glassframe-protocol 1.2.1 → 2.1.0

package/dist/src/commands/PrefixRouter.js

@@ -1,16 +1,25 @@
 "use strict";
 
-const { buildPanel } = require("../ui/ControlPanel");
+const { buildPanel, buildMetricsMessage, buildEnginePage } = require("../ui/ControlPanel");
 const { buildLogMessage } = require("../logging/ComponentsV2");
 
-const LAYER_NAMES = ["antiRaid", "antiNuke", "basicSecurity", "aiModeration"];
-const COMMANDS = ["panel", "status", "help", "whitelist", "scan", "metrics", "phishing"];
+const COMMANDS = ["panel", "status", "help", "whitelist", "scan", "metrics", "phishing", "prefix", "engine"];
+const OWNER_ONLY_COMMANDS = new Set(["engine"]);
+
+const LAYER_REASONING = {
+  basicSecurity: "watches every message for spam, scam/phishing language, raid-recruitment language, and bad links.",
+  antiRaid: "watches joins for rate spikes, alt-account patterns, and account-creation clusters.",
+  antiNuke: "watches the audit log for destructive bursts, dangerous permission grants, and channel lockouts.",
+  aiModeration: "sends only ambiguous messages (not clean, not clearly bad) to Groq for a second opinion."
+};
 
 /**
  * GlassFrame Protocol registers no slash commands, by design (see
  * docs/COMMANDS.md). Every command here is a plain prefix command gated on
  * Manage Server permission, with a short per-user cooldown so a doubled
- * keypress can't fire the same command twice in a row.
+ * keypress can't fire the same command twice in a row. Each server can set
+ * its own prefix (`!gf prefix set`); the default from config.js always
+ * still works too, as a fallback.
  */
 class PrefixRouter {
   constructor(frame) {
@@ -32,16 +41,25 @@ class PrefixRouter {
     return false;
   }
 
+  /** Tries this server's custom prefix (if set) and the default, longer one first, so an overlapping pair resolves sensibly. */
+  _matchPrefix(message) {
+    const custom = this.frame.guildPrefixes.get(message.guild.id);
+    const candidates = [custom, this.frame.config.prefix].filter(Boolean).sort((a, b) => b.length - a.length);
+    return candidates.find((p) => message.content.toLowerCase().startsWith(p.toLowerCase())) || null;
+  }
+
   async _handle(message) {
     if (!message.guild || message.author.bot) return;
-    const prefix = this.frame.config.prefix;
-    if (!message.content.toLowerCase().startsWith(prefix.toLowerCase())) return;
+    const prefix = this._matchPrefix(message);
+    if (!prefix) return;
 
     const args = message.content.slice(prefix.length).trim().split(/\s+/);
     const command = (args.shift() || "").toLowerCase();
     if (!COMMANDS.includes(command)) return;
 
-    if (!this.frame.isAuthorized(message.member)) {
+    if (OWNER_ONLY_COMMANDS.has(command)) {
+      if (!this.frame.isOwner(message.author.id)) return; // silent - this command doesn't exist as far as non-owners can tell
+    } else if (!this.frame.isAuthorized(message.member)) {
       await message.reply({ content: "You need Manage Server permission to use GlassFrame Protocol commands." });
       return;
     }
@@ -55,6 +73,8 @@ class PrefixRouter {
     if (command === "scan") return this._scan(message);
     if (command === "metrics") return this._metrics(message);
     if (command === "phishing") return this._phishing(message, args);
+    if (command === "prefix") return this._prefix(message, args);
+    if (command === "engine") return this._engine(message, args);
   }
 
   async _panel(message) {
@@ -63,46 +83,66 @@ class PrefixRouter {
     this.frame.panelMessages.set(sent.id, message.guild.id);
   }
 
