ВЕРСИИ (87)

### 🔧 İyileştirmeler - **`SessionManager.cleanupBlacklist()` — eşik tabanlı tembel temizlik**: Periyodik temizleyici, blacklist boyutu `CLEANUP_THRESHOLD` (10 000) altındayken artık no-op. Önceden her tick'te tüm token'lar JWT validasyonundan geçiriliyordu (gereksiz CPU); JWT'nin kendi expire mekanizması zaten geçersiz token'ları reddettiğinden, yalnızca blacklist gerçekten büyürse tam tarama çalışır. - **`AttackLevelManager` — CPS eşikleri enum çarpanlarından türetiliyor**: `calculateTargetLevel()` artık her seviyenin CPS sınırını `AttackLevel.getCpsMultiplier()` üzerinden okuyor; magic number (8/5/3/2) kaldırıldı. Bir yerde tune edildiğinde eşikler senkron kalıyor. ### 🐛 Hata Düzeltmeleri - **`AttackLevelManager` — LOCKDOWN katmanında verified oyuncular geçebiliyor**: Önceki davranış LOCKDOWN'da herkesi (verified dahil) reddediyordu; bu, slot-seviyeli filtrelemeyi yapan `VerifiedPlayerShield`'ı by-pass ediyor ve meşru oyuncuların saldırı sırasında tamamen dışarıda kalmasına yol açıyordu. Artık verified bağlantılar bu katmandan geçirilip Shield'a teslim ediliyor; yalnız verified-olmayan bağlantılar burada düşürülüyor. Eşlik eden test (`lockdownLevel_onlyAllowsVerified`) güncellendi. ### ⚖️ Tuning - **`AttackLevel` CPS çarpanları yumuşatıldı**: ELEVATED 2.0×→1.5×, HIGH 3.0×→2.0×, CRITICAL 5.0×→3.0×, LOCKDOWN 8.0×→5.0×. Saldırı seviyeleri daha erken devreye giriyor; eskisi büyük saldırılarda çok geç tepki veriyordu.

### 🔧 İyileştirmeler - **`SessionManager.cleanupBlacklist()` — eşik tabanlı tembel temizlik**: Periyodik temizleyici, blacklist boyutu `CLEANUP_THRESHOLD` (10 000) altındayken artık no-op. Önceden her tick'te tüm token'lar JWT validasyonundan geçiriliyordu (gereksiz CPU); JWT'nin kendi expire mekanizması zaten geçersiz token'ları reddettiğinden, yalnızca blacklist gerçekten büyürse tam tarama çalışır. - **`AttackLevelManager` — CPS eşikleri enum çarpanlarından türetiliyor**: `calculateTargetLevel()` artık her seviyenin CPS sınırını `AttackLevel.getCpsMultiplier()` üzerinden okuyor; magic number (8/5/3/2) kaldırıldı. Bir yerde tune edildiğinde eşikler senkron kalıyor. ### 🐛 Hata Düzeltmeleri - **`AttackLevelManager` — LOCKDOWN katmanında verified oyuncular geçebiliyor**: Önceki davranış LOCKDOWN'da herkesi (verified dahil) reddediyordu; bu, slot-seviyeli filtrelemeyi yapan `VerifiedPlayerShield`'ı by-pass ediyor ve meşru oyuncuların saldırı sırasında tamamen dışarıda kalmasına yol açıyordu. Artık verified bağlantılar bu katmandan geçirilip Shield'a teslim ediliyor; yalnız verified-olmayan bağlantılar burada düşürülüyor. Eşlik eden test (`lockdownLevel_onlyAllowsVerified`) güncellendi. ### ⚖️ Tuning - **`AttackLevel` CPS çarpanları yumuşatıldı**: ELEVATED 2.0×→1.5×, HIGH 3.0×→2.0×, CRITICAL 5.0×→3.0×, LOCKDOWN 8.0×→5.0×. Saldırı seviyeleri daha erken devreye giriyor; eskisi büyük saldırılarda çok geç tepki veriyordu.

**Dev Build #96** - [`e3707a8`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/e3707a80aade99242f98a9b3a72e1611a1ff2051) Merge pull request #14 from ATOMGAMERAGA/claude/modest-mccarthy-9cYZG (Atom Gamer Arda A.G.A) - [`cfc7fb4`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/cfc7fb45b7acfe31a21358ec137fb2808f56eea6) fix(WhitelistManager): tolerate corrupted whitelist.json on load (Claude) - [`c6f34e5`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c6f34e5f8e842588a6e47548bab12ca96a4f14f6) Merge pull request #11 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`bfd7750`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/bfd775095cddfb4cd1d87acca41fe8f1e9b0674d) fix(jenkins): Auto Version Bump koşulu klasik Pipeline'da da çalışsın (Claude) - [`52e8d78`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/52e8d789f5a6aaf0654f01b8abfb9c9c49691fd6) fix(jenkins): force fresh checkout — defansif workspace state reset (Claude) - [`0156aff`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/0156affab1abf43b7bb8b52b026b9f735cd7e662) Merge pull request #10 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`79a6183`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/79a6183ce6a0462c1f8777c4d58e6b22eff04eae) fix(jenkins): skip Modrinth publish for stale tag builds — guard against accidental old-version releases (Claude) - [`d9afcfb`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d9afcfb1c6cb8a236424f559a3c27a65294cd454) Merge pull request #9 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`cb0acb4`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/cb0acb4eeb916c19fc6dec42ee1462e3c2224766) fix(ci): rewrite Jenkins trigger to support Multibranch Pipelines + multi-method fallback (Claude) - [`55b0562`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/55b056206158ecd0c3b54351dbbf54fad1ec5cd9) Merge pull request #8 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A)

**Dev Build #96** - [`e3707a8`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/e3707a80aade99242f98a9b3a72e1611a1ff2051) Merge pull request #14 from ATOMGAMERAGA/claude/modest-mccarthy-9cYZG (Atom Gamer Arda A.G.A) - [`cfc7fb4`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/cfc7fb45b7acfe31a21358ec137fb2808f56eea6) fix(WhitelistManager): tolerate corrupted whitelist.json on load (Claude) - [`c6f34e5`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c6f34e5f8e842588a6e47548bab12ca96a4f14f6) Merge pull request #11 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`bfd7750`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/bfd775095cddfb4cd1d87acca41fe8f1e9b0674d) fix(jenkins): Auto Version Bump koşulu klasik Pipeline'da da çalışsın (Claude) - [`52e8d78`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/52e8d789f5a6aaf0654f01b8abfb9c9c49691fd6) fix(jenkins): force fresh checkout — defansif workspace state reset (Claude) - [`0156aff`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/0156affab1abf43b7bb8b52b026b9f735cd7e662) Merge pull request #10 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`79a6183`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/79a6183ce6a0462c1f8777c4d58e6b22eff04eae) fix(jenkins): skip Modrinth publish for stale tag builds — guard against accidental old-version releases (Claude) - [`d9afcfb`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d9afcfb1c6cb8a236424f559a3c27a65294cd454) Merge pull request #9 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`cb0acb4`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/cb0acb4eeb916c19fc6dec42ee1462e3c2224766) fix(ci): rewrite Jenkins trigger to support Multibranch Pipelines + multi-method fallback (Claude) - [`55b0562`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/55b056206158ecd0c3b54351dbbf54fad1ec5cd9) Merge pull request #8 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A)

**Dev Build #94** - [`c6f34e5`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c6f34e5f8e842588a6e47548bab12ca96a4f14f6) Merge pull request #11 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`bfd7750`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/bfd775095cddfb4cd1d87acca41fe8f1e9b0674d) fix(jenkins): Auto Version Bump koşulu klasik Pipeline'da da çalışsın (Claude) - [`52e8d78`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/52e8d789f5a6aaf0654f01b8abfb9c9c49691fd6) fix(jenkins): force fresh checkout — defansif workspace state reset (Claude) - [`0156aff`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/0156affab1abf43b7bb8b52b026b9f735cd7e662) Merge pull request #10 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`79a6183`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/79a6183ce6a0462c1f8777c4d58e6b22eff04eae) fix(jenkins): skip Modrinth publish for stale tag builds — guard against accidental old-version releases (Claude) - [`d9afcfb`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d9afcfb1c6cb8a236424f559a3c27a65294cd454) Merge pull request #9 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`cb0acb4`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/cb0acb4eeb916c19fc6dec42ee1462e3c2224766) fix(ci): rewrite Jenkins trigger to support Multibranch Pipelines + multi-method fallback (Claude) - [`55b0562`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/55b056206158ecd0c3b54351dbbf54fad1ec5cd9) Merge pull request #8 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`12e1267`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/12e12678123005b1139a37763c36e36c41aaddb4) 🔖 Release v2.3.0 — Jenkins auto-version + ArmorStand/WindCharge kalıcı fix + persistent whitelist + metrics endpoint (Claude) - [`9149faa`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/9149faa47ec2cb92049cfffeec3241302388e7f4) 🔧 fix(actions): simplify Jenkins trigger to use notifyCommit endpoint (ATOMGAMERAGA)

**Dev Build #94** - [`c6f34e5`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c6f34e5f8e842588a6e47548bab12ca96a4f14f6) Merge pull request #11 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`bfd7750`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/bfd775095cddfb4cd1d87acca41fe8f1e9b0674d) fix(jenkins): Auto Version Bump koşulu klasik Pipeline'da da çalışsın (Claude) - [`52e8d78`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/52e8d789f5a6aaf0654f01b8abfb9c9c49691fd6) fix(jenkins): force fresh checkout — defansif workspace state reset (Claude) - [`0156aff`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/0156affab1abf43b7bb8b52b026b9f735cd7e662) Merge pull request #10 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`79a6183`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/79a6183ce6a0462c1f8777c4d58e6b22eff04eae) fix(jenkins): skip Modrinth publish for stale tag builds — guard against accidental old-version releases (Claude) - [`d9afcfb`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d9afcfb1c6cb8a236424f559a3c27a65294cd454) Merge pull request #9 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`cb0acb4`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/cb0acb4eeb916c19fc6dec42ee1462e3c2224766) fix(ci): rewrite Jenkins trigger to support Multibranch Pipelines + multi-method fallback (Claude) - [`55b0562`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/55b056206158ecd0c3b54351dbbf54fad1ec5cd9) Merge pull request #8 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`12e1267`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/12e12678123005b1139a37763c36e36c41aaddb4) 🔖 Release v2.3.0 — Jenkins auto-version + ArmorStand/WindCharge kalıcı fix + persistent whitelist + metrics endpoint (Claude) - [`9149faa`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/9149faa47ec2cb92049cfffeec3241302388e7f4) 🔧 fix(actions): simplify Jenkins trigger to use notifyCommit endpoint (ATOMGAMERAGA)

**Dev Build #94** - [`c6f34e5`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c6f34e5f8e842588a6e47548bab12ca96a4f14f6) Merge pull request #11 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`bfd7750`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/bfd775095cddfb4cd1d87acca41fe8f1e9b0674d) fix(jenkins): Auto Version Bump koşulu klasik Pipeline'da da çalışsın (Claude) - [`52e8d78`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/52e8d789f5a6aaf0654f01b8abfb9c9c49691fd6) fix(jenkins): force fresh checkout — defansif workspace state reset (Claude) - [`0156aff`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/0156affab1abf43b7bb8b52b026b9f735cd7e662) Merge pull request #10 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`79a6183`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/79a6183ce6a0462c1f8777c4d58e6b22eff04eae) fix(jenkins): skip Modrinth publish for stale tag builds — guard against accidental old-version releases (Claude) - [`d9afcfb`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d9afcfb1c6cb8a236424f559a3c27a65294cd454) Merge pull request #9 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`cb0acb4`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/cb0acb4eeb916c19fc6dec42ee1462e3c2224766) fix(ci): rewrite Jenkins trigger to support Multibranch Pipelines + multi-method fallback (Claude) - [`55b0562`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/55b056206158ecd0c3b54351dbbf54fad1ec5cd9) Merge pull request #8 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`12e1267`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/12e12678123005b1139a37763c36e36c41aaddb4) 🔖 Release v2.3.0 — Jenkins auto-version + ArmorStand/WindCharge kalıcı fix + persistent whitelist + metrics endpoint (Claude) - [`9149faa`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/9149faa47ec2cb92049cfffeec3241302388e7f4) 🔧 fix(actions): simplify Jenkins trigger to use notifyCommit endpoint (ATOMGAMERAGA)

**Dev Build #94** - [`c6f34e5`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c6f34e5f8e842588a6e47548bab12ca96a4f14f6) Merge pull request #11 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`bfd7750`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/bfd775095cddfb4cd1d87acca41fe8f1e9b0674d) fix(jenkins): Auto Version Bump koşulu klasik Pipeline'da da çalışsın (Claude) - [`52e8d78`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/52e8d789f5a6aaf0654f01b8abfb9c9c49691fd6) fix(jenkins): force fresh checkout — defansif workspace state reset (Claude) - [`0156aff`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/0156affab1abf43b7bb8b52b026b9f735cd7e662) Merge pull request #10 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`79a6183`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/79a6183ce6a0462c1f8777c4d58e6b22eff04eae) fix(jenkins): skip Modrinth publish for stale tag builds — guard against accidental old-version releases (Claude) - [`d9afcfb`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d9afcfb1c6cb8a236424f559a3c27a65294cd454) Merge pull request #9 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`cb0acb4`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/cb0acb4eeb916c19fc6dec42ee1462e3c2224766) fix(ci): rewrite Jenkins trigger to support Multibranch Pipelines + multi-method fallback (Claude) - [`55b0562`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/55b056206158ecd0c3b54351dbbf54fad1ec5cd9) Merge pull request #8 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`12e1267`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/12e12678123005b1139a37763c36e36c41aaddb4) 🔖 Release v2.3.0 — Jenkins auto-version + ArmorStand/WindCharge kalıcı fix + persistent whitelist + metrics endpoint (Claude) - [`9149faa`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/9149faa47ec2cb92049cfffeec3241302388e7f4) 🔧 fix(actions): simplify Jenkins trigger to use notifyCommit endpoint (ATOMGAMERAGA)

