AtomGuard

İyileştirmeler

- `SessionManager.cleanupBlacklist()` — eşik tabanlı tembel temizlik: Periyodik temizleyici, blacklist boyutu CLEANUP_THRESHOLD (10 000) altındayken artık no-op. Önceden her tick'te tüm token'lar JWT validasyonundan geçiriliyordu (gereksiz CPU); JWT'nin kendi expire mekanizması zaten geçersiz token'ları reddettiğinden, yalnızca blacklist gerçekten büyürse tam tarama çalışır. - `AttackLevelManager` — CPS eşikleri enum çarpanlarından türetiliyor: calculateTargetLevel() artık her seviyenin CPS sınırını AttackLevel.getCpsMultiplier() üzerinden okuyor; magic number (8/5/3/2) kaldırıldı. Bir yerde tune edildiğinde eşikler senkron kalıyor.

Hata Düzeltmeleri

- `AttackLevelManager` — LOCKDOWN katmanında verified oyuncular geçebiliyor: Önceki davranış LOCKDOWN'da herkesi (verified dahil) reddediyordu; bu, slot-seviyeli filtrelemeyi yapan VerifiedPlayerShield'ı by-pass ediyor ve meşru oyuncuların saldırı sırasında tamamen dışarıda kalmasına yol açıyordu. Artık verified bağlantılar bu katmandan geçirilip Shield'a teslim ediliyor; yalnız verified-olmayan bağlantılar burada düşürülüyor. Eşlik eden test (lockdownLevel_onlyAllowsVerified) güncellendi.

Tuning

- `AttackLevel` CPS çarpanları yumuşatıldı: ELEVATED 2.0×→1.5×, HIGH 3.0×→2.0×, CRITICAL 5.0×→3.0×, LOCKDOWN 8.0×→5.0×. Saldırı seviyeleri daha erken devreye giriyor; eskisi büyük saldırılarda çok geç tepki veriyordu.

Dev Build #96 - [e3707a8](https://github.com/ATOMGAMERAGA/AtomGuard/commit/e3707a80… Merge pull request #14 from ATOMGAMERAGA/claude/modest-mccarthy-9cYZG (Atom Gamer Arda A.G.A) - [cfc7fb4](https://github.com/ATOMGAMERAGA/AtomGuard/commit/cfc7fb45… fix(WhitelistManager): tolerate corrupted whitelist.json on load (Claude) - [c6f34e5](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c6f34e5f… Merge pull request #11 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [bfd7750](https://github.com/ATOMGAMERAGA/AtomGuard/commit/bfd77509… fix(jenkins): Auto Version Bump koşulu klasik Pipeline'da da çalışsın (Claude) - [52e8d78](https://github.com/ATOMGAMERAGA/AtomGuard/commit/52e8d789… fix(jenkins): force fresh checkout — defansif workspace state reset (Claude) - [0156aff](https://github.com/ATOMGAMERAGA/AtomGuard/commit/0156affa… Merge pull request #10 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [79a6183](https://github.com/ATOMGAMERAGA/AtomGuard/commit/79a6183c… fix(jenkins): skip Modrinth publish for stale tag builds — guard against accidental old-version releases (Claude) - [d9afcfb](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d9afcfb1… Merge pull request #9 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [cb0acb4](https://github.com/ATOMGAMERAGA/AtomGuard/commit/cb0acb4e… fix(ci): rewrite Jenkins trigger to support Multibranch Pipelines + multi-method fallback (Claude) - [55b0562](https://github.com/ATOMGAMERAGA/AtomGuard/commit/55b05620… Merge pull request #8 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A)

Dev Build #96 - [e3707a8](https://github.com/ATOMGAMERAGA/AtomGuard/commit/e3707a80… Merge pull request #14 from ATOMGAMERAGA/claude/modest-mccarthy-9cYZG (Atom Gamer Arda A.G.A) - [cfc7fb4](https://github.com/ATOMGAMERAGA/AtomGuard/commit/cfc7fb45… fix(WhitelistManager): tolerate corrupted whitelist.json on load (Claude) - [c6f34e5](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c6f34e5f… Merge pull request #11 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [bfd7750](https://github.com/ATOMGAMERAGA/AtomGuard/commit/bfd77509… fix(jenkins): Auto Version Bump koşulu klasik Pipeline'da da çalışsın (Claude) - [52e8d78](https://github.com/ATOMGAMERAGA/AtomGuard/commit/52e8d789… fix(jenkins): force fresh checkout — defansif workspace state reset (Claude) - [0156aff](https://github.com/ATOMGAMERAGA/AtomGuard/commit/0156affa… Merge pull request #10 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [79a6183](https://github.com/ATOMGAMERAGA/AtomGuard/commit/79a6183c… fix(jenkins): skip Modrinth publish for stale tag builds — guard against accidental old-version releases (Claude) - [d9afcfb](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d9afcfb1… Merge pull request #9 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [cb0acb4](https://github.com/ATOMGAMERAGA/AtomGuard/commit/cb0acb4e… fix(ci): rewrite Jenkins trigger to support Multibranch Pipelines + multi-method fallback (Claude) - [55b0562](https://github.com/ATOMGAMERAGA/AtomGuard/commit/55b05620… Merge pull request #8 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A)

Dev Build #94 - [c6f34e5](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c6f34e5f… Merge pull request #11 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [bfd7750](https://github.com/ATOMGAMERAGA/AtomGuard/commit/bfd77509… fix(jenkins): Auto Version Bump koşulu klasik Pipeline'da da çalışsın (Claude) - [52e8d78](https://github.com/ATOMGAMERAGA/AtomGuard/commit/52e8d789… fix(jenkins): force fresh checkout — defansif workspace state reset (Claude) - [0156aff](https://github.com/ATOMGAMERAGA/AtomGuard/commit/0156affa… Merge pull request #10 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [79a6183](https://github.com/ATOMGAMERAGA/AtomGuard/commit/79a6183c… fix(jenkins): skip Modrinth publish for stale tag builds — guard against accidental old-version releases (Claude) - [d9afcfb](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d9afcfb1… Merge pull request #9 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [cb0acb4](https://github.com/ATOMGAMERAGA/AtomGuard/commit/cb0acb4e… fix(ci): rewrite Jenkins trigger to support Multibranch Pipelines + multi-method fallback (Claude) - [55b0562](https://github.com/ATOMGAMERAGA/AtomGuard/commit/55b05620… Merge pull request #8 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [12e1267](https://github.com/ATOMGAMERAGA/AtomGuard/commit/12e12678… Release v2.3.0 — Jenkins auto-version + ArmorStand/WindCharge kalıcı fix + persistent whitelist + metrics endpoint (Claude) - [9149faa](https://github.com/ATOMGAMERAGA/AtomGuard/commit/9149faa4… fix(actions): simplify Jenkins trigger to use notifyCommit endpoint (ATOMGAMERAGA)

Dev Build #94 - [c6f34e5](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c6f34e5f… Merge pull request #11 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [bfd7750](https://github.com/ATOMGAMERAGA/AtomGuard/commit/bfd77509… fix(jenkins): Auto Version Bump koşulu klasik Pipeline'da da çalışsın (Claude) - [52e8d78](https://github.com/ATOMGAMERAGA/AtomGuard/commit/52e8d789… fix(jenkins): force fresh checkout — defansif workspace state reset (Claude) - [0156aff](https://github.com/ATOMGAMERAGA/AtomGuard/commit/0156affa… Merge pull request #10 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [79a6183](https://github.com/ATOMGAMERAGA/AtomGuard/commit/79a6183c… fix(jenkins): skip Modrinth publish for stale tag builds — guard against accidental old-version releases (Claude) - [d9afcfb](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d9afcfb1… Merge pull request #9 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [cb0acb4](https://github.com/ATOMGAMERAGA/AtomGuard/commit/cb0acb4e… fix(ci): rewrite Jenkins trigger to support Multibranch Pipelines + multi-method fallback (Claude) - [55b0562](https://github.com/ATOMGAMERAGA/AtomGuard/commit/55b05620… Merge pull request #8 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [12e1267](https://github.com/ATOMGAMERAGA/AtomGuard/commit/12e12678… Release v2.3.0 — Jenkins auto-version + ArmorStand/WindCharge kalıcı fix + persistent whitelist + metrics endpoint (Claude) - [9149faa](https://github.com/ATOMGAMERAGA/AtomGuard/commit/9149faa4… fix(actions): simplify Jenkins trigger to use notifyCommit endpoint (ATOMGAMERAGA)

Critical Bug Fixes — Eski "fix'lendi ama çalışmıyor" sorunları için kalıcı çözüm

- `TokenBucketModule` — `atomguard.bypass` permission'ını dinlemiyordu: Tüm diğer modüller isExempt(player) ile OP/staff'ı muaf tutarken, token bucket modülü bu kontrolü atlıyordu. ETKILESIM bucket'ında PLAYER_BLOCK_PLACEMENT + USE_ITEM + ANIMATION + INTERACT_ENTITY paketleri vardı (kapasite 300, refill 120/s); ANIMATION her el sallamada gönderildiği için kovayı hızla tüketiyor ve yerleştirme paketleri sessizce düşürülüyordu. Bu davranış armor stand placement'ın bazı oyuncularda yerleşmemesinin ve yerleşenlerde hep aynı yöne bakmasının asıl sebebiydi (sunucu, drop edilen ilk USE_ITEM paketinden sonraki bir paketten spawn ediyor → yaw farklı oluyor). Düzeltme: isExempt(player) kontrolü eklendi, ANIMATION paketi DIGER bucket'ına taşındı, ETKILESIM bucket default'ları 500/200'e yükseltildi, ve drop edilen paketler artık DEBUG log'a yazılıyor. - `ItemSanitizerModule` — ARMOR_STAND / ITEM_FRAME / PAINTING için explicit muafiyet: onPlayerInteract handler'ı bypass'sız oyunculara her etkileşimde sanitize çalıştırıyordu; bu materialler false-positive riskli olduğu için (özellikle yeni 1.21 data component'leriyle) artık explicit muaf. Tüm hasPermission("atomguard.bypass") çağrıları yeni isExempt(player) helper'ı ile değiştirildi. - `WindChargeIntegrityModule` (YENİ) — Vanilla wind charge knockback garantisi: v2.2.5/v2.2.6/v2.2.9 yamalarına rağmen wind charge oyuncuları zıplatmıyordu (redstone aktive ediyor ama bounce yok). Bu yeni modül, son güvenlik ağı olarak: - Wind charge kaynaklı EntityDamageByEntityEvent / EntityExplodeEvent iptal edilmişse HIGHEST priority'de geri alır (başka plugin LOWEST'te iptal etmiş olsa bile) - ProjectileHitEvent'te 1 tick sonra etki yarıçapındaki canlı varlıklara manuel velocity uygular (vanilla zaten ittiyse skip — çift etki yok) - Tüm event'leri DEBUG'a loglar (detailed-log: true) — başka bir handler iptal ediyorsa kanıt için - Config: moduller.wind-charge-integrity.aktif: true, radius, velocity-magnitude, min-upward-velocity, fallback-enabled

Yeni Özellikler

- `/atomguard whitelist <add|remove|list>` komutu + `WhitelistManager`: Bukkit'in atomguard.bypass permission'ından ayrı, kalıcı, isim-bazlı muafiyet listesi. JSON persistence (plugins/AtomGuard/whitelist.json). Tüm modüller AbstractModule.isExempt(player) üzerinden hem permission hem de whitelist'i kontrol eder. - Bağımsız `/metrics` HTTP endpoint'i: Web Panel'in JWT-protected /api/metrics'inden farklı olarak, Bearer-token korumalı, JWT gerektirmeyen Prometheus/Grafana entegrasyon noktası. JSON (default) ve Prometheus exposition (?format=prom) formatı destekler. Config: web-panel.metrics-token (boş ise endpoint 401 döner). - Discord webhook structured embeds: notifyBotAction ve diğer notify metotları artık embed fields array'i kullanıyor (oyuncu, IP, sebep ayrı alanlarda). Tüm embed'lere timestamp (ISO 8601) ve footer.text (AtomGuard • <server-name>) eklendi. Config: discord-webhook.server-name. - `AbstractModule.isExempt(Player)` helper'ı: Tüm modüllerin bypass kontrolü için merkezî giriş noktası. Permission + whitelist'i birlikte kontrol eder. Gelecekte ek mekanizmalar (trust score üst sınırı, IP whitelist, vs.) burada eklenecek.

İyileştirmeler & Race / Memory Fix'leri

- `AttackModeManager.blockedDuringAttack` race condition (Critical): volatile long ++ non-atomic; async packet handler'larda lost-update race oluyordu. AtomicLong incrementAndGet() ile değiştirildi. - `AtomGuardAPI.instance` volatile: onLoad/onEnable race'inde yarım-init görme riskine karşı volatile eklendi. - `SmartLagModule.unfreezeAll()` artık tüm chunk'ları taramıyor: Eski kod yüklü TÜM chunk'ları döndüğü için 10k+ chunk'lı sunucularda main thread stall yapıyordu (lag önleyici feature lag üretiyor). Şimdi sadece frozenChunks set'ini iter ediyor. - `AntiBotModule` async task disable'da iptal ediliyor: 5 saniyelik attack-evaluation task'ı runTaskTimerAsynchronously ile yaratılıp ID tutulmuyordu. Şimdi evaluationTaskId field'da tutuluyor ve onDisable()'da iptal ediliyor. - `ConnectionRateCheck` thread-safe deque erişimi: addLast() + size() ayrı çağrılardı; başka thread eski entry'leri purge ederken size yanlış gelebilirdi. synchronized(deque) blok ile atomik snapshot. - Velocity `ConnectionAnalyzer` CLAUDE.md uyum hatası: Kod Math.max(10, suspiciousThreshold) kullanıyordu ama doküman "Minimum enforced at 8" diyordu. → 8'e düşürüldü (küçük sunucularda 8 daha gerçekçi). - Config.yml — eksik bölümler eklendi: moduller.item-sanitizer.* (5 anahtar), moduller.redstone-limiter.* (2 anahtar), moduller.wind-charge-integrity.* (5 anahtar), heuristic.escik-supheli / escik-yuksek / decay-saniye / rotation-tolerance-derece, web-panel.metrics-token, discord-webhook.server-name.

CI/CD

- Jenkinsfile — Auto Version Bump stage eklendi: Pipeline artık main/master branch'inde, commit zaten tag'lenmemişse, conventional commit mesajından bump türünü tespit ediyor ve otomatik olarak bump-version.sh <type> --tag --push --ci çağırıyor. Recursion guard (🔖 Release v ile başlayan commit'leri skip), explicit skip ([skip release] / [skip ci]), explicit override ([release:patch|minor|major]) destekleniyor. Push edilen yeni tag webhook ile taze build başlatıyor ve Stable Release stage'i otomatik çalışıyor. - `bump-version.sh` — `--ci` flag eklendi: CI'da interaktif olmayan modda çalışması için GIT_AUTHOR_NAME / GIT_AUTHOR_EMAIL env'den okunuyor.

Critical Bug Fixes — Eski "fix'lendi ama çalışmıyor" sorunları için kalıcı çözüm

- `TokenBucketModule` — `atomguard.bypass` permission'ını dinlemiyordu: Tüm diğer modüller isExempt(player) ile OP/staff'ı muaf tutarken, token bucket modülü bu kontrolü atlıyordu. ETKILESIM bucket'ında PLAYER_BLOCK_PLACEMENT + USE_ITEM + ANIMATION + INTERACT_ENTITY paketleri vardı (kapasite 300, refill 120/s); ANIMATION her el sallamada gönderildiği için kovayı hızla tüketiyor ve yerleştirme paketleri sessizce düşürülüyordu. Bu davranış armor stand placement'ın bazı oyuncularda yerleşmemesinin ve yerleşenlerde hep aynı yöne bakmasının asıl sebebiydi (sunucu, drop edilen ilk USE_ITEM paketinden sonraki bir paketten spawn ediyor → yaw farklı oluyor). Düzeltme: isExempt(player) kontrolü eklendi, ANIMATION paketi DIGER bucket'ına taşındı, ETKILESIM bucket default'ları 500/200'e yükseltildi, ve drop edilen paketler artık DEBUG log'a yazılıyor. - `ItemSanitizerModule` — ARMOR_STAND / ITEM_FRAME / PAINTING için explicit muafiyet: onPlayerInteract handler'ı bypass'sız oyunculara her etkileşimde sanitize çalıştırıyordu; bu materialler false-positive riskli olduğu için (özellikle yeni 1.21 data component'leriyle) artık explicit muaf. Tüm hasPermission("atomguard.bypass") çağrıları yeni isExempt(player) helper'ı ile değiştirildi. - `WindChargeIntegrityModule` (YENİ) — Vanilla wind charge knockback garantisi: v2.2.5/v2.2.6/v2.2.9 yamalarına rağmen wind charge oyuncuları zıplatmıyordu (redstone aktive ediyor ama bounce yok). Bu yeni modül, son güvenlik ağı olarak: - Wind charge kaynaklı EntityDamageByEntityEvent / EntityExplodeEvent iptal edilmişse HIGHEST priority'de geri alır (başka plugin LOWEST'te iptal etmiş olsa bile) - ProjectileHitEvent'te 1 tick sonra etki yarıçapındaki canlı varlıklara manuel velocity uygular (vanilla zaten ittiyse skip — çift etki yok) - Tüm event'leri DEBUG'a loglar (detailed-log: true) — başka bir handler iptal ediyorsa kanıt için - Config: moduller.wind-charge-integrity.aktif: true, radius, velocity-magnitude, min-upward-velocity, fallback-enabled

Yeni Özellikler

- `/atomguard whitelist <add|remove|list>` komutu + `WhitelistManager`: Bukkit'in atomguard.bypass permission'ından ayrı, kalıcı, isim-bazlı muafiyet listesi. JSON persistence (plugins/AtomGuard/whitelist.json). Tüm modüller AbstractModule.isExempt(player) üzerinden hem permission hem de whitelist'i kontrol eder. - Bağımsız `/metrics` HTTP endpoint'i: Web Panel'in JWT-protected /api/metrics'inden farklı olarak, Bearer-token korumalı, JWT gerektirmeyen Prometheus/Grafana entegrasyon noktası. JSON (default) ve Prometheus exposition (?format=prom) formatı destekler. Config: web-panel.metrics-token (boş ise endpoint 401 döner). - Discord webhook structured embeds: notifyBotAction ve diğer notify metotları artık embed fields array'i kullanıyor (oyuncu, IP, sebep ayrı alanlarda). Tüm embed'lere timestamp (ISO 8601) ve footer.text (AtomGuard • <server-name>) eklendi. Config: discord-webhook.server-name. - `AbstractModule.isExempt(Player)` helper'ı: Tüm modüllerin bypass kontrolü için merkezî giriş noktası. Permission + whitelist'i birlikte kontrol eder. Gelecekte ek mekanizmalar (trust score üst sınırı, IP whitelist, vs.) burada eklenecek.

İyileştirmeler & Race / Memory Fix'leri

- `AttackModeManager.blockedDuringAttack` race condition (Critical): volatile long ++ non-atomic; async packet handler'larda lost-update race oluyordu. AtomicLong incrementAndGet() ile değiştirildi. - `AtomGuardAPI.instance` volatile: onLoad/onEnable race'inde yarım-init görme riskine karşı volatile eklendi. - `SmartLagModule.unfreezeAll()` artık tüm chunk'ları taramıyor: Eski kod yüklü TÜM chunk'ları döndüğü için 10k+ chunk'lı sunucularda main thread stall yapıyordu (lag önleyici feature lag üretiyor). Şimdi sadece frozenChunks set'ini iter ediyor. - `AntiBotModule` async task disable'da iptal ediliyor: 5 saniyelik attack-evaluation task'ı runTaskTimerAsynchronously ile yaratılıp ID tutulmuyordu. Şimdi evaluationTaskId field'da tutuluyor ve onDisable()'da iptal ediliyor. - `ConnectionRateCheck` thread-safe deque erişimi: addLast() + size() ayrı çağrılardı; başka thread eski entry'leri purge ederken size yanlış gelebilirdi. synchronized(deque) blok ile atomik snapshot. - Velocity `ConnectionAnalyzer` CLAUDE.md uyum hatası: Kod Math.max(10, suspiciousThreshold) kullanıyordu ama doküman "Minimum enforced at 8" diyordu. → 8'e düşürüldü (küçük sunucularda 8 daha gerçekçi). - Config.yml — eksik bölümler eklendi: moduller.item-sanitizer.* (5 anahtar), moduller.redstone-limiter.* (2 anahtar), moduller.wind-charge-integrity.* (5 anahtar), heuristic.escik-supheli / escik-yuksek / decay-saniye / rotation-tolerance-derece, web-panel.metrics-token, discord-webhook.server-name.

CI/CD

- Jenkinsfile — Auto Version Bump stage eklendi: Pipeline artık main/master branch'inde, commit zaten tag'lenmemişse, conventional commit mesajından bump türünü tespit ediyor ve otomatik olarak bump-version.sh <type> --tag --push --ci çağırıyor. Recursion guard (🔖 Release v ile başlayan commit'leri skip), explicit skip ([skip release] / [skip ci]), explicit override ([release:patch|minor|major]) destekleniyor. Push edilen yeni tag webhook ile taze build başlatıyor ve Stable Release stage'i otomatik çalışıyor. - `bump-version.sh` — `--ci` flag eklendi: CI'da interaktif olmayan modda çalışması için GIT_AUTHOR_NAME / GIT_AUTHOR_EMAIL env'den okunuyor.