+  /** Each layer's line explains what it actually watches for, not just on/off - the same reasoning-first approach as metrics. */
   async _status(message) {
     const status = this.frame.getStatus(message.guild.id);
-    const fields = LAYER_NAMES.map((l) => ({ name: l, value: status[l] ? "ACTIVE" : "INACTIVE" }));
+    const fields = Object.keys(this.frame.layers).map((name) => ({
+      name: `${status[name] ? "ACTIVE" : "INACTIVE"} - ${name}`,
+      value: LAYER_REASONING[name] || "a custom layer registered via frame.registerLayer()."
+    }));
     const payload = buildLogMessage({ level: "info", title: "GlassFrame Protocol - Status", fields });
     await message.channel.send(payload);
   }
 
   async _help(message) {
-    const prefix = this.frame.config.prefix;
-    const payload = buildLogMessage({
-      level: "info",
-      title: "GlassFrame Protocol - Commands",
-      description: [
-        `${prefix}panel - open the 5-button control panel`,
-        `${prefix}status - show which layers are active`,
-        `${prefix}scan - check current roles for name/permission mismatches`,
-        `${prefix}metrics - show performance and cache health`,
-        `${prefix}phishing add|remove|list <domain> - manage the link blocklist`,
-        `${prefix}whitelist add <userId> - exempt a user from all punitive action`,
-        `${prefix}whitelist remove <userId> - remove an exemption`,
-        `${prefix}help - this message`
-      ].join("\n")
-    });
+    const prefix = this.frame.getPrefix(message.guild.id);
+    const sections = [
+      {
+        name: "Getting started",
+        value: [
+          `${prefix}panel - the 5-button control panel. Nothing runs until a layer is armed here (or via autoStart in code).`,
+          `${prefix}status - which layers are on right now, and what each one actually watches for.`
+        ].join("\n")
+      },
+      {
+        name: "Security tools",
+        value: [
+          `${prefix}scan - checks current roles for name/permission mismatches (impersonation bait, quiet privilege grants).`,
+          `${prefix}phishing add|remove|list <domain> - manage the link blocklist Basic Security checks messages against.`,
+          `${prefix}whitelist add|remove <userId> - exempt someone from punitive action, in this server only.`
+        ].join("\n")
+      },
+      {
+        name: "Diagnostics",
+        value: `${prefix}metrics - this server's numbers (open cases, flagged members, whitelist size); one button on the message switches to bot-wide totals across every server.`
+      },
+      {
+        name: "Customization",
+        value: [
+          `${prefix}prefix set <newPrefix> - change this server's command prefix.`,
+          `${prefix}prefix reset - go back to the default (\`${this.frame.config.prefix}\`).`
+        ].join("\n")
+      }
+    ];
+    const payload = buildLogMessage({ level: "info", title: "GlassFrame Protocol - Help", fields: sections });
     await message.channel.send(payload);
   }
 
   async _whitelist(message, args) {
+    const prefix = this.frame.getPrefix(message.guild.id);
     const [sub, id] = args;
     if (!sub || !id) {
-      await message.reply({ content: `Usage: ${this.frame.config.prefix}whitelist <add|remove> <userId>` });
+      await message.reply({ content: `Usage: ${prefix}whitelist <add|remove> <userId>` });
       return;
     }
 
     const action = sub.toLowerCase();
-    if (action === "add") this.frame.whitelist.add(id);
-    else if (action === "remove") this.frame.whitelist.delete(id);
+    if (action === "add") this.frame.addToWhitelist(message.guild.id, id);
+    else if (action === "remove") this.frame.removeFromWhitelist(message.guild.id, id);
     else return;
 
     await message.reply({
-      content: `Whitelist updated: ${id} ${action === "add" ? "added to" : "removed from"} the exemption list.`
+      content: `Whitelist updated: ${id} ${action === "add" ? "added to" : "removed from"} the exemption list for this server.`
     });
   }
 
