ANTI ADMIN ABUSE

## 2.0.0 - rebuilt for every platform, and for Minecraft 1.8 through 26.2 ### Read this first Three bugs in 1.0 made it unsafe to run, and all three are fixed: - **The bundled `config.yml` contained Java source code instead of YAML**, so the plugin threw on startup. - **The Discord request ran on the server main thread.** Every command executed froze the whole server for a full HTTP round trip to Discord; a slow or unreachable webhook meant a multi-second freeze per command. Delivery now runs on its own thread and never blocks gameplay. - **Command text was pasted straight into the JSON payload.** Any command containing a quote produced a malformed body that Discord rejected. Command text is now properly escaped. ### Massively wider compatibility - **One Bukkit jar now covers Minecraft 1.8 through 26.2** - Bukkit, Spigot, Paper, Purpur, Pufferfish and **Folia**. Previously 1.17-1.21.4, Paper/Spigot only. - **New: Velocity, BungeeCord, Fabric and NeoForge builds.** - Runs on Java 8 and up, including the Java 25 required by Minecraft 26.x. ### Security - **Credential redaction, on by default.** `/login`, `/register`, `/changepassword`, `/authme`, `/2fa` and friends have their arguments replaced with `***`. A command logger that forwards `/login hunter2` to Discord is a password leak, not an audit trail. - **Webhook URLs are scrubbed from all logged command text**, so configuring the plugin can never publish its own webhook URL into the channel it points at. - `@everyone` and role pings in logged commands can no longer notify anyone. ### New - `/aaa status` shows delivered / failed / dropped / queued counters. - `/aaa test` sends a test message so you can confirm setup. - `/aaa reload` re-reads the config without a restart. - `watched-commands` allow-list mode, `ignored-commands` to cut chat noise, `only-staff-commands` to log just operators, and `server-name` so one channel can serve several servers. - Rate limits (HTTP 429) are retried honouring Discord's `Retry-After`; a bad webhook is reported once instead of retried forever. If Discord is unreachable the queue is bounded, so memory cannot run away. - `/setwebhook` still works, and no longer echoes the URL back into chat. ### Verified Booted on real servers with assertions on the actual HTTP payloads: Paper 1.8.8, 1.12.2, 1.16.5, 1.17.1, 1.18.2, 1.20.1, 1.20.6, 1.21.4, 1.21.11, 26.1.2 and 26.2; Folia and Purpur on 1.21.11 and 26.2; Fabric 1.21.11; NeoForge 1.21.11 and 26.2; Velocity 3.5.1. BungeeCord is load-verified only, since it has no console command event to drive from a test - see the README. Fabric is not available for 26.x: yarn mappings have not been published for those releases yet. Use the Bukkit build, which does support 26.2.

