026-06-05 — Bugfix, Tests & Setup Guide

Bugfixes

- Fixed Discord showing "command failed" for vanilla commands that actually ran — Bukkit.dispatchCommand()'s unreliable return value is no longer treated as success/failure; only a thrown exception counts as a failure. The audit log now records the real execution status. - Fixed the RateLimiter memory leak for good — removed the self-defeating empty-entry churn (entries were removed and immediately re-added) and added a periodic purgeExpired() that runs automatically every 100 commands, keeping the tracking map bounded on busy public servers. - Fixed HttpURLConnection not being released in ModrinthUpdateChecker — disconnect() is now called in a finally block.

Improvements

- The plugin no longer forwards its own log messages to Discord, preventing echo/feedback noise (e.g. repeated send-error warnings looping back into the log channel). - Added a JUnit 5 test suite (21 tests) covering CommandSecurity, RateLimiter and the update-checker version comparison; tests run on every build via Surefire. - Added a bundled SETUP.md guide (installation + step-by-step Discord bot creation), automatically exported next to config.yml on first start. - bStats metrics integration for anonymous usage statistics (moved here — the commit landed after the 1.4.1 release). - Aligned @version JavaDoc tags across classes and corrected placeholder GitHub links in the README.

[2.0.0] - 2026-05-03 — Minecraft 26 Edition

Port of v1.4.1 to Minecraft 26.x with Java 25. Functionally identical to v1.4.1. - Java 25 target (was Java 21) - Paper API 26.1.2 (was 1.21.4) - api-version: 26.1 (was 1.21) - bStats metrics integration Build: Java 25 | Paper 26.1.2 | JDA 6.1.0 | Folia supported

[1.4.1] - 2026-05-03 — Bugfix & Quality Release

Bugfixes

- Fixed NullPointerException when audit logging is disabled - Fixed rate limiter not updating on config reload - Fixed allowed-user-ids not working with unquoted numeric IDs - Fixed default config re-adding placeholder user IDs - Fixed token placeholder check (now recognizes EN + DE placeholders) - Fixed resource leak in ModrinthUpdateChecker (try-with-resources) - Fixed LogFilter regex using matches() instead of find() — patterns no longer need .* wrapping - Fixed RateLimiter memory leak on public servers (auto-cleanup of empty entries) - Fixed update checker notifying about incompatible Java/MC versions - Fixed language files not receiving new message keys on update (auto-merge added)

Improvements

- Log queue: O(1) size tracking via AtomicInteger - Async audit log file writing (dedicated daemon thread) - Bulk delete for message cleanup (Discord API, < 14 days) - Command aliases pointing to blocked commands are rejected on load - Performance alerts (TPS/Memory) now fully localized (EN/DE) - Update checker filters by Minecraft version via Modrinth API - Language files auto-merge new keys (like config.yml already did) - Deprecated API calls replaced (URL constructor, Reflection for TPS) - bStats metrics integration Build: Java 21 | Paper 1.21 - 1.21.11 | JDA 6.1.0 | Folia supported Migration: Drop-in replacement — just swap the JAR.

[1.4.0] - 2026-04-10 Folia Support & Stability Release

New Features

Folia Compatibility - Full Folia support - Plugin now works on both Paper and Folia servers - Automatic detection - Detects server type and uses appropriate scheduler API - Zero configuration - Works out of the box on both platforms - Region-aware scheduling - Uses global region scheduler for console commands on Folia - Async scheduler migration - All async tasks use Folia's new scheduler when available Modrinth Update Checker - Automatically checks for new versions on startup via Modrinth API - Notification in server console and optionally in Discord channel - Configurable: update-checker.enabled Config Auto-Merge - New config options from updates are automatically added to existing config - User values are never overwritten - only missing keys are added - No more manual config migration needed after updates

Bugfixes

- Fixed: `MAX_EMBED_SIZE_EXCEEDED` error - Embeds are now split into groups that respect Discord's 6000 character total limit per message. Previously, multiple embeds could exceed this limit and cause ErrorResponseException: 50035 - Fixed: `Thread.sleep(1000)` blocking server shutdown - Removed unnecessary sleep in onDisable(). The shutdown notification already uses blocking complete() call - Fixed: `CommandSecurity` race condition - Static fields are now thread-safe using AtomicBoolean and AtomicReference. Config reloads during command checks no longer cause inconsistent state - Fixed: `SchedulerAdapter.isCancelled()` always returning `false` - Folia tasks now properly track cancel state via AtomicBoolean, Paper tasks delegate to BukkitTask.isCancelled() - Fixed: Potential `NullPointerException` in `MessageCleanup` - Added null-safety check for jda.getSelfUser() during message cleanup - Fixed: Fragile JSON parsing in `ModrinthUpdateChecker` - Replaced manual indexOf()/substring() parsing with Gson for robust Modrinth API response handling

