NodeRunner

🆕 What's new in 1.2.0

Per-Bot Environment Variables

Each bot in the bots: list can now have its own env: block that overrides the global environment variables — useful for running multiple bots with different tokens.

Multi-Bot Dashboard Selector

When running multiple bots, the dashboard now shows a bot selector dropdown to switch between bots without leaving the page.

Dashboard Security Hardening

• CSRF protection — All mutating API endpoints now require an X-NR-Request header
• Brute-force login protection — Lockout after 5 failed attempts (5 minute cooldown)
• Session pruning — Expired sessions are now cleaned up automatically

---

Changes

• Dashboard now uses a bounded thread pool (8 threads) instead of an unbounded cached pool
• SSE heartbeats use a shared scheduled executor instead of per-connection threads
• NodeDownloader is now a shared singleton — multiple bots no longer trigger duplicate downloads
• Webhook shutdown is now handled cleanly on plugin disable
• Restart now waits for the process to fully stop before starting again (prevents race conditions)

Bug Fixes

• Fixed stop command not waiting for the process to actually terminate before reporting "stopped"
• Fixed auto-restart thread not being interrupted when manually stopping a bot