## 2.0.0 - rebuilt for every platform, and for Minecraft 1.8 through 26.2 ### Read this first Three bugs in 1.0 made it unsafe to run, and all three are fixed: - **The bundled `config.yml` contained Java source code instead of YAML**, so the plugin threw on startup. - **The Discord request ran on the server main thread.** Every command executed froze the whole server for a full HTTP round trip to Discord; a slow or unreachable webhook meant a multi-second freeze per command. Delivery now runs on its own thread and never blocks gameplay. - **Command text was pasted straight into the JSON payload.** Any command containing a quote produced a malformed body that Discord rejected. Command text is now properly escaped. ### Massively wider compatibility - **One Bukkit jar now covers Minecraft 1.8 through 26.2** - Bukkit, Spigot, Paper, Purpur, Pufferfish and **Folia**. Previously 1.17-1.21.4, Paper/Spigot only. - **New: Velocity, BungeeCord, Fabric and NeoForge builds.** - Runs on Java 8 and up, including the Java 25 required by Minecraft 26.x. ### Security - **Credential redaction, on by default.** `/login`, `/register`, `/changepassword`, `/authme`, `/2fa` and friends have their arguments replaced with `***`. A command logger that forwards `/login hunter2` to Discord is a password leak, not an audit trail. - **Webhook URLs are scrubbed from all logged command text**, so configuring the plugin can never publish its own webhook URL into the channel it points at. - `@everyone` and role pings in logged commands can no longer notify anyone. ### New - `/aaa status` shows delivered / failed / dropped / queued counters. - `/aaa test` sends a test message so you can confirm setup. - `/aaa reload` re-reads the config without a restart. - `watched-commands` allow-list mode, `ignored-commands` to cut chat noise, `only-staff-commands` to log just operators, and `server-name` so one channel can serve several servers. - Rate limits (HTTP 429) are retried honouring Discord's `Retry-After`; a bad webhook is reported once instead of retried forever. If Discord is unreachable the queue is bounded, so memory cannot run away. - `/setwebhook` still works, and no longer echoes the URL back into chat. ### Verified Booted on real servers with assertions on the actual HTTP payloads: Paper 1.8.8, 1.12.2, 1.16.5, 1.17.1, 1.18.2, 1.20.1, 1.20.6, 1.21.4, 1.21.11, 26.1.2 and 26.2; Folia and Purpur on 1.21.11 and 26.2; Fabric 1.21.11; NeoForge 1.21.11 and 26.2; Velocity 3.5.1. BungeeCord is load-verified only, since it has no console command event to drive from a test - see the README. Fabric is not available for 26.x: yarn mappings have not been published for those releases yet. Use the Bukkit build, which does support 26.2.

## 2.0.0 - rebuilt for every platform, and for Minecraft 1.8 through 26.2 ### Read this first Three bugs in 1.0 made it unsafe to run, and all three are fixed: - **The bundled `config.yml` contained Java source code instead of YAML**, so the plugin threw on startup. - **The Discord request ran on the server main thread.** Every command executed froze the whole server for a full HTTP round trip to Discord; a slow or unreachable webhook meant a multi-second freeze per command. Delivery now runs on its own thread and never blocks gameplay. - **Command text was pasted straight into the JSON payload.** Any command containing a quote produced a malformed body that Discord rejected. Command text is now properly escaped. ### Massively wider compatibility - **One Bukkit jar now covers Minecraft 1.8 through 26.2** - Bukkit, Spigot, Paper, Purpur, Pufferfish and **Folia**. Previously 1.17-1.21.4, Paper/Spigot only. - **New: Velocity, BungeeCord, Fabric and NeoForge builds.** - Runs on Java 8 and up, including the Java 25 required by Minecraft 26.x. ### Security - **Credential redaction, on by default.** `/login`, `/register`, `/changepassword`, `/authme`, `/2fa` and friends have their arguments replaced with `***`. A command logger that forwards `/login hunter2` to Discord is a password leak, not an audit trail. - **Webhook URLs are scrubbed from all logged command text**, so configuring the plugin can never publish its own webhook URL into the channel it points at. - `@everyone` and role pings in logged commands can no longer notify anyone. ### New - `/aaa status` shows delivered / failed / dropped / queued counters. - `/aaa test` sends a test message so you can confirm setup. - `/aaa reload` re-reads the config without a restart. - `watched-commands` allow-list mode, `ignored-commands` to cut chat noise, `only-staff-commands` to log just operators, and `server-name` so one channel can serve several servers. - Rate limits (HTTP 429) are retried honouring Discord's `Retry-After`; a bad webhook is reported once instead of retried forever. If Discord is unreachable the queue is bounded, so memory cannot run away. - `/setwebhook` still works, and no longer echoes the URL back into chat. ### Verified Booted on real servers with assertions on the actual HTTP payloads: Paper 1.8.8, 1.12.2, 1.16.5, 1.17.1, 1.18.2, 1.20.1, 1.20.6, 1.21.4, 1.21.11, 26.1.2 and 26.2; Folia and Purpur on 1.21.11 and 26.2; Fabric 1.21.11; NeoForge 1.21.11 and 26.2; Velocity 3.5.1. BungeeCord is load-verified only, since it has no console command event to drive from a test - see the README. Fabric is not available for 26.x: yarn mappings have not been published for those releases yet. Use the Bukkit build, which does support 26.2.

