ВЕРСИИ (29)

### Added - Added JVM garbage-collection metrics to server statistics: collection count, cumulative collection time, committed heap and heap usage percentage. - Added a dashboard card showing total GC collections and cumulative pause time. ### Performance - Batched incoming WebSocket console log rendering with `requestAnimationFrame` and `DocumentFragment` to reduce DOM updates and layout work during log bursts. - Kept console auto-scroll, filtering, search highlighting, line limits and log ordering unchanged while reducing per-line rendering overhead. - Removed persistent `will-change` allocation from every console log line. - Cached the ANSI escape pattern used by the Log4j console appender instead of compiling the regular expression for every log message.

### Added - Added JVM garbage-collection metrics to server statistics: collection count, cumulative collection time, committed heap and heap usage percentage. - Added a dashboard card showing total GC collections and cumulative pause time. ### Performance - Batched incoming WebSocket console log rendering with `requestAnimationFrame` and `DocumentFragment` to reduce DOM updates and layout work during log bursts. - Kept console auto-scroll, filtering, search highlighting, line limits and log ordering unchanged while reducing per-line rendering overhead. - Removed persistent `will-change` allocation from every console log line. - Cached the ANSI escape pattern used by the Log4j console appender instead of compiling the regular expression for every log message.

### Added - Added JVM garbage-collection metrics to server statistics: collection count, cumulative collection time, committed heap and heap usage percentage. - Added a dashboard card showing total GC collections and cumulative pause time. ### Performance - Batched incoming WebSocket console log rendering with `requestAnimationFrame` and `DocumentFragment` to reduce DOM updates and layout work during log bursts. - Kept console auto-scroll, filtering, search highlighting, line limits and log ordering unchanged while reducing per-line rendering overhead. - Removed persistent `will-change` allocation from every console log line. - Cached the ANSI escape pattern used by the Log4j console appender instead of compiling the regular expression for every log message.

### Added - Added Paper `26.2` compatibility detection to the diagnostics API. ### Fixed - Batched server-stats history compaction after retention pruning, preventing a full history-file rewrite for every new point at the retention limit.

### Added - Added Paper `26.2` compatibility detection to the diagnostics API. ### Fixed - Batched server-stats history compaction after retention pruning, preventing a full history-file rewrite for every new point at the retention limit.

### Added - Added Paper `26.2` compatibility detection to the diagnostics API. ### Fixed - Batched server-stats history compaction after retention pruning, preventing a full history-file rewrite for every new point at the retention limit.

### Changed - Version bump 2.4.9. - Added grouped Paper build artifacts for Minecraft/Paper `1.21` - `1.21.11` and `26.1` - `26.1.2`. - Shortened generated jar names to `bwc-<version>-paper-1.21.X.jar` and `bwc-<version>-paper-26.X.jar`. - Ignored module `target` directories. - Updated README build output and `system-stats.history` / `player-activity` configuration docs. - Rendered Minecraft legacy, hex and MiniMessage-style player name colors in the Players tab. ### Added - Added `/api/players/offline` with pagination, search and configurable page limits for offline player lists. - Added live one-point stats history samples to stats payloads so charts keep moving between persisted history loads. ### Performance - Cached heavy player activity, known-player and offline-player payloads instead of rebuilding them every stats tick. - Reduced repeated LuckPerms/offline-player work during dashboard stats broadcasts. - Reused the server stats history append writer and flushed it in small batches instead of opening the file for every stat point. - Kept live TPS/RAM/player/CPU chart samples updating from the stats stream every second while longer chart ranges load from persisted history. - Buffered player activity history writes with configurable batch flushing. - Moved offline player lists to a paged `/api/players/offline` endpoint instead of including them in every stats payload. - Added configurable cache and flush intervals for stats history and player activity payloads. - Split Chart.js into a lazy-loaded frontend chunk so the initial web UI bundle is smaller. **Full Changelog**: https://github.com/AREKKUZZERA/better-web-console/compare/2.4.8...2.4.9

