Bot Viewer Detector

Scans your Twitch chat's current viewer list and flags accounts that look like follow/view-bots, so you can review and block them manually. Nothing is banned automatically.

Connect my channel

After connecting: mod the bot with /mod guildscribebot (or whichever account owns TWITCH_BOT_ID) so it can reply to !botcheck.

`,\n );\n }\n\n const data = await getFlaggedChatters(broadcasterId);\n const broadcaster = await getBroadcaster(broadcasterId);\n if (!data) {\n return page(\n \"Bot Viewer Detector\",\n `

Reconnect needed

This channel's Twitch connection has expired or been revoked.

Reconnect

`,\n );\n }\n\n const rows = data.results\n .map(\n (r) =>\n `${\n escapeHtml(r.displayName)\n }${r.score}${r.accountAgeDays}d${\n escapeHtml(r.reasons.join(\"; \"))\n }`,\n )\n .join(\"\");\n\n return page(\n \"Likely Bot Viewers\",\n `

Likely Bot Viewers${\n broadcaster ? ` — ${escapeHtml(String(broadcaster.display_name))}` : \"\"\n }

${data.totalChatters} chatters checked · ${data.results.length} flagged for review. Heuristic guess, not a certainty — check an account before blocking it.

\n \n \n ${rows || ''}\n

Username	Score	Account age	Why flagged
Nothing flagged right now.

\n \n

Reconnect / grant new permissions

`,\n );\n});\n\napp.get(\"/json\", async (c) => {\n const broadcasterId = await resolveBroadcasterId(c);\n if (!broadcasterId) {\n return c.json({ error: \"No channel connected yet. Visit /connect.\" }, 400);\n }\n const data = await getFlaggedChatters(broadcasterId);\n if (!data) {\n return c.json(\n { error: \"This channel needs to reconnect at /connect.\" },\n 401,\n );\n }\n return c.json({ total_chatters: data.totalChatters, flagged: data.results });\n});\n\n// ── OAuth connect flow ──\n\napp.get(\"/connect\", async (c) => {\n const state = crypto.randomUUID();\n await saveOAuthState(state, Date.now() + 10 * 60 * 1000);\n const url = new URL(c.req.url);\n const auth = new URL(\"https://id.twitch.tv/oauth2/authorize\");\n auth.search = new URLSearchParams({\n client_id: env(\"TWITCH_CLIENT_ID\"),\n redirect_uri: `${url.origin}/callback`,\n response_type: \"code\",\n // Broadcasters are implicitly moderators of their own channel, so\n // authorizing here as the broadcaster covers moderator:read:chatters too.\n scope: \"channel:bot moderator:read:chatters\",\n state,\n }).toString();\n return new Response(null, {\n status: 302,\n headers: { Location: auth.toString() },\n });\n});\n\napp.get(\"/callback\", async (c) => {\n const url = new URL(c.req.url);\n const error = url.searchParams.get(\"error\");\n if (error) {\n return page(\n \"Connection cancelled\",\n `

Connection cancelled

${\n escapeHtml(url.searchParams.get(\"error_description\") ?? error)\n }

`,\n );\n }\n const code = url.searchParams.get(\"code\");\n const state = url.searchParams.get(\"state\");\n if (!code || !state) return c.text(\"Missing OAuth code or state\", 400);\n const valid = await consumeOAuthState(state);\n if (!valid) return c.text(\"Invalid or expired OAuth state\", 400);\n\n try {\n const token = await exchangeCode(code, `${url.origin}/callback`);\n const user = await getSelf(token.access_token);\n\n // Reconnecting would otherwise try to create a duplicate\n // channel.chat.message subscription with the same type/condition/\n // callback, which Twitch rejects — clean up first so this is safe to\n // run repeatedly (e.g. to pick up newly requested scopes).\n const existing = await getBroadcaster(user.id);\n if (existing?.subscription_id) {\n try {\n await deleteEventSubSubscription(String(existing.subscription_id));\n } catch (e) {\n console.error(\"eventsub cleanup failed\", e);\n }\n }\n\n const sub = await createChatSubscription(user.id, `${url.origin}/eventsub`);\n await upsertBroadcaster(user.id, user.login, user.display_name, sub.id);\n await saveModToken(\n user.id,\n token.access_token,\n token.refresh_token,\n Array.isArray(token.scope)\n ? token.scope.join(\" \")\n : String(token.scope ?? \"\"),\n Date.now() + Math.max(0, Number(token.expires_in ?? 0) * 1000 - 60_000),\n );\n\n return page(\n \"Connected\",\n `

Connected

${\n escapeHtml(user.display_name)\n } is now connected. !botcheck will work once the bot is modded.

Important: in Twitch chat, run /mod guildscribebot (or whichever account owns TWITCH_BOT_ID) so it can reply.

View dashboard

`,\n );\n } catch (e) {\n console.error(e);\n return page(\n \"Connection failed\",\n `

Connection failed

Could not complete the Twitch connection. Please try again.

