glassframe-protocol 1.2.1 → 2.1.0

package/dist/src/layers/AntiRaidLayer.js

@@ -12,15 +12,10 @@ class AntiRaidLayer extends Layer {
     this.joinProfiles = new Map(); // guildId -> [{ at, created }] for cluster correlation
   }
 
-  onEnable() {
+  attach() {
     this._listen(this.client, "guildMemberAdd", (member) => this._handleJoin(member).catch(() => {}));
   }
 
-  onDisable() {
-    this.joinTimestamps.clear();
-    this.joinProfiles.clear();
-  }
-
   isLockedDown(guildId) {
     const until = this.lockedDown.get(guildId);
     return typeof until === "number" && Date.now() < until;
@@ -75,7 +70,8 @@ class AntiRaidLayer extends Layer {
 
   async _handleJoin(member) {
     const { guild, user } = member;
-    this.frame.performance.recordEvent("antiRaid.guildMemberAdd");
+    if (!this.isEnabled(guild.id)) return;
+    this.frame.performance.recordEvent("antiRaid.guildMemberAdd", guild.id);
     const joinCount = this._recordJoin(guild.id);
     const { score: altScore, entropyCheck } = this._altScore(user);
     const cluster = this._clusterScore(guild.id, user);
@@ -110,6 +106,7 @@ class AntiRaidLayer extends Layer {
     }
 
     await this.frame.logger.log(guild, {
+      layer: this.name,
       level: "alert",
       title: "Raid Detected - Lockdown Engaged",
       description: `${joinCount} joins inside ${this.config.joinWindowMs / 1000}s. Verification level temporarily raised.`,
@@ -133,6 +130,7 @@ class AntiRaidLayer extends Layer {
     }
 
     await this.frame.logger.log(guild, {
+      layer: this.name,
       level: "ok",
       title: "Lockdown Lifted",
       description: "Join activity normalized. Verification level restored.",

package/dist/src/layers/BasicSecurityLayer.js

@@ -6,31 +6,29 @@ const { classifyMessage } = require("../utils/nlpEngine");
 class BasicSecurityLayer extends Layer {
   constructor(frame) {
     super("basicSecurity", frame);
-    this.buffers = new Map(); // userId -> { timestamps, lastContent, dupCount }
+    this.buffers = new Map(); // `guildId:userId` -> { timestamps, lastContent, dupCount }
   }
 
-  onEnable() {
+  attach() {
     this._listen(this.client, "messageCreate", (message) => this._handle(message).catch(() => {}));
   }
 
-  onDisable() {
-    this.buffers.clear();
-  }
-
-  _bufferFor(userId) {
-    if (!this.buffers.has(userId)) {
-      this.buffers.set(userId, { timestamps: [], lastContent: "", dupCount: 0 });
+  _bufferFor(guildId, userId) {
+    const key = `${guildId}:${userId}`;
+    if (!this.buffers.has(key)) {
+      this.buffers.set(key, { timestamps: [], lastContent: "", dupCount: 0 });
     }
-    return this.buffers.get(userId);
+    return this.buffers.get(key);
   }
 
   async _handle(message) {
     if (!message.guild || message.author.bot) return;
+    if (!this.isEnabled(message.guild.id)) return;
     const done = this.frame.performance.time("basicSecurity.messageCreate");
-    this.frame.performance.recordEvent("basicSecurity.messageCreate");
+    this.frame.performance.recordEvent("basicSecurity.messageCreate", message.guild.id);
 
     const cfg = this.config;
-    const buf = this._bufferFor(message.author.id);
+    const buf = this._bufferFor(message.guild.id, message.author.id);
     const now = Date.now();
 
     buf.timestamps = buf.timestamps.filter((t) => now - t < cfg.spam.windowMs);
@@ -45,6 +43,8 @@ class BasicSecurityLayer extends Layer {
     const mentionCount = message.mentions.users.size + message.mentions.roles.size;
     const classification = classifyMessage(message.content || "");
     const linkFlag = this._checkLinks(message.content || "");
+    const hasInvite = this._checkInviteLink(message.content || "");
+    const trust = this.frame.roleAnalyzer.trustLevel(message.member);
 