Dev Build #91 - [0156aff](https://github.com/ATOMGAMERAGA/AtomGuard/commit/0156affa… Merge pull request #10 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [79a6183](https://github.com/ATOMGAMERAGA/AtomGuard/commit/79a6183c… fix(jenkins): skip Modrinth publish for stale tag builds — guard against accidental old-version releases (Claude) - [d9afcfb](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d9afcfb1… Merge pull request #9 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [cb0acb4](https://github.com/ATOMGAMERAGA/AtomGuard/commit/cb0acb4e… fix(ci): rewrite Jenkins trigger to support Multibranch Pipelines + multi-method fallback (Claude) - [55b0562](https://github.com/ATOMGAMERAGA/AtomGuard/commit/55b05620… Merge pull request #8 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [12e1267](https://github.com/ATOMGAMERAGA/AtomGuard/commit/12e12678… Release v2.3.0 — Jenkins auto-version + ArmorStand/WindCharge kalıcı fix + persistent whitelist + metrics endpoint (Claude) - [9149faa](https://github.com/ATOMGAMERAGA/AtomGuard/commit/9149faa4… fix(actions): simplify Jenkins trigger to use notifyCommit endpoint (ATOMGAMERAGA) - [979c18b](https://github.com/ATOMGAMERAGA/AtomGuard/commit/979c18b1… trigger-jenkins.yml: handle CSRF crumb to fix HTTP 403 (ATOMGAMERAGA) - [e86d341](https://github.com/ATOMGAMERAGA/AtomGuard/commit/e86d341c… Document trigger-jenkins.yml workflow under v2.2.9 changelog (ATOMGAMERAGA) - [8d32535](https://github.com/ATOMGAMERAGA/AtomGuard/commit/8d325356… Add GitHub Actions workflow to trigger Jenkins directly (ATOMGAMERAGA)

Bug Fixes

- `FrameCrashModule` — Armor stand counter overflow causing permanent placement block: When blocking a spawn, count.incrementAndGet() was called but never rolled back, permanently inflating the per-chunk counter so all future placements in that chunk were rejected indefinitely. Fixed by calling count.decrementAndGet() immediately before cancelling the event. Same fix applied to the item-frame path. - `FrameCrashModule` — Stale `armorStandCounts` persisting across chunk reloads: clearChunk(), clearAll(), and cleanup() only operated on frameCounts and completely ignored armorStandCounts. On chunk unload/reload the stale counter was reused instead of being recalculated from real entity counts, causing all new armor stand spawns to be blocked. All three methods now also remove/clean entries from armorStandCounts. - `ExplosionLimiterModule` — Wind Charge projectile not pushing players: EntityType.WIND_CHARGE and EntityType.BREEZE_WIND_CHARGE were counted against the 10-explosion-per-second rate limit. When other explosions (TNT, creepers, beds) consumed the budget, wind charge EntityExplodeEvent was cancelled, preventing its velocity/knockback effect. Both entity types are now exempt from the rate limit alongside END_CRYSTAL. - `InvalidSlotModule` — Trial Chamber vault interaction blocked by too-strict slot cap: MAX_SLOT was set to 90 (double chest + player inventory), which is insufficient for vault inventories in Trial Chambers. Any CLICK_WINDOW packet with a slot ID above 90 was cancelled and the inventory force-closed, preventing the vault from being opened with the trial key. MAX_SLOT raised to 128 to cover all vanilla container types. - `SmartLagModule` — Trial Chamber vault state machine blocked during lag freeze: During a lag-freeze cycle, onPhysics() cancelled all BlockPhysicsEvent in frozen chunks except WATER and LAVA. The VAULT block uses block-physics events to advance its state machine (INACTIVE → ACTIVE → UNLOCKING → DEACTIVATED), so physics cancellation prevented the vault from opening. VAULT is now added to the physics exemption list alongside WATER and LAVA.

Bug Fixes

- `FrameCrashModule` — Armor stand counter overflow causing permanent placement block: When blocking a spawn, count.incrementAndGet() was called but never rolled back, permanently inflating the per-chunk counter so all future placements in that chunk were rejected indefinitely. Fixed by calling count.decrementAndGet() immediately before cancelling the event. Same fix applied to the item-frame path. - `FrameCrashModule` — Stale `armorStandCounts` persisting across chunk reloads: clearChunk(), clearAll(), and cleanup() only operated on frameCounts and completely ignored armorStandCounts. On chunk unload/reload the stale counter was reused instead of being recalculated from real entity counts, causing all new armor stand spawns to be blocked. All three methods now also remove/clean entries from armorStandCounts. - `ExplosionLimiterModule` — Wind Charge projectile not pushing players: EntityType.WIND_CHARGE and EntityType.BREEZE_WIND_CHARGE were counted against the 10-explosion-per-second rate limit. When other explosions (TNT, creepers, beds) consumed the budget, wind charge EntityExplodeEvent was cancelled, preventing its velocity/knockback effect. Both entity types are now exempt from the rate limit alongside END_CRYSTAL. - `InvalidSlotModule` — Trial Chamber vault interaction blocked by too-strict slot cap: MAX_SLOT was set to 90 (double chest + player inventory), which is insufficient for vault inventories in Trial Chambers. Any CLICK_WINDOW packet with a slot ID above 90 was cancelled and the inventory force-closed, preventing the vault from being opened with the trial key. MAX_SLOT raised to 128 to cover all vanilla container types. - `SmartLagModule` — Trial Chamber vault state machine blocked during lag freeze: During a lag-freeze cycle, onPhysics() cancelled all BlockPhysicsEvent in frozen chunks except WATER and LAVA. The VAULT block uses block-physics events to advance its state machine (INACTIVE → ACTIVE → UNLOCKING → DEACTIVATED), so physics cancellation prevented the vault from opening. VAULT is now added to the physics exemption list alongside WATER and LAVA.

Dev Build #76 - [e74c95d](https://github.com/ATOMGAMERAGA/AtomGuard/commit/e74c95da… Release v2.2.4 — Dispenser/Dropper Shulker & Armor + Armor Stand Freeze Fix (ATOMGAMERAGA) - [306c3dc](https://github.com/ATOMGAMERAGA/AtomGuard/commit/306c3dca… Release v2.2.3 — Dispenser/Dropper False Positive Fix (ATOMGAMERAGA) - [c546980](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c5469807… Release v2.2.2 — VPN/Proxy Detection Overhaul & IP+Username Pair Verification (ATOMGAMERAGA) - [51a3c5d](https://github.com/ATOMGAMERAGA/AtomGuard/commit/51a3c5dd… Release v2.2.1 — False Positive & Thread Safety Overhaul (ATOMGAMERAGA) - [83d59c8](https://github.com/ATOMGAMERAGA/AtomGuard/commit/83d59c8c… Fix GitHub release ID parsing & re-tag v2.2.0 as stable (ATOMGAMERAGA) - [2638acb](https://github.com/ATOMGAMERAGA/AtomGuard/commit/2638acb7… Fix Jenkinsfile Groovy syntax error on line 161 (ATOMGAMERAGA) - [fb1e5c0](https://github.com/ATOMGAMERAGA/AtomGuard/commit/fb1e5c04… Release v2.2.0 — Velocity False Positive & Error Elimination (ATOMGAMERAGA) - [0d5f294](https://github.com/ATOMGAMERAGA/AtomGuard/commit/0d5f294f… Release v2.1.4 — Heuristic False Positive Kick Fix (ATOMGAMERAGA) - [97ea350](https://github.com/ATOMGAMERAGA/AtomGuard/commit/97ea350e… Release v2.1.3 — Hit Registration & Timeout Fix (ATOMGAMERAGA) - [7e7c9df](https://github.com/ATOMGAMERAGA/AtomGuard/commit/7e7c9df4… Update CHANGELOG for v2.1.2 — Block Breaking Kick Fix (ATOMGAMERAGA)

Dev Build #76 - [e74c95d](https://github.com/ATOMGAMERAGA/AtomGuard/commit/e74c95da… Release v2.2.4 — Dispenser/Dropper Shulker & Armor + Armor Stand Freeze Fix (ATOMGAMERAGA) - [306c3dc](https://github.com/ATOMGAMERAGA/AtomGuard/commit/306c3dca… Release v2.2.3 — Dispenser/Dropper False Positive Fix (ATOMGAMERAGA) - [c546980](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c5469807… Release v2.2.2 — VPN/Proxy Detection Overhaul & IP+Username Pair Verification (ATOMGAMERAGA) - [51a3c5d](https://github.com/ATOMGAMERAGA/AtomGuard/commit/51a3c5dd… Release v2.2.1 — False Positive & Thread Safety Overhaul (ATOMGAMERAGA) - [83d59c8](https://github.com/ATOMGAMERAGA/AtomGuard/commit/83d59c8c… Fix GitHub release ID parsing & re-tag v2.2.0 as stable (ATOMGAMERAGA) - [2638acb](https://github.com/ATOMGAMERAGA/AtomGuard/commit/2638acb7… Fix Jenkinsfile Groovy syntax error on line 161 (ATOMGAMERAGA) - [fb1e5c0](https://github.com/ATOMGAMERAGA/AtomGuard/commit/fb1e5c04… Release v2.2.0 — Velocity False Positive & Error Elimination (ATOMGAMERAGA) - [0d5f294](https://github.com/ATOMGAMERAGA/AtomGuard/commit/0d5f294f… Release v2.1.4 — Heuristic False Positive Kick Fix (ATOMGAMERAGA) - [97ea350](https://github.com/ATOMGAMERAGA/AtomGuard/commit/97ea350e… Release v2.1.3 — Hit Registration & Timeout Fix (ATOMGAMERAGA) - [7e7c9df](https://github.com/ATOMGAMERAGA/AtomGuard/commit/7e7c9df4… Update CHANGELOG for v2.1.2 — Block Breaking Kick Fix (ATOMGAMERAGA)

Bug Fixes

- `SmartLagModule` — Dispenser/dropper false positive fix: During a lag spike (tick delta > 80 ms), the module froze heavy chunks by cancelling all BlockRedstoneEvent, BlockPhysicsEvent, and EntitySpawnEvent in those chunks. This inadvertently broke dispensers and droppers: redstone signals to dispenser/dropper blocks were zeroed (so they never fired), placed water/lava did not flow (physics cancelled), and item/projectile entities spawned by droppers and dispensers were suppressed. Three targeted exemptions added: - onRedstone: Dispenser and dropper blocks are now skipped — their redstone signals are never blocked by the freeze. - onPhysics: WATER and LAVA blocks are now exempt — fluid physics proceed normally even in a frozen chunk. - onSpawn: Item and Projectile entities are now exempt — items dropped by droppers and projectiles shot by dispensers are no longer cancelled.

Bug Fixes

- `SmartLagModule` — Dispenser/dropper false positive fix: During a lag spike (tick delta > 80 ms), the module froze heavy chunks by cancelling all BlockRedstoneEvent, BlockPhysicsEvent, and EntitySpawnEvent in those chunks. This inadvertently broke dispensers and droppers: redstone signals to dispenser/dropper blocks were zeroed (so they never fired), placed water/lava did not flow (physics cancelled), and item/projectile entities spawned by droppers and dispensers were suppressed. Three targeted exemptions added: - onRedstone: Dispenser and dropper blocks are now skipped — their redstone signals are never blocked by the freeze. - onPhysics: WATER and LAVA blocks are now exempt — fluid physics proceed normally even in a frozen chunk. - onSpawn: Item and Projectile entities are now exempt — items dropped by droppers and projectiles shot by dispensers are no longer cancelled.

New Features

- Velocity — 10-layer VPN/Proxy detection system (`VPNProviderChain` v2): Replaced the previous multi-provider API chain with a 10-layer consensus engine: local IP list → CIDR blocker → IP2Proxy database → DNSBL (9 lists) → ASN analysis → Reverse DNS hostname patterns → Port scanning → proxycheck.io → iphub.info → AbuseIPDB / ip-api. Each layer casts a weighted vote; a configurable consensus threshold decides the final verdict. - Velocity — `ReverseDNSDetector`: New detection engine that resolves the connecting IP's hostname and matches it against 100+ known VPN/hosting/proxy provider patterns (NordVPN, ExpressVPN, Vultr, Hetzner, Tor exit nodes, etc.). Includes a residential ISP whitelist (Comcast, Telekom, Turkcell, etc.) to prevent false positives. Detection types: vpn, hosting, proxy, tor. - Velocity — `PortScanDetector`: New engine that probes 14 known proxy ports (SOCKS4/5: 1080/1081, Tor: 9050/9150, Squid/HTTP-Proxy: 3128/8080/8118, OpenVPN: 1194, PPTP: 1723, IKEv2: 500, SSH: 22) on the connecting IP using non-blocking SocketChannel with 800 ms connect timeout. Runs entirely on a virtual thread pool. SSH alone is never flagged; ports 443 and 8080 require at least one additional significant port to count. Requires ≥ 2 meaningful open proxy ports for suspicious=true. - Velocity — `ASNDetector`: New ASN-based engine with an embedded database of 60+ known VPN ASNs (NordVPN, ExpressVPN, Mullvad, ProtonVPN, PIA…), 35+ hosting ASNs (AWS, GCP, Azure, DigitalOcean, Hetzner, Vultr…), and 8 residential-proxy network ASNs (Bright Data, Oxylabs, SmartProxy…). Queries ip-api.com with a 10-minute local cache. Classification: vpn (confidence 95), proxy (90), hosting (70), residential (pass). - Velocity — `DNSBLChecker` v2: Expanded from 3 to 9 DNSBL lists (dronebl.org, spamhaus xbl/zen, sorbs, socks.sorbs, http.sorbs, s5h.net, efnetrbl.org, beetjevansen.nl). All lists are queried in parallel with a 3-second total timeout. Introduces DNSBLResult with listedIn() and listCount() for per-list visibility. - Velocity — IP + Username pair verification (`VerifiedPlayerStore` v2): The verified-player store now tracks (ip, username) pairs instead of IP-only. Consequences: same IP + same username → bypass; same username + different IP → re-verification required; different username + same IP → re-verification required. Backed by a new ag_verified_players table with verify_count and last_login columns. Automatic migration from the old ag_limbo_verified table. File backup (verified-players.txt) maintained alongside the database. - Velocity — Kick-After-Verify flow (`VerificationLimbo` v2): After passing the Limbo physics challenge the player is now kicked with a styled success message ("Your IP and username have been verified — please reconnect") instead of being silently transferred to the main server. Configurable via kick-after-verify: true. The kick message includes the masked IP (1.2.*.**) and username. Failure kick and timeout kick messages are also redesigned with coloured borders. - Velocity — `VPNCheck` v2: Timeout extended from 2 s to 6 s to accommodate the multi-layer chain. New fail-closed-on-timeout config option: when true and attack mode is active, a timeout result becomes a deny instead of a pass. VPN detections now use hardDeny (was deny) so the trust-score penalty is proportionally larger. Audit log entries now include the detection method, confidence score, and all reporting providers.

Improvements

- Velocity — Consensus algorithm with 7 decision rules: Tor detection → unconditional block (confidence ≥ 98). ≥ 3 strong non-hosting votes → unconditional block. ≥ 2 strong votes + confidence ≥ threshold → block. Single strong vote + individual confidence ≥ 90 + weighted confidence ≥ 70 → block. Hosting-only flags → always pass (false-positive protection). General consensus threshold → block. Insufficient consensus → pass. - Velocity — `VPNProviderChain`: private-IP check extended: Now covers 172.16.x–172.31.x (full RFC-1918 /12 range), ::1, fc00::/7, fe80::, and 0.0.0.0, preventing unnecessary lookups for link-local and ULA addresses. - Velocity — `VPNDetectionModule`: verified-clean cache enlarged to 20 000: Previously 10 000. Also added a 15-minute cleanup scheduler and an hourly statistics log (total checks, blocked, cache hits, verified-clean size). - Velocity — `VPNResultCache` capacity raised to 50 000: Configured via vpn-proxy-block.cache-max-size (default 50 000). TTL remains 1 hour, configurable via vpn-proxy-block.cache-ttl-ms. - Velocity — `VerifiedBypassCheck` v2: When require-ip-username-pair: true the bypass is granted only if both the IP and the username match a verified pair. Switching to a different username from the same IP forces a new Limbo session. - Velocity — `VerificationModule`: new API methods: isVerifiedPair(ip, username), isIPChanged(ip, username), hasEverBeenVerified(username), isKickAfterVerify(), isRequireIPUsernamePair(). - Velocity — `ConnectionListener` v2: Pre-login verified flag now uses isVerifiedPair() when require-ip-username-pair is enabled. Login handler logs IP-change events ("IP change detected: &lt;user&gt; new IP: &lt;ip&gt; — re-verification") before routing to Limbo. Login handler logs verified logins explicitly. - Velocity — `PortScanDetector`: virtual thread pool: Uses Executors.newVirtualThreadPerTaskExecutor() — no thread-pool sizing needed, OS-level scheduling, ideal for high-volume I/O-bound port probing. - Velocity — `ASNDetector`: org/ISP name keyword fallback: If the ASN number is not in the embedded database, the org and ISP strings returned by ip-api are scanned for keywords (vpn, nordvpn, mullvad, proxy, luminati, bright data, hosting, datacenter, vps, etc.) to catch new or unlisted providers.

New Features

- Velocity — 10-layer VPN/Proxy detection system (`VPNProviderChain` v2): Replaced the previous multi-provider API chain with a 10-layer consensus engine: local IP list → CIDR blocker → IP2Proxy database → DNSBL (9 lists) → ASN analysis → Reverse DNS hostname patterns → Port scanning → proxycheck.io → iphub.info → AbuseIPDB / ip-api. Each layer casts a weighted vote; a configurable consensus threshold decides the final verdict. - Velocity — `ReverseDNSDetector`: New detection engine that resolves the connecting IP's hostname and matches it against 100+ known VPN/hosting/proxy provider patterns (NordVPN, ExpressVPN, Vultr, Hetzner, Tor exit nodes, etc.). Includes a residential ISP whitelist (Comcast, Telekom, Turkcell, etc.) to prevent false positives. Detection types: vpn, hosting, proxy, tor. - Velocity — `PortScanDetector`: New engine that probes 14 known proxy ports (SOCKS4/5: 1080/1081, Tor: 9050/9150, Squid/HTTP-Proxy: 3128/8080/8118, OpenVPN: 1194, PPTP: 1723, IKEv2: 500, SSH: 22) on the connecting IP using non-blocking SocketChannel with 800 ms connect timeout. Runs entirely on a virtual thread pool. SSH alone is never flagged; ports 443 and 8080 require at least one additional significant port to count. Requires ≥ 2 meaningful open proxy ports for suspicious=true. - Velocity — `ASNDetector`: New ASN-based engine with an embedded database of 60+ known VPN ASNs (NordVPN, ExpressVPN, Mullvad, ProtonVPN, PIA…), 35+ hosting ASNs (AWS, GCP, Azure, DigitalOcean, Hetzner, Vultr…), and 8 residential-proxy network ASNs (Bright Data, Oxylabs, SmartProxy…). Queries ip-api.com with a 10-minute local cache. Classification: vpn (confidence 95), proxy (90), hosting (70), residential (pass). - Velocity — `DNSBLChecker` v2: Expanded from 3 to 9 DNSBL lists (dronebl.org, spamhaus xbl/zen, sorbs, socks.sorbs, http.sorbs, s5h.net, efnetrbl.org, beetjevansen.nl). All lists are queried in parallel with a 3-second total timeout. Introduces DNSBLResult with listedIn() and listCount() for per-list visibility. - Velocity — IP + Username pair verification (`VerifiedPlayerStore` v2): The verified-player store now tracks (ip, username) pairs instead of IP-only. Consequences: same IP + same username → bypass; same username + different IP → re-verification required; different username + same IP → re-verification required. Backed by a new ag_verified_players table with verify_count and last_login columns. Automatic migration from the old ag_limbo_verified table. File backup (verified-players.txt) maintained alongside the database. - Velocity — Kick-After-Verify flow (`VerificationLimbo` v2): After passing the Limbo physics challenge the player is now kicked with a styled success message ("Your IP and username have been verified — please reconnect") instead of being silently transferred to the main server. Configurable via kick-after-verify: true. The kick message includes the masked IP (1.2.*.**) and username. Failure kick and timeout kick messages are also redesigned with coloured borders. - Velocity — `VPNCheck` v2: Timeout extended from 2 s to 6 s to accommodate the multi-layer chain. New fail-closed-on-timeout config option: when true and attack mode is active, a timeout result becomes a deny instead of a pass. VPN detections now use hardDeny (was deny) so the trust-score penalty is proportionally larger. Audit log entries now include the detection method, confidence score, and all reporting providers.

Improvements

- Velocity — Consensus algorithm with 7 decision rules: Tor detection → unconditional block (confidence ≥ 98). ≥ 3 strong non-hosting votes → unconditional block. ≥ 2 strong votes + confidence ≥ threshold → block. Single strong vote + individual confidence ≥ 90 + weighted confidence ≥ 70 → block. Hosting-only flags → always pass (false-positive protection). General consensus threshold → block. Insufficient consensus → pass. - Velocity — `VPNProviderChain`: private-IP check extended: Now covers 172.16.x–172.31.x (full RFC-1918 /12 range), ::1, fc00::/7, fe80::, and 0.0.0.0, preventing unnecessary lookups for link-local and ULA addresses. - Velocity — `VPNDetectionModule`: verified-clean cache enlarged to 20 000: Previously 10 000. Also added a 15-minute cleanup scheduler and an hourly statistics log (total checks, blocked, cache hits, verified-clean size). - Velocity — `VPNResultCache` capacity raised to 50 000: Configured via vpn-proxy-block.cache-max-size (default 50 000). TTL remains 1 hour, configurable via vpn-proxy-block.cache-ttl-ms. - Velocity — `VerifiedBypassCheck` v2: When require-ip-username-pair: true the bypass is granted only if both the IP and the username match a verified pair. Switching to a different username from the same IP forces a new Limbo session. - Velocity — `VerificationModule`: new API methods: isVerifiedPair(ip, username), isIPChanged(ip, username), hasEverBeenVerified(username), isKickAfterVerify(), isRequireIPUsernamePair(). - Velocity — `ConnectionListener` v2: Pre-login verified flag now uses isVerifiedPair() when require-ip-username-pair is enabled. Login handler logs IP-change events ("IP change detected: &lt;user&gt; new IP: &lt;ip&gt; — re-verification") before routing to Limbo. Login handler logs verified logins explicitly. - Velocity — `PortScanDetector`: virtual thread pool: Uses Executors.newVirtualThreadPerTaskExecutor() — no thread-pool sizing needed, OS-level scheduling, ideal for high-volume I/O-bound port probing. - Velocity — `ASNDetector`: org/ISP name keyword fallback: If the ASN number is not in the embedded database, the org and ISP strings returned by ip-api are scanned for keywords (vpn, nordvpn, mullvad, proxy, luminati, bright data, hosting, datacenter, vps, etc.) to catch new or unlisted providers.

