v3.0.6

Stabilization and bug-fix release.

Security

• Secrets are encrypted at rest. Microsoft token caches, the Discord bot token and webhook URL, and login-plugin passwords are sealed with AES-256-GCM. The data key is kept by the desktop app's main process, protected by the OS keychain (Windows DPAPI through Electron safeStorage), and handed to the backend over the existing process channel.

• Microsoft sign-in uses an in-memory token cache that persists only the sealed form, so token JSON is no longer written to disk in clear text.

• Existing plaintext files (*_live-cache.json, *_mca-cache.json, *_xbl-cache.json, discord-secrets.json, login-secrets.json) are encrypted on first start and the plaintext copies are overwritten and deleted.

• When encryption is not available (plain npm run dev, or no OS keychain), the panel shows a warning banner instead of failing silently.

• The MCP bearer token is sealed the same way in mcp-token.json.sealed and no longer stored in mcp.json. An existing token is moved on first start (the old mcp.json is wiped and rewritten without it), so connected MCP clients keep working.

• The data folder is restricted to the current user (by SID) and SYSTEM on Windows. The ACL is set on the folder itself and inherited by everything inside, not applied file by file. It no longer skips this when USERNAME is empty.

• Recovery for files locked by the earlier per-file (/T) ACL run: on every start the panel first resets the ACLs inside the data folder to inherit from it (icacls /reset /T), taking ownership first if the reset is refused, and only then hardens the folder. Manual recovery, run as the same Windows user with the panel closed:

  icacls "%APPDATA%\caya-bot-panel\data" /reset /T /C /Q

  If that reports "Access is denied", take ownership first, then repeat the reset:

  takeown /F "%APPDATA%\caya-bot-panel\data" /R /D Y

• The REST API, Socket.IO and /mcp check the Host and Origin headers. Requests from other web pages (CSRF) and DNS-rebinding hosts are refused with 403. MCP clients and scripts that send no Origin keep working. Extra host names can be allowed with CAYA_ALLOWED_HOSTS.

• Discord webhook calls, including Test webhook, only go to https://discord.com/api/webhooks/… (or discordapp.com). Other URLs are rejected before any request and redirects are not followed.

Fixes

• Login-plugin passwords are stored exactly as typed. Leading and trailing spaces are no longer trimmed.
• Closing the Microsoft sign-in dialog, or letting the device code expire, now moves the bot to stopped with a clear message instead of leaving it in an error or connecting state.
• The 3D bot view checks free memory first and limits how many views run at once (1–3, by CPU count). A second tab on the same bot reuses the running view instead of restarting it. The view closes when the bot disconnects or reconnects, instead of staying attached to the old connection.
• Web panel review: see the 3.0.6 UI notes in the pull request (states, validation, secret fields, translations, layout, accessibility).

Packaging

• The Windows release ships only the Setup (NSIS) installer plus SHA256SUMS.txt. The portable exe is no longer built.
• npm run test:packaging checks the build config and that the viewer, Discord, canvas and headless GL modules are production dependencies, so they are copied into the installed app.

Tests

• New npm run test:security: crypto round trip, tamper detection, migration of plaintext files, the encrypted token cache, untrimmed passwords, webhook URL rules, Host/Origin rules, the Windows ACL arguments and the viewer limits.

3.0.5

What's New

Microsoft accounts, a regression test gate, 24/7 mode, Discord, shareable templates, and a bot view. This release replaces 1.0.5.

Accounts

• Sign in with a Microsoft account through a device code. Saved accounts stay in a local cache
• Cancel keeps the account. Sign out asks first, then the button turns off
• A failed join shows the server reason. Kick text is readable instead of [object Object]

Tests

• npm run test:all covers auth, platform, movement rules, build rules, and a live flying-squid baseline
• GitHub Actions runs that gate on every push and pull request
• The course checks a 3-block gap, a stair descent, a downward sprint, a ladder climb, a refused same-level 4-block gap, and a water MLG
• The POV snapshot is accepted by image contrast. The WebGL probe runs under Xvfb

