Changelog

v0.18.330Fix: Nitrado log-fetch warnings/errors were unattributed in bot.log

• The recurring "Log seek"/"Log download" warnings and errors nitrado.js logs when a server's ADM/RPT/script log fetch fails never named which server they were about ; with several guilds' Nitrado polling interleaved in the same ~30s cycle, a failing server could only be guessed at from timestamp proximity to a nearby guild-tagged line. Every one of these lines now includes the Nitrado service ID.

v0.18.329New: grant/revoke Admin or Moderator directly from the dashboard

• General Settings now has an Add / Remove Admins & Moderators section: paste a player's Discord user ID to grant or revoke the configured .bOne Admin or Moderator role for them, without leaving the dashboard or using Discord's own role UI. Works the same way for guilds running .bOne (the secondary bot) as it does for the primary bot. Requires a role to already be picked above first.

v0.18.328Improvement: Skywalk detection's sit-emote path now requires the sit to happen at sea level

• The real skywalking exploit is triggered by an emote glitch performed at the coast/in shallow water, not inland or up a mountain ; Skywalk's "sit then rise" path (Path A) now only arms its baseline when the sit emote itself was logged within 5m of DayZ's ~0m sea level (the one map-independent elevation reference available without a real heightmap), instead of arming on any sit anywhere. Paths B (sustained float) and C (anomalous altitude gain) are unaffected.

v0.18.327Fix: keyword triggers now fire on an emoji glued directly to text, not just spaced out

• A keyword whose trigger is an emoji (a plain 🎉-style emoji, or a Discord custom emoji's full <:name:id> form) already fired fine when surrounded by spaces, but silently never fired when glued directly against other text ("yay🎉", "🎉congrats") ; extremely common in real chat. Keyword responses could already contain emoji of either kind with no issue. Word-based keywords ("cat" not matching inside "category") are unaffected.

v0.18.326Fix: a heatmap could get stuck reposting every poll cycle instead of on its real schedule (live production bug)

• The scheduled Heatmap auto-post and the live Players Heatmap both wrote their "just posted, don't fire again yet" timestamp through a server reference that could go stale during the image render/Discord send if this guild had any other concurrent activity ; when that happened, the write silently never landed, so the guild stayed permanently "due" and reposted a fresh heatmap on every single ~30s poll cycle instead of its real once-a-day (or once-every-N-minutes) schedule. Same class of bug already fixed this week in store/teleport/weekly digest, now closed here too.

v0.18.325Fix: Ticket Categories role picker + the ticket system's dashboard pages are now grouped together

• Fixed a real bug: picking which roles auto-see a ticket category used a native multi-select, where a plain click on a 2nd role silently replaced the 1st instead of adding to it. Now checkboxes, like every other multi-pick control on the dashboard ; check as many roles as you want.
• Ticket Categories and Ticket Setup used to live under Server Config on the guild hub, while Manage Tickets and Ticket Panels lived under Support ; all 4 ticket pages never appeared together, only reachable from each other via a small link. All 4 now group together on the hub, and those redundant inline links are gone.

v0.18.324New: admins can now let a user hold more than one open ticket at once

• Tickets were always capped at one open ticket per user, no way to change it. Admins can now turn that off per guild ; /ticket allow-multiple enabled:true, or the new toggle on the Ticket Setup dashboard page. Off by default, so no guild's behavior changes unless an admin flips it.

v0.18.323Fix: 10 real bugs found by a full-codebase audit (12-agent sweep of every src file)

• Security: a player named exactly "__proto__" could crash the Raiding detector every cycle (a prototype-pollution edge case), silently dropping that whole poll cycle's events for the server with no retry ; fixed with the same guard other player-name lookups already use.
• Security: the Server Monitor host (real outbound UDP query) never got the same private/internal-address guard the FTP host already has ; an admin could point the bot at an internal address. Also closed a DNS-rebinding gap on the FTP host itself: it was only checked once at save time, never re-checked at actual connection time.
• Fix: Fire Rate alerts triggered by a hit (not a kill, the common case) reported the victim's map position instead of the accused shooter's, since the parser never extracted the attacker's own position from a hit line the way it already does for a kill line.
• Fix: a real stale-object-reference bug (already fixed in tempban/zone/base-ping) was still open in the Store, Teleport, and Weekly Digest features ; under real concurrent activity, a store purchase's refund or cleanup entry, a new/removed teleporter, or a posted weekly digest's "already sent" flag could all silently fail to save.
• Fix: a per-server pricing config (category base price / tier multiplier) added yesterday never backfilled onto an already-existing server, the same gap already fixed once before for a different field.
• Fix: /dz-kick with both a Discord user and a gamertag pointing at two different people recorded the kick against the wrong person (DM, list entry, and all).
• Fix: /giveaway start could leave a live, untracked giveaway message in the channel forever if the react-to-enter step failed after the message itself sent successfully.
• Fix: Punishment History showed a blank " ()" for a gamertag-only kick (no linked Discord account) instead of the actual gamertag.
• Fix: a moderator granted only the Ticket Panels permission could manage panels from the dashboard but was rejected doing the identical thing via /ticket panel-create in Discord.

v0.18.322Fix: Zone Entry role-ping alerts ignored Protected Gamertags (live production bug)

• A zone with the Alert purpose configured (@-mentions a role when a player enters) was the one trigger type in the whole ban/alert system that never checked the Protected Gamertags list ; a protected player still got pinged every time they entered, even though every other trigger (Zone/Base Ping auto-ban, Base Ping's own alert) already respects that list. Now checked the same way.

v0.18.321New: Ban Logs on the Player Punishments page ; one-click Unban for every ban type

• The Active Bans table on Player Punishments used to only cover Temp-Bans. Base Ping auto-bans and Zone auto-bans (which had NO dashboard unban path at all before this ; Base Ping was Discord-only via /baseping unban, Zone had no manual unban whatsoever) are now merged into the same table, each with its own one-click Unban button.
• Added a "Nitrado Ban List" section: a live, on-demand ("Load from Nitrado") read of this server's raw in-game ban list, showing anyone banned outside this bot's own records (added via /dz-ban or Nitrado's own panel) with its own Unban button.

v0.18.320New: add/remove Base Damage and Container Damage schedule windows directly on the dashboard

• The Base/Container Damage page could already enable/disable a schedule and set a timezone, but adding or removing an actual protection window still required /basedamage schedule-add/schedule-remove in Discord. The page now has real add-a-window and remove-a-window forms for both sections, same day/time parsing and validation Discord's own command already uses.

v0.18.319New: Protected Gamertags ; permanently exempt a gamertag from every ban path

• New dashboard page (and /dz-ban protect-add|protect-remove|protect-list, admin-only) lets you mark a gamertag as protected, guild-wide, across every server. A protected gamertag is skipped by Zone/Base Ping auto-ban, /tempban, /dz-kick, and /dz-ban alike ; base-ping/zone auto-bans previously had no admin-protection at all, unlike the manual commands, so this also closes that real gap. Not the same as the server-join Whitelist (a different, existing feature) ; named separately to avoid confusion.

v0.18.318New: Store Items table is now searchable and filterable by category

• The Store & Economy page's Items table now has a search box (name or classname) and a category dropdown, same filter bar the Item Catalog page already has. Matches show across every page at once (paging is suspended while a filter is active), with a live "Showing X of Y" count.

v0.18.317Fix: Item Catalog pictures were broken almost everywhere (live production incident)

• dayz.wiki.gg started 429ing nearly every single image request for 15+ minutes straight tonight ; earlier tonight's fix (only caching a genuine 404 as "no picture," not a rate limit) meant the bot kept retrying at the same pace instead of giving up, which turned out to just keep re-tripping the same rate limit. Added a real circuit breaker: after a few failed fetches in a row, the bot stops hitting the wiki entirely for 90 seconds instead of hammering it the whole time, and widened the spacing between fetches. A confirmed live production incident, not a hypothetical.

v0.18.316Fix: Store Items table is now paginated (was unusable once a store held hundreds of items)

• A store can now hold 1,000+ items (auto-stocked on setup, or via Add All Items) and the Store & Economy page's Items table had no pagination at all ; one page trying to render every row was genuinely broken at that size. Now paginated (50 per page) with Prev/Next controls, same "render once, page client-side" approach the rest of the dashboard already uses for its bigger lists.

v0.18.315Fix: Zone Autoban-Build no longer fires on placing a sea chest, barrel, or other unrelated item

• The Autoban-Build zone trigger had no item filter at all ; placing literally anything inside the zone (a sea chest, a barrel, a tent) triggered the same auto-ban as actually building a base. Now scoped to real base-structure activity only (fence/watchtower/flag/barbed-wire/shelter kits and parts, or actually building/dismantling one) ; same classname knowledge the building Cash reward already uses for the identical question.

v0.18.314New: Placement is now its own feed, separate from Construction

• Someone placing an item (a tent, a landmine, a fence kit, a fireplace) used to share the same "Construction" feed as actually building/dismantling a base structure. Placement is now its own separate event type/feed channel (/channel create type:Placement, or /setup auto-channels for a new server) with its own icon and color on the Event Map, so the two can be routed to different channels ; every Cash reward, Zone Autoban-Build trigger, and Raiding detection that used to key off Construction still applies to Placement exactly the same as before, only which channel it posts to has changed.

v0.18.313Draw a Zone now uses the same real map as Event Map ; alert channel picker moved onto the Base Pings page

• Fixed a real gap: Draw a Zone always showed a lower-resolution flat map background, even for chernarusplus and livonia, which the Event Map page already renders from real, ~12x finer satellite tile imagery. Draw a Zone now uses that same real map whenever it's available, with proper pan/zoom, falling back to the old flat rendering only for a map that has no tile imagery yet.
• The alert channel Base Pings and Zone entry alerts post to now has its own picker directly on the Base Pings page, instead of only being reachable from a separate Server Config page.

v0.18.312New: shops auto-stock on setup, tier pricing is now configurable ; fixed a real image-loading bug

• A brand-new DayZ server (/setup server-add) now gets its Corna Store shop pre-stocked with the entire real item catalog at the current default prices automatically ; a player can buy something the moment the shop is live, no separate trip to the Item Catalog page needed. Existing servers get the same thing with one click: a new "Add All Items" button on the Item Catalog page stocks every category at once instead of one at a time.
• Pricing Defaults on the Item Catalog page now also has a per-rarity-tier price multiplier (Tier1 through Tier4, Unique) alongside the existing per-category base price ; how much pricier a rarer weapon/item is than a common one is fully in your control now, not fixed.
• Fixed a real bug: the Item Catalog's pictures were mostly showing the fallback icon instead of the real item photo. Root cause was the first-ever page load hitting dayz.wiki.gg's rate limit partway through fetching 250+ never-before-seen images, and every rate-limited image got permanently marked "no picture available" instead of being retried ; only a genuine "this item has no wiki picture" now gets remembered that way, a rate limit gets retried on the next view instead.

v0.18.311Fix: Online Players board no longer posts a "0 online" message

• The Online Players status board now stays silent while a server is empty instead of showing an empty roster ; if the board was already up when the last player logged off, it gets removed, and a fresh one goes up the moment someone logs back on.

v0.18.310New: Zones can ping a role when a player enters ; guild map-config fix

• Zones (/zone) get a 4th purpose: Alert. Pick a Discord role and a cooldown on the Zones dashboard page (works on any existing zone, however it was created) or the Draw-a-Zone page for a new shape, and that role gets pinged the moment a player steps inside ; fires once on entry, not again until they leave and come back. Shares the same alert channel Base Pings already uses.
• Fixed one guild's Zone map rendering the wrong terrain: its server was saved with the Livonia map slug instead of Chernarus. Corrected directly in that guild's config.

v0.18.309New: Item Catalog ; every DayZ item with a real picture, one-click add to your store

• The Store's catalog used to start completely empty ; every item was typed in by hand, name and exact classname and all, with no images anywhere. New Item Catalog page (linked from Store & Economy) browses every real sellable DayZ item (1,400+, filtered from the full vanilla item list) as an image tile with its real name, a suggested price, and a one-click Add button ; an "Add All" button per category (Weapons, Food, Clothes, Tools, Containers, Explosives) stocks a whole category at once. Suggested prices are computed from a per-category base price (admin-editable, applies going forward) scaled up by the item's real rarity tier. The existing Store Items table also gets a picture next to each already-configured item now.
• Real item pictures come from dayz.wiki.gg, fetched and cached by the bot itself the first time any item is ever viewed (a live browser check caught that hotlinking the wiki directly gets blocked by the browser's own cross-origin policy, even though a plain server-side check said it would work fine ; fixed by proxying and caching instead). A picture for the one-off item a wiki page doesn't have falls back to a category icon, so every single item always shows something.

v0.18.308Fix: a single stuck routine log read could freeze EVERY guild's feeds at once, not just one

• Caught live tonight, right after deploying the previous fix: a guild with a large backlog of unread log content could hang its own poll cycle indefinitely on a routine (non-rotation) read that had no time limit at all -- and because the sweep that polls every guild shares one lock, that one guild stalled ALL of a bot process's guilds at once. Observed live freezing all 9 of one bot's guilds for 5+ minutes with zero progress; restarted the process to restore service immediately, then closed the actual gap: every log read a poll cycle makes now shares the same real time budget the rotation-recovery reads already had, so one stuck read can no longer hold up the whole sweep.

v0.18.307Fix: a live false-flood alert on deathmatch servers; the same stale-record bug found across kicks/temp-bans/zone-bans too; third audit pass

• The connection-flood alert (built for a real DDoS incident) was firing repeatedly on a fast-paced deathmatch server, where players rage-quitting or crashing out right after a death produce the exact same tight cluster of "lost connection" kicks a real attack does. Server Monitoring now has a per-server switch to turn off just that one heuristic, leaving the separate (and still valid) Nitrado-unreachable outage alert untouched.
• A third independent full-codebase audit, plus tracing the previous two nights' concurrent-save fix all the way through, found the SAME underlying bug (a concurrent save silently orphaning an in-progress ban/kick record) in three more places it hadn't been fixed yet: base-ping ban expiry, base-damage schedule syncing, and -- the deepest instance -- inside the actual Nitrado unban call itself for zone bans, temp-bans, and kicks, where the record could go stale mid-call even after the caller had already re-resolved it. All fixed the same way, with a live-concurrency regression test proving each one.
• Also fixed: three separate ways a real Nitrado read/download failure during log-rotation recovery could get silently mistaken for a clean, successful drain, hiding the failure from every outage alert that depends on it; and a background giveaway reroll could leave a giveaway permanently locked forever if the bot crashed at exactly the wrong moment.

v0.18.306Fix: a concurrent save could silently lose an auto-ban record; second full-audit pass

• A real, quietly-serious one: for a multi-server guild, an auto-ban record (base-ping or zone) written right after the real Nitrado ban call could be silently lost if ANY other save for that same guild landed during that round trip -- routine under normal poll traffic, not a rare coincidence. The bot-side tracking record vanished even though the real ban was in place, so it never showed up in the ban list and never got auto-reversed when its time was up.
• A second full-codebase audit pass turned up and fixed several more: a background sweep's own "is it still running" tracking could get confused by two overlapping runs of the same sweep; /dz-store pay let a "__proto__" recipient silently destroy the sender's Cash with no error and nothing credited; four dashboard channel pickers (embed builder, channel manager, creator alerts, dz-income) accepted a real but non-text channel and reported success while every later post to it would have silently failed; removing a reaction-role mapping that then failed to save left the removal applied in memory anyway, waiting to be flushed by an unrelated later save; and editing a saved embed past Discord's size limits corrupted the live record with the rejected values before the rejection was even reported.

v0.18.305Fix: the per-cycle log-recovery walk could still freeze feeds for minutes; test-2 audit fixes

• Third same-night follow-up to the log-recovery-walk freeze: the shared time budget from the previous fix could still be blown past by a SINGLE already-in-flight network call running long (each one retries internally with its own real timeout), since the budget was only ever checked between steps, not during one. The whole recovery step is now raced against a hard deadline so this can no longer hold up every other guild's feeds no matter what a single stuck call is doing.
• A full-codebase audit (test 2) also turned up and fixed: Twitch/TikTok go-live and new-post alerts weren't actually saved to disk, so a routine bot restart while a creator was live could re-announce an already-live stream or already-posted video; an IPv4-mapped IPv6 address (e.g. the cloud metadata endpoint in that form) could slip past the FTP-host SSRF guard; a raw "__proto__" gamertag could crash achievement checking; a saved embed's link-button URL had no format validation; editing an existing zone's ban tiers always said "Added" instead of "Updated"; and three small dashboard display bugs (a stray comma instead of a blank cell in Tickets and Logins, and /resetlogs not actually resetting everything its own name promises).

v0.18.304Fix: a permanently-broken server (e.g. a suspended Nitrado subscription) could hammer Nitrado forever with zero backoff protection

• Found via a full-log audit today: a real suspended-subscription service was retrying its script-log discovery call thousands of times a day, every single poll cycle, with no cooldown ever kicking in -- because that specific call's failures were invisible to the circuit breaker built earlier this week (its own /gameservers check and every routine log read looked "fine," since a server that never actually ran has no log files to even attempt reading). Script-log discovery failures now feed the same circuit breaker as everything else, so a genuinely dead service gets the same escalating backoff protection instead of being hit every 30s indefinitely.

v0.18.303Fix: yesterday's per-cycle recovery cap could still freeze every other server for minutes, and could quietly duplicate events

• Same-night follow-up to v0.18.302: capping how many log generations that recovery walk downloads per cycle bounds worst-case DATA volume, not worst-case TIME -- a real second live recurrence (dotbone, ~9 more minutes with zero log output) proved that under sustained Nitrado slowness, every read can be succeeding, just too slowly, blowing past a cycle's time budget with no warning at all. A real wall-clock budget now backs up the count cap, so this can no longer hold the shared cycle lock for more than a bounded window no matter how slow (not just how much) Nitrado is being.
• Separately, a same-night audit caught a real correctness gap in that recovery walk: a log generation that gets fully downloaded and then becomes the new tracked file had its read position wrongly reset to the start instead of to where its content actually ends -- on a big enough backlog, that could have silently re-announced real kill/chat/connect events a second time on the next cycle. Fixed to track and reuse the real position.

v0.18.302Fix: one struggling server could freeze feed updates for every other server on the same bot process

• Real incident: a service that fell many restarts behind (sustained Nitrado rate-limiting) needed to recover a couple dozen retained log generations in one go -- each one its own real, rate-limited download, all running inside the single shared per-cycle lock. That held the lock for 15+ minutes straight and froze every other guild's kill/chat/connect feeds on the same process, not just the struggling one's. That recovery walk is now capped per cycle (the rest is picked up on later cycles, same "spread it out, don't lose it" approach already used for oversized single-file backlogs), and a cycle that has to pause partway now correctly counts toward the existing circuit breaker instead of being invisible to it.

v0.18.301New: Online Players board, a simple always-up-to-date "who's on" list

• New auto-updating channel type (Online Players): just a plain, sorted list of currently-connected gamertags, refreshed automatically as people join/leave. Deliberately minimal by design, no extra stats or fields ; /player online is still there for the fuller on-demand version. Available via /setup auto-channels or /channel create.

v0.18.300Nitrado circuit breaker fix: it now actually catches the failure it was built for

• Same-day follow-up: yesterday's circuit breaker (v0.18.299) only watched the initial Nitrado connectivity check, not the actual log-reading calls that run every cycle -- so a service whose connectivity check kept succeeding while its log reads kept failing (confirmed live, the exact shape of the original incident) never tripped the breaker at all, and kept hammering Nitrado every 30s regardless. Both checks now feed the same breaker.

v0.18.299Nitrado circuit breaker: a struggling server backs off instead of hammering Nitrado forever

• Real incident today: sustained Nitrado rate-limiting (429s) across many guilds at once, self-reinforcing because every affected guild's own poll cycle kept retrying fresh every ~30s regardless, never giving the rate limit room to clear. Once a server's Nitrado connection has been failing for a few minutes straight, it now backs off on its own (3 min, then 8, then settling at 15 min for a persistently-broken service) instead of retrying every single cycle -- protects the services actually struggling without slowing down every healthy guild's normal ~30s polling.
• Server Monitoring now shows when a server is in this cooldown and roughly when it'll be checked again, so it reads as "backing off on purpose" instead of looking like the bot silently gave up.

v0.18.298/logins goes deeper: real device fingerprinting + IP abuse scoring

• The dev-only /logins page now captures a real browser device fingerprint on top of the usual Discord/network info: screen size, GPU (via WebGL), CPU core count, device memory, and a canvas render hash. Two different Discord accounts sharing the same device now get flagged as likely the same person even when they log in from different IPs (defeats a VPN, which a plain IP match never could).
• Also added: a real IP abuse-confidence score (AbuseIPDB, free tier) alongside the existing proxy/hosting flags, shown on every login and pushed to the security alert channel the same way a proxy/hosting flag already is.

v0.18.297/creator link now supports TikTok too (go-live and new-post alerts)

• /creator link platform:tiktok username:<you> links a TikTok account, same self-service flow as Twitch. You'll get an alert when you go live on TikTok, and another when you post something new.
• Worth knowing: TikTok has no official API for either of these (unlike Twitch), so both run on unofficial, reverse-engineered detection. Go-live checks every 3 minutes; new-post detection watches your total video count every 15 minutes rather than reading individual posts (a currently-broken piece of the library it depends on), so a new-post alert links to your profile rather than the specific video. Less prompt and less reliable than Twitch by nature, not a bug.

v0.18.296Security hardening pass: a real XSS fix, SSRF protection, and more

• Found and fixed a real stored-XSS gap: a crafted player display name (sourced from DayZ's own logs, which place no restriction on it) could break out of the Event Map's inline data script tag and run arbitrary script in an admin's dashboard session. Now safely escaped, with the same fix applied to Draw a Zone for consistency.
• Rotation's FTP setup now blocks a hostname that resolves to a private/internal/loopback address (an SSRF gap; nothing stopped an admin, intentionally or by mistake, from pointing this bot's own outbound connection at its own infrastructure).
• The Logins dev page got a real upgrade: an overview stat strip, a new "N failed attempt(s) first" signal correlating a run of failed logins right before a success (a real brute-force-then-success pattern the page never surfaced before), and client-side search/flagged-only filtering.
• Smaller hardening: a weak DATA_ENCRYPTION_KEY now warns on boot (same as the existing session-secret check); dependency vulnerabilities patched (0 remaining); a couple of expensive map-render pages now rate-limited against a leaked/abused session; the public file-drop upload endpoint no longer parses a large body before checking the link is even valid.

v0.18.295Diagnostics page redesign: see what actually needs attention in one glance

• The /dev/diagnostics page now opens with a plain-language "N things worth a look" banner (or a clean "everything looks healthy" line), each item linking straight down to the section it's about -- no more scrolling the whole page to find out if anything's wrong.
• The 6 "is anything wrong" sections (data findings, code scan, log errors/warnings, background jobs, retry counters) now collapse to a single reassuring line when healthy, and only expand automatically when there's something real to see -- a clean process no longer forces a scroll past a wall of empty tables to reach the developer controls at the bottom.
• Reorganized into three clear groups (Anything Wrong? / System Status / Developer Controls) instead of one long flat list, and the top stat strip is now clickable, jumping straight to the matching section.

v0.18.294Alert Guilds actually reaches people now; Channels Configured stopped showing broken links

• Alert Guilds (dev panel) no longer requires a guild's Discord "system channel" specifically — most guilds never set one, so the alert was silently landing nowhere. It now posts to any channel the bot can actually send in, and @-pings the guild's own configured .bOne Admin + Moderator roles so it can't be missed.
• Fixed a real bug in the "Channels Configured" confirmation embed (/setup auto-channels): every channel reference in it was literally broken text (e.g. "<#kill-feed>" instead of a real link) rather than a clickable mention, and duplicated each channel's own emoji right next to itself. Now shows real, working links in a compact wrapped list instead of a long duplicated-icon wall of text.

v0.18.293Draw a Zone: you can now zoom in for more accurate placement

• Real user feedback: the Draw a Zone map couldn't be zoomed, capping every click at the full-map view's resolution. Scroll to zoom in (up to 8x) and drag to pan while zoomed, with Zoom In/Out/Reset View buttons for anyone without a scroll wheel. Points now survive panning/zooming mid-draw instead of only being placed at whatever the view happened to be at click time.

v0.18.292Mission Config Errors feed catches more real failure shapes

• Fixed a real gap: a multi-line "JSON ERROR" reason (e.g. a broken cfggameplay.json) was getting truncated to its first line in the Mission Config Errors feed, silently dropping the actual error detail. Now captured in full, plus the script file/line for JSON-parse-specific failures when DayZ logs one.
• The feed now also catches Nitrado's own "types.xml won't even parse" errors from restart.log (a genuinely broken economy config file, not the routine "we silently adjusted a value" case that stays in Nitrado Types.xml Override) — same private admin-only channel as everything else in this feed.

v0.18.291Combat-Log Attempts is now a suspicion alert too, not its own channel

• Combat-Log Attempt (a player cancelling a logout right as they're about to be finished off) no longer gets its own dedicated feed channel either, same call as Knockout Disconnection a moment ago. Now grouped with the other /detect suspicion alerts (Join-Kill, Raiding, etc.) in the shared private suspicion-alerts channel /setup auto-channels creates.

v0.18.290Knockout Disconnections is now a suspicion alert, not its own channel

• Knockout Disconnection (a player disconnecting while knocked out, a possible combat-log evasion) no longer gets its own dedicated feed channel. It's now grouped with the other /detect suspicion alerts (Join-Kill, Raiding, etc.) in the shared private suspicion-alerts channel /setup auto-channels creates, since that's the more useful place to actually notice it.

v0.18.2899 new feeds: knockouts, emotes, combat-logging, weapon jams, and more

• New feeds, most auto-provisioned by /setup auto-channels: Knockouts and Knockout Disconnections (a player going unconscious, regaining consciousness, or disconnecting while still out), Emotes, Combat-Log Attempts and Logout Type (instant vs. timed), Weapon Jams, and an auto-updating Infected Zone Status board (server-wide infected/animal counts plus per-group zone health, straight from the server's own Central Economy log).
• Two new admin-only diagnostic feeds, private by default: Mission Config Broken (a server-side script/config error, e.g. a missing custom mission file) and Nitrado Types.xml Override (when Nitrado's own automated limiter silently lowers a configured item count below what's set in your economy config).
• Under the hood: this bot now reads two DayZ log files it never touched before (script_*.log and restart.log), on top of the existing .ADM/.RPT ones, using the same Nitrado connection already configured via /setup.

v0.18.242Setting up a Ticket Category no longer means alt-tabbing to Discord first

• The dashboard's Ticket Categories page can now create the Discord category channel for you, right in the same form, instead of requiring you to go create it in Discord first and come back to find it in a dropdown. The page also now explains how Categories and Panels fit together and links straight to Ticket Panels.
• Also gave Blackwater DayZ's partner-page tracer animation a real pass: bursts now travel in a true straight line like real automatic fire, fire more often, and add a subtle screen-wide flicker synced to each shot.

v0.18.241Blackwater DayZ's background now actually reads as gunfire

• Reworked the tracer animation on the Blackwater DayZ partner page: real glowing streak lines with a bright head and a muzzle flash at the origin, fired in short automatic-fire bursts instead of single soft dots drifting by.

v0.18.240Blackwater DayZ's partner page gets its own continuous background

• The Blackwater DayZ partner page now has a real, continuous full-page background animation of its own: sparse ambient dust and the occasional tracer round streaking across the screen and fading out, instead of a static page once the opening animation finishes.

v0.18.239A second official partner: Blackwater DayZ, with its own dedicated page

• /partners is now an index of every official partner community, each with its own dedicated page instead of one shared spotlight. Blackwater DayZ (console PvP/deathmatch, run by Austin) joins Baked Beanz as an official partner, with its own tactical/night-vision visual identity and a real target-lock opening animation.

v0.18.238/features is now .bOne's own flagship page, wordmark and all

• The Features page got a full revamp into a real flagship page for .bOne: a new animated opener featuring the actual .bOne wordmark and Knuckle mark (the prepared brand kit's first real appearance anywhere on the live site), real copy on what .bOne actually does, and live server/community counts alongside the real feature count, all sitting above the same real feature grid as before.

v0.18.237Fix: server settings imported from another bot could silently stop showing up in feeds

• A backup exported from one bot process and imported into a different one (for example, moving a server's settings from the primary bot to .bOne) was carrying over the ORIGINAL bot's internal ownership marker, which quietly excluded that server from every background check (loot/event feeds, temp-bans, zones, giveaways, reminders) run by the bot it was actually imported into. No error appeared anywhere ; feeds just stopped. Both the /setup backup-import command and the dashboard's Import button now correctly hand ownership to whichever bot performs the import. Already-affected servers have been corrected live.

v0.18.236.bOne rebrand, phase 3b: deploy tooling now targets the renamed process

• Purely internal deploy-tooling update, no behavior change: the deploy script's own process target renamed from 'benchbot' to 'bone' to match phase 3a's file rename, ahead of actually renaming the live process itself.

v0.18.235.bOne rebrand, phase 3a: renamed the entry/config/env files themselves

• Purely internal: benchbot.js, BenchbotConfig.js, and Benchbot.env(.example) are now bone.js, BoneConfig.js, and Bone.env(.example). Every import/reference across the whole codebase updated in lockstep. No behavior change ; nothing you'd notice from Discord or the dashboard.

v0.18.234/about now shows the real .bOne wordmark, and says .bOne instead of BenchBot

• Bench's own "About" write-up (/about) now displays the actual .bOne wordmark image alongside the text, and the one remaining "BenchBot" mention in that text/title is now ".bOne" too.

v0.18.233.bOne rebrand, phase 2: real branding — new favicon, wordmark on the repo README

• The dashboard's browser-tab icon is now .bOne's actual current mark (it was quietly still the pre-rebrand shape until now). The project's README also leads with the real .bOne wordmark instead of plain text, light or dark depending on how you view GitHub.
• Icons/wordmark for chat, the public site, and everywhere else stay as their own separate follow-up ; this was specifically the browser tab + repo front door.

v0.18.232.bOne rebrand, phase 1: every command, message, and page now says .bOne instead of BenchBot

• Every user-facing bit of text this bot controls (Discord replies/embeds, command descriptions, the dashboard's pages, docs) now says ".bOne" instead of "BenchBot" ; this covers text only, not yet the site's branding images/icons or any repo/infra naming, which are their own separate follow-up steps.
• A few things that live on your own DayZ server were deliberately left alone rather than blindly renamed: hordes, airstrikes, and other events you've already created keep working under their original names exactly as before ; only brand-new ones use the new naming. Same for the "Feeds"/"Games"/"Utilities" Discord categories /setup auto-channels already created for you ; they'll get relabeled automatically the next time that command runs, nothing duplicates.

v0.18.231Fix: dashboard pages with a lot of real data (many players, many entries) could go permanently blank

• The dashboard's scroll-reveal animation decided whether to show a section based on what fraction of ITS OWN total height had scrolled into view ; for a section that grew tall enough (found live: a guild's 152-player Cash Balances table, ~9,000px tall), even a full screen of visible overlap could never reach that fraction, so the section just never appeared, with nothing in any log to explain why. Fixed to trigger on any visibility at all instead, which can't fail this way no matter how much data a section ends up holding.

v0.18.230Full-codebase audit: a faction currency exploit and a critical account-corruption bug found and fixed, plus several smaller cleanups

• /faction leave and /faction bank deposit used to trust a freely-typed gamertag with no ownership check, unlike every other faction command. Anyone could force a rival faction's members out one by one off its public roster (forfeiting its Cash bank on the last member) or drain a fellow member's real Cash balance into the shared bank without consent. Both now require your own linked gamertag, same as kick/promote/withdraw already did.
• Linking a Discord account to the gamertag "__proto__" (a reserved word with special meaning in JavaScript) used to be able to corrupt shared bot memory across every server the bot serves, once that account touched Cash, quests, or a saved store location. Now blocked outright at /link, with matching safety checks everywhere a gamertag is used as a lookup key.
• A message that gets automatically reposted (reaction role panels, ticket panels, suggestions) now correctly explains why: "it was deleted" vs. "it's owned by a different bot" are two different situations and now get two different, accurate explanations instead of one hardcoded story.
• Several dashboard tables and cells had a handful of stray bare commas left over from an old cleanup pass, showing as visual noise instead of "nothing here" (Login History's IP location, Giveaways' active countdown, and a few config dropdowns). All show clean placeholder text now.

v0.18.229Corna Store: items can now be grouped into categories (Ammo, Weapons, etc.) instead of one long list

• /dz-store admin item-add has a new optional category field (with autocomplete suggesting whatever categories you've already used, so names stay consistent) ; leave it blank and an item stays Uncategorized, same as before.
• Both /dz-store view's Items list and the dashboard's Store page now group items under a heading per category instead of one flat list.

