ArkOpsAi

Issues Fixed:

1. Tool Call Parameter Lack of Validation — Added safe extraction methods requireString(), optionalString(), and optionalInt(), replacing all direct calls to args.get().getAsString() to avoid NPE (Non-Point Exception).

2. Redundant Handler Instances — Instead of creating separate OpsCommandExecutor and OpsGuiCommand instances, they now receive shared instances to ensure frequency limits and context sharing.

3. ArrayList Thread Safety — Changed the value type of requestTimestamps from ArrayList to CopyOnWriteArrayList, and added synchronized protection to checkRateLimit.

4. Prompt Injection Protection — Added NFKC normalization, character filtering control, a 2000-character length limit, and 20+ injection variant matching rules to sanitizeInput().

5. Incomplete Context Saving — Rewrote saveContext() to save the complete conversation context (user message + all tool_calls/tool ​​results), using a Java List as an intermediary to resolve JsonArray issues. Issues with unsupported index insertion:

6. Tab completion logic defect — onTabComplete() now uses String.join(" ", args) to match multi-word prefixes, correctly handling multi-word subcommands such as "set gamemode".

7. Unused configuration values ​​— max-tokens and temperature are now read from config.yml instead of being hardcoded.

8. OkHttpClient timeout not read — connectTimeout / readTimeout / writeTimeout are now read from the timeout value in the configuration.

9. check_permission information leakage — check_permission tool moved to the SUPER_ADMIN permission block, inaccessible to ordinary users; reload_* series tools are also moved to the SUPER_ADMIN block.

10. JarFile resource leakage — JarFile and ClassLoader in the loadSkillsFromFolder, reloadSkill, and loadNewSkills methods are all changed to try-with-resources.

11. Notice board not restored — PlayerQuitEvent added. 11. Listener for clearing SignSession in sessions and restoring signboard blocks to empty when a player exits:

12. Storage Leakage: Added the cleanupPlayerData(UUID) method to clear playerContexts and requestTimestamps, called in ChatListener's PlayerQuitEvent.

13. Uninterpreted Help Information: All help text is now read using lang.getMessage("command.help_*"), and corresponding translation keys have been added to zh.yml and en.yml.

14. CompletableFuture using ForkJoinPool: Added a custom ExecutorService (daemon thread, thread name ArkOpsAI-Async), all asynchronous requests now use the custom thread pool, and it is correctly shut down in shutdown().

15. Added User Agreement and Privacy Policy