Bot Viewer Detector

Scans your Twitch chat's current viewer list and flags accounts that look like follow/view-bots, so you can review and block them manually. Nothing is banned automatically.

Connect my channel

After connecting: mod the bot with /mod guildscribebot (or whichever account owns TWITCH_BOT_ID) so it can reply to !botcheck.

`,\n );\n }\n\n const data = await getFlaggedChatters(broadcasterId);\n const broadcaster = await getBroadcaster(broadcasterId);\n if (!data) {\n return page(\n \"Bot Viewer Detector\",\n `

Reconnect needed

This channel's Twitch connection has expired or been revoked.

Reconnect

`,\n );\n }\n\n const rows = data.results\n .map(\n (r) =>\n `${\n escapeHtml(r.displayName)\n }${r.score}${r.accountAgeDays}d${\n escapeHtml(r.reasons.join(\"; \"))\n }`,\n )\n .join(\"\");\n\n return page(\n \"Likely Bot Viewers\",\n `

Likely Bot Viewers${\n broadcaster ? ` — ${escapeHtml(String(broadcaster.display_name))}` : \"\"\n }

${data.totalChatters} chatters checked · ${data.results.length} flagged for review. Heuristic guess, not a certainty — check an account before blocking it.

\n \n \n ${rows || ''}\n

Username	Score	Account age	Why flagged
Nothing flagged right now.

\n \n

Reconnect / grant new permissions

`,\n );\n});\n\napp.get(\"/json\", async (c) => {\n const broadcasterId = await resolveBroadcasterId(c);\n if (!broadcasterId) {\n return c.json({ error: \"No channel connected yet. Visit /connect.\" }, 400);\n }\n const data = await getFlaggedChatters(broadcasterId);\n if (!data) {\n return c.json(\n { error: \"This channel needs to reconnect at /connect.\" },\n 401,\n );\n }\n return c.json({ total_chatters: data.totalChatters, flagged: data.results });\n});\n\n// ── OAuth connect flow ──\n\napp.get(\"/connect\", async (c) => {\n const state = crypto.randomUUID();\n await saveOAuthState(state, Date.now() + 10 * 60 * 1000);\n const url = new URL(c.req.url);\n const auth = new URL(\"https://id.twitch.tv/oauth2/authorize\");\n auth.search = new URLSearchParams({\n client_id: env(\"TWITCH_CLIENT_ID\"),\n redirect_uri: `${url.origin}/callback`,\n response_type: \"code\",\n // Broadcasters are implicitly moderators of their own channel, so\n // authorizing here as the broadcaster covers moderator:read:chatters too.\n scope: \"channel:bot moderator:read:chatters\",\n state,\n }).toString();\n return new Response(null, {\n status: 302,\n headers: { Location: auth.toString() },\n });\n});\n\napp.get(\"/callback\", async (c) => {\n const url = new URL(c.req.url);\n const error = url.searchParams.get(\"error\");\n if (error) {\n return page(\n \"Connection cancelled\",\n `

Connection cancelled

${\n escapeHtml(url.searchParams.get(\"error_description\") ?? error)\n }

`,\n );\n }\n const code = url.searchParams.get(\"code\");\n const state = url.searchParams.get(\"state\");\n if (!code || !state) return c.text(\"Missing OAuth code or state\", 400);\n const valid = await consumeOAuthState(state);\n if (!valid) return c.text(\"Invalid or expired OAuth state\", 400);\n\n try {\n const token = await exchangeCode(code, `${url.origin}/callback`);\n const user = await getSelf(token.access_token);\n\n // Reconnecting would otherwise try to create a duplicate\n // channel.chat.message subscription with the same type/condition/\n // callback, which Twitch rejects — clean up first so this is safe to\n // run repeatedly (e.g. to pick up newly requested scopes).\n const existing = await getBroadcaster(user.id);\n if (existing?.subscription_id) {\n try {\n await deleteEventSubSubscription(String(existing.subscription_id));\n } catch (e) {\n console.error(\"eventsub cleanup failed\", e);\n }\n }\n\n const sub = await createChatSubscription(user.id, `${url.origin}/eventsub`);\n await upsertBroadcaster(user.id, user.login, user.display_name, sub.id);\n await saveModToken(\n user.id,\n token.access_token,\n token.refresh_token,\n Array.isArray(token.scope)\n ? token.scope.join(\" \")\n : String(token.scope ?? \"\"),\n Date.now() + Math.max(0, Number(token.expires_in ?? 0) * 1000 - 60_000),\n );\n\n return page(\n \"Connected\",\n `

Connected

${\n escapeHtml(user.display_name)\n } is now connected. !botcheck will work once the bot is modded.

