adb-plugin-aegis 1.0.1

package/README.md

@@ -0,0 +1,113 @@
+# Aegis
+
+Automated threat detection and mitigation for Discord servers, built as a plugin for [Advanced Discord Bot](https://github.com/dead/Advanced-Discord-Bot).
+
+## Modules
+
+| Module | Description | Default |
+|--------|-------------|---------|
+| **Anti-Raid** | Detects mass joins and auto-locks the server | Off |
+| **Anti-Spam** | Detects duplicate messages and mass mentions | Off |
+| **Anti-Link** | Deletes messages containing URLs or Discord invites | Off |
+| **Anti-Alt** | Blocks or flags accounts below a minimum age | Off |
+
+All modules are off by default. Enable each one independently per guild.
+
+## Installation
+
+```bash
+# In your ADB plugins directory
+npm install adb-plugin-aegis
+```
+
+Then add `"adb-plugin-aegis"` to your ADB plugin list.
+
+## Required Bot Permissions
+
+- Manage Channels (for lockdown)
+- Kick Members / Ban Members (for anti-alt/spam enforcement)
+- Moderate Members (timeout, for spam mute)
+- Manage Messages (to delete spam/links)
+- Set Verification Level (for raid lockdown)
+- Send Messages + Embed Links (for log channel output)
+
+## Configuration Commands
+
+All `/antimod` subcommands require **Administrator** permission.  
+`/antiraid lockdown` requires **Moderate Members** permission.
+
+### Setup
+
+```
+/antimod setup          Show overview and module list
+/antimod status         Show all module states and current settings
+/antimod log #channel   Set the channel for Aegis log embeds
+```
+
+### Anti-Raid
+
+```
+/antimod raid on
+/antimod raid off
+/antimod raid threshold <joins> <seconds>
+  — e.g. /antimod raid threshold 10 10  (10 joins in 10s)
+```
+
+When the threshold is hit, Aegis automatically:
+1. Sets server verification to **HIGH**
+2. Denies `SendMessages` for `@everyone` in all text channels
+3. Logs to the configured log channel
+
+To lift manually:
+
+```
+/antiraid lockdown
+```
+
+### Anti-Spam
+
+```
+/antimod spam on
+/antimod spam off
+/antimod spam action <warn|mute|kick|ban>
+  — "mute" applies a 10-minute timeout (default)
+```
+
+Triggers on N identical messages in a window, or a single message with N+ mentions.
+
+### Anti-Link
+
+```
+/antimod link on
+/antimod link off
+/antimod link whitelist <domain>
+  — e.g. /antimod link whitelist github.com
+```
+
+Discord invite links (`discord.gg/...`) are always blocked when the module is on, regardless of the whitelist.  
+Whitelisted domains are stored per guild and persist across restarts.
+
+### Anti-Alt
+
+```
+/antimod alt on
+/antimod alt off
+/antimod alt age <days>   — minimum account age (default: 7 days)
+```
+
+Actions:
+- **flag** (default) — logs the join to the log channel; member is not removed
+- **kick** — immediately kicks the member with a reason
+
+## Development / Testing
+
+```bash
+npm install
+npm test
+```
+
+Tests run without a real Discord connection or database (in-memory mocks).
+
+## License
+
+MIT