24/7

• Auto-start is one switch, shown in the bot header and on the 24/7 tab
• A start delay from 0 to 300 seconds spaces bots out on top of the existing stagger
• A started bot retries after 5s, 10s, 30s, and 60s. A ban, whitelist, duplicate login, or Microsoft auth kick stops the loop
• There is no second reconnect switch and no sleeping-server preset
• Anti-AFK has a mode and timings. While it is on, other actions stay locked and chat still works
• The login plugin can wait for the server, log in on every join, or register once and then log in. Custom commands use {password}. A player line such as <Steve> /login is ignored

Discord

• The webhook only posts into one channel. Test webhook sends CaYa Bot Panel webhook test. Deaths, drops, and tasks stay silent until an event is ticked
• The Discord bot is a separate login. With a token and a server id it registers /bot start, /bot stop, /bot say, and /bot status. An empty allowlist blocks every command
• The chat bridge copies Minecraft lines as [MC] and writes that channel back as [Discord]
• Settings splits the two connections and shows a hover and press state on the controls

Bot view and templates

• Open 3D view shows this bot on this computer, and it can go full screen. It stays off until you open it
• An MCP session takes a still first-person PNG and a text description. It does not open the 3D page or turn the bot
• Automation templates can be exported and imported
• The hunter lock-on panel follows the selected language
• The README lists the MCP tool names for 24/7, Discord, templates, and the bot view
• On a narrow window, Login, 24/7, and Bot view stay on the upper row. Chat, logs, and the other tabs stay on the row below

Fixed issues

Work for these is in this release. The issues stay open because some checklist items are still undone.

• #27 Microsoft device-code login and the account cache
• #28 24/7 auto-start, the login plugin, and anti-AFK
• #29 Discord webhook, slash commands, and the chat bridge
• #30 bot view, the POV screenshot, and templates

Not in this release

• #16 upside-down stairs, ceiling-hung and wall-attached blocks
• #19 crafting a chest when none is nearby, and staged material batches
• #21 speaking Minecraft 26.3. The version check from 1.0.4 remains; the protocol is still not published

Full Changelog: v1.0.4...v3.0.5

1.0.4

What's New

Stability release after v1.0.3. Stop and Reset actually free the bot, farm and gather were rebuilt from field tests, and pathfinder follow no longer takes the risky shortcuts that were never filed as issues.

Stop, combat, doors

• Stop / Reset aborts the running task and refuses a stale path goal, so the bot no longer stays locked on a target
• Combat does not dig or place when those toggles are off, and does not punch through glass
• Wooden doors open and are walked through the center; iron doors use a nearby button, lever, or plate
• A door that will not toggle is left behind instead of trapping follow in the maze

Farm and gather

• Till pours water into the hole from the rim, then hoes. Plant is seeds only. Harvest breaks, walks onto the drops, replants, and deposits to a house chest
• Farm water sources are 9 blocks apart. Default radius is 6. Stop turns the job off
• Collect any nearby surface block. The count is +N on top of what you already have
• Trees: break leaves in the way, look up to the top logs, replant the matching sapling on the stump

Pathfinder and follow

These were not separate issues. They came out of the same field tests.

• Long sky detours are dropped. A straight walk is preferred over a jump
• Sprint jumps are only taken when the landing is real. L-corners past sprint range are walked, not jumped
• The jump key is actually pressed on a gap, instead of walking off the edge
• Downward sprint jumps can land below takeoff height. Short non-lethal drops are allowed
• The player's own jumps can be copied. A failed jump is not remembered in a way that blocks the next try
• Follow does not reset its path after every door or hop
• Turning ladders stay on pathfinder. A straight ladder can step off onto the nearest solid that is not the ladder in front

Survival and chests

• Place and break switches in Survival are a hard stop, including when combat would otherwise dig or scaffold
• MLG does not waterlog leaves. Grass and crops are not the landing: water replaces the plant on the block under them
• Beside a leaf canopy, the bot steers to the lower open ground and places water there
• The water bucket is picked back up after the clutch, including while combat is fleeing
• Forget removes a remembered chest from the list. The block in the world stays