     const reasons = [];
     let weight = 0;
@@ -61,6 +61,14 @@ class BasicSecurityLayer extends Layer {
       reasons.push(`mention spam (${mentionCount})`);
       weight += 25;
     }
+    // A single @everyone/@here reaches every member at once - much higher
+    // impact than several individual mentions, so it's weighted heavier and
+    // checked separately. Recognized trusted staff are exempt, since a real
+    // admin's announcement ping is routine, not an attack.
+    if (message.mentions.everyone && trust !== "HIGH" && trust !== "PROTECTED") {
+      reasons.push("@everyone/@here mention from a non-trusted member");
+      weight += 50;
+    }
     if (classification.scam >= cfg.nlp.scamScoreThreshold) {
       reasons.push(`scam language (${classification.scam.toFixed(2)})`);
       weight += 35;
@@ -69,6 +77,20 @@ class BasicSecurityLayer extends Layer {
       reasons.push(`phishing language (${classification.phishing.toFixed(2)})`);
       weight += 35;
     }
+    if (classification.raidCallout >= cfg.nlp.raidCalloutThreshold) {
+      reasons.push(`raid-recruitment language (${classification.raidCallout.toFixed(2)})`);
+      weight += 35;
+    }
+    // The specific pattern in a lot of real raid-tool spam: an invite link
+    // to another server, paired with language recruiting people to raid
+    // with it. Neither signal alone is damning - plenty of normal messages
+    // share an invite, plenty of normal messages mention "raid" in passing
+    // - but together, from a non-trusted member, it's a strong, specific
+    // signal worth weighting heavily on its own.
+    if (hasInvite && classification.raidCallout >= cfg.nlp.raidCalloutThreshold && trust !== "HIGH" && trust !== "PROTECTED") {
+      reasons.push("Discord invite link paired with raid-recruitment language");
+      weight += 50;
+    }
     if (linkFlag) {
       reasons.push(linkFlag);
       weight += 30;
@@ -106,6 +128,11 @@ class BasicSecurityLayer extends Layer {
     }
     return null;
   }
+
+  /** True if the message contains a Discord server invite link, of any of the URL forms Discord accepts. */
+  _checkInviteLink(text) {
+    return /(?:discord\.gg|discord(?:app)?\.com\/invite)\/[a-z0-9-]+/i.test(text);
+  }
 }
 
 module.exports = BasicSecurityLayer;

package/dist/src/logging/SmartLogger.js

@@ -2,12 +2,23 @@
 
 const { buildLogMessage } = require("./ComponentsV2");
 
+const RECENT_LOG_LIMIT = 30;
+
 /**
  * Every GlassFrame alert goes through one gate that:
  *  (a) merges near-duplicate events inside a short window into a single,
- *      updated message instead of one message per event, and
+ *      updated message instead of one message per event,
  *  (b) never sends to a guild's log channel faster than a configured floor,
- * so a burst never turns into a wall of messages or a Discord 429.
+ *      so a burst never turns into a wall of messages or a Discord 429, and
+ *  (c) keeps a small in-memory record of the most recent events across
+ *      EVERY guild, for the owner-only `!gf engine` dashboard - see
+ *      getRecentLogs() below.
+ *
+ * `getLogChannel(guild, layerName)` receives the reporting layer's name as
+ * an optional second argument, so you can route different layers to
+ * different channels if you want. A `getLogChannel` that only takes one
+ * parameter (the common case) keeps working unchanged - JS simply ignores
+ * the extra argument.
  */
 class SmartLogger {
   constructor(getLogChannel, config, { debug = false } = {}) {
@@ -16,10 +27,12 @@ class SmartLogger {
     this.debug = debug;
     this.pending = new Map(); // dedupeKey -> { count, payload, sent }
     this.lastSend = new Map(); // guildId -> timestamp
+    this.recentLogs = []; // bounded ring buffer, newest first - see getRecentLogs()
   }
 