package/commands/antimod.js

@@ -0,0 +1,258 @@
+"use strict";
+
+const { PermissionFlagsBits } = (() => {
+  try {
+    return require("discord.js");
+  } catch {
+    return { PermissionFlagsBits: { Administrator: 8n } };
+  }
+})();
+
+const { getGuildConfig, setGuildConfig } = require("../lib/getConfig");
+
+/**
+ * Factory — returns the /antimod command object.
+ * @param {object} ctx
+ * @param {object} AegisLog  - mongoose model
+ * @param {object} Whitelist - mongoose model
+ */
+module.exports = function createAntimodCommand(ctx, AegisLog, Whitelist) {
+  const data = {
+    name: "antimod",
+    description: "Configure Aegis automated moderation modules",
+    defaultMemberPermissions: String(PermissionFlagsBits.Administrator),
+    options: [
+      {
+        name: "setup",
+        type: 1, // SUB_COMMAND
+        description: "Show Aegis setup overview",
+      },
+      {
+        name: "status",
+        type: 1,
+        description: "Show all module states and key settings",
+      },
+      {
+        name: "log",
+        type: 1,
+        description: "Set the log channel for Aegis events",
+        options: [
+          {
+            name: "channel",
+            type: 7, // CHANNEL
+            description: "Channel to send logs to",
+            required: true,
+          },
+        ],
+      },
+      {
+        name: "raid",
+        type: 2, // SUB_COMMAND_GROUP
+        description: "Anti-raid module settings",
+        options: [
+          { name: "on", type: 1, description: "Enable anti-raid" },
+          { name: "off", type: 1, description: "Disable anti-raid" },
+          {
+            name: "threshold",
+            type: 1,
+            description: "Set join threshold for raid detection",
+            options: [
+              { name: "joins", type: 4, required: true, description: "Number of joins to trigger lockdown" },
+              { name: "seconds", type: 4, required: true, description: "Time window in seconds" },
+            ],
+          },
+        ],
+      },
+      {
+        name: "spam",
+        type: 2,
+        description: "Anti-spam module settings",
+        options: [
+          { name: "on", type: 1, description: "Enable anti-spam" },
+          { name: "off", type: 1, description: "Disable anti-spam" },
+          {
+            name: "action",
+            type: 1,
+            description: "Set action taken on spammers",
+            options: [
+              {
+                name: "type",
+                type: 3, // STRING
+                required: true,
+                description: "Action to take",
+                choices: [
+                  { name: "warn", value: "warn" },
+                  { name: "mute (10 min timeout)", value: "mute" },
+                  { name: "kick", value: "kick" },
+                  { name: "ban", value: "ban" },
+                ],
+              },
+            ],
+          },
+        ],
+      },
+      {
+        name: "link",
+        type: 2,
+        description: "Anti-link module settings",
+        options: [
+          { name: "on", type: 1, description: "Enable anti-link" },
+          { name: "off", type: 1, description: "Disable anti-link" },
+          {
+            name: "whitelist",
+            type: 1,
+            description: "Add a domain to the link whitelist",
+            options: [
+              {
+                name: "domain",
+                type: 3,
+                required: true,
+                description: "Domain to allow (e.g. example.com)",
+              },
+            ],
+          },
+        ],
+      },
+      {
+        name: "alt",
+        type: 2,
+        description: "Anti-alt (new account) module settings",
+        options: [
+          { name: "on", type: 1, description: "Enable anti-alt" },
+          { name: "off", type: 1, description: "Disable anti-alt" },
+          {
+            name: "age",
+            type: 1,
+            description: "Set minimum account age in days",
+            options: [
+              { name: "days", type: 4, required: true, description: "Minimum account age in days" },
+            ],
+          },
+        ],
+      },
+    ],
+  };
+
+  async function execute(interaction) {
+    if (!interaction.memberPermissions?.has(PermissionFlagsBits.Administrator)) {
+      return interaction.reply({ content: "You need Administrator permission to use this command.", ephemeral: true });
+    }
+
+    const guildId = interaction.guildId;
+    const group = interaction.options.getSubcommandGroup(false);
+    const sub = interaction.options.getSubcommand();
+
+    // Top-level subcommands (no group)
+    if (!group) {
+      if (sub === "setup") {
+        return interaction.reply({
+          content:
+            "**Aegis Setup**\n\nUse the following commands to configure each module:\n" +
+            "• `/antimod raid on` — enable raid detection\n" +
+            "• `/antimod spam on` — enable spam detection\n" +
+            "• `/antimod link on` — enable link filtering\n" +
