Add incident response and passport alt detection

This change introduces the Incident Response plugin to correlate Automod, raid, impersonation, scam, and nuke signals into scored incidents with severity policies, lockouts, and dashboard management. It also adds Passport alt-network signal collection and matching for likely alt accounts, including optional MaxMind geo lookups and dashboard controls for dismissing/clearing data. In parallel, Automod gains Domain Intelligence heuristics for risky domains and related rule config, with schema, DB migrations, permission defaults, and tests for the new scoring and clustering logic.

Author: Clawb1t

.env.example

@@ -35,6 +35,13 @@ DREAMLINER_ONE_SKU_ID=1537178843033501727
 # Discofy" message context command to submit quotes.
 DISCOFY_API_KEY=
 
+# --- Passport Alts (network-signal alt detection) ---
+# Optional path to a local MaxMind GeoLite2-City .mmdb file. When set, verifications also record
+# a coarse city/region used as a secondary alt-matching signal. When unset, matching falls back to
+# IP/subnet only — no third-party lookups are ever made. Get a free file+license at
+# https://www.maxmind.com/en/geolite2/signup
+# GEOIP_DB_PATH=
+
 # --- Social Notifications (YouTube uploads) ---
 # YouTube Data API v3 key (Google Cloud Console → enable "YouTube Data API v3" → Credentials).
 # Required to resolve creator handles/URLs and poll for new uploads.

config/default.server.yaml

@@ -190,6 +190,45 @@ plugins:
       dm_flagged_member: false
       auto_action: none
       can_status: false
+  incident_response:
+    enabled: false
+    config:
+      correlation_window_ms: 1800000
+      thresholds:
+        medium: 6
+        high: 14
+        critical: 26
+      sources:
+        automod: true
+        raid: true
+        impersonation: true
+        scam_protect: true
+        nuke_detection: true
+      nuke:
+        channel_delete_count: 3
+        channel_delete_window_ms: 30000
+        role_delete_count: 3
+        role_delete_window_ms: 30000
+        ban_count: 5
+        ban_window_ms: 60000
+        kick_count: 5
+        kick_window_ms: 60000
+        webhook_count: 3
+        webhook_window_ms: 60000
+        admin_grant_new_account_hours: 72
+      policy_low:
+        actions: []
+        notify_roles: []
+      policy_medium:
+        actions: []
+        notify_roles: []
+      policy_high:
+        actions: []
+        notify_roles: []
+      policy_critical:
+        actions: []
+        notify_roles: []
+      can_manage: false
   raid_mesh:
     enabled: false
     config: {}
@@ -283,6 +322,7 @@ plugins:
         disabled_title: Verification is off
         disabled_body: This server isn't using Passport right now.
       remember_verifications: true
+      alt_detection: false
       min_account_age_seconds: 0
       bypass_role_ids: []
       timeout_action: none

drizzle/migrations/0082_passport_alts.sql

@@ -0,0 +1,22 @@
+CREATE TABLE IF NOT EXISTS `passport_network_signals` (
+  `guild_id` text NOT NULL,
+  `user_id` text NOT NULL,
+  `ip_address` text NOT NULL,
+  `country` text,
+  `region` text,
+  `city` text,
+  `verified_at` integer NOT NULL,
+  PRIMARY KEY(`guild_id`, `user_id`)
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `passport_network_signals_guild`
+  ON `passport_network_signals` (`guild_id`);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `passport_alt_dismissals` (
+  `guild_id` text NOT NULL,
+  `user_id_a` text NOT NULL,
+  `user_id_b` text NOT NULL,
+  `dismissed_at` integer NOT NULL,
+  `dismissed_by` text NOT NULL,
+  PRIMARY KEY(`guild_id`, `user_id_a`, `user_id_b`)
+);