   async log(guild, payload) {
     const key = payload.dedupeKey ? `${guild.id}:${payload.dedupeKey}` : null;
+    this._recordRecent(guild, payload);
 
     if (key && this.pending.has(key)) {
       const entry = this.pending.get(key);
@@ -56,7 +69,7 @@ class SmartLogger {
 
   async _deliver(guild, payload, count) {
     await this._respectRateFloor(guild.id);
-    const channel = await this.getLogChannel(guild);
+    const channel = await this.getLogChannel(guild, payload.layer);
     if (!channel) return null;
 
     const message = buildLogMessage({ ...payload, count });
@@ -76,6 +89,23 @@ class SmartLogger {
     if (wait > 0) await new Promise((resolve) => setTimeout(resolve, wait));
   }
 
+  _recordRecent(guild, payload) {
+    this.recentLogs.unshift({
+      at: Date.now(),
+      guildId: guild.id,
+      guildName: guild.name,
+      level: payload.level || "info",
+      title: payload.title || "",
+      layer: payload.layer || null
+    });
+    if (this.recentLogs.length > RECENT_LOG_LIMIT) this.recentLogs.length = RECENT_LOG_LIMIT;
+  }
+
+  /** The most recent log events across every guild, newest first - powers the owner-only `!gf engine` command. */
+  getRecentLogs(limit = 10) {
+    return this.recentLogs.slice(0, limit);
+  }
+
   _debug(msg) {
     if (this.debug) console.log(`[GlassFrame:SmartLogger] ${msg}`);
   }

package/dist/src/moderation/PunishmentEngine.js

@@ -5,8 +5,11 @@ const ProtocolCache = require("../core/Cache");
 
 // Used only to decide whether continued bad behavior mid-case deserves a
 // stronger response - never to decide the response itself (_decideAction
-// still owns that, trust-gating included).
+// still owns that, trust-gating included). Custom actions (registerAction)
+// default to 2 - the same tier as quarantine/timeout - since there's no
+// way to know their real severity automatically.
 const ACTION_SEVERITY = { log: 0, alert: 1, quarantine: 2, timeout: 2, kick: 3, ban: 4 };
+const severityOf = (action) => ACTION_SEVERITY[action] ?? 2;
 
 /**
  * The only place in GlassFrame Protocol that actually punishes a member.
@@ -18,21 +21,26 @@ const ACTION_SEVERITY = { log: 0, alert: 1, quarantine: 2, timeout: 2, kick: 3,
  * ladder alone would say.
  */
 class PunishmentEngine extends EventEmitter {
-  constructor({ config, threatEngine, roleAnalyzer, logger, whitelist, queue, performance, debug = false }) {
+  constructor({ config, threatEngine, roleAnalyzer, logger, whitelist, customActions, queue, performance, debug = false }) {
     super();
     this.config = config.punishment;
     this.threatEngine = threatEngine;
     this.roleAnalyzer = roleAnalyzer;
     this.logger = logger;
+    // actionName -> async (member, record) => void, registered via
+    // frame.registerAction() so config.punishment.ladder can reference
+    // custom actions beyond ban/kick/timeout/quarantine.
+    this.customActions = customActions || new Map();
     // Actual Discord mutations (ban/kick/timeout/quarantine) go through this
     // bounded-concurrency queue rather than firing directly, so a burst of
     // simultaneous cases (a raid, a nuke sweep) can't overrun Discord's rate
     // limits. Falls back to running inline if no queue is supplied.
     this.queue = queue || { push: (task) => task() };
     this.performance = performance || { recordEvent() {}, time: () => () => {} };
-    // Accept the same Set the rest of GlassFrame uses (not a copy), so
-    // runtime whitelist edits (e.g. !gf whitelist add) apply immediately here too.
-    this.whitelist = whitelist instanceof Set ? whitelist : new Set(whitelist || []);
+    // Accept the same Map the rest of GlassFrame uses (guildId -> Set<userId>),
+    // by reference, not a copy, so runtime edits (e.g. !gf whitelist add)
+    // apply immediately here too.
+    this.whitelist = whitelist;
     this.cases = new ProtocolCache("open-cases", { ttlMs: this.config.caseCooldownMs, debug });
   }
 