v0.18.228Fix: reaction role panels, ticket panels, and suggestions could get permanently stuck if a guild ever moves to a different bot

• Discord never lets one bot edit a message a different bot posted. If a guild's data ever moves to a different bot process (e.g. a .bOne migration), three features used to break on that one specific message: reaction role panels stopped accepting new add/remove-role edits (and silently lost the change), ticket panel edits failed with a visible error, and worst of all, resolving a suggestion reported success while the public embed silently never updated at all.
• All three now self-heal the same way the leaderboard, live heatmap, and giveaways already did: if the original message can't be edited, a fresh one is posted automatically, tracked going forward, and you're told it happened (with the old message's id, so it's easy to find and delete).

v0.18.227Fix: Login History showed a broken-looking double-comma for logins that predate device/ISP tracking

• Every login recorded before the login-audit upgrade shipped has no device/ISP data (nothing to backfill it with), which rendered as two stacked bare commas in the new Device/ISP column, reading like a bug rather than "no data for this old entry." Collapsed to the same single-comma empty placeholder every other column here already uses.

v0.18.226Fix: the new Login History table was cut off on a normal desktop window

• The Login History table's 8 columns didn't fit the dashboard's own max-width container ; it was technically scrollable but with no visible cue, so it just looked broken. Consolidated back down to 6 columns and fixed the layout so no single long value (a Discord ID, an IPv6 address) can push the table wider than the page again.

v0.18.225Dashboard login audit: deeper signal, failed attempts, correlation, trust list, session revocation

• Developer-only /logins page overhaul: now captures device/browser, ISP, and ASN per login (in addition to VPN/proxy/hosting), flags a login from an IP or device that account has never used before, flags two different accounts sharing the same IP or device, and flags an 'impossible travel' pattern (the same account logging in from two implausible locations too close together in time).
• New: failed/rejected login attempts (bad OAuth state, a Discord API error, a rate-limit trip) are now recorded and shown in their own section, instead of only existing in bot.log.
• New: a trusted-source allowlist (an account or a specific IP) so a known, legitimate VPN user's routine logins stop generating flags and alerts, without weakening detection for anyone else.
• New: an Active Sessions view with a real 'revoke all sessions' action per Discord account, immediately invalidating that account's existing dashboard login everywhere.
• New: a browser-reported timezone check ; a VPN changes an IP's apparent location but not the OS's timezone setting, so a mismatch between the two is a real signal worth surfacing.

v0.18.224Embed Builder: add buttons to a custom embed (links + self-serve role toggles)

• /embed create can now attach up to 5 buttons to whatever you build: Link buttons open a URL, and Role Toggle buttons grant/remove a role when a member clicks them, no reactions needed. The wizard has a new Add Button step (Link opens a quick label+URL form ; Role walks you through picking the role, then its label).
• The same admin-only safety rule /reactionrole already enforces applies here too: only a full Administrator (or BenchBot's own admin role) can wire up a toggle button for BenchBot's own admin/moderator role, or any role carrying a powerful Discord permission ; a moderator with just Embed Builder access can't use this to grant themselves elevated access.
• The dashboard's Embed Builder page got the same Buttons section, so you can add/edit/remove buttons there too, including picking a role from a real dropdown instead of typing an ID.

v0.18.223Fix: a buried stash could show a location off the map entirely

• A ground stash's Buried event was reading its height value where the real north-south coordinate belongs (and vice versa), the one location log line in this bot that doesn't use the same format every other event type does ; a buried item could show an "Open on iZurvive" link that plotted it in open ocean, nowhere near where it actually was. Fixed and verified against the real report.

v0.18.222/economy daily|weekly|work|beg|crime and /slut now pay real Cash, fully admin-configurable

• These 6 commands used to pay a fixed, hardcoded amount of Dollars (a Discord-side minigame currency) with zero way for an admin to change it ; a real admin reported they couldn't configure daily/work/slut at all. They now pay real Cash (the DayZ economy /dz-store spends), and every one of them can be enabled/disabled and have its chances, payout ranges, and cooldowns tuned via the new /economy admin daily|weekly|work|beg|crime|slut.
• Since Cash is tied to your actual DayZ gamertag, these 6 commands now need a linked gamertag (/link set) to use, the same requirement /dz-store already has ; you'll get a clear prompt instead of a silent failure if you haven't linked yet.
• On a guild running more than one DayZ server, these commands now ask which server's Cash economy to use, same as /dz-store/other server-scoped commands ; a single-server guild sees no change at all.

v0.18.221Cash is now clearly marked as the real DayZ economy everywhere

• Dollars/Plates/Bullets/Chips/Salvage were never labeled as anything in particular, and Cash's own icon doubled as Dollars' icon almost everywhere ; Dollars now gets its own icon, and every balance display, /game currencies, and the leaderboard now say plainly that Cash (spendable at the Corna Store) is the real economy and the rest is minigame money.
• /player-hub's Balance button and /myprofile's Economy Ledger now show Chips and Salvage too (previously missing entirely), not just Dollars/Plates/Bullets/Cash ; one place to see every balance at once.

v0.18.220Fix: full-codebase audit ; 8 more real bugs found and closed

• /expedition go's run-in-progress guard released almost immediately instead of holding for the whole run, letting a well-geared player stack several runs at once and multiply their guaranteed find rate ; now genuinely holds until the run actually ends.
• A handful of gamertag/item/slug lookups (banlist review, banlist reports, legal pages, /shop buy) mishandled a few reserved words ("__proto__", "constructor", etc.) in a way that could corrupt shared bot state or crash the command instead of just saying "not found" ; all closed with the same guard pattern already used elsewhere.
• /suggest could orphan an already-posted suggestion (and silently reuse its number for the next one) if only the confirmation emojis failed to attach ; a suggestion is now tracked the moment it's actually posted, regardless of what happens after.
• A very large log-catchup batch (recovering from a multi-restart outage) could crash mid-cycle and permanently lose that whole batch of events ; fixed the crash.
• The dashboard now warns at boot if its session secret is missing entirely, instead of silently starting and failing every single login with a confusing, unrelated error.
• A safety gap in the FTP mission-file writer (used by /createevent, /rotation) that could, on an unusual path, delete a live file with no way to restore it ; closed before it ever hit production.

v0.18.219Fix: audit sweep complete ; last 3 ack-timing gaps closed

• /quests' submission-review post, the embed builder's "Send Now" button, and /ticket add|remove could all fail to respond under ordinary network latency ; the same class of fix applied everywhere else in the bot this week, now covering every remaining command that had it.

v0.18.218Fix: /altcheck could miss (or falsely flag) a handoff that crosses midnight

• Every line in a log file used to get stamped with the file's own rotation-start date, regardless of the line's real time of day ; a server whose restarts don't land at exactly midnight could make a genuine account-switch handoff invisible, or make an innocent player's real overlapping session look like it never happened (the exact thing that's supposed to rule someone out). Now tracks the real chronological order within each file correctly.

v0.18.217Fix: audit sweep continued ; a stuck quest button and 3 slow-command ack failures

• Double-clicking "Start Quest" on an already-started quest silently did nothing (a real double-acknowledgment bug) instead of just showing the quest again.
• /ticket priority, /ticket rename, /player-hub setup, and /dz-income submit could all fail to respond under ordinary network latency, same class of bug as everywhere else in the bot that already acks before doing slower work ; these four just hadn't gotten the fix yet.

v0.18.216Fix: audit sweep continued ; a kick ban-evasion race and a Cash-farming exploit closed

• /dz-kick had the same race /tempban was already fixed for: two kicks for the same gamertag landing at once used to create two independent records, and the shorter one's expiry could unban the gamertag early even while the other still claimed active. Now merges into one record, same as /tempban.
• /dz-store admin config's hit/build/flag cooldown fields accepted 0, which doesn't mean "instant" ; it fully disables the anti-farm cooldown, letting the reward pay out on every single qualifying action. Also closed a related gap where the dashboard's own store config accepted a negative starting Cash balance.

v0.18.215Fix: full audit sweep ; 4 real bugs closed, including a privilege-escalation gap and a multi-restart data-loss gap

• /dz-ban add never checked whether the target was a protected admin/bot-admin-role holder/developer, unlike every sibling punitive command ; a moderator with only the narrow 'ban' permission could have permanently game-banned an admin (no auto-reversal on this one, unlike /tempban or /dz-kick). Now blocked the same way, via a reverse gamertag→Discord lookup.
• Removing a DayZ server and adding a replacement (the common "swap Nitrado subscriptions" workflow) could silently reuse the removed server's in-memory runtime state if the new one got the same id ; phantom "online" players, old map events shown on a brand-new server, even a permanently-stuck write lock in rare cases. Fixed at the source.
• Tonight's earlier log-rotation-drain fix only ever recovered ONE hop ; if a DayZ server restarted twice or more during an outage, an entire intermediate log generation could still be silently, permanently lost. Now walks every generation Nitrado still retains, not just the one immediately before the newest.

v0.18.214Fix: /baseping whitelist now also stops the alert, not just the auto-ban

• A whitelisted gamertag (/baseping whitelist add) used to still trigger the base ping's own alert, only the auto-ban was skipped ; now whitelisting exempts a gamertag entirely, no alert and no auto-ban, so a base's own owner stops getting pinged for being in their own base. Same whitelist, same commands, just one consistent meaning now.

v0.18.213New: multiple DayZ servers on the same Discord server can now share a name

• /setup server-add no longer blocks a name already used by another server here. When 2+ servers share a name, every place that shows or accepts a server name (autocomplete, /setup server-list, the dashboard's server switcher) shows it as "Name (#id)" so the right one is always unambiguous ; a unique name works exactly as it always has.

v0.18.212Fix: the dashboard could silently be served from the secondary bot's own, separate data instead of the primary one's

• The secondary bot used to unconditionally try to start its own dashboard server on the same port the primary one uses, racing it on every restart ; whichever process lost was just quietly dashboard-less, and whenever the secondary bot won, everyone's real dashboard traffic was served from its own separate (often much emptier) data store instead of the primary bot's live one. The secondary bot never needs its own dashboard, the primary one already serves its guilds too, so it no longer even tries.

v0.18.211Fix: a real event written right before a server restart could be silently lost

• Every ADM/RPT log rotates to a fresh file on server restart ; anything written to the OLD file after the bot's last read but before the restart used to be silently dropped the instant the bot switched over, rather than ever being read. Now the bot drains whatever was left in the old file first, so a vehicle spawn, kill, chat line, or anything else logged in that final window is recovered instead of lost, found while auditing a live report of vehicles missing from the map that had genuinely spawned.

v0.18.210New: DZ-Income dashboard page for setting rates and the review channel

• /dz-income's role rates and review channel can now also be set from a new dashboard page (guild hub > DZ-Income), the same config /dz-income admin already offered on Discord ; view/add/edit/remove a role's hourly rate and pick the review channel from real dropdowns instead of typing role/channel names. Admin-only, same as the Discord command's own admin subcommands ; approving/rejecting submissions themselves stays Discord-only.

v0.18.209New: /dz-income ; honor-based hours-worked pay, admin-reviewed before anything is paid

• Set an hourly Cash rate per role (/dz-income admin set-rate) for staff, builders, event crew, whatever roles you use ; a player reports hours worked with /dz-income submit, and it posts to a review channel you configure with Approve/Reject buttons. Nothing is paid automatically ; every single submission needs an admin or granted moderator's decision first. If someone qualifies for more than one configured role, their highest rate is used automatically.
• The submitter can never approve or reject their own submission, even if they also hold the reviewing role ; approved amounts deposit straight into their linked gamertag's Cash balance and they're DMed either way.

v0.18.208New: dashboard now works for servers running the secondary bot, not just the primary one

• Any server admin-managed through the secondary bot instead of the primary one could not use the web dashboard at all ; every page checked guild membership against the primary bot's own Discord connection only, so a secondary-only server was invisible to it. The dashboard now also recognizes the secondary bot's own servers across every page (login, the server picker, and all ~35 individual settings pages), automatically using whichever bot actually manages that server.

v0.18.207Fix: connect/disconnect feeds could show a wildly wrong "Time Online"/"Time Offline"

• Reported live as "Time Online: 1m" on a session that was actually hours long. Whenever the bot has to catch up on a backlog (right after every restart, until it finishes reading anything it missed), a player's connect and disconnect could both get processed together in the same catch-up pass ; the duration was measuring how long that catch-up took, not how long the player was actually online. Now shows "Unknown (bot restarted mid-session)" in that specific case instead of a misleading number, and is unaffected the rest of the time.

v0.18.206Fix: the secondary bot's icons were STILL broken after the previous fix ; real root cause this time

• Live-reported still broken right after v0.18.205 shipped. That first fix mutated the shared code's icon definitions in place at startup, which only worked for icons read fresh each time a command runs ; several places (the leaderboard, faction cards, the in-game currencies, help/quickstart pages) instead build their own icon text once when the bot first starts up, before that mutation had a chance to run, so they kept using the primary bot's own icon IDs regardless.
• Properly fixed this time by rewriting outgoing messages themselves right before they're sent to Discord, instead of trying to catch every place an icon might get used early ; this covers every icon everywhere, including places like this that build their text in advance, confirmed against a real live connection before shipping this time, not just re-tested in isolation.

v0.18.205Fix: the secondary bot was showing raw ":icon_name:" text instead of actual icons in every embed

• Every embed the secondary (dotbone) bot sends was showing literal text like ":bb_star:" or ":bb_gun:" instead of the real icon ; those tags reference custom emoji IDs that only belong to the primary bot's own Discord application, and Discord can't render another bot's message using someone else's application emoji. The secondary bot now uses its own already-uploaded copies of all 89 icons instead, swapped in automatically at startup ; the primary bot's own embeds are completely unaffected.

v0.18.204Fix: Loadout Generator was offering wrong or missing attachments for most weapons and gear

• Reported live: the SCAR couldn't take any support/buttstock attachment, and the AUG could only take one optic. A full re-audit against dayz.wiki.gg (cross-checked against this server's own real item list) found the problem was much bigger than those two ; nearly every AK-pattern rifle had a Western-only ACOGOptic wrongly listed instead of its real Eastern optics, and most Western rifles (M4A1, FAL, M14, Scout, SV98, UMP45, MP5K, and more) were missing nearly their entire real optic/suppressor/furniture list. All now corrected, plus the newer SCAR-H now has its real buttstock option.
• Also found and fixed while auditing gear: the belt was missing the Winter-color holster, and the vest listed a pouch color ("_Desert") that was never a real item on this server ; the real Winter-color pouch is offered instead. Two similar invalid "_Desert" entries for the vest/backpack item picker were removed outright since the real Winter versions already show up normally.
• Added a dedicated test suite (14 tests) that checks every single attachment the generator can ever offer is a real, spawnable item ; this class of bug (an item that just doesn't exist) will now fail a test immediately instead of silently shipping.

v0.18.203New: Creator Alerts (Phase A) ; automatic go-live posts for linked Twitch streamers

• Members can now link their own Twitch account with /creator link, no admin needed ; when they go live, BenchBot automatically posts an alert (with a link, their real profile picture, and stream title) to a channel admins configure, pinging either @everyone or a specific role (/creator admin channel, /creator admin ping-role, or the new Creator Alerts dashboard page).
• First phase of a bigger creator-alerts push ; YouTube (new videos + going live) is planned next, and TikTok/Instagram/X will get a static profile link (no platform currently offers a free, reliable way to auto-detect a new post on those three).

v0.18.202New: hide event locations from specific Discord feeds, per event type

• Dashboard > Channel Management now has a Location Visibility section: check any event type (kills, builds, flags, stashes, etc.) and its Discord embeds stop including Coordinates/Nearest Town/Map link entirely, while everything else about the event still posts as normal. Each type is independent, so e.g. base/flag locations can stay hidden while kill locations still show, or the other way around.

v0.18.201New: a faster, second DDoS signal that catches a flood even while Nitrado stays reachable

• Direct follow-up to the 2026-08-14 incident: a live re-check of the same server's logs found the actual attack still let Nitrado's own status query respond normally for its whole acute phase ; only individual players were being flooded off. The existing outage alert (v0.18.197) couldn't have caught that. Server Monitoring now also watches for several different players losing their connection within seconds of each other (calibrated against the real incident's own timing), and posts its own immediate alert, pinged the same way, independent of whether Nitrado itself ever goes unreachable.
• The Server Monitoring dashboard page now shows this signal's live status too, next to the existing outage-streak progress.

v0.18.200Fix: Military Convoy map events were actually mislabeled airdrop supply crates

• Found via a real log audit for Baked Beanz: the dynamic-event classifier's fallback for "_DE"-suffixed classnames (meant for real Abandoned_* convoy wreckage) was also catching StaticAirplaneCrate's own supply-box loot children (StaticObj_Misc_SupplyBox1/2/3_DE), which happen to carry the same suffix. Every Military Convoy event this server had ever logged (949 of them) was actually an airdrop crate. Now correctly classified as airdrop instead.

v0.18.199New: Server Monitoring dashboard page, and DDoS detection + Player Activity Map are now flagship features

• Server Monitoring (/server-monitor) now has a real dashboard page too, not just Discord commands: live A2S status with a one-click 'Check Now', the direct host/port config form, the shared alert channel, live Nitrado-outage streak progress toward the alert threshold, and who the outage alert will actually @-ping (or a warning if nobody's configured yet).
• The Player Activity Map and this new Server Monitoring page are now showcased as flagship capabilities on the public /features page, alongside Event Map, Store & Economy, and Global Watchlist ; both back real, actively-used detection work, not just backend plumbing nobody sees.

v0.18.198Fix: Event Map (and constellation cards sitewide) still stuttering on mobile

• Found the same bug (v0.18.196's mobile background fix) in two more places: the Event Map's own pan/zoom recompute, and the animated constellation cards used on /features, quests, and player profile pages. Both ran their full resize logic on EVERY 'resize' event, completely undebounced ; mobile browsers fire that repeatedly as the address bar collapses/expands during ordinary scrolling, so the map kept re-centering and every constellation card kept reallocating its canvas several times per scroll. Both are now debounced to settle once, ~200ms after a resize actually finishes.

v0.18.197New: fast, DDoS-aware Nitrado outage alerts that actually ping admins and the dev channel

• The Nitrado outage alert (v0.18.190) now fires in ~3 minutes instead of ~10, and both the per-guild alert and the dev error-channel alert now actually @-mention people (the guild's configured bot-admin/mod roles, and the bot's own developer(s)) instead of posting a silent embed nobody gets notified about.
• New: when a Nitrado outage is detected, the bot now also checks whether the game server's own hostname (from /server-monitor or the configured FTP host) is resolving in DNS. If it's failing too, the alert calls that out explicitly as matching a real DDoS pattern (not just a routine Nitrado hiccup) ; grounded directly in a real incident against a customer's game server that showed exactly this combination.

v0.18.196New: two-finger pinch-to-zoom on the Event Map ; fixed the sitewide background glitching on mobile

• The Event Map now supports real two-finger pinch-to-zoom (and pinch+drag together) on touch devices, matching how a mobile map app is expected to work. Previously the map only ever tracked one pointer at a time, so a second finger touching down mid-drag just silently hijacked the pan instead of starting a pinch.
• Fixed a real bug behind reported "glitchy, laggy... snappy and choppy" background animation on mobile: the sitewide starfield/constellation and code-rain backgrounds fully re-randomized every particle/column and reallocated their canvas on EVERY resize event, completely undebounced ; mobile browsers fire resize repeatedly as the address bar collapses/expands during normal scrolling, so the whole background was discontinuously snapping to a new random layout several times per scroll. Now only does that on a genuine resize (width actually changing) ; an address-bar toggle just resyncs the canvas height in place.

v0.18.195Fix: Player Activity Map blip colors, click-to-pin player info, and a double-polling slowdown

• Player blips are now GUARANTEED distinct colors while simultaneously on screen (up to 20 concurrent players), not just a per-gamertag hash that could coincidentally collide two real names onto the same shade every time. Colors are allocated from the palette live, freed back to the pool once a player ages out of the window, and fall back to the old hash-based color only past real 20-player concurrent capacity.
• Player blips are now clickable: click one for a real detail panel (recent activity, any active "potential cheating" flags for that player, and a link to their full public profile), pinned open the same way Events-mode blips already work (click elsewhere or Escape to close). Previously a blip only showed a one-line tooltip on hover, with no click interaction at all.
• Fixed a real bug found while building the above: the new "potential cheating" overlay layer (v0.18.194) was missing pointer-events:none on itself, so its full-map-sized invisible bounding box silently blocked clicks on player blips underneath it anywhere on the map, not just where a flag actually renders.
• Fixed a real performance issue (reported: "the whole map page feels slow/laggy"): Players mode's ~20s poll used to start once and never stop, running forever in the background even after switching back to Events mode, on top of Events mode's own poll loop which also never paused — once a session had ever visited Players mode, both loops ran concurrently for the rest of the page's life. Players-mode polling now starts/stops with the mode switch.

v0.18.194New: Player Activity Map anti-cheat overlay ; 3 new /detect detectors (Phase C)

• Players mode on the Event Map now has a "Potential Cheating" overlay: a distinct pulsing marker for any /detect alert (all 10 types) within the selected time window, with a show/hide toggle and an honest hover tooltip (what triggered it, plus the same disclaimer text /detect's own embeds already show). Alerts get their own retention tier, isolated from Events mode exactly like position/connect/disconnect already are.
• 3 new /detect behavior-detection alert types: Fire Rate (the same attacker landing hits/kills against several different players within a few seconds), Headshots (repeated long-range headshot kills by the same killer), and Teleport/Speedhack (implied speed between two position readings far beyond even a real vehicle). All 10 detectors (7 existing + 3 new) now route to the map for the first time ; previously none of them did. Configurable via /detect config and the dashboard, same as every other detector.

v0.18.193New: Player Activity Map now shows ghost trails and vehicle detection (Phase B)

• Players mode on the Event Map now draws a fading ghost trail behind each player, connecting their recent position/kill/hit history, and flags a blip with a distinct shape + vehicle icon when their implied speed between two samples lands in a real vehicle's range (~30-150 km/h, using DayZ's verified ~24 km/h max sprint as the floor). Everything is computed client-side from data Players mode already receives ; no new server requests. Anti-cheat overlays (Phase C) are next.

v0.18.192New: Player Activity Map, a Players mode on the Event Map (Phase A)

• The Event Map dashboard page now has a mode toggle at the top: Events (unchanged, today's exact experience) and Players (new). Players mode shows a colored blip per active player, position updates plus kills/deaths/hits, its own time windows (5m/10m/30m/2h/4h/6h), a live per-player legend, and hover tooltips with real event detail. Same page, same URL, same permission as Events mode ; nothing about Events mode changed. Trails, vehicle detection, and anti-cheat overlays are planned for later phases.

v0.18.191New: Nitrado outage alerts also reach the dev error channel, not just per-guild

• The new sustained-Nitrado-outage alert (v0.18.190) only reached a guild that had already configured its own uptime-alert channel ; most hadn't, so a real, hours-long outage produced no notification anywhere until directly reported. Now also posts to /dev error-channel (the same bot-wide channel already used for repeated process errors), naming which guild/server is affected, so an outage for ANY guild surfaces centrally regardless of that guild's own setup.

v0.18.190Fix: player online status could get stuck after a real disconnect ; added a live Nitrado outage alert

• CRITICAL: a player who genuinely disconnected could still show up in /player online (and the dashboard) forever afterward, if any other event type for them (a hit, kill, teleport, chat line, or build action) happened moments earlier in the same log but sorted AFTER their disconnect in the parser's own internal processing order. The event parser was never actually chronological, just grouped by event type ; now sorted by real time before anything reads it.
• HIGH: a sustained Nitrado API outage (every request failing) for a guild produced no active notification anywhere, only a passive dashboard warning nobody would see unless they happened to open that exact page. Now posts a real alert to the server's uptime-alert channel (same one /server-monitor channel sets) the moment a sustained outage is detected, and a recovery alert the moment it clears.

v0.18.189Fix: 7 bugs from a full audit sweep, including 3 CRITICAL

• CRITICAL: /dz-store buy/pay/setlocation let any player act on ANOTHER player's Cash balance or saved spawn location by simply typing their gamertag in the optional gamertag option ; no ownership check existed. Now checks the caller's own linked gamertags first, falling back to requiring mod permission for anyone acting on someone else's identity.
• CRITICAL: /dz-kick, /tempban, and the dashboard's Fine tool all resolved WHO gets punished from the gamertag option, but checked protection status against a separate, unrelated user option ; a moderator could punish a protected Administrator's real gamertag while the check passed against an unrelated bystander. Now checked against whoever the gamertag actually belongs to.
• CRITICAL: every PvP/infected/animal kill was silently double-counting the victim's death stat. DayZ logs a closing summary line after EVERY death, including a real kill, and the parser was counting that closing line as a second, separate death.
• HIGH: /casino blackjack could pay out the same hand twice if a button click landed right at the same moment the table's own 60-second timeout fired.
• HIGH: two /tempban start calls issued for the same player around the same time (two mods, or Discord+dashboard) could create two separate active bans instead of one ; when the shorter one expired, it silently freed the player even though a longer ban was meant to still be active.
• HIGH: a killer/attacker Steam name containing parentheses (clan tags/region markers are common) was getting silently cut off in kill feeds, hit feeds, and reward payouts.
• HIGH: /achievements me and /achievements dayz permanently skipped a role reward if anyone viewed the achievement before the automatic sweep caught the unlock a few seconds later.

v0.18.188Fix: /dz-kick can now be used with just a gamertag

• /dz-kick required a Discord user, with no way to kick a player who was never in this Discord at all, or whose Discord account was never linked. user is now optional ; a gamertag alone is enough. A protected Administrator's DayZ character still can't be kicked this way if their gamertag is linked to their Discord account, same protection as before, just checked in reverse when no user is given directly.

v0.18.187Fix: death feed was falsely reporting real suicides/fall damage as Dehydration

• Real bug, verified against live server logs: DayZ logs a closing 'died. Stats>' summary line after EVERY death, regardless of real cause, right after whatever specific line already exists (committed suicide, bled out). The parser was matching that summary line as a SECOND, separate death, and guessing a cause from its Water/Energy numbers, so a real suicide or fall-damage death was showing up a second time as 'Dehydration' or 'Starvation' even though nothing about it was actually dehydration-related.
• Fixed at the source: duplicate death lines for the same player/moment are now collapsed into the one real death, keeping whichever cause DayZ actually logged. When a death has no specific cause line at all, we now check for a real logged hit (e.g. fall damage) at the same moment before ever guessing, and if there's truly nothing to go on, the feed now says so honestly ('Cause unclear') instead of asserting a specific cause that was never actually verified.

v0.18.186Update: background grid now has scattered circuit-trace detail

• Added a handful of small right-angle trace lines with via-dots to the sitewide grid, sparse and static, with the earlier glow-pulse points repositioned to sit exactly on a couple of them so it reads as a couple of powered trace endpoints on an etched circuit board, not just floating glow blobs.

v0.18.185New: /dashboard command

• A quick way to get to the web dashboard: /dashboard replies (privately) with a link straight to your server list, no need to remember or dig up the URL.

v0.18.184Update: sitewide background grid now has a subtle animated circuit glow

• The terrain grid behind every page now has a couple of soft, slow-pulsing glow points sitting at real grid intersections, on top of a slightly brighter base grid; a small circuit-board-style detail pass, kept deliberately subtle so it never competes with real page content.

v0.18.183Fix: homepage/guild-picker background no longer snaps when the mouse leaves

• The homepage and guild-picker's 3D constellation background used to jump straight back to its resting rotation the instant the cursor left the hero area, a visible, chopped-looking snap. It now keeps spinning in the direction (and at roughly the speed) the cursor was moving when it left, decaying smoothly to a stop instead of cutting instantly.

v0.18.182Update: sitewide background dimmed and re-themed around stars

• The sitewide scrolling code background was loud enough to compete with real page content for attention (most visible on pages without their own bespoke look, like /features, /docs, /changelog); dimmed and spaced out so it reads as ambient texture instead of a wall of text.
• The sitewide constellation field's stars are now pale starlight white (with a gentle twinkle) instead of brand green, so it reads as a night sky behind every page, while the connecting lines stay green as this site's own thread through it.

v0.18.181Fix: /bench page rendered at roughly double width on mobile

• The /bench page's code snippet grid had no width constraint on its grid items, so a long unwrapped code line stretched the entire page (and everything in it) to fit instead of scrolling horizontally within its own code block; the whole page rendered at ~2x the phone's actual width. Fixed.

v0.18.180Fix: busy connect/disconnect (and other) feed cycles no longer drop players

• A poll cycle with more connects, disconnects, kills, etc. than fit in one Discord embed (a hard 25-field limit) used to show the first few and silently drop the rest, with only a small 'Showing 3 of 5' footer note; the dropped players had no name, PSN, or location shown anywhere, not truncated info. Fixed to spill into as many messages as it takes so every event in the cycle gets shown.

v0.18.179New: an Official Partners page, first partner is Baked Beanz

• New /partners page: BenchBot's official-partner showcase, its own warm ember/campfire visual identity and a continuous rising-embers animation distinct from every other page on the site. First (and for now, only) partner is Baked Beanz (Baked Beans™ Roleplay, PS5), with a live member/online count pulled straight from Discord's own invite API.
• Removed the OMG-Its-Dan21/OMG Projects credit and link from the homepage, /about, and /expedition; no longer affiliated.

v0.18.178Fix: intermittent "database is locked" errors mirroring economy data to SQLite

• Added a busy-timeout to the SQLite economy mirror so a writer that finds the database momentarily locked retries for a few seconds instead of failing immediately. These failures never touched real player data (the JSON files stay authoritative and the mirror write is best-effort), just noisy error logs; this should make them stop happening.

v0.18.177Update: /bench page now explains its own code and backs up the hype

• Every real code snippet on /bench now has a short explanation of what's actually happening in it, not just the highlighted source. Added a standout callout on the single most impressive fact: self-hosted codegen is verified for real by transpiling to Rust, invoking rustc on it, and running the result, every time the test suite runs.

v0.18.176New: a Bench (.b) language showcase page

• Bench (.b files, also called .bench), a real from-scratch programming language, now has its own page at /bench: real syntax-highlighted code copied straight from its own repo (control flow, generics, traits, real OS-thread concurrency, and its own self-hosted lexer written in Bench itself), verified stats, and a continuous animated circuit-board background instead of a one-time intro. A genuinely separate visual identity from both BenchBot's own pages and /argus.

v0.18.175Update: /argus page now covers encryption and threat-intel scope

• The /argus page now specifically names its AES-256 encryption (SQLCipher) and adds a real stat and explanation for its threat-intel sources (4 independent feeds covering scam domains, malicious netblocks, and known-bad IPs, shared across every server it protects). Deliberately does not claim cross-server user surveillance: that's a real, separate, and still-unbuilt feature, not something this page should suggest already exists.

v0.18.174New: an Argus teaser page

• Argus (a separate, standalone Discord security bot, still in active development) now has its own page on the site at /argus: its real detection capabilities, verified stats pulled straight from its own repo, and a boot-up animation built in Argus's own established visual identity. Clearly marked in development, not yet installable.

v0.18.173Fix: 4 places that could get permanently stuck once a guild moves to a new bot

• Found via the same live migration testing as the race fix above: the leaderboard channel, the live-players heatmap channel, giveaway endings, and the global banlist review queue all keep one message alive by editing it in place every cycle, and Discord flatly refuses to let one bot edit a message a different bot posted. Once a guild's data moves to a new bot process, all four would fail silently every single cycle forever, and a still-open giveaway would never announce its winners at all. Each one now reposts a fresh message under its own identity the first time it hits this, instead of getting stuck.

v0.18.172Fix: closed a live race between the two bot processes on a freshly-invited guild

• Found live, minutes after the .bOne bot's very first real invite: an already-running bot process has no way to learn a guild it thought it owned just got claimed by the other one, since that claim only ever updates the claiming process's own memory. Both processes ended up independently polling the same DayZ server logs for several minutes with separately-diverging read positions, heading toward duplicate kill-feed messages and duplicate cash payouts before it was caught and stopped. Every bot process now rechecks who owns each guild every 30 seconds, closing the gap down from indefinite to a single short window.

v0.18.171Infra: closed a gap in the multi-bot-process safety net (v0.18.170)

• Found live while actually standing up a second bot process for the first time: on-boot re-encryption resave (turns on automatically whenever DATA_ENCRYPTION_KEY is set) blanket-resaved every shared guild regardless of which bot process owned it, unlike every other background sweep. A second process restarting could have silently overwritten another guild's more-recent write with its own stale copy. It now respects the same per-guild ownership every sweep already does.