@@ -121,32 +161,13 @@ class PrefixRouter {
   }
 
   async _metrics(message) {
-    const m = this.frame.getMetrics();
-    const fmtCache = (c) => `size ${c.size} | hits ${c.hits} | misses ${c.misses} | evictions ${c.evictions}`;
-    const fmtQueue = (q) => `active ${q.active}/${q.concurrency} | pending ${q.pending} | completed ${q.completed} | failed ${q.failed}`;
-    const fmtLatency = Object.entries(m.performance.avgLatencyMs)
-      .map(([name, ms]) => `${name}: ${ms}ms avg`)
-      .join("\n") || "no samples yet";
-
-    const payload = buildLogMessage({
-      level: "info",
-      title: "GlassFrame Protocol - Performance",
-      description: `Uptime: ${Math.round(m.performance.uptimeMs / 60000)} min`,
-      fields: [
-        { name: "Action queue", value: fmtQueue(m.queues.actions) },
-        { name: "AI queue", value: fmtQueue(m.queues.ai) },
-        { name: "Threat score cache", value: fmtCache(m.caches.threatScores) },
-        { name: "Open case cache", value: fmtCache(m.caches.openCases) },
-        { name: "Groq verdict cache", value: fmtCache(m.caches.groqVerdicts) },
-        { name: "Average latency", value: fmtLatency }
-      ]
-    });
+    const payload = buildMetricsMessage(this.frame, message.guild.id, "guild");
     await message.channel.send(payload);
   }
 
   async _phishing(message, args) {
+    const prefix = this.frame.getPrefix(message.guild.id);
     const [sub, domain] = args;
-    const prefix = this.frame.config.prefix;
 
     if (!sub || sub.toLowerCase() === "list") {
       const domains = this.frame.phishingDatabase.list();
@@ -172,6 +193,60 @@ class PrefixRouter {
       await message.reply({ content: `Usage: ${prefix}phishing <add|remove|list> <domain>` });
     }
   }
+
+  async _prefix(message, args) {
+    const [sub, newPrefix] = args;
+    const current = this.frame.getPrefix(message.guild.id);
+
+    if (!sub) {
+      await message.reply({ content: `This server's prefix is currently \`${current}\`. Usage: ${current}prefix set <newPrefix> | reset` });
+      return;
+    }
+
+    const action = sub.toLowerCase();
+    if (action === "reset") {
+      this.frame.guildPrefixes.delete(message.guild.id);
+      this.frame._persistGuildState(message.guild.id);
+      await message.reply({ content: `Prefix reset to the default: \`${this.frame.config.prefix}\`` });
+      return;
+    }
+
+    if (action === "set") {
+      if (!newPrefix) {
+        await message.reply({ content: `Usage: ${current}prefix set <newPrefix>` });
+        return;
+      }
+      this.frame.setPrefix(message.guild.id, newPrefix);
+      await message.reply({
+        content: `This server's prefix is now \`${newPrefix}\`. The default \`${this.frame.config.prefix}\` still works too, as a fallback.`
+      });
+      return;
+    }
+
+    await message.reply({ content: `Usage: ${current}prefix set <newPrefix> | reset` });
+  }
+
+  /**
+   * Owner-only, bot-wide dashboard - see frame.getEngineReport(). Not
+   * listed in !gf help on purpose. If config.engine.password is set, it's
+   * required as `!gf engine <password>`; the command message is deleted
+   * either way (right or wrong) so the password never sits visible in
+   * channel history. Wrong-password attempts count toward a lockout - see
+   * GlassFrame.verifyEnginePassword().
+   */
+  async _engine(message, args) {
+    const passwordOk = this.frame.verifyEnginePassword(message.author.id, args.join(" "));
+    try {
+      if (message.deletable) await message.delete();
+    } catch {
+      /* best effort - if the bot can't delete here, that's a permissions gap to fix, not a reason to fail open */
+    }
+    if (!passwordOk) return;
+
+    const report = this.frame.getEngineReport();
+    const payload = buildEnginePage(report, "overview");
+    await message.channel.send(payload);
+  }
 }
 
 module.exports = PrefixRouter;

package/dist/src/core/Cache.js

@@ -84,6 +84,16 @@ class ProtocolCache {
     return { ...this.stats, size: this.store.size, name: this.name };
   }
 