Improvements

- Velocity — `PlayerBehaviorProfile`: `usedUsernames` set is now thread-safe: The field was backed by a plain HashSet. recordSession() can be called from multiple Netty I/O threads simultaneously (each pre-login event arrives on a different thread), creating a risk of ConcurrentModificationException or silent data corruption. Replaced with ConcurrentHashMap.newKeySet(), which provides the same Set contract with full thread safety at zero contention cost. - Velocity — `PlayerBehaviorProfile.calculateTrustScore()`: new-player first-login bonus: Brand-new players (no sessions, no logins, no violations) start with score 50. If trust-score-threshold is ever misconfigured above 50, every new player is denied before they can build any history. Added a +5 bonus applied only to completely fresh profiles, raising the guaranteed floor to 55 and providing a safe buffer against accidental misconfiguration. - Velocity — `BehaviorManager.getProfile()`: `offlineModeLenient` set at profile creation time: Previously the flag was set only inside recordLogin(), which is called after TrustScoreCheck already ran. A fresh profile therefore always had offlineModeLenient = false, making the multi-account username penalty fire on offline-mode servers even when it should have been suppressed. Now the config is read once at profile instantiation so the flag is correct before any pipeline check consults the score. - Velocity — `ThreatScore` setters are now `synchronized`: resetForNewAnalysis() and calculate() were already synchronized, but individual setters (e.g. setConnectionRateScore()) were not. Under concurrent analysis of the same IP: Thread A sets a score → Thread B resets → Thread A calls calculate() — resulting in a corrupted total that could trigger a false-positive block or silently suppress a real threat. All seven setters are now synchronized on the same monitor as calculate(). - Velocity — `AttackLevelManager.shouldAllowConnection()`: LOCKDOWN no longer blocks verified players: The LOCKDOWN case previously returned false unconditionally, with a comment claiming VerifiedPlayerShield handles verified players separately. In practice the call order in DDoSProtectionModule.checkConnection() is Shield first, then shouldAllowConnection(). The level manager's blanket false overrode the Shield's approval, meaning verified players were rejected during LOCKDOWN regardless of slot availability. Changed to isVerified — matching the CRITICAL case. - Velocity — `SmartThrottleEngine`: LOCKDOWN verified-player limit has a hard minimum of 5: getLimitForLevel() returned lockdownLimit for verified players under LOCKDOWN. If lockdownLimit was set to 0 or 1 in config, verified players could still be throttled out. The value is now Math.max(5, lockdownLimit), guaranteeing that at least 5 reconnect attempts per 60-second window are allowed even during the strictest attack mode. - Velocity — `VerifiedPlayerShield.isVerified()`: consults `VerificationModule` first: Previously only checked VelocityAntiBotModule.isVerified(). Players verified via the Limbo system (VerificationModule) were not recognized by the Shield during CRITICAL/LOCKDOWN, causing them to be denied slots despite having completed the physics challenge. Now checks VerificationModule when enabled, with AntiBot as fallback. - Velocity — `DDoSProtectionModule.checkConnection()`: CPS counter excludes verified connections: synFloodDetector.recordConnection(ip) was called for every incoming connection, including verified players. Fifty verified players reconnecting simultaneously after a server restart could push the CPS counter above the attack threshold, escalating the attack level artificially and triggering unnecessary lockdown for unrelated new players. Verified connections are now excluded from the CPS count. - Velocity — `DDoSProtectionModule`: verified players do not receive attack-mode reputation penalties: reputationTracker.recordAttackConnection(ip) was called for all connections during attack mode. Verified players reconnecting during an attack were penalized, eventually getting close to the auto-ban threshold despite being legitimate users. Penalty is now skipped when isVerified is true. - Velocity — `ConnectionListener.onDisconnect()`: `VerifiedPlayerShield` slot released on player quit: VerifiedPlayerShield.onConnectionClosed() decrements slotsInUse but was never called from the disconnect listener. Slots only grew, never shrank. After enough players logged out and back in during a CRITICAL/LOCKDOWN event, slotsInUse would reach guaranteedSlots and all subsequent verified connections would be denied with "slot full". plugin.getDdosModule().onConnectionClosed(ip, "player-disconnect") is now called on every DisconnectEvent. - Velocity — Five modules default to `enabled: false` in `config.yml`: ReconnectControlModule, LatencyCheckModule, FastChatModule, PasswordCheckModule, and CountryFilterModule had no modules.<name>.enabled key in config.yml. VelocityModule.isConfigActive() defaults to true when the key is absent, so all five were silently active on every fresh install — imposing reconnect cooldowns, latency-based kicks, and chat rate limits without the admin's knowledge. Explicit enabled: false sections have been added for each. - Velocity — `ReconnectControlModule`: verified players bypass cooldown and crash-loop detection: Pre-login listener had no verified-player check. Verified players reconnecting after a server restart hit the 10-second reconnect cooldown or were flagged as crash-loop clients. Added verified bypass via VerificationModule and AntiBot before any cooldown/crash-loop logic runs. Crash-loop threshold raised from 3 to 5 reconnects, window extended from 30 s to 60 s, and default action changed from kick to flag to prevent mass false kicks after restarts. - Velocity — `LatencyCheckModule`: verified players bypass latency checks: The module registered its own LoginEvent listener, independent of the pipeline's skipForVerified() mechanism. A player allowed by the pipeline could still be kicked by this module for a sub-5 ms login time (common on local datacenter proxies). Verified players now return early. Default minimum-ms lowered from 5 to 0 and default actions changed from kick to flag. - Velocity — `ChatListener`: defers to `FastChatModule` when active: Both ChatListener (backed by ProxyExploitModule.checkChat()) and FastChatModule subscribed to PlayerChatEvent independently with separate rate-limit counters. A single message could be evaluated by both systems, producing inconsistent deny decisions and sending two different error messages to the player. ChatListener now returns early when FastChatModule.isEnabled() is true. - Velocity — `NicknameBlocker` + `HandshakeValidator`: Bedrock/Floodgate prefix exemption: Floodgate prefixes usernames with . (e.g. .BedrockPlayer123). ozel-karakter-engel: true in NicknameBlocker and the [a-zA-Z0-9_]+ regex in HandshakeValidator both rejected these names as containing illegal characters. A configurable bedrock-prefix key (default .) is now checked first in NicknameBlocker; HandshakeValidator strips a leading . or * before applying the character regex. - Velocity — `JoinPatternDetector.getJoinScore()`: maximum capped at 60: The raw score could reach 50 (rapid + quitter combined). With joinPatternScore * 0.25 weighting and flagCount = 1, the 60 % single-flag reduction yields 50 * 0.25 * 0.60 = 7.5 — harmless alone. But combined with any second flag, the reduction disappears and the score contribution can push a borderline connection to medium-risk. The cap prevents this single detector from dominating the total score. - Velocity — `AntiBotCheck`: redundant `antiBot.isVerified()` call removed: `skipForVerified() =

Improvements

- Velocity — `PlayerBehaviorProfile`: `usedUsernames` set is now thread-safe: The field was backed by a plain HashSet. recordSession() can be called from multiple Netty I/O threads simultaneously (each pre-login event arrives on a different thread), creating a risk of ConcurrentModificationException or silent data corruption. Replaced with ConcurrentHashMap.newKeySet(), which provides the same Set contract with full thread safety at zero contention cost. - Velocity — `PlayerBehaviorProfile.calculateTrustScore()`: new-player first-login bonus: Brand-new players (no sessions, no logins, no violations) start with score 50. If trust-score-threshold is ever misconfigured above 50, every new player is denied before they can build any history. Added a +5 bonus applied only to completely fresh profiles, raising the guaranteed floor to 55 and providing a safe buffer against accidental misconfiguration. - Velocity — `BehaviorManager.getProfile()`: `offlineModeLenient` set at profile creation time: Previously the flag was set only inside recordLogin(), which is called after TrustScoreCheck already ran. A fresh profile therefore always had offlineModeLenient = false, making the multi-account username penalty fire on offline-mode servers even when it should have been suppressed. Now the config is read once at profile instantiation so the flag is correct before any pipeline check consults the score. - Velocity — `ThreatScore` setters are now `synchronized`: resetForNewAnalysis() and calculate() were already synchronized, but individual setters (e.g. setConnectionRateScore()) were not. Under concurrent analysis of the same IP: Thread A sets a score → Thread B resets → Thread A calls calculate() — resulting in a corrupted total that could trigger a false-positive block or silently suppress a real threat. All seven setters are now synchronized on the same monitor as calculate(). - Velocity — `AttackLevelManager.shouldAllowConnection()`: LOCKDOWN no longer blocks verified players: The LOCKDOWN case previously returned false unconditionally, with a comment claiming VerifiedPlayerShield handles verified players separately. In practice the call order in DDoSProtectionModule.checkConnection() is Shield first, then shouldAllowConnection(). The level manager's blanket false overrode the Shield's approval, meaning verified players were rejected during LOCKDOWN regardless of slot availability. Changed to isVerified — matching the CRITICAL case. - Velocity — `SmartThrottleEngine`: LOCKDOWN verified-player limit has a hard minimum of 5: getLimitForLevel() returned lockdownLimit for verified players under LOCKDOWN. If lockdownLimit was set to 0 or 1 in config, verified players could still be throttled out. The value is now Math.max(5, lockdownLimit), guaranteeing that at least 5 reconnect attempts per 60-second window are allowed even during the strictest attack mode. - Velocity — `VerifiedPlayerShield.isVerified()`: consults `VerificationModule` first: Previously only checked VelocityAntiBotModule.isVerified(). Players verified via the Limbo system (VerificationModule) were not recognized by the Shield during CRITICAL/LOCKDOWN, causing them to be denied slots despite having completed the physics challenge. Now checks VerificationModule when enabled, with AntiBot as fallback. - Velocity — `DDoSProtectionModule.checkConnection()`: CPS counter excludes verified connections: synFloodDetector.recordConnection(ip) was called for every incoming connection, including verified players. Fifty verified players reconnecting simultaneously after a server restart could push the CPS counter above the attack threshold, escalating the attack level artificially and triggering unnecessary lockdown for unrelated new players. Verified connections are now excluded from the CPS count. - Velocity — `DDoSProtectionModule`: verified players do not receive attack-mode reputation penalties: reputationTracker.recordAttackConnection(ip) was called for all connections during attack mode. Verified players reconnecting during an attack were penalized, eventually getting close to the auto-ban threshold despite being legitimate users. Penalty is now skipped when isVerified is true. - Velocity — `ConnectionListener.onDisconnect()`: `VerifiedPlayerShield` slot released on player quit: VerifiedPlayerShield.onConnectionClosed() decrements slotsInUse but was never called from the disconnect listener. Slots only grew, never shrank. After enough players logged out and back in during a CRITICAL/LOCKDOWN event, slotsInUse would reach guaranteedSlots and all subsequent verified connections would be denied with "slot full". plugin.getDdosModule().onConnectionClosed(ip, "player-disconnect") is now called on every DisconnectEvent. - Velocity — Five modules default to `enabled: false` in `config.yml`: ReconnectControlModule, LatencyCheckModule, FastChatModule, PasswordCheckModule, and CountryFilterModule had no modules.<name>.enabled key in config.yml. VelocityModule.isConfigActive() defaults to true when the key is absent, so all five were silently active on every fresh install — imposing reconnect cooldowns, latency-based kicks, and chat rate limits without the admin's knowledge. Explicit enabled: false sections have been added for each. - Velocity — `ReconnectControlModule`: verified players bypass cooldown and crash-loop detection: Pre-login listener had no verified-player check. Verified players reconnecting after a server restart hit the 10-second reconnect cooldown or were flagged as crash-loop clients. Added verified bypass via VerificationModule and AntiBot before any cooldown/crash-loop logic runs. Crash-loop threshold raised from 3 to 5 reconnects, window extended from 30 s to 60 s, and default action changed from kick to flag to prevent mass false kicks after restarts. - Velocity — `LatencyCheckModule`: verified players bypass latency checks: The module registered its own LoginEvent listener, independent of the pipeline's skipForVerified() mechanism. A player allowed by the pipeline could still be kicked by this module for a sub-5 ms login time (common on local datacenter proxies). Verified players now return early. Default minimum-ms lowered from 5 to 0 and default actions changed from kick to flag. - Velocity — `ChatListener`: defers to `FastChatModule` when active: Both ChatListener (backed by ProxyExploitModule.checkChat()) and FastChatModule subscribed to PlayerChatEvent independently with separate rate-limit counters. A single message could be evaluated by both systems, producing inconsistent deny decisions and sending two different error messages to the player. ChatListener now returns early when FastChatModule.isEnabled() is true. - Velocity — `NicknameBlocker` + `HandshakeValidator`: Bedrock/Floodgate prefix exemption: Floodgate prefixes usernames with . (e.g. .BedrockPlayer123). ozel-karakter-engel: true in NicknameBlocker and the [a-zA-Z0-9_]+ regex in HandshakeValidator both rejected these names as containing illegal characters. A configurable bedrock-prefix key (default .) is now checked first in NicknameBlocker; HandshakeValidator strips a leading . or * before applying the character regex. - Velocity — `JoinPatternDetector.getJoinScore()`: maximum capped at 60: The raw score could reach 50 (rapid + quitter combined). With joinPatternScore * 0.25 weighting and flagCount = 1, the 60 % single-flag reduction yields 50 * 0.25 * 0.60 = 7.5 — harmless alone. But combined with any second flag, the reduction disappears and the score contribution can push a borderline connection to medium-risk. The cap prevents this single detector from dominating the total score. - Velocity — `AntiBotCheck`: redundant `antiBot.isVerified()` call removed: `skipForVerified() =

Improvements

- Velocity — BotDetectionEngine: `flagCount` threshold raised to 3 for high-risk and medium-risk classification: isHighRisk() and isMediumRisk() previously required flagCount >= 2, while ThreatScore's own identical methods enforced >= 3. The discrepancy meant a player triggering exactly two suspicious categories (e.g. unusual connection rate + join-pattern) could be flagged as medium-risk. Both methods now consistently require 3 independent suspicious categories before any blocking action is taken, making it mathematically impossible to reach a block threshold through 2-flag scenarios alone (max achievable score with 2 flags ≈ 37, well below both thresholds). - Velocity — ConnectionAnalyzer: grace period extended from 10 s to 15 s: The first-connection grace window (during which connection-rate counting is suppressed) was 10 seconds. Forge modpack clients, slow authentication servers, and skin-download overhead can easily exceed 10 seconds, causing the connection counter to start incrementing during legitimate join flow. Extended to 15 seconds to provide a safe buffer. - Velocity — JoinPatternDetector: quit-count decay accelerated: The decay interval was reduced from 5 minutes to 3 minutes, and the decay amount was increased from 5 to 7 points per cycle. Previously, an IP that accumulated 20 quit-counts (e.g. during a server crash or mass disconnect) would take up to 20 minutes to clear the maxQuitsBeforeSuspect threshold. With the new values, a count of 20 decays to zero in roughly 9 minutes (3 cycles × 7 points). - Velocity — JoinPatternDetector: parameters now configurable via `config.yml`: joinWindowSeconds, maxJoinsInWindow, and maxQuitsBeforeSuspect were previously hardcoded in VelocityAntiBotModule.onEnable() as (120, 8, 15). Added three new config keys under modules.bot-protection: join-window-seconds (default 120), max-joins-in-window (default 8), max-quits-before-suspect (default 20). The JoinPatternDetector constructor still enforces its own minimums (8 / 20) as a safety floor. - Velocity — IP Reputation: initial score raised and invalid-handshake penalty reduced: initial-score increased 60 → 75. Combined with the previous invalid-handshake-penalty: 8, a Forge/FML client whose handshake failed validation only 7 times (before ever logging in) could drop below the 24-hour auto-ban threshold. Penalty reduced 8 → 3: a Forge client that fails 10 consecutive handshake checks now loses only 30 points (75 → 45), remaining well above both auto-ban thresholds (15 and 10). - Velocity — BurstAllowance: `min-verified-ratio-percent` reduced 30 % → 15 %: Burst mode was gated on at least 30 % of connections being from verified IPs. During server restarts or event starts, the verified ratio is naturally low (new players joining for the first time), so burst mode never activated precisely when it was needed most. Lowered to 15 % to allow burst mode to engage during realistic restart traffic. - Velocity — `ping-per-second` config section added to `rate-limit`: GlobalRateLimitModule read per-IP and global ping-rate limits from modules.rate-limit.ping-per-second.*, but that YAML section was missing from config.yml. All ping rate-limit reads fell through to hardcoded Java defaults, making the config keys invisible and non-functional. Section added with per-ip-max: 5 and global-max: 200.

Bug Fixes

- Velocity — GlobalRateLimitModule: `ping-saniye.global-max` config key never resolved: allowPing() called getConfigInt("ping-saniye.global-max", 200) — a Turkish/English mixed key that does not exist in config.yml. The read always returned the default value of 200 and could never be overridden. Corrected to "ping-per-second.global-max" to match the newly added YAML section.

Improvements

- Velocity — BotDetectionEngine: `flagCount` threshold raised to 3 for high-risk and medium-risk classification: isHighRisk() and isMediumRisk() previously required flagCount >= 2, while ThreatScore's own identical methods enforced >= 3. The discrepancy meant a player triggering exactly two suspicious categories (e.g. unusual connection rate + join-pattern) could be flagged as medium-risk. Both methods now consistently require 3 independent suspicious categories before any blocking action is taken, making it mathematically impossible to reach a block threshold through 2-flag scenarios alone (max achievable score with 2 flags ≈ 37, well below both thresholds). - Velocity — ConnectionAnalyzer: grace period extended from 10 s to 15 s: The first-connection grace window (during which connection-rate counting is suppressed) was 10 seconds. Forge modpack clients, slow authentication servers, and skin-download overhead can easily exceed 10 seconds, causing the connection counter to start incrementing during legitimate join flow. Extended to 15 seconds to provide a safe buffer. - Velocity — JoinPatternDetector: quit-count decay accelerated: The decay interval was reduced from 5 minutes to 3 minutes, and the decay amount was increased from 5 to 7 points per cycle. Previously, an IP that accumulated 20 quit-counts (e.g. during a server crash or mass disconnect) would take up to 20 minutes to clear the maxQuitsBeforeSuspect threshold. With the new values, a count of 20 decays to zero in roughly 9 minutes (3 cycles × 7 points). - Velocity — JoinPatternDetector: parameters now configurable via `config.yml`: joinWindowSeconds, maxJoinsInWindow, and maxQuitsBeforeSuspect were previously hardcoded in VelocityAntiBotModule.onEnable() as (120, 8, 15). Added three new config keys under modules.bot-protection: join-window-seconds (default 120), max-joins-in-window (default 8), max-quits-before-suspect (default 20). The JoinPatternDetector constructor still enforces its own minimums (8 / 20) as a safety floor. - Velocity — IP Reputation: initial score raised and invalid-handshake penalty reduced: initial-score increased 60 → 75. Combined with the previous invalid-handshake-penalty: 8, a Forge/FML client whose handshake failed validation only 7 times (before ever logging in) could drop below the 24-hour auto-ban threshold. Penalty reduced 8 → 3: a Forge client that fails 10 consecutive handshake checks now loses only 30 points (75 → 45), remaining well above both auto-ban thresholds (15 and 10). - Velocity — BurstAllowance: `min-verified-ratio-percent` reduced 30 % → 15 %: Burst mode was gated on at least 30 % of connections being from verified IPs. During server restarts or event starts, the verified ratio is naturally low (new players joining for the first time), so burst mode never activated precisely when it was needed most. Lowered to 15 % to allow burst mode to engage during realistic restart traffic. - Velocity — `ping-per-second` config section added to `rate-limit`: GlobalRateLimitModule read per-IP and global ping-rate limits from modules.rate-limit.ping-per-second.*, but that YAML section was missing from config.yml. All ping rate-limit reads fell through to hardcoded Java defaults, making the config keys invisible and non-functional. Section added with per-ip-max: 5 and global-max: 200.

Bug Fixes

- Velocity — GlobalRateLimitModule: `ping-saniye.global-max` config key never resolved: allowPing() called getConfigInt("ping-saniye.global-max", 200) — a Turkish/English mixed key that does not exist in config.yml. The read always returned the default value of 200 and could never be overridden. Corrected to "ping-per-second.global-max" to match the newly added YAML section.

Dev Build #71 - [2638acb](https://github.com/ATOMGAMERAGA/AtomGuard/commit/2638acb7… Fix Jenkinsfile Groovy syntax error on line 161 (ATOMGAMERAGA) - [fb1e5c0](https://github.com/ATOMGAMERAGA/AtomGuard/commit/fb1e5c04… Release v2.2.0 — Velocity False Positive & Error Elimination (ATOMGAMERAGA) - [0d5f294](https://github.com/ATOMGAMERAGA/AtomGuard/commit/0d5f294f… Release v2.1.4 — Heuristic False Positive Kick Fix (ATOMGAMERAGA) - [97ea350](https://github.com/ATOMGAMERAGA/AtomGuard/commit/97ea350e… Release v2.1.3 — Hit Registration & Timeout Fix (ATOMGAMERAGA) - [7e7c9df](https://github.com/ATOMGAMERAGA/AtomGuard/commit/7e7c9df4… Update CHANGELOG for v2.1.2 — Block Breaking Kick Fix (ATOMGAMERAGA) - [ac87b94](https://github.com/ATOMGAMERAGA/AtomGuard/commit/ac87b943… Release v2.1.2 (ATOMGAMERAGA) - [b956d80](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b956d803… Release v2.1.1 — Code Audit Fix (Placeholders, CIDR, NPE, Thread Leak) (ATOMGAMERAGA) - [d4f1047](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d4f10472… Release v2.1.0 — Network Protection False Positive Fix (ATOMGAMERAGA) - [5963a5b](https://github.com/ATOMGAMERAGA/AtomGuard/commit/5963a5b6… Release v2.0.11 — PostVerificationEvent Async Fix (ATOMGAMERAGA) - [b780fae](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b780fae8… Release v2.0.10 — False Positive & Duplication Fix Audit (ATOMGAMERAGA)

Dev Build #71 - [2638acb](https://github.com/ATOMGAMERAGA/AtomGuard/commit/2638acb7… Fix Jenkinsfile Groovy syntax error on line 161 (ATOMGAMERAGA) - [fb1e5c0](https://github.com/ATOMGAMERAGA/AtomGuard/commit/fb1e5c04… Release v2.2.0 — Velocity False Positive & Error Elimination (ATOMGAMERAGA) - [0d5f294](https://github.com/ATOMGAMERAGA/AtomGuard/commit/0d5f294f… Release v2.1.4 — Heuristic False Positive Kick Fix (ATOMGAMERAGA) - [97ea350](https://github.com/ATOMGAMERAGA/AtomGuard/commit/97ea350e… Release v2.1.3 — Hit Registration & Timeout Fix (ATOMGAMERAGA) - [7e7c9df](https://github.com/ATOMGAMERAGA/AtomGuard/commit/7e7c9df4… Update CHANGELOG for v2.1.2 — Block Breaking Kick Fix (ATOMGAMERAGA) - [ac87b94](https://github.com/ATOMGAMERAGA/AtomGuard/commit/ac87b943… Release v2.1.2 (ATOMGAMERAGA) - [b956d80](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b956d803… Release v2.1.1 — Code Audit Fix (Placeholders, CIDR, NPE, Thread Leak) (ATOMGAMERAGA) - [d4f1047](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d4f10472… Release v2.1.0 — Network Protection False Positive Fix (ATOMGAMERAGA) - [5963a5b](https://github.com/ATOMGAMERAGA/AtomGuard/commit/5963a5b6… Release v2.0.11 — PostVerificationEvent Async Fix (ATOMGAMERAGA) - [b780fae](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b780fae8… Release v2.0.10 — False Positive & Duplication Fix Audit (ATOMGAMERAGA)

Bug Fixes

- Core — HeuristicEngine: false positive kicks ("Şüpheli davranış tespit edildi"): Normal gameplay (PvP, building, mining) was triggering heuristic kicks due to multiple compounding issues: - Module violation weight too high: Every blockExploit() call added 0.5 suspicion points per module block. With a 150.0 kick threshold, only 300 legitimate module blocks were needed to trigger a kick. Reduced default weight from 0.5 → 0.1 (limiters: 0.1 → 0.02). - Kick threshold too low: Default 150.0 was easily reachable during normal play. Raised to 300.0. - Slow score decay: Decay rate of 2.0 points/second meant 75 seconds of inactivity to clear a moderate score. Increased to 5.0 points/second (30 seconds to clear). - Rotation spike penalty too harsh: +3.0 points per 8 consecutive rotation spikes. Reduced to 1.5. - Click variance penalty too harsh: +8.0 points for low click variance. Reduced to 4.0. - Session score persistence: Heuristic profile was not reset on player join, so scores from a previous session (or a kick-reconnect cycle) carried over. Added removeProfile() call on PlayerJoinEvent to ensure a fresh profile each session.