### 🐛 Critical Bug Fixes — Eski "fix'lendi ama çalışmıyor" sorunları için kalıcı çözüm - **`TokenBucketModule` — `atomguard.bypass` permission'ını dinlemiyordu**: Tüm diğer modüller `isExempt(player)` ile OP/staff'ı muaf tutarken, token bucket modülü bu kontrolü atlıyordu. ETKILESIM bucket'ında `PLAYER_BLOCK_PLACEMENT` + `USE_ITEM` + `ANIMATION` + `INTERACT_ENTITY` paketleri vardı (kapasite 300, refill 120/s); ANIMATION her el sallamada gönderildiği için kovayı hızla tüketiyor ve yerleştirme paketleri sessizce düşürülüyordu. Bu davranış **armor stand placement'ın bazı oyuncularda yerleşmemesinin ve yerleşenlerde hep aynı yöne bakmasının** asıl sebebiydi (sunucu, drop edilen ilk USE_ITEM paketinden sonraki bir paketten spawn ediyor → yaw farklı oluyor). Düzeltme: `isExempt(player)` kontrolü eklendi, `ANIMATION` paketi `DIGER` bucket'ına taşındı, ETKILESIM bucket default'ları 500/200'e yükseltildi, ve drop edilen paketler artık DEBUG log'a yazılıyor. - **`ItemSanitizerModule` — ARMOR_STAND / ITEM_FRAME / PAINTING için explicit muafiyet**: `onPlayerInteract` handler'ı bypass'sız oyunculara her etkileşimde sanitize çalıştırıyordu; bu materialler false-positive riskli olduğu için (özellikle yeni 1.21 data component'leriyle) artık explicit muaf. Tüm `hasPermission("atomguard.bypass")` çağrıları yeni `isExempt(player)` helper'ı ile değiştirildi. - **`WindChargeIntegrityModule` (YENİ) — Vanilla wind charge knockback garantisi**: v2.2.5/v2.2.6/v2.2.9 yamalarına rağmen wind charge oyuncuları zıplatmıyordu (redstone aktive ediyor ama bounce yok). Bu yeni modül, son güvenlik ağı olarak: - Wind charge kaynaklı `EntityDamageByEntityEvent` / `EntityExplodeEvent` iptal edilmişse HIGHEST priority'de geri alır (başka plugin LOWEST'te iptal etmiş olsa bile) - `ProjectileHitEvent`'te 1 tick sonra etki yarıçapındaki canlı varlıklara manuel velocity uygular (vanilla zaten ittiyse skip — çift etki yok) - Tüm event'leri DEBUG'a loglar (`detailed-log: true`) — başka bir handler iptal ediyorsa kanıt için - Config: `moduller.wind-charge-integrity.aktif: true`, `radius`, `velocity-magnitude`, `min-upward-velocity`, `fallback-enabled` ### 🆕 Yeni Özellikler - **`/atomguard whitelist <add|remove|list>` komutu + `WhitelistManager`**: Bukkit'in `atomguard.bypass` permission'ından ayrı, kalıcı, isim-bazlı muafiyet listesi. JSON persistence (`plugins/AtomGuard/whitelist.json`). Tüm modüller `AbstractModule.isExempt(player)` üzerinden hem permission hem de whitelist'i kontrol eder. - **Bağımsız `/metrics` HTTP endpoint'i**: Web Panel'in JWT-protected `/api/metrics`'inden farklı olarak, Bearer-token korumalı, JWT gerektirmeyen Prometheus/Grafana entegrasyon noktası. JSON (default) ve Prometheus exposition (`?format=prom`) formatı destekler. Config: `web-panel.metrics-token` (boş ise endpoint 401 döner). - **Discord webhook structured embeds**: `notifyBotAction` ve diğer notify metotları artık embed `fields` array'i kullanıyor (oyuncu, IP, sebep ayrı alanlarda). Tüm embed'lere `timestamp` (ISO 8601) ve `footer.text` (`AtomGuard • <server-name>`) eklendi. Config: `discord-webhook.server-name`. - **`AbstractModule.isExempt(Player)` helper'ı**: Tüm modüllerin bypass kontrolü için merkezî giriş noktası. Permission + whitelist'i birlikte kontrol eder. Gelecekte ek mekanizmalar (trust score üst sınırı, IP whitelist, vs.) burada eklenecek. ### 🔧 İyileştirmeler & Race / Memory Fix'leri - **`AttackModeManager.blockedDuringAttack` race condition (Critical)**: `volatile long ++` non-atomic; async packet handler'larda lost-update race oluyordu. `AtomicLong incrementAndGet()` ile değiştirildi. - **`AtomGuardAPI.instance` volatile**: onLoad/onEnable race'inde yarım-init görme riskine karşı `volatile` eklendi. - **`SmartLagModule.unfreezeAll()` artık tüm chunk'ları taramıyor**: Eski kod yüklü TÜM chunk'ları döndüğü için 10k+ chunk'lı sunucularda main thread stall yapıyordu (lag önleyici feature lag üretiyor). Şimdi sadece `frozenChunks` set'ini iter ediyor. - **`AntiBotModule` async task disable'da iptal ediliyor**: 5 saniyelik attack-evaluation task'ı `runTaskTimerAsynchronously` ile yaratılıp ID tutulmuyordu. Şimdi `evaluationTaskId` field'da tutuluyor ve `onDisable()`'da iptal ediliyor. - **`ConnectionRateCheck` thread-safe deque erişimi**: `addLast()` + `size()` ayrı çağrılardı; başka thread eski entry'leri purge ederken size yanlış gelebilirdi. `synchronized(deque)` blok ile atomik snapshot. - **Velocity `ConnectionAnalyzer` CLAUDE.md uyum hatası**: Kod `Math.max(10, suspiciousThreshold)` kullanıyordu ama doküman "Minimum enforced at 8" diyordu. → 8'e düşürüldü (küçük sunucularda 8 daha gerçekçi). - **Config.yml — eksik bölümler eklendi**: `moduller.item-sanitizer.*` (5 anahtar), `moduller.redstone-limiter.*` (2 anahtar), `moduller.wind-charge-integrity.*` (5 anahtar), `heuristic.escik-supheli` / `escik-yuksek` / `decay-saniye` / `rotation-tolerance-derece`, `web-panel.metrics-token`, `discord-webhook.server-name`. ### 🚀 CI/CD - **Jenkinsfile — Auto Version Bump stage eklendi**: Pipeline artık `main`/`master` branch'inde, commit zaten tag'lenmemişse, conventional commit mesajından bump türünü tespit ediyor ve otomatik olarak `bump-version.sh <type> --tag --push --ci` çağırıyor. Recursion guard (`🔖 Release v` ile başlayan commit'leri skip), explicit skip (`[skip release]` / `[skip ci]`), explicit override (`[release:patch|minor|major]`) destekleniyor. Push edilen yeni tag webhook ile taze build başlatıyor ve Stable Release stage'i otomatik çalışıyor. - **`bump-version.sh` — `--ci` flag eklendi**: CI'da interaktif olmayan modda çalışması için `GIT_AUTHOR_NAME` / `GIT_AUTHOR_EMAIL` env'den okunuyor.

### 🐛 Critical Bug Fixes — Eski "fix'lendi ama çalışmıyor" sorunları için kalıcı çözüm - **`TokenBucketModule` — `atomguard.bypass` permission'ını dinlemiyordu**: Tüm diğer modüller `isExempt(player)` ile OP/staff'ı muaf tutarken, token bucket modülü bu kontrolü atlıyordu. ETKILESIM bucket'ında `PLAYER_BLOCK_PLACEMENT` + `USE_ITEM` + `ANIMATION` + `INTERACT_ENTITY` paketleri vardı (kapasite 300, refill 120/s); ANIMATION her el sallamada gönderildiği için kovayı hızla tüketiyor ve yerleştirme paketleri sessizce düşürülüyordu. Bu davranış **armor stand placement'ın bazı oyuncularda yerleşmemesinin ve yerleşenlerde hep aynı yöne bakmasının** asıl sebebiydi (sunucu, drop edilen ilk USE_ITEM paketinden sonraki bir paketten spawn ediyor → yaw farklı oluyor). Düzeltme: `isExempt(player)` kontrolü eklendi, `ANIMATION` paketi `DIGER` bucket'ına taşındı, ETKILESIM bucket default'ları 500/200'e yükseltildi, ve drop edilen paketler artık DEBUG log'a yazılıyor. - **`ItemSanitizerModule` — ARMOR_STAND / ITEM_FRAME / PAINTING için explicit muafiyet**: `onPlayerInteract` handler'ı bypass'sız oyunculara her etkileşimde sanitize çalıştırıyordu; bu materialler false-positive riskli olduğu için (özellikle yeni 1.21 data component'leriyle) artık explicit muaf. Tüm `hasPermission("atomguard.bypass")` çağrıları yeni `isExempt(player)` helper'ı ile değiştirildi. - **`WindChargeIntegrityModule` (YENİ) — Vanilla wind charge knockback garantisi**: v2.2.5/v2.2.6/v2.2.9 yamalarına rağmen wind charge oyuncuları zıplatmıyordu (redstone aktive ediyor ama bounce yok). Bu yeni modül, son güvenlik ağı olarak: - Wind charge kaynaklı `EntityDamageByEntityEvent` / `EntityExplodeEvent` iptal edilmişse HIGHEST priority'de geri alır (başka plugin LOWEST'te iptal etmiş olsa bile) - `ProjectileHitEvent`'te 1 tick sonra etki yarıçapındaki canlı varlıklara manuel velocity uygular (vanilla zaten ittiyse skip — çift etki yok) - Tüm event'leri DEBUG'a loglar (`detailed-log: true`) — başka bir handler iptal ediyorsa kanıt için - Config: `moduller.wind-charge-integrity.aktif: true`, `radius`, `velocity-magnitude`, `min-upward-velocity`, `fallback-enabled` ### 🆕 Yeni Özellikler - **`/atomguard whitelist <add|remove|list>` komutu + `WhitelistManager`**: Bukkit'in `atomguard.bypass` permission'ından ayrı, kalıcı, isim-bazlı muafiyet listesi. JSON persistence (`plugins/AtomGuard/whitelist.json`). Tüm modüller `AbstractModule.isExempt(player)` üzerinden hem permission hem de whitelist'i kontrol eder. - **Bağımsız `/metrics` HTTP endpoint'i**: Web Panel'in JWT-protected `/api/metrics`'inden farklı olarak, Bearer-token korumalı, JWT gerektirmeyen Prometheus/Grafana entegrasyon noktası. JSON (default) ve Prometheus exposition (`?format=prom`) formatı destekler. Config: `web-panel.metrics-token` (boş ise endpoint 401 döner). - **Discord webhook structured embeds**: `notifyBotAction` ve diğer notify metotları artık embed `fields` array'i kullanıyor (oyuncu, IP, sebep ayrı alanlarda). Tüm embed'lere `timestamp` (ISO 8601) ve `footer.text` (`AtomGuard • <server-name>`) eklendi. Config: `discord-webhook.server-name`. - **`AbstractModule.isExempt(Player)` helper'ı**: Tüm modüllerin bypass kontrolü için merkezî giriş noktası. Permission + whitelist'i birlikte kontrol eder. Gelecekte ek mekanizmalar (trust score üst sınırı, IP whitelist, vs.) burada eklenecek. ### 🔧 İyileştirmeler & Race / Memory Fix'leri - **`AttackModeManager.blockedDuringAttack` race condition (Critical)**: `volatile long ++` non-atomic; async packet handler'larda lost-update race oluyordu. `AtomicLong incrementAndGet()` ile değiştirildi. - **`AtomGuardAPI.instance` volatile**: onLoad/onEnable race'inde yarım-init görme riskine karşı `volatile` eklendi. - **`SmartLagModule.unfreezeAll()` artık tüm chunk'ları taramıyor**: Eski kod yüklü TÜM chunk'ları döndüğü için 10k+ chunk'lı sunucularda main thread stall yapıyordu (lag önleyici feature lag üretiyor). Şimdi sadece `frozenChunks` set'ini iter ediyor. - **`AntiBotModule` async task disable'da iptal ediliyor**: 5 saniyelik attack-evaluation task'ı `runTaskTimerAsynchronously` ile yaratılıp ID tutulmuyordu. Şimdi `evaluationTaskId` field'da tutuluyor ve `onDisable()`'da iptal ediliyor. - **`ConnectionRateCheck` thread-safe deque erişimi**: `addLast()` + `size()` ayrı çağrılardı; başka thread eski entry'leri purge ederken size yanlış gelebilirdi. `synchronized(deque)` blok ile atomik snapshot. - **Velocity `ConnectionAnalyzer` CLAUDE.md uyum hatası**: Kod `Math.max(10, suspiciousThreshold)` kullanıyordu ama doküman "Minimum enforced at 8" diyordu. → 8'e düşürüldü (küçük sunucularda 8 daha gerçekçi). - **Config.yml — eksik bölümler eklendi**: `moduller.item-sanitizer.*` (5 anahtar), `moduller.redstone-limiter.*` (2 anahtar), `moduller.wind-charge-integrity.*` (5 anahtar), `heuristic.escik-supheli` / `escik-yuksek` / `decay-saniye` / `rotation-tolerance-derece`, `web-panel.metrics-token`, `discord-webhook.server-name`. ### 🚀 CI/CD - **Jenkinsfile — Auto Version Bump stage eklendi**: Pipeline artık `main`/`master` branch'inde, commit zaten tag'lenmemişse, conventional commit mesajından bump türünü tespit ediyor ve otomatik olarak `bump-version.sh <type> --tag --push --ci` çağırıyor. Recursion guard (`🔖 Release v` ile başlayan commit'leri skip), explicit skip (`[skip release]` / `[skip ci]`), explicit override (`[release:patch|minor|major]`) destekleniyor. Push edilen yeni tag webhook ile taze build başlatıyor ve Stable Release stage'i otomatik çalışıyor. - **`bump-version.sh` — `--ci` flag eklendi**: CI'da interaktif olmayan modda çalışması için `GIT_AUTHOR_NAME` / `GIT_AUTHOR_EMAIL` env'den okunuyor.