+  /** Counts non-expired entries whose key starts with `prefix` - used for per-guild breakdowns of a `guildId:userId`-keyed cache. */
+  countByPrefix(prefix) {
+    const now = Date.now();
+    let count = 0;
+    for (const [key, entry] of this.store) {
+      if (key.startsWith(prefix) && now <= entry.expiresAt) count++;
+    }
+    return count;
+  }
+
   destroy() {
     if (this._sweeper) clearInterval(this._sweeper);
   }

package/dist/src/core/Layer.js

@@ -13,18 +13,20 @@ const EventEmitter = require("events");
  * verification level, revert a role's permissions) since those are
  * time-critical and aren't about penalizing one member.
  *
- * enable()/disable() are the only lifecycle a layer needs to implement -
- * disable() fully detaches every listener the layer attached, so a disabled
- * layer does zero work rather than quietly early-returning inside a handler
- * that's still subscribed.
+ * Enabled state is per-guild, not global: one bot process can serve many
+ * guilds, each with its own independent set of active layers. Discord's
+ * gateway doesn't support attaching a listener scoped to a single guild, so
+ * the underlying event listener is attached exactly once, ever
+ * (attach()), and every handler must gate its actual work behind
+ * `this.isEnabled(guildId)` as its first check - a disabled guild does zero
+ * work past that check, an enabled one proceeds normally.
  */
 class Layer extends EventEmitter {
   constructor(name, frame) {
     super();
     this.name = name;
     this.frame = frame;
-    this.enabled = false;
-    this._listeners = [];
+    this.enabledGuilds = new Set();
   }
 
   get client() {
@@ -35,34 +37,37 @@ class Layer extends EventEmitter {
     return this.frame.config[this.name] || {};
   }
 
+  isEnabled(guildId) {
+    return this.enabledGuilds.has(guildId);
+  }
+
   _listen(emitter, event, handler) {
     emitter.on(event, handler);
-    this._listeners.push([emitter, event, handler]);
   }
 
-  enable() {
-    if (this.enabled) return this;
-    this.enabled = true;
-    this.onEnable();
-    this.frame.emit("layerToggled", { layer: this.name, enabled: true });
+  enable(guildId) {
+    const already = this.enabledGuilds.has(guildId);
+    this.enabledGuilds.add(guildId);
+    if (!already) {
+      this.frame._persistGuildState(guildId);
+      this.frame.emit("layerToggled", { layer: this.name, guildId, enabled: true });
+    }
     return this;
   }
 
-  disable() {
-    if (!this.enabled) return this;
-    this.enabled = false;
-    for (const [emitter, event, handler] of this._listeners) {
-      emitter.removeListener(event, handler);
+  disable(guildId) {
+    const had = this.enabledGuilds.delete(guildId);
+    if (had) {
+      this.frame._persistGuildState(guildId);
+      this.frame.emit("layerToggled", { layer: this.name, guildId, enabled: false });
     }
-    this._listeners = [];
-    this.onDisable();
-    this.frame.emit("layerToggled", { layer: this.name, enabled: false });
     return this;
   }
 
-  // Subclasses override these two hooks.
-  onEnable() {}
-  onDisable() {}
+  // Subclasses override this: attach event listeners exactly once here
+  // (called once per layer, at GlassFrame construction). Gate all real work
+  // behind `this.isEnabled(guildId)`.
+  attach() {}
 }
 
 module.exports = Layer;

package/dist/src/core/PerformanceMonitor.js

@@ -3,19 +3,31 @@
 /**
  * Lightweight internal metrics collector - no external dependency, no
  * network call, just counters and a small rolling latency sample per event
- * type. Exposed via `frame.getMetrics()` / `!gf metrics` so you can see
- * whether the protocol is keeping up on a busy server without wiring in a
- * separate APM tool.
+ * type, plus a lightweight per-guild activity tally. Exposed via
+ * `frame.getMetrics()` / `!gf metrics` (per-server and bot-wide) and the
+ * owner-only `!gf engine` dashboard, so you can see whether the protocol is
+ * keeping up - and which server is generating the most work - without
+ * wiring in a separate APM tool.
  */
 class PerformanceMonitor {
   constructor() {
     this.startedAt = Date.now();
     this.eventCounts = {};
     this.latencies = {}; // name -> last 50 durations in ms
+    this.guildActivity = new Map(); // guildId -> event count since startup
   }
 
-  recordEvent(name) {
+  /** `guildId` is optional - pass it from any per-guild handler to also tally that guild's activity. */
+  recordEvent(name, guildId) {
     this.eventCounts[name] = (this.eventCounts[name] || 0) + 1;
+    if (guildId) {
+      this.guildActivity.set(guildId, (this.guildActivity.get(guildId) || 0) + 1);
+    }
+  }
+
+  /** Guild IDs ranked by recorded activity, busiest first. */
+  topGuildsByActivity(limit = 5) {
+    return [...this.guildActivity.entries()].sort((a, b) => b[1] - a[1]).slice(0, limit);
   }
 