Important: in Twitch chat, run /mod guildscribebot (or whichever account owns TWITCH_BOT_ID) so it can reply.

View dashboard

`,\n );\n } catch (e) {\n console.error(e);\n return page(\n \"Connection failed\",\n `

Connection failed

Could not complete the Twitch connection. Please try again.

`,\n );\n }\n});\n\n// ── EventSub webhook: challenge handshake + incoming chat messages ──\n\napp.post(\"/eventsub\", async (c) => {\n const rawBody = await c.req.text();\n const valid = await verifyEventSub(c.req.raw, rawBody);\n if (!valid) return c.text(\"Invalid signature\", 403);\n\n const messageType = c.req.header(\"Twitch-Eventsub-Message-Type\");\n const payload = JSON.parse(rawBody);\n\n if (messageType === \"webhook_callback_verification\") {\n return c.text(payload.challenge, 200);\n }\n\n if (messageType === \"revocation\") {\n console.error(\"EventSub subscription revoked:\", payload.subscription);\n return c.text(\"\", 200);\n }\n\n if (\n messageType === \"notification\" &&\n payload.subscription?.type === \"channel.chat.message\"\n ) {\n const event = payload.event;\n const text: string = event?.message?.text ?? \"\";\n const broadcasterId: string = event?.broadcaster_user_id;\n\n if (text.trim().toLowerCase().startsWith(\"!botcheck\")) {\n handleBotCheck(broadcasterId).catch((err) =>\n console.error(\"botcheck failed\", err)\n );\n }\n\n return c.text(\"\", 200);\n }\n\n return c.text(\"\", 200);\n});\n\nasync function handleBotCheck(broadcasterId: string) {\n const data = await getFlaggedChatters(broadcasterId);\n if (!data) {\n await sendChatMessage(\n \"🤖 Bot check needs the channel to reconnect — visit /connect.\",\n broadcasterId,\n );\n return;\n }\n const reply = data.results.length === 0\n ? `🤖 No likely bot viewers spotted out of ${data.totalChatters} in chat right now.`\n : `🤖 ${data.results.length} likely bot viewer${\n data.results.length === 1 ? \"\" : \"s\"\n } out of ${data.totalChatters} in chat right now.`;\n await sendChatMessage(reply, broadcasterId);\n}\n\nexport default app.fetch;",3,["D",1789434764818],"branchVersion","label","botdetector",[18],"pulls","branches","forks","envVars",{"_185":187,"_188":26},"connections",{"_185":26,"_186":26},"count","unfilledCount",4,"emptyCount",{"_35":223,"_13":224,"_63":225,"_45":-5,"_37":38,"_174":226,"_198":108,"_39":227,"_41":218,"_65":21,"_170":228,"_67":24,"_175":-5,"_201":229,"_17":230},{"_35":215,"_13":216,"_63":217,"_45":-5,"_37":38,"_174":218,"_198":108,"_39":219,"_41":73,"_65":66,"_170":220,"_67":24,"_175":-5,"_201":221,"_17":222},{"_35":207,"_13":208,"_63":209,"_45":-5,"_37":38,"_174":210,"_198":108,"_39":211,"_41":73,"_65":66,"_170":212,"_67":24,"_175":-5,"_201":213,"_17":214},{"_35":169,"_13":18,"_63":64,"_45":-5,"_37":38,"_174":88,"_198":108,"_39":204,"_41":172,"_65":94,"_170":171,"_67":24,"_175":176,"_201":205,"_17":206},{"_35":194,"_13":195,"_63":196,"_45":-5,"_37":38,"_174":197,"_198":108,"_39":199,"_41":172,"_65":66,"_170":200,"_67":24,"_175":-5,"_201":202,"_17":203},"c92ee92a-14ce-4867-8925-5e290ffb8006","twitch.ts","a3c58130-b09b-11f1-881e-1607ee4eb77e",16,"latest",["D",1789434268736],"// Twitch Helix API helpers for the bot-viewer detector.\n//\n// Env vars still needed (down from 6 to 4 now that broadcaster/token capture\n// happens automatically via OAuth):\n// TWITCH_CLIENT_ID - your app's Client ID — reuse GuildScribe's\n// TWITCH_CLIENT_SECRET - your app's Client Secret — reuse GuildScribe's\n// TWITCH_BOT_ID - your bot account's numeric user id — reuse GuildScribe's\n// EVENTSUB_SECRET - any random string, used to verify EventSub webhook signatures\n\nimport { getModToken, saveModToken } from \"./db.ts\";\n\nexport const env = (name: string) => {\n const value = Deno.env.get(name);\n if (!value) throw new Error(`Missing environment variable: ${name}`);\n return value;\n};\n\n// ── App access token (client_credentials) — used for Get Users lookups,\n// sending chat messages, and managing EventSub subscriptions. ──\n\nlet cachedAppToken: { token: string; expiresAt: number } | null = null;\n\nexport function invalidateAppToken() {\n cachedAppToken = null;\n}\n\nexport async function getAppToken(): Promise {\n if (cachedAppToken && Date.now() < cachedAppToken.expiresAt) {\n return cachedAppToken.token;\n }\n const body = new URLSearchParams({\n client_id: env(\"TWITCH_CLIENT_ID\"),\n client_secret: env(\"TWITCH_CLIENT_SECRET\"),\n grant_type: \"client_credentials\",\n });\n const res = await fetch(\"https://id.twitch.tv/oauth2/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body,\n });\n if (!res.ok) {\n throw new Error(`App token failed: ${res.status} ${await res.text()}`);\n }\n const data = await res.json();\n const expiresInMs = Number(data.expires_in ?? 0) * 1000;\n cachedAppToken = {\n token: data.access_token as string,\n expiresAt: Date.now() + Math.max(0, expiresInMs - 60_000),\n };\n return cachedAppToken.token;\n}\n\n// ── Authorization-code OAuth (the broadcaster's own /connect flow) ──\n\nexport async function exchangeCode(code: string, redirectUri: string) {\n const body = new URLSearchParams({\n client_id: env(\"TWITCH_CLIENT_ID\"),\n client_secret: env(\"TWITCH_CLIENT_SECRET\"),\n code,\n grant_type: \"authorization_code\",\n redirect_uri: redirectUri,\n });\n const res = await fetch(\"https://id.twitch.tv/oauth2/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body,\n });\n if (!res.ok) {\n throw new Error(`OAuth exchange failed: ${res.status} ${await res.text()}`);\n }\n return await res.json();\n}\n\nexport async function refreshUserToken(refreshToken: string) {\n const body = new URLSearchParams({\n client_id: env(\"TWITCH_CLIENT_ID\"),\n client_secret: env(\"TWITCH_CLIENT_SECRET\"),\n grant_type: \"refresh_token\",\n refresh_token: refreshToken,\n });\n const res = await fetch(\"https://id.twitch.tv/oauth2/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body,\n });\n if (!res.ok) {\n throw new Error(`Token refresh failed: ${res.status} ${await res.text()}`);\n }\n return await res.json();\n}\n\n/** A valid moderator:read:chatters token for this broadcaster, refreshing\n * (and persisting the refresh) if the stored one is expiring soon. Returns\n * null if this channel was never connected, or the refresh itself fails\n * (revoked) — either way the mod needs to (re)visit /connect. */\nexport async function getValidModToken(\n broadcasterId: string,\n): Promise {\n const row = await getModToken(broadcasterId);\n if (!row) return null;\n if (Date.now() < Number(row.expires_at) - 60_000) {\n return String(row.access_token);\n }\n try {\n const refreshed = await refreshUserToken(String(row.refresh_token));\n const expiresAt = Date.now() +\n Math.max(0, Number(refreshed.expires_in ?? 0) * 1000 - 60_000);\n const scope = Array.isArray(refreshed.scope)\n ? refreshed.scope.join(\" \")\n : String(row.scope ?? \"\");\n await saveModToken(\n broadcasterId,\n refreshed.access_token,\n refreshed.refresh_token ?? String(row.refresh_token),\n scope,\n expiresAt,\n );\n return String(refreshed.access_token);\n } catch (_e) {\n return null;\n }\n}\n\nexport interface TwitchUser {\n id: string;\n login: string;\n display_name: string;\n created_at: string;\n profile_image_url: string;\n}\n\n/** Get Users, batched 100 logins per request (Helix's max). */\nexport async function getUsersByLogin(logins: string[]): Promise {\n const token = await getAppToken();\n const out: TwitchUser[] = [];\n for (let i = 0; i < logins.length; i += 100) {\n const batch = logins.slice(i, i + 100);\n const params = new URLSearchParams();\n for (const l of batch) params.append(\"login\", l);\n const res = await fetch(`https://api.twitch.tv/helix/users?