Neuro Lag

[1.6.0] — 2026-04-29 — Code Quality & Security Improvement Release

This release addresses every major issue identified in the internal code audit: particle hardcoding, HTML injection, zip-bomb risk, missing checksum verification, scheduler spam, and excessive operator-list iteration.

Improved — AlertManager

• Configurable particle types — FLAME / HAPPY_VILLAGER were previously hardcoded. Both critical and recovery particle types and spawn count are now read from monitors.yml under alerts.alert-particles.*.
• Per-player cooldown — a 10-second per-player debounce (lastPlayerAlert map) prevents sensory spam (sound + particles) when multiple worlds transition at nearly the same time. Chat/actionbar messages are still delivered each transition regardless of the per-player gate.
• Action-bar alert — new alerts.enable-actionbar-warnings option (default false) sends the alert as an action bar in addition to (or instead of) the chat message.
• Single operator-list pass — Bukkit.getOnlinePlayers() is now iterated once per alert call and filtered into a local operators list, eliminating repeated permission checks inside a second loop.
• World debounce key fix — key is now worldName + ':' + newState (separator added) to prevent false matches when world name ends with the state string (e.g. worldCRITICAL).

Improved — AuditManager

• Entity collection cap — entity enumeration on the main thread is now capped at MAX_ENTITIES_PER_WORLD_AUDIT = 5 000 entities per world. Worlds exceeding the cap are sampled from the head of the list; a visible notice is printed in the report.
• Full HTML escaping — esc() now encodes &, <, >, ", and ', closing the XSS vector that existed when world names or plugin names contained special characters.
• Re-entrancy guard — an AtomicBoolean auditInProgress flag prevents overlapping concurrent report writes on servers that fire many critical events in quick succession.
• Async release — auditInProgress is cleared in a finally block to guarantee it is always released, even if an IOException occurs during the write.

Improved — BackupManager

• Filename-based sort — purgeOld() and listBackups() now sort backup filenames lexicographically (ISO-8601 timestamps sort correctly as strings). Eliminates one Files.getLastModifiedTime() syscall per backup file on every purge cycle.
• In-memory cache — listBackups() returns a cached list; the cache is invalidated after every doBackup() / purgeOld() to avoid directory scans on every command invocation.
• SHA-256 checksum — each backup ZIP is accompanied by a .zip.sha256 file written at creation time. restoreBackup() verifies the checksum before extracting; a mismatch aborts the restore and logs a SEVERE message. If no checksum file exists, restore proceeds with a warning (backwards-compatible with pre-1.6.0 backups).
• Zip-bomb protection — restoreZip() now enforces a 10 MB per-entry cap and a 50 MB total-extraction cap. Any entry or restore that exceeds these limits throws immediately with a descriptive message rather than consuming heap until OOM.
• Checksum file cleanup — purgeOld() also deletes the paired .sha256 file when removing an old backup, preventing orphaned checksum files accumulating on disk.

Improved — ConfigManager

• New fields for 1.6.0 alert config — alertParticleCritical, alertParticleRecovery, alertParticleCount, alertActionBarEnabled are loaded from monitors.yml.
• parseParticle() helper — mirrors the existing parseSound() helper; logs a warning and falls back to Particle.POOF on unknown particle names instead of throwing.
• Particle import added — org.bukkit.Particle is now imported in ConfigManager.

Config changes

# monitors.yml — new in 1.6.0
alerts:
  # Configurable particle types (was hardcoded FLAME / HAPPY_VILLAGER)
  alert-particles:
    critical: FLAME           # NEW — any Bukkit Particle enum name
    recovery: HAPPY_VILLAGER  # NEW
    count: 20                 # NEW — number of particles to spawn
  # Action bar alert (independent of chat messages)
  enable-actionbar-warnings: false  # NEW