   /** Call at the start of a unit of work; call the returned function when it finishes. */

package/dist/src/core/VersionInfo.js

@@ -1,6 +1,6 @@
 "use strict";
 
-const VERSION = "1.2.1";
+const VERSION = "2.1.0";
 const NAME = "GlassFrame Protocol";
 const RELEASED = "2026-07-31";
 

package/dist/src/layers/AIModerationLayer.js

@@ -29,21 +29,21 @@ class AIModerationLayer extends Layer {
     return this.frame.groqClient;
   }
 
-  onEnable() {
+  attach() {
     if (!this.groq?.available) {
       this.frame.emit("warning", {
         layer: "aiModeration",
-        message: "No Groq API keys configured - layer is active but will stay idle. Set aiModeration.apiKeys in config."
+        message: "No Groq API keys configured - layer can be armed but will stay idle. Set aiModeration.apiKeys in config."
       });
     }
     this._listen(this.client, "messageCreate", (message) => this._handle(message).catch(() => {}));
   }
 
-  onDisable() {}
-
   async _handle(message) {
     if (!message.guild || message.author.bot || !message.content) return;
+    if (!this.isEnabled(message.guild.id)) return;
     if (!this.groq?.available) return;
+    this.frame.performance.recordEvent("aiModeration.messageCreate", message.guild.id);
 
     const cfg = this.config;
     const local = classifyMessage(message.content);

package/dist/src/layers/AntiNukeLayer.js

@@ -19,7 +19,10 @@ const EVENT_MAP = {
   [AuditLogEvent.EmojiCreate]: "emojiCreate",
   [AuditLogEvent.EmojiDelete]: "emojiDelete",
   [AuditLogEvent.StickerCreate]: "stickerCreate",
-  [AuditLogEvent.StickerDelete]: "stickerDelete"
+  [AuditLogEvent.StickerDelete]: "stickerDelete",
+  [AuditLogEvent.MemberRoleUpdate]: "memberRoleUpdate",
+  [AuditLogEvent.ChannelOverwriteCreate]: "channelOverwriteCreate",
+  [AuditLogEvent.ChannelOverwriteUpdate]: "channelOverwriteUpdate"
 };
 
 class AntiNukeLayer extends Layer {
@@ -33,22 +36,24 @@ class AntiNukeLayer extends Layer {
     this.webhookMessageCounts = new Map(); // webhookId -> timestamps[]
   }
 
-  onEnable() {
+  attach() {
     this._listen(this.client, "guildAuditLogEntryCreate", (entry, guild) =>
       this._handleEntry(entry, guild).catch(() => {})
     );
     if (this.config.webhookAbuse.enabled) {
       this._listen(this.client, "messageCreate", (message) => this._handleWebhookMessage(message).catch(() => {}));
     }
-    // Give every guild an immediate role audit the moment AntiNuke is armed.
-    for (const guild of this.client.guilds.cache.values()) {
-      this._auditRoles(guild).catch(() => {});
-    }
   }
 
-  onDisable() {
-    this.actionLog.clear();
-    this.webhookMessageCounts.clear();
+  /** Give a guild an immediate role audit the moment AntiNuke is armed for it. */
+  enable(guildId) {
+    const wasEnabled = this.isEnabled(guildId);
+    super.enable(guildId);
+    if (!wasEnabled) {
+      const guild = this.client.guilds.cache.get(guildId);
+      if (guild) this._auditRoles(guild).catch(() => {});
+    }
+    return this;
   }
 