${params}`, {\n headers: {\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n Authorization: `Bearer ${token}`,\n },\n });\n if (!res.ok) {\n throw new Error(`Get Users failed: ${res.status} ${await res.text()}`);\n }\n const data = await res.json();\n out.push(...data.data);\n }\n return out;\n}\n\n/** The token owner's own Twitch identity — used right after OAuth exchange\n * to find out who just connected, and to resolve moderator_id for Get Chatters. */\nexport async function getSelf(accessToken: string): Promise {\n const res = await fetch(\"https://api.twitch.tv/helix/users\", {\n headers: {\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n Authorization: `Bearer ${accessToken}`,\n },\n });\n if (!res.ok) {\n throw new Error(\n `Could not identify token owner: ${res.status} ${await res.text()}`,\n );\n }\n const data = await res.json();\n return data.data[0];\n}\n\nexport interface Chatter {\n user_id: string;\n user_login: string;\n user_name: string;\n}\n\n/** Get Chatters, using the broadcaster's own stored moderator:read:chatters\n * token (broadcasters are implicitly moderators of their own channel, so\n * moderator_id === broadcaster_id here). */\nexport async function getChatters(\n broadcasterId: string,\n modAccessToken: string,\n): Promise {\n const out: Chatter[] = [];\n let cursor: string | undefined;\n do {\n const params = new URLSearchParams({\n broadcaster_id: broadcasterId,\n moderator_id: broadcasterId,\n first: \"1000\",\n });\n if (cursor) params.set(\"after\", cursor);\n const res = await fetch(\n `https://api.twitch.tv/helix/chat/chatters?${params}`,\n {\n headers: {\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n Authorization: `Bearer ${modAccessToken}`,\n },\n },\n );\n if (!res.ok) {\n throw new Error(`Get Chatters failed: ${res.status} ${await res.text()}`);\n }\n const data = await res.json();\n out.push(...data.data);\n cursor = data.pagination?.cursor || undefined;\n } while (cursor);\n return out;\n}\n\n// ── Sending chat messages (app-token bot flow, same as GuildScribe) ──\n\nexport async function sendChatMessage(\n text: string,\n broadcasterId: string,\n): Promise {\n const message = text.slice(0, 500);\n if (!message.trim()) return true;\n try {\n const send = async (token: string) =>\n fetch(\"https://api.twitch.tv/helix/chat/messages\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${token}`,\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n broadcaster_id: broadcasterId,\n sender_id: env(\"TWITCH_BOT_ID\"),\n message,\n }),\n });\n\n let res = await send(await getAppToken());\n if (res.status === 401) {\n invalidateAppToken();\n res = await send(await getAppToken());\n }\n if (!res.ok) {\n console.error(\n `Twitch chat send failed: ${res.status} ${await res.text()}`,\n );\n }\n return res.ok;\n } catch (err) {\n console.error(\"sendChatMessage failed\", err);\n return false;\n }\n}\n\n// ── EventSub subscription management ──\n\nasync function createEventSubSubscription(\n type: string,\n version: string,\n condition: Record,\n callbackUrl: string,\n) {\n const appToken = await getAppToken();\n const res = await fetch(\n \"https://api.twitch.tv/helix/eventsub/subscriptions\",\n {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${appToken}`,\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n type,\n version,\n condition,\n transport: {\n method: \"webhook\",\n callback: callbackUrl,\n secret: env(\"EVENTSUB_SECRET\"),\n },\n }),\n },\n );\n const text = await res.text();\n if (!res.ok) {\n throw new Error(\n `EventSub subscription failed (${type}): ${res.status} ${text}`,\n );\n }\n return JSON.parse(text).data[0];\n}\n\nexport async function createChatSubscription(\n broadcasterId: string,\n callbackUrl: string,\n) {\n return createEventSubSubscription(\n \"channel.chat.message\",\n \"1\",\n { broadcaster_user_id: broadcasterId, user_id: env(\"TWITCH_BOT_ID\") },\n callbackUrl,\n );\n}\n\nexport async function deleteEventSubSubscription(subscriptionId: string) {\n if (!subscriptionId) return true;\n const appToken = await getAppToken();\n const res = await fetch(\n `https://api.twitch.tv/helix/eventsub/subscriptions?id=${\n encodeURIComponent(subscriptionId)\n }`,\n {\n method: \"DELETE\",\n headers: {\n Authorization: `Bearer ${appToken}`,\n \"Client-Id\": env(\"TWITCH_CLIENT_ID\"),\n },\n },\n );\n if (res.status === 404) return true;\n if (!res.ok) {\n throw new Error(\n `EventSub deletion failed: ${res.status} ${await res.text()}`,\n );\n }\n return true;\n}\n\n/** Constant-time string compare, so signature checking doesn't leak timing info. */\nexport function timingSafeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) {\n diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n }\n return diff === 0;\n}\n\nexport async function verifyEventSub(\n req: Request,\n rawBody: string,\n): Promise {\n const id = req.headers.get(\"Twitch-Eventsub-Message-Id\") ?? \"\";\n const timestamp = req.headers.get(\"Twitch-Eventsub-Message-Timestamp\") ?? \"\";\n const received = req.headers.get(\"Twitch-Eventsub-Message-Signature\") ?? \"\";\n if (!id || !timestamp || !received) return false;\n const receivedAt = Date.parse(timestamp);\n if (\n !Number.isFinite(receivedAt) ||\n Math.abs(Date.now() - receivedAt) > 10 * 60 * 1000\n ) return false;\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(env(\"EVENTSUB_SECRET\")),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const signature = new Uint8Array(\n await crypto.subtle.sign(\n \"HMAC\",\n key,\n new TextEncoder().encode(id + timestamp + rawBody),\n ),\n );\n const hex = [...signature].map((b) => b.toString(16).padStart(2, \"0\")).join(\n \"\",\n );\n const expected = `sha256=${hex}`;\n return timingSafeEqual(expected, received);\n}","children",[],[195],["D",1789434764818],[],[18],"38500745-f00c-485f-813c-835b14d9a297","db.ts","725abbfa-b0a1-11f1-9048-1607ee4eb77e",19,["D",1789434299195],"// Storage for the bot-viewer detector — connected broadcasters and their\n// moderator:read:chatters tokens. Mirrors GuildScribe's db.ts / ads_db.ts\n// conventions (INSERT OR REPLACE, broadcaster_id-keyed rows) so behavior\n// matches your other bots if this ever moves into the same monorepo.\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport async function ensureTables() {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS oauth_states (state TEXT PRIMARY KEY, expires_at INTEGER)`,\n );\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS broadcasters (\n broadcaster_id TEXT PRIMARY KEY, login TEXT, display_name TEXT,\n subscription_id TEXT, connected_at INTEGER, connected INTEGER NOT NULL DEFAULT 1\n )`,\n );\n // The connecting account's own OAuth token, scope moderator:read:chatters —\n // refreshed on demand (see getValidModToken in twitch.ts). Broadcasters are\n // implicitly moderators of their own channel, so having the broadcaster\n // authorize at /connect is enough; no separate mod account login needed.\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS mod_tokens (\n broadcaster_id TEXT PRIMARY KEY, access_token TEXT NOT NULL, refresh_token TEXT NOT NULL,\n scope TEXT, expires_at INTEGER NOT NULL, updated_at INTEGER NOT NULL\n )`,\n );\n}\n\nexport async function saveOAuthState(state: string, expiresAt: number) {\n await sqlite.execute(\n \"INSERT INTO oauth_states (state, expires_at) VALUES (?,?)\",\n [state, expiresAt],\n );\n}\n\n/** Deletes the state either way (single use), returns whether it was valid. */\nexport async function consumeOAuthState(state: string): Promise {\n const check = await sqlite.execute(\n \"SELECT * FROM oauth_states WHERE state = ? AND expires_at > ?\",\n [\n state,\n Date.now(),\n ],\n );\n await sqlite.execute(\"DELETE FROM oauth_states WHERE state = ?