@@ -47,7 +55,7 @@ class PunishmentEngine extends EventEmitter {
   async report({ guild, member, layer, weight, reason }) {
     if (!member) return null;
     const userId = member.id;
-    if (this.whitelist.has(userId)) return null;
+    if (this.whitelist.get(guild.id)?.has(userId)) return null;
 
     const { score, tier } = this.threatEngine.addSignal(guild.id, userId, { layer, weight, reason });
     if (tier === "none") return null;
@@ -66,7 +74,7 @@ class PunishmentEngine extends EventEmitter {
 
       const trust = this.roleAnalyzer.trustLevel(member);
       const nextAction = this._decideAction(tier, trust);
-      if (ACTION_SEVERITY[nextAction] > ACTION_SEVERITY[openCase.action]) {
+      if (severityOf(nextAction) > severityOf(openCase.action)) {
         openCase.action = nextAction;
         openCase.trust = trust;
         this.cases.set(key, openCase);
@@ -124,6 +132,9 @@ class PunishmentEngine extends EventEmitter {
         const removable = member.roles.cache.filter((r) => r.id !== guild.id && r.editable);
         await this.queue.push(() => member.roles.remove(removable, this._reason(record)));
         performed = true;
+      } else if (this.customActions.has(action) && canAct) {
+        await this.queue.push(() => this.customActions.get(action)(member, record));
+        performed = true;
       }
     } catch (err) {
       record.error = err.message;
@@ -140,6 +151,7 @@ class PunishmentEngine extends EventEmitter {
     await this.logger.log(guild, {
       level: action === "alert" ? "alert" : action === "log" ? "info" : "warn",
       title: this._title(action),
+      layer: "punishmentEngine",
       description: `${member.user.tag} (${member.id}) - tier **${record.tier}**, trust **${record.trust}**.`,
       fields: [
         { name: "Reasons", value: record.reasons.slice(-5).join("\n") },

package/dist/src/ui/ControlPanel.js

@@ -55,4 +55,198 @@ function buildPanel(frame, guildId) {
   return { flags: MessageFlags.IsComponentsV2, components: [container] };
 }
 