v0.18.170Infra: prep work for a second bot process sharing this same data

• No visible change for any existing server. Every background sweep (temp-bans, zone/base-ping bans, kicks, the online-count channel, server-uptime checks, giveaways, reminders, scheduled embeds, and the main DayZ log poller) now skips a guild whose data is marked as owned by a different bot process, and a guild is automatically marked as owned by whichever bot process is actually in it. This is the safety net that lets a second, separate bot application eventually share this same data store without either process racing the other's reads/writes for the same guild.

v0.18.169Fix: dashboard-created events could silently lose their own write

• Found via a direct audit: creating an airstrike, gas strike, vehicle spawn, or horde from the dashboard skipped a lock the same feature's Discord command already held, so a dashboard-created event could race the automatic cleanup sweep (or another concurrent create) and have its write silently overwritten, with the dashboard still reporting success. The lock now lives inside the shared function itself, so every caller (Discord and dashboard alike) is protected the same way, and no future caller can forget it.
• Also closed a smaller version of the same kind of race in ticket panel creation: two panel-creates arriving at nearly the same moment, right at the 20-panel limit, could both slip through before either had actually reserved a slot.

v0.18.168Security: closed a bounty payout exploit, plus a duplicate-ticket race

• Found via a direct audit: /bounty claim paid out to whoever ran the command, with no check at all that they were actually the killer named on the bounty. Since /bounty list shows every fulfilled bounty's id to the whole server, anyone could have claimed anyone else's reward. It now checks the claimant's own linked gamertags (/link set) against the recorded killer first, and only falls back to a staff member sorting it out manually for a killer who hasn't linked a gamertag yet.
• Filling out a ticket application's modal takes real time; two near-simultaneous submissions (a fast double-click, two tabs, or just bad timing) could both slip past the 'you already have an open ticket' check before either had actually reserved one, opening a second ticket. The check that actually reserves a ticket now happens at the one point that's guaranteed race-safe, closing that window for good.

v0.18.167Fix: the Event Map could go silent for a busy server, sometimes permanently

• Found via a real live report: a server logging loot at a genuinely high, sustained rate could grow its log faster than one poll cycle's read could drain, so it never finished catching up after a restart, not just for a few minutes, but indefinitely. The map, and everything else that waits for a server to be fully caught up, went silent for as long as that kept happening, even though the server was actively logging the whole time.
• A poll cycle can now read several chunks in a row when it's still behind, instead of just one chunk per cycle. A brief backlog still catches up in one cycle like before; a much larger one now drains in a handful of cycles instead of dozens, and a sustained-busy server no longer gets permanently stuck.

v0.18.166Polish: homepage background slowed down further (2nd pass)

• Follow-up on the previous pass: node drift, the ambient rotation, and how often new radar-ping/comet events appear are all roughly another 2-2.3x slower. The radar sweep itself was left exactly as-is.

v0.18.165Polish: homepage background constellations calmed down and spread across the whole page

• The animated background on the homepage had too much going on at once ; every rotation, drift, and sweep now runs 2.5-3.5x slower, and new radar-ping/comet events fire less often.
• The fuller effect used to fade to almost nothing right after the hero section ; it's now visibly present the whole way down the homepage, not just at the top.

v0.18.164Fix: full diagnostic sweep, 9 real bugs including 3 privilege-escalation/exploit CRITICALs

• CRITICAL: any guild member could take over a rival faction (accept a fake join request, transfer leadership to themselves) by typing that faction's public leader gamertag into /faction accept/kick/promote/transfer-leader/etc., then drain its shared Cash bank ; those actions now require your own /linked gamertag, not a typed-in one.
• CRITICAL: a mod holding only the delegable reaction-role permission (Discord command or dashboard) could map an emoji to the bot-admin/moderator role, or any Administrator-flagged role, then grant it to themselves by reacting ; both surfaces now reserve mapping a role like that to real Administrators.
• CRITICAL: /zone's auto-ban could produce two independent active bans for the same player from two hits in one poll cycle, and reversing the shorter one unbanned the player early even while the longer one was still meant to be active ; now merges to one ban per player per server, matching /baseping's already-fixed equivalent.
• HIGH: the dashboard's Event Creation page trusted a client-submitted target for Remove/Edit Count with no server-side check it was real, letting a moderator with only the narrow create-event permission point it at an arbitrary path on the server's own FTP account ; it now re-verifies against the real spawn list first.
• HIGH: /createevent's Edit Count/Remove and the automatic 15-minutes-after-restart cleanup sweep could write to the same event-spawn files at the same time with no coordination, silently dropping whichever change finished last ; both now share one lock.
• HIGH: the dashboard's Cash Zone and Autoban Zone forms accepted a 0 or negative cooldown/offense-window, which defeats the cooldown entirely (unbounded Cash farming) or permanently disables ban-tier escalation ; both now enforce the same 1-minimum floor the Discord commands already had.
• A per-server basePing/detector/cash-config field added after a server's data was already saved could stay permanently missing instead of picking up its default, on any guild running more than one DayZ server ; fixed the same way the single-server equivalent already was.
• /shop buy let players acquire /expedition-catalog items (Ammo Case, Reinforced Backpack, etc.) for free, since those use a different currency /shop's own balance check never recognized ; removed from /shop buy entirely, unaffected on /expedition buy where they belong.

v0.18.163Fix: /player online kept showing players who left hours (and several restarts) ago

• A forced server restart ends every player's connection immediately, but often never writes an explicit "disconnected" line for whoever was still in-game at that moment, unlike a normal logout. The bot had no way to tell the difference, so it kept marking those exact players online forever, through as many further restarts as it took, until each one happened to reconnect. Now a detected restart marks everyone who was online beforehand as offline right away, so /player online reflects who's actually connected instead of who was connected before the last restart nobody logged out of cleanly.

v0.18.162Fix: rare command failures under load (real ack-timing data finally came in)

• A handful of commands (this time /dz-ban) have occasionally failed instantly with Discord's "Unknown interaction" error since 2026-08-07 ; diagnostics added back then (still shown in bot.log if it happens again) finally caught it with real numbers: the bot's own code was ready in 96ms, but the actual Discord network call took 3.7 seconds and blew past Discord's hard 3-second reply deadline before it could even complete. Lowered how many event-announcement messages the bot sends at once per server, leaving real headroom below Discord's global rate limit instead of sitting right at it ; this is a mitigation based on the first real evidence caught, not a guaranteed fix.

v0.18.161Add: base ping whitelist ; let staff fight in a zone everyone else gets auto-banned in

• New per-base-ping whitelist for auto-action: exempt specific gamertags (staff, event-runners) from a base ping's auto-ban entirely, while everyone else who enters or gets a kill there still gets banned as configured. The alert notification still fires either way ; only the punitive ban is skipped for an exempt name.
• Manage it with /baseping whitelist add|remove|list, or the new "Auto-Action & Whitelist" card on the dashboard's Base Pings page, which also brings full auto-action configuration (enable, trigger type, ban tiers) to the dashboard for the first time ; it was Discord-command-only before.

v0.18.160Fix: auto-mod link allowlist had no way to manage it ; add: auto-role on gamertag link

• Fixed: the auto-mod External Links check had an allowlist field with zero way to ever add to it, so turning it on blocked every link with no exceptions, including GIFs sent through Discord's own Tenor-backed picker. New /automod links add|remove|list (Discord) and a Link Allowlist section on the dashboard's Auto-Mod page let you allow specific domains through, e.g. tenor.com or giphy.com ; a domain covers all of its subdomains too.
• Add: an admin-configurable role that's automatically granted the moment a member links a gamertag (/link set, /link admin set, or the Player Hub button). Configure it with /setup link-role, or the new "Auto-assign once a member links a gamertag" picker on the dashboard's General Settings page ; off by default.

v0.18.159Fix: 11 issues from a full diagnostic sweep across the bot and dashboard

• Fixed: removing a zone, base ping, or DayZ server and later adding a new one could silently inherit the deleted one's offense/ban history (or Event Map data), since the auto-assigned id could get reused ; every removal now cleans up its own history instead of leaving it to reattach.
• Fixed: a moderator without Administrator could re-grant themselves an achievement's role reward by editing its unlock condition instead of the role field directly ; changing the condition on a role-attached achievement now requires admin, same as changing the role itself.
• Fixed: the Server Config page showed your Nitrado API token in plain text in the edit form ; it's now a masked password field that only changes when you actually type a new one or explicitly clear it.
• Fixed: a real DayZ vehicle spawn could be misclassified against the RPT log's dynamic-event list instead of the actual known vehicle list, and vice versa.
• Fixed: a player already standing inside a base-ping zone across a routine bot restart could get flagged as a fresh "entered" the moment the bot came back online, wrongly feeding a real auto-ban offense for doing nothing.
• Fixed: a failed /restart, /stop, or /start could retry automatically and risk double-triggering the action against your live server ; those three now make a single attempt instead of silently retrying an ambiguous failure.
• Fixed: several admin confirm-and-execute dialogs (Cash wipe, close all tickets, wipe achievements, purge/purgechannels) could still complete even after a guild was deactivated mid-confirmation, same class of gap fixed for other flows last session.
• Fixed: the Embed Builder's multi-step draft flow didn't re-check your permission on each step, only when it was first opened ; each step now re-verifies access, matching how other multi-step admin flows already work.
• Reliability: a single bad or unexpected event in a poll cycle could silently drop every event after it in that same batch ; each event is now processed independently, so one failure no longer takes the rest of the batch with it.
• Reliability: startup now registers commands and warms invite tracking for every server the bot is in concurrently instead of one at a time, so a bot in many Discord servers comes fully online faster after a restart.

v0.18.158Fix: quest system fully broken, plus a self-approval exploit and two data-isolation bugs

• Every quest button/select-menu click and the review modal crashed instantly (a real bug in v0.18.152-153's server-resolution code); /quests, Start Quest, Submit for Review, and Approve/Reject are all working again.
• Fixed: the Approve/Reject buttons on a quest submission had no permission check at all; anyone who could see the review message could approve their own submission for a real Cash payout. Approving/rejecting now requires the same admin/mod permission as the Quests dashboard page.
• Fixed: a guild's 2nd+ DayZ server created before the quest system shipped could silently share quest/announcement data with another server on the same guild instead of having its own. Every server now gets its own independent copy on load.
• Fixed two bugs in last session's Nitrado status cache: a different (unauthorized) token for the same server id could be served another server's cached data instead of its own ; and a slow, still-retrying request could wrongly evict a newer, valid cache entry.

v0.18.157Add: upload an image file straight from your computer in the Embed Builder

• The dashboard's Embed Builder Image and Thumbnail fields now have an Upload button next to the URL box; pick a file (PNG/JPEG/GIF/WebP, 8MB max) and it's hosted automatically, no need to find somewhere else to host it and paste a link first.

v0.18.156Add: global ranks; compare your players across every opted-in BenchBot server

• New "Global Ranks" toggle on Server Config: opt this server's players into a bot-wide rank pool, compared against every other server (any guild) that has also opted in. Off by default; your players are never compared against anyone else's until you turn it on.
• Once opted in, /myprofile pages show a Network Rank alongside the existing per-server rank, computed by kills across the whole opted-in pool.

v0.18.155Polish: player profile page background no longer a flat void

• The /myprofile page now carries the same ambient sitewide starfield every other dashboard page already has; it was skipped when the page was first built (deliberately standalone, no dashboard shell), which left the wide margins outside the content column flat and empty on anything wider than a phone.

v0.18.154Fix: Nitrado rate-limiting from redundant status polling

• Three independent recurring jobs (the main event poller, the online-count channel's mapSlug sweep, temp-ban list reads) each queried Nitrado's server-status endpoint on their own schedule with no sharing between them ; on a Nitrado service already running a tight quota, that redundant load could tip it into sustained rate-limiting, felt anywhere live data is shown (the Event Map included).
• That status call is now deduped behind a short shared cache, and automatically invalidated the moment any of those same jobs writes to the server (e.g. applying or reversing a ban): so a read right after a write always sees the fresh result, never a stale one.

v0.18.153Polish: Quests + player profile get the constellation treatment ; quest rewards simplified ; announcements now configurable

• The Quests dashboard page and the /myprofile player page now use the site's constellation visual language (seeded starfield/node art, comet included on the profile hero) instead of a plain table/dossier look: every quest gets its own unique constellation "fingerprint" glyph.
• Quest rewards simplified to just two options: DayZ currency (Cash, spendable at the Corna Store) and an optional custom note admins write for anything else (e.g. "Ghillie Suit kit; ask an admin") ; Dollars/Plates/Bullets and role rewards are no longer quest reward options.
• Quest completion announcements are now fully configurable per server; pick the channel and customize the title/description (with placeholders like {player}/{quest}/{reward}) right from the Quests dashboard page, plus a Send Test button to preview it.
• A manually-approved quest step now announces and DMs the player exactly like an auto-detected one (previously it silently skipped both).
• Completing a quest step now DMs the linked player with what's next (or their reward, if that was the last step).
• Fixed a small mobile layout overflow on the Quests dashboard page.

v0.18.152Add: full quest system; auto-detected steps, manual submission + approval, admin builder

• New /quests command lets a player view every quest on this server, start one, and see their own step-by-step progress.
• Admins build multi-step quests on a new dashboard page (guild hub > Quests); steps can be a zone to visit, a kill count, a travel distance, or a manual step (submitted by the player, approved or rejected by an admin), any mix, in any order or strictly sequential.
• Zone/kill/travel steps complete automatically off the same live event stream playerStats and Cash already read: no extra polling. A manual step's submission posts to a review channel with Approve/Reject buttons.
• Rewards (Dollars/Plates/Bullets, Cash, and/or a Discord role) pay out automatically the moment every step in a quest is done.

v0.18.151Add: /myprofile, a public player dossier page

• New /myprofile command posts a link to a real player profile page ; a public, no-login "Field Dossier" showing combat/survival stats, rank among every tracked player, both economy ledgers (Dollars/Plates/Bullets and Corna Store Cash, kept clearly separate), all 3 real achievement categories with unlock state, and a new Rivalries ledger tracking who's killed you most and who you've killed most.
• Ban/kick/fine/warning history is deliberately never shown on this page ; that stays admin-only, exactly as everywhere else in the dashboard.

v0.18.150Polish: real dashboard panel cards, not a wall of green buttons

• Every one of the 35+ hub panel cards (Auto-Mod, Zones, Event Map, etc.) now has a real title with a category icon instead of a solid green pill button ; the whole card is now the click target (previously only the small button text was, despite the whole card lifting on hover), with a hover arrow to signal it.
• Card backgrounds are a touch more opaque so the animated background text reads less distracting behind titles and descriptions.

v0.18.149Polish: Event Map search raises matches out of clusters instead of jumping to them

• Searching no longer pans/zooms the view ; instead every matching blip is pulled out of clustering entirely and rendered bigger with a glowing ring, so results are easy to spot right where they already are without the map yanking around under you.
• A tight group of matches that would normally collapse into one cluster badge now shows every one of them individually.

v0.18.148Add: search bar on the Event Map

• The Event Map's control panel has a new Search box at the top ; type an item, vehicle classname, category, or player name and matching contacts filter live, everything else dims out of the cluster/blip view.
• A live match count shows under the search box, with an 'Enter to jump' hint ; pressing Enter pans and zooms to whichever match sits closest to your current view.
• Search combines with the existing category checkboxes ; a category you've toggled off stays off even if it would otherwise match.

v0.18.147Polish: slower, steadier Constellation Charts

• The flagship cards and the homepage's own particle-field hero now tumble noticeably slower ; a calmer, more ambient drift instead of a fast visible spin.
• Every card's constellation now fills a consistent amount of the visual area regardless of its random viewing angle ; previously an unlucky angle could compress a shape into a small, sparser-looking corner of the card even though the underlying cluster was just as rich as any other card's.

v0.18.146Polish: Constellation Charts get much denser, glowier fields

• Every card's constellation now has roughly double the nodes and connections, a much denser scattering of background dust, and a real soft glow/bloom behind the brightest stars ; a busier, richer starfield across both the flagship and standard cards.
• Same green/amber/rust palette and calm-grid behavior throughout ; a pure visual density pass, no behavior changes.

v0.18.145Add: real 3D depth for the constellation effects (cards + homepage)

• Every card's constellation and the homepage's own particle-field hero are now genuine rotating 3D point clouds (real perspective, nodes properly sized/layered by actual distance) instead of flat dots with a fake size trick ; the flagship cards and homepage hero visibly tumble in place, the homepage also tilts toward your cursor.
• The ~37 standard feature cards get the same real 3D perspective computed once per card (a fixed, per-card viewing angle) rather than continuous animation, keeping that grid calm and fast to scan.
• The sitewide particle-field background behind every other dashboard page is untouched ; this only reaches the homepage hero and the feature cards.

v0.18.144Polish: Constellation Charts get sparkle glints, dashed links, and a denser starfield

• Every card's constellation now has a couple of bright sparkle-glint stars, dashed (not solid) connecting lines, and a real scattering of tiny background dust points behind the main shape ; a denser, more starfield-like look on both the flagship and standard cards.
• Still the site's own green/amber/rust palette throughout, nothing new to configure ; a pure visual polish pass, no behavior changes.

v0.18.143Add: Event Map tooltips now show event times in your own local time

• Hovering an Event Map blip used to only show the raw time straight from the DayZ server's own log ; that clock's timezone is whatever the game server itself happens to be set to, not yours.
• The tooltip now shows the time your own browser thinks it is (plus a plain-language "3h ago"), with the original server-log time kept right underneath for anyone cross-referencing the DayZ server's own logs directly.

v0.18.142Redo: the tactical-HUD flagship cards had a real bug and got replaced entirely with "Constellation Charts"

• The v0.18.141 HUD redesign had a genuine rendering bug (its rotating border occasionally tore outside the card's rounded corners) and, on a closer look, every card in a category still shared one identical giant icon ; both are fixed by a full redesign instead of a patch.
• Every one of the ~37 standard feature cards, and all 4 flagship cards, now shows its own small constellation ; glowing nodes connected by faint lines, generated uniquely per feature so no two cards in a category look alike anymore, plus a small grid-reference/status readout underneath.
• The 4 flagship cards additionally animate live (gentle drift, an occasional signal pulse, and a real comet crossing reserved for the hero card only) ; the standard grid stays fully static so scanning 37 cards at once stays calm, with just a small hover-only pulse per card.
• Also fixed a rare, unrelated pre-existing bug in the sitewide particle-field background found while live-testing this: a radar ping could occasionally compute a negative radius and throw, found and fixed with a one-line clamp.

v0.18.141Redesign: the flagship Features cards get a whole new tactical HUD treatment

• The 4 flagship spotlight cards on /features dropped the glowing-orb-with-spinning-rings look for something genuinely different ; a rotating energy-frame border around the whole card, a radar-style scanline sweep, a 4-corner targeting-lock reticle around the icon, a small scanning signal indicator, and a beveled nameplate with a double rule and flanking chevrons.
• The full 36-feature grid below it is untouched ; still the calmer glow/ring showcase treatment, so the true flagship cards keep standing out.

v0.18.140Add: full Ticket Panels dashboard overhaul + a new Application intake-form mode

• New Ticket Panels dashboard page ; create, edit, and delete as many ticket panels as you want (up to 20), each with its own custom title, description, categories, and channel, with a live mock-embed preview showing exactly what it'll look like in Discord before you post it.
• New Application mode, toggled per-panel ; clicking the button pops up a real Discord form (up to 5 configurable questions) instead of going straight to a blank chat, then the submitted answers post as the ticket's opening message and it behaves like a normal ticket (chat, claim, close) from there.
• Open Tickets and a ticket's own detail page now both show whether it came from a Ticket or Application panel, with the submitted Q&A visible right on the ticket detail page.

v0.18.139Add: the full Features list gets the animated showcase treatment too, with a flashier flagship tier for real contrast

• All 36 features (not just the 4 flagship picks) now get the animated icon showcase treatment instead of a plain icon badge ; every one of them gets a real glowing, tone-colored icon composition now.
• To keep the true flagship cards standing out above that, they got noticeably flashier: a 3rd ring, 6 light particles instead of 4, a permanent glow at rest (not just on hover), and a real diagonal light-sweep across the card.

v0.18.138Add: a real masonry showcase, custom animated icons, and a proper Docs landing page

• The homepage's Explore section, the Features spotlight, and a brand-new /docs landing page all now use a real editorial masonry layout ; asymmetric card sizes, a big animated icon centerpiece per tile (a glowing orb, two counter-rotating rings, and drifting light particles around the real feature icon), and a caption underneath, instead of a plain uniform grid.
• /docs used to just bounce straight to the setup guide ; it's now a real landing page with its own showcase grid, one tile for Get Started and one for each of the 7 command categories, so there's an actual "pick where to start" moment before the dense reference content.

v0.18.137Polish: Features and Reviews get a real showroom-grade spotlight treatment

• Pushed the Features spotlight much further: the lead capability now gets a genuinely dramatic full-width reveal ; glowing border, ambient light behind it, a huge glowing title, and a big glowing icon, with a slow cinematic rise into view instead of a quick fade.
• The featured review on Reviews (and the homepage) gets the same treatment: a glowing avatar, a glowing oversized quote mark, a glowing title, and the same dramatic reveal ; every other card keeps its hover glow, just calmer, so the one true spotlight moment actually reads as one.

v0.18.136Polish: Features and Reviews now read like a real showcase, not a table

• Features had 36 identical plain boxes in a row ; it now leads with a large spotlight for a few standout capabilities (Event Map, Store & Economy, the Global Watchlist, Custom Achievements), every card gets a real colored icon badge instead of a tiny outline glyph, and each category header gets a real number.
• Reviews now shows a decorative quote mark and a real initial avatar per reviewer, and cards size to their own content instead of stretching to match their row ; it reads like a wall of testimonials now, not a spreadsheet.

v0.18.135Add: 5 new public pages ; Features, Docs, Changelog, and Reviews, plus a deeper homepage

• The public site was really just one page (this homepage) plus /legal. It now has real Features, Docs, Changelog, and Reviews pages, each pulling from content that already existed but was locked behind Discord: the same 36 dashboard capabilities, the same step-by-step setup guide and full command reference, and this same changelog you're reading right now, going all the way back to day one.
• The homepage itself got real cards for every review instead of a cramped scroll box, a third live stat (commands run in the last 30 days), and a new "Explore more" section tying the whole site together.
• Card grids across the site now reveal in with a per-card cascade instead of popping in all at once, and page-to-page navigation gets a real cross-fade on browsers that support it.

v0.18.134Mobile: every remaining dashboard table now stacks into readable cards on a phone; the mobile table pass is complete

• Finished what the last two updates started: every dashboard page with a data table (27 more since last time; Store & Economy, Server Config, Factions, Zones, Base Pings, Teleporters, Custom Achievements, the Guild Manager, and the rest) now collapses into labeled stacked cards on a phone instead of forcing sideways scrolling. All 32 table-bearing dashboard pages are covered.
• Purely a mobile layout change; desktop keeps the exact same table view it always had, nothing about how any of these pages work changed.

v0.18.133Mobile: the Watchlist, Tickets, and Punishments tables now stack into readable cards on a phone instead of forcing sideways scrolling

• Continuing the mobile pass: the Global Watchlist, open Tickets list, and Player Punishments pages (both the active ban list and the merged history table) had dense multi-column tables that only worked by scrolling sideways on a phone. They now collapse into a stacked card per row on small screens, each field labeled, with the desktop table view unchanged.
• More dashboard pages with tables still need this same treatment: this covers the highest-traffic ones first.

v0.18.132Mobile: dashboard pages get real breathing room, and the Event Map console no longer eats the whole screen

• First pass of a real mobile pass across the dashboard (more to come); tightened padding/spacing on every page so a phone screen isn't mostly whitespace, and card grids now genuinely stack instead of just squeezing.
• The Event Map's control panel was a fixed-width sidebar that covered most of a phone screen, leaving barely any room to see the map underneath it. It now collapses to just its header bar by default on mobile, tap it to expand the full controls, so the map itself is what you actually see first.

v0.18.131Fix: severe backlog-catchup bug; hours of history could get replayed as if it just happened, after any restart with a real gap

• Found and fixed the actual root cause of the Event Map's impossible loot numbers (a user's own words: "there's no way that 8000 items spawned in 2 hours"), and it went deeper than the map. Since last night's log-reading speed fix, catching up on a real backlog after a restart could take several read cycles on a busy server, but the bot only protected the very first cycle from being treated as live; every cycle after that got dumped into the map, kill/death feeds, achievements, and cash payouts as if it had just happened, timestamped with the moment it was processed instead of when it actually occurred.
• Both gaps are closed: the bot now correctly stays in catch-up mode for as many cycles as a real backlog actually takes to drain, and the live map buffer itself no longer accepts backlog-era events at all (previously only the permanent database copy was protected, not the live view).

v0.18.130Polish: homepage visual pass; real depth on the "why this exists" story, a bigger pull-quote moment, and more breathing room

• The homepage story section had no card behind it at all; long-form text sitting directly on the busy animated background. It now gets the same elevated-panel treatment as everything else on the page, and the pull-quote moment is bigger and glows.
• The page itself is noticeably wider on desktop now, so the credits and feature cards actually use the screen instead of staying pinned to a narrow single column; Special Thanks now lays out as a real grid instead of one card per row.
• The two hero stat numbers (communities/servers protected) were hard to read against the busiest part of the background; solid background now, no more blending in.

v0.18.129Fix: Event Map time-window buttons were never actually showing different loot history, plus a real fix for the earlier clustering bug

• Root-caused why every time-window button (2H through 24H) could show the exact same loot count: the buttons were only ever filtering a small, fast in-memory buffer that was never sized to hold real day-long history in the first place. The map now queries the real stored history for whichever window you pick, so 24H actually means 24 real hours.
• This safely reintroduces deeper loot history without bringing back the earlier "one giant cluster swallowing everything" bug: this time, clusters have a hard cap on how far they can visually spread, so heavy local activity still consolidates into one marker, but nothing can ever chain across the whole map into a single dominating blob again.

v0.18.128Add: real ack-timing diagnostics for the unexplained rare command-failure pattern

• A handful of commands (seen on /player online, /link, /basedamage, /dev error-channel) have occasionally failed with no identifiable slow code to explain it, unlike every other case fixed tonight. Every command's acknowledgment call is now timed centrally: if this happens again, the logs will show real numbers (how long our own code took vs. how long the actual Discord round-trip took) instead of needing another manual audit.

v0.18.127Add: multi-panel ticket support; post several independent "Open a Ticket" panels, each with its own text and categories

• New: /ticket panel-create, panel-list, panel-edit, panel-delete. A server can now post multiple ticket panels in different channels; e.g. a general-support panel in #help offering every category, and a focused player-reports panel in #reports offering just "Player Report"/"Ban Appeal"; each with its own custom embed title and description.
• The original /ticket panel and /ticket quicksetup are completely unchanged; that panel and every one already posted in the wild keeps working exactly as before ; this is purely additive.

v0.18.126Fix: 3 more silent-failure commands found by a post-incident audit (/setup bot-admin-role, mod-role, bot-trap, /channel create)

• Ran a full audit for the same "command silently fails under load" bug fixed for 12 other commands earlier tonight, specifically to catch anything that could still fail the same way. Found and fixed 3 more: /setup bot-admin-role and /setup mod-role (when creating the role automatically instead of picking an existing one) and /setup bot-trap could all hit the same 3-second Discord acknowledgment window if the server was busy ; /channel create had the identical gap. All four now acknowledge immediately and do their work after, closing the window for good.
• Also confirmed via the same audit: no other part of the app has a similar unbounded-clustering risk to the loot map issue, deploy is byte-for-byte identical between this codebase and the live server, and the error-alert channel is genuinely wired and active.

v0.18.125Revert: Event Map loot retention/clustering change (v0.18.124), made map clutter worse, not better

• Reverted last night's loot retention raise + separate loot clustering pass. In practice, once loot's retention was raised to 4000 events, the wider loot-only clustering radius chained almost every loot spawn on the map into one dominating cluster (a single marker showing a count in the thousands) instead of separate readable hotspots: confirmed live, visibly worse than the original overpopulation complaint it was meant to fix. Loot is back to its previous retention window and clusters the same way every other event type does. A real fix for loot's map density still needs to be found; this just undoes a change that made things worse in the meantime.

v0.18.123Add: a new dynamic event type (Airdrop), full parser audit, and a real "any error, any guild" dev alert channel

• Added a genuinely missing event type: Airdrop (StaticAirplaneCrate) spawns were being silently ignored on every server; the log line was already recognized, it just had no category to route into. Now shows up on the Event Map and can get its own feed channel like Heli Crash, Convoy, Police Situation, etc.
• Ran a full audit of the log parsers against real production data from every active server: confirmed nothing else is being silently dropped beyond what was already fixed tonight.
• Extended /dev error-channel: it used to only alert on a full process crash (rare) ; it now alerts on repeated errors from ANY command, in ANY guild, the exact category of bug found and fixed tonight, while still collapsing a burst into one alert instead of spamming one message per error.

v0.18.122Fix: Event Map missing loot (and some other RPT-sourced events) during specific overnight hours

• Found and fixed the real cause of a reported "the Event Map shows no loot" incident: the log reader required a strictly two-digit hour ("04:08:56") on every timestamp it read from a server's RPT log, but real RPT logs write single-digit hours space-padded instead (" 4:08:56", not "04:08:56"); so every loot spawn, cleanup, and a few other event types logged between 12am and 9:59am were silently skipped, every single day, for as long as this parser has existed. Fixed and covered by new tests built from the actual real log format. Player kills, hits, chat, and other admin-log (ADM) events were never affected; only the separate RPT log stream had this timestamp quirk.

v0.18.121Fix: several commands could silently fail under load (already-acknowledged / interaction expired errors)

• Found and fixed a real production incident: /player online, /link, /basedamage, /warn, /dz-kick, /tempban, /online-count setup, /ticket panel, /reactionrole (create/addrole/removerole), /suggest, /suggestion resolve, and /giveaway start could all silently fail (the member sees a generic "Something Went Wrong" DM, or nothing at all) when the bot took more than 3 seconds to respond; Discord's hard limit for the first acknowledgment. Every one of these now acknowledges the command immediately and does its actual work afterward, closing that window for good.

v0.18.120Fix: feeds falling behind; the log reader was re-downloading the entire (ever-growing) log file every 30 seconds

• Found and fixed the real cause of slow/delayed feed channels: reading a server's log for new events was re-downloading the ENTIRE file every 30-second cycle, forever, for as long as that server stayed up without restarting; one real log had grown past 33MB. A single oversized download like that could stall EVERY server's feeds fleet-wide for up to a minute and a half at a time. Now reads only the new bytes since the last check, every cycle, regardless of how large the file has grown.

v0.18.119Fix: cluster popup wheel-scroll fought the map, plus a website copy cleanup

• Fixed: scrolling inside a busy Event Map cluster's category breakdown popup (the "17 Events" list) zoomed the map underneath instead of scrolling the list; the popup's list is now its own independent scroll area.
• Cleaned up punctuation across the dashboard/website's visible text (error messages, page copy, table placeholders) for consistency.

v0.18.118Fix: 3 real reported bugs; a silent restart-detection outage, an FTP setup permission gate, and a map label overlap

• Found and fixed a real production incident while chasing a "restart detection isn't working" report: two servers' Nitrado connections had been failing on literally every single check for over a week straight, completely silently; nothing ever errored loudly because a failed connection looked identical to "this server just has no logs yet." The dashboard's Server Config page now shows a clear warning once a server's connection has been down for a sustained stretch, instead of this requiring a manual dig through raw logs to ever notice.
• Fixed: /rotation setup-ftp could be opened by a moderator granted the delegable 'rotation' permission, but silently rejected the save itself (full Administrator only); so filling in and submitting FTP credentials appeared to do nothing, with no clear explanation why. Now blocked with a clear message the moment the command is run, before typing anything in.
• Fixed: on a busy stretch of the Event Map, a town name label could render directly under a cluster count badge, making both hard to read. Labels now yield to a nearby event marker instead of overlapping it.

v0.18.117Add: full dashboard visual rework; depth, icons, and a living background on every page

• Every dashboard page (35+ of them, not just a handful) now has real card depth, hover glow, and a category icon next to its title, instead of flat bordered panels.
• The main Guild Hub is now grouped into 6 labeled categories (Moderation, Economy, Events, Community, Server Config, Support) instead of one long unlabeled wall of identical buttons.
• The homepage and post-login server picker got a new animated background, glowing connected nodes, a radar sweep, and the occasional comet streak, with real proof numbers (communities/servers running the bot) instead of a static logo.
• A quieter version of that same background now runs on every other page too, so the whole site feels alive, not just the front door.
• Security fix: the Event Map's live data feed could let an attacker-controlled in-game player/weapon/reason name break out of its data block and run script in an admin's dashboard session; found during this pass, unrelated to anything above, now closed.
• Fixed along the way: a scroll-reveal animation that was silently doing nothing on a few pages, a couple of buttons that had lost their keyboard-focus styling, a corner decoration rendering in the wrong spot, and animated backgrounds going blank after a window resize for anyone with reduced-motion turned on.