### Changed - Version bump 2.4.9. - Added grouped Paper build artifacts for Minecraft/Paper `1.21` - `1.21.11` and `26.1` - `26.1.2`. - Shortened generated jar names to `bwc-<version>-paper-1.21.X.jar` and `bwc-<version>-paper-26.X.jar`. - Ignored module `target` directories. - Updated README build output and `system-stats.history` / `player-activity` configuration docs. - Rendered Minecraft legacy, hex and MiniMessage-style player name colors in the Players tab. ### Added - Added `/api/players/offline` with pagination, search and configurable page limits for offline player lists. - Added live one-point stats history samples to stats payloads so charts keep moving between persisted history loads. ### Performance - Cached heavy player activity, known-player and offline-player payloads instead of rebuilding them every stats tick. - Reduced repeated LuckPerms/offline-player work during dashboard stats broadcasts. - Reused the server stats history append writer and flushed it in small batches instead of opening the file for every stat point. - Kept live TPS/RAM/player/CPU chart samples updating from the stats stream every second while longer chart ranges load from persisted history. - Buffered player activity history writes with configurable batch flushing. - Moved offline player lists to a paged `/api/players/offline` endpoint instead of including them in every stats payload. - Added configurable cache and flush intervals for stats history and player activity payloads. - Split Chart.js into a lazy-loaded frontend chunk so the initial web UI bundle is smaller. **Full Changelog**: https://github.com/AREKKUZZERA/better-web-console/compare/2.4.8...2.4.9

### Added - Added a fallback `/api/stats` polling path in the web UI so dashboard data can recover when WebSocket stats are delayed or unavailable. - Added tests for absolute session lifetime expiry behavior. - Persistent TPS/RAM/CPU/player history storage in `server-stats-history.tsv`. - New authenticated endpoint: `GET /api/stats/history`. - Dashboard range selector for `1h`, `6h`, `24h`, and `all`. - Offline player roster, offline profile lookup, and last-seen display. - LuckPerms rank/prefix display via soft dependency. - Config options for stats history retention, API max points, and write interval. ### Changed - Added an absolute web session lifetime limit in addition to the idle timeout. - Added `security.session-max-lifetime-minutes` to `config.yml` and README examples. - Set the session cookie `Max-Age` from the absolute session lifetime so browser cookies and server-side sliding sessions stay consistent. - Matched unknown-user dummy bcrypt verification cost to real password hashes. - Updated `/bwc reload` messaging and docs to mention that session max lifetime changes require a server restart. - Dashboard charts now render persisted/downsampled history. - Player models support online/offline state, rank metadata, and activity counters. - Paper `26.1` grouped artifact renamed from `26.1.X` to `26.X`. - Project version bumped to `2.4.8`. ### Fixed - Restored normal login form submit behavior for browser autofill, password managers and automation. - Cleared the password field after a successful web login. - Warned server owners when the web panel listens on all interfaces without secure cookies or an IP whitelist. - Ensured loaded persisted sessions are rejected when they exceed the absolute lifetime, even if their idle timeout has not expired. **Full Changelog**: https://github.com/AREKKUZZERA/better-web-console/compare/2.4.6...2.4.8

### Added - Added a fallback `/api/stats` polling path in the web UI so dashboard data can recover when WebSocket stats are delayed or unavailable. - Added tests for absolute session lifetime expiry behavior. - Persistent TPS/RAM/CPU/player history storage in `server-stats-history.tsv`. - New authenticated endpoint: `GET /api/stats/history`. - Dashboard range selector for `1h`, `6h`, `24h`, and `all`. - Offline player roster, offline profile lookup, and last-seen display. - LuckPerms rank/prefix display via soft dependency. - Config options for stats history retention, API max points, and write interval. ### Changed - Added an absolute web session lifetime limit in addition to the idle timeout. - Added `security.session-max-lifetime-minutes` to `config.yml` and README examples. - Set the session cookie `Max-Age` from the absolute session lifetime so browser cookies and server-side sliding sessions stay consistent. - Matched unknown-user dummy bcrypt verification cost to real password hashes. - Updated `/bwc reload` messaging and docs to mention that session max lifetime changes require a server restart. - Dashboard charts now render persisted/downsampled history. - Player models support online/offline state, rank metadata, and activity counters. - Paper `26.1` grouped artifact renamed from `26.1.X` to `26.X`. - Project version bumped to `2.4.8`. ### Fixed - Restored normal login form submit behavior for browser autofill, password managers and automation. - Cleared the password field after a successful web login. - Warned server owners when the web panel listens on all interfaces without secure cookies or an IP whitelist. - Ensured loaded persisted sessions are rejected when they exceed the absolute lifetime, even if their idle timeout has not expired. **Full Changelog**: https://github.com/AREKKUZZERA/better-web-console/compare/2.4.6...2.4.8

### Added - Added Spanish (`es`) localization to the web UI language selector. - Added missing localized labels for sessions, audit, config, diagnostics and player profile fields across supported languages. ### Changed - Replaced OSHI-based system metrics with Java runtime and OS MXBean metrics to reduce shaded dependencies and runtime native-library issues. - Added stable `name` attributes to login, console, player, audit, config and modal form controls for better browser autofill and automation compatibility. - Localized remaining hardcoded player activity and profile labels. ### Fixed - Collected an initial stats snapshot when the plugin starts so the dashboard has data sooner after startup. - Loaded existing `logs/latest.log` lines into the web console backlog before live log capture starts.

