Bugfix release: **model replies no longer carry hex colours or MiniMessage tags into other plugins**, a new **`sanitize.allow-markup`** option, and **plain-text replies in `/nai talk` and `/nai test`**. Everyone on 1.0.0 should update; one key is added to `config.yml` automatically and the file stays at `config-version: 2`. ## Upgrading - Replace `NexusAI-1.0.0.jar` with `NexusAI-1.0.1.jar` and restart. `api-version` stays `1.20.6`. Commands, permissions and placeholders are unchanged. - Recommended for every server on 1.0.0, especially when NexusAI placeholders are shown through TAB, DeluxeMenus, a scoreboard or a chat plugin that understands MiniMessage or `&#RRGGBB`. - On startup and on `/nai reload`, `sanitize.allow-markup: false` is appended to `config.yml` when it is missing, with a comment above it, and the log says `Added missing config keys: sanitize.allow-markup`. The file is copied to `config.yml.bak` first (or `config.yml.bak.` when that backup already exists). `config-version` stays `2`, and your other values and comments are kept. - Answers already stored in `pool.yml` are cleaned when they are loaded. The next routine pool save writes the cleaned text back, and an answer that is empty after cleaning is dropped. No backup of `pool.yml` is made for this; copy the file before upgrading if you want to keep the 1.0.0 version. - The cache key is now `player-input-guard-v8`, so answers cached by 1.0.0 are not reused and are requested again. ## Reply markup - **Fix:** in 1.0.0 a model reply lost `§` and the legacy `&` codes, but hex colours and MiniMessage tags stayed in the text. A plugin that parses that markup after PlaceholderAPI inserts the reply could then show it as coloured text, or as a click or hover action that the model chose. 1.0.1 removes that markup as well. - Removed forms: `&#RRGGBB`, `&#RGB`, `<#RRGGBB>` and MiniMessage tags such as ``, ``, ``, ``, ``, `` and ``, in any letter case. Only the tag is removed, so `Hi` becomes `Hi`. The pass repeats until nothing changes, so nested tags cannot reassemble. - Cleaning runs before a reply reaches a placeholder, a dialogue reply, the pool or the cache, and again on every pool and cache read, so answers stored by an older jar are cleaned too. Legacy `§` and `&` codes are removed exactly as in 1.0.0. - Text that is not a tag stays as written, for example `<3`, `x < y`, `1<2`, `<- back` and a bare `&` as in `rock & stone`. - A reply that is empty after cleaning, such as a reply that is only tags, is handled like a colour-only reply in 1.0.0: it is not cached, the placeholder shows a pooled answer or the fallback text, and the log and `/nai status` say `The model reply was empty after removing colour codes.` with a `Retry after` time. - **Fix:** `/nai talk` and `/nai test` apply the colours of the chat template first and then insert the reply as plain text. The reply is never parsed as colour codes or MiniMessage there, including when `sanitize.allow-markup` is `true`. ## `sanitize.allow-markup` - New option, default `false`. With `true`, `&#RRGGBB`, `<#RRGGBB>` and MiniMessage tags are kept in placeholder replies, so a plugin that renders them can show colours chosen by the model. Legacy `§` and `&` codes are still removed, and `/nai talk` and `/nai test` stay plain text. - **Enable it only if you understand the risk.** With `true`, click and hover tags in a reply also reach the plugin that shows the placeholder, and a plugin that parses MiniMessage turns them into working click and hover actions. The model writes the reply, and player text in the prompt can influence it. Keep the default unless no plugin that reads NexusAI placeholders parses MiniMessage or hex colours. - Markup removed from `pool.yml` while the option was `false` does not come back when you switch it to `true`. ## Known issues - JSON text components in a reply (for example `{"text":"…"}`) are not removed. NexusAI does not parse them, but a plugin that parses JSON components after PlaceholderAPI inserts the reply can still act on them. - A tag with `>` inside a quoted argument ends at the first `>`, so a few characters of that tag can remain as visible plain text. - The player-input boundary and the reply filter reduce prompt-injection risk. They do not eliminate it. A reply that complies directly and never mentions the guard, the boundary, the request or an injection phrase from the player text still reaches the player. - Small models such as `allam-2-7b` answer weakly. Do not use a small model alone: put another model later in `model-queue` and keep a `fallback`. - Groq's free tier has a per-minute output-token quota per account, and `max-tokens` 256 does not remove it. Frequent long `/nai talk` turns, or many long placeholders, can still return HTTP 429 and pause requests to that provider. ## Compatibility - Paper and Purpur **1.20.6–26.2**; Folia is **not supported**; Java **21** or newer - PlaceholderAPI **2.11.6+** (soft-depend) - Tested with PlaceholderAPI 2.12.3 on Paper 1.20.6-151, 1.21.1-133, 1.21.4-232, 1.21.8-60 and 26.2-129, and on Purpur 1.20.6-2233 and 26.2-2633 (Java 21 on 1.20.6–1.21.8, Java 25 on 26.2). - Paper and Purpur 26.3, Spigot and CraftBukkit are not supported. ## Download `NexusAI-1.0.1.jar`, SHA-256 `2595abd7b76634239ddf6b7651bd5d2db218ccce6dc08aec966ed1c9d1a011da` Full history: [CHANGELOG.md](https://github.com/NearestStep/NexusAI/blob/main/CHANGELOG.md)