v0.18.116Add: dashboard visual overhaul; real toggle switches, danger actions, tags, and animation across the site

• Real toggle switches (Casino chip economy, Account Links mode) instead of a button whose label just changed text.
• Destructive actions (Disband, Remove Member, Unlink) are now clearly marked in red with a confirmation prompt before they go through; Factions and Account Links specifically.
• Tickets' priority column is now color-coded at a glance, and Close All sits inside a clearly-marked warning panel.
• Member/pending gamertag lists render as individual tags instead of a run-on comma-separated line.
• Every dashboard page now has a subtle entrance animation on load, and the Automod/Logins tables collapse into readable stacked cards on a phone instead of requiring sideways scrolling.
• First wave of a larger overhaul; more pages get this treatment over time.

v0.18.115Add: All / None / "only" buttons for the Event Map contact filters

• Real reported gap: filtering the map down to a specific event type meant clicking 16 checkboxes off one at a time. "All" and "None" now clear or restore every filter in one click, and each row has its own "only" button to instantly isolate just that one.

v0.18.114Add: cluster breakdown on the Event Map now shows exactly what spawned, not just the category

• Real reported gap: a cluster popup showing "Loot Spawn: 2" gave zero indication of what actually spawned. It now lists the real item/vehicle names under each category (e.g. two different loot types shown separately, not lumped together); same for construction items and anything else with a specific identity behind the category.
• Categories with nothing more specific to show (Kill, PvP Hit, etc.) are completely unchanged.

v0.18.113Add: real town names on the Event Map, hover-to-preview clusters, and an honest "Zoom In"

• Town and city names now show on the map itself, styled like Google/Apple Maps place labels; clears up automatically as you zoom in so it never looks cluttered.
• Hovering a cluster now previews its category breakdown, not just clicking: same as individual markers already worked.
• Real reported gap: for events that keep happening at (or very near) the exact same in-game spot, a fixed convoy spawn point, for example, no amount of zooming can ever visually separate them, so "Zoom In" was a dead end that looked broken. It now says so honestly instead of showing a button that does nothing, while every cluster that CAN actually be zoomed into still works exactly as before.

v0.18.112Fix: clicking a cluster on the Event Map now actually shows what's inside it

• Real reported gap: clicking a cluster marker just zoomed in with zero indication of what was actually there. Clicking one now shows exactly which event types are inside and how many of each, with a "Zoom In" button if you want the old jump-closer behavior too.
• Found and fixed along the way: that same click was occasionally getting silently swallowed by the map's own drag-to-pan handling, so the button looked like it did nothing even when it should have worked.

v0.18.111Fix: Event Map couldn't reach the map edges when zoomed in, plus a quick server switcher

• Real reported gap: zooming in near a coastal town (Elektro, Cherno, anywhere close to an edge) got visibly cut off and couldn't pan any closer; the pan limit was left over from before the map got sharper and didn't account for how much bigger the new zoomed-in view actually is. Every part of the map can now be reached at any zoom level.
• Guilds running more than one DayZ server can now jump straight between each server's map from a small switcher inside the map itself, instead of backing all the way out to the dashboard first.
• Also fixed: real map tiles were occasionally failing to load during normal zooming/panning (missing gray patches on the map); a traffic limit meant for regular page loads was too strict for how many map tiles a zoom or pan legitimately needs at once.

v0.18.110Add: Event Map now renders real map tiles instead of one blurry image, and blips are finally clickable

• Real reported gap: the map background was a single small flattened image, so it turned to mush as soon as you zoomed in past a couple of clicks; nowhere close to the Google/Apple Maps clarity this feature was always meant to have. It's now a real zoomable tile set built straight from the actual game terrain, sharp all the way down to street level, on Chernarus and Livonia (Sakhal keeps today's placeholder until its own tiles exist).
• Clicking a marker previously did nothing: only hovering showed its info card, which also meant markers were completely unusable on phones and tablets (no mouse to hover with). Tap or click a marker now and its info card stays open until you tap it again, tap elsewhere, or hit Escape.
• Marker outlines got a stronger drop shadow so they stay readable sitting on top of real, busier satellite terrain instead of the old flat placeholder.

v0.18.109Add: Event Map now shows vehicle spawns, item spawns, and teleports too, with real clustering for busy areas

• Real reported gap: vehicle respawns on most servers happen through routine economy restocking, not the "dynamic event" system the map was watching, so they never showed up even though they were definitely happening. The map now recognizes real vehicle spawns directly (Vehicle Spawn), plus general item spawns (Loot Spawn) and teleporter usage (Teleport), 17 event types total now, up from 14.
• Busy areas no longer show a wall of overlapping, indistinguishable dots; nearby events now group into a single marker with a count badge, same as Google Maps ; click it to zoom in and it splits apart into the individual events.
• Item spawns are tracked separately with a shorter retention window than everything else, since they happen far more often than kills or vehicle spawns: this keeps them from crowding out the events that matter more.

v0.18.108Fix: Event Map now tells you when a time-window switch has no more history to show instead of silently looking broken

• Right after the Event Map's history-persistence feature went live, every time window (2H through 24H) looked identical for a while since there simply wasn't more than an hour of real recorded history yet; clicking between them looked like nothing was happening. The map now shows exactly how much history is actually on file (e.g. "Only ~1H of history recorded so far") so it's clear the feature is working and just needs more real time to build up a longer history, not stuck or broken.

v0.18.107Add: Event Map goes fullscreen with a real icon for every event type; kills, vehicles, dynamic events all look distinct now

• The Event Map now takes over the whole browser window the moment you open it, instead of sitting in a small section on the page: closer to opening a real map app.
• Every event type now gets its own real icon instead of just a shape: kills get a hit-marker, deaths a skull, a heli crash looks like a helicopter, a military convoy and a police car are now clearly different vehicles, police situations get a badge, and so on; 15 distinct icons in total, shown in the updated legend.
• The zoom range now automatically adjusts to how much real detail is actually in your server's map image, instead of a fixed limit: so it'll get better on its own once a higher-resolution map image is in place, with no further changes needed.

v0.18.106Add: Event Map history now survives restarts, plus /stop, /start, whitelist on/off, and base/container damage buttons

• The Event Map's 6H/14H/24H time windows now actually hold that much history; event data is mirrored to disk, so a bot restart or deploy no longer wipes out everything the map had recorded.
• New /stop and /start Discord commands (the dashboard already had buttons for these ; now Discord has matching commands too).
• New /whitelist enable and /whitelist disable; turn Nitrado whitelist enforcement on/off directly, both from Discord and a new dashboard page, instead of needing to flip it in Nitrado's own panel manually.
• The Base Damage dashboard page now has direct Enable/Disable buttons for both base damage and container damage schedules, not just schedule editing.
• New /wipe command and a matching dashboard control for permanently resetting a server's map (admin-only, requires typing the server's exact name to confirm); built and safety-gated, but I couldn't confirm the exact file path this hosting setup uses for persistence data, so it currently refuses safely rather than risk deleting the wrong thing. Let me know if you know where that data lives and I'll finish wiring it up.

v0.18.105Fix: the bot now auto-detects your actual map from Nitrado instead of trusting a manually-set value that could silently be wrong

• Real reported bug: a 2-server guild had one server saved as Livonia in its config while it was actually running Chernarus+, so every map-dependent feature (Event Map, heatmap, /distance) showed the wrong map with nothing to catch it.
• /map, /status, and the dashboard's Server Config status check now compare your saved map setting against what the DayZ server itself is actually reporting, and auto-correct it (with a visible notice) when they disagree.
• This also now runs silently in the background every ~5 minutes for every configured server, not just ones with an online-count channel set up, so a wrong map gets caught and fixed even if nobody happens to check.

v0.18.104Fix: Event Map blips were too small/faint to read, and zoom went far past what the map images can support

• Blips are now bigger, bolder, and outlined so they're actually visible at a glance instead of reading as a faint colored fleck over a busy map; kills/deaths/hits are circles, construction is a square, dynamic events are a triangle, all with a strong dark outline.
• The hover info card is now a plain, clean card instead of a busy angular readout, and the floating control panel dropped its scanline/pulsing decorations for a calmer look.
• Max zoom lowered from 8x to 3x: the source map images are naturally low-resolution, so zooming further than that just produced an unreadable blur, not real detail.

v0.18.103Add: zoomable/pannable full-screen Event Map, selectable time range, and a full blip/tooltip visual redesign

• The Event Map dashboard page is now a real interactive map instead of a small static image: scroll to zoom (in on your cursor), click-and-drag to pan, and a fullscreen button for the whole-screen view. The map itself now spans the full width of the page instead of a narrow column.
• New selectable time range on the map, 2H / 4H / 6H / 14H / 24H, so you can see just the last couple hours of activity or zoom out to a full day, without losing your current pan/zoom position when you switch.
• Blips and the hover tooltip got a full visual redesign: each event category now has its own distinct shape (not just color) so kills, deaths, hits, construction, and dynamic events are recognizable at a glance, recent events glow brighter and fade as they age, and the info card that pops up on hover is a lot more readable.

v0.18.102Add: live Event Map on the dashboard; kills, deaths, construction, and dynamic events plotted where they happened

• New "Event Map" dashboard page (per server, gated behind its own Moderator Permission toggle like every other admin page) shows kills, deaths, PvP hits, construction, and dynamic events (heli crashes, convoys, and the rest) as color-coded dots over the server's real map. Hover a dot for who/what/where. New events appear automatically every ~20 seconds while the page is open, and each category can be filtered on/off with a checkbox. Nothing new is written to disk for this; it's the bot's own short-term memory (roughly the last 500 map-worthy events per server), so a restart clears it, same as the existing /activitylog recent command.

v0.18.101Add: player Cash balances shown as a table on the Store dashboard page

• The Store & Economy dashboard page now lists every player with a tracked Cash balance in one table (gamertag + current balance), with an Add Cash and a Remove Cash field right on each row: no more typing a gamertag from memory into a separate form and hoping it's spelled right. Giving Cash to someone not in the list yet (their very first touch of the economy) still works via a small form below the table. Setting an exact balance, giving to everyone at once, and wiping the whole ledger are unchanged, just regrouped under their own "Other Cash Tools" section.

v0.18.100Fix: 2 real production error sources found by directly auditing live logs, not code review

• Root-caused the single largest source of error-level log noise (~90% of all errors in the last 13 days): fetching a DayZ server's RPT/ADM log tail requests a one-time download link from Nitrado once, then reused that same link across every retry attempt if the download itself failed, but that link is very likely short-lived/single-use, so every retry was doomed against an already-stale link instead of actually getting a fresh shot. Now requests a brand-new download link on every attempt.
• Fixed a bug that logged a real error on every single bot restart: shutting down closed the SQLite economy mirror's connection but never marked it as unavailable, so any economy save still in flight at that exact moment tried to write to the now-closed database and failed loudly. No data was ever actually at risk (SQLite is a secondary mirror ; the real save always goes to the primary store first), but the noise is gone now.

v0.18.99Fix: a critical currency-duplication exploit + 10 more issues (Wave 4 bulletproofing audit)

• CRITICAL: the Bounty Config dashboard page had no floor on its cost fields, unlike the equivalent Discord command; an admin (deliberately or by mistake) saving a negative "cost per extra day" let any player place a bounty with a large negative total cost, which then ADDED currency to their balance instead of charging them, repeatably. Now rejects the same way Discord's command structurally always has.
• A keyword auto-response containing @everyone, @here, or a role mention actually pinged when triggered; turning the narrow "Keywords" permission (meant only for simple auto-replies) into a mass-ping tool any ordinary member could fire just by typing the trigger word. Responses can still @-mention the person who triggered them, just nothing broader.
• 5 different features, permanent bans, temp-bans, kicks, zone auto-bans, base-ping auto-bans, all write to the SAME shared Nitrado ban list with no coordination between them. Two of them landing close together (a 2nd admin, or an automatic sweep) could silently drop one write while both reported success ; the same gap existed separately for the Nitrado whitelist. All 6 write paths now coordinate through a shared lock.
• A background cleanup sweep (removing expired store purchases and temporary teleporters after a restart) wrote to the same two shared files /rotation, /dz-store, and base-damage scheduling already carefully lock against, but wasn't part of that lock itself, so it could silently corrupt either file if its timing lined up with one of them.
• /ask's 30-minute cooldown could be bypassed by firing several questions in quick succession (each one billed to the bot's Claude API) before the first had finished answering.
• A report submitted through the dashboard's Banlist page never notified the developer review channel the way the same report submitted via Discord does, so it could sit un-reviewed indefinitely with nothing surfacing it.
• Two members joining via different invite links close together could have their invite mis-attributed; crediting one inviter twice and the other not at all.
• The dashboard's keyword channel-scoping form, restart/stop server buttons, and automod timeout/threshold fields each had a validation or confirmation gap the equivalent Discord command already closed (an unvalidated channel id, no server-side restart confirmation, no upper bound on timeout minutes/warning threshold).

v0.18.98Fix: a critical role-grant privilege escalation + 4 more issues (Wave 3 bulletproofing audit)

• CRITICAL: a mod granted only the narrow "Custom Achievements" permission (not Administrator) could attach ANY Discord role as an achievement's reward; including the server's own BenchBot Admin role, or a real Administrator-flagged role; auto-granted completely unattended the moment a trivially-satisfiable condition (e.g. "net worth ≥ 0") evaluated true. This bypassed the deliberate Administrator-only gate /achievements role-set already enforced for the identical capability, on both Discord and the dashboard. Role rewards are now Administrator-only there too ; a mod can still create/edit achievements freely, they just can't attach or change a role reward themselves.
• Two different staff members (or Discord and the dashboard) closing the same ticket at nearly the same moment could both succeed, double-posting the "Ticket Closed" log embed with conflicting "Closed By"/reason info; most reliably via /ticket closeall's up-to-30-second confirmation window racing an individual close. Closing a ticket is now safe to attempt twice ; only the first one actually takes effect.
• A rare Discord autocomplete edge case (no option flagged as "focused" on the interaction) could throw before the bot's own per-module error isolation even started, silently killing autocomplete suggestions for that one command with none of the usual diagnostic logging. Now caught cleanly.
• /dev guild-deactivate is meant to make the bot go fully quiet in a server, but a handful of already-open multi-step flows (a /casino blackjack hand in progress, /createevent, /embed create, /expedition, /loadout, and the channel-visibility picker) kept working until their own timeout; for blackjack, that meant real wallet currency could still change hands after deactivation. All 6 now stop immediately.
• The Player Hub panel (the button-only, no-commands-needed player dashboard) silently showed one server's Balance/Stats/Store/Leaderboard data for every player in a guild with 2+ DayZ servers configured, with no indication a different server even existed: unlike every equivalent slash command, which already asks which server you mean. The panel now prompts for which server too, when there's more than one.

v0.18.97Fix: a real achievement data-corruption bug + 8 more correctness/race issues (Wave 2 bulletproofing audit)

• CRITICAL: custom achievements created a 2nd, 3rd, etc. one all got the exact same id ("custom_NaN") due to a subtle id-generation bug, on both Discord and the dashboard; editing or deleting one could silently hit or wipe out a completely different achievement, and role rewards could leak between them. Fixed at the root, AND every guild's already-existing data is automatically repaired the next time it loads.
• The dashboard's Custom Achievements form had no length limit (only a client-side hint), unlike Discord's ; an oversized one saved there would crash /achievements for every player in the guild the next time they ran it. Now rejected server-side, matching Discord's own limits.
• /baseping auto-action threw an error ("Something went wrong") the first time it was run against a base ping created since the bot's last restart, on both Discord and the dashboard. Fixed, plus the dashboard's Add Base Ping form now enforces the same radius/cooldown minimums Discord already did (a radius of 0 silently created an alert zone that could never trigger).
• The dashboard could add the same gamertag to two different factions at once (create, add-member, and approve-request all only checked the one faction being edited); Discord's /faction create|join already prevented this ; the dashboard now does too.
• A banlist review decision made on one surface (Discord or the dashboard) never disabled the other's still-live Approve/Deny buttons, so a stale click days later could silently reverse an already-made decision with no record it happened. Also fixed a rare race where two servers reporting the same gamertag at once could post two separate, orphaned review messages instead of one.
• A giveaway reroll (Discord or the dashboard) landing at the exact moment the automatic sweep was finishing that same giveaway could race it and announce a second, different set of winners. The dashboard's reroll also now enforces the same 1-20 winner-count range Discord already did.
• A base ping with auto-action enabled could double-ban a player (and then un-ban them early) if they triggered two qualifying events in the same ~30-second cycle; e.g. a kill right as they entered the zone.
• Performance: /achievements wipe stripped achievement-granted roles from members one at a time; for a role held by hundreds of members, that could take minutes. Now parallelized. Also fixed the wealth leaderboard re-sorting itself once per configured server instead of once per guild on every poll cycle.

v0.18.96Fix: 2 real economy race conditions, an automod security gap, and 5 performance issues (Wave 1 bulletproofing audit)

• CRITICAL: /dz-store buy could be double-spent; two purchases fired close together (double-tap, a retried command) could both pass the balance check before either had deducted, driving a balance negative and granting two purchases for the price of one. Cash is now deducted atomically at the moment of purchase, and refunded automatically if the purchase itself fails.
• CRITICAL: two purchases on the same DayZ server racing could silently overwrite each other's spawned items in the store's spawner file, even though both had already been charged. The spawner file write is now locked per-server so this can't happen ; a rejected purchase due to the lock is refunded automatically.
• SECURITY: auto-mod could time out or ban a real server Administrator, the configured BenchBot Admin role, or the bot's own developer just for tripping a word/spam/link/invite/mentions rule; something /warn, /tempban, and /dz-kick have always refused to do. Auto-mod now checks the same protection before taking any action.
• The dashboard's Player Punishments page let a mod granted only "Player Punishments" (with Temp-Ban and Kick explicitly left off) still issue real temp-bans and kicks: those two actions now require their own permissions, matching what Discord's own /tempban and /dz-kick already enforce.
• Warning escalation's ban action could ban a still-present, protected admin if Discord's member-fetch happened to fail at the wrong moment (a transient hiccup was being treated the same as "they left the server"). Escalation now aborts safely instead of guessing.
• A temp-ban whose initial in-game ban failed to apply (a transient Nitrado hiccup) used to just stay un-applied for its entire duration, sometimes a full week, with no automatic recovery; it now retries automatically every sweep, matching /dz-kick's existing behavior.
• Performance: 3 more background sweeps (giveaways, reminders, scheduled embeds) and 2 bulk multi-server commands (/tempban ...all-servers, /dz-kick ...all-servers) were still processing guilds/servers one at a time instead of concurrently, so one slow or rate-limited one could delay everyone else behind it. All converted to the same bounded-concurrency approach already used elsewhere in the bot. Also fixed a multi-server guild's poll cycle redundantly re-running its full economy-achievement check once per configured server instead of once per guild.
• Root-caused and fixed real test-suite flakiness (different, unrelated tests failing on different runs): the test suite was reading and writing the SAME real data folder the live bot uses, so a "fresh" test guild id could occasionally collide with leftover state from an earlier run. Tests now run against a fully isolated, disposable data folder every time.

v0.18.95Fix: critical cross-guild data leak + 4 more dashboard-vs-Discord gaps, found by an adversarial audit

• CRITICAL: fixed a real cross-guild data corruption bug in ticket categories. Any guild that had never run /ticket category-add shared the same 5 built-in category objects in memory with EVERY other never-customized guild on the bot ; granting a role to a category via /ticket category-role-add or the dashboard's role picker mutated that shared object in place, silently leaking the role grant into every other never-customized guild's category list (visible in /ticket category-list and the dashboard). This is now impossible; every write path clones its own category list, and the shared defaults are frozen so any future mistake of this kind throws immediately instead of corrupting data.
• Fixed the dashboard's ticket Add/Remove Member forms: Remove used to report success even when the ticket's channel had been deleted outside the dashboard (nothing actually happened) ; Add used to blame "couldn't find that member" even when the real problem was the missing channel. Both now fail with the accurate reason.
• The dashboard's Ticket Categories "Add" form and Ticket Setup's panel/quicksetup channel pickers now re-validate the submitted channel server-side (matching the equivalent Discord commands) instead of trusting a possibly-stale or wrong-type channel id, which could otherwise silently persist a setting that would never actually work.

v0.18.94Add: DayZ server-side logging requirement made obvious, and a faster Ticket Transfer

• Root-caused a real report of dynamic-event/vehicle-spawn/heli/convoy/police feeds never posting: those event types are only ever detected by parsing specific DayZ RPT log lines that the DayZ server itself only writes when cfgeconomycore.xml's <defaults> block has log_ce_dynamicevent and log_ce_vehicle set to "true"; most servers ship with these off. This wasn't a BenchBot bug, but it was easy to miss, so it's now called out everywhere it matters: a new /quickstart step (4 of 9), a note on /channel create|set for the affected event types, and a warning on the Channel Management dashboard page.
• Ticket Transfer (dashboard) now quick-picks from BenchBot Admin role members instead of requiring a raw Discord user ID every time: the manual ID field is still there as a fallback for anyone not yet cached. Add/Remove Member also now shows how to copy a Discord user ID, matching the hint already used elsewhere on the dashboard.

v0.18.93Fix: live crash in /ticket category-role-add on categories added via Discord

• Fixed a live bug shipped in 0.18.92: a ticket category added via /ticket category-add was missing its roleIds field entirely (the dashboard's equivalent route was already fixed, the Discord command wasn't), so running /ticket category-role-add on it crashed with "Something went wrong handling that command." /ticket category-add now sets roleIds correctly, and category-role-add/category-role-remove are also hardened to tolerate a category with no roleIds at all, so this class of crash can't recur even from an untouched code path.

v0.18.92Add: per-category ticket roles, and a new /quickstart step-by-step setup guide

• Tickets: admins can now control exactly which staff role(s) automatically see each type of ticket; e.g. only your Ban Appeals team sees Ban Appeal tickets, not every category. New /ticket category-role-add|category-role-remove commands, and a matching Ticket Categories dashboard page section (pick roles per category). The BenchBot Admin role still always sees every ticket regardless.
• New /quickstart command: a complete, plain-language, step-by-step walkthrough for setting the bot up from scratch, in the right order, for admins who've never used it before. Separate from /help (a by-category reference); this is a guided, numbered path from "just invited the bot" to "fully working."

v0.18.91Fix: 4 more issues found by a deep-dive audit of last night's permissions/autocomplete incident

• Applied the same fix from the last update to 2 more places that had the identical gap: a broken command could also have silently blocked modal-submission (form popups) or button/menu clicks for every other command, and separately, for full slash commands themselves. All three are now isolated the same way.
• The dashboard's ban rejection message ("no Player/Ban Role configured") used to send admins to a dashboard page with nothing about roles ; it now names the actual /setup player-role and /setup ban-role commands, since those roles can only be set there.
• Achievement role rewards and reaction-roles now warn immediately when you pick a role, if BenchBot's own role isn't positioned above it in Server Settings; previously this failed completely silently, matching the warning /setup player-role and /setup ban-role already gave.
• /setup view now shows which Moderator Permissions are actually granted, so you can confirm a dashboard toggle saved without going back to check the dashboard itself.

v0.18.90Fix: a broken feature could silently block autocomplete for every command after it, and a wrong dashboard link

• Fixed a real live bug: channel/server search-as-you-type (autocomplete) could fail with Discord's "Loading options failed" for commands like /ticket panel, even though the bot's own data was fine; a bug in any ONE unrelated command's autocomplete handler was able to silently break autocomplete for every command that happens to be checked after it internally. Each command's autocomplete now runs in isolation, so one broken (or slow) one can never take down another's.
• Fixed the Moderator Permissions dashboard page linking to the wrong page ("Server Config") when telling an admin where to set the BenchBot Moderator role; that role is actually set on the General Settings page, which is where both links now point.

v0.18.89Fix: 2 correctness gaps found by an independent review of the last 2 releases

• /dz-ban add now rejects an empty or newline-containing gamertag before it ever reaches Nitrado: the ban list is stored as a plain newline-joined string, so a pasted gamertag with a stray line break would have silently split into extra, wrong entries.
• A hand-edited or corrupted save file with a malformed gamertagLinks entry could previously crash a live poll cycle (zone/base-ping auto-ban checks) instead of just skipping that one bad entry ; now tolerated gracefully everywhere it's read.

v0.18.88Add: /dz-ban, permanent Nitrado ban list management

• New /dz-ban add|remove|list ; type in a gamertag and the bot adds it straight to that server's Nitrado ban list, permanently (no auto-expiry, no Discord role swap, and no linked Discord account required: the gamertag alone is enough). Distinct from /tempban (Discord role-swap, auto-reversing after a set duration) and /dz-kick (soft 5-minute removal) ; use those when you want the ban tied to a Discord member instead. Admin-gated by default like every other moderation command ; an admin can delegate it to the BenchBot Moderator role from the Moderator Permissions page.

v0.18.87Add: multi-gamertag linking, toggled per-guild

• /link set now supports linking more than one gamertag to a single Discord account: off by default (today's exact one-gamertag-per-account behavior). An admin turns it on with /link admin mode (or the Account Links dashboard page's new mode switch). Once on: /link set adds instead of overwrites (up to 5), /link remove and /link admin remove take an optional gamertag to pick which one, /link status shows all of them, and a new /link primary switches which one commands that auto-resolve "your gamertag" (like /dz-store) use. Also fixed a real pre-existing bug: /link admin set could link a gamertag that was already linked to someone else, a check /link set itself always enforced.

v0.18.86Fix: several more real-time features weren't reading a real 2nd+ server's own data

• Following the /link fix above, did a full audit for the same bug class and fixed everything found: the automated behavior-detection sweep (dupe/boost/camping/etc.) was checking the wrong server's alert thresholds every poll cycle on a guild with a real 2nd+ server ; /detect (view/toggle/configure the 7 behavior detectors) had no per-server awareness at all, so it always showed and edited the first server's settings ; the dashboard's Server Config page showed the wrong server's channel routing table ; and an unlocked achievement's announcement could post to the wrong server's default channel when no dedicated achievement channel was set. All four now correctly scope to whichever server they're actually about.

v0.18.85Fix: /link falsely said a real player had never been seen playing

• Fixed a real bug affecting any guild running a real 2nd+ DayZ server: /link set (and /link admin set)'s "has this gamertag ever been seen playing" check only ever looked at the server that existed before multi-server support; a player who'd genuinely played, sometimes the night before, on a real added 2nd+ server got told they'd never been seen and couldn't link their account without an admin forcing it. It now checks every one of a guild's configured servers.

v0.18.84New: developer control panel on the dashboard

• Developer-only, not visible to regular server admins: a new /dev dashboard page (bot-wide guild list with server counts, deactivate/reactivate, and command-usage analytics) for tracking and managing every server BenchBot runs on, all in one place instead of jumping between individual Discord servers.

v0.18.83Fix: channel pickers across every command now searchable, no more "not a valid channel"

• Fixed a real, widely-hit bug: every DayZ server BenchBot manages has racked up 50-150+ channels (largely from /setup auto-channels itself), and Discord's own native channel-picker popup becomes unreliable at that scale; failing to list or search channels, and sometimes rejecting a valid pick as "not a valid channel." Every command that asks you to pick a channel (or category) now uses the bot's own searchable autocomplete instead, the exact same mechanism the server: option already uses, so typing a few letters reliably finds it, no matter how many channels your server has.
• This touches every channel-picking field across the bot: /setup channel/bot-trap, /channel set/modlog-exclude/modlog-include, /lootfeed channel, /banlist, /baseping, /embed-builder, /dev error-channel/security-channel, /giveaway, /keyword, /online-count, /player-hub, /purgechannels, /reactionrole, /server-monitor channel, and /ticket panel/quicksetup/category-add.

v0.18.82Multi-server Stage 6: /logs, /restart, /status, /altcheck, /whitelist, /map, /distance, /server-monitor now per-server

• Finishing the multi-server rollout's remaining Discord commands: /logs, /restart, /status, /resetlogs, /altcheck, /whitelist, /map, /distance, and /server-monitor all still read the old shared, guild-wide config; every one of them gained the same optional server: option every other migrated command already has, and now correctly targets whichever DayZ server you mean.
• Fixed a real gap found doing this: the bot's restart-history tracker (what /logs restarts reads) was still recording every server's detected restarts into one shared list, so a real 2nd+ server's restarts were invisible to it. Also fixed /server-monitor's background uptime checker, which only ever checked one server per guild instead of every one of them.
• Fixed a subtler bug in the automatic Weekly Recap post: it was computing "Most Contested Zone" against the wrong server's map and mixing kill locations across servers, for any guild running more than one.

v0.18.81Fix: /setup player-role, ban-role, channel, location-format, heatmap-auto, players-heatmap now per-server

• Fixed a severe bug: these six /setup subcommands were still writing to the old shared, guild-wide config even after /setup nitrado and /setup map were made per-server. Since /tempban reads the player/ban roles from each server's own config directly (no fallback for a real added server), any guild running a real 2nd+ DayZ server had no way at all, Discord or dashboard, to set those roles for it, so /tempban start would permanently fail there with "no roles configured." All six gained the same optional server: option every other migrated command already has.

v0.18.80Multi-server Stage 5 cleanup: 3 more gaps closed, hub server switcher, General Settings split out

• Fixed 3 more real gaps found doing a final pass over Stage 5: /event create (the Discord command, not just its dashboard page), /channel, and /setup auto-channels|view had never been touched by any earlier stage, so on a guild with a real 2nd server they'd have silently kept reading/writing the wrong server's event spawns, channel routing, or full-setup channels. All three (plus the Channel Management dashboard page) are now fully per-server, with the same server: option every other migrated command already has.
• The guild hub now shows a server switcher (a row of pills) once a guild has 2+ DayZ servers configured, so every per-server page's card follows whichever server you've selected instead of always falling back to the old picker.
• Server Config split into two pages: Server Config (Nitrado, map, FTP, live status; per server) and a new General Settings page (bot-admin role, mod role, auto-role, farewell DM; guild-wide, shared across all of a guild's servers).

v0.18.79Multi-server Stage 5: 14 more dashboard pages move to real per-server URLs

• Continuing the multi-server rollout (Stages 1-4, v0.18.71-0.18.78): the admin dashboard's Rotation, Base Damage, Behavior Detection, Alt Check, Bounty Config, Classnames, Store & Economy, Factions, Base Pings, Zones, Teleporters, Event Creation, Loot Feed, and Player Punishments pages now live under a real per-server URL instead of quietly falling back to the guild's first server. Every old link still works; it now transparently redirects (or offers a quick picker on a guild running 2+ servers) instead of just rendering.
• Fixed a real gap found while doing this: /teleport (the Discord command itself, not just its dashboard page) had never been touched by any earlier stage, so on a guild with a real 2nd server it would have silently kept reading/writing the wrong server's teleporters and FTP credentials. It's now fully per-server, with the same server: option every other command already has.
• Also fixed: the Store & Economy dashboard page was still almost entirely reading the guild's shared, pre-migration data (cash balances, zones, items, kits) even after Stage 3 supposedly moved that data per-server ; a 2nd real server's admin would have been editing the wrong server's store without any indication. Corrected as part of this move.

v0.18.78Multi-server Stage 4: temp-bans and kicks now track per server, plus a new all-servers bulk-ban option

• Continuing the multi-server rollout (Stage 1 v0.18.71, Stage 2 v0.18.74, Stage 3 v0.18.77): /tempban and /dz-kick records now track independently per DayZ server instead of being shared across a guild's servers, and both gained an optional server: option; omit it and nothing changes for the 95% of guilds running one server. Warnings stay shared across all of a guild's servers, since a Discord warning isn't tied to any one game server.
• New: all-servers:true on /tempban start and /dz-kick start applies the ban across every DayZ server configured for the guild at once (each with its own role swap/Nitrado credentials), instead of running the command once per server by hand ; /tempban release also gained all-servers:true to lift a bulk ban everywhere in one go. Reports back per-server so a failure on one server never blocks the others.
• Fixed a real gap found while doing this: /player online's banned-player note only checked the aliased single-server ban lists, so it would've silently gone blank for a 2nd+ server ; the dashboard's Player Punishments page had the same gap for temp-bans, kicks, and fines.

v0.18.77Multi-server Stage 3: cash economy, store, zones, base pings, factions, and bounties now track per server