### Added - Added Spanish (`es`) localization to the web UI language selector. - Added missing localized labels for sessions, audit, config, diagnostics and player profile fields across supported languages. ### Changed - Replaced OSHI-based system metrics with Java runtime and OS MXBean metrics to reduce shaded dependencies and runtime native-library issues. - Added stable `name` attributes to login, console, player, audit, config and modal form controls for better browser autofill and automation compatibility. - Localized remaining hardcoded player activity and profile labels. ### Fixed - Collected an initial stats snapshot when the plugin starts so the dashboard has data sooner after startup. - Loaded existing `logs/latest.log` lines into the web console backlog before live log capture starts.

### Added - Added searchable audit log table with filters by action, user, IP and text query. - Added audit export in JSON and CSV formats. - Added web config editor for aliases, blocked commands, logging and system stats options. - Added compatibility diagnostics for plugin version, Java, server version and supported Paper/Purpur lines. - Added recent error grouping for console ERROR/SEVERE/exception lines. - Added player profile drawer with UUID, gamemode, health, food, level, location and recent activity. ### Changed - Improved dashboard with compatibility and error summary blocks. - Improved player activity history grouping, expand/collapse behavior and mobile layout. - Improved sessions and audit tables on small screens. - Refactored the frontend from legacy bundled code into React components and shared webconsole modules.

### Added - Added searchable audit log table with filters by action, user, IP and text query. - Added audit export in JSON and CSV formats. - Added web config editor for aliases, blocked commands, logging and system stats options. - Added compatibility diagnostics for plugin version, Java, server version and supported Paper/Purpur lines. - Added recent error grouping for console ERROR/SEVERE/exception lines. - Added player profile drawer with UUID, gamemode, health, food, level, location and recent activity. ### Changed - Improved dashboard with compatibility and error summary blocks. - Improved player activity history grouping, expand/collapse behavior and mobile layout. - Improved sessions and audit tables on small screens. - Refactored the frontend from legacy bundled code into React components and shared webconsole modules.

## Added - New Audit tab for recent authentication, command and player-action audit events. - Search and refresh controls for audit history. - Built-in favicon asset. ## Improved - Web sessions are now persisted as SHA-256 token hashes instead of raw session tokens. - Existing session storage is migrated automatically on next startup. - Dashboard stats now use cached snapshots, reducing extra Bukkit main-thread work from web clients. - Chart.js is bundled with the plugin frontend instead of loaded from a CDN.

## Added - New Audit tab for recent authentication, command and player-action audit events. - Search and refresh controls for audit history. - Built-in favicon asset. ## Improved - Web sessions are now persisted as SHA-256 token hashes instead of raw session tokens. - Existing session storage is migrated automatically on next startup. - Dashboard stats now use cached snapshots, reducing extra Bukkit main-thread work from web clients. - Chart.js is bundled with the plugin frontend instead of loaded from a CDN.

### Security - Added same-origin protection for authenticated API POST requests. - Added same-origin protection for WebSocket handshakes. - Tightened Content Security Policy for scripts and WebSocket connections. - Added HSTS automatically when `security.secure-cookies` is enabled. - Added login request body size limits. - Added POSIX owner-only permission hardening for `users.dat`, `sessions.tsv` and `audit.log`. ### Fixed - Fixed active web sessions becoming unstable after restart because refreshed session activity was not persisted. - Fixed WebSocket reconnects resetting per-session command rate limits. - Fixed invalid CIDR whitelist prefixes matching unintended IP addresses. - Fixed audit log shutdown potentially dropping queued entries. - Aligned web login username validation with `/bwc adduser` rules. ### Performance - Cached dummy bcrypt verification hash for unknown-user login attempts. - Cached world/entity stats between stats collection ticks. - Limited and compacted persisted player activity history. - Cached player activity summary counters.