drizzle/migrations/0083_incident_response.sql

@@ -0,0 +1,61 @@
+CREATE TABLE IF NOT EXISTS `incidents` (
+  `id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+  `guild_id` text NOT NULL,
+  `entity_type` text NOT NULL,
+  `entity_id` text NOT NULL,
+  `severity` text DEFAULT 'low' NOT NULL,
+  `risk_score` integer DEFAULT 0 NOT NULL,
+  `status` text DEFAULT 'open' NOT NULL,
+  `title` text NOT NULL,
+  `signal_count` integer DEFAULT 0 NOT NULL,
+  `source_count` integer DEFAULT 0 NOT NULL,
+  `responded_severity` text,
+  `actions_taken` text DEFAULT '[]' NOT NULL,
+  `first_signal_at` integer NOT NULL,
+  `last_signal_at` integer NOT NULL,
+  `resolved_by` text,
+  `resolved_at` integer,
+  `created_at` integer NOT NULL,
+  `updated_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `incidents_guild_status` ON `incidents` (`guild_id`, `status`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `incidents_guild_entity` ON `incidents` (`guild_id`, `entity_type`, `entity_id`);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `incident_signals` (
+  `id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+  `incident_id` integer NOT NULL,
+  `guild_id` text NOT NULL,
+  `source` text NOT NULL,
+  `signal_type` text NOT NULL,
+  `weight` integer NOT NULL,
+  `entity_type` text NOT NULL,
+  `entity_id` text NOT NULL,
+  `secondary_entity_type` text,
+  `secondary_entity_id` text,
+  `reason` text NOT NULL,
+  `detail` text,
+  `created_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `incident_signals_incident` ON `incident_signals` (`incident_id`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `incident_signals_guild_created` ON `incident_signals` (`guild_id`, `created_at`);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `incident_lockdowns` (
+  `id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+  `guild_id` text NOT NULL,
+  `channel_id` text NOT NULL,
+  `incident_id` integer,
+  `previous_overwrite` text NOT NULL,
+  `locked_at` integer NOT NULL,
+  `locked_by` text NOT NULL,
+  `unlock_at` integer,
+  `unlocked_at` integer,
+  `unlocked_by` text
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `incident_lockdowns_guild` ON `incident_lockdowns` (`guild_id`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `incident_lockdowns_unlock_at` ON `incident_lockdowns` (`unlock_at`);

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "dreamliner",
-  "version": "0.1.14",
+  "version": "0.1.20",
   "description": "Dreamliner — a Discord moderation bot with file-based configuration",
   "type": "module",
   "main": "dist/index.js",
@@ -34,6 +34,7 @@
     "ffmpeg-static": "^5.3.0",
     "gifenc": "^1.0.3",
     "google-translate-api-x": "^10.7.3",
+    "maxmind": "^5.0.7",
     "opusscript": "^0.0.8",
     "prism-media": "^1.3.5",
     "yaml": "^2.7.1",

package.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "generatedAt": "2026-09-13T13:41:48.616Z",
+  "generatedAt": "2026-09-14T09:24:44.948Z",
   "templatePath": "config/default.server.yaml",
   "schemaPath": "schema/guild-config.schema.json",
   "categories": [
@@ -36,6 +36,11 @@
           "name": "Impersonation Detection",
           "description": "Flags members whose name or avatar closely matches a protected role holder or watchlist entry."
         },
+        {
+          "key": "incident_response",
+          "name": "Incident Response",
+          "description": "Correlates Automod, Raid, Impersonation, and Scam Protect signals (plus its own server-nuke detectors) into scored Incidents, with an opt-in escalating response per severity."
+        },
         {
           "key": "raid_mesh",
           "name": "Raid Defense Mesh",
@@ -312,6 +317,13 @@
       "category": "Protection",
       "categoryId": "protect"
     },
+    {
+      "key": "incident_response",
+      "name": "Incident Response",
+      "description": "Correlates Automod, Raid, Impersonation, and Scam Protect signals (plus its own server-nuke detectors) into scored Incidents, with an opt-in escalating response per severity.",
+      "category": "Protection",
+      "categoryId": "protect"
+    },
     {
       "key": "raid_mesh",
       "name": "Raid Defense Mesh",