## 2.0.0 - rebuilt for every platform, and for Minecraft 1.8 through 26.2 ### Read this first Three bugs in 1.0 made it unsafe to run, and all three are fixed: - **The bundled `config.yml` contained Java source code instead of YAML**, so the plugin threw on startup. - **The Discord request ran on the server main thread.** Every command executed froze the whole server for a full HTTP round trip to Discord; a slow or unreachable webhook meant a multi-second freeze per command. Delivery now runs on its own thread and never blocks gameplay. - **Command text was pasted straight into the JSON payload.** Any command containing a quote produced a malformed body that Discord rejected. Command text is now properly escaped. ### Massively wider compatibility - **One Bukkit jar now covers Minecraft 1.8 through 26.2** - Bukkit, Spigot, Paper, Purpur, Pufferfish and **Folia**. Previously 1.17-1.21.4, Paper/Spigot only. - **New: Velocity, BungeeCord, Fabric and NeoForge builds.** - Runs on Java 8 and up, including the Java 25 required by Minecraft 26.x. ### Security - **Credential redaction, on by default.** `/login`, `/register`, `/changepassword`, `/authme`, `/2fa` and friends have their arguments replaced with `***`. A command logger that forwards `/login hunter2` to Discord is a password leak, not an audit trail. - **Webhook URLs are scrubbed from all logged command text**, so configuring the plugin can never publish its own webhook URL into the channel it points at. - `@everyone` and role pings in logged commands can no longer notify anyone. ### New - `/aaa status` shows delivered / failed / dropped / queued counters. - `/aaa test` sends a test message so you can confirm setup. - `/aaa reload` re-reads the config without a restart. - `watched-commands` allow-list mode, `ignored-commands` to cut chat noise, `only-staff-commands` to log just operators, and `server-name` so one channel can serve several servers. - Rate limits (HTTP 429) are retried honouring Discord's `Retry-After`; a bad webhook is reported once instead of retried forever. If Discord is unreachable the queue is bounded, so memory cannot run away. - `/setwebhook` still works, and no longer echoes the URL back into chat. ### Verified Booted on real servers with assertions on the actual HTTP payloads: Paper 1.8.8, 1.12.2, 1.16.5, 1.17.1, 1.18.2, 1.20.1, 1.20.6, 1.21.4, 1.21.11, 26.1.2 and 26.2; Folia and Purpur on 1.21.11 and 26.2; Fabric 1.21.11; NeoForge 1.21.11 and 26.2; Velocity 3.5.1. BungeeCord is load-verified only, since it has no console command event to drive from a test - see the README. Fabric is not available for 26.x: yarn mappings have not been published for those releases yet. Use the Bukkit build, which does support 26.2.

## 2.0.0 - rebuilt for every platform, and for Minecraft 1.8 through 26.2 ### Read this first Three bugs in 1.0 made it unsafe to run, and all three are fixed: - **The bundled `config.yml` contained Java source code instead of YAML**, so the plugin threw on startup. - **The Discord request ran on the server main thread.** Every command executed froze the whole server for a full HTTP round trip to Discord; a slow or unreachable webhook meant a multi-second freeze per command. Delivery now runs on its own thread and never blocks gameplay. - **Command text was pasted straight into the JSON payload.** Any command containing a quote produced a malformed body that Discord rejected. Command text is now properly escaped. ### Massively wider compatibility - **One Bukkit jar now covers Minecraft 1.8 through 26.2** - Bukkit, Spigot, Paper, Purpur, Pufferfish and **Folia**. Previously 1.17-1.21.4, Paper/Spigot only. - **New: Velocity, BungeeCord, Fabric and NeoForge builds.** - Runs on Java 8 and up, including the Java 25 required by Minecraft 26.x. ### Security - **Credential redaction, on by default.** `/login`, `/register`, `/changepassword`, `/authme`, `/2fa` and friends have their arguments replaced with `***`. A command logger that forwards `/login hunter2` to Discord is a password leak, not an audit trail. - **Webhook URLs are scrubbed from all logged command text**, so configuring the plugin can never publish its own webhook URL into the channel it points at. - `@everyone` and role pings in logged commands can no longer notify anyone. ### New - `/aaa status` shows delivered / failed / dropped / queued counters. - `/aaa test` sends a test message so you can confirm setup. - `/aaa reload` re-reads the config without a restart. - `watched-commands` allow-list mode, `ignored-commands` to cut chat noise, `only-staff-commands` to log just operators, and `server-name` so one channel can serve several servers. - Rate limits (HTTP 429) are retried honouring Discord's `Retry-After`; a bad webhook is reported once instead of retried forever. If Discord is unreachable the queue is bounded, so memory cannot run away. - `/setwebhook` still works, and no longer echoes the URL back into chat. ### Verified Booted on real servers with assertions on the actual HTTP payloads: Paper 1.8.8, 1.12.2, 1.16.5, 1.17.1, 1.18.2, 1.20.1, 1.20.6, 1.21.4, 1.21.11, 26.1.2 and 26.2; Folia and Purpur on 1.21.11 and 26.2; Fabric 1.21.11; NeoForge 1.21.11 and 26.2; Velocity 3.5.1. BungeeCord is load-verified only, since it has no console command event to drive from a test - see the README. Fabric is not available for 26.x: yarn mappings have not been published for those releases yet. Use the Bukkit build, which does support 26.2.