-module.exports = { buildPanel, BUTTONS };
+/**
+ * !gf metrics shows THIS SERVER's numbers by default - the one button on
+ * this message switches to bot-wide (all servers) and back. This is a
+ * second, separate button from the 5-button panel above; it lives on the
+ * metrics command's own message, not on the panel.
+ */
+function buildMetricsMessage(frame, guildId, scope = "guild") {
+  const isGlobal = scope === "global";
+  const fields = [];
+
+  if (isGlobal) {
+    const m = frame.getMetrics();
+    const fmtCache = (c) => `size ${c.size} | hits ${c.hits} | misses ${c.misses} | evictions ${c.evictions}`;
+    const fmtQueue = (q) => `active ${q.active}/${q.concurrency} | pending ${q.pending} | completed ${q.completed} | failed ${q.failed}`;
+    const fmtLatency =
+      Object.entries(m.performance.avgLatencyMs)
+        .map(([name, ms]) => `${name}: ${ms}ms avg`)
+        .join("\n") || "no samples yet";
+
+    const queueNote = (q) =>
+      q.pending > 0
+        ? `-# ${q.pending} task(s) queued behind the concurrency cap - normal during a burst, worth raising the cap in config if it's constant.`
+        : "-# Nothing queued - everything is running as soon as it's requested.";
+
+    fields.push(
+      { name: "Uptime", value: `${Math.round(m.performance.uptimeMs / 60000)} min` },
+      { name: "Action queue", value: `${fmtQueue(m.queues.actions)}\n${queueNote(m.queues.actions)}` },
+      { name: "AI queue", value: `${fmtQueue(m.queues.ai)}\n${queueNote(m.queues.ai)}` },
+      {
+        name: "Threat score cache (all servers)",
+        value: `${fmtCache(m.caches.threatScores)}\n-# One entry per member with any recent signal, across every server - this decays and self-prunes, so a high size alone isn't a problem.`
+      },
+      {
+        name: "Open case cache (all servers)",
+        value: `${fmtCache(m.caches.openCases)}\n-# Members currently inside their debounce window after being actioned - this is what stops a repeat trip from re-punishing or re-logging.`
+      },
+      {
+        name: "Groq verdict cache (all servers)",
+        value: `${fmtCache(m.caches.groqVerdicts)}\n-# A high hit rate means repeated/near-identical messages are being caught without a fresh API call each time.`
+      },
+      { name: "Average latency", value: fmtLatency || "no samples yet" }
+    );
+  } else {
+    const gm = frame.getGuildMetrics(guildId);
+    const statusLines = REAL_LAYERS.map((l) => `${gm.status[l] ? "ACTIVE" : "inactive"} - ${l}`).join("\n");
+    const activeCount = REAL_LAYERS.filter((l) => gm.status[l]).length;
+
+    fields.push(
+      {
+        name: "Layers",
+        value: `${statusLines}\n-# ${activeCount === 0 ? "Nothing is armed yet - use the panel or autoStart to turn a layer on." : `${activeCount}/4 layers watching this server.`}`
+      },
+      {
+        name: "Flagged members right now",
+        value: `${gm.flaggedMembers}\n-# Members with a live risk score above zero. This naturally decays over time on its own - a number that keeps climbing is worth a closer look, one that holds steady usually isn't.`
+      },
+      {
+        name: "Open cases",
+        value: `${gm.openCases}\n-# Members currently in their post-action cooldown window. A repeat trip within it escalates the same case rather than opening (or logging) a new one.`
+      },
+      {
+        name: "Whitelisted users",
+        value: `${gm.whitelistSize}\n-# Users exempt from punitive action in this server specifically - whitelisting elsewhere doesn't affect this count.`
+      }
+    );
+  }
+
+  const nextScope = isGlobal ? "guild" : "global";
+  const toggleButton = new ButtonBuilder()
+    .setCustomId(`gfp_metrics_${nextScope}`)
+    .setLabel(isGlobal ? "Show This Server" : "Show Global (All Servers)")
+    .setStyle(ButtonStyle.Secondary);
+  const row = new ActionRowBuilder().addComponents(toggleButton);
+
+  const container = new ContainerBuilder().setAccentColor(0x5865f2);
+  container.addTextDisplayComponents(
+    new TextDisplayBuilder().setContent(
+      isGlobal ? "**GlassFrame Protocol - Global Metrics**" : "**GlassFrame Protocol - This Server's Metrics**"
+    )
+  );
+  container.addSeparatorComponents(new SeparatorBuilder().setSpacing(SeparatorSpacingSize.Small));
+  container.addTextDisplayComponents(
+    new TextDisplayBuilder().setContent(fields.map((f) => `**${f.name}**\n${f.value}`).join("\n\n"))
+  );
+  container.addSeparatorComponents(new SeparatorBuilder().setSpacing(SeparatorSpacingSize.Small));
+  container.addActionRowComponents(row);
+  container.addTextDisplayComponents(new TextDisplayBuilder().setContent("-# GlassFrame Protocol"));
+
+  return { flags: MessageFlags.IsComponentsV2, components: [container] };
+}
+
+const ENGINE_PAGES = [
+  { id: "overview", label: "Overview" },
+  { id: "servers", label: "Servers" },
+  { id: "ai", label: "AI" },
+  { id: "performance", label: "Performance" },
+  { id: "logs", label: "Activity Log" }
+];
+
+/**
+ * The owner-only `!gf engine` dashboard - everything running across every
+ * guild at once, split into 5 pages so each one has room to actually go