• Continuing the multi-server rollout (Stage 1 v0.18.71, Stage 2 v0.18.74): Cash balances, the store (items/kits/spawn locations), custom classnames, admin-drawn zones, base pings, factions, and bounties now all track independently per DayZ server instead of being shared across a guild's servers. /dz-store, /classname, /zone, /baseping, /faction, and /bounty all gained an optional server: option, following the same pattern already used everywhere else; omit it and nothing changes for the 95% of guilds running one server.
• Factions get their own separate roster per server (so two servers can each have their own "Reapers" faction with no conflict) ; bounty costs/payouts stay on the shared server-wide Dollars economy, only the bounty listings themselves are per-server.
• Fixed several real bugs uncovered while doing this: /zone's autoban (and /baseping's) were reading Nitrado credentials from the wrong place for a 2nd server, meaning a ban could silently fire against the wrong server's account ; /faction leaderboard was reading stale, pre-Stage-2 combat stats ; both zone and base-ping auto-ban sweeps only checked one server per guild instead of every one of them.

v0.18.76New: /remind personal reminders and /invites tracking

• /remind create in:<30m/2h/1d/1w> text:<>; set a personal reminder ; BenchBot pings you back in the same channel when it's due. /remind list and /remind cancel manage your own pending ones (up to 25 at a time).
• /invites leaderboard and /invites lookup; tracks which invite link a new member used to join and credits whoever invited them, so you can see who's actually bringing people in. Backfills automatically ; no setup needed.

v0.18.75Auto-Mod escalation + custom warning text now on the dashboard too

• The Auto-Mod dashboard page now has everything /automod config warn_text and /automod escalation added on the Discord side last update: a Warning Text column per check, and a new Escalation section (auto-timeout/ban once a member crosses a warning threshold). Previously these were Discord-command-only.
• Also fixed the dashboard's action label to say "Delete + Warn" instead of just "Delete", matching what it's actually called on the Discord side.

v0.18.74Multi-server Stage 2: rotation, base damage, heatmap, leaderboard, player stats, achievements, online-count now track per server

• Continuing the multi-server rollout (Stage 1 shipped v0.18.71): rotation pools, base-damage schedules, event cleanup, heatmap sampling, the leaderboard, the weekly digest, player stats, loot-feed samples, position tracking, online-count, and DayZ achievement progress now all track independently per DayZ server instead of being shared across a guild's servers. Every affected command (/rotation, /basedamage, /heatmap, /leaderboard, /player, /activitylog, /lootfeed, /online-count, /achievements dayz) gained an optional server: option, following the same pattern /setup nitrado already used; omit it and nothing changes for the 95% of guilds running one server.
• Fixed several real bugs uncovered while doing this: /player online|locations|track and the Live Players heatmap were reading the wrong (shared) runtime state for anyone who'd already added a real 2nd server, so that server's online players were invisible ; /online-count, /rotation, and /basedamage were reading Nitrado/FTP credentials from the wrong place for a 2nd server ; and /online-count's background refresh only ever checked one server per guild instead of every one of them.
• /achievements wipe now correctly clears every server's combat/survival progress, not just the first one, since that progress is no longer shared.

v0.18.73Fix: dashboard Zones page 404 ; warning text box too small to type in

• Fixed a real bug: the dashboard hub's "Zones" card linked to a URL that didn't exist (a leftover mismatch from when the page was built), so clicking it just showed a bare "Cannot GET" error instead of the Zones page. Added a regression test that checks every hub card links somewhere real, so this class of bug can't silently ship again.
• The Punishments page's "Warning text" box is now a proper multi-line text area (was a single-line field, so longer warnings got cut off with no way to see what you'd typed or start a new line).

v0.18.72New: automod Delete + Warn now logs a real warning, escalation, and /warn + /warnings

• Auto-mod's "Delete + Warn" (and plain "Warn only") action now logs a real, trackable warning to the same history the dashboard's Punishments page uses; previously it only posted a one-time public chat notice with no lasting record. Delete + Timeout and Delete + Ban are unaffected (already a standalone consequence).
• New /automod config warn_text: option; write your own custom wording per check (spam, mass mentions, invites, links, censored words) instead of the built-in reason text ; say "default" to reset it.
• New /automod escalation; admins can configure an automatic timeout or ban once a member reaches a set number of total warnings (from auto-mod AND manual warnings combined). Fires once, right when the threshold is crossed.
• New /warn and /warnings commands; mods can issue a warning directly in Discord and look up a member's warning history, without opening the dashboard. Both share the exact same warning ledger and escalation as auto-mod and the dashboard, so every warning source counts toward the same total.

v0.18.71New: multi-server support; up to 5 DayZ servers per Discord guild (Stage 1)

• Laid the foundation for running multiple DayZ servers on one Discord guild (up to 5). Every server gets a Server Name to tell them apart.
• /setup server-add, /setup server-list, and /setup server-remove manage a guild's servers. /setup nitrado and /setup map now accept an optional server: option; with only one server configured (the normal case today) nothing changes, you're never prompted.
• The dashboard's Server Config page now lives at a per-server URL ; the old link keeps working automatically for every guild that only has one server.
• This is the first of several stages; feeds, economy, zones, and moderation still operate on a guild's first/only server for now and will move to true per-server tracking in upcoming updates.

v0.18.70Fix: delayed online-count voice channel ; sped up every Nitrado-polling feed

• Fixed a real bug in the online-count voice channel (the one showing "🟢 Online: N" at the top of a server): it swept every server in one sequential line under a single shared lock, so if one server's channel got stuck behind Discord's own strict rename rate limit, EVERY other server's count froze too, silently, with no error logged. Each server now updates independently, with a hard 20s cap so a stuck rename can never hang the others.
• Found and fixed the exact same bug shape in 4 more places that periodically talk to Nitrado on a timer: /tempban, /baseping auto-action, /zone autoban, and /dz-kick's ban-reversal sweeps all had the identical one-slow-server-blocks-everyone flaw (basePing's and zone's sweeps could additionally abort entirely if one server errored, silently skipping the rest ; also fixed).
• The main 30-second log poller now fetches a server's ADM and RPT logs at the same time instead of one after the other: roughly halves that part of every poll cycle.
• /altcheck (alt-account detection) now pulls its FTP and Nitrado data sources concurrently instead of sequentially, and downloads its (up to 40) log files in parallel batches instead of one at a time: a long-running server's /altcheck could previously take 40 sequential round-trips just to gather files.

v0.18.69New: /achievements wipe

• /achievements wipe (Admin) permanently resets every player's achievement progress on the server, both Discord-linked (economy) and DayZ-gamertag (combat/survival) records, in one go, with a confirm/cancel button first (same safety pattern as /dz-store admin cash-wipe).
• Also strips any Discord role an achievement auto-grants from whoever currently holds it, so roles stay consistent with the now-cleared progress instead of leaving stale badges behind.

v0.18.68Fix: stale online-player list ; clarify why a banned player still shows online

• Fixed a real production bug: a busy guild sending many individual kill/death/hit/build embeds one at a time could stall that guild's ENTIRE poll cycle for 60-90+ seconds, and since every guild shares one polling gate, that stall silently delayed the online-player list (and everything else) for every other server too, even ones with nothing going on. Individual embed sends are now dispatched with bounded concurrency instead of strictly one after another.
• /player online now flags a currently-online player who has an active /tempban, /dz-kick, /baseping auto-ban, or /zone auto-ban record with a note explaining why they're still listed: this server has no RCON/BattlEye access, so a ban only blocks a *future* reconnect; it can't force-disconnect a session that's already connected. That's real game-server behavior, not a stale list.

v0.18.67New: draw a zone on the map (final stage of the Zone system)

• The Zones dashboard page now has a "Draw a Zone" tool; click points directly on your server's map (Chernarus+, Livonia, or Sakhal) to outline an irregular shape instead of typing in a center + radius. Existing zones render as translucent outlines for reference while drawing.
• A drawn zone can serve any purpose (Cash reward, Autoban-Kill, Autoban-Build); enable any combination in one form, since this is the only place a non-circular zone can be created at all.
• This completes the 4-stage Zone system: Sakhal map support, the /zone command, the numeric-entry dashboard page, and now polygon drawing; admins can now fully configure autoban and Cash zones by command or by hand-drawing them on a real map.

v0.18.66New: dashboard Zones page (3rd stage of the Zone system)

• The new /zone Discord command now has a dashboard counterpart: a Zones page listing every zone (any purpose) with Remove, plus a numeric-entry form for creating/updating autoban zones (same fields as /zone create: name, X/Y, radius, trigger, tiered ban lengths, offense window).
• Cash-reward zone creation stays on the existing Store & Economy page (linked from the new Zones page): this keeps one place per purpose, matching how the Discord commands are already split between /dz-store and /zone.
• Reachable from the server hub once an admin grants the 'zone' Moderator Permission (dashboard: Moderator Permissions page).

v0.18.65New: /zone; admin-drawable autoban zones (2nd stage of the Zone system)

• /zone create <name> <x> <y> <radius_m> <trigger:kill|build> <tier1/tier2/tier3>; draw a circular zone that auto-bans on a Nitrado level (with an escalating, tiered duration + DM notice, same proven mechanism /baseping's own auto-action already uses) whenever a kill happens inside it (kill trigger) or a base/flag/stash gets placed inside it (build trigger). Run /zone create again against the same name to add the other trigger to the same zone.
• /zone list / /zone remove: a unified view across every zone regardless of purpose (autoban or Cash reward), complementing /dz-store's existing cash-only zone list.
• Under the hood, the old cash-only zone store (gd.cashZones) is now a single unified gd.zones list shared by every zone purpose; existing Cash zones migrated automatically, /dz-store zone-add|remove|list keep working exactly as before.
• Gated behind a new 'zone' Moderator Permission an admin can grant from the dashboard's Moderator Permissions page.

v0.18.64New: Sakhal map support (first stage of the upcoming Zone system)

• Sakhal is now a selectable map everywhere Chernarus+/Livonia already were: /setup map, the dashboard's Server Config map picker, rotation/base-damage/teleport/event mission-folder targeting, and heatmap rendering (real 15,360x15,360 size, matching Chernarus+).
• 13 real Sakhal town names are in for /mapdistance-style "nearest town" lookups (Petropavlovsk-Sakhalinsky, Severomorsk, Nogovo, Aniva, Burukan, Tumanovo, Orlovo, Rybnoye, Rudnogorsk, Matrosovo, Yasnomorsk, Sovetskoye, Zhupanovo): every Major Town and Town from Sakhal's real settlement list. Smaller villages aren't covered yet (not available from this project's data source for Sakhal) ; unmatched spots just show raw coordinates instead, same graceful fallback every map already has beyond its known towns.
• This is the first of several planned pieces building toward a new Zone system (admin-drawable zones for autoban, cash rewards, and more), more to come.

v0.18.63Embed Builder dashboard: color picker, live preview, unlimited-feeling fields

• The dashboard's Embed Builder page got a real overhaul: a color swatch/picker next to the hex field (still type an exact code if you want, or just click Default to clear it), a live preview panel that updates as you type showing roughly what the sent embed will look like (color bar, fields grouped inline the way Discord actually lays them out, image/thumbnail, footer/author), and fields are now Add/Remove buttons instead of a fixed wall of 10 blank rows, and the real cap is now 25, matching what /embed on Discord (and Discord itself) already allows, not an arbitrary lower dashboard-only limit.
• Also fixed the Description box rendering as a tiny unstyled default browser textarea instead of matching every other field on the page: a real, previously-unnoticed gap where this dashboard's shared styling never actually covered textareas at all.

v0.18.62New: Player Punishments; a combined ban/kick/fine/warning dashboard page

• New Player Punishments page on the dashboard: the live ban list, one small form each to issue a ban, kick, fine, or warning, and a combined Punishment History showing all four together, most recent first. Fines dock a player's Corna Store balance directly ; warnings are a plain logged note with no side effects. Gated behind its own Moderator Permission, same as every other dashboard page.
• Every action requires a real, resolvable Discord member and re-checks the same Administrator/bot-admin-role protection /tempban and /dz-kick already enforce: a real admin can't be banned, kicked, fined, or warned from this page, even by gamertag override.

v0.18.61Fix: /server-monitor set silently saved an invalid dot-typo'd host

• /server-monitor set already defended against pasting "1.2.3.4:2302" straight from Nitrado's panel (stripped the :port automatically), but a "1.2.3.4.2302" dot-typo, a real one found live on a production server, sailed straight through unvalidated, silently saving a broken host and leaving the uptime check failing forever with no error ever shown to whoever set it up.
• Now rejected up front with a clear message telling you to use : instead of . for the port.

v0.18.60New: /dz-kick, kick a player off the DayZ server

• New /dz-kick start user:<@member>; kicks a player off the DayZ server. There's no way to instantly disconnect one connected player on console (no RCON access), so this works as a 5-minute auto-reversing in-game ban through Nitrado instead, the closest real equivalent; it never touches Discord roles, unlike /tempban. The player gets DMed right away making it clear it's a kick, not a ban, and exactly when they can reconnect.
• Reuses the same auto-reversal safety net /tempban and /baseping's auto-ban already rely on: if the unban fails to go through on schedule, BenchBot keeps retrying automatically and posts a warning to the Moderation Log rather than leaving someone kicked with no one noticing.
• /dz-kick list shows everyone currently kicked, same shape as /tempban list.

v0.18.59New: Restart/Stop/Start Server buttons on the dashboard

• Server Config on the dashboard now has Restart Server, Stop Server, and Start Server buttons under Live Server Status, mirroring /restart: each asks for a confirmation click first since they immediately disconnect every player.
• Fixed Live Server Status showing a raw/blank map value instead of the server's actual configured map (same root cause as the earlier /status fix; Nitrado's own settings.general.map field isn't reliable, so this now reads the map BenchBot already has configured), and added a Last Restart / Status Changed timestamp.

v0.18.58New: /restart, restart the DayZ server on demand

• New /restart confirm:true restarts the DayZ server right now, straight from Discord; no more needing to go into Nitrado's panel directly. Immediate, no player warning, and not delegable via Moderator Permissions (real Administrator/bot-admin-role only) since it disconnects every player on the server the moment it runs.
• A restart triggered this way shows up in /logs restarts the same as any other restart, once it actually completes.

v0.18.57New: /logs; download RPT/ADM logs, and a 24h restart history

• New /logs download type:<rpt|adm> sends the server's current log file straight to Discord as a downloadable attachment; no more digging through Nitrado's file manager. If a log's too large for Discord to attach, it's truncated to the most recent portion (which is almost always what you actually want to check) rather than failing outright.
• New /logs restarts; there's no real "restart log" on Nitrado's side, so the bot now tracks its own: every time it detects a real server restart, it's logged with a timestamp, kept for 24 hours. /logs restarts shows them newest-first with how long the server stayed up between each one, plus a downloadable copy: the actual point being to see whether restarts are landing on schedule or clustering suspiciously close together.
• Both gated by a new Server Logs moderator permission, delegable like most other admin-config features.

v0.18.56New: ticket category folders, and a live players heatmap

• Ticket categories used to only be distinguishable by name/topic: every ticket still landed in the same shared "Tickets" folder in the sidebar regardless of type. /ticket category-add now takes an optional parent_category, so e.g. donation tickets and staff-support tickets can land in separate Discord folders. Existing categories with none set keep using the shared folder exactly as before ; also on the Ticket Categories dashboard page.
• New /setup players-heatmap enabled:<> [interval-minutes]; a live map of exactly who's online right now, edited in place in the Heatmap channel instead of reposting every time, refreshing on your own set interval (default 2 min, skips the render entirely if nothing's actually moved).

v0.18.55Fixed: base-ping auto-bans could get silently stuck claiming "banned" when they weren't

• Found during an audit, not a live report: if a base-ping auto-ban's Nitrado write failed (network hiccup, bad token), the bot's own record was marked 'active' forever with no retry; the offender was never actually banned in-game, but the bot's records and /baseping bans said otherwise. The 30s sweep now retries a failed ban every cycle until it actually lands (or Nitrado gets reconfigured), instead of giving up silently after the first attempt.
• Also fixed a deeper version of the same bug: a persistent Nitrado outage doesn't throw an exception (it retries internally, then returns nothing), so the old code could mistake "couldn't even check the ban list" for "already banned, nothing to do" and falsely report success; now matches /tempban's own, already-correct handling of that exact case.

v0.18.54New: fully customizable achievements ; admins can add and remove your own

• The achievement list was hardcoded before ; now every server can build its own. /achievements custom-add label:<> desc:<> source:<> operator:<>=|>|=> threshold:<> [role] creates one from a fixed, structured menu of trackable stats; kills, deaths, longest kill distance, playtime, longest life survived, bench max, range rank, net worth (per currency), or shop purchases; no code, just pick a stat and a number. The optional role option auto-grants a Discord role the moment it unlocks, same mechanism /achievements role-set already uses.
• custom-edit/custom-remove manage what you've added (autocomplete), custom-list shows every one with its condition. The exact same builder is also on the dashboard's new Custom Achievements page; build/edit on one surface, see it reflected on the other. Gated by a new Custom Achievements moderator permission, delegable to a trusted mod role like most other admin-config features.
• Custom achievements show up automatically in /achievements me and /achievements dayz right alongside the built-in ones, and post the same live unlock announcement.

v0.18.53New: /baseping auto-action, escalating, configurable auto-bans

• Base pings could only alert before ; now each zone can optionally auto-ban whoever triggers it, for real, through Nitrado. /baseping auto-action name:<> enabled:<> trigger_on:<presence|kill|both> turns it on per zone; presence (entering it) and/or kill (a kill happened while the killer was standing inside it, the Conquest-style 'get a kill in spawn, get banned' case).
• Every offense bans ; duration escalates with repeat offenses within a rolling window (tier1/tier2/tier3, e.g. 1h/6h/1d, window_days default 30), then auto-reverses on schedule same as /tempban. The banned player gets a DM explaining why, if their gamertag is linked to a Discord account.
• /baseping bans lists everyone currently auto-banned ; /baseping unban gamertag:<> ends one early. /baseping list now shows an auto-ban tag next to any zone that has it configured.

v0.18.52Fixed: /status always showing Map: ? ; added a Last Restart field

• Fixed a real reported bug, live-verified against production: /status read the map from a Nitrado field (settings.general.map) that doesn't actually exist on the API response, so it always showed "?" even on a fully configured, running server. It now reads the map from the bot's own /setup map configuration, the same source heatmap/loot map already trust.
• /status now also shows a Last Restart field (relative time, e.g. "3 hours ago") sourced from Nitrado's own status-change timestamp; labeled Status Changed instead if the server is currently stopped.

v0.18.51Ticket channels now show category in the name and topic

• Real reported gap: a ticket's category already showed in /ticket list, the dashboard, and the embed inside the channel, but never in the channel name or topic, the two places staff actually scan first. Ticket channels are now named ticket-<category>-<username>-<id> (e.g. ticket-player-report-johndoe-42) instead of just ticket-<username>-<id>, and the channel topic shows the category right away (still combines with priority once /ticket priority is set, same as before).

v0.18.50Fixed: /player online always saying nobody was online

• Fixed a real reported bug, same root cause the Online Count channel fix caught last update: Nitrado's DayZ query never actually returns player names (query.players is always empty, regardless of real occupancy), so /player online's old check always said "No players currently online" even with people actually connected. It now lists real gamertags from the bot's own live log tracking (runtime.playerState, the same source /player locations already uses successfully), not Nitrado's broken player list.

v0.18.49New /setup heatmap-auto, recurring automatic heatmap posts

• Heatmaps no longer need someone to run /heatmap every time. /setup heatmap-auto enabled:<> categories:<> interval-days:<> sample-days:<> (admin, or the Server Config dashboard page) posts a fresh heatmap to your Heatmap channel automatically on a recurring schedule ; pick which categories (kills, deaths, dynamic events, vehicle spawns, or all), how often, and how many days of samples each post shows. Runs alongside the existing on-demand /heatmap command, which still works exactly as before.

v0.18.48New /embed recurring scheduling (Phase 3 of 3 ; feature complete)

• /embed create's wizard gained a Schedule Recurring button, and the dashboard's Embed Builder page got the matching option ; set which days (or every day), which times (24h, one or more per day), and a timezone, and it posts automatically on that recurring schedule, indefinitely, via the same sweep as one-time scheduling. This completes the Embed Builder ; fully custom embeds (title, description, color, image, thumbnail, footer, author, up to 25 fields), built on Discord or the dashboard, sent now, once later, or on a repeat.

v0.18.47New /embed scheduling (Phase 2 of 3: one-time)

• /embed create's wizard gained a Schedule Once button ; give it a duration (30m, 2h, 1d, 1w) and it sends automatically once that time passes, no one needing to be online to trigger it. The dashboard's Embed Builder page got the matching option. /embed list now shows a scheduled embed's send time ; /embed send id:<> still works anytime regardless of any pending schedule. Recurring schedules ("every Monday at 6pm") land next update.

v0.18.46New /embed; build a fully custom embed (Phase 1 of 3: manual send)

• New /embed create name:<> channel:<#> ; a guided popup wizard for a fully custom embed (title, description, color, image, thumbnail, footer, author, up to 25 name/value fields), with a live preview updating after every step. /embed list|send|delete manage what's saved. The same builder is also on the dashboard's new Embed Builder page; build or edit one there instead if you'd rather use a form than Discord popups. Scheduling (send later, or repeating) is coming in the next two updates ; for now, every embed sends on demand only (Send Now or Save as Draft).

v0.18.45New /whoami; self-diagnose exactly what access BenchBot sees you as

• New /whoami shows exactly what BenchBot currently sees you as in the server you run it in: real Discord Administrator, BenchBot Admin role, BenchBot Moderator role (and which specific permissions it's been granted), and Bot Developer status. Deliberately open to everyone with no permission required to run it, so it still works to self-diagnose even if something else is wrongly denying you access. Confirmed live: DEV_USER_IDS was already correctly configured ; the bot developer's unconditional access already applies in every server the bot is in, by design, since it's a plain ID check with no per-guild state.
• Fixed a real gap found during this audit: the Bot Trap's admin-exemption check was missing the developer bypass every other admin-equivalent check in this bot carries; the bot's own developer, with no real Administrator permission or bot-admin role in a given server, could get instantly banned by their own bot-trap for posting in the wrong channel. Now exempt everywhere, unconditionally, same as every other admin-only check.

v0.18.44New /player-hub; a no-commands-needed button panel for players

• New /player-hub setup posts a persistent "Player Hub" panel with 5 buttons: Link Gamertag, Balance, Store, My Stats, Leaderboard. Built for players who don't know or don't want to learn slash commands ; Link opens a small popup asking just for a gamertag (the same /link set logic underneath, just no typing a command), Balance shows Dollars + Cash together at a glance, Store and Leaderboard open the exact same browsers /dz-store view and /leaderboard already show, and My Stats shows achievement progress on both sides (Discord-side always, DayZ-side once linked). /player-hub remove stops tracking the channel without deleting the panel message.

v0.18.43New "longest life" survival achievements, plus role rewards on unlock

• New longest-single-life tracking, distinct from cumulative playtime ; a life spans from spawn until death, however many times you reconnect in between, and resets fresh at every death. Three new DayZ-side achievements off it: Surviving (2h), Hardened (6h), Untouchable (24h), visible via /achievements dayz.
• New /achievements role-set achievement:<> role:<@role> (admin) auto-grants a Discord role the instant any achievement unlocks; Discord-side ones (bench rank, wealth, ...) grant immediately ; DayZ-side ones (kills, playtime, longest life, ...) only work for a gamertag with a real /link on file, since that's the only place this bot connects a gamertag to a Discord account. /achievements role-remove undoes it (doesn't take the role back from anyone who already has it) ; /achievements role-list shows the current mappings.

v0.18.42Fixed: Online Count channel always showing 0 ; new /welcome customization

• Fixed a real reported bug: the Online Count voice channel (/online-count) always showed 0 players, even with people actually on the server. Root cause, confirmed live against production: Nitrado's DayZ server query never actually returns a player-name list (always empty, regardless of real occupancy), which is the field this read ; it now reads the same live player-count field every other part of the bot (/status, /player online, /mapdistance, the dashboard) already used correctly.
• New /welcome config to customize the embed new members see in the Welcome channel: title, message, color, and a banner image, plus toggles for the avatar thumbnail and member-count field. {user}/{username}/{server}/{membercount} substitute into the title and message. /welcome preview posts it right now using you as a stand-in for a new member ; /welcome view shows the current config ; /welcome reset clears everything back to default. Off by default (opt-in via Moderator Permissions, no dashboard page yet).

v0.18.41New /channel embed-mode; post feed events individually instead of batched

• Every live feed normally groups all of a poll cycle's same-type events into one embed (e.g. 10 builds in one cycle become 1 message). New /channel embed-mode type:<> mode:<batched|individual> lets you opt any event type out of that per-cycle grouping ; set to individual, each event posts as its own embed as soon as it happens instead of waiting to be bundled with the rest of the cycle. Matching checklist on the dashboard's Channel Management page. Off (batched) by default for every type ; on a very busy server, switching a high-volume type to individual can mean a burst posts as several separate messages instead of one, taking a little longer to fully post.
• /channel list now also notes which event types are currently set to post individually, if any.

v0.18.40/store renamed to /dz-store, plus player-to-player Cash pay

• /store is now /dz-store ; "DZ" for DayZ, marking every command tied to the real DayZ-currency economy at a glance, distinct from the Discord-side minigame currencies (/economy, /casino, /bench, /range, ...). Every subcommand carries over unchanged (view, balance, setlocation, buy, admin).
• New /dz-store pay to_gamertag:<> amount:<> ; send some of your own Cash directly to another player's gamertag, no admin needed. Same self-service gamertag resolution as buy/balance/setlocation (uses your /link if you don't pass one). Logged to the same transaction table /economy audit reads, under its own type so the two currencies' fraud-pattern scans never mix.

v0.18.39Fixed: /channel create|set rejecting a typed-out event type

• Fixed a real reported bug: typing an event type's exact visible label (e.g. "Death (no attacker)") instead of tapping the autocomplete suggestion, easy to do on mobile, submitted that raw label text instead of the real value, and got rejected as "Unknown event type" even though it was a completely valid choice. /channel create and /channel set now also accept an exact (case-insensitive) match on the visible label, not just the underlying value.

v0.18.38Live online-player-count voice channel

• New /online-count setup|remove ; creates (or points at an existing) voice channel whose NAME shows the live DayZ online-player count, e.g. "🟢 Online: 12". Locked so nobody can actually join it. Discord limits how often a channel name can change, so this updates every few minutes rather than instantly.
• /help now also documents /server-monitor (it was missing entirely) and the Admin web dashboard's description no longer says only 2 commands are covered, it's 27+ areas now.

v0.18.37Fixed: Bot Trap and Auto-Mod ban actions silently failing

• Fixed a real, live-confirmed bug: Bot Trap (and Auto-Mod's ban action) called message.member.ban(); which requires the offender to already be in the bot's member cache. An account that just joined and immediately posted (exactly the profile both of these exist to catch) is very often NOT cached yet, so the ban call silently did nothing while the message still got deleted and reported, making it look like it worked. Both now ban by the raw user ID instead, which needs no cached member at all, and a failed ban is now actually logged and flagged in the Moderation Log ("Bot Trap Triggered; Ban Failed") instead of failing invisibly.

v0.18.36Exclude channels from the Moderation Log

• New /channel modlog-exclude channel:<#> stops message edits/deletes in that specific channel from posting to the Moderation Log, even when one's configured ; /channel modlog-include undoes it. Matching checklist on the dashboard's Channel Management page. Only affects message edit/delete logging; joins, leaves, nickname/role changes, and bans still always log for every channel.

v0.18.35Combine feeds into one channel

• New /channel set type:<> channel:<#existing> (and the matching dashboard form on Channel Management) points an event type at a channel that already exists, instead of always creating a new one. Point any number of types at the same channel to combine them ; e.g. send kills, deaths, and hits all to one #combat-feed instead of three separate channels. No restriction on which types can share a channel, including the normally-private ones (stash, mod-log, bot-trap) ; that's on you to keep intentional.
• /channel list now also shows the Welcome channel type added last update ; it was missing from that display (the dashboard's channel dropdowns already had it).

v0.18.34Fixed: developer dashboard access on a server you've joined but aren't an admin of yet

• Fixed a real bug: the bot's developer always had full dashboard access to a server they weren't personally a Discord member of, but if they DID join a server (e.g. to help configure it) before being granted real Administrator or a bot-admin-role there, the dashboard treated them as a completely unprivileged member instead; showing the Moderator Permissions empty state instead of the real hub. Discord commands were never affected by this, only the dashboard.

v0.18.33New Welcome channel

• New Welcome channel type ; set one up with /channel create type:Welcome or /setup auto-channels, and every new member gets a public embed there with an @-mention, their avatar, and a running member count. Nothing else to configure ; same 'having the channel set is the on/off switch' behavior as every other feed channel.

v0.18.32Temp-ban + transcripts: dashboard and /help catch-up

• Fixed: an admin had no way to actually grant the tempban permission to a moderator ; it existed in the data model and gated the command, but never got a checkbox on the Moderator Permissions dashboard page. Added, plus a regression test so a future new permission can't ship the same gap silently.
• /help now documents /tempban and /setup player-role|ban-role, and the /ticket entry no longer says 'metadata only'; it's been a full transcript since last update.

v0.18.31Temp-ban now bans in-game too

• /tempban start now also bans the player's DayZ gamertag through Nitrado (settings.general.bans), not just the Discord-side role swap from last update ; /tempban release and the automatic expiry sweep now lift the in-game ban too, at the same time as the role swap reverses.
• Verified directly against real production Nitrado data before shipping (not assumed) ; a gamertag is required for the in-game half (provide one with /tempban start's gamertag option, or have the player /link set theirs first): the Discord role swap always happens regardless, even with no gamertag on file.

v0.18.30Temp-ban mechanic (Discord side)

• New /tempban start|release|list ; temporarily swaps a member's role (their normal role off, a 'ban' role on) for a set duration (e.g. 30m, 2h, 1d, 1w), then automatically swaps it back once the sentence is up: no admin follow-up needed. Set the two roles once with /setup player-role and /setup ban-role.
• Protects against being used on real admins/BenchBot-admin-role holders. If a temp-banned member leaves and rejoins mid-sentence, the ban role is re-applied automatically instead of quietly expiring.
• In-game Nitrado banning (the other half of this feature) isn't wired up yet in this release ; only the Discord-side role swap is live so far. That's landing in a follow-up update once it's been verified against a real server.

v0.18.29Ticket transcripts

• Closing a ticket now attaches a full text transcript (every message, timestamps, authors, attachment links) to the existing ticket-closed log post: the conversation used to just disappear along with the deleted channel, leaving only a metadata summary behind.
• The 'closing in N seconds' countdown before a ticket's channel is deleted is now 10 seconds instead of 5, giving the transcript a bit more room to finish reading a long conversation before the channel is gone.

v0.18.28Moderator Permissions now enforced on the dashboard too

• The same 24 permissions from last update now also gate the matching dashboard pages, not just the Discord commands: a moderator granted (say) Teleporters can open /g/<server>/teleport but gets blocked from every other page, exactly matching what their role can do in Discord. /banlist and /tickets pages keep working exactly as before.
• Fixed a real access bug found while wiring this up: a signed-in member with no BenchBot Moderator role at all could load the Banlist and Tickets dashboard pages, because those two default to on for every server. Server-config, Moderator Permissions, ticket setup, auto-channel setup, and cash-wipe stay admin-only on the dashboard, matching Discord.

v0.18.27Moderator Permissions now enforced on the Discord side

• 24 more commands now check the Moderator Permissions an admin grants (Server Config → Moderator Permissions) instead of requiring full Administrator: /altcheck, /automod, /basedamage, /baseping, /bounty admin, /casino global-chips, /channel, /classname add|remove, /createevent, /detect, /economy audit, /faction admin, /giveaway, /keyword, /link admin, /links add|remove, /loadout, /lootfeed channel, /reactionrole, /rotation (setup-ftp's credential entry stays admin-only), /server-monitor, /store admin (cash-wipe and cash-import stay admin-only), /suggestion resolve, /teleport, /whitelist.
• /ticket and /banlist keep working exactly as before ; those two already enforced this. /ticket category-add|category-remove now have their own separate permission from the rest of /ticket, matching the dashboard's Ticket Categories having its own page.
• The dashboard side of these 24 (server-config pages, not just Discord commands) is the last piece ; landing next.

v0.18.26New Moderator Permissions dashboard page, and a real dashboard nav fix

• Fixed: a BenchBot Moderator couldn't actually reach the web dashboard at all before this; the server list and the per-server hub page both only checked for full Administrator, so a mod-only account hit a wall before ever seeing a page meant for them.
• New Moderator Permissions page (Server Config → Moderator Permissions) lets an admin choose exactly which dashboard sections the Moderator role can open. A moderator's dashboard now shows only the sections they've been granted, not an all-or-nothing view.
• This is groundwork, not the full rollout yet: /ticket and /banlist (Discord + dashboard) are the only two features that actually check these permissions today, same as before this update. Every other checkbox on the new page is real and saves correctly, but doesn't do anything to enforce access yet ; each remaining feature gets wired up to it over the next few releases.