+            "• `/antimod alt on` — enable new-account blocking\n" +
+            "• `/antimod log #channel` — set the log channel\n\n" +
+            "All modules are **off by default**. Use `/antimod status` to see current settings.",
+          ephemeral: true,
+        });
+      }
+
+      if (sub === "status") {
+        const config = await getGuildConfig(ctx, guildId);
+        const bool = (v) => (v ? "✅ ON" : "❌ OFF");
+        return interaction.reply({
+          content:
+            `**Aegis Status** for ${interaction.guild?.name ?? guildId}\n\n` +
+            `**Anti-Raid:** ${bool(config.raid_enabled)} | Threshold: ${config.raid_joins} joins / ${config.raid_seconds}s | Lockdown: ${config.raid_lockdown_active ? "ACTIVE" : "inactive"}\n` +
+            `**Anti-Spam:** ${bool(config.spam_enabled)} | Threshold: ${config.spam_messages} msgs / ${config.spam_seconds}s | Action: ${config.spam_action}\n` +
+            `**Anti-Link:** ${bool(config.link_enabled)} | Block invites: ${bool(config.link_block_invites)}\n` +
+            `**Anti-Alt:** ${bool(config.alt_enabled)} | Min age: ${config.alt_min_age_days}d | Action: ${config.alt_action}\n` +
+            `**Log channel:** ${config.log_channel_id ? `<#${config.log_channel_id}>` : "not set"}`,
+          ephemeral: true,
+        });
+      }
+
+      if (sub === "log") {
+        const channel = interaction.options.getChannel("channel");
+        await setGuildConfig(ctx, guildId, { log_channel_id: channel.id });
+        return interaction.reply({ content: `Log channel set to <#${channel.id}>.`, ephemeral: true });
+      }
+    }
+
+    // Grouped subcommands
+    if (group === "raid") {
+      if (sub === "on") {
+        await setGuildConfig(ctx, guildId, { raid_enabled: true });
+        return interaction.reply({ content: "Anti-raid **enabled**.", ephemeral: true });
+      }
+      if (sub === "off") {
+        await setGuildConfig(ctx, guildId, { raid_enabled: false });
+        return interaction.reply({ content: "Anti-raid **disabled**.", ephemeral: true });
+      }
+      if (sub === "threshold") {
+        const joins = interaction.options.getInteger("joins");
+        const seconds = interaction.options.getInteger("seconds");
+        await setGuildConfig(ctx, guildId, { raid_joins: joins, raid_seconds: seconds });
+        return interaction.reply({ content: `Raid threshold set: **${joins} joins** in **${seconds}s**.`, ephemeral: true });
+      }
+    }
+
+    if (group === "spam") {
+      if (sub === "on") {
+        await setGuildConfig(ctx, guildId, { spam_enabled: true });
+        return interaction.reply({ content: "Anti-spam **enabled**.", ephemeral: true });
+      }
+      if (sub === "off") {
+        await setGuildConfig(ctx, guildId, { spam_enabled: false });
+        return interaction.reply({ content: "Anti-spam **disabled**.", ephemeral: true });
+      }
+      if (sub === "action") {
+        const type = interaction.options.getString("type");
+        await setGuildConfig(ctx, guildId, { spam_action: type });
+        return interaction.reply({ content: `Spam action set to **${type}**.`, ephemeral: true });
+      }
+    }
+
+    if (group === "link") {
+      if (sub === "on") {
+        await setGuildConfig(ctx, guildId, { link_enabled: true });
+        return interaction.reply({ content: "Anti-link **enabled**.", ephemeral: true });
+      }
+      if (sub === "off") {
+        await setGuildConfig(ctx, guildId, { link_enabled: false });
+        return interaction.reply({ content: "Anti-link **disabled**.", ephemeral: true });
+      }
+      if (sub === "whitelist") {
+        const rawDomain = interaction.options.getString("domain");
+        const domain = rawDomain.toLowerCase().replace(/^https?:\/\//, "").split("/")[0];
+        const existing = await Whitelist.findOne({ guildId, domain });
+        if (existing) {
+          return interaction.reply({ content: `\`${domain}\` is already whitelisted.`, ephemeral: true });
+        }
+        await Whitelist.create({ guildId, domain });
+        return interaction.reply({ content: `Domain \`${domain}\` added to the link whitelist.`, ephemeral: true });
+      }
+    }
+
+    if (group === "alt") {
+      if (sub === "on") {
+        await setGuildConfig(ctx, guildId, { alt_enabled: true });
+        return interaction.reply({ content: "Anti-alt **enabled**.", ephemeral: true });
+      }
+      if (sub === "off") {
+        await setGuildConfig(ctx, guildId, { alt_enabled: false });
+        return interaction.reply({ content: "Anti-alt **disabled**.", ephemeral: true });
+      }
+      if (sub === "age") {
+        const days = interaction.options.getInteger("days");
+        await setGuildConfig(ctx, guildId, { alt_min_age_days: days });
+        return interaction.reply({ content: `Minimum account age set to **${days} days**.`, ephemeral: true });
+      }
+    }
+
+    return interaction.reply({ content: "Unknown subcommand.", ephemeral: true });
+  }
+
+  return { data, execute };
+};