**Dev Build #91** - [`0156aff`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/0156affab1abf43b7bb8b52b026b9f735cd7e662) Merge pull request #10 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`79a6183`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/79a6183ce6a0462c1f8777c4d58e6b22eff04eae) fix(jenkins): skip Modrinth publish for stale tag builds — guard against accidental old-version releases (Claude) - [`d9afcfb`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d9afcfb1c6cb8a236424f559a3c27a65294cd454) Merge pull request #9 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`cb0acb4`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/cb0acb4eeb916c19fc6dec42ee1462e3c2224766) fix(ci): rewrite Jenkins trigger to support Multibranch Pipelines + multi-method fallback (Claude) - [`55b0562`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/55b056206158ecd0c3b54351dbbf54fad1ec5cd9) Merge pull request #8 from ATOMGAMERAGA/claude/jenkins-atomguard-fixes-JT76d (Atom Gamer Arda A.G.A) - [`12e1267`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/12e12678123005b1139a37763c36e36c41aaddb4) 🔖 Release v2.3.0 — Jenkins auto-version + ArmorStand/WindCharge kalıcı fix + persistent whitelist + metrics endpoint (Claude) - [`9149faa`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/9149faa47ec2cb92049cfffeec3241302388e7f4) 🔧 fix(actions): simplify Jenkins trigger to use notifyCommit endpoint (ATOMGAMERAGA) - [`979c18b`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/979c18b1634bae6434273cb5743d6fbe8a330494) 🔧 trigger-jenkins.yml: handle CSRF crumb to fix HTTP 403 (ATOMGAMERAGA) - [`e86d341`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/e86d341ccdb367905b2d1d020d8517d6f28b7560) 📝 Document trigger-jenkins.yml workflow under v2.2.9 changelog (ATOMGAMERAGA) - [`8d32535`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/8d325356b0ac91402e5ed32bf08ceb079b2e8d8a) 🔧 Add GitHub Actions workflow to trigger Jenkins directly (ATOMGAMERAGA)

### 🐛 Bug Fixes - **`FrameCrashModule` — Armor stand counter overflow causing permanent placement block**: When blocking a spawn, `count.incrementAndGet()` was called but never rolled back, permanently inflating the per-chunk counter so all future placements in that chunk were rejected indefinitely. Fixed by calling `count.decrementAndGet()` immediately before cancelling the event. Same fix applied to the item-frame path. - **`FrameCrashModule` — Stale `armorStandCounts` persisting across chunk reloads**: `clearChunk()`, `clearAll()`, and `cleanup()` only operated on `frameCounts` and completely ignored `armorStandCounts`. On chunk unload/reload the stale counter was reused instead of being recalculated from real entity counts, causing all new armor stand spawns to be blocked. All three methods now also remove/clean entries from `armorStandCounts`. - **`ExplosionLimiterModule` — Wind Charge projectile not pushing players**: `EntityType.WIND_CHARGE` and `EntityType.BREEZE_WIND_CHARGE` were counted against the 10-explosion-per-second rate limit. When other explosions (TNT, creepers, beds) consumed the budget, wind charge `EntityExplodeEvent` was cancelled, preventing its velocity/knockback effect. Both entity types are now exempt from the rate limit alongside `END_CRYSTAL`. - **`InvalidSlotModule` — Trial Chamber vault interaction blocked by too-strict slot cap**: `MAX_SLOT` was set to 90 (double chest + player inventory), which is insufficient for vault inventories in Trial Chambers. Any CLICK_WINDOW packet with a slot ID above 90 was cancelled and the inventory force-closed, preventing the vault from being opened with the trial key. `MAX_SLOT` raised to 128 to cover all vanilla container types. - **`SmartLagModule` — Trial Chamber vault state machine blocked during lag freeze**: During a lag-freeze cycle, `onPhysics()` cancelled all `BlockPhysicsEvent` in frozen chunks except WATER and LAVA. The `VAULT` block uses block-physics events to advance its state machine (INACTIVE → ACTIVE → UNLOCKING → DEACTIVATED), so physics cancellation prevented the vault from opening. `VAULT` is now added to the physics exemption list alongside WATER and LAVA.

### 🐛 Bug Fixes - **`FrameCrashModule` — Armor stand counter overflow causing permanent placement block**: When blocking a spawn, `count.incrementAndGet()` was called but never rolled back, permanently inflating the per-chunk counter so all future placements in that chunk were rejected indefinitely. Fixed by calling `count.decrementAndGet()` immediately before cancelling the event. Same fix applied to the item-frame path. - **`FrameCrashModule` — Stale `armorStandCounts` persisting across chunk reloads**: `clearChunk()`, `clearAll()`, and `cleanup()` only operated on `frameCounts` and completely ignored `armorStandCounts`. On chunk unload/reload the stale counter was reused instead of being recalculated from real entity counts, causing all new armor stand spawns to be blocked. All three methods now also remove/clean entries from `armorStandCounts`. - **`ExplosionLimiterModule` — Wind Charge projectile not pushing players**: `EntityType.WIND_CHARGE` and `EntityType.BREEZE_WIND_CHARGE` were counted against the 10-explosion-per-second rate limit. When other explosions (TNT, creepers, beds) consumed the budget, wind charge `EntityExplodeEvent` was cancelled, preventing its velocity/knockback effect. Both entity types are now exempt from the rate limit alongside `END_CRYSTAL`. - **`InvalidSlotModule` — Trial Chamber vault interaction blocked by too-strict slot cap**: `MAX_SLOT` was set to 90 (double chest + player inventory), which is insufficient for vault inventories in Trial Chambers. Any CLICK_WINDOW packet with a slot ID above 90 was cancelled and the inventory force-closed, preventing the vault from being opened with the trial key. `MAX_SLOT` raised to 128 to cover all vanilla container types. - **`SmartLagModule` — Trial Chamber vault state machine blocked during lag freeze**: During a lag-freeze cycle, `onPhysics()` cancelled all `BlockPhysicsEvent` in frozen chunks except WATER and LAVA. The `VAULT` block uses block-physics events to advance its state machine (INACTIVE → ACTIVE → UNLOCKING → DEACTIVATED), so physics cancellation prevented the vault from opening. `VAULT` is now added to the physics exemption list alongside WATER and LAVA.

### 🐛 Bug Fixes - **`FrameCrashModule` — Armor stand counter overflow causing permanent placement block**: When blocking a spawn, `count.incrementAndGet()` was called but never rolled back, permanently inflating the per-chunk counter so all future placements in that chunk were rejected indefinitely. Fixed by calling `count.decrementAndGet()` immediately before cancelling the event. Same fix applied to the item-frame path. - **`FrameCrashModule` — Stale `armorStandCounts` persisting across chunk reloads**: `clearChunk()`, `clearAll()`, and `cleanup()` only operated on `frameCounts` and completely ignored `armorStandCounts`. On chunk unload/reload the stale counter was reused instead of being recalculated from real entity counts, causing all new armor stand spawns to be blocked. All three methods now also remove/clean entries from `armorStandCounts`. - **`ExplosionLimiterModule` — Wind Charge projectile not pushing players**: `EntityType.WIND_CHARGE` and `EntityType.BREEZE_WIND_CHARGE` were counted against the 10-explosion-per-second rate limit. When other explosions (TNT, creepers, beds) consumed the budget, wind charge `EntityExplodeEvent` was cancelled, preventing its velocity/knockback effect. Both entity types are now exempt from the rate limit alongside `END_CRYSTAL`. - **`InvalidSlotModule` — Trial Chamber vault interaction blocked by too-strict slot cap**: `MAX_SLOT` was set to 90 (double chest + player inventory), which is insufficient for vault inventories in Trial Chambers. Any CLICK_WINDOW packet with a slot ID above 90 was cancelled and the inventory force-closed, preventing the vault from being opened with the trial key. `MAX_SLOT` raised to 128 to cover all vanilla container types. - **`SmartLagModule` — Trial Chamber vault state machine blocked during lag freeze**: During a lag-freeze cycle, `onPhysics()` cancelled all `BlockPhysicsEvent` in frozen chunks except WATER and LAVA. The `VAULT` block uses block-physics events to advance its state machine (INACTIVE → ACTIVE → UNLOCKING → DEACTIVATED), so physics cancellation prevented the vault from opening. `VAULT` is now added to the physics exemption list alongside WATER and LAVA.

### 🐛 Bug Fixes - **`FrameCrashModule` — Armor stand counter overflow causing permanent placement block**: When blocking a spawn, `count.incrementAndGet()` was called but never rolled back, permanently inflating the per-chunk counter so all future placements in that chunk were rejected indefinitely. Fixed by calling `count.decrementAndGet()` immediately before cancelling the event. Same fix applied to the item-frame path. - **`FrameCrashModule` — Stale `armorStandCounts` persisting across chunk reloads**: `clearChunk()`, `clearAll()`, and `cleanup()` only operated on `frameCounts` and completely ignored `armorStandCounts`. On chunk unload/reload the stale counter was reused instead of being recalculated from real entity counts, causing all new armor stand spawns to be blocked. All three methods now also remove/clean entries from `armorStandCounts`. - **`ExplosionLimiterModule` — Wind Charge projectile not pushing players**: `EntityType.WIND_CHARGE` and `EntityType.BREEZE_WIND_CHARGE` were counted against the 10-explosion-per-second rate limit. When other explosions (TNT, creepers, beds) consumed the budget, wind charge `EntityExplodeEvent` was cancelled, preventing its velocity/knockback effect. Both entity types are now exempt from the rate limit alongside `END_CRYSTAL`. - **`InvalidSlotModule` — Trial Chamber vault interaction blocked by too-strict slot cap**: `MAX_SLOT` was set to 90 (double chest + player inventory), which is insufficient for vault inventories in Trial Chambers. Any CLICK_WINDOW packet with a slot ID above 90 was cancelled and the inventory force-closed, preventing the vault from being opened with the trial key. `MAX_SLOT` raised to 128 to cover all vanilla container types. - **`SmartLagModule` — Trial Chamber vault state machine blocked during lag freeze**: During a lag-freeze cycle, `onPhysics()` cancelled all `BlockPhysicsEvent` in frozen chunks except WATER and LAVA. The `VAULT` block uses block-physics events to advance its state machine (INACTIVE → ACTIVE → UNLOCKING → DEACTIVATED), so physics cancellation prevented the vault from opening. `VAULT` is now added to the physics exemption list alongside WATER and LAVA.

**Dev Build #76** - [`e74c95d`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/e74c95daab66fec5aa45a33628e5f2f13f3c3884) 🔖 Release v2.2.4 — Dispenser/Dropper Shulker & Armor + Armor Stand Freeze Fix (ATOMGAMERAGA) - [`306c3dc`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/306c3dcad2bb749a5ec9938056fe53addb5bfc9a) 🔖 Release v2.2.3 — Dispenser/Dropper False Positive Fix (ATOMGAMERAGA) - [`c546980`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c5469807b6259eab9e3bbaec3e4a9e429c8f682f) 🔖 Release v2.2.2 — VPN/Proxy Detection Overhaul & IP+Username Pair Verification (ATOMGAMERAGA) - [`51a3c5d`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/51a3c5dd4f60270541a5e53da008902354a70d01) 🔖 Release v2.2.1 — False Positive & Thread Safety Overhaul (ATOMGAMERAGA) - [`83d59c8`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/83d59c8c870dae396d8ee875359b6ecbc8731d78) 🔧 Fix GitHub release ID parsing & re-tag v2.2.0 as stable (ATOMGAMERAGA) - [`2638acb`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/2638acb71dacdc3179bab575b12419029dcd8859) 🔧 Fix Jenkinsfile Groovy syntax error on line 161 (ATOMGAMERAGA) - [`fb1e5c0`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/fb1e5c048c0f50e72c8ea1a7b7610fc469579d43) 🔖 Release v2.2.0 — Velocity False Positive & Error Elimination (ATOMGAMERAGA) - [`0d5f294`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/0d5f294f18d413a7e3566542a4efa84adce2ff42) 🔖 Release v2.1.4 — Heuristic False Positive Kick Fix (ATOMGAMERAGA) - [`97ea350`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/97ea350e6130a41d186084c699b48d2bdc47fe1d) 🔖 Release v2.1.3 — Hit Registration & Timeout Fix (ATOMGAMERAGA) - [`7e7c9df`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/7e7c9df43e47eac93976364b0aa344d7af331063) 📝 Update CHANGELOG for v2.1.2 — Block Breaking Kick Fix (ATOMGAMERAGA)

