SnCaptcha changelog

Time-based anti-macro captcha for EdTools farming worlds, on Paper 1.20.x and 1.21.x.

A player who keeps breaking blocks in a tracked world accumulates farming time. Once their total crosses a threshold drawn privately for them, the plugin sends a captcha: a countdown title telling them to run /captcha, Blindness while it is open, and a 30-second deadline. The menu shows four number heads in random cells, and clicking them in ascending order solves it. Failing to answer, or spending the wrong-click budget, runs a configurable ladder of console commands.

The threshold is a per-player random value inside a configured range, drawn once and re-drawn after every captcha. Two players farming side by side are never asked at the same time, and nobody can learn the interval by timing it.

How it decides

• Farming time accrues from EdToolsBreakBlockEvent in the worlds listed under worlds:. A player counts as farming while they broke a block within farming.active-window-seconds, and keeps accruing for farming.stop-farming-grace-seconds after their last break. Leaving a tracked world or standing in an exempt WorldGuard region pauses the timer; it neither resets nor keeps counting.
• Accumulated farming time is the only trigger. There is no behavioural scoring, no pattern analysis and no response-timing heuristic.
• A captcha is only ever sent to somebody who is actually farming. Accrued time does not decay, so sending one to an idle player would guarantee a timeout.
• Solving or failing both zero the accrued time and draw a new threshold, so the next captcha is a full farming session away.

The captcha itself

It is a menu, never chat, because a proxy-level mute would stop a chat answer from ever reaching the server. The heads carry no name, no lore and no hidden data: only the rendered skin says which digit a head is, the digit-to-cell assignment and the head skins are both re-randomized on every open, and clicks are routed by cell. A generic auto-clicker has nothing in the menu to read.

A wrong click restarts the sequence and spends one of captcha.gui.max-wrong-clicks, and that budget survives closing and reopening the menu, so a script cannot buy fresh attempts by reopening.

For staff

Alerts go to holders of sncaptcha.notify when a captcha is sent, when it is halfway through unanswered, when it fails and when it is solved, with the same lines optionally appended to alerts.log. /captcha status ranks farmers by accumulated time, /captcha info <player> shows one player's time, threshold and history, /captcha force <player> sends one immediately and /captcha reset <player> clears stored data.

The plugin refuses to send a captcha at all - and says so in the console - when it cannot present a solvable board: a broken menu file, head textures it cannot read, or a missing captcha title. A player is never blinded and put on a deadline for a board they could not have finished.

Permissions

sncaptcha.admin with one child per action, sncaptcha.notify for the staff alerts, and sncaptcha.bypass for total exemption. /captcha itself carries no permission: solving a captcha has to be reachable by every player.

This version's nodes are sncaptcha.*. Servers that had oki.captcha.* nodes granted will need the new ones issued in LuckPerms.

Installing

1. Put SnLib.jar in plugins/. SnCaptcha is a SnLib consumer and will not enable without it.
2. Make sure EdTools is installed - it is a hard dependency, so the server will not load SnCaptcha without it.
3. Put SnCaptcha.jar in plugins/ and start the server. It generates config.yml, lang/messages_en.yml and guis/captcha.yml on that first boot.
4. Paste your licence key into plugins/.Sn-License/license.yml, created on that same boot, and restart.
5. Set worlds: to your farming world names, and set the sanctions.failures tiers to commands your server actually has - the shipped examples assume a punishment plugin.
6. Run /captcha reload.

New config keys are merged into your files on every update, keeping your values and comments.

Requirements: Java 21, Paper 1.20.x or 1.21.x, SnLib, EdTools. WorldGuard (region exemptions) and Floodgate (Bedrock players are never sent a captcha) are optional.