## 2.0.0 - rebuilt for every platform, and for Minecraft 1.8 through 26.2 ### Read this first Three bugs in 1.0 made it unsafe to run, and all three are fixed: - **The bundled `config.yml` contained Java source code instead of YAML**, so the plugin threw on startup. - **The Discord request ran on the server main thread.** Every command executed froze the whole server for a full HTTP round trip to Discord; a slow or unreachable webhook meant a multi-second freeze per command. Delivery now runs on its own thread and never blocks gameplay. - **Command text was pasted straight into the JSON payload.** Any command containing a quote produced a malformed body that Discord rejected. Command text is now properly escaped. ### Massively wider compatibility - **One Bukkit jar now covers Minecraft 1.8 through 26.2** - Bukkit, Spigot, Paper, Purpur, Pufferfish and **Folia**. Previously 1.17-1.21.4, Paper/Spigot only. - **New: Velocity, BungeeCord, Fabric and NeoForge builds.** - Runs on Java 8 and up, including the Java 25 required by Minecraft 26.x. ### Security - **Credential redaction, on by default.** `/login`, `/register`, `/changepassword`, `/authme`, `/2fa` and friends have their arguments replaced with `***`. A command logger that forwards `/login hunter2` to Discord is a password leak, not an audit trail. - **Webhook URLs are scrubbed from all logged command text**, so configuring the plugin can never publish its own webhook URL into the channel it points at. - `@everyone` and role pings in logged commands can no longer notify anyone. ### New - `/aaa status` shows delivered / failed / dropped / queued counters. - `/aaa test` sends a test message so you can confirm setup. - `/aaa reload` re-reads the config without a restart. - `watched-commands` allow-list mode, `ignored-commands` to cut chat noise, `only-staff-commands` to log just operators, and `server-name` so one channel can serve several servers. - Rate limits (HTTP 429) are retried honouring Discord's `Retry-After`; a bad webhook is reported once instead of retried forever. If Discord is unreachable the queue is bounded, so memory cannot run away. - `/setwebhook` still works, and no longer echoes the URL back into chat. ### Verified Booted on real servers with assertions on the actual HTTP payloads: Paper 1.8.8, 1.12.2, 1.16.5, 1.17.1, 1.18.2, 1.20.1, 1.20.6, 1.21.4, 1.21.11, 26.1.2 and 26.2; Folia and Purpur on 1.21.11 and 26.2; Fabric 1.21.11; NeoForge 1.21.11 and 26.2; Velocity 3.5.1. BungeeCord is load-verified only, since it has no console command event to drive from a test - see the README. Fabric is not available for 26.x: yarn mappings have not been published for those releases yet. Use the Bukkit build, which does support 26.2.

added consle logger

saves discord webhook

First Release