Added

Console commands on a detection (actions.on-flag). Not every server wants a flagged player gone. Some would rather mark them: drop them into a restricted group, make them verify through Discord, hand the name to another plugin. That is now a list of console commands.

actions:
  on-flag:
    - "lp user {player} permission set myserver.vpnflagged true"
    - "webhook {player} flagged {reason} from {ip}"
  delay-seconds: 3
  run-when: always

Placeholders: {player} {uuid} {ip} {reason} {reason_id} {country} {isp} {asn} {score} {sources} {action} {platform}. The leading slash is optional.

Combined with detection.dry-run: true this is the flag-instead-of-kick setup: the detection fires, the alert and the webhook go out, the commands run, and the player stays connected.

delay-seconds matters because a connection is judged before the player is on the server. At 0 the commands run while they are still connecting, which suits a permission grant but not anything that needs them online. run-when takes always, kicked or allowed.

Fixed

• Clearing discord.username or discord.title broke the webhook entirely, with every alert rejected as HTTP 400. Both are now left out of the payload when blank instead of sent as "".
• Underscores in a player name were eaten by Discord's Markdown. Some_Name arrived italic and __Name__ underlined, so staff searched for a name that was never sent. The name, address and ISP now go out as code spans.
• Providers answering with a redirect were treated as failures. Up to three hops are now followed.
• A keyed service left enabled without a key was asked with an empty key. The parameter is now dropped from the URL entirely.