**Dev Build #76** - [`e74c95d`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/e74c95daab66fec5aa45a33628e5f2f13f3c3884) 🔖 Release v2.2.4 — Dispenser/Dropper Shulker & Armor + Armor Stand Freeze Fix (ATOMGAMERAGA) - [`306c3dc`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/306c3dcad2bb749a5ec9938056fe53addb5bfc9a) 🔖 Release v2.2.3 — Dispenser/Dropper False Positive Fix (ATOMGAMERAGA) - [`c546980`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c5469807b6259eab9e3bbaec3e4a9e429c8f682f) 🔖 Release v2.2.2 — VPN/Proxy Detection Overhaul & IP+Username Pair Verification (ATOMGAMERAGA) - [`51a3c5d`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/51a3c5dd4f60270541a5e53da008902354a70d01) 🔖 Release v2.2.1 — False Positive & Thread Safety Overhaul (ATOMGAMERAGA) - [`83d59c8`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/83d59c8c870dae396d8ee875359b6ecbc8731d78) 🔧 Fix GitHub release ID parsing & re-tag v2.2.0 as stable (ATOMGAMERAGA) - [`2638acb`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/2638acb71dacdc3179bab575b12419029dcd8859) 🔧 Fix Jenkinsfile Groovy syntax error on line 161 (ATOMGAMERAGA) - [`fb1e5c0`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/fb1e5c048c0f50e72c8ea1a7b7610fc469579d43) 🔖 Release v2.2.0 — Velocity False Positive & Error Elimination (ATOMGAMERAGA) - [`0d5f294`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/0d5f294f18d413a7e3566542a4efa84adce2ff42) 🔖 Release v2.1.4 — Heuristic False Positive Kick Fix (ATOMGAMERAGA) - [`97ea350`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/97ea350e6130a41d186084c699b48d2bdc47fe1d) 🔖 Release v2.1.3 — Hit Registration & Timeout Fix (ATOMGAMERAGA) - [`7e7c9df`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/7e7c9df43e47eac93976364b0aa344d7af331063) 📝 Update CHANGELOG for v2.1.2 — Block Breaking Kick Fix (ATOMGAMERAGA)

### 🐛 Bug Fixes - **`SmartLagModule` — Dispenser/dropper false positive fix**: During a lag spike (tick delta > 80 ms), the module froze heavy chunks by cancelling all `BlockRedstoneEvent`, `BlockPhysicsEvent`, and `EntitySpawnEvent` in those chunks. This inadvertently broke dispensers and droppers: redstone signals to dispenser/dropper blocks were zeroed (so they never fired), placed water/lava did not flow (physics cancelled), and item/projectile entities spawned by droppers and dispensers were suppressed. Three targeted exemptions added: - `onRedstone`: Dispenser and dropper blocks are now skipped — their redstone signals are never blocked by the freeze. - `onPhysics`: `WATER` and `LAVA` blocks are now exempt — fluid physics proceed normally even in a frozen chunk. - `onSpawn`: `Item` and `Projectile` entities are now exempt — items dropped by droppers and projectiles shot by dispensers are no longer cancelled.

### 🐛 Bug Fixes - **`SmartLagModule` — Dispenser/dropper false positive fix**: During a lag spike (tick delta > 80 ms), the module froze heavy chunks by cancelling all `BlockRedstoneEvent`, `BlockPhysicsEvent`, and `EntitySpawnEvent` in those chunks. This inadvertently broke dispensers and droppers: redstone signals to dispenser/dropper blocks were zeroed (so they never fired), placed water/lava did not flow (physics cancelled), and item/projectile entities spawned by droppers and dispensers were suppressed. Three targeted exemptions added: - `onRedstone`: Dispenser and dropper blocks are now skipped — their redstone signals are never blocked by the freeze. - `onPhysics`: `WATER` and `LAVA` blocks are now exempt — fluid physics proceed normally even in a frozen chunk. - `onSpawn`: `Item` and `Projectile` entities are now exempt — items dropped by droppers and projectiles shot by dispensers are no longer cancelled.

### ✨ New Features - **Velocity — 10-layer VPN/Proxy detection system (`VPNProviderChain` v2)**: Replaced the previous multi-provider API chain with a 10-layer consensus engine: local IP list → CIDR blocker → IP2Proxy database → DNSBL (9 lists) → ASN analysis → Reverse DNS hostname patterns → Port scanning → proxycheck.io → iphub.info → AbuseIPDB / ip-api. Each layer casts a weighted vote; a configurable consensus threshold decides the final verdict. - **Velocity — `ReverseDNSDetector`**: New detection engine that resolves the connecting IP's hostname and matches it against 100+ known VPN/hosting/proxy provider patterns (NordVPN, ExpressVPN, Vultr, Hetzner, Tor exit nodes, etc.). Includes a residential ISP whitelist (Comcast, Telekom, Turkcell, etc.) to prevent false positives. Detection types: `vpn`, `hosting`, `proxy`, `tor`. - **Velocity — `PortScanDetector`**: New engine that probes 14 known proxy ports (SOCKS4/5: 1080/1081, Tor: 9050/9150, Squid/HTTP-Proxy: 3128/8080/8118, OpenVPN: 1194, PPTP: 1723, IKEv2: 500, SSH: 22) on the connecting IP using non-blocking `SocketChannel` with 800 ms connect timeout. Runs entirely on a virtual thread pool. SSH alone is never flagged; ports 443 and 8080 require at least one additional significant port to count. Requires ≥ 2 meaningful open proxy ports for `suspicious=true`. - **Velocity — `ASNDetector`**: New ASN-based engine with an embedded database of 60+ known VPN ASNs (NordVPN, ExpressVPN, Mullvad, ProtonVPN, PIA…), 35+ hosting ASNs (AWS, GCP, Azure, DigitalOcean, Hetzner, Vultr…), and 8 residential-proxy network ASNs (Bright Data, Oxylabs, SmartProxy…). Queries ip-api.com with a 10-minute local cache. Classification: `vpn` (confidence 95), `proxy` (90), `hosting` (70), `residential` (pass). - **Velocity — `DNSBLChecker` v2**: Expanded from 3 to 9 DNSBL lists (`dronebl.org`, `spamhaus xbl/zen`, `sorbs`, `socks.sorbs`, `http.sorbs`, `s5h.net`, `efnetrbl.org`, `beetjevansen.nl`). All lists are queried in parallel with a 3-second total timeout. Introduces `DNSBLResult` with `listedIn()` and `listCount()` for per-list visibility. - **Velocity — IP + Username pair verification (`VerifiedPlayerStore` v2)**: The verified-player store now tracks `(ip, username)` pairs instead of IP-only. Consequences: same IP + same username → bypass; same username + different IP → re-verification required; different username + same IP → re-verification required. Backed by a new `ag_verified_players` table with `verify_count` and `last_login` columns. Automatic migration from the old `ag_limbo_verified` table. File backup (`verified-players.txt`) maintained alongside the database. - **Velocity — Kick-After-Verify flow (`VerificationLimbo` v2)**: After passing the Limbo physics challenge the player is now kicked with a styled success message ("Your IP and username have been verified — please reconnect") instead of being silently transferred to the main server. Configurable via `kick-after-verify: true`. The kick message includes the masked IP (`1.2.*.**`) and username. Failure kick and timeout kick messages are also redesigned with coloured borders. - **Velocity — `VPNCheck` v2**: Timeout extended from 2 s to 6 s to accommodate the multi-layer chain. New `fail-closed-on-timeout` config option: when `true` and attack mode is active, a timeout result becomes a deny instead of a pass. VPN detections now use `hardDeny` (was `deny`) so the trust-score penalty is proportionally larger. Audit log entries now include the detection method, confidence score, and all reporting providers. ### 🔧 Improvements - **Velocity — Consensus algorithm with 7 decision rules**: Tor detection → unconditional block (confidence ≥ 98). ≥ 3 strong non-hosting votes → unconditional block. ≥ 2 strong votes + confidence ≥ threshold → block. Single strong vote + individual confidence ≥ 90 + weighted confidence ≥ 70 → block. Hosting-only flags → always pass (false-positive protection). General consensus threshold → block. Insufficient consensus → pass. - **Velocity — `VPNProviderChain`: private-IP check extended**: Now covers `172.16.x–172.31.x` (full RFC-1918 /12 range), `::1`, `fc00::/7`, `fe80::`, and `0.0.0.0`, preventing unnecessary lookups for link-local and ULA addresses. - **Velocity — `VPNDetectionModule`: verified-clean cache enlarged to 20 000**: Previously 10 000. Also added a 15-minute cleanup scheduler and an hourly statistics log (total checks, blocked, cache hits, verified-clean size). - **Velocity — `VPNResultCache` capacity raised to 50 000**: Configured via `vpn-proxy-block.cache-max-size` (default 50 000). TTL remains 1 hour, configurable via `vpn-proxy-block.cache-ttl-ms`. - **Velocity — `VerifiedBypassCheck` v2**: When `require-ip-username-pair: true` the bypass is granted only if both the IP **and** the username match a verified pair. Switching to a different username from the same IP forces a new Limbo session. - **Velocity — `VerificationModule`: new API methods**: `isVerifiedPair(ip, username)`, `isIPChanged(ip, username)`, `hasEverBeenVerified(username)`, `isKickAfterVerify()`, `isRequireIPUsernamePair()`. - **Velocity — `ConnectionListener` v2**: Pre-login verified flag now uses `isVerifiedPair()` when `require-ip-username-pair` is enabled. Login handler logs IP-change events ("IP change detected: &lt;user&gt; new IP: &lt;ip&gt; — re-verification") before routing to Limbo. Login handler logs verified logins explicitly. - **Velocity — `PortScanDetector`: virtual thread pool**: Uses `Executors.newVirtualThreadPerTaskExecutor()` — no thread-pool sizing needed, OS-level scheduling, ideal for high-volume I/O-bound port probing. - **Velocity — `ASNDetector`: org/ISP name keyword fallback**: If the ASN number is not in the embedded database, the org and ISP strings returned by ip-api are scanned for keywords (`vpn`, `nordvpn`, `mullvad`, `proxy`, `luminati`, `bright data`, `hosting`, `datacenter`, `vps`, etc.) to catch new or unlisted providers.

### ✨ New Features - **Velocity — 10-layer VPN/Proxy detection system (`VPNProviderChain` v2)**: Replaced the previous multi-provider API chain with a 10-layer consensus engine: local IP list → CIDR blocker → IP2Proxy database → DNSBL (9 lists) → ASN analysis → Reverse DNS hostname patterns → Port scanning → proxycheck.io → iphub.info → AbuseIPDB / ip-api. Each layer casts a weighted vote; a configurable consensus threshold decides the final verdict. - **Velocity — `ReverseDNSDetector`**: New detection engine that resolves the connecting IP's hostname and matches it against 100+ known VPN/hosting/proxy provider patterns (NordVPN, ExpressVPN, Vultr, Hetzner, Tor exit nodes, etc.). Includes a residential ISP whitelist (Comcast, Telekom, Turkcell, etc.) to prevent false positives. Detection types: `vpn`, `hosting`, `proxy`, `tor`. - **Velocity — `PortScanDetector`**: New engine that probes 14 known proxy ports (SOCKS4/5: 1080/1081, Tor: 9050/9150, Squid/HTTP-Proxy: 3128/8080/8118, OpenVPN: 1194, PPTP: 1723, IKEv2: 500, SSH: 22) on the connecting IP using non-blocking `SocketChannel` with 800 ms connect timeout. Runs entirely on a virtual thread pool. SSH alone is never flagged; ports 443 and 8080 require at least one additional significant port to count. Requires ≥ 2 meaningful open proxy ports for `suspicious=true`. - **Velocity — `ASNDetector`**: New ASN-based engine with an embedded database of 60+ known VPN ASNs (NordVPN, ExpressVPN, Mullvad, ProtonVPN, PIA…), 35+ hosting ASNs (AWS, GCP, Azure, DigitalOcean, Hetzner, Vultr…), and 8 residential-proxy network ASNs (Bright Data, Oxylabs, SmartProxy…). Queries ip-api.com with a 10-minute local cache. Classification: `vpn` (confidence 95), `proxy` (90), `hosting` (70), `residential` (pass). - **Velocity — `DNSBLChecker` v2**: Expanded from 3 to 9 DNSBL lists (`dronebl.org`, `spamhaus xbl/zen`, `sorbs`, `socks.sorbs`, `http.sorbs`, `s5h.net`, `efnetrbl.org`, `beetjevansen.nl`). All lists are queried in parallel with a 3-second total timeout. Introduces `DNSBLResult` with `listedIn()` and `listCount()` for per-list visibility. - **Velocity — IP + Username pair verification (`VerifiedPlayerStore` v2)**: The verified-player store now tracks `(ip, username)` pairs instead of IP-only. Consequences: same IP + same username → bypass; same username + different IP → re-verification required; different username + same IP → re-verification required. Backed by a new `ag_verified_players` table with `verify_count` and `last_login` columns. Automatic migration from the old `ag_limbo_verified` table. File backup (`verified-players.txt`) maintained alongside the database. - **Velocity — Kick-After-Verify flow (`VerificationLimbo` v2)**: After passing the Limbo physics challenge the player is now kicked with a styled success message ("Your IP and username have been verified — please reconnect") instead of being silently transferred to the main server. Configurable via `kick-after-verify: true`. The kick message includes the masked IP (`1.2.*.**`) and username. Failure kick and timeout kick messages are also redesigned with coloured borders. - **Velocity — `VPNCheck` v2**: Timeout extended from 2 s to 6 s to accommodate the multi-layer chain. New `fail-closed-on-timeout` config option: when `true` and attack mode is active, a timeout result becomes a deny instead of a pass. VPN detections now use `hardDeny` (was `deny`) so the trust-score penalty is proportionally larger. Audit log entries now include the detection method, confidence score, and all reporting providers. ### 🔧 Improvements - **Velocity — Consensus algorithm with 7 decision rules**: Tor detection → unconditional block (confidence ≥ 98). ≥ 3 strong non-hosting votes → unconditional block. ≥ 2 strong votes + confidence ≥ threshold → block. Single strong vote + individual confidence ≥ 90 + weighted confidence ≥ 70 → block. Hosting-only flags → always pass (false-positive protection). General consensus threshold → block. Insufficient consensus → pass. - **Velocity — `VPNProviderChain`: private-IP check extended**: Now covers `172.16.x–172.31.x` (full RFC-1918 /12 range), `::1`, `fc00::/7`, `fe80::`, and `0.0.0.0`, preventing unnecessary lookups for link-local and ULA addresses. - **Velocity — `VPNDetectionModule`: verified-clean cache enlarged to 20 000**: Previously 10 000. Also added a 15-minute cleanup scheduler and an hourly statistics log (total checks, blocked, cache hits, verified-clean size). - **Velocity — `VPNResultCache` capacity raised to 50 000**: Configured via `vpn-proxy-block.cache-max-size` (default 50 000). TTL remains 1 hour, configurable via `vpn-proxy-block.cache-ttl-ms`. - **Velocity — `VerifiedBypassCheck` v2**: When `require-ip-username-pair: true` the bypass is granted only if both the IP **and** the username match a verified pair. Switching to a different username from the same IP forces a new Limbo session. - **Velocity — `VerificationModule`: new API methods**: `isVerifiedPair(ip, username)`, `isIPChanged(ip, username)`, `hasEverBeenVerified(username)`, `isKickAfterVerify()`, `isRequireIPUsernamePair()`. - **Velocity — `ConnectionListener` v2**: Pre-login verified flag now uses `isVerifiedPair()` when `require-ip-username-pair` is enabled. Login handler logs IP-change events ("IP change detected: &lt;user&gt; new IP: &lt;ip&gt; — re-verification") before routing to Limbo. Login handler logs verified logins explicitly. - **Velocity — `PortScanDetector`: virtual thread pool**: Uses `Executors.newVirtualThreadPerTaskExecutor()` — no thread-pool sizing needed, OS-level scheduling, ideal for high-volume I/O-bound port probing. - **Velocity — `ASNDetector`: org/ISP name keyword fallback**: If the ASN number is not in the embedded database, the org and ISP strings returned by ip-api are scanned for keywords (`vpn`, `nordvpn`, `mullvad`, `proxy`, `luminati`, `bright data`, `hosting`, `datacenter`, `vps`, etc.) to catch new or unlisted providers.