   _record(guildId, executorId, type) {
@@ -66,12 +71,13 @@ class AntiNukeLayer extends Layer {
   async _handleEntry(entry, guild) {
     const type = EVENT_MAP[entry.action];
     if (!type) return;
-    this.frame.performance.recordEvent(`antiNuke.auditEntry.${type}`);
+    if (!this.isEnabled(guild.id)) return;
+    this.frame.performance.recordEvent(`antiNuke.auditEntry.${type}`, guild.id);
 
     const executor = entry.executor;
     if (!executor || executor.id === this.client.user.id) return;
     if (executor.id === guild.ownerId) return;
-    if (this.frame.whitelist.has(executor.id)) return;
+    if (this.frame.isWhitelisted(guild.id, executor.id)) return;
 
     if (type === "roleUpdate" && this.config.watchDangerousGrants) {
       await this._checkDangerousGrant(entry, guild, executor);
@@ -82,6 +88,12 @@ class AntiNukeLayer extends Layer {
     if (type === "inviteCreate" && this.config.watchInviteAbuse) {
       await this._checkInviteAbuse(entry, guild, executor);
     }
+    if (type === "memberRoleUpdate" && this.config.watchDangerousGrants) {
+      await this._checkMemberRoleGrant(entry, guild, executor);
+    }
+    if ((type === "channelOverwriteCreate" || type === "channelOverwriteUpdate") && this.config.watchOverwriteAbuse) {
+      await this._checkChannelOverwriteAbuse(entry, guild, executor);
+    }
     if (type === "webhookCreate" && this.config.webhookAbuse.enabled) {
       this.recentWebhooks.set(
         entry.targetId,
@@ -90,11 +102,10 @@ class AntiNukeLayer extends Layer {
       );
     }
 
-    // Invite creation doesn't count toward the generic burst threshold below -
-    // a legitimate server creates invites routinely, so it's special-cased
-    // above (and only escalated for non-staff + unrestricted configs)
-    // instead of contributing to a raw count.
-    if (type === "inviteCreate") return;
+    // These are special-cased above instead of contributing to a raw burst
+    // count - a single grant/overwrite change is worth flagging immediately
+    // on its own merits, not after N repeats.
+    if (type === "inviteCreate" || type === "memberRoleUpdate" || type === "channelOverwriteCreate" || type === "channelOverwriteUpdate") return;
 
     const count = this._record(guild.id, executor.id, type);
     const threshold = this.config.thresholds[type];
@@ -135,6 +146,7 @@ class AntiNukeLayer extends Layer {
     const role = guild.roles.cache.get(entry.targetId);
 
     await this.frame.logger.log(guild, {
+      layer: this.name,
       level: "alert",
       title: "Dangerous Permission Grant Detected",
       description: `${executor.tag} granted **${gained.join(", ")}** to role ${role ? role.name : entry.targetId}.`,
@@ -159,6 +171,7 @@ class AntiNukeLayer extends Layer {
     if (!changed.length) return;
 
     await this.frame.logger.log(guild, {
+      layer: this.name,
       level: "warn",
       title: "Server Identity Changed",
       description: `${executor.tag} changed: ${changed.map((c) => c.key).join(", ")}.`,
@@ -190,6 +203,7 @@ class AntiNukeLayer extends Layer {
     if (trust === "HIGH" || trust === "PROTECTED") return;
 
     await this.frame.logger.log(guild, {
+      layer: this.name,
       level: "warn",
       title: "Unrestricted Invite Created By Non-Staff Member",
       description: `${executor.tag} (trust: ${trust}) created an invite with no expiry and no use limit.`,
@@ -197,6 +211,86 @@ class AntiNukeLayer extends Layer {
     });
   }
 