`,\n );\n }\n});\n\n// ── EventSub webhook: challenge handshake + incoming chat messages ──\n\napp.post(\"/eventsub\", async (c) => {\n const rawBody = await c.req.text();\n const valid = await verifyEventSub(c.req.raw, rawBody);\n if (!valid) return c.text(\"Invalid signature\", 403);\n\n const messageType = c.req.header(\"Twitch-Eventsub-Message-Type\");\n const payload = JSON.parse(rawBody);\n\n if (messageType === \"webhook_callback_verification\") {\n return c.text(payload.challenge, 200);\n }\n\n if (messageType === \"revocation\") {\n console.error(\"EventSub subscription revoked:\", payload.subscription);\n return c.text(\"\", 200);\n }\n\n if (\n messageType === \"notification\" &&\n payload.subscription?.type === \"channel.chat.message\"\n ) {\n const event = payload.event;\n const text: string = event?.message?.text ?? \"\";\n const broadcasterId: string = event?.broadcaster_user_id;\n\n if (text.trim().toLowerCase().startsWith(\"!botcheck\")) {\n handleBotCheck(broadcasterId).catch((err) =>\n console.error(\"botcheck failed\", err)\n );\n }\n\n return c.text(\"\", 200);\n }\n\n return c.text(\"\", 200);\n});\n\nasync function handleBotCheck(broadcasterId: string) {\n const data = await getFlaggedChatters(broadcasterId);\n if (!data) {\n await sendChatMessage(\n \"🤖 Bot check needs the channel to reconnect — visit /connect.\",\n broadcasterId,\n );\n return;\n }\n const reply = data.results.length === 0\n ? `🤖 No likely bot viewers spotted out of ${data.totalChatters} in chat right now.`\n : `🤖 ${data.results.length} likely bot viewer${\n data.results.length === 1 ? \"\" : \"s\"\n } out of ${data.totalChatters} in chat right now.`;\n await sendChatMessage(reply, broadcasterId);\n}\n\nexport default app.fetch;","botdetector",[],[197],"38500745-f00c-485f-813c-835b14d9a297","db.ts","725abbfa-b0a1-11f1-9048-1607ee4eb77e",19,["D",1789434299195],"// Storage for the bot-viewer detector — connected broadcasters and their\n// moderator:read:chatters tokens. Mirrors GuildScribe's db.ts / ads_db.ts\n// conventions (INSERT OR REPLACE, broadcaster_id-keyed rows) so behavior\n// matches your other bots if this ever moves into the same monorepo.\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport async function ensureTables() {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS oauth_states (state TEXT PRIMARY KEY, expires_at INTEGER)`,\n );\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS broadcasters (\n broadcaster_id TEXT PRIMARY KEY, login TEXT, display_name TEXT,\n subscription_id TEXT, connected_at INTEGER, connected INTEGER NOT NULL DEFAULT 1\n )`,\n );\n // The connecting account's own OAuth token, scope moderator:read:chatters —\n // refreshed on demand (see getValidModToken in twitch.ts). Broadcasters are\n // implicitly moderators of their own channel, so having the broadcaster\n // authorize at /connect is enough; no separate mod account login needed.\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS mod_tokens (\n broadcaster_id TEXT PRIMARY KEY, access_token TEXT NOT NULL, refresh_token TEXT NOT NULL,\n scope TEXT, expires_at INTEGER NOT NULL, updated_at INTEGER NOT NULL\n )`,\n );\n}\n\nexport async function saveOAuthState(state: string, expiresAt: number) {\n await sqlite.execute(\n \"INSERT INTO oauth_states (state, expires_at) VALUES (?,?)\",\n [state, expiresAt],\n );\n}\n\n/** Deletes the state either way (single use), returns whether it was valid. */\nexport async function consumeOAuthState(state: string): Promise {\n const check = await sqlite.execute(\n \"SELECT * FROM oauth_states WHERE state = ? AND expires_at > ?\",\n [\n state,\n Date.now(),\n ],\n );\n await sqlite.execute(\"DELETE FROM oauth_states WHERE state = ?\", [state]);\n return check.rows.length > 0;\n}\n\nexport async function upsertBroadcaster(\n broadcasterId: string,\n login: string,\n displayName: string,\n subscriptionId: string,\n) {\n await sqlite.execute(\n `INSERT OR REPLACE INTO broadcasters (broadcaster_id, login, display_name, subscription_id, connected_at, connected)\n VALUES (?,?,?,?,?,1)`,\n [broadcasterId, login, displayName, subscriptionId, Date.now()],\n );\n}\n\nexport async function getBroadcaster(broadcasterId: string) {\n const res = await sqlite.execute(\n \"SELECT * FROM broadcasters WHERE broadcaster_id = ?