### Security - Added same-origin protection for authenticated API POST requests. - Added same-origin protection for WebSocket handshakes. - Tightened Content Security Policy for scripts and WebSocket connections. - Added HSTS automatically when `security.secure-cookies` is enabled. - Added login request body size limits. - Added POSIX owner-only permission hardening for `users.dat`, `sessions.tsv` and `audit.log`. ### Fixed - Fixed active web sessions becoming unstable after restart because refreshed session activity was not persisted. - Fixed WebSocket reconnects resetting per-session command rate limits. - Fixed invalid CIDR whitelist prefixes matching unintended IP addresses. - Fixed audit log shutdown potentially dropping queued entries. - Aligned web login username validation with `/bwc adduser` rules. ### Performance - Cached dummy bcrypt verification hash for unknown-user login attempts. - Cached world/entity stats between stats collection ticks. - Limited and compacted persisted player activity history. - Cached player activity summary counters.

### Added - Added a React + Vite frontend build pipeline for the web UI. - Added a read-only web sessions metadata API and React sessions panel scaffold. - Added a Sessions tab to the current web UI. - Added vanilla/Paper player actions for message, gamemode and teleport. - Added all-time player activity storage with day-grouped history in the Players tab. - Added dashboard player activity summaries and top active players. ### Changed - Improved Players tab filtering and reduced repeated history rendering. - Switched the main web UI entrypoint from the legacy HTML resource to the Vite-built React bundle. ### Performance - Cached player activity summary counters instead of recalculating them for every stats payload. **Full Changelog**: https://github.com/AREKKUZZERA/better-web-console/compare/2.4.2...2.4.3

### Added - Added a React + Vite frontend build pipeline for the web UI. - Added a read-only web sessions metadata API and React sessions panel scaffold. - Added a Sessions tab to the current web UI. - Added vanilla/Paper player actions for message, gamemode and teleport. - Added all-time player activity storage with day-grouped history in the Players tab. - Added dashboard player activity summaries and top active players. ### Changed - Improved Players tab filtering and reduced repeated history rendering. - Switched the main web UI entrypoint from the legacy HTML resource to the Vite-built React bundle. ### Performance - Cached player activity summary counters instead of recalculating them for every stats payload. **Full Changelog**: https://github.com/AREKKUZZERA/better-web-console/compare/2.4.2...2.4.3

## Performance and packaging - Reduced final plugin jar size by excluding unused JNA native binaries for unsupported/rare platforms. - Removed extra Maven/package metadata from shaded jars. - Optimized WebSocket broadcasts so stats/log JSON payloads are built once per broadcast instead of once per connected client. - Reduced small runtime allocations in stats collection, API request body reading, log export filtering, and player/reason validation.

## Performance and packaging - Reduced final plugin jar size by excluding unused JNA native binaries for unsupported/rare platforms. - Removed extra Maven/package metadata from shaded jars. - Optimized WebSocket broadcasts so stats/log JSON payloads are built once per broadcast instead of once per connected client. - Reduced small runtime allocations in stats collection, API request body reading, log export filtering, and player/reason validation.

### Added - Added visible Server Health reason badges for low TPS, session errors and high player capacity. - Added dashboard Health History for Watch/Critical state transitions with start time, duration and reasons. ### Fixed - Kept the Server Health tooltip reason text synchronized after changing the web UI language. **Full Changelog**: https://github.com/AREKKUZZERA/better-web-console/compare/2.4.0...2.4.1

### Added - Added visible Server Health reason badges for low TPS, session errors and high player capacity. - Added dashboard Health History for Watch/Critical state transitions with start time, duration and reasons. ### Fixed - Kept the Server Health tooltip reason text synchronized after changing the web UI language. **Full Changelog**: https://github.com/AREKKUZZERA/better-web-console/compare/2.4.0...2.4.1

### Added - Added a persistent 24-hour player activity history store for join, leave and player command events. - Added player activity history to the stats API and Players tab. - Added recent player command count and activity feed updates to the dashboard overview. - Added web UI localization with language selection for English, Russian, Chinese, Polish, German and French. ### Changed - Improved dashboard overview layout and centering. - Improved Players tab responsive layout for smaller screens. - Updated README installation guidance for the new Paper build matrix. ### Build - Added separate Paper build artifacts for Minecraft/Paper `1.21` - `1.21.11` and `26.1` - `26.1.2`. - Shortened generated jar names to `bwc-<version>-paper-1.21.X.jar` and `bwc-<version>-paper-26.1.X.jar`. - Ignored module `target` directories. ### Fixed - Protected player activity history compaction from recursive pruning. - Cleared stale activity history UI while stats are unavailable or reset. - Handled empty activity history timestamps in the web UI. - Handled unknown player capacity values in dashboard cards. - Escaped activity feed text before rendering user/server-provided content. - Limited activity history payload size returned by the stats API. - Collected API stats on the main server thread. **Full Changelog**: https://github.com/AREKKUZZERA/better-web-console/compare/2.3.0...2.4.0