+  /**
+   * RoleUpdate (above) catches a role's own permissions changing - this
+   * catches the other half: a specific MEMBER being handed a role that
+   * already carries dangerous permissions. Missing this meant someone
+   * with ManageRoles could quietly promote themselves (or an accomplice)
+   * without ever touching a role's definition.
+   */
+  async _checkMemberRoleGrant(entry, guild, executor) {
+    const added = (entry.changes || []).find((c) => c.key === "$add");
+    if (!added || !Array.isArray(added.new) || !added.new.length) return;
+
+    const dangerous = this.frame.config.roleAnalysis.dangerousPermissions;
+    const dangerousRoles = added.new
+      .map((r) => guild.roles.cache.get(r.id))
+      .filter((role) => role && dangerous.some((p) => role.permissions.has(PermissionsBitField.Flags[p])));
+    if (!dangerousRoles.length) return;
+
+    let executorMember = null;
+    try {
+      executorMember = await guild.members.fetch(executor.id);
+    } catch {
+      /* left already */
+    }
+    const trust = executorMember ? this.frame.roleAnalyzer.trustLevel(executorMember) : "LOW";
+    if (trust === "HIGH" || trust === "PROTECTED") return;
+
+    await this.frame.logger.log(guild, {
+      layer: this.name,
+      level: "alert",
+      title: "Dangerous Role Granted To A Member",
+      description: `${executor.tag} (trust: ${trust}) gave <@${entry.targetId}> the role(s): ${dangerousRoles
+        .map((r) => r.name)
+        .join(", ")}.`,
+      dedupeKey: `antinuke:member-grant:${entry.targetId}`
+    });
+  }
+
+  /**
+   * A nuke doesn't have to delete anything - locking @everyone out of a
+   * public channel, or opening a private one up to @everyone, does the
+   * same damage through permission overwrites instead. Only @everyone's
+   * own overwrite is watched here; a role- or member-specific overwrite
+   * change is routine channel administration and not worth flagging.
+   */
+  async _checkChannelOverwriteAbuse(entry, guild, executor) {
+    if (!entry.extra || String(entry.extra.id) !== guild.id) return;
+
+    const allowChange = (entry.changes || []).find((c) => c.key === "allow");
+    const denyChange = (entry.changes || []).find((c) => c.key === "deny");
+    if (!allowChange && !denyChange) return;
+
+    const oldAllow = new PermissionsBitField(BigInt(allowChange?.old ?? 0));
+    const newAllow = new PermissionsBitField(BigInt(allowChange?.new ?? 0));
+    const oldDeny = new PermissionsBitField(BigInt(denyChange?.old ?? 0));
+    const newDeny = new PermissionsBitField(BigInt(denyChange?.new ?? 0));
+
+    const view = PermissionsBitField.Flags.ViewChannel;
+    const nowGrantsView = !oldAllow.has(view) && newAllow.has(view);
+    const nowBlocksView = !oldDeny.has(view) && newDeny.has(view);
+    if (!nowGrantsView && !nowBlocksView) return;
+
+    let executorMember = null;
+    try {
+      executorMember = await guild.members.fetch(executor.id);
+    } catch {
+      /* left already */
+    }
+    const trust = executorMember ? this.frame.roleAnalyzer.trustLevel(executorMember) : "LOW";
+    if (trust === "HIGH" || trust === "PROTECTED") return;
+
+    const channel = guild.channels.cache.get(entry.targetId);
+    await this.frame.logger.log(guild, {
+      layer: this.name,
+      level: "alert",
+      title: nowBlocksView ? "Channel Locked Out For Everyone" : "Private Channel Opened To Everyone",
+      description: `${executor.tag} (trust: ${trust}) changed @everyone's access to ${channel ? channel.name : entry.targetId}.`,
+      dedupeKey: `antinuke:overwrite:${entry.targetId}`
+    });
+  }
+
   /**
    * Webhook messages never carry a guild member, so BasicSecurityLayer's
    * per-author spam buffer can't see them - a "create webhook, then flood
@@ -206,6 +300,7 @@ class AntiNukeLayer extends Layer {
    */
   async _handleWebhookMessage(message) {
     if (!message.webhookId || !message.guild) return;
+    if (!this.isEnabled(message.guild.id)) return;
     const info = this.recentWebhooks.get(message.webhookId);
     if (!info) return;
 
@@ -228,6 +323,7 @@ class AntiNukeLayer extends Layer {
     }
 
     await this.frame.logger.log(guild, {
+      layer: this.name,
       level: "alert",
       title: "Webhook Message Flood - Webhook Removed",
       description: `A recently created webhook sent ${list.length}+ messages inside ${cfg.windowMs / 1000}s and has been deleted.`,
@@ -267,6 +363,7 @@ class AntiNukeLayer extends Layer {
     if (!flags.length) return;
 
     await this.frame.logger.log(guild, {
+      layer: this.name,
       level: "warn",
       title: "Role Audit - Possible Impersonation/Permission Mismatch",
       description: flags.map((f) => `**${f.name}** (${f.roleId}) - ${f.reason}`).join("\n"),