Bug Fixes

- Core — HeuristicEngine: false positive kicks ("Şüpheli davranış tespit edildi"): Normal gameplay (PvP, building, mining) was triggering heuristic kicks due to multiple compounding issues: - Module violation weight too high: Every blockExploit() call added 0.5 suspicion points per module block. With a 150.0 kick threshold, only 300 legitimate module blocks were needed to trigger a kick. Reduced default weight from 0.5 → 0.1 (limiters: 0.1 → 0.02). - Kick threshold too low: Default 150.0 was easily reachable during normal play. Raised to 300.0. - Slow score decay: Decay rate of 2.0 points/second meant 75 seconds of inactivity to clear a moderate score. Increased to 5.0 points/second (30 seconds to clear). - Rotation spike penalty too harsh: +3.0 points per 8 consecutive rotation spikes. Reduced to 1.5. - Click variance penalty too harsh: +8.0 points for low click variance. Reduced to 4.0. - Session score persistence: Heuristic profile was not reset on player join, so scores from a previous session (or a kick-reconnect cycle) carried over. Added removeProfile() call on PlayerJoinEvent to ensure a fresh profile each session.

Bug Fixes

- Core — EntityInteractCrashModule: intermittent hit registration failure in PvP: The per-player INTERACT_ENTITY packet counter was never reset per second — it accumulated indefinitely and only cleared every 5 minutes via the periodic cleanup() task. After just 20 total interactions (not per second as the max-interactions-per-second config implied), all subsequent attack packets were silently dropped, making PvP combat appear to randomly stop working. Replaced the unbounded AtomicInteger counter with a proper 1-second sliding window (long[] with count + timestamp), so the limit now correctly applies per second as intended. - Core — TokenBucketModule: intermittent "Timed Out" kicks: KEEP_ALIVE and PONG packets were not exempted from token bucket rate limiting, unlike the other three packet-filtering modules (PacketExploitModule, PacketDelayModule, OfflinePacketModule) which all had explicit exemptions. These critical connection-keepalive packets were classified into the "DIGER" (other) bucket (150 capacity / 60 tokens/sec). During high traffic, the bucket would deplete and silently drop keepalive responses, causing the server to kick the player after 30 seconds with "Timed Out". Added an early return for KEEP_ALIVE and PONG packets before any bucket processing.

Bug Fixes

- Core — EntityInteractCrashModule: intermittent hit registration failure in PvP: The per-player INTERACT_ENTITY packet counter was never reset per second — it accumulated indefinitely and only cleared every 5 minutes via the periodic cleanup() task. After just 20 total interactions (not per second as the max-interactions-per-second config implied), all subsequent attack packets were silently dropped, making PvP combat appear to randomly stop working. Replaced the unbounded AtomicInteger counter with a proper 1-second sliding window (long[] with count + timestamp), so the limit now correctly applies per second as intended. - Core — TokenBucketModule: intermittent "Timed Out" kicks: KEEP_ALIVE and PONG packets were not exempted from token bucket rate limiting, unlike the other three packet-filtering modules (PacketExploitModule, PacketDelayModule, OfflinePacketModule) which all had explicit exemptions. These critical connection-keepalive packets were classified into the "DIGER" (other) bucket (150 capacity / 60 tokens/sec). During high traffic, the bucket would deplete and silently drop keepalive responses, causing the server to kick the player after 30 seconds with "Timed Out". Added an early return for KEEP_ALIVE and PONG packets before any bucket processing.

Dev Build #67 - [7e7c9df](https://github.com/ATOMGAMERAGA/AtomGuard/commit/7e7c9df4… Update CHANGELOG for v2.1.2 — Block Breaking Kick Fix (ATOMGAMERAGA) - [ac87b94](https://github.com/ATOMGAMERAGA/AtomGuard/commit/ac87b943… Release v2.1.2 (ATOMGAMERAGA) - [b956d80](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b956d803… Release v2.1.1 — Code Audit Fix (Placeholders, CIDR, NPE, Thread Leak) (ATOMGAMERAGA) - [d4f1047](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d4f10472… Release v2.1.0 — Network Protection False Positive Fix (ATOMGAMERAGA) - [5963a5b](https://github.com/ATOMGAMERAGA/AtomGuard/commit/5963a5b6… Release v2.0.11 — PostVerificationEvent Async Fix (ATOMGAMERAGA) - [b780fae](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b780fae8… Release v2.0.10 — False Positive & Duplication Fix Audit (ATOMGAMERAGA) - [5dbd863](https://github.com/ATOMGAMERAGA/AtomGuard/commit/5dbd8638… Release v2.0.9 — False Positive Fixes (ATOMGAMERAGA) - [2c08e1b](https://github.com/ATOMGAMERAGA/AtomGuard/commit/2c08e1b6… Release v2.0.8 — Fix player timeout caused by OfflinePacketModule (ATOMGAMERAGA) - [b0c0184](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b0c01842… Release v2.0.7 — AntiBotModule Kritik Düzeltmeler (ATOMGAMERAGA) - [526be87](https://github.com/ATOMGAMERAGA/AtomGuard/commit/526be87e… Release v2.0.6 — Özel Login Plugini Uyumluluk Düzeltmeleri (ATOMGAMERAGA)

Dev Build #67 - [7e7c9df](https://github.com/ATOMGAMERAGA/AtomGuard/commit/7e7c9df4… Update CHANGELOG for v2.1.2 — Block Breaking Kick Fix (ATOMGAMERAGA) - [ac87b94](https://github.com/ATOMGAMERAGA/AtomGuard/commit/ac87b943… Release v2.1.2 (ATOMGAMERAGA) - [b956d80](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b956d803… Release v2.1.1 — Code Audit Fix (Placeholders, CIDR, NPE, Thread Leak) (ATOMGAMERAGA) - [d4f1047](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d4f10472… Release v2.1.0 — Network Protection False Positive Fix (ATOMGAMERAGA) - [5963a5b](https://github.com/ATOMGAMERAGA/AtomGuard/commit/5963a5b6… Release v2.0.11 — PostVerificationEvent Async Fix (ATOMGAMERAGA) - [b780fae](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b780fae8… Release v2.0.10 — False Positive & Duplication Fix Audit (ATOMGAMERAGA) - [5dbd863](https://github.com/ATOMGAMERAGA/AtomGuard/commit/5dbd8638… Release v2.0.9 — False Positive Fixes (ATOMGAMERAGA) - [2c08e1b](https://github.com/ATOMGAMERAGA/AtomGuard/commit/2c08e1b6… Release v2.0.8 — Fix player timeout caused by OfflinePacketModule (ATOMGAMERAGA) - [b0c0184](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b0c01842… Release v2.0.7 — AntiBotModule Kritik Düzeltmeler (ATOMGAMERAGA) - [526be87](https://github.com/ATOMGAMERAGA/AtomGuard/commit/526be87e… Release v2.0.6 — Özel Login Plugini Uyumluluk Düzeltmeleri (ATOMGAMERAGA)

Yeni Özellikler

-

İyileştirmeler

-

Hata Düzeltmeleri

-

Yeni Özellikler

-

İyileştirmeler

-

Hata Düzeltmeleri

-

Bug Fixes

- Core — MiniMessage placeholders broken across all message files: All 196 dynamic placeholders in the four message files (messages_tr.yml, messages_en.yml, velocity/messages_tr.yml, velocity/messages_en.yml) were using curly-brace format ({sayi}, {ip}, {oyuncu}, etc.), which MiniMessage never resolves — it only processes <tag> syntax. Every command output, kick message, and admin notification that contained a dynamic value (counts, IPs, player names, durations) was therefore rendered as a raw literal string. All 196 occurrences converted to angle-bracket format (<sayi>, <ip>, <oyuncu>, etc.). - Velocity — ExternalListManager: CIDR subnet blocking silently ignored: isBlocked() contained an empty // TODO: Proper CIDR check branch — any entry with a / in it (e.g. 192.168.0.0/16) was skipped without matching, making all subnet-based external blacklist rules completely inoperative. Replaced with a correct byte-level CIDR matching implementation using InetAddress and bit-mask arithmetic; IPv6 is supported by address-length parity check. - Core — PlaceholderAPI `%atomguard_player_reputation%` always returned "100": The expansion returned a hardcoded "100" string regardless of the player's actual trust score. Wired to TrustScoreManager.getScore(UUID) with a null-safe fallback. Added two additional placeholders: %atomguard_trust_tier% (returns the player's TrustTier enum name) and %atomguard_attack_mode_status% (returns "true" / "false"). - Core — BotProtectionModule: NullPointerException on `getAddress()`: Nine call sites in BotProtectionModule dereferenced user.getAddress().getAddress().getHostAddress() without a null guard, and two more used player.getAddress() the same way. Proxy connections or mid-handshake disconnects can leave the address as null, causing an NPE that propagates into the packet handler thread. Null checks added at all eleven sites; affected handlers return early when the address is unavailable. - Core — RateLimitMiddleware: NullPointerException on `getRemoteAddress()`: checkRateLimit() unconditionally called exchange.getRemoteAddress().getAddress().getHostAddress(). A broken or prematurely closed HTTP connection yields a null remote address, causing an NPE. A null check is now performed first; if the address is unavailable the request is allowed through. - Velocity — PrometheusExporter: thread leak on plugin reload: The HTTP server executor was created with Executors.newSingleThreadExecutor() as an anonymous local — its reference was never stored, so stop() called httpServer.stop(0) but never shut down the executor. On each plugin reload a new thread was leaked. The executor is now stored in a field (httpExecutor), created as a named daemon thread, and shutdownNow() + awaitTermination(3 s) are called in stop(). - Core — ForensicsManager: silent I/O failures: Four catch (Exception ignored) {} blocks in ForensicsManager (onAttackStart, recordMetrics, loadRecentSnapshots, getSnapshot) swallowed disk I/O errors, JSON parse failures, and serialization exceptions without any log output. An admin could lose forensic attack records with no indication of why. All four blocks now log a WARNING with the failure context and message. - Core — IPReputationManager: silent CIDR parse exception: isInBlockedCidr() swallowed InetAddress.getByName() and CidrRange.contains() exceptions silently. Misconfigured CIDR entries would fail invisibly. Exception now logged at WARNING level with the offending IP and error message. - Core — DiscordWebhookManager: silent TPS monitoring exception: The periodic TPS check scheduled task caught all exceptions with ignored. Any error (e.g. server API unavailable during shutdown) would silently suppress the failure. Now logged via LogManager.warning(). - Core — ConnectionThrottleModule: hardcoded Turkish kick message with legacy color codes: The connection-throttle kick used LegacyComponentSerializer.legacyAmpersand().deserialize("&cCok fazla baglanti denemesi!") — a hardcoded Turkish string with old &c color syntax, bypassing both MessageManager and locale support. Replaced with plugin.getMessageManager().getMessage("engelleme.baglanti-siniri"), which is already defined in both messages_tr.yml and messages_en.yml. - Core — BotProtectionModule: hardcoded strings with legacy `ChatColor` API: Three player-facing messages (verification prompt, verification success, bot-kick) used ChatColor.translateAlternateColorCodes('&', ...) with hardcoded Turkish strings. Migrated to MessageManager (antibot.dogrulama-mesaji, antibot.dogrulandi-mesaji, antibot.kick-mesaji). Corresponding keys added to both locale files. ChatColor import removed. - Core — ModuleManager: BotProtectionModule and AntiBotModule active simultaneously: @Deprecated BotProtectionModule could run alongside AntiBotModule if both were enabled in config, causing double-kick and double-ban for the same connection. enableAllModules() now checks for this conflict after all modules are started and automatically disables BotProtectionModule with a WARNING log entry explaining the reason.

Improvements

- Core — messages_en.yml: 23 missing keys added: The adli-analiz, bal-kupu, guven, and istihbarat sections were entirely absent from the English message file. Players or admins triggering these features on English-locale servers received [Missing: key] errors. All 23 keys now present with proper English translations. - Velocity — messages_en.yml: 6 missing kick keys added: kick.ddos-seviye, kick.ddos-subnet, kick.ddos-parmak-izi, kick.ddos-itibar, kick.ddos-slot, and kick.genel were present in the Turkish file but absent from English. Added with corresponding English text.

Bug Fixes

- Core — MiniMessage placeholders broken across all message files: All 196 dynamic placeholders in the four message files (messages_tr.yml, messages_en.yml, velocity/messages_tr.yml, velocity/messages_en.yml) were using curly-brace format ({sayi}, {ip}, {oyuncu}, etc.), which MiniMessage never resolves — it only processes <tag> syntax. Every command output, kick message, and admin notification that contained a dynamic value (counts, IPs, player names, durations) was therefore rendered as a raw literal string. All 196 occurrences converted to angle-bracket format (<sayi>, <ip>, <oyuncu>, etc.). - Velocity — ExternalListManager: CIDR subnet blocking silently ignored: isBlocked() contained an empty // TODO: Proper CIDR check branch — any entry with a / in it (e.g. 192.168.0.0/16) was skipped without matching, making all subnet-based external blacklist rules completely inoperative. Replaced with a correct byte-level CIDR matching implementation using InetAddress and bit-mask arithmetic; IPv6 is supported by address-length parity check. - Core — PlaceholderAPI `%atomguard_player_reputation%` always returned "100": The expansion returned a hardcoded "100" string regardless of the player's actual trust score. Wired to TrustScoreManager.getScore(UUID) with a null-safe fallback. Added two additional placeholders: %atomguard_trust_tier% (returns the player's TrustTier enum name) and %atomguard_attack_mode_status% (returns "true" / "false"). - Core — BotProtectionModule: NullPointerException on `getAddress()`: Nine call sites in BotProtectionModule dereferenced user.getAddress().getAddress().getHostAddress() without a null guard, and two more used player.getAddress() the same way. Proxy connections or mid-handshake disconnects can leave the address as null, causing an NPE that propagates into the packet handler thread. Null checks added at all eleven sites; affected handlers return early when the address is unavailable. - Core — RateLimitMiddleware: NullPointerException on `getRemoteAddress()`: checkRateLimit() unconditionally called exchange.getRemoteAddress().getAddress().getHostAddress(). A broken or prematurely closed HTTP connection yields a null remote address, causing an NPE. A null check is now performed first; if the address is unavailable the request is allowed through. - Velocity — PrometheusExporter: thread leak on plugin reload: The HTTP server executor was created with Executors.newSingleThreadExecutor() as an anonymous local — its reference was never stored, so stop() called httpServer.stop(0) but never shut down the executor. On each plugin reload a new thread was leaked. The executor is now stored in a field (httpExecutor), created as a named daemon thread, and shutdownNow() + awaitTermination(3 s) are called in stop(). - Core — ForensicsManager: silent I/O failures: Four catch (Exception ignored) {} blocks in ForensicsManager (onAttackStart, recordMetrics, loadRecentSnapshots, getSnapshot) swallowed disk I/O errors, JSON parse failures, and serialization exceptions without any log output. An admin could lose forensic attack records with no indication of why. All four blocks now log a WARNING with the failure context and message. - Core — IPReputationManager: silent CIDR parse exception: isInBlockedCidr() swallowed InetAddress.getByName() and CidrRange.contains() exceptions silently. Misconfigured CIDR entries would fail invisibly. Exception now logged at WARNING level with the offending IP and error message. - Core — DiscordWebhookManager: silent TPS monitoring exception: The periodic TPS check scheduled task caught all exceptions with ignored. Any error (e.g. server API unavailable during shutdown) would silently suppress the failure. Now logged via LogManager.warning(). - Core — ConnectionThrottleModule: hardcoded Turkish kick message with legacy color codes: The connection-throttle kick used LegacyComponentSerializer.legacyAmpersand().deserialize("&cCok fazla baglanti denemesi!") — a hardcoded Turkish string with old &c color syntax, bypassing both MessageManager and locale support. Replaced with plugin.getMessageManager().getMessage("engelleme.baglanti-siniri"), which is already defined in both messages_tr.yml and messages_en.yml. - Core — BotProtectionModule: hardcoded strings with legacy `ChatColor` API: Three player-facing messages (verification prompt, verification success, bot-kick) used ChatColor.translateAlternateColorCodes('&', ...) with hardcoded Turkish strings. Migrated to MessageManager (antibot.dogrulama-mesaji, antibot.dogrulandi-mesaji, antibot.kick-mesaji). Corresponding keys added to both locale files. ChatColor import removed. - Core — ModuleManager: BotProtectionModule and AntiBotModule active simultaneously: @Deprecated BotProtectionModule could run alongside AntiBotModule if both were enabled in config, causing double-kick and double-ban for the same connection. enableAllModules() now checks for this conflict after all modules are started and automatically disables BotProtectionModule with a WARNING log entry explaining the reason.

Improvements

- Core — messages_en.yml: 23 missing keys added: The adli-analiz, bal-kupu, guven, and istihbarat sections were entirely absent from the English message file. Players or admins triggering these features on English-locale servers received [Missing: key] errors. All 23 keys now present with proper English translations. - Velocity — messages_en.yml: 6 missing kick keys added: kick.ddos-seviye, kick.ddos-subnet, kick.ddos-parmak-izi, kick.ddos-itibar, kick.ddos-slot, and kick.genel were present in the Turkish file but absent from English. Added with corresponding English text.

New Features

- Velocity — BurstAllowance system: New BurstAllowance class detects legitimate short-lived traffic spikes (server restarts, event starts) and temporarily multiplies all rate limits by a configurable burst-multiplier (default 3×). Activation requires CPS to exceed burst-threshold (default 30) and the verified-player ratio to be above min-verified-ratio-percent (default 30%). At most max-bursts-per-hour (default 10) activations are permitted per hour to prevent abuse. Configurable under modules.ddos-protection.burst-allowance. - Velocity — DDoS protection dry-run mode: New modules.ddos-protection.dry-run: false config key. When set to true, connections that would be blocked are only logged ([DRY-RUN] Engellenecekti: <ip> | Sebep: <reason>) and counted under the ddos_dryrun_would_block statistic, but are not actually rejected. Allows safe threshold tuning on live servers before fully enabling protection. - Velocity — `network-protection.enabled` now defaults to `true`: The master toggle for all Velocity network protections (DDoS, AntiBot, VPN, Firewall) is now enabled out of the box. False-positive root causes have been resolved (see Fixes below), making it safe to ship protection on by default.

Improvements

- Velocity — Threshold recalibration (false-positive prevention): All DDoS protection thresholds raised to tolerate normal multi-player reconnect patterns. attack-mode.threshold 30 → 50 CPS, attack-mode.min-unique-ips 10 → 15, connection-limit.per-ip-per-minute 5 → 10, smart-throttle.normal-limit 10 → 15 / cautious-limit 5 → 8 / lockdown-limit 0 → 1. attack-levels.hysteresis-rise-seconds 3 → 5 s, hysteresis-fall-seconds 15 → 30 s. rate-limit.connections-per-second.per-ip-max 3 → 5, global-max 50 → 100. - Velocity — AttackLevelManager CPS multipliers raised: Level transition thresholds increased so that small concurrent join bursts (6–7 players) no longer trigger ELEVATED mode. ELEVATED now requires 2× base CPS (was 1.5×), HIGH 3× (was 2×), CRITICAL 5× (was 3×), LOCKDOWN 8× (was 5×). - Velocity — SmartThrottleEngine: sliding window replaces cumulative counter: The per-IP throttle counter was a Caffeine AtomicInteger that only reset after a 5-minute TTL, allowing a player who reconnected 11 times within 5 minutes to be permanently throttled until the window expired. Replaced with ConcurrentLinkedDeque<Long> timestamps and a 60-second sliding window — only connections within the last 60 seconds count toward the limit. - Velocity — ConnectionThrottler: verified-player bypass: tryConnect(ip, isVerified) and tryConnectAttackMode(ip, isVerified) overloads added. Verified players (those who have previously logged in successfully) receive max(limitPerMinute × 3, 15) connections per minute in normal mode and limitPerMinute (instead of limitPerMinute / 2) in attack mode, eliminating throttle-caused reconnect loops for returning players.

Bug Fixes

- Velocity — DDoSProtectionModule config completely disconnected from `config.yml`: The module was registered under the name "ddos-koruma" but config.yml uses modules.ddos-protection. Additionally, all 43 config keys in onEnable() were Turkish (e.g. saldiri-modu.esik, akilli-throttle.normal-limit) while the YAML uses English keys. As a result, every config read fell through to the Java hardcoded default and config.yml edits had no effect on DDoS behaviour. The module name is now "ddos-protection" and all keys are aligned with config.yml. - Velocity — VelocityAntiBotModule config keys mismatched: onEnable() read Turkish keys (analiz-penceresi, supheli-esik, yuksek-risk-esik, captcha.aktif, etc.) while config.yml uses English (analysis-window, suspicious-threshold, high-risk-threshold, captcha.enabled). All 11 keys corrected. Additionally, the bot-protection YAML section was at the top level of the file while VelocityModule.getConfigXxx() prefixes with modules.; the section has been moved under modules: so reads now resolve correctly. - Velocity — NicknameBlocker read from wrong YAML path: NicknameBlocker.reload() read from bot-protection.nick-engelleme.* (top-level). After moving bot-protection under modules:, all paths updated to modules.bot-protection.nick-engelleme.*. - Velocity — FirewallModule config keys mismatched: onEnable() and onConfigReload() used Turkish keys (oto-yasak-esik, oto-yasak-sure, kalici-yasak-esik, decay-dakika); these now match the YAML (auto-ban-threshold, auto-ban-duration, permanent-ban-threshold, decay-minutes). permanent-ban-threshold: 500 added to config.yml. - Velocity — VPNDetectionModule `premium-vpn-politikasi` key never read: The premium-bypass policy was hardcoded to "izin-ver" because the config key didn't exist in config.yml. Key renamed to premium-vpn-policy: "allow" and added to the modules.vpn-proxy-block section. - Velocity — ProxyExploitModule config section missing: The module was registered as "exploit-koruma" with no matching modules.exploit-koruma section in config.yml. Module renamed to "exploit-protection", Turkish keys (sohbet-limit, tekrar-mesaj-limit, komut-limit, sunucu-degistirme-limit) corrected to English, and a full modules.exploit-protection block added to config.yml.