v0.18.25Groundwork for granular BenchBot Moderator permissions

• First step of a multi-part rollout: an admin will soon be able to choose exactly which features the BenchBot Moderator role can use, per feature, instead of the current all-or-nothing (tickets + banlist only). This release is infrastructure only ; nothing changes yet for any server, existing mod-role setups keep working exactly as before.

v0.18.24New /whitelist ; manage the Nitrado server whitelist from Discord

• New /whitelist add | remove | list (admin) ; type in a gamertag and BenchBot adds it straight to this server's Nitrado whitelist, no need to open the Nitrado panel. list also shows whether whitelist enforcement itself is currently on or off.

v0.18.23New /store admin cash-import ; bulk-migrate balances from another bot

• New /store admin cash-import ; upload a CSV (gamertag,balance) or JSON file to bulk-set Cash balances, for moving a server's players over from another killfeed/economy bot without everyone starting from zero. Previews what would change first (new vs. updated records, any unparseable rows) ; re-run with confirm:true to actually apply it. add_to_existing:true adds to current balances instead of overwriting them.

v0.18.22Fixed /player locations showing stale, undated position times

• "Server Time" on /player locations is a bare HH:MM:SS with no date straight from the ADM log, and a reconnected player keeps their last-known position until a fresh ping arrives; so two online players' displayed times could be hours or days apart with nothing showing which was stale. Now shows how long ago each position was actually recorded (e.g. "14:32:07 (3m ago)"), sourced from a real timestamp rather than the ambiguous server clock string alone.

v0.18.21Reaction role panels can post in Announcement channels

• /reactionrole create's channel picker only allowed standard text channels, so Announcement channels (a common home for a rules/roles panel) silently didn't show up as an option. Now allows both.

v0.18.20New /promo command

• Added /promo: a ready-to-post green embed with the DayZ Nerd Squad logo, a short pitch for the community/BenchBot, and links to dayznerdsquad.com and the Discord invite, meant for partner servers to share.

v0.18.19Special thanks update

• Updated Austin's (formerly listed as "Blackout Austin") credit on the welcome page and /about embed to also recognize being a top donor funding the project, alongside testing/feedback.

v0.18.18Special thanks tag fix, part 2

• The earlier fix (v0.18.8) only removed the stray "DZB Creator" tag from Jarv's credit on the public welcome page: the /about embed's Special Thanks field still had it. Removed there too.

v0.18.17Admin Base Pings

• New /baseping add|edit|remove|toggle|list: define a base by name/x/y/radius_m, and the moment a tracked player's position falls inside it, an alert posts with a real @-mention (a faction's leader/co-leader via mention_faction, and/or a specific mention_user).
• Fires once on entry, not repeatedly while camped inside; cooldown_min is a jitter backstop, not a periodic reminder.
• Needs an alert channel; set one per base ping, or a server-wide default in Server Config.

v0.18.16/faction replaces /clan

• Self-serve factions with leader + co-leader roles and a shared Cash bank, replacing the old single-owner, currency-less /clan (existing clans migrate automatically).
• create/join/leave act on your own gamertag (optional once linked); join needs a leader/co-leader's /faction accept.
• kick/promote/demote/transfer-leader manage roles; bank deposit|withdraw|balance moves Cash in/out the shared bank (withdraw needs leader/co-leader).
• disband (leader) or an empty roster ends the faction.

v0.18.15DayZ server uptime monitor

• New /server-monitor command: set a server's IP + query port and it gets checked every 60 seconds via a direct A2S status query, independent of Nitrado's own log/API polling.
• Posts to an admin-configured channel when the server stops responding (after 3 consecutive missed checks, to avoid a false alarm from one dropped packet) and again the moment it's back.
• /server-monitor status shows a live check plus current monitor config at any time.

v0.18.14Security fix: prototype pollution in /keyword and dashboard behavior-detection config

• Both the dashboard's keyword/behavior-detection config pages and the /keyword command used an admin-supplied name directly as an object key. A specially-crafted name ("__proto__") could corrupt shared internal state instead of just that one setting.
• Fixed by validating names before they're used as keys, in both the dashboard routes and the /keyword command.

v0.18.13Fixed mobile dashboard navigation

• The dashboard nav bar was hiding its entire link list (including "Your Servers") on phone-width screens with no menu to bring it back; mobile visitors had no way to navigate the dashboard at all.
• Replaced it with a working menu button that opens/closes the same links in a dropdown.

v0.18.11Loadout Generator moved to Nerd Squad Labs

• Removed the dashboard's Loadout Generator page (/g/:guildId/loadout); it never touched any per-guild data, so it fit Labs' "tool" model better than the dashboard's "configure the bot for my server" model.
• Rebuilt at dayznerdsquad.com/tools/loadout-generator, on Labs' own item/attachment database instead of a static classname list; full equipment slots plus weapon attachments, exports the same spawn-ready JSON format.
• The Discord /loadout command is unaffected; it's a separate code path and still works the same.

v0.18.10Auto-mod action label fix

• Renamed the /automod "Delete" action to "Delete + Warn"; it already posted the public warning notice on every hit, the label just never said so, which read as if a delete+warn option was missing.

v0.18.9Command usage logging

• Every slash command invocation is now recorded to the SQLite mirror (guild, user, command, subcommand, timestamp); bot.log rotates after a few days, so this was previously the only way to answer "has anyone actually used this recently."
• New /dev usage-stats (developer only): total invocations, unique users/servers, and top commands over a configurable lookback window.

v0.18.8Special thanks tag fix

• Corrected Jarv's credit line on the welcome page; dropped a stray "DZB Creator" tag that shouldn't have been there.

v0.18.7Mascot v4, angular skull eyes, no more mud

• Third pass on the nav mascot: v2's bared-teeth detail turned into an illegible dark smudge at real 20px size, so it's gone; diamond-shaped angular eye sockets read as skull-like without needing fine detail that dies at small sizes.

v0.18.6Mascot redrawn to match the real reference art

• Redrew the nav mascot again against the actual hooded-skull reference art (previous pass read as a generic ghost); sharper hood peak, skull eye sockets, nasal cavity, and a bared-teeth jaw line.

v0.18.5Redrawn mascot, real member reviews on the homepage

• Redrew the mascot mark in the nav to a cleaner hooded-skull badge.
• Added a "What people are saying" section to the homepage with real reviews from the Discord server.

v0.18.4A little visual polish, new mascot, outlined login button

• Added a small goggles-and-skull mark next to the site name in the top nav, replacing the plain dot.
• The "Login with Discord" button is now outlined instead of solid-filled, matching the rest of the site's button language.
• Cleaned up how the corner-bracket panel decoration and button styles are defined internally: no visible change, just less duplicated code to keep in sync.

v0.18.3Nerd Squad Labs is now a real tab on the site

• Added a "Labs" link to the top nav on every page, pointing at labs.dayznerdsquad.com: the DayZ modding tools site is now reachable from the main site instead of only being a bare URL you had to already know.

v0.18.2Stop announcing the dashboard runs on Express

• The dashboard no longer sends the "X-Powered-By: Express" header on every response; a small, free piece of recon info for anyone probing the site that had no reason to be public.

v0.18.1Dashboard no longer leaks internal error details

• A bug hitting any dashboard page used to be able to show a raw internal error (file paths, line numbers) instead of failing quietly. It now always shows a plain "something went wrong" message and logs the real details privately instead.

v0.18.0Security overhaul; VPN/proxy detection, rate limiting, stronger headers

• Dashboard logins from a known VPN, proxy, or datacenter address are now flagged and posted to a developer alert channel (configurable via /dev security-channel): this only notifies, it never blocks anyone from logging in.
• Added rate limiting to every mutating dashboard action and to the login callback, on top of the existing login-page limit.
• Hardened the dashboard's security headers: added HSTS, a Referrer-Policy, a Permissions-Policy, and tightened the Content-Security-Policy against clickjacking and base-tag injection.
• The bot now warns on startup if secrets are being stored unencrypted or the dashboard session secret is weak, instead of staying silent about it.
• Patched a handful of transitive dependency vulnerabilities flagged by npm audit.

v0.17.1Badge wordmark now fills the ring instead of floating small in the middle

• Bumped up the text size and trimmed the padding on the hero's DayZ Nerd Squad badge so it fills the circle the way the real logo does.

v0.17.0Homepage hero now matches the real DayZ Nerd Squad badge logo

• The hero's "DayZ Nerd Squad" wordmark is now laid out like the actual badge logo; DayZ in a bold script over a divider line over "Nerd Squad" with a ® mark, all inside the ring: instead of stacked plain text. Also added a real self-hosted script font for it, since the previous system-font cursive wasn't guaranteed to even be installed.

v0.16.0Removing the bot now automatically clears stored secrets

• When BenchBot is removed from a server, its Nitrado token and FTP password are now cleared automatically. Everything else, stats, economy, tickets, rotation history, is kept, so re-adding the bot later doesn't lose that history. Updated the Privacy Policy to match.

v0.15.1Add a copyright line to every page footer

• "© 2026 DayZ Nerd Squad™. All rights reserved." now appears in the footer alongside the legal links, on every page.

v0.15.0New: Legal pages; Privacy Policy, Terms, Cookies, and Copyright

• Added /legal with four sub-pages (Privacy Policy, Terms of Service, Cookie Policy, Copyright/DMCA), linked from the footer of every page. Written in plain language to accurately describe what this site and bot actually collect and do: not a generic template.

v0.14.0Fix: developer access to other servers' dashboards actually works now

• The dashboard already intended for the bot's developer to be able to open any server's dashboard for support, even one they haven't personally joined on Discord, but clicking through 404'd anyway because the underlying permission check still required actual membership. Fixed the check itself, dev-gated as before.

v0.13.6Fix: root-caused why the background sometimes silently failed to render

• Found and fixed the actual bug behind the background issues from the last few updates: a negative-layer positioning trick that could make Chrome silently drop the whole effect on certain pages. Rebuilt it on a safer positioning approach that renders reliably everywhere, and tuned the brightness down slightly now that it reliably shows up.

v0.13.5Fix: background wasn't rendering at all on the homepage

• The homepage's main content area and footer had an extra blur effect the dashboard didn't have; combined with the background canvas, it was silently preventing the background from rendering at all there (confirmed live: not even a plain test box would show up). Removed it; the background now renders on the homepage the same as everywhere else.

v0.13.4Fix: background now shows through behind panels too, not just in the gaps

• Panels and cards were fully opaque, so the falling-code background only showed in the empty space around content instead of feeling like it covered the whole page. They're now translucent with a blur, so the code is visible (softened) behind everything, not blocked by it.
• Fixed the new favicon actually being blocked by the same security policy that was just fixed for avatars, data URIs needed their own allowance.

v0.13.3Background is now a dense, continuous scroll of code

• The falling-code background was too sparse: one line per column with long gaps between refreshes. Every column is now a continuously scrolling, densely stacked stream (like scrolling through a real log), always covering the visible screen behind whatever page you're on.

v0.13.2Redesign: the background is now clean scrolling code, grid-aligned, no smear

• Rebuilt the falling-code background: columns are now wide enough that lines never overlap each other, aligned exactly to the page's coordinate grid, and there's no more fade/trail smear; it now reads as clean text sliding through the grid instead of a streaky blur.

v0.13.1Fix: the new background animation was too faint to actually see

• The falling-code background from the last update was real but nearly invisible; low opacity, small text, sparse coverage. It's now noticeably brighter, denser, and immediately visible on page load instead of taking a while to populate.
• Fixed a missing favicon (was silently 404ing on every page).

v0.13.0Site-wide visual overhaul: real typography, a tactical background, sharper dashboard styling

• New self-hosted display and code fonts everywhere: the old font stack silently fell back to a generic system font for almost everyone; headings and labels now actually render in the intended condensed industrial typeface.
• Every dashboard page (not just the homepage) now has a subtle animated background of drifting code lines and a faint tactical coordinate grid, instead of a flat black fill.
• Panels, buttons, tables, and forms across the whole dashboard got a sharper pass: corner-bracket panel accents, a clearer color-coded severity stripe on save banners, refined hover states.
• Fixed a long-standing bug where Discord profile pictures never actually loaded in the top nav: the security policy was silently blocking them.

v0.12.2Loadout Generator: add cargo items in bulk with a quantity field

• The cargo Add form now has a quantity field; add several of the same item in one click instead of clicking Add repeatedly, each copy auto-placed in its own cell.
• If a container runs out of room partway through a batch, whatever fits gets added and the banner says how many made it in.

v0.12.1Loadout Generator: one-click cargo, SCARH + Desert gear added

• Adding an item to a backpack or vest is now a single click: the dashboard finds a legal spot for you (auto-rotating if needed) instead of asking you to pick a position on a second page.
• Added the SCARH (including the black variant) with its magazine and Holo Optic, plus Desert-camo Plate Carrier Vest, Pouches, and a Desert Tortilla backpack.

v0.12.0Loadout Generator overhaul: real 2D cargo grids, wider attachment coverage

• Backpacks and vests now use their real internal cargo grid; pick an item, see every legal spot it can go, and place it with rotation support. A running slot counter keeps you from over-filling any container.
• Cargo automatically gets cleared out if it no longer fits; swap to a smaller backpack or unequip a vest pouch and anything that no longer has room is removed and called out on screen, instead of silently going stale.
• More weapons and rigs now expose their real attachment points, including additional magazine sizes for the M4A1/M16A2 and the Smersh Vest's utility buttpack.
• Fixed the finished-loadout instructions to reference the correct file: drop the JSON into spawnGearPresetFiles in the player data block of cfggameplay.json.

v0.11.0New: Live Ticket Management; the dashboard now covers every admin command

• Manage open tickets right from the dashboard: claim, unclaim, transfer, set priority, rename the channel, open a private staff thread, add/remove a member, send a close request, or close immediately; plus a Close All for every open ticket at once.
• This wraps up the full dashboard push: everything with real admin configuration is now available on the web, not just in Discord.

v0.10.0New: Reaction Roles are now on the dashboard

• Post a reaction-role panel, add or remove emoji-to-role mappings, and stop tracking a panel, all from the dashboard.
• Paste an emoji the same way Discord's own chat box would insert one (a unicode character, or a custom emoji tag); there's no dashboard emoji picker yet.

v0.9.0New: Full Server Setup is now on the dashboard

• One-click setup of every BenchBot feed, dynamic-event, game, utility, and ticket channel, plus the BenchBot Admin role: the same thing /setup auto-channels does in Discord, now with a button. Safe to run more than once.
• A matching "Remove All" action tears every auto-created channel back down, gated behind a confirmation checkbox.

v0.8.0New: Loadout Generator is now on the dashboard

• Build a full DayZ loadout right from the dashboard: every equipment slot, weapon attachments (magazines, optics, buttstocks, and what's inside a holster/sheath), and cargo, then download the ready-to-use JSON file.
• Every equipment slot shows its complete item list on the web (no 24-item cap like Discord's dropdown), so nothing's hidden behind a search box anymore.

v0.7.0New: Event Creation is now on the dashboard

• Create airstrikes, gas strikes, custom vehicle spawns, and hordes right from the dashboard: one page instead of Discord's step-by-step menu, plus a live spawn list you can remove from or (for hordes) adjust the zombie count on.
• Scheduled cleanups (auto-removal 15 minutes after the next restart) are shown right on the same page.

v0.6.0New: Channel Management, Loot Feed, Giveaways, Ticket Setup, and the rest of Server Config are now on the dashboard

• Server Config now also covers the default channel, bot-trap, BenchBot Admin/Moderator/Auto roles, and encrypted backup export/import: all with live channel/role pickers, a first for the dashboard.
• Keywords can now be scoped to specific channels from the dashboard, matching what /keyword channel-add already did in Discord.
• New pages: Channel Management (create event channels, bulk visibility), Loot Feed (channel + an inline spawn map), Giveaways (start/list/reroll), and Ticket Setup (post the panel, or run quick setup), 4 more pages, 22 per-guild total.
• Developers now also get a Global Watchlist Review page (approve/deny pending reports), separate from each server's own dashboard.

v0.5.0New: Store/Economy, Server Config, Keywords, Teleporters, Ticket Categories, and the Global Watchlist are now on the dashboard

• Dashboard now covers Store & Economy (cash config, give/take/set balances, earning zones, items, kits), Server Config (Nitrado credentials, map, farewell DM, live server status, channel routing), Keywords, Teleporters, Ticket Categories, and the guild-scoped half of the Global Watchlist, 6 more pages, 18 total.
• This is the first batch of "quick win" modules from the larger dashboard-parity push ; several harder areas (event creation, loadout generator, live ticket management, and the rest of server setup) are still coming in later updates.

v0.4.0New: 10 more admin features now configurable from the dashboard

• Dashboard now covers Casino (global chips toggle), Economy (audit report), Custom Classnames, Links, Gamertag Links (admin), Bounty config, Automod (checks + word list), Behavior Detection (all 7 detectors), Alt Account scan, and Suggestion resolution, 12 pages total, up from 2.
• New per-server hub page (click "Manage" from Your Servers) links to every dashboard page for that server in one place.

v0.3.2New: persistent site-wide nav bar, dashboard reskinned to match the homepage

• A real top nav bar (Home, Discord, contextual links, login/logout) now appears on every page, public homepage and admin dashboard alike, replacing the earlier per-page dropdown. Always a way back to Home from anywhere in the dashboard.
• The whole dashboard (Rotation, Base Damage, Your Servers, Recent Logins) is reskinned to match the public homepage's black/green DayZ Nerd Squad identity, instead of a generic admin-panel look bolted onto a branded homepage.

v0.3.1New: dashboard page-picker dropdown, including a way back to the homepage

• Every logged-in dashboard page now has a "Go to…" dropdown in the header; Home (About Us) and Your Servers always, plus a quick link between Rotation and Base Damage when you're already on one of those for a server. Previously there was no way back to the public homepage once logged in.
• New /about route: always shows the public homepage regardless of login state, giving the dropdown a stable destination.

v0.3.0New: dashboard login audit log ; developers see every guild in the picker

• New developer-only /logins page: a real "who logged into the dashboard, from where" view (username, Discord ID, IP, location, timestamp), instead of only being visible by grepping bot.log by hand. Bot-wide and developer-only on purpose: this bot serves several unrelated Discord communities, and login IPs/locations from one guild's admins have nothing to do with another's.
• The guild picker now lists every guild the bot is in for developers, not just ones they personally administer; matches the bypass /g/:guildId routes already granted developers, just makes the picker consistent with what clicking through already allowed.

v0.2.9Homepage: SEO basics (meta description, social preview tags, robots.txt, sitemap.xml)

• The public homepage had no meta description or Open Graph/Twitter card tags: both search engine snippets and link previews (Discord, etc.) were showing nothing useful. Added a real description plus social preview tags, a robots.txt pointing at a new sitemap.xml, and a canonical URL tag.

v0.2.8Fix: login cookies scoped to the wrong domain (root vs. dashboard subdomain)

• Cookies default to "host-only"; dayznerdsquad.com and dashboard.dayznerdsquad.com count as different hosts under that rule, even though one looks like a subdomain of the other. This caused two confirmed bugs, reproduced live: a session started on one domain wasn't recognized on the other, and clicking "Login with Discord" from the root domain's welcome page failed every single time (the state cookie got set on the wrong host for the callback, which always lands on the dashboard subdomain). Cookies are now explicitly scoped to the whole domain, fixing both.

v0.2.7Dashboard login: longer state-cookie window

• The login-state cookie (protects the OAuth handshake against CSRF) lasted 5 minutes ; extended to 30. Real-world delay reading Discord's consent screen, entering 2FA, etc. was hitting "Login failed; invalid or expired state" more than it should.

v0.2.6Fix (actual root cause): dashboard login was never reaching the session check

• Found it: GET / branched on req.hostname to decide between the public homepage and the real dashboard, added when a second domain was still expected to work. PebbleHost's reverse proxy doesn't forward the original Host header the way that logic assumed, so on the live server req.hostname never matched and every single request got intercepted before ever reaching the session-checking code; explaining why bot.log kept confirming successful logins while the browser stayed logged out no matter what, through two earlier fix attempts that addressed real but ultimately unrelated issues (Set-Cookie/redirect handling, caching). That hostname branching only ever existed for the second-domain case, which is no longer in use, so it's removed outright; GET / is hostname-independent now.

v0.2.5Fix attempt #2: dashboard login still not sticking in the browser

• The single-Set-Cookie-header fix in 0.2.4 wasn't enough; bot.log kept confirming successful logins server-side while the browser stayed logged out. Two more changes: every dashboard response now sends Cache-Control: no-store (a caching layer serving a stale pre-login page for "/" after the redirect is a real candidate), and the post-login redirect no longer uses a 3xx status; it's a 200 page with a client-side refresh instead, since a redirect response combined with Set-Cookie was the other suspect. Root cause still not 100% confirmed ; this needs a live retest.

v0.2.4Fix: dashboard login silently failed to actually log you in

• /auth/callback was setting two Set-Cookie headers in the same response (clearing the old login-state cookie, and setting the new session cookie) ; confirmed live that the login completed successfully server-side (Discord auth, code exchange, session built) but the browser never ended up logged in; most likely the hosting reverse proxy only forwarding one Set-Cookie header per response. Now sends exactly one per response ; the state cookie is left to expire on its own short (5 min) lifetime instead of being explicitly cleared alongside the session cookie.

v0.2.3Dashboard: about-me landing page, login rate limiting, login IP logging

• dashboard.dayznerdsquad.com's logged-out page now shows the same about-me content (Bench's story, community highlights, Discord invite) as the public homepage, with a clear "Login with Discord" link through to the actual admin dashboard: instead of a bare login screen. Since PebbleHost's reverse proxy only supports one domain per server, this consolidates everything onto the one domain that's actually reachable.
• /auth/login is now rate-limited (20 attempts per IP per 10 minutes): the one truly public, unauthenticated entry point, now that the dashboard is actually internet-exposed.
• Every successful dashboard login now logs the admin's IP address (and best-effort city/region/country) to bot.log, for visibility into who's accessing it.

v0.2.2Fix: dashboard + homepage were rendering completely unstyled

• The dashboard's Content-Security-Policy header (default-src 'self') was silently blocking every inline <style> (and now <script>) tag on every dashboard page and the public homepage: confirmed live in a real browser (plain unstyled HTML, no visible error). No build step means no separate CSS/JS files to point a stricter policy at, so style-src/script-src now explicitly allow 'unsafe-inline'. Automated tests use fetch(), which never enforced CSP, so this went unnoticed since the dashboard first shipped in v0.2.0.

v0.2.1New: public homepage at the root domain, alongside the admin dashboard

• The bot's web server now answers on two audiences from the same process/port: the admin dashboard on its own subdomain, and a public homepage (Bench's own story, what the community offers, special thanks, and a Join Discord button) on the root domain / www; branching on which hostname the request came in on. No new port or config needed beyond pointing both domains at the same reverse-proxied port.
• The homepage's story section reuses the exact same text as /about (now a shared export) rather than a separately maintained copy, so the two can never drift apart.

v0.2.0New: admin web dashboard (foundation + /rotation, /basedamage)

• A browser-based admin dashboard, gated behind Discord login (OAuth) ; only shows servers where you're actually an admin (real Administrator, or this bot's own configured admin role), checked live against Discord every time, same as every admin command already does. Runs in the same process as the bot, on its own opt-in port (unset = fully disabled, same convention as the existing /health endpoint).
• Covers /rotation (view pool/status, trigger a rotation, enable/disable) and /basedamage (view schedule, set timezone, apply now) so far ; everything else is still Discord-only. More commands move over gradually: see ARCHITECTURE.md's "Adding dashboard support for a feature" for the pattern.
• Requires the bot's host operator to configure it (DASHBOARD_PORT/DASHBOARD_BASE_URL/DASHBOARD_CLIENT_SECRET/DASHBOARD_SESSION_SECRET in Bone.env, a matching OAuth redirect in the Discord Developer Portal, and, separately, pointing your host's reverse proxy at the port once you're ready to make it reachable). Nothing changes for servers that don't set this up ; it stays fully inert.
• Adds a new dependency (Express) ; deploying it requires node deploy.cjs --with-deps once, in addition to the usual deploy, or the bot won't start at all on a host that doesn't already have it.

v0.1.104Fix: horde zombie count, part 2 ; the territory zone had its own separate cap

• Bug: on top of the children-max fix from the last update, a horde's territory zone (env/zombie_territories.xml) has its OWN independent population cap (smin/smax/dmin/dmax), hardcoded to 100 regardless of requested count. Confirmed live: nominal=200 with this still at 100 actually capped at 100.
• Horde creation and Edit Zombie Count both now set the zone's dmin/dmax to match the requested count (smin/smax stay 0, matching vanilla's own purely event-driven zones like infected villages/cities, as opposed to a static pre-placed patrol).
• This should be the actual full fix ; between this and the last update, every hardcoded population cap on a horde (nominal, children max, and now the zone's own cap) tracks the requested count.

v0.1.103Fix: hordes silently capped at 20 zombies no matter what zombie count was set

• Bug: every horde's children were hardcoded to max="2" each at creation, regardless of the group's target count (nominal). DayZ can only actually reach nominal if the SUM of every child's own max is at least that high, so this silently capped most hordes around 20 (matching the also-hardcoded default target) no matter how high nominal was later set via Edit Zombie Count.
• /createevent's Horde creation form now asks for zombie count up front (previously only zone radius) ; each child's own max is now set to match, so the real cap actually is what you asked for.
• Edit Zombie Count now updates every child's max alongside nominal, so existing under-provisioned hordes can be fixed by just re-running it with the intended count.

v0.1.102/teleport: visible marker objects

• /teleport create now takes an optional marker_classname (e.g. a sewer cover) ; a PRA trigger box is completely invisible in-game, so without something physically marking the spot there was no way to know where to stand. Spawns at every real trigger point (just origin for one-way, both ends for two-way), using the same object-spawner mechanism /store buy already uses.
• Unlike the teleport's own origin_y/dest_y, the marker's height does NOT auto-snap to terrain; give it a real Y or the marker may spawn buried or floating. The create confirmation warns if no height was given.
• /teleport remove and the temporary auto-cleanup (15 min after restart) both clean up the marker too, not just the teleport itself.

v0.1.101/teleport: height (Y) is now optional

• /teleport create no longer requires origin_y/dest_y ; DayZ resolves both the trigger box and the destination to the real terrain surface at the given X/Z regardless of the stored height, so most teleporters only need X/Z. Still overridable for the rare case you want a specific elevation (e.g. a particular floor of a building).
• Confirmed against a real cfggameplay.json that playerRestrictedAreaFiles does live under WorldsData, as /teleport already assumed ; no behavior change there, just removes the last open question from last update's entry.

v0.1.100New: /teleport ; in-game teleporters

• /teleport create name:<> mode:<temporary|permanent> direction:<one-way|two-way> origin_x/y/z:<> dest_x/y/z:<> ; standing in the origin spot moves a player to the destination. Temporary auto-removes it 15 minutes after your server's next restart (same toggle /createevent already has); two-way also creates the return trip back. Same FTP credentials as /rotation.
• /teleport list shows what's configured; /teleport remove name:<> (autocompletes) deletes one, whether it was ever actually used or not.
• Brand new mechanism for this bot (DayZ's Player Restricted Area files) ; recommend testing on a low-stakes spot first before relying on it for anything important.

v0.1.99/help ; how to hide commands from regular members

• New /help entry (Setup & Configuration) explaining Discord's own command-visibility settings ; Server Settings → Integrations → BenchBot lets you hide any command from members without the right role, on top of this bot's own admin/mod/dev gating. Easy to miss since it's not surfaced anywhere else, so it's now spelled out step by step.

v0.1.98Backup restore, repeated-error alerting, and CI

• /setup backup-import: the other half of /setup backup-export : restores a server's BenchBot data from a backup file + its one-time passphrase, on this server or a different one. Completely overwrites whatever's currently saved, so it requires confirm:true, and keeps a local safety copy of the pre-restore data either way. Nitrado/FTP credentials are never included and always need reconfiguring afterward.
• Split the Setup & Configuration help category in two (new "Automation & Tickets" category) ; it was pushing right up against Discord's per-embed size limit and had no room left for new entries.
• New, developer-only: repeated process-level errors (several within a short window) now get alerted to a configurable channel (/dev error-channel), instead of only ever being visible in the raw server log. This bot already deliberately keeps running through an unexpected error rather than crashing (a full restart isn't reliable on this host) ; this just makes sure that doesn't go silently unnoticed if it starts happening a lot.
• Added a CI pipeline ; every push now automatically runs the same checks (syntax, lint, types, the full test suite) that were previously only ever run by hand before a deploy.

v0.1.97/help audit ; a few real features that were missing from it, plus a channel-setup gap

• /setup auto-channels now also creates the Chat and Cash Earned feed channels ; both were valid /channel create types already actively used by the live feed, but auto-channels silently skipped them, so they only ever showed up if you knew to add them by hand.
• /help now documents /setup mod-role (a lighter permission tier than bot-admin-role, for day-to-day moderation only: banlist, ticket claim/close), /setup backup-export (encrypted data backup download), /keyword channels-add/channels-remove (server-wide keyword channel scoping), /basedamage enable/disable/schedule-list, and /game currencies ; all real, already-shipped features that had never made it into the reference menu.

v0.1.96Kill feed: hit location shown, raw coordinates now optional ; link notifications

• Kill feed now shows which body part was hit (when the log line captured one), alongside the existing weapon and distance.
• Kill feed raw Coordinates now respect the existing /setup location-format setting, same as dynamic events already do ; "town" (the default) shows the Nearest Town instead of raw numbers, falling back to Coordinates only when no town is nearby. Switch back with /setup location-format format:coordinates.
• /link set and /link admin set now post a notice to the Moderation Log channel (if one is configured with /setup) when someone links their account ; the reply to the person linking stays private, this just gives admins visibility without having to ask around.

v0.1.95Fix: a bot restart could silently skip a scheduled rotation

• Bug: if the bot was offline for even a minute or two at an exact scheduled trigger time (a redeploy, a host restart, a crash), that whole day's rotation for that time just never happened, with no error, no message, nothing to explain why. Fixed ; a scheduled time now catches up automatically within 3 hours of when it was supposed to fire, so brief downtime around a scheduled time no longer means a silently missed rotation.
• /rotation times add now switches trigger mode to "specific times" automatically (told to you in the reply) ; one less step to set up a schedule, no more separately running /rotation trigger mode:<specific times> first.

v0.1.94New: /rotation can trigger at specific daily times

• /rotation trigger mode now has a third option: "At specific times". Set a timezone with /rotation times timezone zone:<IANA>, then add one or more daily trigger times with /rotation times add time:<HH:MM> ; e.g. time:17:00 for once a day, or time:5:00,19:00 (comma or dash both work) for twice a day. /rotation times remove/list manage the list, /rotation status shows them.
• Each configured time fires its own independent rotation, once a day ; "5:00-19:00" means "fire at 5:00 and fire at 19:00", not a continuous window (rotation swaps which pool files are active, it doesn't have an on/off state to hold open for a range).

v0.1.93Fix: /rotation pool list was hiding the file path once a name was set

• Bug: once a pool entry had a friendly name (e.g. "Dambog Convoy"), /rotation pool list/status stopped showing its actual file path at all ; the only value pool edit/remove actually match against. Typing that friendly name into pool edit/remove (the only value visible) failed with "isn't in the pool", even though the entry was right there.
• Fixed ; the file path now always shows alongside the name. /rotation pool list also now shows each entry's announcement description underneath it (if one is set), truncated to 80 characters.
• pool edit/remove now also recognize when you typed a friendly name instead of the file path, and tell you exactly which path to use instead of just failing.

v0.1.92/fuck renamed to /f__k

• Renamed /fuck to /f__k ; asterisks aren't allowed in Discord command names, so underscores stand in for the censored letters instead, matching the f**k censoring already used in its embed text. Everything else about the command (flavor text, gifs, availability everywhere) is unchanged.

v0.1.91/smd and /fuck now work everywhere

• Removed the NSFW channel restriction from /smd and /fuck ; they now work in any channel, same as the other four action commands.
• Any spelled-out profanity actually shown in the embed (the punch flavor line, the /fuck embed title) is now asterisk-censored, since these can post outside NSFW-marked channels.

v0.1.90/kiss gifs added

• /kiss now has its own curated gif list, same as the other five action commands ; it was shipped without one last version.

v0.1.89New: /hug, /kiss, /punch, /smd, /fuck, /crashout

• Six new action commands ; each posts a flavor-text embed plus a random gif aimed at whoever you target with user:<@member>, drawn from a hand-picked list per command (not a live search) so what posts is always something actually vetted. /smd and /fuck are NSFW-flagged (Discord restricts those two to channels marked NSFW, or DMs) since they're the crude two of the six ; /hug, /kiss, /punch, /crashout aren't restricted.
• /kiss doesn't have any curated gifs yet ; posts flavor text only until some are added.