+ * deep instead of cramming everything into one message. Built from
+ * `frame.getEngineReport()`. Reaching the FIRST page requires
+ * verifyEnginePassword() (see GlassFrame.js) if one is configured;
+ * navigating between pages afterward only re-checks isOwner() on the
+ * clicking Discord identity, not the password again.
+ */
+function buildEnginePage(report, page = "overview") {
+  const container = new ContainerBuilder().setAccentColor(0x5865f2);
+  container.addTextDisplayComponents(
+    new TextDisplayBuilder().setContent(
+      `**GlassFrame Protocol - Engine**\n${report.version.name} v${report.version.version} | up ${Math.round(report.uptimeMs / 60000)} min | serving ${report.guildCount} server(s)`
+    )
+  );
+  container.addSeparatorComponents(new SeparatorBuilder().setSpacing(SeparatorSpacingSize.Small));
+
+  if (page === "overview") {
+    const layerLines = Object.entries(report.layerAdoption)
+      .map(([name, count]) => `${name}: armed in ${count}/${report.guildCount} server(s)`)
+      .join("\n");
+    container.addTextDisplayComponents(
+      new TextDisplayBuilder().setContent(`**Layer adoption across every server**\n${layerLines}`)
+    );
+  } else if (page === "servers") {
+    const lines = report.busiestGuilds.length
+      ? report.busiestGuilds.map((g, i) => `${i + 1}. ${g.name} (${g.guildId}) - ${g.count} events recorded`).join("\n")
+      : "No activity recorded yet.";
+    container.addTextDisplayComponents(
+      new TextDisplayBuilder().setContent(`**Busiest servers, ranked by event volume**\n${lines}`)
+    );
+    container.addSeparatorComponents(new SeparatorBuilder().setSpacing(SeparatorSpacingSize.Small));
+    container.addTextDisplayComponents(
+      new TextDisplayBuilder().setContent(
+        "-# \"Events\" counts messages/joins/audit entries any layer processed for that server since this process started - it resets on restart, and isn't a measure of how much trouble a server is causing, just how much traffic it has."
+      )
+    );
+  } else if (page === "ai") {
+    const lines = [
+      `Groq available: ${report.ai.available ? "yes" : "no (no keys configured)"}`,
+      `Key pool: ${report.ai.keyCount} total, ${report.ai.keysOnCooldown} currently on cooldown`,
+      `Calls in the last minute: ${report.ai.callsLastMinute}`,
+      `Total classify() calls this run: ${report.ai.totalCallsRecorded}`,
+      `Verdict cache: ${report.metrics.caches.groqVerdicts.size} entries, ${report.metrics.caches.groqVerdicts.hits} hits / ${report.metrics.caches.groqVerdicts.misses} misses`
+    ].join("\n");
+    container.addTextDisplayComponents(new TextDisplayBuilder().setContent(`**AI moderation usage**\n${lines}`));
+  } else if (page === "performance") {
+    const m = report.metrics;
+    const fmtCache = (c) => `size ${c.size} | hits ${c.hits} | misses ${c.misses} | evictions ${c.evictions}`;
+    const fmtQueue = (q) => `active ${q.active}/${q.concurrency} | pending ${q.pending} | completed ${q.completed} | failed ${q.failed}`;
+    const latencyLines =
+      Object.entries(m.performance.avgLatencyMs)
+        .map(([name, ms]) => `${name}: ${ms}ms avg`)
+        .join("\n") || "no samples yet";
+
+    container.addTextDisplayComponents(
+      new TextDisplayBuilder().setContent(
+        `**Queues**\nAction queue: ${fmtQueue(m.queues.actions)}\nAI queue: ${fmtQueue(m.queues.ai)}`
+      )
+    );
+    container.addSeparatorComponents(new SeparatorBuilder().setSpacing(SeparatorSpacingSize.Small));
+    container.addTextDisplayComponents(
+      new TextDisplayBuilder().setContent(
+        `**Caches**\nThreat scores: ${fmtCache(m.caches.threatScores)}\nOpen cases: ${fmtCache(m.caches.openCases)}\nGroq verdicts: ${fmtCache(m.caches.groqVerdicts)}`
+      )
+    );
+    container.addSeparatorComponents(new SeparatorBuilder().setSpacing(SeparatorSpacingSize.Small));
+    container.addTextDisplayComponents(new TextDisplayBuilder().setContent(`**Average latency**\n${latencyLines}`));
+  } else if (page === "logs") {
+    const lines = report.recentLogs.length
+      ? report.recentLogs
+          .map((e) => `[${new Date(e.at).toISOString().slice(11, 19)}] ${e.guildName} - ${e.title}${e.layer ? ` (${e.layer})` : ""}`)
+          .join("\n")
+      : "Nothing logged yet.";
+    container.addTextDisplayComponents(
+      new TextDisplayBuilder().setContent(`**Recent activity, every server (last ${report.recentLogs.length})**\n${lines}`)
+    );
+  }
+
+  container.addSeparatorComponents(new SeparatorBuilder().setSpacing(SeparatorSpacingSize.Small));
+  const row = new ActionRowBuilder().addComponents(
+    ENGINE_PAGES.map((p) =>
+      new ButtonBuilder()
+        .setCustomId(`gfp_engine_${p.id}`)
+        .setLabel(p.label)
+        .setStyle(p.id === page ? ButtonStyle.Success : ButtonStyle.Secondary)
+    )
+  );
+  container.addActionRowComponents(row);
+  container.addTextDisplayComponents(new TextDisplayBuilder().setContent("-# GlassFrame Protocol - owner-only view"));
+
+  return { flags: MessageFlags.IsComponentsV2, components: [container] };
+}
+
+module.exports = { buildPanel, buildMetricsMessage, buildEnginePage, ENGINE_PAGES, BUTTONS };