\", [state]);\n return check.rows.length > 0;\n}\n\nexport async function upsertBroadcaster(\n broadcasterId: string,\n login: string,\n displayName: string,\n subscriptionId: string,\n) {\n await sqlite.execute(\n `INSERT OR REPLACE INTO broadcasters (broadcaster_id, login, display_name, subscription_id, connected_at, connected)\n VALUES (?,?,?,?,?,1)`,\n [broadcasterId, login, displayName, subscriptionId, Date.now()],\n );\n}\n\nexport async function getBroadcaster(broadcasterId: string) {\n const res = await sqlite.execute(\n \"SELECT * FROM broadcasters WHERE broadcaster_id = ?\",\n [broadcasterId],\n );\n return res.rows.length ? res.rows[0] : null;\n}\n\n/** This is a personal-use tool, so in practice one channel connects. Used by\n * \"/\" and \"/json\" when no ?channel= query param is given. */\nexport async function getFirstConnectedBroadcaster() {\n const res = await sqlite.execute(\n \"SELECT * FROM broadcasters WHERE connected = 1 ORDER BY connected_at ASC LIMIT 1\",\n );\n return res.rows.length ? res.rows[0] : null;\n}\n\nexport async function saveModToken(\n broadcasterId: string,\n accessToken: string,\n refreshToken: string,\n scope: string,\n expiresAt: number,\n) {\n await sqlite.execute(\n `INSERT OR REPLACE INTO mod_tokens (broadcaster_id, access_token, refresh_token, scope, expires_at, updated_at)\n VALUES (?,?,?,?,?,?)`,\n [broadcasterId, accessToken, refreshToken, scope, expiresAt, Date.now()],\n );\n}\n\nexport async function getModToken(broadcasterId: string) {\n const res = await sqlite.execute(\n \"SELECT * FROM mod_tokens WHERE broadcaster_id = ?\",\n [broadcasterId],\n );\n return res.rows.length ? res.rows[0] : null;\n}",[],[208],"46df2354-64f4-4991-8d06-30482d932865","botDetection.ts","8475738a-b09b-11f1-a52d-1607ee4eb77e",5,["D",1789431761819],"import type { TwitchUser } from \"./twitch.ts\";\n\n// Well-known, legitimate service bots — never flag these regardless of score.\n// Add your own bot accounts here (e.g. your GuildScribe/Hunt & Hoard bot logins).\nconst KNOWN_SAFE_BOTS = new Set([\n \"nightbot\",\n \"streamelements\",\n \"streamlabs\",\n \"moobot\",\n \"soundalerts\",\n \"wizebot\",\n \"fossabot\",\n \"pretzelrocks\",\n \"own3d\",\n \"sery_bot\",\n \"restreambot\",\n \"commanderroot\",\n]);\n\n// Shapes commonly produced by follow/view-bot generator tools.\nconst BOT_NAME_PATTERNS = [\n /^[a-z]{3,12}\\d{5,}$/i, // short word + 5+ trailing digits, e.g. \"coolgamer88421\"\n /^[a-z0-9]{16,}$/i, // long random alphanumeric blob\n];\n\nexport interface BotScoreResult {\n login: string;\n displayName: string;\n score: number;\n reasons: string[];\n accountAgeDays: number;\n profileUrl: string;\n}\n\n/** Returns null if the account isn't flagged at all. */\nexport function scoreUser(user: TwitchUser): BotScoreResult | null {\n const login = user.login.toLowerCase();\n if (KNOWN_SAFE_BOTS.has(login)) return null;\n\n const reasons: string[] = [];\n let score = 0;\n\n const createdAt = new Date(user.created_at).getTime();\n const ageDays = (Date.now() - createdAt) / (1000 * 60 * 60 * 24);\n\n if (ageDays < 3) {\n score += 3;\n reasons.push(`Account is ${ageDays.toFixed(1)} days old`);\n } else if (ageDays < 14) {\n score += 2;\n reasons.push(`Account is only ${Math.round(ageDays)} days old`);\n } else if (ageDays < 45) {\n score += 1;\n reasons.push(`Account is ${Math.round(ageDays)} days old`);\n }\n\n if (\n !user.profile_image_url ||\n user.profile_image_url.includes(\"user-default-pictures\")\n ) {\n score += 2;\n reasons.push(\"Using the default profile picture\");\n }\n\n if (BOT_NAME_PATTERNS.some((p) => p.test(login))) {\n score += 2;\n reasons.push(\"Username matches common bot-generator patterns\");\n }\n\n if (score === 0) return null;\n\n return {\n login: user.login,\n displayName: user.display_name,\n score,\n reasons,\n accountAgeDays: Math.round(ageDays),\n profileUrl: `https://twitch.tv/${user.login}`,\n };\n}",[],[216],"62666a88-9024-4411-9fd6-9955295cd17e","README.md","92e96052-b09b-11f1-b904-1607ee4eb77e",14,["D",1789434214479],"# Bot Viewer Detector\n\nScans your Twitch chat's current viewer list and flags accounts that look like\nfollow/view-bots, so you can review and block them manually. Nothing is banned\nautomatically.