ReportToxicity

Breaking config change punishments: has been replaced with moderation:

Replace your old block with: moderation: kick_command: "kick {player} {reason}" ban_command: "ban {player} {reason}"

Supported tokens:

• {player}
• {reason}
• {report_id}

The old punishments: keys are ignored.

Security

• Closed the item-drag duplication exploit
• /rt status no longer leaks backend details to regular players
• Staff permissions are rechecked at click time
• Reporter input is sanitized
• API keys, setup tokens, and report descriptions are redacted from logs
• Plain http:// base URLs are refused at load
• Activation codes are validated before setup is called

Reliability

• No more lost reports during backend outages
• New sync.fail_open option
• Exponential retry backoff
• Better handling of WordPress 429 responses
• Correct dead-letter behavior
• /rt reload is now a hard sync boundary
• In-flight HTTP/setup tasks cancel cleanly on disable

UX and commands

• /rt help staff now outputs a full moderation guide
• Clearer cooldown and duplicate messages
• Session timeout now closes the inventory and notifies the player
• Reviewer and claimed-by names now render correctly
• Backend errors now surface to staff instead of bare HTTP status codes

Testing

• ~580 unit tests
• 171 end-to-end tests
• Coverage floors, static analysis, and consistency checks enforced in CI

Notes

• Requires an active ReportToxicity subscription
• Free-tier /rt history calls now correctly return HTTP 403 unless upgraded to Basic or higher