Changes

Scheduler Refactoring - New SchedulerAdapter class provides unified API for Paper and Folia - Replaced all Bukkit.getScheduler() calls with adapter methods - Console commands now use GlobalRegionScheduler on Folia - Removed busy-wait loops when cancelling tasks (cleaner shutdown) Code Cleanup - Removed legacy org.example package (outdated duplicate code from pre-1.3.0) - Added Gson as provided dependency (shipped by Paper at runtime) Technical Details - Auto-detection via io.papermc.paper.threadedregions.RegionizedServer class check - folia-supported: true flag in plugin.yml - Backwards compatible with Paper/Spigot servers

Build Information

JAR File: consolediscord-1.4.0.jar Size: ~16 MB (with JDA shaded) Java Version: 21 Paper Version: 1.21.4-R0.1-SNAPSHOT (also supports Folia) JDA Version: 6.1.0 ---

Migration Guide from 1.3.0 → 1.4.0

Automatic Migration

All changes are 100% backwards compatible. Simply replace the JAR file! New config options (like update-checker) are automatically merged into your existing config.yml on first startup - no manual editing needed.

[1.3.0] - 2026-03-10 The Big Feature Update

New Features

#### Intelligent Log Forwarding 1. Discord Embeds instead of Code Blocks - Color-coded embeds for better readability (Green=INFO, Orange=WARN, Red=ERROR) - Structured presentation with timestamps - Batch processing: Up to 10 log lines per embed - Configurable: log-formatting.use-embeds 2. Emoji Encoding for Log Levels - FATAL - Critical errors - ERROR - Errors - WARN - Warnings - INFO - Information - DEBUG - Debug output - TRACE - Trace logs - Configurable: log-formatting.use-emojis 3. Log-Level Filtering - Send only specific log levels to Discord - Default: INFO, WARN, ERROR, FATAL - Configurable: log-levels: [INFO, WARN, ERROR] 4. Regex Filters for Logs - Filter out annoying spam logs ("Can't keep up", UUID warnings) - Unlimited regex patterns - Configurable: log-filters.ignore-patterns 5. Log Categories with Separate Channels - Security logs in separate channel (op, ban, kick, etc.) - Performance logs in separate channel (TPS, Memory) - Unlimited categories definable - Pattern-based routing - Configurable: log-categories #### Remote Commands 6. Command Autocomplete - Intelligent suggestions while typing - Pre-configured common commands (gamemode, weather, time, difficulty, etc.) - Also shows command aliases - Automatic Discord slash command integration 7. Command Aliases - Define shortcuts: tps → spark tps - Unlimited aliases - Autocomplete shows aliases with arrow: tps → spark tps - Configurable: command-aliases.aliases #### Security & Monitoring 8. Command Audit Logging - Logs every command with user, timestamp, and status - File-based: plugins/ConsoleDiscord/audit.log - Optionally also in Discord channel - Format: [2026-03-10 19:30:45] User#123 (Name) executed: cmd [SUCCESS] - Configurable: command-audit 9. Performance Alerts - TPS warning at < 15.0 TPS (adjustable) - Memory warning at > 90% RAM (adjustable) - Cooldown system prevents spam (default: 5min) - Color-coded embeds: Warning / Critical - Configurable: performance-alerts #### Management 10. Startup/Shutdown Notifications - Server Start: Shows version & plugin count - Server Stop: Shows uptime - Beautiful embeds with timestamp - Configurable: notifications.startup & notifications.shutdown 11. Auto-Cleanup for Old Messages - Automatically deletes old log messages - Default: After 7 days (adjustable) - Check every 24 hours (adjustable) - Only bot's own messages are deleted - Configurable: auto-cleanup 12. Batch Embeds - Groups up to 10 log lines per embed - Discord limit: Max 10 embeds per message - Reduces API calls and rate limits - Better performance with many logs - Configurable: log-formatting.embed-batch-size 13. Configurable Command Blacklist - Fully customizable: You decide which commands to block - Default recommendation: Only op and deop blocked (changeable) - Flexible: Add commands like stop, restart, whitelist as needed - Disableable: Security can be completely turned off - Namespace protection: Prefixes like minecraft:, bukkit: are always blocked - Configurable: command-security.enabled & command-security.blocked-commands ---