package/commands/antiraid.js

@@ -0,0 +1,125 @@
+"use strict";
+
+const { PermissionFlagsBits } = (() => {
+  try {
+    return require("discord.js");
+  } catch {
+    return { PermissionFlagsBits: { ModerateMembers: 1n << 40n } };
+  }
+})();
+
+const { getGuildConfig, setGuildConfig } = require("../lib/getConfig");
+const { logAction } = require("../lib/logAction");
+
+/**
+ * Factory — returns the /antiraid command object.
+ * @param {object} ctx
+ */
+module.exports = function createAntiraidCommand(ctx) {
+  const data = {
+    name: "antiraid",
+    description: "Manually toggle raid lockdown for this server",
+    defaultMemberPermissions: String(PermissionFlagsBits.ModerateMembers),
+    options: [
+      {
+        name: "lockdown",
+        type: 1, // SUB_COMMAND
+        description: "Toggle server lockdown on or off",
+      },
+    ],
+  };
+
+  async function execute(interaction) {
+    if (!interaction.memberPermissions?.has(PermissionFlagsBits.ModerateMembers)) {
+      return interaction.reply({ content: "You need the Moderate Members permission to use this command.", ephemeral: true });
+    }
+
+    const guild = interaction.guild;
+    const guildId = interaction.guildId;
+    const sub = interaction.options.getSubcommand();
+
+    if (sub !== "lockdown") {
+      return interaction.reply({ content: "Unknown subcommand.", ephemeral: true });
+    }
+
+    await interaction.deferReply({ ephemeral: true });
+
+    const config = await getGuildConfig(ctx, guildId);
+
+    if (!config.raid_lockdown_active) {
+      // --- Activate lockdown ---
+      try {
+        await guild.setVerificationLevel(3); // HIGH
+      } catch (err) {
+        ctx.logger.warn("[Aegis] Could not set verification level", err);
+      }
+
+      const textChannels = guild.channels.cache.filter(
+        (c) => c.isTextBased?.() && typeof c.permissionOverwrites?.edit === "function"
+      );
+      for (const [, channel] of textChannels) {
+        await channel.permissionOverwrites
+          .edit(guild.roles.everyone, { SendMessages: false })
+          .catch(() => {});
+      }
+
+      await setGuildConfig(ctx, guildId, { raid_lockdown_active: true });
+      await logAction(ctx, null, guildId, {
+        module: "raid",
+        action: "lockdown_on",
+        targetUserId: null,
+        reason: `Manual lockdown by ${interaction.user.tag}`,
+      });
+
+      if (config.log_channel_id) {
+        const logCh = guild.channels.cache.get(config.log_channel_id);
+        if (logCh?.isTextBased?.()) {
+          await logCh
+            .send(`🔒 **[Aegis] Manual lockdown activated** by ${interaction.user}. Use \`/antiraid lockdown\` to lift.`)
+            .catch(() => {});
+        }
+      }
+
+      ctx.logger.warn(`[Aegis] Manual lockdown activated in guild ${guildId} by ${interaction.user.tag}`);
+      return interaction.editReply("🔒 **Lockdown activated.** All text channels locked, verification level set to HIGH.");
+    } else {
+      // --- Lift lockdown ---
+      try {
+        await guild.setVerificationLevel(2); // MEDIUM
+      } catch (err) {
+        ctx.logger.warn("[Aegis] Could not reset verification level", err);
+      }
+
+      const textChannels = guild.channels.cache.filter(
+        (c) => c.isTextBased?.() && typeof c.permissionOverwrites?.edit === "function"
+      );
+      for (const [, channel] of textChannels) {
+        await channel.permissionOverwrites
+          .edit(guild.roles.everyone, { SendMessages: null }) // inherit
+          .catch(() => {});
+      }
+
+      await setGuildConfig(ctx, guildId, { raid_lockdown_active: false });
+      await logAction(ctx, null, guildId, {
+        module: "raid",
+        action: "lockdown_off",
+        targetUserId: null,
+        reason: `Lockdown lifted by ${interaction.user.tag}`,
+      });
+
+      if (config.log_channel_id) {
+        const logCh = guild.channels.cache.get(config.log_channel_id);
+        if (logCh?.isTextBased?.()) {
+          await logCh
+            .send(`🔓 **[Aegis] Lockdown lifted** by ${interaction.user}.`)
+            .catch(() => {});
+        }
+      }
+
+      ctx.logger.info(`[Aegis] Lockdown lifted in guild ${guildId} by ${interaction.user.tag}`);
+      return interaction.editReply("🔓 **Lockdown lifted.** Text channels unlocked, verification level restored to MEDIUM.");
+    }
+  }
+
+  return { data, execute };
+};