\n\n- **`/`** — dashboard: sorted table of flagged accounts with reasons. Once\n connected, this is also the landing page.\n- **`/json`** — same data as JSON.\n- **`!botcheck`** — chat command that replies with just the count, e.g. \"🤖 4\n likely bot viewers out of 212 in chat right now.\"\n\n## What changed from the env-var version\n\nYou no longer set `TWITCH_BROADCASTER_LOGIN` or `TWITCH_MOD_OAUTH_TOKEN` by\nhand. Instead, visiting `/connect` and authorizing on Twitch captures your\nlogin, ID, and a refreshable moderator:read:chatters token automatically — same\nOAuth pattern GuildScribe already uses (`/connect` → Twitch → `/callback`),\nstored in this project's own SQLite database. The token also now refreshes\nitself instead of expiring every ~4 hours.\n\n## How detection works\n\nEach chatter is scored on:\n\n- Account age (younger = more suspicious)\n- Default/missing profile picture\n- Username shape (word+digits, long random strings — common bot-generator\n patterns)\n\nKnown legitimate bots (Nightbot, StreamElements, etc. — see `botDetection.ts`)\nare always excluded. This is heuristic, not certain — glance at a flagged\naccount before blocking it.\n\n## Setup on Val Town\n\n1. Create a new Val Town project and upload `main.ts`, `twitch.ts`, `db.ts`, and\n `botDetection.ts`. Set `main.ts` as the HTTP val entrypoint.\n2. Add these four environment variables (account-level Environment Variables\n page):\n\n | Key | Value |\n | ---------------------- | ------------------------------------------------------------------- |\n | `TWITCH_CLIENT_ID` | your app's Client ID — reuse GuildScribe's |\n | `TWITCH_CLIENT_SECRET` | your app's Client Secret — reuse GuildScribe's |\n | `TWITCH_BOT_ID` | your bot account's numeric user id — reuse GuildScribe's |\n | `EVENTSUB_SECRET` | any random string you make up — doesn't need to match GuildScribe's |\n\n3. Open the val's URL — you'll land on a \"Connect my channel\" page. Click it,\n authorize on Twitch, and you're done: broadcaster login, chatters token, and\n EventSub subscription are all set up automatically in that one step.\n4. In Twitch chat, run `/mod guildscribebot` (or whichever account owns\n `TWITCH_BOT_ID`) if it isn't already modded, so it's allowed to speak.\n5. Type `!botcheck` in chat — you should get a reply within a few seconds.\n6. Reloading `/` from then on shows the dashboard directly, no reconnecting\n needed unless Twitch revokes the authorization.\n\n## Known limitations\n\n- If the stored token ever gets revoked (e.g. you remove the app's access in\n your Twitch settings), `!botcheck` and `/` will say the channel needs to\n reconnect — just visit `/connect` again.\n- `!botcheck` re-scans the whole chatter list on every call, so there's a couple\n seconds of delay before the reply — that's expected, not a bug.",[],[224],["D",1789431551373],["D",1789522252250],{"_11":12,"_147":70},{"_11":12,"_142":143,"_69":70,"_30":68,"_144":145,"_146":24},{"_41":88,"_13":16,"_35":38,"_134":96,"_135":-5,"_136":-5,"_137":-5,"_138":-5,"_139":-5,"_140":14,"_141":12},"ctx",{"_53":-5,"_166":269,"_270":271,"_272":273,"_274":24,"_275":24,"_276":24,"_277":108,"_278":-5,"_279":-7,"_280":-7,"_281":26,"_282":24,"_283":24,"_284":-5,"_285":24,"_286":24,"_287":24,"_288":-5},"ENV",{"_240":241,"_242":243,"_244":16,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":256,"_257":258,"_259":260,"_261":262,"_263":264,"_265":266,"_267":268},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · main.ts