Bugfix release: model replies no longer carry hex colours or MiniMessage tags into other plugins, a new sanitize.allow-markup option, and plain-text replies in /nai talk and /nai test. Everyone on 1.0.0 should update; one key is added to config.yml automatically and the file stays at config-version: 2.

Upgrading

• Replace NexusAI-1.0.0.jar with NexusAI-1.0.1.jar and restart. api-version stays 1.20.6. Commands, permissions and placeholders are unchanged.
• Recommended for every server on 1.0.0, especially when NexusAI placeholders are shown through TAB, DeluxeMenus, a scoreboard or a chat plugin that understands MiniMessage or &#RRGGBB.
• On startup and on /nai reload, sanitize.allow-markup: false is appended to config.yml when it is missing, with a comment above it, and the log says Added missing config keys: sanitize.allow-markup. The file is copied to config.yml.bak first (or config.yml.bak.<timestamp> when that backup already exists). config-version stays 2, and your other values and comments are kept.
• Answers already stored in pool.yml are cleaned when they are loaded. The next routine pool save writes the cleaned text back, and an answer that is empty after cleaning is dropped. No backup of pool.yml is made for this; copy the file before upgrading if you want to keep the 1.0.0 version.
• The cache key is now player-input-guard-v8, so answers cached by 1.0.0 are not reused and are requested again.

Reply markup

• Fix: in 1.0.0 a model reply lost § and the legacy & codes, but hex colours and MiniMessage tags stayed in the text. A plugin that parses that markup after PlaceholderAPI inserts the reply could then show it as coloured text, or as a click or hover action that the model chose. 1.0.1 removes that markup as well.
• Removed forms: &#RRGGBB, &#RGB, <#RRGGBB> and MiniMessage tags such as <red>, <gradient:…>, <rainbow>, <click:…>, <hover:…>, <insert:…> and <newline>, in any letter case. Only the tag is removed, so <red>Hi</red> becomes Hi. The pass repeats until nothing changes, so nested tags cannot reassemble.
• Cleaning runs before a reply reaches a placeholder, a dialogue reply, the pool or the cache, and again on every pool and cache read, so answers stored by an older jar are cleaned too. Legacy § and & codes are removed exactly as in 1.0.0.
• Text that is not a tag stays as written, for example <3, x < y, 1<2, <- back and a bare & as in rock & stone.
• A reply that is empty after cleaning, such as a reply that is only tags, is handled like a colour-only reply in 1.0.0: it is not cached, the placeholder shows a pooled answer or the fallback text, and the log and /nai status say The model reply was empty after removing colour codes. with a Retry after time.
• Fix: /nai talk and /nai test apply the colours of the chat template first and then insert the reply as plain text. The reply is never parsed as colour codes or MiniMessage there, including when sanitize.allow-markup is true.

sanitize.allow-markup

• New option, default false. With true, &#RRGGBB, <#RRGGBB> and MiniMessage tags are kept in placeholder replies, so a plugin that renders them can show colours chosen by the model. Legacy § and & codes are still removed, and /nai talk and /nai test stay plain text.
• Enable it only if you understand the risk. With true, click and hover tags in a reply also reach the plugin that shows the placeholder, and a plugin that parses MiniMessage turns them into working click and hover actions. The model writes the reply, and player text in the prompt can influence it. Keep the default unless no plugin that reads NexusAI placeholders parses MiniMessage or hex colours.
• Markup removed from pool.yml while the option was false does not come back when you switch it to true.

Known issues

• JSON text components in a reply (for example {"text":"…"}) are not removed. NexusAI does not parse them, but a plugin that parses JSON components after PlaceholderAPI inserts the reply can still act on them.
• A tag with > inside a quoted argument ends at the first >, so a few characters of that tag can remain as visible plain text.
• The player-input boundary and the reply filter reduce prompt-injection risk. They do not eliminate it. A reply that complies directly and never mentions the guard, the boundary, the request or an injection phrase from the player text still reaches the player.
• Small models such as allam-2-7b answer weakly. Do not use a small model alone: put another model later in model-queue and keep a fallback.
• Groq's free tier has a per-minute output-token quota per account, and max-tokens 256 does not remove it. Frequent long /nai talk turns, or many long placeholders, can still return HTTP 429 and pause requests to that provider.

Compatibility

• Paper and Purpur 1.20.6–26.2; Folia is not supported; Java 21 or newer
• PlaceholderAPI 2.11.6+ (soft-depend)
• Tested with PlaceholderAPI 2.12.3 on Paper 1.20.6-151, 1.21.1-133, 1.21.4-232, 1.21.8-60 and 26.2-129, and on Purpur 1.20.6-2233 and 26.2-2633 (Java 21 on 1.20.6–1.21.8, Java 25 on 26.2).
• Paper and Purpur 26.3, Spigot and CraftBukkit are not supported.

Download

NexusAI-1.0.1.jar, SHA-256 2595abd7b76634239ddf6b7651bd5d2db218ccce6dc08aec966ed1c9d1a011da

Full history: CHANGELOG.md