New Features

- Velocity — BurstAllowance system: New BurstAllowance class detects legitimate short-lived traffic spikes (server restarts, event starts) and temporarily multiplies all rate limits by a configurable burst-multiplier (default 3×). Activation requires CPS to exceed burst-threshold (default 30) and the verified-player ratio to be above min-verified-ratio-percent (default 30%). At most max-bursts-per-hour (default 10) activations are permitted per hour to prevent abuse. Configurable under modules.ddos-protection.burst-allowance. - Velocity — DDoS protection dry-run mode: New modules.ddos-protection.dry-run: false config key. When set to true, connections that would be blocked are only logged ([DRY-RUN] Engellenecekti: <ip> | Sebep: <reason>) and counted under the ddos_dryrun_would_block statistic, but are not actually rejected. Allows safe threshold tuning on live servers before fully enabling protection. - Velocity — `network-protection.enabled` now defaults to `true`: The master toggle for all Velocity network protections (DDoS, AntiBot, VPN, Firewall) is now enabled out of the box. False-positive root causes have been resolved (see Fixes below), making it safe to ship protection on by default.

Improvements

- Velocity — Threshold recalibration (false-positive prevention): All DDoS protection thresholds raised to tolerate normal multi-player reconnect patterns. attack-mode.threshold 30 → 50 CPS, attack-mode.min-unique-ips 10 → 15, connection-limit.per-ip-per-minute 5 → 10, smart-throttle.normal-limit 10 → 15 / cautious-limit 5 → 8 / lockdown-limit 0 → 1. attack-levels.hysteresis-rise-seconds 3 → 5 s, hysteresis-fall-seconds 15 → 30 s. rate-limit.connections-per-second.per-ip-max 3 → 5, global-max 50 → 100. - Velocity — AttackLevelManager CPS multipliers raised: Level transition thresholds increased so that small concurrent join bursts (6–7 players) no longer trigger ELEVATED mode. ELEVATED now requires 2× base CPS (was 1.5×), HIGH 3× (was 2×), CRITICAL 5× (was 3×), LOCKDOWN 8× (was 5×). - Velocity — SmartThrottleEngine: sliding window replaces cumulative counter: The per-IP throttle counter was a Caffeine AtomicInteger that only reset after a 5-minute TTL, allowing a player who reconnected 11 times within 5 minutes to be permanently throttled until the window expired. Replaced with ConcurrentLinkedDeque<Long> timestamps and a 60-second sliding window — only connections within the last 60 seconds count toward the limit. - Velocity — ConnectionThrottler: verified-player bypass: tryConnect(ip, isVerified) and tryConnectAttackMode(ip, isVerified) overloads added. Verified players (those who have previously logged in successfully) receive max(limitPerMinute × 3, 15) connections per minute in normal mode and limitPerMinute (instead of limitPerMinute / 2) in attack mode, eliminating throttle-caused reconnect loops for returning players.

Bug Fixes

- Velocity — DDoSProtectionModule config completely disconnected from `config.yml`: The module was registered under the name "ddos-koruma" but config.yml uses modules.ddos-protection. Additionally, all 43 config keys in onEnable() were Turkish (e.g. saldiri-modu.esik, akilli-throttle.normal-limit) while the YAML uses English keys. As a result, every config read fell through to the Java hardcoded default and config.yml edits had no effect on DDoS behaviour. The module name is now "ddos-protection" and all keys are aligned with config.yml. - Velocity — VelocityAntiBotModule config keys mismatched: onEnable() read Turkish keys (analiz-penceresi, supheli-esik, yuksek-risk-esik, captcha.aktif, etc.) while config.yml uses English (analysis-window, suspicious-threshold, high-risk-threshold, captcha.enabled). All 11 keys corrected. Additionally, the bot-protection YAML section was at the top level of the file while VelocityModule.getConfigXxx() prefixes with modules.; the section has been moved under modules: so reads now resolve correctly. - Velocity — NicknameBlocker read from wrong YAML path: NicknameBlocker.reload() read from bot-protection.nick-engelleme.* (top-level). After moving bot-protection under modules:, all paths updated to modules.bot-protection.nick-engelleme.*. - Velocity — FirewallModule config keys mismatched: onEnable() and onConfigReload() used Turkish keys (oto-yasak-esik, oto-yasak-sure, kalici-yasak-esik, decay-dakika); these now match the YAML (auto-ban-threshold, auto-ban-duration, permanent-ban-threshold, decay-minutes). permanent-ban-threshold: 500 added to config.yml. - Velocity — VPNDetectionModule `premium-vpn-politikasi` key never read: The premium-bypass policy was hardcoded to "izin-ver" because the config key didn't exist in config.yml. Key renamed to premium-vpn-policy: "allow" and added to the modules.vpn-proxy-block section. - Velocity — ProxyExploitModule config section missing: The module was registered as "exploit-koruma" with no matching modules.exploit-koruma section in config.yml. Module renamed to "exploit-protection", Turkish keys (sohbet-limit, tekrar-mesaj-limit, komut-limit, sunucu-degistirme-limit) corrected to English, and a full modules.exploit-protection block added to config.yml.

Bug Fixes

- Core — TrustScoreManager: `IllegalStateException` on player quit: PostVerificationEvent is declared as an async event (super(true)), but recalculate() was firing it synchronously via Bukkit.getPluginManager().callEvent() from the main server thread. This was triggered on every player disconnect through the PlayerQuitEvent → recordQuit() → recalculate() call chain, as well as from recordViolation() and recordKick(). Paper 1.21.4 enforces that async events may only be called from off-thread, throwing IllegalStateException and leaving the trust score partially updated. The event dispatch in recalculate() is now wrapped in Bukkit.getScheduler().runTaskAsynchronously(), covering all three call sites at once.

Bug Fixes

- Core — TrustScoreManager: `IllegalStateException` on player quit: PostVerificationEvent is declared as an async event (super(true)), but recalculate() was firing it synchronously via Bukkit.getPluginManager().callEvent() from the main server thread. This was triggered on every player disconnect through the PlayerQuitEvent → recordQuit() → recalculate() call chain, as well as from recordViolation() and recordKick(). Paper 1.21.4 enforces that async events may only be called from off-thread, throwing IllegalStateException and leaving the trust score partially updated. The event dispatch in recalculate() is now wrapped in Bukkit.getScheduler().runTaskAsynchronously(), covering all three call sites at once.

Bug Fixes

- Core — DuplicationFixModule: ArrayIndexOutOfBoundsException on hotbar swap: InventoryClickEvent.getHotbarButton() returns -1 for non-hotbar keyboard clicks (including SWAP_OFFHAND), causing PlayerInventory.getItem(-1) to throw ArrayIndexOutOfBoundsException. The slot value is now validated with >= 0 && < inventory.getSize() before use. The SWAP_OFFHAND (F key) click type is now handled separately — if the item in the player's offhand is a Shulker Box while a Shulker Box inventory is open, the swap is cancelled, closing the shulker-in-shulker duplication vector. - Core — HeuristicEngine: false-positive kicks for legitimate players: Several thresholds were too aggressive for normal gameplay. max-rotation-speed default raised from 8.0 to 12.0 degrees/ms (high-DPI mice), max-rotation-spikes from 5 to 8. Rotation suspicion added per burst lowered from 5.0 to 3.0, click suspicion from 15.0 to 8.0. The kick threshold in checkSuspicionLevel() raised from 100.0 to 150.0; after a kick the suspicion score is now fully zeroed instead of only reducing by 50. Players with the atomguard.bypass permission now skip both rotation and click analysis entirely. Rotation analysis is skipped for the first 5 seconds after a player joins (session grace period) to avoid false spikes from initial position packets. Click intervals below 10 ms are filtered out as lag-induced packet merging artifacts. When speed falls below the threshold, spikes now decrement by 1 (decrementRotationSpikes) instead of resetting to zero, preventing a single normal packet from clearing accumulated evidence. The minimum click sample count raised from 10 to 15. - Core — HeuristicProfile: decay too slow and suspicion cap too low: DECAY_RATE_PER_SECOND raised from 0.5 to 2.0 (4× faster natural decay), MAX_CLICK_SAMPLES from 20 to 30. The addSuspicion() internal cap raised from 100.0 to 200.0 so the score can actually reach the new 150.0 kick threshold. New sessionStartTime field (set to System.currentTimeMillis() at profile creation) with getter/setter for grace period checks. New decrementRotationSpikes() method decrements rotationSpikes by 1 if positive (gradual cooldown instead of instant reset). - Core — AbstractModule: blockExploit() applies uniform +1.0 heuristic weight regardless of module type: High-frequency limiter modules (piston-limiter, redstone-limiter, falling-block-limiter, explosion-limiter) fire hundreds of times per second during normal lag spikes, causing innocent players to accumulate suspicion rapidly. These modules now contribute +0.1 per block event; all other modules contribute +0.5 (was always +1.0).

Improvements

- Config — New `heuristic` section: Added a dedicated heuristic: block to config.yml (placed before external-services:) exposing all tunable thresholds: action, kick-threshold (150.0), max-rotation-speed (12.0), max-rotation-spikes (8), min-spike-interval-ms (150), min-click-samples (15), min-click-variance (5.0), max-avg-click-interval (100.0). These values were previously hard-coded in the engine; operators can now raise them on high-activity servers to further reduce false positives without touching the source.

Bug Fixes

- Core — DuplicationFixModule: ArrayIndexOutOfBoundsException on hotbar swap: InventoryClickEvent.getHotbarButton() returns -1 for non-hotbar keyboard clicks (including SWAP_OFFHAND), causing PlayerInventory.getItem(-1) to throw ArrayIndexOutOfBoundsException. The slot value is now validated with >= 0 && < inventory.getSize() before use. The SWAP_OFFHAND (F key) click type is now handled separately — if the item in the player's offhand is a Shulker Box while a Shulker Box inventory is open, the swap is cancelled, closing the shulker-in-shulker duplication vector. - Core — HeuristicEngine: false-positive kicks for legitimate players: Several thresholds were too aggressive for normal gameplay. max-rotation-speed default raised from 8.0 to 12.0 degrees/ms (high-DPI mice), max-rotation-spikes from 5 to 8. Rotation suspicion added per burst lowered from 5.0 to 3.0, click suspicion from 15.0 to 8.0. The kick threshold in checkSuspicionLevel() raised from 100.0 to 150.0; after a kick the suspicion score is now fully zeroed instead of only reducing by 50. Players with the atomguard.bypass permission now skip both rotation and click analysis entirely. Rotation analysis is skipped for the first 5 seconds after a player joins (session grace period) to avoid false spikes from initial position packets. Click intervals below 10 ms are filtered out as lag-induced packet merging artifacts. When speed falls below the threshold, spikes now decrement by 1 (decrementRotationSpikes) instead of resetting to zero, preventing a single normal packet from clearing accumulated evidence. The minimum click sample count raised from 10 to 15. - Core — HeuristicProfile: decay too slow and suspicion cap too low: DECAY_RATE_PER_SECOND raised from 0.5 to 2.0 (4× faster natural decay), MAX_CLICK_SAMPLES from 20 to 30. The addSuspicion() internal cap raised from 100.0 to 200.0 so the score can actually reach the new 150.0 kick threshold. New sessionStartTime field (set to System.currentTimeMillis() at profile creation) with getter/setter for grace period checks. New decrementRotationSpikes() method decrements rotationSpikes by 1 if positive (gradual cooldown instead of instant reset). - Core — AbstractModule: blockExploit() applies uniform +1.0 heuristic weight regardless of module type: High-frequency limiter modules (piston-limiter, redstone-limiter, falling-block-limiter, explosion-limiter) fire hundreds of times per second during normal lag spikes, causing innocent players to accumulate suspicion rapidly. These modules now contribute +0.1 per block event; all other modules contribute +0.5 (was always +1.0).

Improvements

- Config — New `heuristic` section: Added a dedicated heuristic: block to config.yml (placed before external-services:) exposing all tunable thresholds: action, kick-threshold (150.0), max-rotation-speed (12.0), max-rotation-spikes (8), min-spike-interval-ms (150), min-click-samples (15), min-click-variance (5.0), max-avg-click-interval (100.0). These values were previously hard-coded in the engine; operators can now raise them on high-activity servers to further reduce false positives without touching the source.

Bug Fixes

- Velocity — HandshakeValidator: missing protocol IDs for 1.21.2–1.21.4: Protocol numbers 769 (1.21.4), 768 (1.21.3), and 767 (1.21.2) were absent from KNOWN_PROTOCOLS. With enforce-known-protocols: true, every legitimate 1.21.2+ client received a handshakeScore=50, which combined with other categories could trigger a false-positive kick. A new ek-protokoller config list allows adding future protocol numbers without a plugin update. - Velocity — BrandAnalyzer: unknown-brand false positives: Many widely-used clients were missing from the legitimate brand list (sodium, iris, fml,forge, fml, tlauncher, shiginima, pojav, meteor, wurst). With allow-unknown: false these players received an unnecessary brandScore=20. A new izinli-brandlar config list allows operators to add their own allowed brands. - Velocity — ConnectionListener.onBrand() race condition: PlayerClientBrandEvent can fire before LoginEvent, meaning isVerified(ip) returns false at brand-check time even for legitimate players. If the player already has a backend server connection (getCurrentServer().isPresent()), the handler now calls markVerified(ip) and returns immediately instead of scoring and potentially kicking. - Velocity — VelocityAntiBotModule: NicknameBlocker sets all 7 score categories to 100: When a blocked nickname was detected, all categories (connectionRate, handshake, brand, joinPattern, geo, protocol) were forced to 100 in addition to username. This produced misleading audit logs and inflated flagCount, bypassing the single-category 60 % penalty in ThreatScore.calculate(). Now only usernameScore=100 is set; flagCount stays at 1 and the penalty is applied correctly. - Velocity — recordBrand() double analyze clears previous scores: recordBrand() called a full engine.analyze() as a second pass, which triggered resetForNewAnalysis() and wiped all scores built by the initial analyzePreLogin(). Brand is now applied via the new BotDetectionEngine.updateBrandScore() method, which sets brandScore and calls calculate() without resetting other categories. - Velocity — IPReputationEngine: grace-period race condition: Two concurrent pipeline checks for the same IP could both pass the 3-violation grace period by reading violations.get() before either had incremented. The violation counter is now incremented atomically at the top of addContextualScore() and the method returns early if the IP is still within the grace window, preventing any score accumulation or downstream ban checks during the grace period. - Velocity — PlayerBehaviorProfile: username-diversity penalty on offline-mode servers: The trust score applied a −20 penalty when more than 3 different usernames were seen from the same IP. On offline-mode servers (cracked launchers, multiple household accounts) this is completely normal behaviour. The threshold is raised to 6 unique usernames, the penalty reduced to −10, and a new offlineModeLenient flag disables the penalty entirely when set. - Velocity — LatencyCheckModule: fast-login threshold too aggressive: The default minimum handshake-to-login duration was 15 ms, which caused false kicks for players connecting from the same data centre or through a local proxy. Default lowered to 5 ms. - Core — HeuristicEngine: high-DPI mouse users flagged for rotation speed: Default max-rotation-speed raised from 5.0 to 8.0 degrees/ms, and max-rotation-spikes raised from 3 to 5. A new min-spike-interval-ms guard (default 100 ms) ensures that rapid successive packets at high FPS are counted as at most one spike per interval, preventing false suspicion accumulation from legitimate 360° PvP movement.

Bug Fixes

- Velocity — HandshakeValidator: missing protocol IDs for 1.21.2–1.21.4: Protocol numbers 769 (1.21.4), 768 (1.21.3), and 767 (1.21.2) were absent from KNOWN_PROTOCOLS. With enforce-known-protocols: true, every legitimate 1.21.2+ client received a handshakeScore=50, which combined with other categories could trigger a false-positive kick. A new ek-protokoller config list allows adding future protocol numbers without a plugin update. - Velocity — BrandAnalyzer: unknown-brand false positives: Many widely-used clients were missing from the legitimate brand list (sodium, iris, fml,forge, fml, tlauncher, shiginima, pojav, meteor, wurst). With allow-unknown: false these players received an unnecessary brandScore=20. A new izinli-brandlar config list allows operators to add their own allowed brands. - Velocity — ConnectionListener.onBrand() race condition: PlayerClientBrandEvent can fire before LoginEvent, meaning isVerified(ip) returns false at brand-check time even for legitimate players. If the player already has a backend server connection (getCurrentServer().isPresent()), the handler now calls markVerified(ip) and returns immediately instead of scoring and potentially kicking. - Velocity — VelocityAntiBotModule: NicknameBlocker sets all 7 score categories to 100: When a blocked nickname was detected, all categories (connectionRate, handshake, brand, joinPattern, geo, protocol) were forced to 100 in addition to username. This produced misleading audit logs and inflated flagCount, bypassing the single-category 60 % penalty in ThreatScore.calculate(). Now only usernameScore=100 is set; flagCount stays at 1 and the penalty is applied correctly. - Velocity — recordBrand() double analyze clears previous scores: recordBrand() called a full engine.analyze() as a second pass, which triggered resetForNewAnalysis() and wiped all scores built by the initial analyzePreLogin(). Brand is now applied via the new BotDetectionEngine.updateBrandScore() method, which sets brandScore and calls calculate() without resetting other categories. - Velocity — IPReputationEngine: grace-period race condition: Two concurrent pipeline checks for the same IP could both pass the 3-violation grace period by reading violations.get() before either had incremented. The violation counter is now incremented atomically at the top of addContextualScore() and the method returns early if the IP is still within the grace window, preventing any score accumulation or downstream ban checks during the grace period. - Velocity — PlayerBehaviorProfile: username-diversity penalty on offline-mode servers: The trust score applied a −20 penalty when more than 3 different usernames were seen from the same IP. On offline-mode servers (cracked launchers, multiple household accounts) this is completely normal behaviour. The threshold is raised to 6 unique usernames, the penalty reduced to −10, and a new offlineModeLenient flag disables the penalty entirely when set. - Velocity — LatencyCheckModule: fast-login threshold too aggressive: The default minimum handshake-to-login duration was 15 ms, which caused false kicks for players connecting from the same data centre or through a local proxy. Default lowered to 5 ms. - Core — HeuristicEngine: high-DPI mouse users flagged for rotation speed: Default max-rotation-speed raised from 5.0 to 8.0 degrees/ms, and max-rotation-spikes raised from 3 to 5. A new min-spike-interval-ms guard (default 100 ms) ensures that rapid successive packets at high FPS are counted as at most one spike per interval, preventing false suspicion accumulation from legitimate 360° PvP movement.

Bug Fixes

- Core — OfflinePacketModule auto-disable when no auth plugin detected: If no known auth plugin (AuthMe, nLogin, OpeNLogin, LoginSecurity, JPremium, FastLogin, LimboAuth) is found at startup, OfflinePacketModule and AuthListener are no longer loaded. This was the root cause of players getting "timed out" on servers with custom login plugins. Can be force-enabled via modules.offline-packet.zorla-aktif: true. - Core — OfflinePacketModule KEEP_ALIVE/PONG packet exemption: KEEP_ALIVE, PONG, CLIENT_SETTINGS, RESOURCE_PACK_STATUS, and PLUGIN_MESSAGE packets are now unconditionally exempted from all checks. Previously, these connection-critical packets could be cancelled after the grace period expired, causing the server to think the player was unresponsive and kicking them for timeout. - Core — OfflinePacketModule grace period check order fixed: Grace period check now runs BEFORE IP validation. Previously, an IP mismatch (e.g. IPv4/IPv6 dual-stack) would cancel all packets including KEEP_ALIVE even during the grace period, because the IP check ran first. - Core — OfflinePacketModule IPv4/IPv6 IP comparison fix: IP validation now uses getHostAddress() string comparison instead of InetAddress.equals(), which fails on dual-stack connections (e.g. 127.0.0.1 vs ::ffff:127.0.0.1). - Core — AdvancedChatModule grace period bypass: Chat rate limiting and spam detection now skip players in the auth grace period, preventing chat blocks during the login process.

Improvements

- Config — offline-packet.tolerance-ms: Default increased from 30000ms (30s) to 60000ms (60s) to accommodate slower auth flows. - Config — offline-packet.zorla-aktif: New config key (default: false) to force-enable OfflinePacketModule even when no known auth plugin is detected.

Bug Fixes

- Core — OfflinePacketModule auto-disable when no auth plugin detected: If no known auth plugin (AuthMe, nLogin, OpeNLogin, LoginSecurity, JPremium, FastLogin, LimboAuth) is found at startup, OfflinePacketModule and AuthListener are no longer loaded. This was the root cause of players getting "timed out" on servers with custom login plugins. Can be force-enabled via modules.offline-packet.zorla-aktif: true. - Core — OfflinePacketModule KEEP_ALIVE/PONG packet exemption: KEEP_ALIVE, PONG, CLIENT_SETTINGS, RESOURCE_PACK_STATUS, and PLUGIN_MESSAGE packets are now unconditionally exempted from all checks. Previously, these connection-critical packets could be cancelled after the grace period expired, causing the server to think the player was unresponsive and kicking them for timeout. - Core — OfflinePacketModule grace period check order fixed: Grace period check now runs BEFORE IP validation. Previously, an IP mismatch (e.g. IPv4/IPv6 dual-stack) would cancel all packets including KEEP_ALIVE even during the grace period, because the IP check ran first. - Core — OfflinePacketModule IPv4/IPv6 IP comparison fix: IP validation now uses getHostAddress() string comparison instead of InetAddress.equals(), which fails on dual-stack connections (e.g. 127.0.0.1 vs ::ffff:127.0.0.1). - Core — AdvancedChatModule grace period bypass: Chat rate limiting and spam detection now skip players in the auth grace period, preventing chat blocks during the login process.