v0.1.88New: /rotation pool edit

• New /rotation pool edit file:<> lets you update an already-added pool file's name, coordinates, announcement title, or description without re-adding it. This already worked by re-running /rotation pool add with the same file (it upserts), but that wasn't obvious from the command itself ; edit makes it a dedicated, discoverable action. /rotation pool add still works the old way too, nothing removed.

v0.1.87New: /support, and a clearer /rotation

• New /support ; get a link to the developer's support server (DayZ Nerd Squad) for bug reports, questions, or feature requests.
• /rotation reworked for clarity. /rotation schedule's three unrelated settings (trigger mode, interval, and how many pool files are active) are split up: /rotation trigger now covers only when a rotation fires, and /rotation pool active-count count:<n> covers how many pool files are live at once.
• Both /rotation status and /rotation pool list now spell out the actual pattern your pool size + active count produces, e.g. "1 active out of 8 at a time ; cycles through 8 groups of 1" or "5 active out of 10 at a time ; cycles through 2 groups of 5" ; the two example configs (one file live out of a larger pool; half the pool in / half out) both already worked, they just had no way to see or configure that from the command itself.

v0.1.86New: /purgechannels ; delete a whole category in one shot

• New /purgechannels category:<#category> (admin) permanently deletes a category and every channel inside it, message history included. Shows exactly which channels are about to go and requires a confirm click first, same safety pattern as /purge and /store admin cash-wipe.
• A separate command from /purge, not a subcommand of it ; Discord doesn't allow mixing a command's own options with subcommands, so folding this into /purge would've broken /purge amount:<> for every admin already using it.

v0.1.85New: fully editable ticket categories

• The 5 ticket categories (Player Report, Ban Appeal, ...) used to be fixed for every server. New /ticket category-add label:<> description:<> and /ticket category-remove index:<> (see /ticket category-list for the numbering) let each server customize its own list ; shown both on the panel's category picker and in /ticket createticket.
• /ticket createticket's category field is now search-as-you-type instead of a fixed dropdown, so it can reflect a server's actual (possibly customized) category list instead of Discord's static built-in choices.
• Removing a category doesn't touch tickets already opened under it ; they keep showing the old name until closed.

v0.1.84Fix: /link now warns before linking a gamertag that's never played here

• /link set and /link admin set now check whether the gamertag being linked has ever actually been seen on this server (real recorded stats, or currently online) before linking it ; if not, they warn instead of silently succeeding, and need confirm:true to proceed anyway.
• Found from a real case: an admin linked a member to a gamertag that turned out to belong to a different platform's account and had never once appeared in this server's logs. The link itself "worked" with no error, but every downstream command reading off it (Cash balance, achievements, stats) then silently showed nothing, with no indication the gamertag was ever wrong in the first place.
• This still can't verify real ownership (no RCON on this console server, same limitation as before) ; it only confirms the gamertag itself is real on this server, which catches the much more common typo/wrong-platform mistake.

v0.1.83New: /basedamage ; schedule raid protection by time and day

• New /basedamage ; turn base damage (and, independently, container damage) off during scheduled windows by day of week and time of day, e.g. "protected every night 10pm-6am" or "protected all weekend."
• Set a timezone once with /basedamage timezone, then build a schedule with /basedamage schedule-add/schedule-remove/schedule-list ; /basedamage containerdamage has the same controls for the separate container-damage flag.
• DayZ only reads this setting when the server itself restarts, and this bot can't force a restart, so nothing gets kicked off schedule changes ; the bot just keeps the setting queued and ready, and it takes hold whenever the server next restarts for any reason. /basedamage status shows both what's queued and what's actually live right now.

v0.1.82Clarity pass 2: the rest of the bot, plus a couple of real bugs it turned up

• /events is now /activitylog ; "event" already means five different things across this bot (DayZ dynamic events, admin-created events, rotation pool entries, bench/range bonus moments), so the generic connect/disconnect/kill/position log gets its own name.
• Fixed a leftover from the last update: several bench/range shop items and flavor lines still said "PR" instead of "best"/"record" (Wraps slot label, Personal Trainer, Wrist Wraps/Knee Sleeves/Full Support Gear, Adrenaline Shot, and two of the three legendary-moment flavor lines).
• /ticket add|remove|transfer|priority|rename|thread were labeled "(staff)" but actually required full Administrator ; fixed to match their label, so anyone with the configured mod role can use them, same as claim/unclaim/closerequest already could.
• Player-visible messages no longer show raw internal log tags ("Source: ADM/RPT") ; removed from /player locations and every live feed embed (position, connect, disconnect, death).
• /channel list now shows friendly channel-type names instead of internal slugs (e.g. "Territory Flag" instead of "flag"). /status no longer shows raw byte-offset debug info.
• Event/rotation announcements: dropped the internal "rotated in" phrasing, no longer show a raw file path when an admin didn't set a friendly name, and a nameless entry now just says "New Event" instead of "New Event: Unnamed Event".
• Assorted smaller wording fixes across /achievements, /classname, /distance, /dev, and a dead leftover menu entry removed from /createevent.

v0.1.81Clarity pass: friendlier names and wording across the player-facing commands

• /bench pr is now /bench best, matching /range best ; "PR" is renamed "Best Lift"/"Best Distance" everywhere it shows up.
• /link whoami is now /link status. /opt is gone ; its job moved to /casino global-chips (admin), right next to the rest of the casino settings it actually controls.
• /ban-smile is now /fake-ban. /leaderboard's wealth category was mislabeled "Cash" when it's actually Dollars ; fixed, plus "KDR" now spells out "Kill/Death Ratio".
• New /game currencies ; a plain-language rundown of all six currencies (Dollars, Plates, Bullets, Cash, Chips, Salvage), what each is for, and how to earn/spend it.
• Assorted description and reply wording cleaned up across /store, /economy, /bounty, and elsewhere for anyone new to the bot.

v0.1.80New: developer override, dev-only guild deactivation, and manual banlist review

• The bot's developer now passes every admin/moderator-gated command in any server, joined or not yet configured ; no more depending on that server's own permission setup to fix or configure things.
• New /dev guild-deactivate/guild-reactivate/guild-list (developer only) ; makes the bot go fully quiet in a specific server (no commands, no messages, no polling) without leaving it or losing its data.
• The global watchlist used to auto-verify an entry the instant 2 servers reported the same gamertag, with no human review. New reports still show up immediately as Unverified, but reaching Verified now requires an explicit approval in a review channel ; a new "Rejected" tier records an explicit decline separately. Already-verified entries were grandfathered so nothing regresses.

v0.1.79New: /keyword channels-add ; mass-scope every keyword response at once

• Restricting where keyword responses fire used to mean scoping each keyword individually via /keyword channel-add, one at a time. New /keyword channels-add/channels-remove set a server-wide channel list instead ; once any are set, every keyword response (including ones added later) only ever fires in those channels, full stop. /keyword list now shows this alongside each keyword's own scope.

v0.1.78New: moderator role, encrypted backup export, and confirm-before-delete on bulk actions

• New /setup mod-role: a lower-trust role (below full admin) that can now handle day-to-day banlist reports/disputes and ticket claim/close, without needing full Administrator access.
• New /setup backup-export; download this server's full BenchBot data as an encrypted file, on demand. Nitrado/FTP credentials are always redacted from the export. No restore command yet.
• /purge and /ticket closeall now ask for confirmation (same Danger/Cancel button style as /store admin cash-wipe) before permanently deleting messages or closing every open ticket: both used to fire immediately with no way to back out.

v0.1.77Fix: Cash balances now display as real currency, not raw floats

• A Cash balance could display as something like 1002284.8332666666: the automatic playtime reward was crediting a raw, un-rounded fractional amount straight to the ledger instead of rounding to the nearest cent. Every Cash amount and balance shown anywhere (/store, purchase confirmations, the Cash Earned feed, admin give/take/set) now renders like real currency: $1,002,284.83, capped at 2 decimal places with a dollar sign.

v0.1.76Internals: non-blocking data persistence, wider retry coverage, richer health metrics

• Saving guild/global data used to write to disk synchronously, blocking the whole bot for every write: now fully async, with a new per-file write queue so two saves to the same file (a command racing a poll cycle, say) always land safely in order instead of corrupting each other.
• Sending a live-feed batch to Discord now retries once on a timeout or a 5xx before giving up, instead of silently dropping the whole batch on a single blip.
• /health's JSON now also reports memory usage, last poll-cycle duration, pending-write queue depth, and retry/failure counters: purely informational, no change to the existing healthy/unhealthy signal.

v0.1.75Style: every embed, reply, and DM now uses a semicolon instead of an em dash

• Purely cosmetic ; every user-facing string across the bot (embed titles/descriptions/fields, replies, DMs, autocomplete text) had its em dashes (; ) swapped for semicolons (;). Code comments were deliberately left untouched.

v0.1.74New: /setup farewell-dm ; opt this server out of the farewell DM

• The farewell DM added last version is opted in by default (unchanged) ; /setup farewell-dm choice:No now lets a server opt out entirely, same yes/no framing /casino global-chips already uses for the shared Casino Chip economy. /setup view shows current status.

v0.1.73New: a farewell DM when a member leaves

• Whenever someone leaves (or is kicked from) the server, the bot now DMs them a short, warm goodbye ; thanks for the time spent, an invitation for feedback, signed "; {Guild Name} Admins". No setup required, and it fails silently for anyone with DMs closed or who has blocked the bot.
• Sent alongside the existing Moderation Log "Member Left" post, not instead of it ; the two are independent (the DM has no channel dependency at all).

v0.1.72New: Cash Earned feed ; players now actually see when they earn Cash from playing

• Cash earned from live gameplay (kills, PvP hits, base building, flag raises, playtime, travel, zone visits) used to only ever silently update a gamertag's balance ; nothing ever told a player it happened. Set up a Cash Earned channel (/channel create) and every payout now posts there: who, how much, and what triggered it (with location, when the triggering event had one).
• Naturally rate-limited by each reward's own existing cooldowns/thresholds (unlike the loot feed), so this uses the same per-event batching every other feed already uses, not a condensed summary ; routed through the normal REPORT_CASH_EARNED toggle (on by default).
• A reward configured to 0 (an admin turning that source off via /store admin config) now correctly produces no notification either, instead of announcing "earned 0 Cash."

v0.1.71/bounty overhaul: configurable duration, paid tracking pings, full admin config

• Duration is no longer a fixed 14 days ; /bounty place gained duration_days (extending past the server's basic duration costs a per-day fee) and tracking:true, a paid add-on that pings the target's last-known location in the bounty channel on a repeating interval. Both are one-time, non-refundable costs, charged up front alongside the reward ; only the reward itself is escrowed and refunded on cancel/expiry/unclaimed-expiry, same as before.
• New: /bounty admin config ; minimum and maximum reward, the free "basic" duration and the cost per extra day, the maximum duration a placer can pay up to, tracking's one-time cost and ping frequency, and the claim window (previously a fixed 7 days). Every number in this feature is now tunable per server.
• /bounty list now shows each bounty's duration and flags tracked ones.

v0.1.70New: /lootfeed map ; a color-coded map of where loot has actually spawned

• New: /lootfeed map [days] renders a dot per recorded loot spawn location on your server's map, color-coded by classname ; the top classnames (by how often each has spawned) each get their own color, everything else shares one "Other" color, with a legend in the reply naming each. No on-image text (same reason /player track uses colors instead of labels ; no font is guaranteed to be installed on this host), so identity comes from the legend, not the image itself.
• Backed by a new bounded history (up to 5,000 recent "added" spawns, oldest evicted first) recorded automatically whenever the loot feed is on ; depleted/removed events aren't plotted, since they mark something that was already there going away, not a new spawn location.
• Read-only and open to everyone, same treatment as /heatmap and /player track ; only /lootfeed channel (the auto-posting config) is admin-gated.

v0.1.69Loot feed gets its own dedup budget ; high volume can no longer evict other feeds' recent history

• A busy loot cycle (hundreds of add/depleted/removed events) previously shared the same 500-entry recent-events cache as every other feed type ; enough loot in one cycle could evict recently-seen kills/hits/chat/etc. purely because of volume, not because they were actually stale, risking a rare double-processed non-loot event (double-counted Cash/stats, a duplicate feed line).
• Loot events now dedupe against their own separate, much larger budget (5,000 vs. the shared 500) ; this was the one real correctness cost of routine loot volume; everything else about it (parsing cost, per-event bookkeeping, and ; most importantly ; the single condensed Discord message per cycle regardless of count) was already cheap and doesn't scale with volume.

v0.1.68Fixed: a single failed Discord login could take the whole bot fully offline

• Caught live: client.login() rejected on a transient Discord API 500 (fetching gateway info, before the websocket even opens) ; with nothing else keeping the event loop alive yet (no timers/listeners exist until 'ready' fires), the whole process quietly exited instead of crashing loudly. PebbleHost's own auto-restart then backed off after a couple of quick repeats, leaving the bot fully offline until someone noticed and restarted it by hand.
• Login now retries with capped exponential backoff (5s up to 5 minutes), indefinitely, on any transient failure ; a Discord API hiccup or network blip self-heals the moment it clears instead of requiring manual intervention. An actual invalid/revoked token (401) is treated as the permanent misconfiguration it is and does NOT retry forever ; logged clearly instead of buried under identical retry lines.

v0.1.67New: /lootfeed ; a condensed feed for Central Economy loot placement/cleanup

• New: /lootfeed channel channel:<> designates where the bot posts a condensed summary of routine loot activity ; items added, depleted (fully used up), and removed (cleaned up) by the server's own economy. Off by default via a new REPORT_LOOT setting (Bone.env) even after a channel is set ; this is the single highest-volume thing this bot can parse, so it stays opt-in.
• Deliberately condensed: one embed per poll cycle with pure aggregate counts (e.g. "+ Added: 47 ; BalaclavaMask_White x12, ZmijovkaCap_Red x8...") and the top spawned classnames, never a message or field per individual item the way every other feed here works ; a busy server can log hundreds of these lines a cycle.
• A routine performance-warning line ("[CE][LootRespawner] ... is hard to place, performance drops") is correctly ignored ; it's diagnostic noise, not a real add/cleanup event.
• /setup view now also shows the configured Loot Feed Channel alongside the rest of your config.

v0.1.66Added Community Terms & Software License notice to onboarding and /setup view

• The bot now posts a one-time welcome message when it joins a new server (in the system channel, or the first channel it can post in) introducing /setup and including: "By using DayZ Nerd Squad™ services, you acknowledge and agree to our Community Terms and Software License."
• The same notice now appears in /setup view's footer, so it stays visible any time an admin checks their configuration ; not just once on joining.

v0.1.65New: /keyword channel-add | channel-remove ; stop keywords firing in unrelated channels

• A keyword fires in every channel by default, same as before ; but you can now restrict one to specific channels with /keyword channel-add word:<> channel:<>, and undo it with channel-remove (removing the last restricted channel reverts a keyword to firing everywhere again).
• /keyword list now shows each keyword's current channel scope alongside its response text.
• Existing keywords from before this update are unaffected ; they keep firing everywhere until you explicitly scope them.

v0.1.64Removed /store sell

• /store sell and item-add's sell_price option are gone ; Corna Store is buy-only now. Existing catalog items keep whatever sellPrice they had stored, but nothing reads it anymore.

v0.1.63Fixed: purchases now actually spawn ; Corna Store rewritten to use this server's real object spawner

• A live test purchase confirmed the previous mechanism (writing a custom event into db/events.xml + cfgeventspawns.xml, the Central Economy system) completed and deducted Cash but never actually spawned anything ; this server's mission setup uses DayZ's separate "Custom Files" object spawner (the same vanilla mechanism /rotation already manages for its own file pool) for admin-placed static objects, not a CE event.
• /store buy now writes purchases into custom/BenchBotStore.json, registered once in cfggameplay.json's object spawner list ; confirmed against a real live spawner file's exact schema (field names, nesting, and pos/ypr axis order) before shipping, not guessed from documentation. Still spawns after the next restart and is auto-removed 15 minutes after that, same as before.
• Saved locations now include height/elevation, not just X/Y ; this file format has no terrain-snap fallback the old mechanism had, so an accurate height matters. /store setlocation gained a height option; last-known in-game positions already had this data captured (poller.js) but it was never surfaced until now.
• /store buy gained optional x/y/height options to spawn at custom coordinates for just that one purchase, without touching your saved location ; the player now genuinely chooses between "use my saved spot" and "type coordinates this time," not just one or the other.
• The "no saved location yet" button (added last version) now opens a 3-field modal (X/Y/Height) prefilled from your last known in-game position when available ; accept as-is to use it, or edit any field to enter your own.
• The Purchase Complete confirmation now shows the actual spawn coordinates and nearest town, so a purchase is never silently opaque about where it's headed.
• A saved location from before this update (missing height) is treated the same as "no location" ; you'll be prompted to set one again with the new 3-field flow rather than risk a purchase spawning with a broken/missing elevation.

v0.1.62/store is now Corna Store ; visual identity, easier location-setting, bulk economy admin tools

• The shop is now branded Corna Store throughout, and every /store embed has its own color and 🛒 icon instead of sharing UI_COLOR.gold + the generic money icon with every Discord-side minigame (/economy, /casino, /bench, /bounty, /expedition, ...) ; Cash now reads as visibly different from Dollars/Plates/Bullets/Chips/Salvage, not just a different word.
• Fixed a real label collision behind that confusion: /economy and /bank balances showed a "Cash:" row under your Dollars ; now labeled "On Hand:" so it no longer looks like the same currency /store uses.
• /store buy now offers a 📍 Set Location button right in its "no saved location yet" reply ; opens a coordinate form and saves it in place, instead of only pointing you at a separate /store setlocation command.
• Every gamertag option that means "your own gamertag" ; /clan create|join|leave|disband ; is now optional and falls back to your /link, matching how /store's own commands already worked. No player should ever have to type their gamertag twice once linked.
• New: /store admin config starting_balance ; sets the Cash a brand-new gamertag starts with (applies the moment their ledger record is first created, however that happens).
• New: /store admin cash-give-all ; pays every gamertag with an existing Cash balance at once.
• New: /store admin cash-wipe ; permanently deletes the entire Cash ledger (balances, earn cooldowns, travel progress) after a button confirmation. Everyone restarts fresh at starting_balance next time they're touched.

v0.1.61Feed cleanup: emoji channel names, clearer hit/death/location info

• Every channel /setup auto-channels creates now leads with its own emoji instead of a "dayz-" word prefix (e.g. #dayz-kill-feed is now #💀-kill-feed) ; applied consistently across feeds, dynamic events, games, utilities, and tickets. /remove auto-channels already knows the new names, so it still cleans up correctly.
• /setup auto-channels no longer creates a dedicated chat-log channel ; /channel create type:chat is still available any time you want one manually.
• The hit feed now shows the victim's remaining HP when the log line includes it.
• The kill feed no longer attaches a zoomed map-crop image ; the embed's own coordinates/nearest-town/map-link fields already cover it without an extra render per kill.
• The death feed no longer reports a hedgy "Likely Dehydration + Bleeding (N sources)" ; active bleeding (fast blood loss) is now reported as the cause outright whenever any bleed source is present, since low water/energy are near-universal by the time any survivor dies and aren't a reliable co-factor. Dehydration/Starvation only show up when there's no bleeding to explain it.
• "Nearest Town: Wilderness" is gone for good ; nearestTown now looks within 1000m (down from 2000m) and simply omits the Nearest Town field (or falls back to coordinates, for the one field that only shows one or the other) when nothing is actually nearby, instead of showing a hollow placeholder next to coordinates that were already right there.

v0.1.60New: /store admin Cash commands, and /remove auto-channels

• New: /store admin cash-give|cash-take|cash-set ; directly credit, debit, or override any gamertag's Cash balance. cash-take clamps at 0 instead of going negative; cash-set is a hard override for correcting mistakes.
• New: /remove auto-channels ; the "off switch" for /setup auto-channels. Deletes every channel/category it created (feeds, dynamic events, games, utilities, tickets), requires confirm:true since this is permanent and takes each channel's message history with it. A category is only removed once it's empty, so anything renamed or added manually is left alone. Run /setup auto-channels again any time to recreate everything from scratch.

v0.1.59More ways to earn Cash: PvP hits, base building, flag raising

• Landing a hit on another player, placing a base structure (fence, watchtower, shelter, etc.), and raising a territory flag now all pay out Cash automatically, on top of the existing kill/playtime/travel/zone rewards.
• PvP-hit rewards are cooldown-gated per attacker-victim pair, not a single global cooldown ; so it throttles two players farming each other on repeat without also throttling someone fighting several different real opponents in a row.
• Base-building and flag-raising rewards use a flat per-player cooldown each, since there's no "pair" involved in a solo construction action.
• All six new rates are tunable via /store admin config: hit_reward, hit_cooldown_min, build_reward, build_cooldown_min, flag_reward, flag_cooldown_min.

v0.1.58/store UX overhaul: /store view replaces /store list

• /store view browses Items, Kits, and a new My Account category via a dropdown that swaps the embed in place ; same pattern /shop view already uses. Each item/kit shows a live affordability indicator based on your own balance (if linked via /link, or you can still pass gamertag directly) plus a ready-to-copy buy command, so you never have to remember or retype an exact name.
• My Account shows your Cash balance and saved spawn location together in one place, alongside prompts to /link or /store setlocation if either isn't set yet.
• /store admin's configuration subcommands are unchanged ; this overhaul is entirely player-facing browsing, not the admin catalog-management commands.

v0.1.57/store is complete: zones and selling (4/4)

• New: /store admin zone-add|zone-remove|zone-list ; repeatable, cooldown-gated Cash rewards for visiting a defined area (a real "reason to travel there" mechanic, not a one-time discovery bonus). Any live event with coordinates counts as a visit, not just position pings, so actively playing in a zone (fighting, building) earns it too.
• New: /store sell classname:<> qty:<> ; pays out Cash for anything an admin gave a sell price via item-add's sell_price option. Self-attested, same trust model as everywhere else in this bot that reads a player-claimed value.
• This closes out the /store + Cash economy build: real-item purchases with saved spawn locations, kits, automatic earning (kills/playtime/travel/zones), selling, and account linking, all shipped incrementally over the last several updates.

v0.1.56New: Cash is now earnable automatically ; kills, playtime, travel (3/4)

• Every player kill, every hour spent online, and every 1000m actually traveled now pays out Cash automatically ; no command needed, it just accrues in the background from the same live feed everything else reads. Rates are tunable via /store admin config kill_reward | playtime_reward_per_hour | travel_reward_per_1000m.
• A single unrealistic position jump (reconnecting across the map, a teleport) is not counted as travel ; only genuine, plausible movement between two real position pings.
• Still coming: earning Cash by selling items back, and zone-based rewards for visiting specific places.

v0.1.55New: /link ; link your Discord account to your gamertag

• /link set gamertag:<> links your account (self-attested ; there's no way to automatically verify you own a gamertag, same trust model /clan and /bounty already use ; an admin can fix a bad link with /link admin set). /link remove, /link status, and /link lookup gamertag:<> round it out.
• /store's gamertag options are now all optional ; link once, then /store balance, /store setlocation, and /store buy all use your linked gamertag automatically if you don't specify one. Built as a general-purpose primitive (src/lib/guards.js's requireGamertag()), not store-specific, so future features needing player identity can reuse it too.

v0.1.54New: /store buying is live ; kits, saved locations, one-time spawns (2/4)

• /store setlocation gamertag:<> [x] [y] saves where your purchases spawn (omit x/y to use your last known in-game position). /store buy gamertag:<> item:<>|kit:<> deducts Cash and spawns the purchase there after your DayZ server's next restart ; removed automatically 15 minutes after that restart so it only ever spawns once, reusing the exact same mechanism /createevent's Vehicle spawns already use.
• New: kits (/store admin kit-add|kit-additem|kit-removeitem|kit-remove) ; bundle several different classnames under one price and one purchase.
• Still coming: automatic ways to earn Cash (kills, playtime, travel, zones) and /store sell.

v0.1.53New: /store foundation ; a real-item shop, priced in a new Cash currency (1/4)

• First stage of a new real-item shop: /store list (browse), /store balance gamertag:<> (public), and /store admin item-add|item-remove (configure what's for sale, classname autocompletes against /classname's 1,941+ entry catalog).
• Cash is a brand-new currency, tracked per gamertag rather than per Discord account ; deliberately separate from the existing Dollars/Bullets/Plates economy that powers /bench, /range, /casino, /economy (those are untouched).
• Not live yet: actually buying something (items spawn at a location you save, removed automatically 15 minutes after the next server restart so they only ever spawn once), kits, and the several ways to earn Cash (kills, playtime, travel, zones, selling items). Coming in the next few updates.

v0.1.52New: Weekly Recap Digest ; a narrated "this week" summary, auto-posted every 7 days

• Set up a Weekly Recap Digest channel (/channel create type:weeklydigest or /setup auto-channels) and the bot posts a recap there once a week: top killer, most deaths, longest kill (only counts a genuinely new personal-best distance, not just any kill), the most-contested zone that week resolved from real kill locations, and top clan if /clan is in use.
• All numbers are scoped to that week specifically ; diffed against a snapshot taken at the last digest, not the all-time totals /leaderboard already shows. A brand-new server's first digest lands a week after setup, not immediately with empty stats.

v0.1.51New: /clan ; self-serve clans and a clan leaderboard

• /clan create|join|leave|disband|list|leaderboard. Membership is by gamertag, self-attested (same trust model as /bounty claim) ; no Discord account linking involved. /clan leaderboard ranks clans by combined member kills, pulling from the same stats /leaderboard already tracks.
• Ownership passes automatically to another member if the owner leaves; a clan disbands itself automatically once its last member leaves.

v0.1.50New: Raiding detection ; /detect's 7th heuristic

• Fires when a player places an improvised explosive, or dismantles a base structure (fence, watchtower, territory flag, barbed wire, shelter), somewhere far from anywhere they've actually been seen recently ; a proxy for "this looks like someone else's base," not their own. Uses the same movement history /player track already collects, not a new log format.
• Same admin controls as the other 6 detectors: /detect status/toggle/config raiding, its own cooldown, posts to the shared behavior-alert channel (or its own via /channel create type:raiding).
• /channel list's 6 individual behavior-alert fields (already at Discord's 25-field cap) are now one consolidated field alongside the new 7th ; same technique already used for dynamic-event sub-types.

v0.1.49Fix: /rotation now cycles through the pool in order instead of drawing randomly

• Previously each rotation randomly shuffled whichever pool files weren't currently active ; no immediate repeat of the same file, but no guarantee every file ever got a turn either (could favor a handful of entries indefinitely while skipping others). Now it's a sequential cursor: every file in the pool is visited once before any repeat, wrapping back to the start after the last one.

v0.1.48New: AI-generated rotation announcement text

• /rotation pool add now takes an auto_generate:true option ; when set and no description is given, the bot writes a short radio-dispatch-style announcement itself instead of you typing one. Generated once at creation time (not per-announcement) and stored the same way a manually-typed description is, so {town}/{server} substitution and everything else works identically either way.

v0.1.47New: /ask ; a player-facing AI command

• Open to everyone, no permission gating ; ask it DayZ questions or just chat. 30-minute cooldown per person (only charged on a successful answer, so a hiccup doesn't burn your window).
• Runs on the Claude API. If no key is configured yet, it replies with a friendly "not set up" message instead of erroring.

v0.1.46New: Death Cards ; a shareable kill snapshot on every solo kill

• Every kill feed post now includes an auto-generated image when exactly one kill happens in that cycle: a zoomed map crop centered on the kill location with a crosshair marker. Reuses the same map-background rendering /heatmap and /player track already use, so it needs no new setup and automatically uses your real map images if you've added them.
• Killer/weapon/distance stay in the embed's own fields as text (not baked into the image) ; kept the image itself clean and avoided any font-availability risk on the host.
• Multi-kill cycles keep the existing plain embed (no image) ; one image slot can't represent several different kill locations at once.

v0.1.45Fix: hordes couldn't spawn in towns, and their zone was named wrong

• Horde events created via /createevent used a 100m saferadius and 500m distanceradius by default ; DayZ requires that much clear space from every other active CE event before a spawn is allowed, which city centers essentially never have, so a horde dropped in a town would silently never spawn at all. Both are now 0 by default (cleanupradius, which only governs loose-item cleanup and doesn't block placement, is unchanged).
• Also fixed a naming bug: a horde's territory zone (env/zombie_territories.xml) must be named exactly the same as its event (db/events.xml) ; this was using two different naming conventions, which meant every horde's zone silently never matched its event. Browse/Remove/Edit fall back to the old naming for any horde created before this fix, so existing ones stay manageable.
• New: /createevent → Edit Zombie Count lets you change an existing horde's zombie count without recreating it from scratch.

v0.1.44Fix: dynamic-event/vehicle-spawn feeds were completely silent on some servers

• Found the actual root cause behind every dynamic-event and vehicle-spawn channel (heli crash, military convoy, police situation/car, santa's sleigh, train, contaminated area, vehicle spawns) never receiving anything: this bot only recognized one RPT spawn-log phrasing ("(child) Spawned Name EventID:[N] CurrentID:[N] at [...]"), but some servers only ever emit a second, differently-phrased family instead ("[CE][DE] [Name] Spawning: EventID:[N] CurrentID:[N] at [...]") ; which simply matched nothing, silently. Both formats are now recognized side by side, including the same candidate-position-retry collapsing added for the first format. Routine NPC/economy spawns this line family also logs (vendors, survivor NPCs, mortars, ...) are deliberately excluded rather than dumped into the catch-all channel.

v0.1.43Removed RPT health monitoring ; too much engine noise, too little signal

• The generic RPT error/warning scanner added in 0.1.38 turned out to mostly surface routine modded-server engine chatter (missing model geometry, physics layer mismatches, missing animation files, type-inheritance config errors, preset load errors) no matter how many noise patterns got added to its exclusion list ; a losing game against every DayZ/Enfusion diagnostic category. Removed entirely rather than keep chasing it. RPT's actual value to this bot is Central Economy dynamic-event/vehicle spawns, which was already a separate, dedicated feed (and just got its own fix in 0.1.42) ; that's what stays.

v0.1.42Fix: duplicate-looking dynamic-event/vehicle spawns from CE placement retries

• Central Economy retries several candidate positions for one spawn attempt before settling on a spot (confirmed real sample: the same VehicleBoat spawn logged 12 times at the exact same millisecond, each with different coordinates) ; every retry was being reported as its own separate spawn event. Now collapsed to one event per spawn (CurrentID), keeping the last-logged position.

v0.1.41Fix: log downloads could silently re-fetch the whole file instead of just new bytes

• Found the likely root cause behind two earlier symptoms at once ; an RPT error count that never seemed to shrink cycle to cycle, and the sustained Nitrado HTTP 500s on log downloads: some Nitrado file-download URLs don't honor the Range request this bot sends to fetch only new bytes, and silently return the ENTIRE file with a 200 instead of a 206 Partial Content. That was being treated as "just the new bytes," re-parsing everything from byte 0 every cycle and advancing the tracked offset by the full file size instead of the true delta ; which snowballs into a nonsensical offset within a few cycles and would explain the file becoming unservable. Now detected and handled: the response is sliced locally to just the true new portion, and the offset tracks the real file length either way.

v0.1.40RPT health: ignore missing-asset load failures too

• "Can't load ..." engine errors (missing/mismatched mod animations, models, textures ; confirmed real sample: ~326/cycle of "Can't load sakhal/Anims/cfg/skeletons.anim.xml" on one server) are now excluded from RPT health monitoring, same treatment as the other known-benign mod-asset noise. Not something actionable from this bot, so it no longer counts toward totals or shows up in the health digest.

v0.1.39Critical fix: /player track was silently crashing every poll cycle

• playerTrackSamples (added in 0.1.36 for /player track) was missing from loadGuildData()'s per-field merge ; every already-saved guild file came back with it undefined, so the very first position ping each cycle threw and aborted that entire poll cycle before anything got sent to Discord. Fixed, and added a regression test that checks every defaultGuildData() field survives loading a save file that predates it, so this class of bug can't silently ship again.

v0.1.38RPT health monitoring ; surfaces real errors, ignores engine noise

• Every poll cycle now scans the freshly-downloaded RPT chunk for genuine engine errors/warnings, filtering out known-benign noise (mismatched model geometry, unknown object classes, physics interaction-layer warnings ; the kind of lines that fire constantly on a modded server and mean nothing). Real errors always get logged to bot.log immediately; if any turn up, a summary embed posts to the Moderation Log channel too, throttled to once per 15 minutes so an ongoing issue doesn't spam. This is exactly the kind of signal that would have caught the recent 300MB+ runaway RPT file causing Nitrado download failures without needing a manual log dig.