Minecraft versions

• Bundled protocol is mineflayer 4.39.0, through Minecraft 26.1
• The panel checks Mojang's manifest and the published mineflayer package. A bar warns, can be dismissed for the session, and can install a newer protocol without a new panel build
• 26.3 is not in the published protocol yet. The bar only warns until Prismarine ships it

Fixed issues

• #8 glass melee, #9 combat dig, #10 path into walls, #11 doors, #13 chat layout, #14 Stop/Reset lock, #15 slash commands, #17 farm, #18 gather, #20 MLG

Not in this release

• #16 upside-down stairs, ceiling-hung and wall-attached blocks
• #19 crafting a chest when none is nearby, and staged material batches. Forgetting a chest is included
• #21 speaking 26.3. The check and one-click install are included; the protocol is not published yet

Full Changelog: v1.0.3...v1.0.4

1.0.3

What's New

• Added the new Hunter / Target Lock combat mode
• Added blacklist, whitelist, single-target, and attack-everyone targeting policies
• Added intelligent target search using last known position, movement prediction, spiral/sector scanning, and high-ground checks
• Added Hunter-specific chase, retreat, and recovery settings
• Added separate permissions for block breaking and block placement
• Added door-opening behavior and natural-route fallback when block interaction is disabled
• Added collision-aware line-of-sight checks so targets cannot be attacked through glass or walls
• Hunter mode keeps the LLM in chat-only mode while combat automation is active

Full Changelog: v1.0.2...v1.0.3

1.0.2

Minecraft CaYa Bot Panel v1.0.2

Farming and reliability update.

Highlights

Farming System

• Added tilling, planting and harvesting support
• Supports wheat, carrots, potatoes, beetroot, melons and pumpkins
• Harvests only mature crops and protects melon/pumpkin stems
• Automatically replants harvested crops
• Added continuous farming cycles
• Crops can be deposited into the nearest chest or a chest selected by coordinates
• Seed reserves are preserved during storage
• Added hydration warnings when farmland has no nearby water

Panel, Automation and AI Support

• Added a new Farming panel

• Added farming actions to the automation system

• Added Turkish farming action aliases

• Added four new MCP/Ollama tools:

  • till_soil
  • plant_crops
  • harvest_crops
  • farm_cycle

• MCP tool registry expanded to 57 tools

Storage Improvements

• Chest deposits and withdrawals are now verified against actual inventory counts
• Partial transfers are reported correctly
• Full chests now return an honest error instead of silently failing
• Deposit and withdrawal operations can target specific chest coordinates

Build Reliability

• Faster recovery when construction becomes stuck
• Stop, Reset Work and stop_all can now interrupt recovery immediately
• Repeatedly unreachable blocks are abandoned earlier
• Improved stuck-stage information in the panel and get_build_status

Fixed Issues

• Fixed farming and verified chest storage — #5
• Fixed slow watchdog recovery and blocked cancellation — #6

1.0.1

Minecraft CaYa Bot Panel v1.0.1

Stability and intelligence release after v1.0.0. This version rewrites the construction pipeline, fixes the “stuck after cancel” deadlock on Paper, and adds a full MCP / AI agent layer (Ollama in-game + Claude Code / Cursor / VS Code via /mcp).

Issues closed: #3 · #4

---

Highlights

🏗 Construction engine rewrite (Faz 17 · closes #3)

• Chest stock ledger — nearby chests/barrels/shulkers are marked; stock counts as available; withdraw only when needed
• 3D-printer placement (default) — layer-by-layer serpentine; optional nearby-first
• Stall watchdog — recovery ladder instead of a blind hang
• Mid-build + final repair — damaged/wrong blocks re-queued; honest scaffold accounting
• Creative mode — material needs skipped; items provisioned for placement
• Reconnect resume — mid-build disconnect can continue after respawn
• Panel — place order, stored column, creative / stuck / repair / resume badges

🔓 Stop / Reset always frees the bot (Faz 17+ · closes #4)

Root cause was not only pathfinder: a hung build runner left TaskQueue.pump locked forever, so no later task (goto, stop, new build) could run — restart felt required.

