SpaceBot 🚀

A powerful, self-hosted Discord bot platform built with SvelteKit 2 (Svelte 5) and deployed on Cloudflare Pages. Create custom slash commands, build event-driven automations, and monitor all Discord activity through a beautiful admin dashboard.

✨ Features

🤖 Discord Bot

• Custom Slash Commands — Create your own commands with parameters, choices, and custom responses
• Event-Driven Automations — Trigger actions automatically when Discord events occur
• Full Gateway Support — Real-time event capture via Discord.js gateway connection
• Interactions Endpoint — HTTP-based slash command handling via Cloudflare Workers
• Member Rooms — Members create and run their own text or voice channels with /room or a join-to-create lobby; a server preset decides who may make one, what the creator can do to it, and when it closes itself
• Timebox — /timebox start runs focus blocks and breaks (23/5/15 minutes by default), alone or for everyone in your voice channel, with Pause / Skip / Stop and an optional "deafen me" you can always lift. Off until a server enables it (see docs/timebox.md)
• Activity — SpaceBot as a Discord Activity, opened from a voice channel or a DM, with a tab per module. The foundation is built (sign-in, place check, module switch); the timebox is its first module (see docs/activity.md)
• Quorum — /quorum ask puts a yes/no question to the server; it closes itself at the deadline, posts a RESULT naming an owner and a due date, and keeps counts only, never who voted (see docs/quorum.md)
• Observances — Post a historical day's events at the minutes they happened, on its anniversary. Ships with September 11, 2001; off unless a server owner turns it on and picks a channel (see docs/observances.md)
• Context Menu Commands — Message context menu registration and routing with server-side permission enforcement
• AI Chat for Managers — Server managers can DM the bot for AI-powered assistance. In production this runs on Cloudflare Workers AI (optionally through an AI Gateway for analytics/caching); in local development you can point it at an Ollama model instead (AI_PROVIDER=ollama, default gemma3:4b).
• AI DM Autopilot — When enabled, gateway DMs are enqueued onto a Cloudflare Queue and handled by a standalone orchestrator worker (see docs/ai-autopilot.md).

🌐 Web Dashboard

• Server Selection — Manage all servers where you're an admin
• Event Logs — View detailed logs of all Discord activity (members, messages, voice, moderation, etc.)
• Automation Builder — Visual interface to create event → action automations
• Command Builder — Design custom slash commands with the automation action system
• Public Server Browser — An opt-in directory at /servers where admins can publish their community (off by default; see Server Browser)
• Dark/Light Theme — Beautiful UI with theme toggle support
• Operational UX — Global toasts, skeleton loading states, route-level error handling, and reduced-motion-aware transitions

🧩 Automation & Extensibility

• Local Runner — A standalone Bun CLI users install on their own machine. It connects to the server over WebSocket, runs jobs as shell commands inside a path allowlist, and streams results back (see docs/local-runner-v2.md).
• Superadmin Workflows — Scheduled, server-spanning workflow templates driven by cron_expression values stored in D1 (see docs/superadmin-workflows.md).
• MCP Server — A standalone Model Context Protocol server (mcp-server/) that exposes SpaceBot data/operations to MCP-aware clients.

🔐 Authentication & Security

• Discord OAuth2 — Secure login with Discord credentials
• Sliding Session TTL — Configurable cookie lifetime via SESSION_TTL_SECONDS
• Token Refresh — Page navigations renew the Discord access token from the stored refresh token; a session that can't be renewed is cleared rather than left half-authenticated
• Admin Access Control — Only server admins can manage their servers
• Request Signature Verification — All Discord interactions are cryptographically verified
• Browser Hardening — Same-origin checks for cookie-authenticated JSON mutations plus HTML security headers and report-only CSP

⚡ Cloudflare-Native

• Cloudflare Pages — Deployed on Cloudflare's global edge network
• D1 Database — SQLite-based serverless database for logs and configurations
• Workers AI — AI-powered DM responses via Cloudflare's free LLM models
• AI Gateway — Optional analytics, caching, and rate limiting for AI requests
• Zero Cold Starts — Fast response times worldwide

Roadmap Operations

Repository-ready external integrations are configured with environment variables, not hardcoded credentials:

• PUBLIC_SUPPORT_DISCORD_URL, PUBLIC_BOT_VOTE_URL, and PUBLIC_BOT_REVIEW_URL power public community CTAs.
• SENTRY_DSN, SENTRY_ENVIRONMENT, and SENTRY_TRACES_SAMPLE_RATE enable Sentry.
• RATE_LIMIT_ENABLED, RATE_LIMIT_DEFAULT_WINDOW_SECONDS, and RATE_LIMIT_DEFAULT_MAX_REQUESTS enable D1-backed API limits.

Useful checks:

bun run docs:api
bun run audit:deps
bun run images:check
bun run verify:http3

📸 Screenshots

Secure Discord OAuth2 authentication for accessing the admin dashboard.

View event logs, statistics, and quick access to automations and commands.

The dashboard also supports a clean light theme.

This is the beginning of the README. Read the rest at the original. Read the full README ↗