package/index.js

@@ -0,0 +1,229 @@
+"use strict";
+
+const cron = require("node-cron");
+const { getGuildConfig, setGuildConfig } = require("./lib/getConfig");
+const { recordJoin, isRaid, clearGuild, joinLog } = require("./lib/raidTracker");
+const { recordMessage, isSpam, clearUser, userLog } = require("./lib/spamTracker");
+const { logAction } = require("./lib/logAction");
+const createAntimodCommand = require("./commands/antimod");
+const createAntiraidCommand = require("./commands/antiraid");
+const LogSchema = require("./models/log");
+const WhitelistSchema = require("./models/whitelist");
+
+/**
+ * Main plugin load function — called by ADB when the plugin is activated.
+ * @param {object} ctx - ADB plugin context
+ */
+async function load(ctx) {
+  // Register mongoose models (namespaced automatically by ADB)
+  const AegisLog = ctx.defineModel("log", LogSchema);
+  const Whitelist = ctx.defineModel("whitelist", WhitelistSchema);
+
+  // Register slash commands
+  ctx.registerCommand(createAntimodCommand(ctx, AegisLog, Whitelist));
+  ctx.registerCommand(createAntiraidCommand(ctx));
+
+  // -------------------------------------------------------------------------
+  // Event: guildMemberAdd — anti-alt + anti-raid
+  // -------------------------------------------------------------------------
+  ctx.registerEvent("guildMemberAdd", async (member) => {
+    const guildId = member.guild.id;
+    let config;
+    try {
+      config = await getGuildConfig(ctx, guildId);
+    } catch (err) {
+      ctx.logger.error("[Aegis] guildMemberAdd: failed to load config", err);
+      return;
+    }
+
+    // --- Anti-alt ---
+    if (config.alt_enabled) {
+      const accountAgeDays = (Date.now() - member.user.createdAt.getTime()) / 86400000;
+      if (accountAgeDays < config.alt_min_age_days) {
+        if (config.alt_action === "kick") {
+          await member
+            .kick(`[Aegis] Account too new (${Math.floor(accountAgeDays)}d old, min ${config.alt_min_age_days}d)`)
+            .catch(() => {});
+          await logAction(ctx, AegisLog, guildId, {
+            module: "alt",
+            action: "kick",
+            targetUserId: member.id,
+            reason: `Account age: ${Math.floor(accountAgeDays)}d (min ${config.alt_min_age_days}d)`,
+          });
+        } else {
+          await logAction(ctx, AegisLog, guildId, {
+            module: "alt",
+            action: "flag",
+            targetUserId: member.id,
+            reason: `Account age: ${Math.floor(accountAgeDays)}d (min ${config.alt_min_age_days}d)`,
+          });
+        }
+      }
+    }
+
+    // --- Anti-raid ---
+    if (config.raid_enabled && !config.raid_lockdown_active) {
+      const times = recordJoin(guildId);
+      if (isRaid(times, config.raid_joins, config.raid_seconds)) {
+        clearGuild(guildId);
+        await triggerLockdown(ctx, member.guild, guildId, config, AegisLog);
+      }
+    }
+  });
+
+  // -------------------------------------------------------------------------
+  // Event: messageCreate — anti-link + anti-spam
+  // -------------------------------------------------------------------------
+  ctx.registerEvent("messageCreate", async (message) => {
+    if (message.author.bot || !message.guild) return;
+
+    const guildId = message.guild.id;
+    let config;
+    try {
+      config = await getGuildConfig(ctx, guildId);
+    } catch (err) {
+      ctx.logger.error("[Aegis] messageCreate: failed to load config", err);
+      return;
+    }
+
+    // --- Anti-link ---
+    if (config.link_enabled) {
+      const hasInvite = /discord\.gg\/[a-zA-Z0-9]+/.test(message.content);
+      const urlMatches = message.content.match(/https?:\/\/[^\s]+/gi);
+
+      let blocked = false;
+
+      if (hasInvite && config.link_block_invites) blocked = true;
+
+      if (!blocked && urlMatches) {
+        const whitelist = await Whitelist.find({ guildId }).lean();
+        const allowedDomains = whitelist.map((w) => w.domain.toLowerCase());
+
+        const domains = urlMatches.map((url) => {
+          try {
+            return new URL(url).hostname.toLowerCase();
+          } catch {
+            return "";
+          }
+        });
+
+        if (domains.some((d) => d && !allowedDomains.includes(d))) blocked = true;
+      }
+
+      if (blocked) {
+        await message.delete().catch(() => {});
+        await logAction(ctx, AegisLog, guildId, {
+          module: "link",
+          action: "delete",
+          targetUserId: message.author.id,
+          reason: "Blocked link or invite",
+        });
+        return; // skip spam check for this message
+      }
+    }
+
+    // --- Anti-spam ---
+    if (config.spam_enabled) {
+      const messages = recordMessage(guildId, message.author.id, message.content);
+      if (isSpam(messages, config.spam_messages, config.spam_seconds)) {
+        clearUser(guildId, message.author.id);
+        await message.delete().catch(() => {});
+
+        const member = message.member;
+        if (member) {
+          const action = config.spam_action;
+          if (action === "mute") {
+            await member.timeout(10 * 60 * 1000, "[Aegis] Spam detected").catch(() => {});
+          } else if (action === "kick") {
+            await member.kick("[Aegis] Spam detected").catch(() => {});
+          } else if (action === "ban") {
+            await member.ban({ reason: "[Aegis] Spam detected" }).catch(() => {});
+          }
+          // "warn" action: message deleted, no further punishment
+        }
+
+        await logAction(ctx, AegisLog, guildId, {
+          module: "spam",
+          action: config.spam_action,
+          targetUserId: message.author.id,
+          reason: "Spam detected",
+        });
+      }
+    }
+  });
+
+  // -------------------------------------------------------------------------
+  // Cleanup cron — prune in-memory trackers every 5 minutes
+  // -------------------------------------------------------------------------
+  const cleanupTask = cron.schedule("*/5 * * * *", () => {
+    const cutoff = Date.now() - 60 * 1000;
+
+    // Prune raidTracker
+    for (const [guildId, times] of joinLog.entries()) {
+      const filtered = times.filter((t) => t > cutoff);
+      if (filtered.length === 0) joinLog.delete(guildId);
+      else joinLog.set(guildId, filtered);
+    }
+
+    // Prune spamTracker
+    for (const [key, entry] of userLog.entries()) {
+      const filtered = entry.messages.filter((m) => m.ts > cutoff);
+      if (filtered.length === 0) userLog.delete(key);
+      else entry.messages = filtered;
+    }
+  });
+
+  // -------------------------------------------------------------------------
+  // Cleanup on unload
+  // -------------------------------------------------------------------------
+  ctx.hooks.on("onPluginUnload", ({ pluginName }) => {
+    if (pluginName === "adb-plugin-aegis") {
+      cleanupTask.stop();
+      ctx.logger.info("[Aegis] Cleanup task stopped on unload");
+    }
+  });
+
+  ctx.logger.info("[Aegis] Plugin loaded — anti-raid, anti-spam, anti-link, anti-alt ready");
+}
+
+// ---------------------------------------------------------------------------
+// Internal helper — activate server lockdown
+// ---------------------------------------------------------------------------
+async function triggerLockdown(ctx, guild, guildId, config, AegisLog) {
+  try {
+    await guild.setVerificationLevel(3).catch(() => {}); // HIGH
+
+    const textChannels = guild.channels.cache.filter(
+      (c) => c.isTextBased?.() && typeof c.permissionOverwrites?.edit === "function"
+    );
+    for (const [, channel] of textChannels) {
+      await channel.permissionOverwrites
+        .edit(guild.roles.everyone, { SendMessages: false })
+        .catch(() => {});
+    }
+
+    await setGuildConfig(ctx, guildId, { raid_lockdown_active: true });
+
+    await logAction(ctx, AegisLog, guildId, {
+      module: "raid",
+      action: "lockdown",
+      targetUserId: null,
+      reason: "Raid detected — auto lockdown",
+    });
+
+    if (config.log_channel_id) {
+      const ch = guild.channels.cache.get(config.log_channel_id);
+      if (ch?.isTextBased?.()) {
+        await ch
+          .send("🔒 **[Aegis] Raid detected — lockdown activated.** Use `/antiraid lockdown` to lift.")
+          .catch(() => {});
+      }
+    }
+
+    ctx.logger.warn(`[Aegis] Lockdown triggered in guild ${guildId}`);
+  } catch (err) {
+    ctx.logger.error(`[Aegis] Lockdown failed in guild ${guildId}`, err);
+  }
+}
+
+module.exports = { load };