Changes

#### Package Refactoring

Before: org.example
Now:    dev.boondocksulfur.consolediscord

New Package Structure: - dev.boondocksulfur.consolediscord - Main plugin - dev.boondocksulfur.consolediscord.audit - Audit logging - dev.boondocksulfur.consolediscord.cleanup - Message cleanup - dev.boondocksulfur.consolediscord.i18n - Internationalization - dev.boondocksulfur.consolediscord.listener - Discord events - dev.boondocksulfur.consolediscord.logging - Log appender & formatter - dev.boondocksulfur.consolediscord.performance - Performance monitoring - dev.boondocksulfur.consolediscord.security - Security & rate limiting #### Maven Configuration - groupId: dev.boondocksulfur (previously: org.example) - artifactId: consolediscord (previously: console-discord) - JDA relocation adjusted #### Config Extensions The config.yml has been extended with 58 new options: - Advanced logging options (17 options) - Command features (10 options) - Performance alerts (4 options) - Notifications & cleanup (5 options) ---

Documentation

- JavaDoc: Complete documentation for all classes and methods - README.md: Completely revised with feature matrix and examples - CHANGELOG.md: Detailed changelog with migration guide ---

Improvements

- Better error messages with i18n support - More informative Discord responses (emojis for feedback) - Cleaner code structure with separation of concerns - Improved type safety with proper generics - More consistent logging practices - Optimized performance through batch processing - NEW: Thread-safe reconnect logic with synchronized lock - no more race conditions - NEW: Discord bot token format validation on startup - NEW: Configurable command blacklist - you decide which commands to block ---

Security

- Blocks execution of server-critical commands - Prevents command spam via rate limiting - Validates user permissions before execution - Filters commands with namespace prefixes - Audit trail for all commands - NEW: Configurable command blacklist - blocks only dangerous operations you specify - NEW: Discord bot token validation - checks format and length on startup - NEW: Race condition protection for Discord reconnects through synchronized lock ---

Build Information

JAR File: consolediscord-1.3.0.jar Size: ~8 MB (with JDA shaded) Java Version: 21 Paper Version: 1.21.4-R0.1-SNAPSHOT JDA Version: 6.1.0 ---

Migration Guide from 1.2.0 → 1.3.0

Automatic Migration

Most changes are backwards compatible. Your old config.yml will continue to work!

New Config Options

On first startup with 1.3.0, these options will be automatically added:

# New options with defaults
language: "en"
max-commands-per-minute: 5
command-security:
  enabled: true
  blocked-commands: ["op", "deop"]
log-levels: [INFO, WARN, ERROR, FATAL]
log-formatting:
  use-embeds: true
  use-emojis: true
  embed-batch-size: 10
log-filters:
  ignore-patterns: []
log-categories:
  enabled: false
command-aliases:
  enabled: true
  aliases: {}
command-audit:
  enabled: true
  log-file: "audit.log"
performance-alerts:
  enabled: true
  low-tps-threshold: 15.0
  high-memory-threshold: 90
notifications:
  startup: true
  shutdown: true
auto-cleanup:
  enabled: false

Recommended Post-Migration Steps

1. Enable Discord Embeds:

   log-formatting:
     use-embeds: true
     use-emojis: true
   

2. Filter Spam Logs:

   log-filters:
     ignore-patterns:
       - "Can't keep up! Is the server overloaded\\?"
   

3. Configure Command Aliases:

   command-aliases:
     enabled: true
     aliases:
       tps: "spark tps"
       save: "save-all"
   

4. Reload Plugin:

   /cdr reload
   

Breaking Changes

None! All changes are backwards compatible.

[1.2.0] - 2025-01-22

Bugfixes

- Discord Slash-Command Interaction Fix: Behoben, dass beim Ausführen von /mc cdr reload der Fehler IllegalStateException: This interaction has already been acknowledged auftrat - Slash-Commands verwenden jetzt deferReply() um Discord sofort zu bestätigen - Antworten werden nun über getHook().sendMessage() gesendet - JDA-Status wird geprüft bevor Antworten gesendet werden, um Race Conditions beim Reload zu vermeiden - Verbesserte Fehlerbehandlung: Alle Discord-API-Aufrufe haben jetzt Error-Handler, die Fehler loggen statt Exceptions zu werfen

Technische Details

- DiscordListener.java: Refactoring der runMinecraftCommand() Methode - Neue Helper-Methode sendResponse() für saubere Trennung von Slash-Command und Message-Antworten

[1.1.0] - Initiale Version

Features

- Server-Konsolen-Logs werden automatisch in einen Discord-Channel gepostet - Minecraft-Befehle können über Discord ausgeführt werden: - /mc <befehl> - Slash-Command - !mc <befehl> - Text-Prefix - Konfigurierbare Berechtigungen (User-IDs) - Optionaler Command-Channel für eingeschränkte Nutzung - Watchdog für automatische JDA-Reconnects - Debug-Modus für JDA-Status-Logging

Changelog Fixed an issue where ConsoleDiscord could throw an IllegalStateException: zip file closed when handling the Discord WebSocket shutdown. Improved plugin classloader handling to prevent crashes and unnecessary error stacktraces in the console.