KOKOTO WebChat (Fabric, Forge, NeoForge)

KOKOTO WebChat

KOKOTO WebChat 5.3.1 is a compatibility-preserving update to 5.3.0 that extends Chat Events with Poll, role-based Recruitment, persisted automatic-end conditions, and targeted window/input fixes. Relay remains protocol 2.2 and the configuration schema remains 5.3.0.

KOKOTO WebChat is a server-side Minecraft web chat for **Bukkit/Paper/Spigot 1.18–26.2 (Java 17), Fabric exact targets 1.18.2–26.2, NeoForge exact targets 1.20.2–26.2, and Forge exact targets 1.18.2–26.2; mod-loader targets select Java 17/21/25 by Minecraft version**. It can run as a standalone web chat or embed into supported map frontends including BlueMap, squaremap, Dynmap, Pl3xMap, LiveAtlas, uNmINeD, and Minecraft Overviewer. No client mod is required for the core chat features.

**CurseForge packaging:** this Bukkit Plugins project receives only the Bukkit/Paper/Spigot JAR. Fabric, NeoForge, and Forge builds are published through their matching KOKOTO WebChat Mods projects and must be selected for the exact Minecraft version/loader.

What's new in 5.3.1

• **Poll and Recruitment events**: one-vote-per-account Poll with change-before-finish, plus role capacity, waiting queues, role changes, withdrawal, and oldest-waiter promotion for Recruitment
• **Automatic end policies**: First come remains mandatory-at-capacity; Lottery may auto-draw at participant capacity; Poll may finish at a unique-response threshold; Recruitment may finish when all accepted role slots are full; every type may also set an absolute end date/time
• **Restart-safe lifecycle**: automatic-end policy, target time, completion time, and completion reason are persisted; a server lifecycle task evaluates timed endings without requiring a browser to stay open
• **Mobile add-on Administrator fix**: interactive header controls, including the Administrator/online-user status control, are excluded from public-window drag capture so touch taps are no longer swallowed
• **Standalone private-window raise fix**: pressing DM or Group again restores/raises an already-open list window instead of leaving it hidden behind public or sibling chat windows
• **Presentation parity hardening**: PC add-ons + PiP, PC Standalone + PiP, mobile add-ons, and mobile Standalone share the same canonical settings/state path; only layout/capability differences remain mode-specific
• **Compatibility**: Relay Protocol stays at revision 2.2, configuration schema stays at 5.3.0, and the deployable 45-target platform matrix is unchanged

Main features

• **Two-way game ↔ web chat** with linked Minecraft accounts and optional guest chat
• **BlueMap addon + standalone page** with dark/light/high-contrast UI, PIP, draggable/resizable windows, search, replies, pins, and virtual scrolling
• **1:1 direct messages** with local and cross-server recipients, exact server+UUID routing, retry-safe delivery, unread/read state, and shared game/web threads
• **Group chat rooms** with public/private visibility, invitations, passwords, retention limits, unread counts, delivery retry protection, and member management
• **Relay Protocol 2.2** for multi-server communities with explicit groups, reciprocal peers, independent per-peer send/receive policy, HKDF-SHA256/AES-256-GCM hop-by-hop protection, authenticated responses, replay/loop defenses, server badges and source filters
• **DiscordSRV integration** plus Discord media caching and optional emoji-link augmentation
• **Uploads and rich previews** for images, video, audio, YouTube/Shorts, with optional TikTok and X/Twitter embeds
• **Deterministic long-history virtual scrolling** across images, GIFs, video, audio, YouTube/iframes and link previews, with scroll-anchor correction as media sizes settle
• **Unicode-aware content filtering** for public/group chat and optional DM with Block/Mask/Replace, bulk word lists, custom rules, anti-evasion matching and Web Admin testing
• **Custom emoji management** with multi-file administrator upload, plus optional **ImageEmojis-Bero** Bukkit/Paper integration using the same plugins/KOKOTO-WebChat/emojis tree; its resource-pack HTTP port remains a separate client-facing service
• **SimpleNicks-Bero nickname integration** on Bukkit/Paper-family servers through player-display.mode: "display-name", while KWC retains the real linked account identity
• **Configurable message tokens** such as :enter: / :newline: / :tab: with administrator-localizable aliases and printable custom substitutions
• **Web Push / keyword notifications** and administrator update notifications
• **Per-account visual UI profiles** plus account-synced keyword/notification preferences for signed-in users; device-local window state and Push endpoints stay local
• **Administrator Discord keyword alerts** with KWC-owned matching/deduplication and DiscordSRV logical-channel selection
• **Administration and moderation tools** for message deletion, pins, guest/IP mutes, session revocation, user restrictions, custom emoji management, and private-chat metadata
• **Optional read-only DM and group-chat body audit** for explicitly allowlisted super administrators; both are disabled by default and every audit page read is logged
• Built-in UI languages: **English, Korean, Japanese, Simplified Chinese**

Private messaging and delivery reliability

Cross-server DM targets are identified by **server ID + player UUID**, so a local player cannot be confused with a same-name player on another server. Remote messages stay pending until the destination confirms storage. Failed or uncertain sends can be retried with persistent relay/client message IDs without duplicating sender or receiver records.