package/lib/getConfig.js

@@ -0,0 +1,46 @@
+"use strict";
+
+const DEFAULTS = {
+  log_channel_id: null,
+  // module enabled flags
+  raid_enabled: false,
+  spam_enabled: false,
+  link_enabled: false,
+  alt_enabled: false,
+  // raid
+  raid_joins: 10,
+  raid_seconds: 10,
+  raid_lockdown_active: false,
+  // spam
+  spam_messages: 5,
+  spam_seconds: 3,
+  spam_action: "mute",
+  // link
+  link_block_invites: true,
+  // alt
+  alt_min_age_days: 7,
+  alt_action: "flag",
+};
+
+/**
+ * Load per-guild plugin config merged with defaults.
+ * @param {object} ctx - ADB plugin context
+ * @param {string} guildId
+ * @returns {Promise<object>}
+ */
+async function getGuildConfig(ctx, guildId) {
+  const record = await ctx.db.getPluginConfig(guildId, "adb-plugin-aegis");
+  return Object.assign({}, DEFAULTS, record?.data || {});
+}
+
+/**
+ * Patch per-guild plugin config (shallow merge over existing data).
+ * @param {object} ctx - ADB plugin context
+ * @param {string} guildId
+ * @param {object} patch - fields to update
+ */
+async function setGuildConfig(ctx, guildId, patch) {
+  await ctx.db.updatePluginConfig(guildId, "adb-plugin-aegis", patch);
+}
+
+module.exports = { getGuildConfig, setGuildConfig, DEFAULTS };