v0.1.37Real map backgrounds are live

• Chernarus and Livonia map images are now in place at data/maps/ ; /heatmap and /player track render against the real map instead of the plain grid fallback from now on. No command changes; this just activates the background-image support added in 0.1.36.

v0.1.36/player track + own Utilities channel category + map backgrounds

• Added /player track ; plots recorded position pings on the map, either for one named player or every currently online player at once (each in its own color, up to 8 at a time), similar to how iZurvive plots live player positions. Backed by a new bounded per-player ping history, fed from genuine position-ping events only (not every kill/hit/build, so it stays an accurate movement trail).
• /setup auto-channels now creates a "🛠️ BenchBot Utilities" category for mod-log, suggestions, giveaways, bot-trap, and a new dedicated heatmap channel ; split out from the DayZ event feeds since these are on-demand/interactive rather than a streaming feed. /heatmap and /player track now post there automatically when it exists.
• Both map renderers now use a real map image as the background automatically if one is dropped in at data/maps/<mapSlug>.png ; falls back to the existing grid background if none is present. This project doesn't source or bundle map imagery itself (licensing); deploy.cjs picks up whatever's in data/maps/ automatically once added.

v0.1.35Fix: spurious duplicate position events + auto-bans now purge messages

• Found and fixed a real bug behind the Player Position Updates feed looking flooded with redundant entries: the position-line pattern matched "Player \"X\" ... pos=<...>" anywhere in an ADM line with no anchor, so every single kill, hit, construction, connect, disconnect, teleport, chat, or emote line ; which all carry pos=<...> of their own ; was ALSO silently generating a second, spurious position event alongside its real one. It's now anchored to only match genuine standalone position-ping lines. Internal position tracking (used by /player locations) now reads coordinates directly off whichever event just happened instead of relying on that side effect, so nothing about location freshness was lost.
• Auto-bans (bot-trap, auto-mod) now also purge the banned user's messages across the whole server ; up to Discord's own 7-day maximum ; instead of leaving everything but the one triggering message in place.

v0.1.34Developer-locked commands + flagged bot-trap channel

• /resetlogs is now locked to the bot's developer only (whoever owns this bot's Discord application, plus anyone listed in the new DEV_USER_IDS setting) ; no server's own Administrator or BenchBot-admin role can run it anymore, since it resets bot-internal parsing state rather than anything server-specific.
• The bot-trap channel is no longer disguised ; /setup auto-channels now creates it as an obviously-named "do-not-post-here" channel with a pinned warning embed and a matching channel topic, and /setup bot-trap now posts that same warning when an admin manually designates an existing channel. Anyone but staff who posts there is still banned instantly, unchanged.

v0.1.33Fix: ID collisions on fast concurrent /ticket, /giveaway, /suggest

• A full diagnostic pass found a real race condition in three places: /ticket (via the public "Open a Ticket" button), /giveaway start, and /suggest each computed their next ID before an awaited Discord API call (creating the channel/sending the message) and only recorded it afterward ; two calls close together (a fast double-click, or two different members acting seconds apart) could compute the same ID before either was recorded, corrupting later lookups. Each now reserves its ID immediately, synchronously, before any network call, with a rollback if that call fails.

v0.1.32Crash safety net + /about credits update

• Added global unhandledRejection/uncaughtException handlers ; an error anywhere in the process (including any of the many fire-and-forget async calls throughout the bot) used to be able to kill the whole process with nothing written to bot.log, making a real crash indistinguishable from the process just being idle. Every such error is now logged with a full stack trace first.
• /about now also credits Purejukes and NVG's for working alongside Bench on the community, and Blackout Austin for testing.

v0.1.31Moderation Log + Suggestions (stage 4 ; Server Tools batch complete)

• New Moderation Log ; automatic logging of message edits/deletes, member joins/leaves, nickname/role changes, and bans/unbans, once a Moderation Log channel is set up (/channel create or /setup auto-channels). Auto-Mod actions and triggered Bot Trap events already routed here since their own updates; this is everything else.
• New /suggest text:<> posts to this server's Suggestions channel with 👍/👎 reactions pre-added. New /suggestion resolve id:<> status:<accepted|denied|implemented> [reason] (admin) updates the original post to show the outcome; /suggestion list shows what's still pending.
• This completes the Server Tools batch started a few updates ago: Purge, Auto Role, Links, Auto-Mod, Bot Trap, Reaction Roles, Giveaways, Moderation Log, and Suggestions.

v0.1.30Reaction Roles + Giveaways (stage 3 of the Server Tools batch)

• New /reactionrole create | addrole | removerole | list | remove ; post a panel, then attach emoji → role mappings to it one at a time. React to get the role, remove your reaction to lose it ; real emoji reactions, not buttons. Works indefinitely across bot restarts, same guarantee as the ticket panel button.
• New /giveaway start | reroll | list ; react with 🎉 to enter, winners picked automatically when it ends (checked every 30s, independent of the DayZ poll cycle so it works even without Nitrado configured). /giveaway reroll re-picks from the current reactors at any time after ending.
• Both rely on the GuildMessageReactions intent added in the previous update, plus message/reaction partials so reaction events keep working on messages the bot hasn't seen since its last restart.

v0.1.29Auto-Mod + Bot Trap (stage 2 of the Server Tools batch)

• New /automod ; 5 independently toggleable checks (Spam/Flood, Mass Mentions, Discord Invite Links, External Links, Censored Words), each with its own configurable action (Warn, Delete, Delete + Timeout, Delete + Ban). Spam/Mentions/Invites default on with a mild Delete action; Links/Words default off since they're more prone to false positives. Every hit posts a notice in the channel it happened in, as requested.
• New /setup bot-trap channel:<#channel> ; a decoy channel that instantly bans (and deletes the message from) anyone who posts there, except real Administrators or the bot-admin role.
• Both route their record of what happened to the new Moderation Log channel type (/channel create or /setup auto-channels).

v0.1.28Server Tools: /purge, /setup auto-role, /links (stage 1 of a bigger batch)

• New /purge amount:<1-100> [user] (admin) bulk-deletes recent messages in a channel, optionally filtered to one user.
• New /setup auto-role role:<@role> automatically assigns a role to every new member who joins ; omit role to turn it off.
• New /links list | add | remove ; a curated list of useful links (rules, resources, socials, ...); list is public, add/remove are admin-only.
• Under the hood: the router now centrally wires every Discord gateway event (message edits/deletes, member joins/leaves/updates, bans, reactions), not just slash commands ; the foundation for the auto-mod, bot-trap, reaction-role, giveaway, logging, and suggestion systems coming in the next few updates. New non-privileged intents (GuildMessageReactions, GuildModeration) plus the already-enabled Server Members intent are wired in for that.

v0.1.27Fix: /createevent Vehicle and Horde spawns silently ignored by the server

• Custom Vehicle Spawn and Horde events created via /createevent were being written to db/events.xml without a type prefix DayZ's engine needs to figure out what kind of spawner they are ; confirmed against a real server log: "[DynEvent] 'X' will be ignored :: failed to determine spawner type!" for both an OffroadHatchback vehicle spawn and a horde. They were accepted by the bot and looked correct on inspection, but the DayZ server itself was silently dropping them at load ; nothing ever actually spawned.
• Vehicle spawns now write as Vehicle<classname>BenchBotEvent, hordes as InfectedBenchBotHorde_N, Airstrike/Gas Strike as StaticBenchBotAirstrike/StaticBenchBotGasstrike ; matching the prefix convention DayZ's own vanilla dynamic events already use internally (confirmed against this server's own bundled db/events.xml ; every vanilla Static* event follows this exact pattern).
• Backward compatible with anything already on the server from before this fix: Browse and Remove still recognize the old, unprefixed names, and creating a new Airstrike/Gas Strike/repeat vehicle pick reuses an existing old-named block instead of fragmenting it into two. Any vehicle/horde already silently failing to spawn needs to be removed and recreated once for the corrected name to take effect ; the old entries themselves aren't automatically fixed in place.

v0.1.26Dynamic Event channels moved to their own category

• /setup auto-channels now creates a separate "🔥 BenchBot Dynamic Events" category for the Central Economy spawn feed (the 7 specific event-type channels plus Vehicle Spawn and the Other/Unrecognized catch-all), instead of mixing them into "📡 BenchBot Feeds" with connects/kills/chat/etc. Bounty/Achievement/Leaderboard channels stay in the regular Feeds category ; they aren't part of the RPT spawn feed.

v0.1.25Dynamic Event Spawn feed split into per-type channels

• The Dynamic Event Spawn feed no longer dumps every spawn into one combined channel ; it now sorts each spawn into one of 7 specific event types (Heli Crash, Military Convoy, Police Car, Police Situation, Santa's Sleigh, Train, Contaminated Area), each routable to its own channel, plus a catch-all "Other/Unrecognized" channel for anything that doesn't match. Classification is based on the actual spawned classname, cross-checked against this server's own bundled DayZ mission files (both Chernarus and Livonia) rather than guessed ; Heli Crash in particular is confirmed against a real captured RPT line from earlier this session.
• /setup auto-channels now creates all 7 new channels (plus the existing catch-all and Vehicle Spawn channels) automatically, sorted into the same "BenchBot Feeds" category as everything else.
• /channel create's event-type picker switched from a fixed dropdown to search-as-you-type ; the full type list (now 30+ entries) no longer fits Discord's 25-choice cap for a dropdown.
• Note on confidence: Heli Crash, Santa's Sleigh, Contaminated Area, and Train are matched on unambiguous classnames. Military Convoy vs. Police Car vs. Police Situation lean on a shared naming convention (a "_DE" suffix + keyword) found consistently across this server's bundled mission files for both maps ; solid, but not verified against a real captured RPT line the way Heli Crash was. If any of the three look miscategorized in practice, flag it and it can be tightened.

v0.1.24/ticket closeall

• New /ticket closeall (admin) closes every currently open ticket at once, same as running /ticket close on each ; usable from anywhere, not just inside a ticket channel. Each one is still individually logged to the Ticket Log channel like a normal close.

v0.1.23Ticket system: quicksetup, claim/priority/threads, and auto-channels coverage

• /setup auto-channels now also creates a "Tickets" category with the panel channel (button posted automatically) and an admin-only ticket-log channel, plus routes the Bounty, Achievement, and Leaderboard feed channels ; previously all four needed to be set up by hand via /channel create.
• New /ticket quicksetup configures just the ticket side (staff role, log channel, panel) in one step, without touching every other feed/game channel.
• New in-ticket management commands, mirroring what dedicated ticket bots offer: /ticket add | remove a user, claim | unclaim | transfer ownership, priority (Low/Medium/High/Urgent ; shown in /ticket list and the channel topic), rename the channel, thread opens a private staff-only thread, close [reason] and closerequest (asks the opener to confirm before closing) as slash-command alternatives to the Close Ticket button. /ticket createticket opens a ticket without needing the panel button.

v0.1.22New /ticket support system

• New /ticket panel posts a persistent "Open a Ticket" button ; anyone can click it, pick a category (Player Report, Ban Appeal, Gear/Loss Claim, General Support), and get a private channel with the bot-admin role, under an auto-created "Tickets" category. A Close Ticket button (opener or admin) closes it and deletes the channel a few seconds later.
• New /ticket list (admin) shows everything currently open. A new Ticket Log channel type records who opened/closed each ticket and its category after the channel itself is gone ; metadata only, not a full message transcript.
• Under the hood: this is the first feature in the bot built on a persistent button, one that has to keep working indefinitely for anyone, across restarts ; every other interactive flow (/shop view, /createevent, ...) uses a short-lived collector scoped to one reply instead. Required adding real central button/select-menu dispatch to the router alongside the existing modal/autocomplete routing.

v0.1.21Live leaderboard channel + real-time achievement announcements

• New auto-updating Leaderboard channel type (/channel create) ; one message showing all 4 /leaderboard categories at a glance (top 5 each), edited in place as things change instead of reposted, and skipped entirely on cycles where nothing actually moved.
• New Achievement Unlocked channel type ; posts the moment anyone actually crosses a milestone instead of only surfacing it when someone runs /achievements to check. Combat/Survival unlocks are detected live off the same feed events that already update the stat ledger; Economy/Game unlocks (bench/range rank, wealth, first purchase) are swept once per poll cycle against current state rather than instrumenting every command that could change them.
• /bounty's fulfillment channel (added last version) works the same way and was already live ; just needed a Bounty Fulfilled channel set up via /channel create to route it.

v0.1.20New /heatmap

• New /heatmap category:<kills|deaths|dynamic events|vehicle spawns> [days] ; renders an actual density-map image (not a text approximation) from a new bounded position-sample log fed by the same live feed everything else already reads. No real DayZ satellite map is used (avoids licensing/scraping concerns) ; just a coordinate grid and faint town markers derived from this bot's own town reference data, with sample density rendered as overlapping warm blobs that brighten where activity clusters.
• Requires a new image-rendering dependency (@napi-rs/canvas) ; degrades to a clear error message rather than any crash if that hasn't been installed on a given deployment yet.

v0.1.19New /leaderboard, /achievements, and /bounty

• New /leaderboard ; per-server rankings (not bot-wide, unlike /expedition leaderboard): Wealth, Combat Kills, Combat KDR, Survival Playtime, one category picker like /help and /shop view. Backed by a new persisted per-gamertag stat ledger fed from the live kill/death/disconnect feed.
• New /achievements me | dayz ; small starter set of milestones (bench/range rank, wealth, first purchase on the Discord side; kills, longest confirmed kill, and playtime on the DayZ side). The two sides can't be linked to each other ; this is a console bot, and nothing anywhere in it maps a Discord account to a gamertag ; so achievements/leaderboards show real gamertags directly rather than pretending a connection exists.
• New /bounty place | list | cancel | claim ; player-vs-player bounties on a gamertag, paid from your own escrowed currency, auto-detected the moment that gamertag dies to another player in the live feed and announced in a new configurable Bounty feed channel. Claiming is a self-attested step (same trust model /banlist reports already use) since there's no way to auto-verify which Discord user actually got the kill. Unclaimed bounties refund automatically after 14 days (or 7 days past fulfillment).

v0.1.18Fixed a real location bug in the Dynamic Event / Vehicle Spawn feeds

• Fixed the root cause of Dynamic Event and Vehicle Spawn locations being wrong: the RPT central-economy spawn line ('(child) Spawned X ... at [X,Y,Z]') is a raw engine vector dump where Y is always height, not a ground coordinate ; but the parser was feeding that height value into the nearest-town lookup as if it were the real second ground coordinate, silently pulling every spawn's reported location toward whichever town happened to sit near that elevation band instead of where it actually spawned.
• Confirmed against a real captured spawn line before and after the fix, and against this codebase's own established x/z-ground, y-height convention (the same one /createevent already uses for cfgeventspawns.xml positions) ; the two were previously inconsistent for this one feed.
• Player positions, kills, deaths, and every other ADM-sourced feed were unaffected ; that log format already puts both ground axes first.

v0.1.17/shop view crash fixed ; now a category picker instead of one oversized message

• Fixed a real, live crash: /shop view with no category filter sent all three currency categories combined into one message, and Discord's 6000-char embed budget is a per-message total across everything in it, not per-embed ; that combination exceeded it and the command failed outright (confirmed from a real production error).
• /shop view now works like /help ; a dropdown to browse Dollars/Plates/Bullets one at a time, swapped in place, instead of a wall of text (or a crash). Passing a category directly (e.g. /shop view category:plates) still jumps straight to that one, same as before.

v0.1.16Full codebase review ; two currency-duplication bugs, a credential-loss bug, and a dozen smaller fixes

• Found and fixed two real currency-duplication bugs: a fast double-click on /casino blackjack's Stand or /expedition's Bank It could credit the same win/loot twice (both only guarded against re-entry after an await a second click could slip through before it landed). /expedition go also had no guard against stacking unlimited concurrent runs, letting its cooldown be bypassed entirely for repeated free loot.
• Found and fixed a credential-loss bug: if DATA_ENCRYPTION_KEY was ever wrong or got rotated, every guild's Nitrado token and FTP password got silently overwritten with nothing on the very next save ; which happens automatically on every boot. A failed decrypt now leaves the original value untouched instead of wiping it.
• The Discord client had no error handler at all ; a routine websocket hiccup could have taken the whole bot down as an uncaught exception. Added shard-error and warning handlers too.
• FTP mission-file writes (/rotation, the old /eventspawns) now roll back if the final rename fails, instead of potentially leaving the live server missing that file entirely. /status, /map, and /player online now defer before their sometimes-slow Nitrado calls instead of routinely failing with a stale-interaction error.
• The live behavior-detection feed no longer produces false Dupe/Boost/Join-Kill alerts (or silently masks a real one behind a cooldown) from the event backlog right after every restart, and Join-Kill alerts now point at the accused killer's actual location instead of their victim's.
• Smaller fixes: a near-max-length chat message could silently drop its whole batch past Discord's field cap; the error router's DM fallback used to send a redundant, misleading message even when the in-channel reply had already worked; a roulette refund could be lost if Discord's own reply failed; blackjack's Double had no server-side hand-size check; milestone bonuses under-paid when a single jump crossed more than one threshold at once.

v0.1.15/eventspawns replaced entirely by /createevent ; one guided command

• /eventspawns (11 subcommands across two subcommand groups) is gone, replaced by a single /createevent command with a fully dropdown- and modal-driven flow: pick Create / Browse / Remove / Scheduled Cleanups, then a category (Airstrike, Gas Strike, Custom Vehicle Spawn, or Horde), then whatever that category needs ; a vehicle from a real 20-option list, one or more zombie types from a real 15-group list (now including Infected Mummy), or straight to coordinates.
• Every category writes a fixed, purpose-built event (BenchBotAirstrike, BenchBotGasstrike, a per-vehicle-type event, or an auto-numbered BenchBotHorde_N) instead of borrowing a vanilla event's tuning like the previous version did ; Airstrike is a genuine new mechanic (an explosion effect), not just more helicopter-crash positions.
• New: an optional "remove after restart" toggle on every creation. When enabled, whatever was just injected ; the position, or for a horde the whole event and territory zone ; is automatically removed 15 minutes after your DayZ server's next restart (not 15 minutes after creation; it still needs that one restart to actually go live first). Scheduled removals survive both a DayZ server restart and a bot restart, and show up under /createevent's own Scheduled Cleanups view.

v0.1.14/eventspawns reworked around player-facing categories, plus a new Airstrike event builder

• /eventspawns add and addmany no longer work off a hand-maintained list of blocked filler types ; they now only offer event types that fall into one of four real categories: Vehicles, Heli Crashes, Gas Strikes, and Airstrikes. Anything else (ambient wildlife, police/military filler, and now also the Infected* family and StaticAirplaneCrate) is left alone by this tool ; use /eventspawns horde for infected hotspots, which already had its own correct mechanism. /eventspawns types|list|remove still show and manage everything really in the file, filler included.
• /eventspawns types now groups its list by category instead of one flat alphabetical dump, with an Other section for everything not currently creatable through this tool.
• New /eventspawns create category:airstrike name:<text> ; defines a genuinely new custom event (writes a new <event> block into db/events.xml, something this tool has never done before) by combining a real StaticHeliCrash's tuning with wreck and supply-crate loot, then adds a matching empty entry to cfgeventspawns.xml so /eventspawns add can immediately start placing positions for it. Needs a server restart before the new event definition takes effect.

v0.1.13Reliability pass ; logging, polling, rotation, dedup, and a real README

• Fixed a real crash path: the file logger had no error handler on its write stream, so a failed write (disk full, permissions) could take the whole bot down instead of just failing to log. It now falls back to console-only logging on a write failure, and skips opening the log file at all during automated tests so test runs can never touch or fight over the real bot.log.
• The 30-second poll loop can no longer overlap itself ; if one cycle is still running (a slow Nitrado response, for example) when the next one would fire, it now skips instead of starting a second cycle in parallel and duplicating requests or racing log-read offsets.
• /rotation can no longer race itself either ; it's fired in the background from the poll loop without waiting for it, so a slow FTP round trip used to leave a window where the next cycle could decide a rotation was due again and start a second one over the same remote file. Now locked per-server.
• The live-feed duplicate-event filter no longer grows without bound for the life of the process, and no longer collides two different same-second events from the same player (e.g. two builds one second apart) into looking like the same event ; the key now reflects everything that actually happened, not just when and who.
• README.md rewritten from scratch ; it was still describing a Python predecessor (bot.py, pip, .env) that hasn't existed for a while. Now covers actual setup, the real Node/Discord-based /setup flow, FTP-dependent features, per-guild vs. global state, and deployment.

v0.1.12/help rebuilt as a category browser, new /game list

• /help is no longer two static walls of one-liners ; it's now a dropdown you use to browse by category (Setup & Configuration, Detection & Moderation, DayZ Reference, Games & Economy, Misc), and every entry actually explains how the command works instead of just listing its subcommands.
• New /game list ; a dedicated, paged guide to every game and economy command with real detail: currency, cooldown, payout ranges, and the actual mechanic (push-your-luck odds, injury/jam chance, rob success rate, and so on). /help's Games & Economy category stays short on purpose and points here for the full rundown.
• /changelog's Prev/Next paging got pulled out into a shared helper, now reused by /game list too, instead of being copy-pasted.

v0.1.11Filler event types locked out of /eventspawns, plus horde territory zones

• A curated set of vanilla filler event types (StaticPoliceCar, StaticPoliceSituation, StaticMilitaryConvoy, StaticTrain, Staticpoxmortar, ambient wildlife, and the Christmas-only events) can no longer be added through /eventspawns add or addmany. Nothing changes in your real cfgeventspawns.xml ; this only stops new positions for those types being created through the bot; /eventspawns types | list | remove still work on them normally.
• New /eventspawns horde types | add | addmany | list | remove manages zombie horde territory zones in env/zombie_territories.xml (a real vanilla DayZ mission file, not a mod) ; the mechanism behind persistent infected hotspots like InfectedArmy and InfectedVillage. Set a center point, radius, and how many infected spawn as players approach (dynamic) vs. are always present (static, costlier on performance).
• horde types only lists group names actually defined in db/events.xml with the right settings to read from this file ; nothing is invented, and it's flagged if a group is currently turned off there.
• Same safe backup-then-swap FTP write pattern as the rest of /eventspawns and /rotation.

v0.1.10New /eventspawns ; add spawn positions to cfgeventspawns.xml

• New /eventspawns add lets you drop a new spawn position (X/Z, optional facing angle and elevation) onto any event type that already exists in cfgeventspawns.xml on your Nitrado server ; vehicles, heli crashes, item piles, and more.
• New /eventspawns addmany opens a form for pasting several positions at once (one "x z angle height" per line) instead of running /add repeatedly.
• New /eventspawns list shows every current position for a type with a number next to each; /eventspawns remove deletes one by that number.
• New /eventspawns types lists every event name defined in the file with its current position count, and the type field on every subcommand quick-searches that list as you type.
• Edits go straight to the live file over FTP with the same safe backup-then-swap pattern /rotation uses ; takes effect on the next server restart. This only adds spawn points, not new event types, and doesn't touch db/events.xml's nominal/min/max, so a reminder to check those is included in every reply.

v0.1.9Admin commands now configurable per-role, not just server Administrator

• New /setup bot-admin-role lets you grant BenchBot admin access (setup, channels, detect, rotation, banlist, keywords, and more) to a role that isn't full server Administrator ; point it at an existing role, or leave it blank to auto-create "Bench Bot Admin." Assign the role to members the normal Discord way.
• /setup auto-channels now also creates (or reuses) this role in the same one-shot setup.
• New /channel visibility lets you multi-select several feed channels at once and flip them all admin-only or public in one go, instead of editing each channel's permissions by hand. /channel list now shows a lock icon next to channels that are already admin-only.
• Every previously Administrator-only command still works exactly the same for real server Administrators ; this is additive, not a replacement.

v0.1.8New dynamic event / vehicle spawn feed

• New automated feed posts when the server spawns a dynamic event (heli crash sites, AI survivor encounters, and similar) or a vehicle ; routes through /channel create and /setup auto-channels exactly like every other feed.
• New /setup location-format lets you choose whether spawn locations show as a town name or exact coordinates on this feed.
• Routine ambient wildlife and animal spawns are deliberately excluded ; this feed is for "something worth going to look at," not routine background spawning.

v0.1.7Connect/disconnect feeds show session length

• The connect feed now shows Time Offline (how long since that player's last disconnect, or "First seen this session" if the bot has no record of one).
• The disconnect feed now shows Time Online (how long that session lasted, or "Unknown" if the bot restarted mid-session and missed the connect).

v0.1.6/detect ; automated player behavior detection

• New automated feed watches the live ADM log for 6 exploit patterns and posts an alert embed the moment one trips: Underground (clipping below the map), Skywalk (float/rapid altitude gain, including sit-then-rise), Dupe (connect-cycling), Boost (rapid Fireplace/Garden Plot stacking + altitude gain), Camping (staying in one small radius), and Join-Kill (a kill within minutes of connecting).
• New /detect status shows every detector's current thresholds and on/off state in one place. New /detect toggle turns any detector (or all of them) on or off. New /detect config <name> tunes each detector's numbers ; depth, radius, windows, cooldowns, all admin-configurable, all optional (omit an option to leave it as-is).
• Every alert is a heuristic signal for admin review, not proof ; same framing as /altcheck. No auto-ban; these are alert-only.
• Alerts route through /channel create and /setup auto-channels exactly like every other feed ; auto-channels creates one consolidated, admin-only #dayz-suspicion-alerts channel for all 6 by default.

v0.1.5/expedition ; real inventory, sellable loot, pricier gear

• Found items now go into a real inventory instead of converting straight to Salvage ; /expedition go banks the actual items (Bent Dog Tags, Sealed Sidearm Case, etc.), not a currency amount.
• New /expedition inventory shows everything in your loot bag ; item, rarity, and current sell value each and combined.
• New /expedition sell item:<name> [quantity] cashes loot in for Salvage ; sell one at a time, a stack, or item:all to clear the whole bag at once.
• Case gear's Salvage bonus now applies when you sell instead of when you find ; upgrade Case before a big sell-off and it immediately pays off on everything in your bag.
• Streak multiplier moved from boosting Salvage to boosting Score earned per bank ; Salvage now only comes from actually selling loot.
• All expedition shop prices went up roughly 3.75x across every tier and the Stash Rumor consumable ; the old prices were getting cleared out in a handful of runs.

v0.1.4/expedition ; dense stat-block embeds, no more photos

• Run, bank, and bust embeds dropped the site/loot photos entirely in favor of dense stat blocks ; every push now shows This Find, Push Status, Run Total, Streak, and Rank side by side instead of one flavor line and a picture.
• /expedition sites is back to a single embed listing all four sites with their exact rarity bias numbers (e.g. Rare +6, Legendary +3) instead of vague flavor text.
• /expedition profile and /expedition leaderboard got the same tightened, numbers-forward treatment ; leaderboard now shows salvage alongside score on every entry.

v0.1.3/expedition balance pass ; pick your site, way more gear

• New /expedition go site:<name> ; pick NWAF Ruins, Rustbelt Docks, Red Cross Camp, or Smuggler Row yourself instead of a random site every run; the whole run now stays at that one site instead of jumping around on every push.
• New /expedition sites ; browse what each site favors before committing to a run.
• Legendary odds were tuned way down ; a couple of gear pieces could previously push them past 25% per roll, now capped hard. Pushing deeper still nudges your odds up a little, rewarding the added risk.
• New Boots gear slot (4 tiers) raises how many times you can Push Deeper before being forced to bank. Every gear slot also picked up a Tier 4 rung gated behind Apex Raider rank.
• New consumable, Stash Rumor ; guarantees your next /expedition go opens on a legendary find.
• Every site now shows a real photo in the run embeds and in /expedition sites.

v0.1.2New /expedition minigame ; push your luck

• New /expedition go ; head into NWAF Ruins, Rustbelt Docks, Red Cross Camp, or Smuggler Row and find something right away, then choose: Bank It and keep the haul, or Push Deeper for a bigger one at rising risk of losing the whole run.
• Salvage and score earned fund gear across 5 slots (Pack, Kit, Radio, Case, Instinct) via /expedition shop | buy, plus rank, streak, and milestone progression.
• Rank, streak, milestones, and the leaderboard are bot-wide across every server this bot is in, same as Chips ; one expedition identity everywhere, not per-server.

v0.1.1The big one ; full internal rebuild, security, and reliability

• Completely rebuilt from a single 6,000+ line file into a properly organized codebase with real automated tests ; nothing changes for you day to day, but future fixes and features should land faster and with fewer surprises.
• Nitrado tokens and FTP passwords are now encrypted at rest instead of stored as plain text.
• Nitrado API calls now automatically retry on timeouts and server errors instead of just failing outright ; should quietly resolve a chunk of the transient log-fetch failures from before.
• Economy and Casino Chip balances now have a real database backup running alongside the existing save files, for extra protection against data loss.
• New /economy audit (admin) flags accounts suspiciously paying each other back and forth in a short window ; a common sign of currency being laundered between two accounts.
• If a command fails, you'll now get a DM explaining what happened and what to do, instead of just silence.
• Multiple servers now get their logs polled in parallel instead of one at a time, keeping things fast as more servers join.
• Fixed: a natural blackjack (dealt 21 immediately) was crashing instead of paying out 3:2 ; it now pays out correctly.

v0.0.2Mobile tap-to-copy, and a round of crash fixes

• Player gamertags and Discord usernames shown in embeds (feeds, leaderboards, /banlist, /altcheck, /player locations, casino/economy results) now render as tappable code text instead of bold, so tapping one on Discord mobile copies it straight to your clipboard.
• Fixed /help throwing an error on every use ; it had grown past Discord's 25-field-per-embed limit over the last few updates. Split into two embeds.
• Fixed /shop view (no category filter) failing every time ; real custom-emoji icons are ~35-40 characters each versus 1 for the old text glyphs, and cramming all three currencies' items into one embed pushed it over Discord's 6000-character budget. Now one embed per currency.
• /banlist list and /banlist search got the same fix pre-emptively (large results could hit the same 6000-character ceiling as the watchlist grows) ; both now split across multiple embeds automatically when needed.

/banlist goes global, with a verification system

• Every /banlist report is now shared across every server on this bot, not just the reporting server ; added by any admin, anywhere, visible everywhere immediately.
• New tiering so one admin can't unilaterally get someone bot-wide blacklisted: a gamertag stays Unverified (a lead, not a verdict) until 2+ independent servers report it, at which point it becomes Verified.
• New /banlist dispute lets any server flag another server's report as questionable ; if disputes catch up to reports, the entry flips to Disputed rather than being silently deleted, so the history stays visible.
• /banlist remove now only retracts your own server's report; other servers' reports on the same gamertag are unaffected.
• Existing per-server entries were migrated in automatically as that server's own report ; nothing already added was lost.

Visual overhaul, starting Chips, and watchlist wording

• Every embed in the bot restyled with one consistent look ; 89 custom full-color icons (uploaded as Benchbot's own Discord emoji, not sourced from emoji.gg), covering every command, the shop catalog, loadout builder slots, /distance terrain tiers, bench/range event tiers, and now the live connect/disconnect/kill/death/hit/chat feeds too.
• New players get a one-time 100 Chips starting balance the first time they touch Bench's Casino.
• /banlist wording now describes it as a shared, verified watchlist meant for copying into other servers' banlists.

/changelog ; see what changed

• New /changelog command ; newest entry first, with Prev/Next buttons to page back through history.

Bench's Casino rework ; global Chips economy

• /casino global-chips lets a server admin switch this server's casino games to a new shared Chips currency, kept separate from each server's local Dollars.
• /casino deposit | withdraw | balance move value between this server's Dollars and your shared Chips ; win on one server, cash out on another.
• All casino games (coinflip, dice, roulette, slots, high-low, blackjack) work with either currency depending on this server's setting.

/banlist ; server watchlist

• New /banlist add | remove | list | search | export command ; a categorized (hacker/exploiter/griefer/DDoS/scammer/other) player watchlist with known alts and notes, exportable as plain text for other admins.

Feed overhaul ; coordinates and kill/death/hit detail

• Connect/disconnect/kill/death/hit/chat feed embeds now include coordinates and the nearest town.
• Kill and hit feeds classify PvP vs. infected vs. animal vs. environmental, plus weapon, distance, and body part when available.
• Death feed attempts to identify the likely cause (bleeding, dehydration, starvation) from the server's own stats line.

/altcheck ; alt-account suspicion scan

• New /altcheck command scans ADM logs for behavioral signs of alt accounts (fast account handoffs, low overall play footprint), with repeated-pattern clustering across accounts.
• Explicitly presented as suspicion signals for admin review, not proof ; console DayZ exposes no IP or platform ID to confirm a match.