Ulofi Alias

Pseudonymous Discord chat that still feels like Discord.

Members keep talking in the channels they already use. In immersive channels, Ulofi Alias stops the original message before it appears publicly, then posts it back in the same conversation under that member's persistent alias and avatar. There is no separate anonymous room, compose page, or unfamiliar chat interface.

Ulofi Alias is pseudonymous, not untraceable. When a concrete safety or rules case requires it, an authorized administrator can trace a message, visible alias, or member history back to the Discord account. Identity reveals and other privileged actions are recorded in the audit log.

The bot also brings member verification, AI-assisted review and support, and private tickets into the same community workflow. The source is open so a community can inspect the rules it asks members to trust.

The experience at a glance

Capability	What members experience	What administrators retain
Immersive pseudonymity	Type in an existing channel and appear under a persistent alias and avatar.	Choose immersive and named areas, pause pseudonymous posting, and inspect delivery health.
Accountable moderation	Report a message privately or appeal a rejected post without starting a public argument.	Trace a message or alias when needed, review history, block misuse, and audit every privileged action.
Member verification	Open one private link, complete Turnstile, and receive the configured Discord role.	Server-side validation, expected-domain checks, bounded risk signals, and verified role assignment.
Support and tickets	Ask for private help first, then continue to a human ticket whenever needed.	Private ticket channels, intake fields, staff roles, notes, lifecycle controls, and protected transcripts.

Chat normally, appear as an alias

An administrator enables immersive pseudonymity for the server and chooses any categories or channels that should remain named. In an immersive channel:

1. A member types a normal message in Discord.
2. Ulofi Alias prevents the account identity and original message from becoming public.
3. Eligibility and optional content review run before publication.
4. The message returns to the same channel under that member's persistent alias and avatar.
5. The protected author mapping remains available only for accountable moderation and retention policy.

Conversation does not move elsewhere. Members can use the message context menu to reply under their alias, report a pseudonymous message, or appeal a rejected post. Reviewed images can be published under the same persona with metadata removed before delivery.

Ticket, announcement, staff, or other selected areas can remain outside immersive mode. Ticket categories created by the bot are kept named so members and support staff know who they are speaking with.

Pseudonymous, with a clear accountability boundary

Public participants see the alias, not the member's Discord account. The alias stays consistent so a conversation has continuity without making the account public.

Authorized administrators can:

• reveal the author of one pseudonymous message;
• find a member from a visible alias;
• review the pseudonymous message history linked to a member;
• block or restore a member's access to pseudonymous posting;
• disable one channel or the whole pseudonym system; and
• review the audit trail for reveals and moderation actions.

Reports do not reveal an author to the reporter and never trigger an automatic account penalty. AI review and identity reveal are separate operations; account-level action remains an administrator decision. Retention jobs can unlink older message records from member identity without rewriting the public conversation.

Verification that finishes in one private link

Administrators post a verification panel in Discord. A member receives a private, single-use link that expires after 10 minutes, completes Cloudflare Turnstile on the verification page, and receives the configured role only after the backend confirms the challenge and the Discord role assignment.

Turnstile is validated server-side. The implementation can bind a challenge to the expected action, hostname, and one-time session value, so a successful widget on the wrong site is not treated as completed verification. Cloudflare Tunnel and trusted-proxy handling are available for self-hosted deployments.

Review, support, and tickets

AI-assisted review

Optional review can pass, hold, or reject pseudonymous text and images before they are published. Members can appeal a rejected post, and held content goes to moderators when human review is needed. Review failures do not silently publish uncertain content, and an AI result does not automatically punish a member.

Private support

The /help command gives a private answer from a bounded community knowledge base. If AI support is unavailable or the question needs a person, the response keeps the configured human-support path visible.

Human tickets

The ticket panel can collect a category and up to five intake fields before it opens a private Discord channel. Communities can configure staff roles, staff-only notes, additional participants, reminders, automatic closing and deletion, reopening, and signed transcript links. Transcripts stay on the community's server instead of being uploaded to a third-party transcript host. AI support may be offered before the ticket form, but members can always continue to human help.

Important boundaries

• A pseudonym is not absolute anonymity. The deployment stores the protected mapping required for authorized traceability.
• Pseudonymous messages are delivered by the bot. Members cannot directly edit or delete the resulting webhook message; reports and staff tools handle correction or removal.
• Pseudonymous replies use the Discord message context menu, and reviewed image posting uses /anonimage, because Discord does not expose every native reply and attachment path to the relay.
• Optional AI providers receive only the content submitted to the enabled review or support path. Communities should review provider and retention settings before enabling those integrations.
• The public language is English by default. Discord command names and descriptions use native locale support, with Traditional Chinese available as zh-TW; some advanced administration responses are still being migrated.

Run it locally

Requirements: Node.js 20.17 or newer and npm.

cd src
npm ci
npm test

Copy .env.example to .env, then replace the obvious placeholders with a development Discord application and development Turnstile settings. Do not reuse production credentials locally. A single Discord token must never be used by two running bot instances.

Start a development instance only after configuration:

npm start

Docker Compose is available for a bot plus Cloudflare Tunnel deployment. Review the environment, volume, network, and hostname values before using it; the test suite never starts Compose automatically.

Project map

• src/index.js: Discord and HTTP composition root.
• src/db.js: SQLite schema and settings access.
• src/lib/: verification, privacy, moderation, support, tickets, statistics, backup, and command-localization modules.
• src/public/: verification and administration pages.
• src/tools/: local regression and release checks.
• ARCHITECTURE.md: boundaries, data flow, and extraction plan.
• DEPLOYMENT.md: generic Docker, Turnstile, and Cloudflare Tunnel deployment guide.

Validation and project status

Verification, tickets, moderation, pseudonymity, backup integrity, and command localization have local regression coverage. The tests use fake identifiers and local fixtures. They do not log in to Discord, call OAuth, send email, upload data, or start the production bot.

cd src
npm test
npm run check
docker compose config

See CONTRIBUTING.md before opening a pull request. Report security issues privately using SECURITY.md, not a public issue.

Ulofi Alias is available under the MIT License.