package/dist/src/utils/nlpEngine.js

@@ -103,9 +103,9 @@ const PHISHING_LEXICON = {
 };
 
 const RAID_CALLOUT_LEXICON = {
-  strong: new Set(["raid", "nuke", "spam", "flood", "wipe", "destroy", "invite", "bot"]),
+  strong: new Set(["raid", "raiding", "raids", "raided", "nuke", "nuking", "spam", "spamming", "flood", "wipe", "destroy", "invite", "bot"]),
   weak: new Set(["server", "join", "everyone", "ping", "mass"]),
-  bigrams: new Set(["raid this", "nuke server", "mass ping", "spam bots", "join now"])
+  bigrams: new Set(["raid this", "nuke server", "mass ping", "spam bots", "join now", "start raiding"])
 };
 
 function suspiciousUsernameEntropy(username, floor, ceiling) {

package/docs/CACHE_ARCHITECTURE.md

@@ -15,6 +15,10 @@ watch it operate at runtime - see "Turning on cache logging" below.
 - `getStats()` returns hits/misses/sets/evictions/size for any cache at
   runtime, which is useful when you're tuning thresholds in `config.js` and
   want to know whether a value is actually being reused.
+- `countByPrefix(prefix)` counts non-expired entries whose key starts with
+  a prefix - this is how `frame.getGuildMetrics(guildId)` gets one server's
+  slice of the `threat-scores` and `open-cases` caches below without
+  needing a separate per-guild cache for each.
 
 ## Caches in use
 
@@ -33,6 +37,11 @@ windows with no need for hit/miss stats: `AntiRaidLayer.joinTimestamps` /
 are swept lazily - old timestamps are filtered out on the next write rather
 than on a timer, since they're only ever read right after a write.
 