Improvements

- Config — offline-packet.tolerance-ms: Default increased from 30000ms (30s) to 60000ms (60s) to accommodate slower auth flows. - Config — offline-packet.zorla-aktif: New config key (default: false) to force-enable OfflinePacketModule even when no known auth plugin is detected.

Hata Düzeltmeleri

- Core — VerificationManager tick sayacı düzeltildi: Timer periyodu 40→20 tick'e düşürüldü; cycleCounter eklendi. ticksSinceJoin artık gerçek saniyeyle 1:1 eşleşiyor (önceki versiyonda 40x yavaştı; whitelist'e ulaşmak 20 dakika sürüyordu). - Core — PlayerProfile client brand gerçekten okunuyor: recordPluginMessage() artık minecraft:brand paketinin payload'ını VarInt prefix ile doğru parse ediyor. Configuration phase (WrapperConfigClientPluginMessage) ve Play phase ayrı ayrı handle ediliyor. Önceki versiyonda brand her zaman "unknown" döndürüyordu. - Core — PlayerProfile volatile eksikliği giderildi: protocolVersion, clientBrand, handshakeHostname field'larına volatile eklendi (Netty thread'inde yazılır, async timer thread'inde okunur). - Core — KeepAlive ID bazlı eşleşme: recordKeepAliveSent() / recordKeepAliveResponse() artık KeepAlive ID'sini kullanıyor. Önceki tek-timestamp yaklaşımı 0ms response time üretiyor ve +20 puan yazıyordu. - Core — AntiBotModule getOrCreateProfile race condition: Pre-login'de IP profili oluşturuluyordu; Login'de UUID ile farklı profil açılıyordu. CLIENT_SETTINGS IP profilinde kalıyor, UUID profilinde yoktu → +15 puan. Artık UUID geldiğinde IP profili birleştiriliyor. - Core — AttackTracker unique IP kontrolü: Saldırı tespiti artık hem bağlantı sayısını hem de farklı IP sayısını kontrol ediyor (attack-mode.min-unique-ips, varsayılan: 10). Tek IP'den gelen 30 bağlantı artık saldırı olarak algılanmıyor. - Core — GravityCheck TPS 19-20 edge case: Kademeli tolerans hesaplaması eklendi (tps < 20.0 için lineer lagFactor). Önceki versiyonda yalnızca tps < 19.0 koşulu vardı; 19-20 arası TPS'de false positive oluşuyordu. - Core — PostJoinBehaviorCheck mantık hatası: Sohbet eden oyuncu muafiyeti düzeltildi (önceden dead code'du). AFK oyuncular artık cezalandırılmıyor; check yalnızca etkileşim olmayan ve hareketsiz oyuncuları puanlıyor. Maksimum skor 25→10'a düşürüldü. - Core — WhitelistManager ulaşılamaz eşikler: verify-timeout-ticks 600→300, max-verify-score 15→25. Position packet zorunluluğu kaldırıldı (auth plugin altında hareket edilemiyor; client settings yeterli). - Core — PacketTimingCheck variance eşiği: Variance eşiği 0.1 ms²→5.0 ms² (önceki değer pratikte hiç tetiklenmiyordu). - Core — ConnectionRateCheck online oyuncu: firstJoinTime > 0 ise erken dönüş eklendi; sunucuda aktif oyuncuya gereksiz bağlantı hızı puanı verilmiyordu. - Core — ConfigManager NETWORK_MODULE_NAMES: "bot-protection" eklendi; eski BotProtectionModule ağ koruma kontrolünden hariç tutuluyordu.

İyileştirmeler

- Config — Score eşikleri yükseltildi: allow: 40→45, delay: 70→75, kick: 90→100, blacklist: 120→150 (false positive sonrası bant genişletme). - Config — AttackMode: shutdown-seconds 30→60; min-unique-ips: 10 yeni ayar eklendi. - Config — Whitelist: verify-timeout-ticks: 300, max-verify-score: 25. - Config — Gravity: min-data-count 8→10; min-interval-ms 30→25; max-interval-ms 150→200; min-keepalive-ms 2→1. - Config — PostJoinBehavior: analysis-ticks 1200→600 (tick düzeltmesi sonrası gerçek anlamı aynı: 10 dakika).

Hata Düzeltmeleri

- Core — VerificationManager tick sayacı düzeltildi: Timer periyodu 40→20 tick'e düşürüldü; cycleCounter eklendi. ticksSinceJoin artık gerçek saniyeyle 1:1 eşleşiyor (önceki versiyonda 40x yavaştı; whitelist'e ulaşmak 20 dakika sürüyordu). - Core — PlayerProfile client brand gerçekten okunuyor: recordPluginMessage() artık minecraft:brand paketinin payload'ını VarInt prefix ile doğru parse ediyor. Configuration phase (WrapperConfigClientPluginMessage) ve Play phase ayrı ayrı handle ediliyor. Önceki versiyonda brand her zaman "unknown" döndürüyordu. - Core — PlayerProfile volatile eksikliği giderildi: protocolVersion, clientBrand, handshakeHostname field'larına volatile eklendi (Netty thread'inde yazılır, async timer thread'inde okunur). - Core — KeepAlive ID bazlı eşleşme: recordKeepAliveSent() / recordKeepAliveResponse() artık KeepAlive ID'sini kullanıyor. Önceki tek-timestamp yaklaşımı 0ms response time üretiyor ve +20 puan yazıyordu. - Core — AntiBotModule getOrCreateProfile race condition: Pre-login'de IP profili oluşturuluyordu; Login'de UUID ile farklı profil açılıyordu. CLIENT_SETTINGS IP profilinde kalıyor, UUID profilinde yoktu → +15 puan. Artık UUID geldiğinde IP profili birleştiriliyor. - Core — AttackTracker unique IP kontrolü: Saldırı tespiti artık hem bağlantı sayısını hem de farklı IP sayısını kontrol ediyor (attack-mode.min-unique-ips, varsayılan: 10). Tek IP'den gelen 30 bağlantı artık saldırı olarak algılanmıyor. - Core — GravityCheck TPS 19-20 edge case: Kademeli tolerans hesaplaması eklendi (tps < 20.0 için lineer lagFactor). Önceki versiyonda yalnızca tps < 19.0 koşulu vardı; 19-20 arası TPS'de false positive oluşuyordu. - Core — PostJoinBehaviorCheck mantık hatası: Sohbet eden oyuncu muafiyeti düzeltildi (önceden dead code'du). AFK oyuncular artık cezalandırılmıyor; check yalnızca etkileşim olmayan ve hareketsiz oyuncuları puanlıyor. Maksimum skor 25→10'a düşürüldü. - Core — WhitelistManager ulaşılamaz eşikler: verify-timeout-ticks 600→300, max-verify-score 15→25. Position packet zorunluluğu kaldırıldı (auth plugin altında hareket edilemiyor; client settings yeterli). - Core — PacketTimingCheck variance eşiği: Variance eşiği 0.1 ms²→5.0 ms² (önceki değer pratikte hiç tetiklenmiyordu). - Core — ConnectionRateCheck online oyuncu: firstJoinTime > 0 ise erken dönüş eklendi; sunucuda aktif oyuncuya gereksiz bağlantı hızı puanı verilmiyordu. - Core — ConfigManager NETWORK_MODULE_NAMES: "bot-protection" eklendi; eski BotProtectionModule ağ koruma kontrolünden hariç tutuluyordu.

İyileştirmeler

- Config — Score eşikleri yükseltildi: allow: 40→45, delay: 70→75, kick: 90→100, blacklist: 120→150 (false positive sonrası bant genişletme). - Config — AttackMode: shutdown-seconds 30→60; min-unique-ips: 10 yeni ayar eklendi. - Config — Whitelist: verify-timeout-ticks: 300, max-verify-score: 25. - Config — Gravity: min-data-count 8→10; min-interval-ms 30→25; max-interval-ms 150→200; min-keepalive-ms 2→1. - Config — PostJoinBehavior: analysis-ticks 1200→600 (tick düzeltmesi sonrası gerçek anlamı aynı: 10 dakika).

Yeni Özellikler

- Core — Özel Login Plugini Uyumluluğu: AtomGuard artık herhangi bir özel login plugini ile tam uyumlu. AuthListener.markAuthenticated(UUID) API'si üzerinden login plugin'leri auth tamamlandığında AtomGuard'a bildirimde bulunabilir. - Core — Auth Grace Period (AntiBotModule): Auth bekleyen oyuncular artık bot olarak puanlanmıyor. modules.anti-bot.checks.auth-grace-period-ms (varsayılan: 120 saniye) süresince ThreatScoreCalculator auth bekleyen oyuncuyu serbest geçiriyor. - Core — AtomGuard.getAuthListener(): AuthListener instance'ı artık dışarıdan erişilebilir. Login pluginleri AtomGuard.getInstance().getAuthListener().markAuthenticated(uuid) ile auth tamamlandığını bildirebilir. - Core — PlayerProfile.markAuthenticated(): AntiBotModule player profiline auth durumu eklendi. Auth tamamlandığında profil işaretleniyor; tüm periyodik threat evaluation'lar bu durumu görerek skor hesaplamayı atlıyor.

İyileştirmeler

- Core — TokenBucketModule grace period muafiyeti: Auth grace period'u aktif oyunculara movement paketleri de dahil olmak üzere hiçbir rate limit uygulanmıyor (önceki versiyonda yalnızca komut paketleri muaftı, hareket paketleri cezalandırılıyordu). - Core — HeuristicEngine auth muafiyeti: PacketListener.handleLegacyIncoming() artık auth grace period içindeki oyuncuların rotation/animation analizini atlıyor. Login ekranında fare hareketi artık yanlışlıkla suspicion olarak birikmiyor. - Core — VerifiedPlayerCache auth öncesi koruma: Grace period bittiğinde oyuncu hâlâ auth bekliyor olabilir. BukkitListener artık auth tamamlanmadan oyuncuyu "verified" olarak işaretlemiyor; tamamlanmamışsa +30 saniye daha bekleyerek ikinci kontrol yapıyor. - Core — AntiBotModule.getPlayerProfile(): PlayerProfile nesnesi artık dışarıdan erişilebilir public getter ile sunuluyor. - Core — OfflinePacketModule auth komut listesi genişletildi: Varsayılan fallback listesine /sifre, /şifre, /auth, /2fa, /totp, /pin eklendi. - Core — config.yml: modules.anti-bot.checks.auth-grace-period-ms ayarı eklendi (varsayılan: 120000 ms = 2 dakika).

Yeni Özellikler

- Core — Özel Login Plugini Uyumluluğu: AtomGuard artık herhangi bir özel login plugini ile tam uyumlu. AuthListener.markAuthenticated(UUID) API'si üzerinden login plugin'leri auth tamamlandığında AtomGuard'a bildirimde bulunabilir. - Core — Auth Grace Period (AntiBotModule): Auth bekleyen oyuncular artık bot olarak puanlanmıyor. modules.anti-bot.checks.auth-grace-period-ms (varsayılan: 120 saniye) süresince ThreatScoreCalculator auth bekleyen oyuncuyu serbest geçiriyor. - Core — AtomGuard.getAuthListener(): AuthListener instance'ı artık dışarıdan erişilebilir. Login pluginleri AtomGuard.getInstance().getAuthListener().markAuthenticated(uuid) ile auth tamamlandığını bildirebilir. - Core — PlayerProfile.markAuthenticated(): AntiBotModule player profiline auth durumu eklendi. Auth tamamlandığında profil işaretleniyor; tüm periyodik threat evaluation'lar bu durumu görerek skor hesaplamayı atlıyor.

İyileştirmeler

- Core — TokenBucketModule grace period muafiyeti: Auth grace period'u aktif oyunculara movement paketleri de dahil olmak üzere hiçbir rate limit uygulanmıyor (önceki versiyonda yalnızca komut paketleri muaftı, hareket paketleri cezalandırılıyordu). - Core — HeuristicEngine auth muafiyeti: PacketListener.handleLegacyIncoming() artık auth grace period içindeki oyuncuların rotation/animation analizini atlıyor. Login ekranında fare hareketi artık yanlışlıkla suspicion olarak birikmiyor. - Core — VerifiedPlayerCache auth öncesi koruma: Grace period bittiğinde oyuncu hâlâ auth bekliyor olabilir. BukkitListener artık auth tamamlanmadan oyuncuyu "verified" olarak işaretlemiyor; tamamlanmamışsa +30 saniye daha bekleyerek ikinci kontrol yapıyor. - Core — AntiBotModule.getPlayerProfile(): PlayerProfile nesnesi artık dışarıdan erişilebilir public getter ile sunuluyor. - Core — OfflinePacketModule auth komut listesi genişletildi: Varsayılan fallback listesine /sifre, /şifre, /auth, /2fa, /totp, /pin eklendi. - Core — config.yml: modules.anti-bot.checks.auth-grace-period-ms ayarı eklendi (varsayılan: 120000 ms = 2 dakika).

Hata Düzeltmeleri

- Core — Login/Timeout sorunu düzeltildi: TokenBucketModule artık auth komutlarını rate limit'lemiyor. CHAT_COMMAND paketleri ayrı KOMUT kovasına yönlendirildi. Auth komut listesi modules.token-bucket.auth-exempt-commands ile özelleştirilebilir. - Core — KeepAlive paketleri artık asla engellenmez: PacketDelayModule ve PacketExploitModule, KEEP_ALIVE ve PONG paketlerini bypass ediyor. - Core — Grace period 30 saniyeye çıkarıldı: Auth komutu algılandığında grace period otomatik yenilenir; auth tamamlandığında anında biter. - Core — Auth sistemi tamamen plugin-agnostic: AuthMe hard-dependency kaldırıldı. AuthListener generic yeniden yazıldı — herhangi bir login plugini ile çalışır. - Core — PacketExploitModule race condition düzeltildi: Tür bazlı sayaçlarda HashMap → ConcurrentHashMap (Netty thread güvenliği). - Core — CustomPayloadModule çifte kayıt kaldırıldı: AdvancedPayloadModule zaten aynı işlevi kapsıyor; eski modülün kaydı registerModules()'den silindi. - Core — `atomguard:auth` kanalı whitelist'e eklendi: AdvancedPayloadModule artık atomguard: prefix'li kanalları engellemez; CorePasswordCheckModule çalışıyor. - Core — NettyCrashHandler false positive düzeltildi: "buffer" ve "index" tek başına crash tespiti tetiklemiyor; "buffer overflow" ve "index out of bounds" olarak daraltıldı. - Core — VerifiedPlayerCache zamanlaması düzeltildi: Oyuncu artık grace period dolmadan verified olarak işaretlenmiyor (BukkitListener geciktirildi). - Velocity — Auth komut rate limiti düzeltildi: CommandFloodBlocker'da login/register komutları artık 2 token değil, tamamen muaf tutuluyor.

İyileştirmeler

- Core — Unicode crash filtresi daraltıldı: AdvancedChatModule artık Arapça, İbranice, Korece ve CJK karakterlerini engellemiyor; yalnızca gerçek crash vektörü olan Unicode yön kontrol karakterleri filtreleniyor. - Core — SmartLagModule chunk tarama optimizasyonu: Lag spike'ta tüm chunk'lar yerine rastgele %20 örnekleme yapılıyor; maksimum 10 chunk freeze limiti eklendi. - Core — `PacketExploitModule` CHAT_COMMAND limiti eklendi: Type-based limitlerde CHAT_COMMAND: 30/s varsayılanı eklendi. - Config — Yeni ayarlar: - modules.token-bucket.auth-exempt-commands - modules.token-bucket.buckets.command.kapasite (varsayılan: 50) - modules.token-bucket.buckets.command.dolum-saniye (varsayılan: 20) - modules.offline-packet.auth-commands - modules.offline-packet.tolerance-ms varsayılanı 5000 → 30000 - modules.packet-exploit.type-limits.CHAT_COMMAND (varsayılan: 30)

Hata Düzeltmeleri

- Core — Login/Timeout sorunu düzeltildi: TokenBucketModule artık auth komutlarını rate limit'lemiyor. CHAT_COMMAND paketleri ayrı KOMUT kovasına yönlendirildi. Auth komut listesi modules.token-bucket.auth-exempt-commands ile özelleştirilebilir. - Core — KeepAlive paketleri artık asla engellenmez: PacketDelayModule ve PacketExploitModule, KEEP_ALIVE ve PONG paketlerini bypass ediyor. - Core — Grace period 30 saniyeye çıkarıldı: Auth komutu algılandığında grace period otomatik yenilenir; auth tamamlandığında anında biter. - Core — Auth sistemi tamamen plugin-agnostic: AuthMe hard-dependency kaldırıldı. AuthListener generic yeniden yazıldı — herhangi bir login plugini ile çalışır. - Core — PacketExploitModule race condition düzeltildi: Tür bazlı sayaçlarda HashMap → ConcurrentHashMap (Netty thread güvenliği). - Core — CustomPayloadModule çifte kayıt kaldırıldı: AdvancedPayloadModule zaten aynı işlevi kapsıyor; eski modülün kaydı registerModules()'den silindi. - Core — `atomguard:auth` kanalı whitelist'e eklendi: AdvancedPayloadModule artık atomguard: prefix'li kanalları engellemez; CorePasswordCheckModule çalışıyor. - Core — NettyCrashHandler false positive düzeltildi: "buffer" ve "index" tek başına crash tespiti tetiklemiyor; "buffer overflow" ve "index out of bounds" olarak daraltıldı. - Core — VerifiedPlayerCache zamanlaması düzeltildi: Oyuncu artık grace period dolmadan verified olarak işaretlenmiyor (BukkitListener geciktirildi). - Velocity — Auth komut rate limiti düzeltildi: CommandFloodBlocker'da login/register komutları artık 2 token değil, tamamen muaf tutuluyor.

İyileştirmeler

- Core — Unicode crash filtresi daraltıldı: AdvancedChatModule artık Arapça, İbranice, Korece ve CJK karakterlerini engellemiyor; yalnızca gerçek crash vektörü olan Unicode yön kontrol karakterleri filtreleniyor. - Core — SmartLagModule chunk tarama optimizasyonu: Lag spike'ta tüm chunk'lar yerine rastgele %20 örnekleme yapılıyor; maksimum 10 chunk freeze limiti eklendi. - Core — `PacketExploitModule` CHAT_COMMAND limiti eklendi: Type-based limitlerde CHAT_COMMAND: 30/s varsayılanı eklendi. - Config — Yeni ayarlar: - modules.token-bucket.auth-exempt-commands - modules.token-bucket.buckets.command.kapasite (varsayılan: 50) - modules.token-bucket.buckets.command.dolum-saniye (varsayılan: 20) - modules.offline-packet.auth-commands - modules.offline-packet.tolerance-ms varsayılanı 5000 → 30000 - modules.packet-exploit.type-limits.CHAT_COMMAND (varsayılan: 30)

Yeni Özellikler

-

İyileştirmeler

-

Hata Düzeltmeleri

-

Yeni Özellikler

-

İyileştirmeler

-

Hata Düzeltmeleri

-

Hata Düzeltmeleri

- Core — Tek oyuncu saldırı modu yanlış tetiklemesi düzeltildi: AttackModeManager artık hem hız eşiğini (threshold) hem de benzersiz IP sayısını (min-unique-ips, varsayılan: 10) kontrol ediyor. Tek bir oyuncunun hızlı çık/gir yapması artık saldırı modunu tetikleyemiyor. - Velocity — Aynı düzeltme: SynFloodDetector, benzersiz IP sayısı min-unique-ips altındaysa effectiveCps=0 gönderiyor; AttackLevelManager NONE seviyesinde kalıyor. DDoSProtectionModule.checkConnection() artık IP'yi recordConnection(ip) ile iletiyor.

İyileştirmeler

- Yeni config ayarı: attack-mode.min-unique-ips (core) ve ddos-protection.attack-mode.min-unique-ips (velocity) — varsayılan 10

Hata Düzeltmeleri

- Core — Tek oyuncu saldırı modu yanlış tetiklemesi düzeltildi: AttackModeManager artık hem hız eşiğini (threshold) hem de benzersiz IP sayısını (min-unique-ips, varsayılan: 10) kontrol ediyor. Tek bir oyuncunun hızlı çık/gir yapması artık saldırı modunu tetikleyemiyor. - Velocity — Aynı düzeltme: SynFloodDetector, benzersiz IP sayısı min-unique-ips altındaysa effectiveCps=0 gönderiyor; AttackLevelManager NONE seviyesinde kalıyor. DDoSProtectionModule.checkConnection() artık IP'yi recordConnection(ip) ile iletiyor.