Fix (three layers):

1. Force-detach — cancelled runner that does not unwind within ~2s is abandoned; queue continues; panel logs a warning
2. Bounded mineflayer ops — equip / place / dig / chest open-withdraw-deposit have hard timeouts and honor cancel
3. Extended re-freeze — residual pathfinder goals cannot re-drive the bot after abort

Also: cancel-aware dig, companion pathing pause after Stop so follow does not immediately re-grab the bot.

🧠 MCP / AI agent system (Faz 18)

New panel tab MCP / AI with two modes sharing one tool registry (53 tools):

Mode	How
Ollama (in-game)	Pick a local tool-capable model; enable agent per bot; talk from Agent Chat or in-game by name
MCP endpoint	http://127.0.0.1:3001/mcp — Claude Code, Cursor, VS Code Copilot, Windsurf, Gemini CLI, or stdio clients via mcp-remote

Capabilities

• In-game replies when addressed (toggleable; off → panel Agent Chat only)
• Gather / mine / craft / drops with inventory targets (“have N of X”)
• Schematic-free creative building (geometric primitives) + library schematics
• Live build stage feedback (get_build_status)
• Protect / attack / flee / clear mobs (attack category off by default)
• Trust system — panel-managed; optional model-managed trust
• Persistent memory, autopilot goals, activity feed, persona & language
• Utility mode (default OFF) — own/permitted servers only: server commands, creative fly, utility dig; combat realism (D1–D8) never bypassed

Setup and client configs: see README → MCP / AI agent system.

# Claude Code example
claude mcp add --transport http caya-bot http://127.0.0.1:3001/mcp

───

Commits (since v1.0.0)

┌─────────┬─────────────────────────────────────────────────────────────────────────────┐
│ Commit  │ Change                                                                      │
├─────────┼─────────────────────────────────────────────────────────────────────────────┤
│ c637145 │ feat(build): construction engine rewrite (issue #3)                         │
├─────────┼─────────────────────────────────────────────────────────────────────────────┤
│ 20e0a74 │ fix(build): force-detach hung runners — Stop/Reset frees the bot (Fixes #4) │
├─────────┼─────────────────────────────────────────────────────────────────────────────┤
│ 0f3233d │ feat(mcp): Ollama agent + /mcp endpoint, tools, trust, utility mode         │
├─────────┼─────────────────────────────────────────────────────────────────────────────┤
│ 61db0ac │ docs: README MCP guide + roadmap (TODO)                                     │
└─────────┴─────────────────────────────────────────────────────────────────────────────┘

───

Upgrade notes

1. Pull / install v1.0.1 (or rebuild from master).
2. Restart the panel (npm run dev or your desktop/portable build).
3. MCP: enable the master switch under MCP / AI, pick an Ollama model and/or connect an MCP client. Utility mode stays off unless you turn it on for a permitted server.
4. If a build was stuck on an older build: Stop or Reset work should free the bot within seconds; check the log for force-detached if something still misbehaves.

───

Notes / known limits

• Large schematic physics and some AI chat parse variants still benefit from Paper 1.21.x field checks.
• Small LLMs (≤8B) can mis-call tools; stronger tool-calling models are recommended for serious use.
• Offline (cracked) auth only; panel binds to localhost by default on purpose.

───

Full changelog: compare v1.0.0...v1.0.1 (v1.0.0...v1.0.1)
Docs: README (https://github.com/CaYatur/Minecraft-CaYa-Bot-Panel#readme)

1.0.0

Minecraft CaYa Bot Panel v1.0.0

First public release of Minecraft CaYa Bot Panel.

Included

• Multi-bot management
• Advanced IF / ELSE automation flows
• Task-result variables, retries and error branches
• Smart gathering, mining and crafting
• Chest, barrel and shulker support
• Schematic building
• Combat and survival systems
• Drop-specific-items automation
• English and Turkish interface
• Web and Electron desktop support