NexusAI

Bugfix release: JSON click and hover components are removed from replies, cleaned values in chat messages, a short wait instead of repeated requests for markup-only replies and a backup of pool.yml. Everyone on 1.0.1 should update; config.yml stays at config-version: 2 and no keys are added.

Upgrading

• Replace NexusAI-1.0.1.jar with NexusAI-1.0.2.jar and restart. api-version stays 1.20.6. Commands, permissions and placeholders are unchanged.
• Recommended for every server on 1.0.1, especially when NexusAI placeholders are shown through TAB, DeluxeMenus, a scoreboard or a chat plugin that parses JSON text components or MiniMessage.
• config.yml is not changed: no new keys, config-version stays 2, and no config.yml.bak is written.
• The first save that removes markup from answers already stored in pool.yml copies the file to pool.yml.bak first (or pool.yml.bak.<timestamp> when that backup already exists), keeps the file permissions and replaces the file in one atomic write. The log shows the backup path. Later saves of clean answers do not write another backup.
• The cache key stays player-input-guard-v8. Pool rows and cache entries are cleaned again when they are read, including rows written by 1.0.1.

Reply markup

• Fix: with sanitize.allow-markup: false (the default), a JSON text component in a reply that carries a click, hover or insertion action is reduced to its visible text. This covers the array form and such a component nested inside other JSON. In 1.0.1 these components stayed in the reply, and a plugin that parses JSON components after PlaceholderAPI inserts the reply could act on them.
• A JSON component without an action, such as {"text":"Hi"}, and ordinary brace text such as {^_^} or if (x) { return 1; } stay as written.
• Fix: a > inside a quoted tag argument no longer ends the tag early, so no part of such a tag is left as visible text. <3, x < y, 1<2 and <- back stay text, as before.
• sanitize.allow-markup: true now lets JSON click and hover components through as well as MiniMessage tags and hex colours. Enable it only if you understand the risk: a plugin that parses them turns them into working click and hover actions chosen by the model. Legacy § and & codes are always removed, and /nai talk and /nai test still insert the reply as plain text.

Markup-only replies

• Fix: a reply that is empty only after hex colours, MiniMessage tags or a JSON click or hover component are removed is no longer treated as a provider failure. It is not cached and not stored in the pool, and that prompt waits 30 seconds before the next placeholder or pool request. The wait does not grow, it is not the 5 / 15 / 30 / 60 minute empty-reply pause, and no warning is written. During the wait, placeholders and the pool serve a pooled answer or the prompt's fallback text.
• /nai test reports The model reply was empty after removing markup.; it is not held and does not start the wait. /nai reload clears the wait.
• A reply that is empty after legacy colour codes (&c, §l) are removed still starts the empty-reply pause with a Retry after time, as in 1.0.1. Local rate limits still apply.

Chat messages

• Fix: values inserted into a chat message are cleaned with the same filter before the message is built. This covers {error}, {character} and {id} (talk start, unknown character and /nai prompts), {player}, the moderation, import and /nai status fields. A § code or a tag in such a value no longer colours the line or becomes markup. {prefix} is still the coloured prefix from the locale file, and {reply} and {answer} stay plain text as in 1.0.1.
• /nai talk still matches a character id in any letter case. The first chat line and the console's unknown-character line show the id as it was typed.

Logs and docs

• Fix: a locale: that is not bundled and has no file logs two short warnings: the file path, that English is used instead, and the list of bundled locale codes. A locale file that is not valid YAML logs one warning with the path, the parser reason (with line and column when available) and the locale used instead. There is no stack trace in the console. Reported in #17.
• The length-trim INFO line names the prompt only when the id has the form of a prompts.yml id (a-z, 0-9, _, -, at most 64 characters) or is nai talk. For other literal placeholders only the length is printed, never the text.
• The README and the config.yml comments describe the sanitize.allow-markup risk, the length-trim notices (one key per prompt id, at most 256 ids, cleared by /nai reload) and how a reply is cut after a Roman numeral or a markdown heading. Comments in an existing config.yml are not rewritten.

Known issues

• The player-input boundary and the reply filter reduce prompt-injection risk. They do not eliminate it. A reply that complies directly and never mentions the guard, the boundary, the request or an injection phrase from the player text still reaches the player.
• When a model keeps answering a pooled prompt with markup only, the pool can still send up to size requests for that prompt in each 30-second window.
• Small models such as allam-2-7b answer weakly. Do not use a small model alone: put another model later in model-queue and keep a fallback.
• Groq's free tier has a per-minute output-token quota per account, and max-tokens 256 does not remove it. Frequent long /nai talk turns, or many long placeholders, can still return HTTP 429 and pause requests to that provider.

Compatibility

• Paper and Purpur 1.20.6–26.2; Folia is not supported; Java 21 or newer
• PlaceholderAPI 2.11.6+ (soft-depend)
• Tested with PlaceholderAPI 2.12.3 on Paper 1.20.6-151, 1.21.4-232 and 26.2-129, and on Purpur 26.2-2633 (Java 21 on 1.20.6 and 1.21.4, Java 25 on 26.2).
• Paper and Purpur 26.3, Spigot and CraftBukkit are not supported.

Download

NexusAI-1.0.2.jar, SHA-256 d389b4cd095b4130d5be1f8e2eb4255dea3cd162bf98d1c83c3c37f25149deb7

Full history: CHANGELOG.md