+`SmartLogger.recentLogs` is a fixed-size array (last 30, newest first, not
+a `ProtocolCache`) recording every log event across every guild - it's what
+powers the owner-only `!gf engine` dashboard's Activity Log page. See
+`docs/ENGINE.md`.
+
 Bounded-concurrency queues (`frame.actionQueue`, `frame.aiQueue`) and the
 internal metrics collector (`frame.performance`) are a separate concern from
 caching - see `docs/PERFORMANCE.md`.

package/docs/COMMANDS.md

@@ -9,30 +9,56 @@ running twice or getting a "slow down" reply of its own.
 
 | Command | Does |
 |---|---|
-| `!gf panel` | Sends the 5-button control panel (see below). |
-| `!gf status` | Shows which of the four layers are currently active. |
+| `!gf panel` | Sends the 5-button control panel for this server (see below). |
+| `!gf status` | Shows which of the four layers are currently active **in this server**. |
 | `!gf scan` | Runs `RoleAnalyzer.scanRoles()` on demand and reports any role name/permission mismatches. |
-| `!gf metrics` | Shows queue depth, cache stats, and average latency - see `docs/PERFORMANCE.md`. |
+| `!gf metrics` | Shows **this server's** metrics by default - a button on the message switches to bot-wide (all servers) and back. See `docs/PERFORMANCE.md`. |
 | `!gf phishing add <domain>` | Adds a domain to the link blocklist. |
 | `!gf phishing remove <domain>` | Removes a domain from the blocklist. |
 | `!gf phishing list` | Lists every blocked domain. |
-| `!gf whitelist add <userId>` | Exempts a user from all punitive action. |
-| `!gf whitelist remove <userId>` | Removes an exemption. |
-| `!gf help` | Lists these commands. |
+| `!gf whitelist add <userId>` | Exempts a user from punitive action **in this server**. |
+| `!gf whitelist remove <userId>` | Removes that exemption for this server. |
+| `!gf prefix set <newPrefix>` | Changes this server's own command prefix. |
+| `!gf prefix reset` | Goes back to the default prefix. |
+| `!gf help` | Lists these commands (this list, minus `engine` - see below). |
+
+There is also an owner-only `!gf engine` command - deliberately left out of
+`!gf help` and out of this table's normal flow on purpose. See
+`docs/ENGINE.md`.
+
+Each server can set its own prefix (`!gf prefix set`) - the default from
+`config.prefix` always still works too, as a fallback, in case a server
+forgets its custom one. If a custom prefix happens to overlap with the
+default (e.g. custom `!` vs. default `!gf `), the longer one is tried
+first.
+
+Everything above operates on the server the command was sent in - arming
+AntiRaid, whitelisting someone, or checking status in one server has no
+effect on any other server the bot is in. See `docs/STATE.md`.
 
 ## The control panel
 
-`!gf panel` sends a message with exactly five buttons in one row:
+`!gf panel` sends a message with exactly five buttons in one row, scoped to
+the server it was sent in:
 
 1. **Activate/Deactivate AntiRaid**
 2. **Activate/Deactivate AI Moderation**
 3. **Activate/Deactivate AntiNuke**
 4. **Activate/Deactivate Basic Security**
-5. **Activate/Deactivate Full Protocol** - arms or disarms all four at once
+5. **Activate/Deactivate Full Protocol** - arms or disarms all four at once, for this server only
 
-Every layer starts disabled - nothing runs until it's explicitly activated,
-either from the panel or via `frame.enableLayer("antiRaid")` in code. Button
-labels flip between Activate/Deactivate based on current state, and the
+Every layer starts disabled in every server - nothing runs until it's
+explicitly activated, either from the panel or via
+`frame.enableLayer("antiRaid", guildId)` in code. Button labels flip
+between Activate/Deactivate based on that server's current state, and the
 panel message updates in place on every click rather than posting a new
 message each time. Clicking a button also drops one aggregated log line in
 the security log channel noting who changed what.
+
+## The metrics button
+
+`!gf metrics` (and the panel's numbers, indirectly) has one button of its
+own, separate from the panel's five: **Show Global (All Servers)** /
+**Show This Server**, flipping the message between this server's counts
+(open cases, flagged members, active layers, whitelist size) and bot-wide
+totals across every server (queue depth, cache stats, average latency).