package/lib/logAction.js

@@ -0,0 +1,84 @@
+"use strict";
+
+const { EmbedBuilder } = (() => {
+  try {
+    return require("discord.js");
+  } catch {
+    // discord.js is a peer dep — not available in test harness; provide stub
+    return { EmbedBuilder: null };
+  }
+})();
+
+/**
+ * Log a moderation action to the database and, if configured, post an embed
+ * to the guild's log channel.
+ *
+ * @param {object} ctx        - ADB plugin context
+ * @param {object} AegisLog   - mongoose model for Aegis logs (may be null in lockdown path)
+ * @param {string} guildId
+ * @param {object} opts
+ * @param {string} opts.module        - "raid" | "spam" | "link" | "alt"
+ * @param {string} opts.action        - action taken
+ * @param {string|null} opts.targetUserId
+ * @param {string} opts.reason
+ */
+async function logAction(ctx, AegisLog, guildId, { module, action, targetUserId, reason }) {
+  // Persist to DB
+  if (AegisLog) {
+    try {
+      await AegisLog.create({
+        guildId,
+        module,
+        action,
+        targetUserId: targetUserId || null,
+        reason: reason || "",
+      });
+    } catch (err) {
+      ctx.logger.error("[Aegis] Failed to save log entry", err);
+    }
+  }
+
+  // Post to log channel if configured
+  try {
+    const { getGuildConfig } = require("./getConfig");
+    const config = await getGuildConfig(ctx, guildId);
+    if (!config.log_channel_id) return;
+
+    const guild = ctx.client.guilds?.cache?.get(guildId);
+    if (!guild) return;
+
+    const channel = guild.channels?.cache?.get(config.log_channel_id);
+    if (!channel?.isTextBased()) return;
+
+    const moduleColors = {
+      raid: 0xff4444,
+      spam: 0xff8800,
+      link: 0xffcc00,
+      alt: 0x8844ff,
+    };
+
+    if (EmbedBuilder) {
+      const embed = new EmbedBuilder()
+        .setColor(moduleColors[module] || 0x888888)
+        .setTitle(`[Aegis] ${module.toUpperCase()} — ${action}`)
+        .addFields(
+          { name: "Guild", value: guildId, inline: true },
+          { name: "Module", value: module, inline: true },
+          { name: "Action", value: action, inline: true },
+          { name: "Target", value: targetUserId ? `<@${targetUserId}>` : "N/A", inline: true },
+          { name: "Reason", value: reason || "N/A", inline: false }
+        )
+        .setTimestamp();
+      await channel.send({ embeds: [embed] }).catch(() => {});
+    } else {
+      // Fallback plain text (e.g., if EmbedBuilder stub)
+      await channel
+        .send(`**[Aegis] ${module.toUpperCase()} | ${action}** — ${reason} (${targetUserId ? `<@${targetUserId}>` : "N/A"})`)
+        .catch(() => {});
+    }
+  } catch (err) {
+    ctx.logger.error("[Aegis] Failed to post log embed", err);
+  }
+}
+
+module.exports = { logAction };

package/lib/raidTracker.js

@@ -0,0 +1,39 @@
+"use strict";
+
+// Map<guildId, Array<timestamp>>
+const joinLog = new Map();
+
+/**
+ * Record a join for a guild and return the current timestamp array.
+ * @param {string} guildId
+ * @returns {number[]} array of join timestamps for this guild
+ */
+function recordJoin(guildId) {
+  const times = joinLog.get(guildId) || [];
+  times.push(Date.now());
+  joinLog.set(guildId, times);
+  return times;
+}
+
+/**
+ * Check whether the join timestamps constitute a raid.
+ * @param {number[]} joinTimes - array of timestamps (ms)
+ * @param {number} threshold - minimum joins to trigger
+ * @param {number} windowSeconds - sliding window size
+ * @returns {boolean}
+ */
+function isRaid(joinTimes, threshold, windowSeconds) {
+  const cutoff = Date.now() - windowSeconds * 1000;
+  const recent = joinTimes.filter((t) => t > cutoff);
+  return recent.length >= threshold;
+}
+
+/**
+ * Clear join log for a guild (e.g., after lockdown triggered).
+ * @param {string} guildId
+ */
+function clearGuild(guildId) {
+  joinLog.delete(guildId);
+}
+
+module.exports = { recordJoin, isRaid, clearGuild, joinLog };

package/lib/spamTracker.js

@@ -0,0 +1,66 @@
+"use strict";
+
+// Map<`${guildId}:${userId}`, { messages: Array<{content: string, ts: number}> }>
+const userLog = new Map();
+
+/**
+ * Record a message for a user in a guild.
+ * Prunes entries older than 60 seconds to keep memory bounded.
+ * @param {string} guildId
+ * @param {string} userId
+ * @param {string} content
+ * @returns {{ content: string, ts: number }[]} current message array for this user
+ */
+function recordMessage(guildId, userId, content) {
+  const key = `${guildId}:${userId}`;
+  const entry = userLog.get(key) || { messages: [] };
+  const cutoff = Date.now() - 60 * 1000;
+  // prune messages older than 60s
+  entry.messages = entry.messages.filter((m) => m.ts > cutoff);
+  entry.messages.push({ content, ts: Date.now() });
+  userLog.set(key, entry);
+  return entry.messages;
+}
+
+/**
+ * Determine whether a user's recent messages constitute spam.
+ * Triggers on:
+ *  - >= threshold identical message contents within the window, OR
+ *  - any single message with >= threshold user/role mentions
+ * @param {{ content: string, ts: number }[]} messages
+ * @param {number} threshold
+ * @param {number} windowSeconds
+ * @returns {boolean}
+ */
+function isSpam(messages, threshold, windowSeconds) {
+  const cutoff = Date.now() - windowSeconds * 1000;
+  const recent = messages.filter((m) => m.ts > cutoff);
+
+  // Check for duplicate messages
+  const counts = new Map();
+  for (const m of recent) {
+    const normalized = m.content.trim().toLowerCase();
+    counts.set(normalized, (counts.get(normalized) || 0) + 1);
+    if (counts.get(normalized) >= threshold) return true;
+  }
+
+  // Check for mass mentions in the most recent message
+  const latest = messages[messages.length - 1];
+  if (latest) {
+    const mentionCount = (latest.content.match(/<@[!&]?\d+>/g) || []).length;
+    if (mentionCount >= threshold) return true;
+  }
+
+  return false;
+}
+
+/**
+ * Clear message log for a user in a guild.
+ * @param {string} guildId
+ * @param {string} userId
+ */
+function clearUser(guildId, userId) {
+  userLog.delete(`${guildId}:${userId}`);
+}
+
+module.exports = { recordMessage, isSpam, clearUser, userLog };