### 🔧 Improvements - **Velocity — `PlayerBehaviorProfile`: `usedUsernames` set is now thread-safe**: The field was backed by a plain `HashSet`. `recordSession()` can be called from multiple Netty I/O threads simultaneously (each pre-login event arrives on a different thread), creating a risk of `ConcurrentModificationException` or silent data corruption. Replaced with `ConcurrentHashMap.newKeySet()`, which provides the same `Set` contract with full thread safety at zero contention cost. - **Velocity — `PlayerBehaviorProfile.calculateTrustScore()`: new-player first-login bonus**: Brand-new players (no sessions, no logins, no violations) start with score 50. If `trust-score-threshold` is ever misconfigured above 50, every new player is denied before they can build any history. Added a +5 bonus applied only to completely fresh profiles, raising the guaranteed floor to 55 and providing a safe buffer against accidental misconfiguration. - **Velocity — `BehaviorManager.getProfile()`: `offlineModeLenient` set at profile creation time**: Previously the flag was set only inside `recordLogin()`, which is called *after* `TrustScoreCheck` already ran. A fresh profile therefore always had `offlineModeLenient = false`, making the multi-account username penalty fire on offline-mode servers even when it should have been suppressed. Now the config is read once at profile instantiation so the flag is correct before any pipeline check consults the score. - **Velocity — `ThreatScore` setters are now `synchronized`**: `resetForNewAnalysis()` and `calculate()` were already `synchronized`, but individual setters (e.g. `setConnectionRateScore()`) were not. Under concurrent analysis of the same IP: Thread A sets a score → Thread B resets → Thread A calls `calculate()` — resulting in a corrupted total that could trigger a false-positive block or silently suppress a real threat. All seven setters are now `synchronized` on the same monitor as `calculate()`. - **Velocity — `AttackLevelManager.shouldAllowConnection()`: LOCKDOWN no longer blocks verified players**: The `LOCKDOWN` case previously returned `false` unconditionally, with a comment claiming `VerifiedPlayerShield` handles verified players separately. In practice the call order in `DDoSProtectionModule.checkConnection()` is Shield first, then `shouldAllowConnection()`. The level manager's blanket `false` overrode the Shield's approval, meaning verified players were rejected during LOCKDOWN regardless of slot availability. Changed to `isVerified` — matching the `CRITICAL` case. - **Velocity — `SmartThrottleEngine`: LOCKDOWN verified-player limit has a hard minimum of 5**: `getLimitForLevel()` returned `lockdownLimit` for verified players under LOCKDOWN. If `lockdownLimit` was set to 0 or 1 in config, verified players could still be throttled out. The value is now `Math.max(5, lockdownLimit)`, guaranteeing that at least 5 reconnect attempts per 60-second window are allowed even during the strictest attack mode. - **Velocity — `VerifiedPlayerShield.isVerified()`: consults `VerificationModule` first**: Previously only checked `VelocityAntiBotModule.isVerified()`. Players verified via the Limbo system (`VerificationModule`) were not recognized by the Shield during CRITICAL/LOCKDOWN, causing them to be denied slots despite having completed the physics challenge. Now checks VerificationModule when enabled, with AntiBot as fallback. - **Velocity — `DDoSProtectionModule.checkConnection()`: CPS counter excludes verified connections**: `synFloodDetector.recordConnection(ip)` was called for every incoming connection, including verified players. Fifty verified players reconnecting simultaneously after a server restart could push the CPS counter above the attack threshold, escalating the attack level artificially and triggering unnecessary lockdown for unrelated new players. Verified connections are now excluded from the CPS count. - **Velocity — `DDoSProtectionModule`: verified players do not receive attack-mode reputation penalties**: `reputationTracker.recordAttackConnection(ip)` was called for all connections during attack mode. Verified players reconnecting during an attack were penalized, eventually getting close to the auto-ban threshold despite being legitimate users. Penalty is now skipped when `isVerified` is true. - **Velocity — `ConnectionListener.onDisconnect()`: `VerifiedPlayerShield` slot released on player quit**: `VerifiedPlayerShield.onConnectionClosed()` decrements `slotsInUse` but was never called from the disconnect listener. Slots only grew, never shrank. After enough players logged out and back in during a CRITICAL/LOCKDOWN event, `slotsInUse` would reach `guaranteedSlots` and all subsequent verified connections would be denied with "slot full". `plugin.getDdosModule().onConnectionClosed(ip, "player-disconnect")` is now called on every `DisconnectEvent`. - **Velocity — Five modules default to `enabled: false` in `config.yml`**: `ReconnectControlModule`, `LatencyCheckModule`, `FastChatModule`, `PasswordCheckModule`, and `CountryFilterModule` had no `modules.<name>.enabled` key in `config.yml`. `VelocityModule.isConfigActive()` defaults to `true` when the key is absent, so all five were silently active on every fresh install — imposing reconnect cooldowns, latency-based kicks, and chat rate limits without the admin's knowledge. Explicit `enabled: false` sections have been added for each. - **Velocity — `ReconnectControlModule`: verified players bypass cooldown and crash-loop detection**: Pre-login listener had no verified-player check. Verified players reconnecting after a server restart hit the 10-second reconnect cooldown or were flagged as crash-loop clients. Added verified bypass via VerificationModule and AntiBot before any cooldown/crash-loop logic runs. Crash-loop threshold raised from 3 to 5 reconnects, window extended from 30 s to 60 s, and default action changed from `kick` to `flag` to prevent mass false kicks after restarts. - **Velocity — `LatencyCheckModule`: verified players bypass latency checks**: The module registered its own `LoginEvent` listener, independent of the pipeline's `skipForVerified()` mechanism. A player allowed by the pipeline could still be kicked by this module for a sub-5 ms login time (common on local datacenter proxies). Verified players now return early. Default `minimum-ms` lowered from 5 to 0 and default actions changed from `kick` to `flag`. - **Velocity — `ChatListener`: defers to `FastChatModule` when active**: Both `ChatListener` (backed by `ProxyExploitModule.checkChat()`) and `FastChatModule` subscribed to `PlayerChatEvent` independently with separate rate-limit counters. A single message could be evaluated by both systems, producing inconsistent deny decisions and sending two different error messages to the player. `ChatListener` now returns early when `FastChatModule.isEnabled()` is true. - **Velocity — `NicknameBlocker` + `HandshakeValidator`: Bedrock/Floodgate prefix exemption**: Floodgate prefixes usernames with `.` (e.g. `.BedrockPlayer123`). `ozel-karakter-engel: true` in NicknameBlocker and the `[a-zA-Z0-9_]+` regex in HandshakeValidator both rejected these names as containing illegal characters. A configurable `bedrock-prefix` key (default `.`) is now checked first in NicknameBlocker; HandshakeValidator strips a leading `.` or `*` before applying the character regex. - **Velocity — `JoinPatternDetector.getJoinScore()`: maximum capped at 60**: The raw score could reach 50 (rapid + quitter combined). With `joinPatternScore * 0.25` weighting and `flagCount = 1`, the 60 % single-flag reduction yields `50 * 0.25 * 0.60 = 7.5` — harmless alone. But combined with any second flag, the reduction disappears and the score contribution can push a borderline connection to medium-risk. The cap prevents this single detector from dominating the total score. - **Velocity — `AntiBotCheck`: redundant `antiBot.isVerified()` call removed**: `skipForVerified() = true` already prevents the check from running for verified players at the pipeline level. The additional `if (antiBot.isVerified(ctx.ip()))` guard inside `check()` was dead code that added unnecessary log noise and a redundant ConcurrentHashMap lookup on every pre-login. - **Velocity — `DDoSCheck`: verified status sourced from `ctx.verified()` instead of `AntiBot`**: Was calling `antiBot.isVerified(ctx.ip())` directly inside `check()`, ignoring that `ctx.verified()` already encodes the correct value (from both VerificationModule and AntiBot) as set by `ConnectionListener.onPreLogin()`. Unified to use `ctx.verified()` and removed the now-unused `VelocityAntiBotModule` import. - **Velocity — `ProtocolCheck`: protocol number included in kick message**: The kick message called `buildKickMessage("kick.protocol", Map.of("min", "1.21.4", "max", "1.21.4"))` with hardcoded version strings unrelated to the actual validation result. Replaced with `Map.of("sebep", result.reason(), "protokol", String.valueOf(ctx.protocol()))` so the message conveys the actual rejected protocol ID — useful for diagnosing ViaVersion setups. - **Velocity — `ConnectionPipeline.addCheck()` is now `synchronized`**: The method called `checks.clear()` then `checks.addAll(sorted)` on a `CopyOnWriteArrayList`. A `process()` call arriving between those two operations would see an empty list and skip all security checks silently. The method is now synchronized to make the snapshot-replace operation atomic. - **Velocity — `VPNCheck.check()`: timeout reduced to 2 s with `exceptionally` fail-open**: The synchronous `check()` called `checkAsync(ctx).join()`, blocking the Velocity event thread for up to 3 seconds on VPN lookup timeout. Timeout reduced to 2 seconds; `exceptionally(e -> CheckResult.allowed())` ensures any completion exception (timeout, network error) is treated as a pass rather than crashing the pipeline. - **Limbo — `GravityCheck`: tolerance widened and warmup period added**: `TOLERANCE` raised from `0.04` to `0.08` blocks. High-latency clients (300 ms+) may have multiple tick position updates batched into a single packet, causing the reported Y to deviate from the expected value by more than the old tolerance. A 2-tick warmup period is now applied — ticks 1 and 2 are never counted as incorrect — to absorb the initial positional offset that occurs when gravity integration begins from a rest state. ### 🐛 Bug Fixes - **Core — `DuplicationFixModule.onInventoryClick()`: `ArrayIndexOutOfBoundsException` on slot -1**: `event.getRawSlot()` and `event.getSlot()` return `-1` for clicks outside the inventory window (e.g. dropping items, clicking the area around the inventory). The handler attempted array-index operations with this value. Added an early return when either slot is negative, guarding all subsequent slot-access code. - **Core — Duplicate `HandlerList.unregisterAll(this)` removed from six modules**: `AbstractModule.onDisable()` already calls `HandlerList.unregisterAll(this)`. Six subclasses (`SmartLagModule`, `ShulkerByteModule`, `BundleLockModule`, `StorageEntityLockModule`, `ItemSanitizerModule`, `RedstoneLimiterModule`, `DuplicationFixModule`) repeated this call after `super.onDisable()`, resulting in a no-op double-unregister on every plugin reload. Redundant calls removed.