İyileştirmeler

- Yeni config ayarı: attack-mode.min-unique-ips (core) ve ddos-protection.attack-mode.min-unique-ips (velocity) — varsayılan 10

Dev Build #53 - [b400e0f](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b400e0f9… Add Modrinth badge and link to README [skip ci] (ATOMGAMERAGA) - [4219881](https://github.com/ATOMGAMERAGA/AtomGuard/commit/4219881c… Update README to English with v2.0 features [skip ci] (ATOMGAMERAGA) - [67fd400](https://github.com/ATOMGAMERAGA/AtomGuard/commit/67fd400a… Release v2.0.2 — Full Turkish → English config translation (ATOMGAMERAGA) - [dceb1b6](https://github.com/ATOMGAMERAGA/AtomGuard/commit/dceb1b6d… Release v2.0.1 — Velocity Timed Out düzeltmesi (ATOMGAMERAGA) - [80a4b8d](https://github.com/ATOMGAMERAGA/AtomGuard/commit/80a4b8d3… Release v2.0.0 — Major release (ATOMGAMERAGA) - [3880888](https://github.com/ATOMGAMERAGA/AtomGuard/commit/3880888c… Release v1.2.9 — FrameCrashModule EntityRemoveEvent chunk crash fix (ATOMGAMERAGA) - [bc5bdeb](https://github.com/ATOMGAMERAGA/AtomGuard/commit/bc5bdebd… Release v1.2.8 — ThreatScoreChangedEvent async fix (ATOMGAMERAGA) - [dffd9c3](https://github.com/ATOMGAMERAGA/AtomGuard/commit/dffd9c38… Release v1.2.7 (ATOMGAMERAGA) - [2e6e8b2](https://github.com/ATOMGAMERAGA/AtomGuard/commit/2e6e8b20… Release v1.2.6 — kod kalitesi & 32 hata düzeltmesi (ATOMGAMERAGA) - [90937d3](https://github.com/ATOMGAMERAGA/AtomGuard/commit/90937d3d… fix(bump): CHANGELOG.md'ye tek bölüm ekleme hatası düzeltildi (ATOMGAMERAGA)

Dev Build #53 - [b400e0f](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b400e0f9… Add Modrinth badge and link to README [skip ci] (ATOMGAMERAGA) - [4219881](https://github.com/ATOMGAMERAGA/AtomGuard/commit/4219881c… Update README to English with v2.0 features [skip ci] (ATOMGAMERAGA) - [67fd400](https://github.com/ATOMGAMERAGA/AtomGuard/commit/67fd400a… Release v2.0.2 — Full Turkish → English config translation (ATOMGAMERAGA) - [dceb1b6](https://github.com/ATOMGAMERAGA/AtomGuard/commit/dceb1b6d… Release v2.0.1 — Velocity Timed Out düzeltmesi (ATOMGAMERAGA) - [80a4b8d](https://github.com/ATOMGAMERAGA/AtomGuard/commit/80a4b8d3… Release v2.0.0 — Major release (ATOMGAMERAGA) - [3880888](https://github.com/ATOMGAMERAGA/AtomGuard/commit/3880888c… Release v1.2.9 — FrameCrashModule EntityRemoveEvent chunk crash fix (ATOMGAMERAGA) - [bc5bdeb](https://github.com/ATOMGAMERAGA/AtomGuard/commit/bc5bdebd… Release v1.2.8 — ThreatScoreChangedEvent async fix (ATOMGAMERAGA) - [dffd9c3](https://github.com/ATOMGAMERAGA/AtomGuard/commit/dffd9c38… Release v1.2.7 (ATOMGAMERAGA) - [2e6e8b2](https://github.com/ATOMGAMERAGA/AtomGuard/commit/2e6e8b20… Release v1.2.6 — kod kalitesi & 32 hata düzeltmesi (ATOMGAMERAGA) - [90937d3](https://github.com/ATOMGAMERAGA/AtomGuard/commit/90937d3d… fix(bump): CHANGELOG.md'ye tek bölüm ekleme hatası düzeltildi (ATOMGAMERAGA)

Dev Build #52 - [4219881](https://github.com/ATOMGAMERAGA/AtomGuard/commit/4219881c… Update README to English with v2.0 features [skip ci] (ATOMGAMERAGA) - [67fd400](https://github.com/ATOMGAMERAGA/AtomGuard/commit/67fd400a… Release v2.0.2 — Full Turkish → English config translation (ATOMGAMERAGA) - [dceb1b6](https://github.com/ATOMGAMERAGA/AtomGuard/commit/dceb1b6d… Release v2.0.1 — Velocity Timed Out düzeltmesi (ATOMGAMERAGA) - [80a4b8d](https://github.com/ATOMGAMERAGA/AtomGuard/commit/80a4b8d3… Release v2.0.0 — Major release (ATOMGAMERAGA) - [3880888](https://github.com/ATOMGAMERAGA/AtomGuard/commit/3880888c… Release v1.2.9 — FrameCrashModule EntityRemoveEvent chunk crash fix (ATOMGAMERAGA) - [bc5bdeb](https://github.com/ATOMGAMERAGA/AtomGuard/commit/bc5bdebd… Release v1.2.8 — ThreatScoreChangedEvent async fix (ATOMGAMERAGA) - [dffd9c3](https://github.com/ATOMGAMERAGA/AtomGuard/commit/dffd9c38… Release v1.2.7 (ATOMGAMERAGA) - [2e6e8b2](https://github.com/ATOMGAMERAGA/AtomGuard/commit/2e6e8b20… Release v1.2.6 — kod kalitesi & 32 hata düzeltmesi (ATOMGAMERAGA) - [90937d3](https://github.com/ATOMGAMERAGA/AtomGuard/commit/90937d3d… fix(bump): CHANGELOG.md'ye tek bölüm ekleme hatası düzeltildi (ATOMGAMERAGA) - [c3eea91](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c3eea91f… Release v1.2.5 — kritik thread safety & başlatma sırası düzeltmeleri (ATOMGAMERAGA)

Dev Build #52 - [4219881](https://github.com/ATOMGAMERAGA/AtomGuard/commit/4219881c… Update README to English with v2.0 features [skip ci] (ATOMGAMERAGA) - [67fd400](https://github.com/ATOMGAMERAGA/AtomGuard/commit/67fd400a… Release v2.0.2 — Full Turkish → English config translation (ATOMGAMERAGA) - [dceb1b6](https://github.com/ATOMGAMERAGA/AtomGuard/commit/dceb1b6d… Release v2.0.1 — Velocity Timed Out düzeltmesi (ATOMGAMERAGA) - [80a4b8d](https://github.com/ATOMGAMERAGA/AtomGuard/commit/80a4b8d3… Release v2.0.0 — Major release (ATOMGAMERAGA) - [3880888](https://github.com/ATOMGAMERAGA/AtomGuard/commit/3880888c… Release v1.2.9 — FrameCrashModule EntityRemoveEvent chunk crash fix (ATOMGAMERAGA) - [bc5bdeb](https://github.com/ATOMGAMERAGA/AtomGuard/commit/bc5bdebd… Release v1.2.8 — ThreatScoreChangedEvent async fix (ATOMGAMERAGA) - [dffd9c3](https://github.com/ATOMGAMERAGA/AtomGuard/commit/dffd9c38… Release v1.2.7 (ATOMGAMERAGA) - [2e6e8b2](https://github.com/ATOMGAMERAGA/AtomGuard/commit/2e6e8b20… Release v1.2.6 — kod kalitesi & 32 hata düzeltmesi (ATOMGAMERAGA) - [90937d3](https://github.com/ATOMGAMERAGA/AtomGuard/commit/90937d3d… fix(bump): CHANGELOG.md'ye tek bölüm ekleme hatası düzeltildi (ATOMGAMERAGA) - [c3eea91](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c3eea91f… Release v1.2.5 — kritik thread safety & başlatma sırası düzeltmeleri (ATOMGAMERAGA)

Full English Translation

- Config keys renamed (Turkish → English) across all 40+ modules and all manager classes - Top-level sections renamed: moduller → modules, genel → general, istatistik → statistics, dogrulanmis-onbellek → verified-cache, metrikler → metrics, tehdit-istihbarati → threat-intelligence, guven-skoru → trust-score, adli-analiz → forensics, bildirimler → notifications, forensik → packet-forensics, harici-servisler → external-services - Module names translated: e.g. cok-fazla-kitap → too-many-books, paket-exploit → packet-exploit, bot-koruma → anti-bot, bal-kupu → honeypot, jeton-kovasi → token-bucket, and 40+ more - Common sub-keys translated: aktif → enabled, eylem → action, max-paket-boyutu → max-packet-size, and 100+ more - Velocity config translated: depolama → storage, bot-koruma → bot-protection, moduller → modules, all DDoS/VPN/firewall sub-keys - Default language changed: dil: "tr" → language: "en" (both core and velocity configs) - Hardcoded Turkish strings in Java source translated to English (AtomGuard.java, ForensicsManager, NettyCrashHandler, BukkitListener, ModuleManager, and others) - Migration step added (Migration_2_0_1_to_2_0_2) — automatically renames all Turkish config keys to English for existing installations - Config version bumped to 2.0.2

Full English Translation

- Config keys renamed (Turkish → English) across all 40+ modules and all manager classes - Top-level sections renamed: moduller → modules, genel → general, istatistik → statistics, dogrulanmis-onbellek → verified-cache, metrikler → metrics, tehdit-istihbarati → threat-intelligence, guven-skoru → trust-score, adli-analiz → forensics, bildirimler → notifications, forensik → packet-forensics, harici-servisler → external-services - Module names translated: e.g. cok-fazla-kitap → too-many-books, paket-exploit → packet-exploit, bot-koruma → anti-bot, bal-kupu → honeypot, jeton-kovasi → token-bucket, and 40+ more - Common sub-keys translated: aktif → enabled, eylem → action, max-paket-boyutu → max-packet-size, and 100+ more - Velocity config translated: depolama → storage, bot-koruma → bot-protection, moduller → modules, all DDoS/VPN/firewall sub-keys - Default language changed: dil: "tr" → language: "en" (both core and velocity configs) - Hardcoded Turkish strings in Java source translated to English (AtomGuard.java, ForensicsManager, NettyCrashHandler, BukkitListener, ModuleManager, and others) - Migration step added (Migration_2_0_1_to_2_0_2) — automatically renames all Turkish config keys to English for existing installations - Config version bumped to 2.0.2

Hata Düzeltmeleri

- Velocity — Oyuncu "Timed Out" sorunu düzeltildi: ConnectionListener.onPreLogin() artık EventTask.resumeWhenComplete() döndürüyor; önceki senkron process() çağrısı Velocity event executor thread'ini 5 saneye kadar blokluyordu (VPNCheck .get(3s) + AccountFirewallCheck .get(2s)). Bu blokaj Minecraft istemcisinin bağlantı zaman aşımına çarpmasına neden oluyordu - VPNCheck — blokaj kaldırıldı: checkAsync() override edildi; .get(3, TimeUnit.SECONDS) yerine .orTimeout(3, TimeUnit.SECONDS).exceptionally(...).thenApply(...) zinciri kullanılıyor - AccountFirewallCheck — blokaj kaldırıldı: checkAsync() override edildi; .get(2, TimeUnit.SECONDS) yerine .orTimeout(2, TimeUnit.SECONDS).exceptionally(...).thenApply(...) zinciri kullanılıyor

İyileştirmeler

- ConnectionCheck arayüzü: checkAsync(ctx) default metodu eklendi — tüm mevcut check'ler uyumluluk bozmadan CompletableFuture desteği kazandı - ConnectionPipeline: processAsync(ctx) metodu eklendi — check'leri sıralı CompletableFuture zinciri olarak çalıştırır, ilk reddedilen sonuçta kısa devre yapar

Hata Düzeltmeleri

- Velocity — Oyuncu "Timed Out" sorunu düzeltildi: ConnectionListener.onPreLogin() artık EventTask.resumeWhenComplete() döndürüyor; önceki senkron process() çağrısı Velocity event executor thread'ini 5 saneye kadar blokluyordu (VPNCheck .get(3s) + AccountFirewallCheck .get(2s)). Bu blokaj Minecraft istemcisinin bağlantı zaman aşımına çarpmasına neden oluyordu - VPNCheck — blokaj kaldırıldı: checkAsync() override edildi; .get(3, TimeUnit.SECONDS) yerine .orTimeout(3, TimeUnit.SECONDS).exceptionally(...).thenApply(...) zinciri kullanılıyor - AccountFirewallCheck — blokaj kaldırıldı: checkAsync() override edildi; .get(2, TimeUnit.SECONDS) yerine .orTimeout(2, TimeUnit.SECONDS).exceptionally(...).thenApply(...) zinciri kullanılıyor

İyileştirmeler

- ConnectionCheck arayüzü: checkAsync(ctx) default metodu eklendi — tüm mevcut check'ler uyumluluk bozmadan CompletableFuture desteği kazandı - ConnectionPipeline: processAsync(ctx) metodu eklendi — check'leri sıralı CompletableFuture zinciri olarak çalıştırır, ilk reddedilen sonuçta kısa devre yapar

Yeni Özellikler

- Genişletilmiş Public API: AtomGuardAPI artık ITrustService, IForensicsService, IConnectionPipeline arayüzlerini sunuyor; harici eklentiler güven skoru, adli kayıt ve bağlantı hattına erişebilir - Forensics Sistemi: ForensicsManager / PacketRecorder / RecordingSession — paket kayıt oturumları, saldırı anı anlık görüntüleri disk üzerine kaydediliyor - Traffic Intelligence Engine: AdaptiveThresholdManager, EWMADetector, IsolationForestDetector — adaptif eşik ve anomali tespiti - Notification Manager: NotificationManager — çok sağlayıcılı bildirim yönlendirme (Discord, konsol, custom) - Trust Score Manager: TrustScoreManager (ITrustService) — oyuncu başına güven puanı, tier sistemi, JSON kalıcılığı - Executor Manager: ExecutorManager — paylaşımlı thread pool yönetimi - Web Panel Yenilendi: JWT kimlik doğrulama (JWTAuthProvider, SessionManager), API handler'ları, middleware katmanı - Config Migration (Core): ConfigMigrationManager — 1.x → 2.0.0 otomatik yapılandırma göçü - Config Migration (Velocity): VelocityConfigMigrationManager — Velocity yapılandırma göçü - Velocity Bedrock Desteği: BedrockSupportModule — Bedrock oyuncu kimlik tespiti ve bot ayırt etme - Yeni API Olayları: NotificationSentEvent, PostVerificationEvent, PreConnectionCheckEvent, TrustScoreChangeEvent - IForensicsService / ITrustService API arayüzleri api modülüne eklendi - IConnectionPipeline API arayüzü api modülüne eklendi

İyileştirmeler

- HttpClientUtil: HttpURLConnection tabanlı yardımcı sınıf; IPReputationManager, DiscordWebhookManager, ExternalListFetcher, GeoIPUpdater tümü HttpClientUtil'e geçirildi - Caffeine Önbelleği: CooldownManager, PacketListener bypass cache, IPReputationManager API cache, WebPanel oran sınırlama — tüm el ile TTL yönetimi Caffeine ile değiştirildi - Bypass Cache Basitleştirildi: Cache<UUID, Boolean> Caffeine 10 dk TTL; Netty-safe, kilitsiz - Javadoc: AtomGuard, AbstractModule, PacketListener, ModuleManager, TrustScoreManager, ForensicsManager, NotificationManager — sınıf düzeyi İngilizce Javadoc eklendi - Hardcoded URL'ler kaldırıldı: Velocity VPN sağlayıcıları (ProxyCheckProvider, IPApiProvider, AbuseIPDBProvider, IPHubProvider) ve AccountFirewallModule Ashcon API URL'leri artık harici-servisler config bölümünden okunuyor - Statik Analiz Araçları: SpotBugs, PMD, Checkstyle, OWASP Dependency Check eklentileri parent POM'a eklendi (pluginManagement) - Build Süreci: GitHub Actions workflow güncellendi; Checkstyle doğrulaması CI'ya entegre edildi

Testler

- 92 core testi (TrustScoreManagerTest 21, HeuristicEngineTest 10, ConfigMigrationManagerTest 11, SessionManagerTest 10, JWTAuthProviderTest 10, vb.) - 51 velocity testi (BedrockSupportModuleTest 21, VPNResultCacheTest 12, ConnectionPipelineTest 12, vb.) - Yeni testler (bu sürüm): ThreatScoreCalculatorTest, PacketTimingCheckTest, PingHandshakeCheckTest, PostJoinBehaviorCheckTest, ProtocolCheckTest, UsernamePatternCheckTest, RateLimiterTest (velocity), WhitelistManagerTest (velocity), AttackLevelManagerTest (velocity) - Toplam: 266 test, 0 hata

Hata Düzeltmeleri

- @Override eksiklikleri giderildi: Velocity LatencyCheckModule, CountryFilterModule, ReconnectControlModule — onEnable()/onDisable() üzerindeki @Override etiketleri zaten mevcuttu, doğrulandı

Yeni Özellikler

- Genişletilmiş Public API: AtomGuardAPI artık ITrustService, IForensicsService, IConnectionPipeline arayüzlerini sunuyor; harici eklentiler güven skoru, adli kayıt ve bağlantı hattına erişebilir - Forensics Sistemi: ForensicsManager / PacketRecorder / RecordingSession — paket kayıt oturumları, saldırı anı anlık görüntüleri disk üzerine kaydediliyor - Traffic Intelligence Engine: AdaptiveThresholdManager, EWMADetector, IsolationForestDetector — adaptif eşik ve anomali tespiti - Notification Manager: NotificationManager — çok sağlayıcılı bildirim yönlendirme (Discord, konsol, custom) - Trust Score Manager: TrustScoreManager (ITrustService) — oyuncu başına güven puanı, tier sistemi, JSON kalıcılığı - Executor Manager: ExecutorManager — paylaşımlı thread pool yönetimi - Web Panel Yenilendi: JWT kimlik doğrulama (JWTAuthProvider, SessionManager), API handler'ları, middleware katmanı - Config Migration (Core): ConfigMigrationManager — 1.x → 2.0.0 otomatik yapılandırma göçü - Config Migration (Velocity): VelocityConfigMigrationManager — Velocity yapılandırma göçü - Velocity Bedrock Desteği: BedrockSupportModule — Bedrock oyuncu kimlik tespiti ve bot ayırt etme - Yeni API Olayları: NotificationSentEvent, PostVerificationEvent, PreConnectionCheckEvent, TrustScoreChangeEvent - IForensicsService / ITrustService API arayüzleri api modülüne eklendi - IConnectionPipeline API arayüzü api modülüne eklendi

İyileştirmeler

- HttpClientUtil: HttpURLConnection tabanlı yardımcı sınıf; IPReputationManager, DiscordWebhookManager, ExternalListFetcher, GeoIPUpdater tümü HttpClientUtil'e geçirildi - Caffeine Önbelleği: CooldownManager, PacketListener bypass cache, IPReputationManager API cache, WebPanel oran sınırlama — tüm el ile TTL yönetimi Caffeine ile değiştirildi - Bypass Cache Basitleştirildi: Cache<UUID, Boolean> Caffeine 10 dk TTL; Netty-safe, kilitsiz - Javadoc: AtomGuard, AbstractModule, PacketListener, ModuleManager, TrustScoreManager, ForensicsManager, NotificationManager — sınıf düzeyi İngilizce Javadoc eklendi - Hardcoded URL'ler kaldırıldı: Velocity VPN sağlayıcıları (ProxyCheckProvider, IPApiProvider, AbuseIPDBProvider, IPHubProvider) ve AccountFirewallModule Ashcon API URL'leri artık harici-servisler config bölümünden okunuyor - Statik Analiz Araçları: SpotBugs, PMD, Checkstyle, OWASP Dependency Check eklentileri parent POM'a eklendi (pluginManagement) - Build Süreci: GitHub Actions workflow güncellendi; Checkstyle doğrulaması CI'ya entegre edildi

Testler

- 92 core testi (TrustScoreManagerTest 21, HeuristicEngineTest 10, ConfigMigrationManagerTest 11, SessionManagerTest 10, JWTAuthProviderTest 10, vb.) - 51 velocity testi (BedrockSupportModuleTest 21, VPNResultCacheTest 12, ConnectionPipelineTest 12, vb.) - Yeni testler (bu sürüm): ThreatScoreCalculatorTest, PacketTimingCheckTest, PingHandshakeCheckTest, PostJoinBehaviorCheckTest, ProtocolCheckTest, UsernamePatternCheckTest, RateLimiterTest (velocity), WhitelistManagerTest (velocity), AttackLevelManagerTest (velocity) - Toplam: 266 test, 0 hata

Hata Düzeltmeleri

- @Override eksiklikleri giderildi: Velocity LatencyCheckModule, CountryFilterModule, ReconnectControlModule — onEnable()/onDisable() üzerindeki @Override etiketleri zaten mevcuttu, doğrulandı

Hata Düzeltmeleri

- FrameCrashModule — EntityRemoveEvent chunk yükleme hatası düzeltildi: handleEntityRemoval() içinde entity.getLocation().getChunk() çağrısı, chunk unload sırasında IllegalStateException: Cannot update ticket level while unloading chunks hatasına yol açıyordu. getChunk() yerine Location koordinatlarından bit-shift ile chunk koordinatı hesaplayan ChunkKey.fromLocation() metoduna geçildi.

Hata Düzeltmeleri

- FrameCrashModule — EntityRemoveEvent chunk yükleme hatası düzeltildi: handleEntityRemoval() içinde entity.getLocation().getChunk() çağrısı, chunk unload sırasında IllegalStateException: Cannot update ticket level while unloading chunks hatasına yol açıyordu. getChunk() yerine Location koordinatlarından bit-shift ile chunk koordinatı hesaplayan ChunkKey.fromLocation() metoduna geçildi.

Hata Düzeltmeleri

- ThreatScoreChangedEvent async hatası düzeltildi: ThreatScoreCalculator, HeuristicEngine (Rotation Spike ve Low Click Variance) içindeki ThreatScoreChangedEvent çağrıları main thread yerine runTaskAsynchronously ile çağrılacak şekilde düzeltildi (Paper 1.21.4 IllegalStateException hatası giderildi)

Hata Düzeltmeleri

- ThreatScoreChangedEvent async hatası düzeltildi: ThreatScoreCalculator, HeuristicEngine (Rotation Spike ve Low Click Variance) içindeki ThreatScoreChangedEvent çağrıları main thread yerine runTaskAsynchronously ile çağrılacak şekilde düzeltildi (Paper 1.21.4 IllegalStateException hatası giderildi)

Yeni Özellikler

-

İyileştirmeler

-

Hata Düzeltmeleri

-

Yeni Özellikler

-

İyileştirmeler

-

Hata Düzeltmeleri

-

İyileştirmeler

- VelocityStorageProvider — Kod Tekrarı Giderildi: saveBehaviorProfile() ve saveBehaviorProfileSync() içindeki JSON inşa mantığı buildProfileJson() özel yardımcı metoduna taşındı; bakımı kolaylaştırıldı. - AttackSnapshot — Koleksiyon Optimizasyonu: Saldırı sırasında yoğun yazma yapılan timeline ve triggeredModules alanları CopyOnWriteArrayList'ten Collections.synchronizedList(new ArrayList<>()) türüne değiştirildi; GC baskısı azaltıldı. - ConfigManager — Gereksiz Değişken Kaldırıldı: loadMessages() içindeki anlamsız final String finalFileName = fileName ataması temizlendi; fileName doğrudan kullanılıyor.