package/models/config.js

@@ -0,0 +1,27 @@
+"use strict";
+
+// Guild configuration is stored via ctx.db.getPluginConfig / ctx.db.updatePluginConfig.
+// No separate mongoose model is needed for config; this file is a placeholder
+// that documents the shape of the stored data blob.
+//
+// Stored under: plugin_adb-plugin-aegis_config (internal ADB key)
+//
+// Shape (see lib/getConfig.js DEFAULTS for all fields):
+// {
+//   log_channel_id: string | null,
+//   raid_enabled: boolean,
+//   spam_enabled: boolean,
+//   link_enabled: boolean,
+//   alt_enabled: boolean,
+//   raid_joins: number,
+//   raid_seconds: number,
+//   raid_lockdown_active: boolean,
+//   spam_messages: number,
+//   spam_seconds: number,
+//   spam_action: "warn" | "mute" | "kick" | "ban",
+//   link_block_invites: boolean,
+//   alt_min_age_days: number,
+//   alt_action: "flag" | "kick",
+// }
+
+module.exports = {};

package/models/log.js

@@ -0,0 +1,18 @@
+"use strict";
+
+const { Schema } = require("mongoose");
+
+const LogSchema = new Schema({
+  guildId: { type: String, required: true, index: true },
+  module: {
+    type: String,
+    enum: ["raid", "spam", "link", "alt"],
+    required: true,
+  },
+  action: { type: String, required: true },
+  targetUserId: { type: String, default: null },
+  reason: { type: String, default: "" },
+  triggeredAt: { type: Date, default: Date.now },
+});
+
+module.exports = LogSchema;

package/models/whitelist.js

@@ -0,0 +1,10 @@
+"use strict";
+
+const { Schema } = require("mongoose");
+
+const WhitelistSchema = new Schema({
+  guildId: { type: String, required: true, index: true },
+  domain: { type: String, required: true },
+});
+
+module.exports = WhitelistSchema;

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "adb-plugin-aegis",
+  "version": "1.0.1",
+  "description": "Automated threat detection for Advanced Discord Bot — anti-raid, anti-spam, anti-link, anti-alt",
+  "main": "index.js",
+  "files": [
+    "index.js",
+    "plugin.json",
+    "commands",
+    "models",
+    "lib",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "test": "node test/local-harness.js"
+  },
+  "keywords": [
+    "adb-plugin",
+    "discord",
+    "moderation",
+    "automod",
+    "anti-raid"
+  ],
+  "author": "dead",
+  "license": "MIT",
+  "dependencies": {
+    "node-cron": "^3.0.3"
+  },
+  "peerDependencies": {
+    "discord.js": ">=14.0.0",
+    "mongoose": ">=7.0.0"
+  },
+  "devDependencies": {
+    "mongoose": "^8.0.0"
+  }
+}

package/plugin.json

@@ -0,0 +1,23 @@
+{
+  "name": "adb-plugin-aegis",
+  "displayName": "Aegis",
+  "version": "1.0.0",
+  "description": "Automated threat detection: anti-raid, anti-spam, anti-link, anti-alt. Each module independently toggleable.",
+  "author": "dead",
+  "main": "index.js",
+  "requiresRestart": false,
+  "permissions": ["db.read", "db.write", "commands.register"],
+  "configSchema": {
+    "type": "object",
+    "properties": {
+      "log_channel_id": { "type": "string", "default": null },
+      "raid_joins": { "type": "number", "default": 10 },
+      "raid_seconds": { "type": "number", "default": 10 },
+      "spam_messages": { "type": "number", "default": 5 },
+      "spam_seconds": { "type": "number", "default": 3 },
+      "spam_action": { "type": "string", "enum": ["warn", "mute", "kick", "ban"], "default": "mute" },
+      "alt_min_age_days": { "type": "number", "default": 7 },
+      "alt_action": { "type": "string", "enum": ["flag", "kick"], "default": "flag" }
+    }
+  }
+}