### 🔧 Improvements - **Velocity — `PlayerBehaviorProfile`: `usedUsernames` set is now thread-safe**: The field was backed by a plain `HashSet`. `recordSession()` can be called from multiple Netty I/O threads simultaneously (each pre-login event arrives on a different thread), creating a risk of `ConcurrentModificationException` or silent data corruption. Replaced with `ConcurrentHashMap.newKeySet()`, which provides the same `Set` contract with full thread safety at zero contention cost. - **Velocity — `PlayerBehaviorProfile.calculateTrustScore()`: new-player first-login bonus**: Brand-new players (no sessions, no logins, no violations) start with score 50. If `trust-score-threshold` is ever misconfigured above 50, every new player is denied before they can build any history. Added a +5 bonus applied only to completely fresh profiles, raising the guaranteed floor to 55 and providing a safe buffer against accidental misconfiguration. - **Velocity — `BehaviorManager.getProfile()`: `offlineModeLenient` set at profile creation time**: Previously the flag was set only inside `recordLogin()`, which is called *after* `TrustScoreCheck` already ran. A fresh profile therefore always had `offlineModeLenient = false`, making the multi-account username penalty fire on offline-mode servers even when it should have been suppressed. Now the config is read once at profile instantiation so the flag is correct before any pipeline check consults the score. - **Velocity — `ThreatScore` setters are now `synchronized`**: `resetForNewAnalysis()` and `calculate()` were already `synchronized`, but individual setters (e.g. `setConnectionRateScore()`) were not. Under concurrent analysis of the same IP: Thread A sets a score → Thread B resets → Thread A calls `calculate()` — resulting in a corrupted total that could trigger a false-positive block or silently suppress a real threat. All seven setters are now `synchronized` on the same monitor as `calculate()`. - **Velocity — `AttackLevelManager.shouldAllowConnection()`: LOCKDOWN no longer blocks verified players**: The `LOCKDOWN` case previously returned `false` unconditionally, with a comment claiming `VerifiedPlayerShield` handles verified players separately. In practice the call order in `DDoSProtectionModule.checkConnection()` is Shield first, then `shouldAllowConnection()`. The level manager's blanket `false` overrode the Shield's approval, meaning verified players were rejected during LOCKDOWN regardless of slot availability. Changed to `isVerified` — matching the `CRITICAL` case. - **Velocity — `SmartThrottleEngine`: LOCKDOWN verified-player limit has a hard minimum of 5**: `getLimitForLevel()` returned `lockdownLimit` for verified players under LOCKDOWN. If `lockdownLimit` was set to 0 or 1 in config, verified players could still be throttled out. The value is now `Math.max(5, lockdownLimit)`, guaranteeing that at least 5 reconnect attempts per 60-second window are allowed even during the strictest attack mode. - **Velocity — `VerifiedPlayerShield.isVerified()`: consults `VerificationModule` first**: Previously only checked `VelocityAntiBotModule.isVerified()`. Players verified via the Limbo system (`VerificationModule`) were not recognized by the Shield during CRITICAL/LOCKDOWN, causing them to be denied slots despite having completed the physics challenge. Now checks VerificationModule when enabled, with AntiBot as fallback. - **Velocity — `DDoSProtectionModule.checkConnection()`: CPS counter excludes verified connections**: `synFloodDetector.recordConnection(ip)` was called for every incoming connection, including verified players. Fifty verified players reconnecting simultaneously after a server restart could push the CPS counter above the attack threshold, escalating the attack level artificially and triggering unnecessary lockdown for unrelated new players. Verified connections are now excluded from the CPS count. - **Velocity — `DDoSProtectionModule`: verified players do not receive attack-mode reputation penalties**: `reputationTracker.recordAttackConnection(ip)` was called for all connections during attack mode. Verified players reconnecting during an attack were penalized, eventually getting close to the auto-ban threshold despite being legitimate users. Penalty is now skipped when `isVerified` is true. - **Velocity — `ConnectionListener.onDisconnect()`: `VerifiedPlayerShield` slot released on player quit**: `VerifiedPlayerShield.onConnectionClosed()` decrements `slotsInUse` but was never called from the disconnect listener. Slots only grew, never shrank. After enough players logged out and back in during a CRITICAL/LOCKDOWN event, `slotsInUse` would reach `guaranteedSlots` and all subsequent verified connections would be denied with "slot full". `plugin.getDdosModule().onConnectionClosed(ip, "player-disconnect")` is now called on every `DisconnectEvent`. - **Velocity — Five modules default to `enabled: false` in `config.yml`**: `ReconnectControlModule`, `LatencyCheckModule`, `FastChatModule`, `PasswordCheckModule`, and `CountryFilterModule` had no `modules.<name>.enabled` key in `config.yml`. `VelocityModule.isConfigActive()` defaults to `true` when the key is absent, so all five were silently active on every fresh install — imposing reconnect cooldowns, latency-based kicks, and chat rate limits without the admin's knowledge. Explicit `enabled: false` sections have been added for each. - **Velocity — `ReconnectControlModule`: verified players bypass cooldown and crash-loop detection**: Pre-login listener had no verified-player check. Verified players reconnecting after a server restart hit the 10-second reconnect cooldown or were flagged as crash-loop clients. Added verified bypass via VerificationModule and AntiBot before any cooldown/crash-loop logic runs. Crash-loop threshold raised from 3 to 5 reconnects, window extended from 30 s to 60 s, and default action changed from `kick` to `flag` to prevent mass false kicks after restarts. - **Velocity — `LatencyCheckModule`: verified players bypass latency checks**: The module registered its own `LoginEvent` listener, independent of the pipeline's `skipForVerified()` mechanism. A player allowed by the pipeline could still be kicked by this module for a sub-5 ms login time (common on local datacenter proxies). Verified players now return early. Default `minimum-ms` lowered from 5 to 0 and default actions changed from `kick` to `flag`. - **Velocity — `ChatListener`: defers to `FastChatModule` when active**: Both `ChatListener` (backed by `ProxyExploitModule.checkChat()`) and `FastChatModule` subscribed to `PlayerChatEvent` independently with separate rate-limit counters. A single message could be evaluated by both systems, producing inconsistent deny decisions and sending two different error messages to the player. `ChatListener` now returns early when `FastChatModule.isEnabled()` is true. - **Velocity — `NicknameBlocker` + `HandshakeValidator`: Bedrock/Floodgate prefix exemption**: Floodgate prefixes usernames with `.` (e.g. `.BedrockPlayer123`). `ozel-karakter-engel: true` in NicknameBlocker and the `[a-zA-Z0-9_]+` regex in HandshakeValidator both rejected these names as containing illegal characters. A configurable `bedrock-prefix` key (default `.`) is now checked first in NicknameBlocker; HandshakeValidator strips a leading `.` or `*` before applying the character regex. - **Velocity — `JoinPatternDetector.getJoinScore()`: maximum capped at 60**: The raw score could reach 50 (rapid + quitter combined). With `joinPatternScore * 0.25` weighting and `flagCount = 1`, the 60 % single-flag reduction yields `50 * 0.25 * 0.60 = 7.5` — harmless alone. But combined with any second flag, the reduction disappears and the score contribution can push a borderline connection to medium-risk. The cap prevents this single detector from dominating the total score. - **Velocity — `AntiBotCheck`: redundant `antiBot.isVerified()` call removed**: `skipForVerified() = true` already prevents the check from running for verified players at the pipeline level. The additional `if (antiBot.isVerified(ctx.ip()))` guard inside `check()` was dead code that added unnecessary log noise and a redundant ConcurrentHashMap lookup on every pre-login. - **Velocity — `DDoSCheck`: verified status sourced from `ctx.verified()` instead of `AntiBot`**: Was calling `antiBot.isVerified(ctx.ip())` directly inside `check()`, ignoring that `ctx.verified()` already encodes the correct value (from both VerificationModule and AntiBot) as set by `ConnectionListener.onPreLogin()`. Unified to use `ctx.verified()` and removed the now-unused `VelocityAntiBotModule` import. - **Velocity — `ProtocolCheck`: protocol number included in kick message**: The kick message called `buildKickMessage("kick.protocol", Map.of("min", "1.21.4", "max", "1.21.4"))` with hardcoded version strings unrelated to the actual validation result. Replaced with `Map.of("sebep", result.reason(), "protokol", String.valueOf(ctx.protocol()))` so the message conveys the actual rejected protocol ID — useful for diagnosing ViaVersion setups. - **Velocity — `ConnectionPipeline.addCheck()` is now `synchronized`**: The method called `checks.clear()` then `checks.addAll(sorted)` on a `CopyOnWriteArrayList`. A `process()` call arriving between those two operations would see an empty list and skip all security checks silently. The method is now synchronized to make the snapshot-replace operation atomic. - **Velocity — `VPNCheck.check()`: timeout reduced to 2 s with `exceptionally` fail-open**: The synchronous `check()` called `checkAsync(ctx).join()`, blocking the Velocity event thread for up to 3 seconds on VPN lookup timeout. Timeout reduced to 2 seconds; `exceptionally(e -> CheckResult.allowed())` ensures any completion exception (timeout, network error) is treated as a pass rather than crashing the pipeline. - **Limbo — `GravityCheck`: tolerance widened and warmup period added**: `TOLERANCE` raised from `0.04` to `0.08` blocks. High-latency clients (300 ms+) may have multiple tick position updates batched into a single packet, causing the reported Y to deviate from the expected value by more than the old tolerance. A 2-tick warmup period is now applied — ticks 1 and 2 are never counted as incorrect — to absorb the initial positional offset that occurs when gravity integration begins from a rest state. ### 🐛 Bug Fixes - **Core — `DuplicationFixModule.onInventoryClick()`: `ArrayIndexOutOfBoundsException` on slot -1**: `event.getRawSlot()` and `event.getSlot()` return `-1` for clicks outside the inventory window (e.g. dropping items, clicking the area around the inventory). The handler attempted array-index operations with this value. Added an early return when either slot is negative, guarding all subsequent slot-access code. - **Core — Duplicate `HandlerList.unregisterAll(this)` removed from six modules**: `AbstractModule.onDisable()` already calls `HandlerList.unregisterAll(this)`. Six subclasses (`SmartLagModule`, `ShulkerByteModule`, `BundleLockModule`, `StorageEntityLockModule`, `ItemSanitizerModule`, `RedstoneLimiterModule`, `DuplicationFixModule`) repeated this call after `super.onDisable()`, resulting in a no-op double-unregister on every plugin reload. Redundant calls removed.

### 🔧 Improvements - **Velocity — BotDetectionEngine: `flagCount` threshold raised to 3 for high-risk and medium-risk classification**: `isHighRisk()` and `isMediumRisk()` previously required `flagCount >= 2`, while `ThreatScore`'s own identical methods enforced `>= 3`. The discrepancy meant a player triggering exactly two suspicious categories (e.g. unusual connection rate + join-pattern) could be flagged as medium-risk. Both methods now consistently require **3 independent suspicious categories** before any blocking action is taken, making it mathematically impossible to reach a block threshold through 2-flag scenarios alone (max achievable score with 2 flags ≈ 37, well below both thresholds). - **Velocity — ConnectionAnalyzer: grace period extended from 10 s to 15 s**: The first-connection grace window (during which connection-rate counting is suppressed) was 10 seconds. Forge modpack clients, slow authentication servers, and skin-download overhead can easily exceed 10 seconds, causing the connection counter to start incrementing during legitimate join flow. Extended to 15 seconds to provide a safe buffer. - **Velocity — JoinPatternDetector: quit-count decay accelerated**: The decay interval was reduced from **5 minutes to 3 minutes**, and the decay amount was increased from **5 to 7** points per cycle. Previously, an IP that accumulated 20 quit-counts (e.g. during a server crash or mass disconnect) would take up to 20 minutes to clear the `maxQuitsBeforeSuspect` threshold. With the new values, a count of 20 decays to zero in roughly **9 minutes** (3 cycles × 7 points). - **Velocity — JoinPatternDetector: parameters now configurable via `config.yml`**: `joinWindowSeconds`, `maxJoinsInWindow`, and `maxQuitsBeforeSuspect` were previously hardcoded in `VelocityAntiBotModule.onEnable()` as `(120, 8, 15)`. Added three new config keys under `modules.bot-protection`: `join-window-seconds` (default 120), `max-joins-in-window` (default 8), `max-quits-before-suspect` (default 20). The `JoinPatternDetector` constructor still enforces its own minimums (8 / 20) as a safety floor. - **Velocity — IP Reputation: initial score raised and invalid-handshake penalty reduced**: `initial-score` increased **60 → 75**. Combined with the previous `invalid-handshake-penalty: 8`, a Forge/FML client whose handshake failed validation only 7 times (before ever logging in) could drop below the 24-hour auto-ban threshold. Penalty reduced **8 → 3**: a Forge client that fails 10 consecutive handshake checks now loses only 30 points (75 → 45), remaining well above both auto-ban thresholds (15 and 10). - **Velocity — BurstAllowance: `min-verified-ratio-percent` reduced 30 % → 15 %**: Burst mode was gated on at least 30 % of connections being from verified IPs. During server restarts or event starts, the verified ratio is naturally low (new players joining for the first time), so burst mode never activated precisely when it was needed most. Lowered to 15 % to allow burst mode to engage during realistic restart traffic. - **Velocity — `ping-per-second` config section added to `rate-limit`**: `GlobalRateLimitModule` read per-IP and global ping-rate limits from `modules.rate-limit.ping-per-second.*`, but that YAML section was missing from `config.yml`. All ping rate-limit reads fell through to hardcoded Java defaults, making the config keys invisible and non-functional. Section added with `per-ip-max: 5` and `global-max: 200`. ### 🐛 Bug Fixes - **Velocity — GlobalRateLimitModule: `ping-saniye.global-max` config key never resolved**: `allowPing()` called `getConfigInt("ping-saniye.global-max", 200)` — a Turkish/English mixed key that does not exist in `config.yml`. The read always returned the default value of 200 and could never be overridden. Corrected to `"ping-per-second.global-max"` to match the newly added YAML section.