DM and group-chat message state is shown compactly beside the timestamp. Normal successful delivery is silent; pending or failed delivery is shown only when needed. DM messages use a short unread label until the recipient reads them, then show ✓. Group messages show the number of recipients who have not read the message and change to ✓ when everyone has read it.

Multi-server relay

Relay Protocol 2.2 carries public chat and cross-server DM/read/delete flows inside explicit trust groups and capability-gates public reactions/typing, chat-event routing, and remote public-profile lookup while keeping Protocol major 2 as the wire-compatibility boundary. Each group has one shared secret; peers have no individual secret and must be configured reciprocally in the same group. Every message request authenticates/encrypts itself independently. /relay/v2/handshake is a stateless diagnostic identity/health probe and does not control routing. Messages use directional HKDF-SHA256 keys and AES-256-GCM hop-by-hop authenticated encryption; responses are HMAC-authenticated and timestamp/nonce/relay-ID/hop defenses reject replay or loops.

Each peer keeps enabled as a master switch and may independently configure send and receive for public-chat, event, dm, and profile. Missing entries default to enabled for compatibility. KWC Chat Events use the distinct event source rather than ordinary system, so remote event announcements can be rejected without suppressing unrelated system notices. Public reaction/typing follow public-chat; DM reaction/typing/read/delete follow dm.

Direct one-hop HTTP can be used with an explicit warning because relay payloads remain encrypted/authenticated. Forwarding filtering is per peer: an HTTP peer is excluded only as that forwarding hop, while other HTTPS peers in the same group remain eligible. Relay Protocol 2.2 is not end-to-end encryption: forwarding servers decrypt and re-encrypt as trusted participants. Legacy Relay v1 endpoints return HTTP 426.

On the first upgrade from 5.0.0, old flat relay settings are not converted into guessed groups. Relay is reset disabled so the operator can explicitly define the v2 trust groups before re-enabling it.

Administrator private-chat audit

Private message bodies are not automatically exposed to normal administrators. Optional audit access requires an exact Minecraft name/UUID in private-chat-super-admins **and** the corresponding feature switch:

direct-message:  
admin-audit:  
enabled: false

group-chat:  
admin-audit:  
enabled: false  

Audit views are read-only. Group audit does not join the room or affect read/unread state. Every audit page read records the actor and pagination metadata without copying message bodies into the audit log.

Deployment

Fresh configurations start with the plugin master switch disabled so operators can review storage, authentication, uploads, retention, and web exposure before enabling it. The bundled config.yml is the sole migration template. On a real version migration, KOKOTO WebChat first starts from that latest bundled default and overlays the operator values read from the existing config.yml; old comments, ordering, blank-line layout, and indentation are not carried forward. A previously fixed older config (a marker without _auto_migration) is backed up before reconstruction. The migrated file is marked <version>_auto_migration; while that marker remains, startup/reload repeats the same bundled-default reconstruction with the current values overlaid, keeping newly added settings and bundled comments/layout current. An exact same-version marker stops same-version automatic setting reconstruction; changing ui.language may still rebuild only comments/layout while preserving parsed values. config-reference-<version>.yml is the administrator-readable current default rendered in the same built-in ui.language (English for custom/unsupported UI languages) and is not a migration input. Older generated reference/migration files are removed automatically. /kchat reload validates edited YAML before stopping live services; invalid YAML is rejected so the previous running configuration, UI language, and services remain active. Bundled UTF-8 starter filter-word lists for Korean, English, Japanese, and Simplified Chinese are initialized once when the starter-list marker is absent; existing or disabled files are preserved, and administrator deletions after initialization are not reversed.

For public deployments, placing BlueMap and KOKOTO WebChat behind HTTPS with Caddy or Nginx is recommended.

Optional integrations

• BlueMap (Bukkit plus BlueMapAPI on Fabric/NeoForge and Forge 26.1.2/26.2)
• squaremap and Dynmap filesystem web adapters
• Pl3xMap on Bukkit/Paper-family and Fabric
• LiveAtlas, uNmINeD, and Minecraft Overviewer static-web adapters
• DiscordSRV on Bukkit
• ImageEmojis-Bero on Bukkit/Paper-family servers (shared KWC emoji path + runtime glyph resolution); general ImageEmojis operation follows the upstream plugin documentation
• SimpleNicks-Bero on Bukkit/Paper-family servers through Bukkit display names; general SimpleNicks operation follows the upstream plugin documentation
• Web Push notifications

See the bundled README and docs/ folder for full configuration, reverse-proxy, relay, security, migration, and troubleshooting guides.

AI assistance disclosure

Generative AI was used as a development assistant for code review, implementation and patching, documentation drafting, and multilingual translation. Project requirements, architecture/design decisions, integration, testing, compatibility verification, release validation, and final acceptance are human-directed and reviewed. AI-assisted output is reviewed and validated before inclusion.