\",\n [broadcasterId],\n );\n return res.rows.length ? res.rows[0] : null;\n}\n\n/** This is a personal-use tool, so in practice one channel connects. Used by\n * \"/\" and \"/json\" when no ?channel= query param is given. */\nexport async function getFirstConnectedBroadcaster() {\n const res = await sqlite.execute(\n \"SELECT * FROM broadcasters WHERE connected = 1 ORDER BY connected_at ASC LIMIT 1\",\n );\n return res.rows.length ? res.rows[0] : null;\n}\n\nexport async function saveModToken(\n broadcasterId: string,\n accessToken: string,\n refreshToken: string,\n scope: string,\n expiresAt: number,\n) {\n await sqlite.execute(\n `INSERT OR REPLACE INTO mod_tokens (broadcaster_id, access_token, refresh_token, scope, expires_at, updated_at)\n VALUES (?,?,?,?,?,?)`,\n [broadcasterId, accessToken, refreshToken, scope, expiresAt, Date.now()],\n );\n}\n\nexport async function getModToken(broadcasterId: string) {\n const res = await sqlite.execute(\n \"SELECT * FROM mod_tokens WHERE broadcaster_id = ?\",\n [broadcasterId],\n );\n return res.rows.length ? res.rows[0] : null;\n}",[],[205],["D",1789431761819],[],[18],"62666a88-9024-4411-9fd6-9955295cd17e","README.md","92e96052-b09b-11f1-b904-1607ee4eb77e",14,["D",1789434214479],"# Bot Viewer Detector\n\nScans your Twitch chat's current viewer list and flags accounts that look like\nfollow/view-bots, so you can review and block them manually. Nothing is banned\nautomatically.\n\n- **`/`** — dashboard: sorted table of flagged accounts with reasons. Once\n connected, this is also the landing page.\n- **`/json`** — same data as JSON.\n- **`!botcheck`** — chat command that replies with just the count, e.g. \"🤖 4\n likely bot viewers out of 212 in chat right now.\"\n\n## What changed from the env-var version\n\nYou no longer set `TWITCH_BROADCASTER_LOGIN` or `TWITCH_MOD_OAUTH_TOKEN` by\nhand. Instead, visiting `/connect` and authorizing on Twitch captures your\nlogin, ID, and a refreshable moderator:read:chatters token automatically — same\nOAuth pattern GuildScribe already uses (`/connect` → Twitch → `/callback`),\nstored in this project's own SQLite database. The token also now refreshes\nitself instead of expiring every ~4 hours.\n\n## How detection works\n\nEach chatter is scored on:\n\n- Account age (younger = more suspicious)\n- Default/missing profile picture\n- Username shape (word+digits, long random strings — common bot-generator\n patterns)\n\nKnown legitimate bots (Nightbot, StreamElements, etc. — see `botDetection.ts`)\nare always excluded. This is heuristic, not certain — glance at a flagged\naccount before blocking it.\n\n## Setup on Val Town\n\n1. Create a new Val Town project and upload `main.ts`, `twitch.ts`, `db.ts`, and\n `botDetection.ts`. Set `main.ts` as the HTTP val entrypoint.\n2. Add these four environment variables (account-level Environment Variables\n page):\n\n | Key | Value |\n | ---------------------- | ------------------------------------------------------------------- |\n | `TWITCH_CLIENT_ID` | your app's Client ID — reuse GuildScribe's |\n | `TWITCH_CLIENT_SECRET` | your app's Client Secret — reuse GuildScribe's |\n | `TWITCH_BOT_ID` | your bot account's numeric user id — reuse GuildScribe's |\n | `EVENTSUB_SECRET` | any random string you make up — doesn't need to match GuildScribe's |\n\n3. Open the val's URL — you'll land on a \"Connect my channel\" page. Click it,\n authorize on Twitch, and you're done: broadcaster login, chatters token, and\n EventSub subscription are all set up automatically in that one step.\n4. In Twitch chat, run `/mod guildscribebot` (or whichever account owns\n `TWITCH_BOT_ID`) if it isn't already modded, so it's allowed to speak.\n5. Type `!botcheck` in chat — you should get a reply within a few seconds.\n6. Reloading `/` from then on shows the dashboard directly, no reconnecting\n needed unless Twitch revokes the authorization.\n\n## Known limitations\n\n- If the stored token ever gets revoked (e.g. you remove the app's access in\n your Twitch settings), `!botcheck` and `/` will say the channel needs to\n reconnect — just visit `/connect` again.\n- `!botcheck` re-scans the whole chatter list on every call, so there's a couple\n seconds of delay before the reply — that's expected, not a bug.",[],[216],["D",1789431551373],["D",1789522252250],{"_11":12,"_140":71},{"_11":12,"_135":136,"_70":71,"_30":69,"_137":138,"_139":24},{"_40":126,"_13":16,"_34":37,"_127":87,"_128":-5,"_129":-5,"_130":-5,"_131":-5,"_132":-5,"_133":14,"_134":12},"ctx",{"_53":-5,"_159":261,"_262":263,"_264":265,"_266":24,"_267":24,"_268":24,"_269":100,"_270":-5,"_271":-7,"_272":-7,"_273":26,"_274":24,"_275":24,"_276":-5,"_277":24,"_278":24,"_279":24,"_280":-5},"ENV",{"_232":233,"_234":235,"_236":16,"_237":238,"_239":240,"_241":242,"_243":244,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":256,"_257":258,"_259":260},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","fdb67791413f4386b4dbf18f354029a617f6160f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · botDetection.ts