### 🔧 Improvements - **Velocity — BotDetectionEngine: `flagCount` threshold raised to 3 for high-risk and medium-risk classification**: `isHighRisk()` and `isMediumRisk()` previously required `flagCount >= 2`, while `ThreatScore`'s own identical methods enforced `>= 3`. The discrepancy meant a player triggering exactly two suspicious categories (e.g. unusual connection rate + join-pattern) could be flagged as medium-risk. Both methods now consistently require **3 independent suspicious categories** before any blocking action is taken, making it mathematically impossible to reach a block threshold through 2-flag scenarios alone (max achievable score with 2 flags ≈ 37, well below both thresholds). - **Velocity — ConnectionAnalyzer: grace period extended from 10 s to 15 s**: The first-connection grace window (during which connection-rate counting is suppressed) was 10 seconds. Forge modpack clients, slow authentication servers, and skin-download overhead can easily exceed 10 seconds, causing the connection counter to start incrementing during legitimate join flow. Extended to 15 seconds to provide a safe buffer. - **Velocity — JoinPatternDetector: quit-count decay accelerated**: The decay interval was reduced from **5 minutes to 3 minutes**, and the decay amount was increased from **5 to 7** points per cycle. Previously, an IP that accumulated 20 quit-counts (e.g. during a server crash or mass disconnect) would take up to 20 minutes to clear the `maxQuitsBeforeSuspect` threshold. With the new values, a count of 20 decays to zero in roughly **9 minutes** (3 cycles × 7 points). - **Velocity — JoinPatternDetector: parameters now configurable via `config.yml`**: `joinWindowSeconds`, `maxJoinsInWindow`, and `maxQuitsBeforeSuspect` were previously hardcoded in `VelocityAntiBotModule.onEnable()` as `(120, 8, 15)`. Added three new config keys under `modules.bot-protection`: `join-window-seconds` (default 120), `max-joins-in-window` (default 8), `max-quits-before-suspect` (default 20). The `JoinPatternDetector` constructor still enforces its own minimums (8 / 20) as a safety floor. - **Velocity — IP Reputation: initial score raised and invalid-handshake penalty reduced**: `initial-score` increased **60 → 75**. Combined with the previous `invalid-handshake-penalty: 8`, a Forge/FML client whose handshake failed validation only 7 times (before ever logging in) could drop below the 24-hour auto-ban threshold. Penalty reduced **8 → 3**: a Forge client that fails 10 consecutive handshake checks now loses only 30 points (75 → 45), remaining well above both auto-ban thresholds (15 and 10). - **Velocity — BurstAllowance: `min-verified-ratio-percent` reduced 30 % → 15 %**: Burst mode was gated on at least 30 % of connections being from verified IPs. During server restarts or event starts, the verified ratio is naturally low (new players joining for the first time), so burst mode never activated precisely when it was needed most. Lowered to 15 % to allow burst mode to engage during realistic restart traffic. - **Velocity — `ping-per-second` config section added to `rate-limit`**: `GlobalRateLimitModule` read per-IP and global ping-rate limits from `modules.rate-limit.ping-per-second.*`, but that YAML section was missing from `config.yml`. All ping rate-limit reads fell through to hardcoded Java defaults, making the config keys invisible and non-functional. Section added with `per-ip-max: 5` and `global-max: 200`. ### 🐛 Bug Fixes - **Velocity — GlobalRateLimitModule: `ping-saniye.global-max` config key never resolved**: `allowPing()` called `getConfigInt("ping-saniye.global-max", 200)` — a Turkish/English mixed key that does not exist in `config.yml`. The read always returned the default value of 200 and could never be overridden. Corrected to `"ping-per-second.global-max"` to match the newly added YAML section.

**Dev Build #71** - [`2638acb`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/2638acb71dacdc3179bab575b12419029dcd8859) 🔧 Fix Jenkinsfile Groovy syntax error on line 161 (ATOMGAMERAGA) - [`fb1e5c0`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/fb1e5c048c0f50e72c8ea1a7b7610fc469579d43) 🔖 Release v2.2.0 — Velocity False Positive & Error Elimination (ATOMGAMERAGA) - [`0d5f294`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/0d5f294f18d413a7e3566542a4efa84adce2ff42) 🔖 Release v2.1.4 — Heuristic False Positive Kick Fix (ATOMGAMERAGA) - [`97ea350`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/97ea350e6130a41d186084c699b48d2bdc47fe1d) 🔖 Release v2.1.3 — Hit Registration & Timeout Fix (ATOMGAMERAGA) - [`7e7c9df`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/7e7c9df43e47eac93976364b0aa344d7af331063) 📝 Update CHANGELOG for v2.1.2 — Block Breaking Kick Fix (ATOMGAMERAGA) - [`ac87b94`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/ac87b9438897c97523b997c81f1a848985319b5a) 🔖 Release v2.1.2 (ATOMGAMERAGA) - [`b956d80`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b956d8038a66f0a9e6b98b7aa18ac9fd3cac0eee) 🔖 Release v2.1.1 — Code Audit Fix (Placeholders, CIDR, NPE, Thread Leak) (ATOMGAMERAGA) - [`d4f1047`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d4f10472137713828acca9e94171bbb336c31eb9) 🔖 Release v2.1.0 — Network Protection False Positive Fix (ATOMGAMERAGA) - [`5963a5b`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/5963a5b6dbb34cc0ebd86750cb72317f87f8140e) 🔖 Release v2.0.11 — PostVerificationEvent Async Fix (ATOMGAMERAGA) - [`b780fae`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b780fae856e12011b2fccad822e16ea8a22462ce) 🔖 Release v2.0.10 — False Positive & Duplication Fix Audit (ATOMGAMERAGA)

**Dev Build #71** - [`2638acb`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/2638acb71dacdc3179bab575b12419029dcd8859) 🔧 Fix Jenkinsfile Groovy syntax error on line 161 (ATOMGAMERAGA) - [`fb1e5c0`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/fb1e5c048c0f50e72c8ea1a7b7610fc469579d43) 🔖 Release v2.2.0 — Velocity False Positive & Error Elimination (ATOMGAMERAGA) - [`0d5f294`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/0d5f294f18d413a7e3566542a4efa84adce2ff42) 🔖 Release v2.1.4 — Heuristic False Positive Kick Fix (ATOMGAMERAGA) - [`97ea350`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/97ea350e6130a41d186084c699b48d2bdc47fe1d) 🔖 Release v2.1.3 — Hit Registration & Timeout Fix (ATOMGAMERAGA) - [`7e7c9df`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/7e7c9df43e47eac93976364b0aa344d7af331063) 📝 Update CHANGELOG for v2.1.2 — Block Breaking Kick Fix (ATOMGAMERAGA) - [`ac87b94`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/ac87b9438897c97523b997c81f1a848985319b5a) 🔖 Release v2.1.2 (ATOMGAMERAGA) - [`b956d80`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b956d8038a66f0a9e6b98b7aa18ac9fd3cac0eee) 🔖 Release v2.1.1 — Code Audit Fix (Placeholders, CIDR, NPE, Thread Leak) (ATOMGAMERAGA) - [`d4f1047`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d4f10472137713828acca9e94171bbb336c31eb9) 🔖 Release v2.1.0 — Network Protection False Positive Fix (ATOMGAMERAGA) - [`5963a5b`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/5963a5b6dbb34cc0ebd86750cb72317f87f8140e) 🔖 Release v2.0.11 — PostVerificationEvent Async Fix (ATOMGAMERAGA) - [`b780fae`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b780fae856e12011b2fccad822e16ea8a22462ce) 🔖 Release v2.0.10 — False Positive & Duplication Fix Audit (ATOMGAMERAGA)

### 🐛 Bug Fixes - **Core — HeuristicEngine: false positive kicks ("Şüpheli davranış tespit edildi")**: Normal gameplay (PvP, building, mining) was triggering heuristic kicks due to multiple compounding issues: - **Module violation weight too high**: Every `blockExploit()` call added 0.5 suspicion points per module block. With a 150.0 kick threshold, only 300 legitimate module blocks were needed to trigger a kick. Reduced default weight from 0.5 → 0.1 (limiters: 0.1 → 0.02). - **Kick threshold too low**: Default 150.0 was easily reachable during normal play. Raised to 300.0. - **Slow score decay**: Decay rate of 2.0 points/second meant 75 seconds of inactivity to clear a moderate score. Increased to 5.0 points/second (30 seconds to clear). - **Rotation spike penalty too harsh**: +3.0 points per 8 consecutive rotation spikes. Reduced to 1.5. - **Click variance penalty too harsh**: +8.0 points for low click variance. Reduced to 4.0. - **Session score persistence**: Heuristic profile was not reset on player join, so scores from a previous session (or a kick-reconnect cycle) carried over. Added `removeProfile()` call on `PlayerJoinEvent` to ensure a fresh profile each session.

### 🐛 Bug Fixes - **Core — HeuristicEngine: false positive kicks ("Şüpheli davranış tespit edildi")**: Normal gameplay (PvP, building, mining) was triggering heuristic kicks due to multiple compounding issues: - **Module violation weight too high**: Every `blockExploit()` call added 0.5 suspicion points per module block. With a 150.0 kick threshold, only 300 legitimate module blocks were needed to trigger a kick. Reduced default weight from 0.5 → 0.1 (limiters: 0.1 → 0.02). - **Kick threshold too low**: Default 150.0 was easily reachable during normal play. Raised to 300.0. - **Slow score decay**: Decay rate of 2.0 points/second meant 75 seconds of inactivity to clear a moderate score. Increased to 5.0 points/second (30 seconds to clear). - **Rotation spike penalty too harsh**: +3.0 points per 8 consecutive rotation spikes. Reduced to 1.5. - **Click variance penalty too harsh**: +8.0 points for low click variance. Reduced to 4.0. - **Session score persistence**: Heuristic profile was not reset on player join, so scores from a previous session (or a kick-reconnect cycle) carried over. Added `removeProfile()` call on `PlayerJoinEvent` to ensure a fresh profile each session.

### 🐛 Bug Fixes - **Core — EntityInteractCrashModule: intermittent hit registration failure in PvP**: The per-player `INTERACT_ENTITY` packet counter was never reset per second — it accumulated indefinitely and only cleared every 5 minutes via the periodic `cleanup()` task. After just 20 total interactions (not per second as the `max-interactions-per-second` config implied), all subsequent attack packets were silently dropped, making PvP combat appear to randomly stop working. Replaced the unbounded `AtomicInteger` counter with a proper 1-second sliding window (`long[]` with count + timestamp), so the limit now correctly applies per second as intended. - **Core — TokenBucketModule: intermittent "Timed Out" kicks**: `KEEP_ALIVE` and `PONG` packets were not exempted from token bucket rate limiting, unlike the other three packet-filtering modules (`PacketExploitModule`, `PacketDelayModule`, `OfflinePacketModule`) which all had explicit exemptions. These critical connection-keepalive packets were classified into the "DIGER" (other) bucket (150 capacity / 60 tokens/sec). During high traffic, the bucket would deplete and silently drop keepalive responses, causing the server to kick the player after 30 seconds with "Timed Out". Added an early return for `KEEP_ALIVE` and `PONG` packets before any bucket processing.

### 🐛 Bug Fixes - **Core — EntityInteractCrashModule: intermittent hit registration failure in PvP**: The per-player `INTERACT_ENTITY` packet counter was never reset per second — it accumulated indefinitely and only cleared every 5 minutes via the periodic `cleanup()` task. After just 20 total interactions (not per second as the `max-interactions-per-second` config implied), all subsequent attack packets were silently dropped, making PvP combat appear to randomly stop working. Replaced the unbounded `AtomicInteger` counter with a proper 1-second sliding window (`long[]` with count + timestamp), so the limit now correctly applies per second as intended. - **Core — TokenBucketModule: intermittent "Timed Out" kicks**: `KEEP_ALIVE` and `PONG` packets were not exempted from token bucket rate limiting, unlike the other three packet-filtering modules (`PacketExploitModule`, `PacketDelayModule`, `OfflinePacketModule`) which all had explicit exemptions. These critical connection-keepalive packets were classified into the "DIGER" (other) bucket (150 capacity / 60 tokens/sec). During high traffic, the bucket would deplete and silently drop keepalive responses, causing the server to kick the player after 30 seconds with "Timed Out". Added an early return for `KEEP_ALIVE` and `PONG` packets before any bucket processing.