### Added - Added a persistent 24-hour player activity history store for join, leave and player command events. - Added player activity history to the stats API and Players tab. - Added recent player command count and activity feed updates to the dashboard overview. - Added web UI localization with language selection for English, Russian, Chinese, Polish, German and French. ### Changed - Improved dashboard overview layout and centering. - Improved Players tab responsive layout for smaller screens. - Updated README installation guidance for the new Paper build matrix. ### Build - Added separate Paper build artifacts for Minecraft/Paper `1.21` - `1.21.11` and `26.1` - `26.1.2`. - Shortened generated jar names to `bwc-<version>-paper-1.21.X.jar` and `bwc-<version>-paper-26.1.X.jar`. - Ignored module `target` directories. ### Fixed - Protected player activity history compaction from recursive pruning. - Cleared stale activity history UI while stats are unavailable or reset. - Handled empty activity history timestamps in the web UI. - Handled unknown player capacity values in dashboard cards. - Escaped activity feed text before rendering user/server-provided content. - Limited activity history payload size returned by the stats API. - Collected API stats on the main server thread. **Full Changelog**: https://github.com/AREKKUZZERA/better-web-console/compare/2.3.0...2.4.0

### Added - Added machine/system metrics to the dashboard: - host CPU load and Java process CPU load - CPU model and core/thread count - physical RAM total/used/free - JVM heap and non-heap memory - JVM uptime - server disk total/used/free - OS, Java version, process id and JVM thread count - Added `system-stats` config section to enable/disable system metrics, control polling interval and disk reporting. ### Changed - Reworked the dashboard desktop layout into a wider two-column admin view with grouped health, charts, machine details and analytics. - Added hover states to Machine Details cards to match KPI and chart cards. ### Fixed - Fixed repeated Players tab entrance animation loops by preventing re-animation on active-tab clicks and unchanged player lists. - Fixed OSHI configuration warning by keeping OSHI package/resource names unrelocated in the shaded jar.

### Added - Added simplified production-ready `config.yml` with clearer names and comments. - Added `commands.blocked` to block risky commands from the web console and aliases. - Added `commands.aliases` while keeping legacy `aliases` compatibility. - Added command aliases: `/bwconsole`, `/betterconsole`. - Added management subcommands: - `/bwc setpassword <user> <new-password>` - `/bwc logoutall <user>` - Added extra subcommand aliases: `useradd`, `createuser`, `deluser`, `deleteuser`, `users`, `passwd`, `password`, `killsessions`. - Added JUnit tests for config parsing, safe fallback values and blocked commands. - Added competitor audit and roadmap notes in `docs/competitor-audit.md`. ### Changed - Removed default destructive `restart` web alias from the generated config. - Moved aliases under `commands.aliases` for a clearer config structure. - Invalidating user sessions now happens when removing a user or changing their password. - `/bwc status` now shows alias and blocked-command counts. - `/bwc reload` message now clearly states which settings still need a server restart. - API reads the latest plugin config after reload for aliases, logging and cookie settings. - Maven compiler annotation processing is disabled to avoid noisy JDK warnings. ### Security - Web command blocking now applies both to direct commands and alias-expanded commands. - Alias chains are limited to 10 commands. - Kick/ban web actions validate player names and sanitize reasons. - `logging.audit-log: false` now disables all audit writes consistently. - Optional `security.secure-cookies` adds the `Secure` cookie flag for HTTPS deployments. ### Fixed - Fixed broken encoding text in source/config/docs touched by this update. - Fixed stale API config snapshot after `/bwc reload`. - Fixed sessions remaining active after password change or user removal. **Full Changelog**: https://github.com/AREKKUZZERA/better-web-console/compare/2.0.0...2.2.0

> Major improvements to security, performance, and overall stability. --- ### Security Improvements * Improved **authentication system stability** * Enhanced **session handling** * Strengthened **rate limiting protections** * Minor fixes to **CSRF validation flow** --- ### Performance * Optimized **WebSocket handling** * Reduced latency in **real-time log streaming** * Improved **log buffer performance** --- ### Improvements * Better command handling reliability * Improved error handling in API endpoints * More consistent console behavior --- ### Bug Fixes * Fixed issues with command execution edge cases * Resolved minor UI inconsistencies * Fixed rare connection drops --- ### Internal Changes * Codebase cleanup and refactoring * Improved maintainability for future updates