Hata Düzeltmeleri

- VelocityStatisticsManager / TempBanManager — TOCTOU Yarış Koşulu: save() metodlarındaki Files.exists() ön kontrolü kaldırıldı; Files.createDirectories() doğrudan çağrılıyor (idempotent). Çok iş parçacıklı ortamda dizin oluşturma yarış koşulu giderildi. - WebPanel — Düz Metin Şifre Loglama: Varsayılan web panel şifresi artık loglara açık metin olarak yazılmıyor; yalnızca ilk 3 karakter ve maskelenmiş kısım gösteriliyor. - AtomGuard — `onDisable()` Kapatma Sırası: Modüller ve yöneticiler doğru sırayla kapatılıyor (modüller → yöneticiler → depolama → log); discordWebhookManager.stop(), PacketEvents listener unregister, outgoing/incoming plugin channel unregister eklendi. - RedisManager — Daemon Thread ve PubSub Takılması: PubSub thread'i daemon olarak işaretlendi; stop() artık activePubSub.unsubscribe() çağırarak JedisPubSub'ın subscribe() blokajını serbest bırakıyor. - AttackModeManager — Sayaç Sıfırlama Thread Safety: lastReset alanı volatile long'dan AtomicLong'a yükseltildi; recordConnection() CAS ile tek thread'in sıfırlama yapmasını garantiliyor. - PanicCommand / BukkitListener — Null Address NPE: Oyuncu IP adresi null kontrolü eklendi; bağlantı sırasında adresi henüz atanmamış oyuncularda NullPointerException önlendi. - ConnectionPipeline — ArrayList Yerine CopyOnWriteArrayList: Çok iş parçacıklı ortamda eş zamanlı okuma-yazma güvenliği sağlandı. - SmartLagModule — Watchdog Görev Sızıntısı: onEnable() içinde zamanlayıcı görev ID'si kaydediliyor; onDisable() bu ID ile cancelTask() çağırarak kaynakları doğru serbest bırakıyor. - CorePasswordCheckModule — DoS Güvenlik Açığı: 128 karakteri aşan şifreler için SHA-256 hesaplaması artık yapılmıyor; uzun girdilerle hash işlemi kötüye kullanımı engellendi. - VelocityStorageProvider — Bağlantı Havuzu Boyutu: SQLite için MaximumPoolSize=1 (WAL modu zorunluluğu), MySQL için MaximumPoolSize=5 olarak düzeltildi; önceki yanlış yapılandırma veritabanı hatalarına yol açabiliyordu. - ConnectionListener — Çevrimdışı Mod UUID Null: Velocity PreLoginEvent çevrimdışı modda UUID'yi null döndürebiliyor; UUID.nameUUIDFromBytes ile güvenli yedek atama yapıldı. - ConfigManager — InputStream Kaynağı Sızıntısı: loadConfig() ve loadMessages() içindeki InputStream / InputStreamReader nesneleri try-with-resources ile sarıldı; kaynaklar her durumda kapatılıyor. - IPReputationManager — InputStreamReader Kaynağı Sızıntısı: İki ayrı InputStreamReader kullanımı try-with-resources ile güvence altına alındı. - AtomGuard — BotProtectionModule Kullanımdan Kaldırma: @Deprecated BotProtectionModule registerModules() içinden kaldırıldı.

İyileştirmeler

- VelocityStorageProvider — Kod Tekrarı Giderildi: saveBehaviorProfile() ve saveBehaviorProfileSync() içindeki JSON inşa mantığı buildProfileJson() özel yardımcı metoduna taşındı; bakımı kolaylaştırıldı. - AttackSnapshot — Koleksiyon Optimizasyonu: Saldırı sırasında yoğun yazma yapılan timeline ve triggeredModules alanları CopyOnWriteArrayList'ten Collections.synchronizedList(new ArrayList<>()) türüne değiştirildi; GC baskısı azaltıldı. - ConfigManager — Gereksiz Değişken Kaldırıldı: loadMessages() içindeki anlamsız final String finalFileName = fileName ataması temizlendi; fileName doğrudan kullanılıyor.

Hata Düzeltmeleri

- VelocityStatisticsManager / TempBanManager — TOCTOU Yarış Koşulu: save() metodlarındaki Files.exists() ön kontrolü kaldırıldı; Files.createDirectories() doğrudan çağrılıyor (idempotent). Çok iş parçacıklı ortamda dizin oluşturma yarış koşulu giderildi. - WebPanel — Düz Metin Şifre Loglama: Varsayılan web panel şifresi artık loglara açık metin olarak yazılmıyor; yalnızca ilk 3 karakter ve maskelenmiş kısım gösteriliyor. - AtomGuard — `onDisable()` Kapatma Sırası: Modüller ve yöneticiler doğru sırayla kapatılıyor (modüller → yöneticiler → depolama → log); discordWebhookManager.stop(), PacketEvents listener unregister, outgoing/incoming plugin channel unregister eklendi. - RedisManager — Daemon Thread ve PubSub Takılması: PubSub thread'i daemon olarak işaretlendi; stop() artık activePubSub.unsubscribe() çağırarak JedisPubSub'ın subscribe() blokajını serbest bırakıyor. - AttackModeManager — Sayaç Sıfırlama Thread Safety: lastReset alanı volatile long'dan AtomicLong'a yükseltildi; recordConnection() CAS ile tek thread'in sıfırlama yapmasını garantiliyor. - PanicCommand / BukkitListener — Null Address NPE: Oyuncu IP adresi null kontrolü eklendi; bağlantı sırasında adresi henüz atanmamış oyuncularda NullPointerException önlendi. - ConnectionPipeline — ArrayList Yerine CopyOnWriteArrayList: Çok iş parçacıklı ortamda eş zamanlı okuma-yazma güvenliği sağlandı. - SmartLagModule — Watchdog Görev Sızıntısı: onEnable() içinde zamanlayıcı görev ID'si kaydediliyor; onDisable() bu ID ile cancelTask() çağırarak kaynakları doğru serbest bırakıyor. - CorePasswordCheckModule — DoS Güvenlik Açığı: 128 karakteri aşan şifreler için SHA-256 hesaplaması artık yapılmıyor; uzun girdilerle hash işlemi kötüye kullanımı engellendi. - VelocityStorageProvider — Bağlantı Havuzu Boyutu: SQLite için MaximumPoolSize=1 (WAL modu zorunluluğu), MySQL için MaximumPoolSize=5 olarak düzeltildi; önceki yanlış yapılandırma veritabanı hatalarına yol açabiliyordu. - ConnectionListener — Çevrimdışı Mod UUID Null: Velocity PreLoginEvent çevrimdışı modda UUID'yi null döndürebiliyor; UUID.nameUUIDFromBytes ile güvenli yedek atama yapıldı. - ConfigManager — InputStream Kaynağı Sızıntısı: loadConfig() ve loadMessages() içindeki InputStream / InputStreamReader nesneleri try-with-resources ile sarıldı; kaynaklar her durumda kapatılıyor. - IPReputationManager — InputStreamReader Kaynağı Sızıntısı: İki ayrı InputStreamReader kullanımı try-with-resources ile güvence altına alındı. - AtomGuard — BotProtectionModule Kullanımdan Kaldırma: @Deprecated BotProtectionModule registerModules() içinden kaldırıldı.

Dev Build #44 - [90937d3](https://github.com/ATOMGAMERAGA/AtomGuard/commit/90937d3d… fix(bump): CHANGELOG.md'ye tek bölüm ekleme hatası düzeltildi (ATOMGAMERAGA) - [c3eea91](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c3eea91f… Release v1.2.5 — kritik thread safety & başlatma sırası düzeltmeleri (ATOMGAMERAGA) - [c989906](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c989906f… Release v1.2.4 — thread safety, NPE fix, cleanup (ATOMGAMERAGA) - [7d4ae1d](https://github.com/ATOMGAMERAGA/AtomGuard/commit/7d4ae1db… fix(ci): PacketEvents Modrinth ID düzeltildi hkfCOMjf → HYKaKraK (ATOMGAMERAGA) - [d058ee4](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d058ee44… fix(ci): GitHub stage catchError eklendi, curl -sf → curl -s (ATOMGAMERAGA) - [45d1bb5](https://github.com/ATOMGAMERAGA/AtomGuard/commit/45d1bb55… fix(ci): python3 tamamen kaldırıldı — Groovy JsonOutput + grep ile değiştirildi (ATOMGAMERAGA) - [8a26066](https://github.com/ATOMGAMERAGA/AtomGuard/commit/8a260660… fix(ci): gh CLI → curl/python3 GitHub API, Setup GitHub CLI stage kaldırıldı (ATOMGAMERAGA) - [42951d8](https://github.com/ATOMGAMERAGA/AtomGuard/commit/42951d87… fix(ci): gh kurulum sh syntax düzeltildi, cleanWs→deleteDir (ATOMGAMERAGA) - [a56ae8e](https://github.com/ATOMGAMERAGA/AtomGuard/commit/a56ae8e3… fix(ci): timestamps() kaldırıldı — plugin kurulu değil (ATOMGAMERAGA) - [700a43e](https://github.com/ATOMGAMERAGA/AtomGuard/commit/700a43e7… fix(ci): Jenkinsfile Groovy backtick escape hataları düzeltildi (ATOMGAMERAGA)

Dev Build #44 - [90937d3](https://github.com/ATOMGAMERAGA/AtomGuard/commit/90937d3d… fix(bump): CHANGELOG.md'ye tek bölüm ekleme hatası düzeltildi (ATOMGAMERAGA) - [c3eea91](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c3eea91f… Release v1.2.5 — kritik thread safety & başlatma sırası düzeltmeleri (ATOMGAMERAGA) - [c989906](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c989906f… Release v1.2.4 — thread safety, NPE fix, cleanup (ATOMGAMERAGA) - [7d4ae1d](https://github.com/ATOMGAMERAGA/AtomGuard/commit/7d4ae1db… fix(ci): PacketEvents Modrinth ID düzeltildi hkfCOMjf → HYKaKraK (ATOMGAMERAGA) - [d058ee4](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d058ee44… fix(ci): GitHub stage catchError eklendi, curl -sf → curl -s (ATOMGAMERAGA) - [45d1bb5](https://github.com/ATOMGAMERAGA/AtomGuard/commit/45d1bb55… fix(ci): python3 tamamen kaldırıldı — Groovy JsonOutput + grep ile değiştirildi (ATOMGAMERAGA) - [8a26066](https://github.com/ATOMGAMERAGA/AtomGuard/commit/8a260660… fix(ci): gh CLI → curl/python3 GitHub API, Setup GitHub CLI stage kaldırıldı (ATOMGAMERAGA) - [42951d8](https://github.com/ATOMGAMERAGA/AtomGuard/commit/42951d87… fix(ci): gh kurulum sh syntax düzeltildi, cleanWs→deleteDir (ATOMGAMERAGA) - [a56ae8e](https://github.com/ATOMGAMERAGA/AtomGuard/commit/a56ae8e3… fix(ci): timestamps() kaldırıldı — plugin kurulu değil (ATOMGAMERAGA) - [700a43e](https://github.com/ATOMGAMERAGA/AtomGuard/commit/700a43e7… fix(ci): Jenkinsfile Groovy backtick escape hataları düzeltildi (ATOMGAMERAGA)

İyileştirmeler

- AbstractModule — Asenkron Ağır İşlemler: blockExploit() içindeki olay fırlatma, heuristik güncelleme, güven skoru kaydı ve adli analiz kayıt adımları runTaskAsynchronously ile ana thread'den kaldırıldı; yüksek trafik altında gecikme azaltıldı. - AtomGuard — Periyodik Temizlik: Her 5 dakikada bir tüm modüllerin cleanup() ve HeuristicEngine.cleanupOfflinePlayers() çağrıları yapılıyor; bellek sızıntısı önlendi. - BukkitListener — Bypass Önbelleği: PlayerJoinEvent'te checkAndCacheBypass(), PlayerQuitEvent'te removeBypassCache() çağrıları eklendi; Netty thread'inden permission API çağrısı tamamen kaldırıldı.

Hata Düzeltmeleri

- AtomGuard — Başlatma Sırası Kritik Hata: PacketListener, registerModules() ve enableAllModules() çağrılarından önce oluşturulmaya başlandı. Eski sıralamada modüller registerReceiveHandler() çağırırken packetListener null olduğundan sunucu açılışta NullPointerException ile çöküyordu. - PacketListener — Netty Thread'den hasPermission() Çağrısı: hasBypass() artık Bukkit permission API'sini çağırmıyor; tamamen önbellek tabanlı. Bypass olmayan oyuncular da -1L sentinel değeriyle önbelleğe alınıyor. synchronized liste CopyOnWriteArrayList ile değiştirildi. getPlayer() yalnızca rotasyon/animasyon paketleri için çağrılıyor. - 7 Modül — PacketListenerAbstract Bağımsız Kayıt: PacketExploitModule, PacketDelayModule, OfflinePacketModule, BookCrasherModule, BundleDuplicationModule, InvalidSlotModule, CustomPayloadModule kendi PacketListenerAbstract örneklerini kaydetmek yerine registerReceiveHandler() korumalı metodunu kullanacak şekilde yeniden yazıldı; handler takibi ve merkezi temizlik düzgün çalışıyor. - 26 Modül — Çift Bukkit Olay Kaydı: AbstractModule.onEnable() zaten registerEvents() çağırdığı halde bu modüller onEnable() override'larında ikinci kez manuel kayıt yapıyordu; tüm çift kayıtlar kaldırıldı. - ModuleManager — Başlatma Hatasında Rollback Eksikliği: enableAllModules() ve enableModule() içindeki catch blokları artık module.onDisable() çağırarak yarım kalan modülü geri alıyor; tutarsız aktif-listesi durumu önlendi. - OfflinePacketModule — Güvenilmez Online Kontrolü: Bukkit.getPlayer(uuid) yerine player.isOnline() kullanılıyor; null dereference riski ortadan kalktı. - NBTCrasherModule / AdvancedPayloadModule — Yanlış Handler Kaydı: plugin.getPacketListener().registerReceiveHandler() yerine protected registerReceiveHandler() kullanılıyor; handler listesi tutarsızlığı ve temizlik hataları giderildi. - NettyCrashModule — Thread Safety: pipeline.addAfter() ve pipeline.remove() çağrıları channel.eventLoop().execute() içine taşındı; Netty pipeline değişiklikleri artık kanal kendi event loop thread'inde yapılıyor.

İyileştirmeler

- AbstractModule — Asenkron Ağır İşlemler: blockExploit() içindeki olay fırlatma, heuristik güncelleme, güven skoru kaydı ve adli analiz kayıt adımları runTaskAsynchronously ile ana thread'den kaldırıldı; yüksek trafik altında gecikme azaltıldı. - AtomGuard — Periyodik Temizlik: Her 5 dakikada bir tüm modüllerin cleanup() ve HeuristicEngine.cleanupOfflinePlayers() çağrıları yapılıyor; bellek sızıntısı önlendi. - BukkitListener — Bypass Önbelleği: PlayerJoinEvent'te checkAndCacheBypass(), PlayerQuitEvent'te removeBypassCache() çağrıları eklendi; Netty thread'inden permission API çağrısı tamamen kaldırıldı.

Hata Düzeltmeleri

- AtomGuard — Başlatma Sırası Kritik Hata: PacketListener, registerModules() ve enableAllModules() çağrılarından önce oluşturulmaya başlandı. Eski sıralamada modüller registerReceiveHandler() çağırırken packetListener null olduğundan sunucu açılışta NullPointerException ile çöküyordu. - PacketListener — Netty Thread'den hasPermission() Çağrısı: hasBypass() artık Bukkit permission API'sini çağırmıyor; tamamen önbellek tabanlı. Bypass olmayan oyuncular da -1L sentinel değeriyle önbelleğe alınıyor. synchronized liste CopyOnWriteArrayList ile değiştirildi. getPlayer() yalnızca rotasyon/animasyon paketleri için çağrılıyor. - 7 Modül — PacketListenerAbstract Bağımsız Kayıt: PacketExploitModule, PacketDelayModule, OfflinePacketModule, BookCrasherModule, BundleDuplicationModule, InvalidSlotModule, CustomPayloadModule kendi PacketListenerAbstract örneklerini kaydetmek yerine registerReceiveHandler() korumalı metodunu kullanacak şekilde yeniden yazıldı; handler takibi ve merkezi temizlik düzgün çalışıyor. - 26 Modül — Çift Bukkit Olay Kaydı: AbstractModule.onEnable() zaten registerEvents() çağırdığı halde bu modüller onEnable() override'larında ikinci kez manuel kayıt yapıyordu; tüm çift kayıtlar kaldırıldı. - ModuleManager — Başlatma Hatasında Rollback Eksikliği: enableAllModules() ve enableModule() içindeki catch blokları artık module.onDisable() çağırarak yarım kalan modülü geri alıyor; tutarsız aktif-listesi durumu önlendi. - OfflinePacketModule — Güvenilmez Online Kontrolü: Bukkit.getPlayer(uuid) yerine player.isOnline() kullanılıyor; null dereference riski ortadan kalktı. - NBTCrasherModule / AdvancedPayloadModule — Yanlış Handler Kaydı: plugin.getPacketListener().registerReceiveHandler() yerine protected registerReceiveHandler() kullanılıyor; handler listesi tutarsızlığı ve temizlik hataları giderildi. - NettyCrashModule — Thread Safety: pipeline.addAfter() ve pipeline.remove() çağrıları channel.eventLoop().execute() içine taşındı; Netty pipeline değişiklikleri artık kanal kendi event loop thread'inde yapılıyor.

Hata Düzeltmeleri

- AntiBotModule — NPE Düzeltme: getOrCreateProfile() ve handleIncomingPacket() içinde user.getAddress() null döndürebiliyordu; pre-login paket işleyicilerinde sunucu çöküyordu. Null kontrolü eklendi, null durumda "0.0.0.0" kullanılıyor. - PlayerProfile — Thread Safety: PacketEvents thread'leriyle paylaşılan 8 alan (sentClientSettings, sentPositionPacket, interactedWithInventory, interactedWithWorld, lastSeen, cachedFirstJoinScore, currentThreatScore, successfulSessionCount) volatile yapıldı. maxThreatScore check-then-set yarış koşulu AtomicInteger.updateAndGet() ile çözüldü. - AttackModeManager — Race Condition: attackModeStartTime alanı birden fazla thread'den erişilirken volatile değildi; attack mode süre hesaplamaları yanlış olabiliyordu. volatile yapıldı. - AntiBotModule — Hatalı Offline Kontrol: cleanupProfiles() içinde Bukkit.getOfflinePlayer(uuid).isOnline() güvenilmezdi (disk erişimi yapar, pahalı). Bukkit.getPlayer(uuid) == null ile değiştirildi.

İyileştirmeler

- CHANGELOG.md içindeki yinelenen boş [1.2.3] bölümleri temizlendi.

Hata Düzeltmeleri

- AntiBotModule — NPE Düzeltme: getOrCreateProfile() ve handleIncomingPacket() içinde user.getAddress() null döndürebiliyordu; pre-login paket işleyicilerinde sunucu çöküyordu. Null kontrolü eklendi, null durumda "0.0.0.0" kullanılıyor. - PlayerProfile — Thread Safety: PacketEvents thread'leriyle paylaşılan 8 alan (sentClientSettings, sentPositionPacket, interactedWithInventory, interactedWithWorld, lastSeen, cachedFirstJoinScore, currentThreatScore, successfulSessionCount) volatile yapıldı. maxThreatScore check-then-set yarış koşulu AtomicInteger.updateAndGet() ile çözüldü. - AttackModeManager — Race Condition: attackModeStartTime alanı birden fazla thread'den erişilirken volatile değildi; attack mode süre hesaplamaları yanlış olabiliyordu. volatile yapıldı. - AntiBotModule — Hatalı Offline Kontrol: cleanupProfiles() içinde Bukkit.getOfflinePlayer(uuid).isOnline() güvenilmezdi (disk erişimi yapar, pahalı). Bukkit.getPlayer(uuid) == null ile değiştirildi.

İyileştirmeler

- CHANGELOG.md içindeki yinelenen boş [1.2.3] bölümleri temizlendi.

Hata Düzeltmeleri

- BotProtectionModule — Yanlış "Timed Out" Atması: dogrulama.aktif varsayılanı true'dan false'a değiştirildi. Saldırı modunda bot-korumasi modülünün otomatik devreye girmesi kaldırıldı (artık otomatik-moduller listesinde yok). Hareket tabanlı doğrulama artık sohbet ve komut kullanımını da doğrulama olarak kabul ediyor (PlayerCommandPreprocessEvent ve AsyncPlayerChatEvent eklendi). - ActionExecutor — KEEP_ALIVE Race Condition: executePeriodic'te kara listeye alma sırası düzeltildi. Artık önce oyuncu atılır (player.kick()), ardından 1 tick gecikmeyle IP kara listeye eklenir. Önceki sıralamada (kara liste → kick) KEEP_ALIVE yanıtları iptal edildiğinden sunucu "Timed Out" mesajı gösteriyordu.

İyileştirmeler

- moduller.bot-korumasi config bölümü eklendi (varsayılan devre dışı, tam dokümantasyonlu) - attack-mode.aksiyonlar.otomatik-moduller'den bot-korumasi kaldırıldı; AtomShield protokol koruması bot-koruma (AntiBotModule) üzerinden zaten aktif

Hata Düzeltmeleri

- BotProtectionModule — Yanlış "Timed Out" Atması: dogrulama.aktif varsayılanı true'dan false'a değiştirildi. Saldırı modunda bot-korumasi modülünün otomatik devreye girmesi kaldırıldı (artık otomatik-moduller listesinde yok). Hareket tabanlı doğrulama artık sohbet ve komut kullanımını da doğrulama olarak kabul ediyor (PlayerCommandPreprocessEvent ve AsyncPlayerChatEvent eklendi). - ActionExecutor — KEEP_ALIVE Race Condition: executePeriodic'te kara listeye alma sırası düzeltildi. Artık önce oyuncu atılır (player.kick()), ardından 1 tick gecikmeyle IP kara listeye eklenir. Önceki sıralamada (kara liste → kick) KEEP_ALIVE yanıtları iptal edildiğinden sunucu "Timed Out" mesajı gösteriyordu.

İyileştirmeler

- moduller.bot-korumasi config bölümü eklendi (varsayılan devre dışı, tam dokümantasyonlu) - attack-mode.aksiyonlar.otomatik-moduller'den bot-korumasi kaldırıldı; AtomShield protokol koruması bot-koruma (AntiBotModule) üzerinden zaten aktif

AtomGuard v1.2.2

Advanced Minecraft Server Security & Exploit Protection.

What's New?

We've added a lot of things since v1, but we're not going to release the versions in between. However, if you want, you can download them via our GitHub page.

Installation

1. Stop your server. 2. Delete any old AtomGuard or AtomSMPFixer JARs from the plugins folder. 3. Upload the new AtomGuard-core-v1.2.2.jar to your Paper server's plugins folder. 4. (Optional) Upload AtomGuard-velocity-v1.2.2.jar to your Velocity proxy's plugins folder. 5. Start your server. --- Made with ❤️ by ATOMLAND Studios Full Changelog: https://github.com/ATOMGAMERAGA/AtomGuard/compare/v1.2.1.…

Atom Guard v1.0.0

Advanced Minecraft Server Security & Exploit Protection.

Installation

1. Stop your server. 2. Delete any old AtomGuard or AtomSMPFixer JARs from the plugins folder. 3. Upload the new AtomGuard-v1.0.0.jar. 4. Start your server. --- Made with ❤️ by AtomGuard Team Team Full Changelog: https://github.com/ATOMGAMERAGA/AtomGuard/commits/v1.0.0