**Dev Build #67** - [`7e7c9df`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/7e7c9df43e47eac93976364b0aa344d7af331063) 📝 Update CHANGELOG for v2.1.2 — Block Breaking Kick Fix (ATOMGAMERAGA) - [`ac87b94`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/ac87b9438897c97523b997c81f1a848985319b5a) 🔖 Release v2.1.2 (ATOMGAMERAGA) - [`b956d80`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b956d8038a66f0a9e6b98b7aa18ac9fd3cac0eee) 🔖 Release v2.1.1 — Code Audit Fix (Placeholders, CIDR, NPE, Thread Leak) (ATOMGAMERAGA) - [`d4f1047`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d4f10472137713828acca9e94171bbb336c31eb9) 🔖 Release v2.1.0 — Network Protection False Positive Fix (ATOMGAMERAGA) - [`5963a5b`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/5963a5b6dbb34cc0ebd86750cb72317f87f8140e) 🔖 Release v2.0.11 — PostVerificationEvent Async Fix (ATOMGAMERAGA) - [`b780fae`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b780fae856e12011b2fccad822e16ea8a22462ce) 🔖 Release v2.0.10 — False Positive & Duplication Fix Audit (ATOMGAMERAGA) - [`5dbd863`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/5dbd8638d9d81de802f61f4fc3cc94791edff3d7) 🔖 Release v2.0.9 — False Positive Fixes (ATOMGAMERAGA) - [`2c08e1b`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/2c08e1b622e9bc3ae27258feefabf1d599f385ca) 🔖 Release v2.0.8 — Fix player timeout caused by OfflinePacketModule (ATOMGAMERAGA) - [`b0c0184`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b0c01842faf9c030c761100cf2edddad30e2bda1) 🔖 Release v2.0.7 — AntiBotModule Kritik Düzeltmeler (ATOMGAMERAGA) - [`526be87`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/526be87e9fe275e9ba18e28fe61d34b743c31cb2) 🔖 Release v2.0.6 — Özel Login Plugini Uyumluluk Düzeltmeleri (ATOMGAMERAGA)

**Dev Build #67** - [`7e7c9df`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/7e7c9df43e47eac93976364b0aa344d7af331063) 📝 Update CHANGELOG for v2.1.2 — Block Breaking Kick Fix (ATOMGAMERAGA) - [`ac87b94`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/ac87b9438897c97523b997c81f1a848985319b5a) 🔖 Release v2.1.2 (ATOMGAMERAGA) - [`b956d80`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b956d8038a66f0a9e6b98b7aa18ac9fd3cac0eee) 🔖 Release v2.1.1 — Code Audit Fix (Placeholders, CIDR, NPE, Thread Leak) (ATOMGAMERAGA) - [`d4f1047`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d4f10472137713828acca9e94171bbb336c31eb9) 🔖 Release v2.1.0 — Network Protection False Positive Fix (ATOMGAMERAGA) - [`5963a5b`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/5963a5b6dbb34cc0ebd86750cb72317f87f8140e) 🔖 Release v2.0.11 — PostVerificationEvent Async Fix (ATOMGAMERAGA) - [`b780fae`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b780fae856e12011b2fccad822e16ea8a22462ce) 🔖 Release v2.0.10 — False Positive & Duplication Fix Audit (ATOMGAMERAGA) - [`5dbd863`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/5dbd8638d9d81de802f61f4fc3cc94791edff3d7) 🔖 Release v2.0.9 — False Positive Fixes (ATOMGAMERAGA) - [`2c08e1b`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/2c08e1b622e9bc3ae27258feefabf1d599f385ca) 🔖 Release v2.0.8 — Fix player timeout caused by OfflinePacketModule (ATOMGAMERAGA) - [`b0c0184`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b0c01842faf9c030c761100cf2edddad30e2bda1) 🔖 Release v2.0.7 — AntiBotModule Kritik Düzeltmeler (ATOMGAMERAGA) - [`526be87`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/526be87e9fe275e9ba18e28fe61d34b743c31cb2) 🔖 Release v2.0.6 — Özel Login Plugini Uyumluluk Düzeltmeleri (ATOMGAMERAGA)

### ✨ Yeni Özellikler - ### 🔧 İyileştirmeler - ### 🐛 Hata Düzeltmeleri -

### ✨ Yeni Özellikler - ### 🔧 İyileştirmeler - ### 🐛 Hata Düzeltmeleri -

### 🐛 Bug Fixes - **Core — MiniMessage placeholders broken across all message files**: All 196 dynamic placeholders in the four message files (`messages_tr.yml`, `messages_en.yml`, `velocity/messages_tr.yml`, `velocity/messages_en.yml`) were using curly-brace format (`{sayi}`, `{ip}`, `{oyuncu}`, etc.), which MiniMessage never resolves — it only processes `<tag>` syntax. Every command output, kick message, and admin notification that contained a dynamic value (counts, IPs, player names, durations) was therefore rendered as a raw literal string. All 196 occurrences converted to angle-bracket format (`<sayi>`, `<ip>`, `<oyuncu>`, etc.). - **Velocity — ExternalListManager: CIDR subnet blocking silently ignored**: `isBlocked()` contained an empty `// TODO: Proper CIDR check` branch — any entry with a `/` in it (e.g. `192.168.0.0/16`) was skipped without matching, making all subnet-based external blacklist rules completely inoperative. Replaced with a correct byte-level CIDR matching implementation using `InetAddress` and bit-mask arithmetic; IPv6 is supported by address-length parity check. - **Core — PlaceholderAPI `%atomguard_player_reputation%` always returned "100"**: The expansion returned a hardcoded `"100"` string regardless of the player's actual trust score. Wired to `TrustScoreManager.getScore(UUID)` with a `null`-safe fallback. Added two additional placeholders: `%atomguard_trust_tier%` (returns the player's `TrustTier` enum name) and `%atomguard_attack_mode_status%` (returns `"true"` / `"false"`). - **Core — BotProtectionModule: NullPointerException on `getAddress()`**: Nine call sites in `BotProtectionModule` dereferenced `user.getAddress().getAddress().getHostAddress()` without a null guard, and two more used `player.getAddress()` the same way. Proxy connections or mid-handshake disconnects can leave the address as `null`, causing an NPE that propagates into the packet handler thread. Null checks added at all eleven sites; affected handlers return early when the address is unavailable. - **Core — RateLimitMiddleware: NullPointerException on `getRemoteAddress()`**: `checkRateLimit()` unconditionally called `exchange.getRemoteAddress().getAddress().getHostAddress()`. A broken or prematurely closed HTTP connection yields a `null` remote address, causing an NPE. A `null` check is now performed first; if the address is unavailable the request is allowed through. - **Velocity — PrometheusExporter: thread leak on plugin reload**: The HTTP server executor was created with `Executors.newSingleThreadExecutor()` as an anonymous local — its reference was never stored, so `stop()` called `httpServer.stop(0)` but never shut down the executor. On each plugin reload a new thread was leaked. The executor is now stored in a field (`httpExecutor`), created as a named daemon thread, and `shutdownNow()` + `awaitTermination(3 s)` are called in `stop()`. - **Core — ForensicsManager: silent I/O failures**: Four `catch (Exception ignored) {}` blocks in `ForensicsManager` (`onAttackStart`, `recordMetrics`, `loadRecentSnapshots`, `getSnapshot`) swallowed disk I/O errors, JSON parse failures, and serialization exceptions without any log output. An admin could lose forensic attack records with no indication of why. All four blocks now log a `WARNING` with the failure context and message. - **Core — IPReputationManager: silent CIDR parse exception**: `isInBlockedCidr()` swallowed `InetAddress.getByName()` and `CidrRange.contains()` exceptions silently. Misconfigured CIDR entries would fail invisibly. Exception now logged at `WARNING` level with the offending IP and error message. - **Core — DiscordWebhookManager: silent TPS monitoring exception**: The periodic TPS check scheduled task caught all exceptions with `ignored`. Any error (e.g. server API unavailable during shutdown) would silently suppress the failure. Now logged via `LogManager.warning()`. - **Core — ConnectionThrottleModule: hardcoded Turkish kick message with legacy color codes**: The connection-throttle kick used `LegacyComponentSerializer.legacyAmpersand().deserialize("&cCok fazla baglanti denemesi!")` — a hardcoded Turkish string with old `&c` color syntax, bypassing both `MessageManager` and locale support. Replaced with `plugin.getMessageManager().getMessage("engelleme.baglanti-siniri")`, which is already defined in both `messages_tr.yml` and `messages_en.yml`. - **Core — BotProtectionModule: hardcoded strings with legacy `ChatColor` API**: Three player-facing messages (verification prompt, verification success, bot-kick) used `ChatColor.translateAlternateColorCodes('&', ...)` with hardcoded Turkish strings. Migrated to `MessageManager` (`antibot.dogrulama-mesaji`, `antibot.dogrulandi-mesaji`, `antibot.kick-mesaji`). Corresponding keys added to both locale files. `ChatColor` import removed. - **Core — ModuleManager: BotProtectionModule and AntiBotModule active simultaneously**: `@Deprecated` `BotProtectionModule` could run alongside `AntiBotModule` if both were enabled in config, causing double-kick and double-ban for the same connection. `enableAllModules()` now checks for this conflict after all modules are started and automatically disables `BotProtectionModule` with a `WARNING` log entry explaining the reason. ### 🔧 Improvements - **Core — messages_en.yml: 23 missing keys added**: The `adli-analiz`, `bal-kupu`, `guven`, and `istihbarat` sections were entirely absent from the English message file. Players or admins triggering these features on English-locale servers received `[Missing: key]` errors. All 23 keys now present with proper English translations. - **Velocity — messages_en.yml: 6 missing kick keys added**: `kick.ddos-seviye`, `kick.ddos-subnet`, `kick.ddos-parmak-izi`, `kick.ddos-itibar`, `kick.ddos-slot`, and `kick.genel` were present in the Turkish file but absent from English. Added with corresponding English text.

### 🐛 Bug Fixes - **Core — MiniMessage placeholders broken across all message files**: All 196 dynamic placeholders in the four message files (`messages_tr.yml`, `messages_en.yml`, `velocity/messages_tr.yml`, `velocity/messages_en.yml`) were using curly-brace format (`{sayi}`, `{ip}`, `{oyuncu}`, etc.), which MiniMessage never resolves — it only processes `<tag>` syntax. Every command output, kick message, and admin notification that contained a dynamic value (counts, IPs, player names, durations) was therefore rendered as a raw literal string. All 196 occurrences converted to angle-bracket format (`<sayi>`, `<ip>`, `<oyuncu>`, etc.). - **Velocity — ExternalListManager: CIDR subnet blocking silently ignored**: `isBlocked()` contained an empty `// TODO: Proper CIDR check` branch — any entry with a `/` in it (e.g. `192.168.0.0/16`) was skipped without matching, making all subnet-based external blacklist rules completely inoperative. Replaced with a correct byte-level CIDR matching implementation using `InetAddress` and bit-mask arithmetic; IPv6 is supported by address-length parity check. - **Core — PlaceholderAPI `%atomguard_player_reputation%` always returned "100"**: The expansion returned a hardcoded `"100"` string regardless of the player's actual trust score. Wired to `TrustScoreManager.getScore(UUID)` with a `null`-safe fallback. Added two additional placeholders: `%atomguard_trust_tier%` (returns the player's `TrustTier` enum name) and `%atomguard_attack_mode_status%` (returns `"true"` / `"false"`). - **Core — BotProtectionModule: NullPointerException on `getAddress()`**: Nine call sites in `BotProtectionModule` dereferenced `user.getAddress().getAddress().getHostAddress()` without a null guard, and two more used `player.getAddress()` the same way. Proxy connections or mid-handshake disconnects can leave the address as `null`, causing an NPE that propagates into the packet handler thread. Null checks added at all eleven sites; affected handlers return early when the address is unavailable. - **Core — RateLimitMiddleware: NullPointerException on `getRemoteAddress()`**: `checkRateLimit()` unconditionally called `exchange.getRemoteAddress().getAddress().getHostAddress()`. A broken or prematurely closed HTTP connection yields a `null` remote address, causing an NPE. A `null` check is now performed first; if the address is unavailable the request is allowed through. - **Velocity — PrometheusExporter: thread leak on plugin reload**: The HTTP server executor was created with `Executors.newSingleThreadExecutor()` as an anonymous local — its reference was never stored, so `stop()` called `httpServer.stop(0)` but never shut down the executor. On each plugin reload a new thread was leaked. The executor is now stored in a field (`httpExecutor`), created as a named daemon thread, and `shutdownNow()` + `awaitTermination(3 s)` are called in `stop()`. - **Core — ForensicsManager: silent I/O failures**: Four `catch (Exception ignored) {}` blocks in `ForensicsManager` (`onAttackStart`, `recordMetrics`, `loadRecentSnapshots`, `getSnapshot`) swallowed disk I/O errors, JSON parse failures, and serialization exceptions without any log output. An admin could lose forensic attack records with no indication of why. All four blocks now log a `WARNING` with the failure context and message. - **Core — IPReputationManager: silent CIDR parse exception**: `isInBlockedCidr()` swallowed `InetAddress.getByName()` and `CidrRange.contains()` exceptions silently. Misconfigured CIDR entries would fail invisibly. Exception now logged at `WARNING` level with the offending IP and error message. - **Core — DiscordWebhookManager: silent TPS monitoring exception**: The periodic TPS check scheduled task caught all exceptions with `ignored`. Any error (e.g. server API unavailable during shutdown) would silently suppress the failure. Now logged via `LogManager.warning()`. - **Core — ConnectionThrottleModule: hardcoded Turkish kick message with legacy color codes**: The connection-throttle kick used `LegacyComponentSerializer.legacyAmpersand().deserialize("&cCok fazla baglanti denemesi!")` — a hardcoded Turkish string with old `&c` color syntax, bypassing both `MessageManager` and locale support. Replaced with `plugin.getMessageManager().getMessage("engelleme.baglanti-siniri")`, which is already defined in both `messages_tr.yml` and `messages_en.yml`. - **Core — BotProtectionModule: hardcoded strings with legacy `ChatColor` API**: Three player-facing messages (verification prompt, verification success, bot-kick) used `ChatColor.translateAlternateColorCodes('&', ...)` with hardcoded Turkish strings. Migrated to `MessageManager` (`antibot.dogrulama-mesaji`, `antibot.dogrulandi-mesaji`, `antibot.kick-mesaji`). Corresponding keys added to both locale files. `ChatColor` import removed. - **Core — ModuleManager: BotProtectionModule and AntiBotModule active simultaneously**: `@Deprecated` `BotProtectionModule` could run alongside `AntiBotModule` if both were enabled in config, causing double-kick and double-ban for the same connection. `enableAllModules()` now checks for this conflict after all modules are started and automatically disables `BotProtectionModule` with a `WARNING` log entry explaining the reason. ### 🔧 Improvements - **Core — messages_en.yml: 23 missing keys added**: The `adli-analiz`, `bal-kupu`, `guven`, and `istihbarat` sections were entirely absent from the English message file. Players or admins triggering these features on English-locale servers received `[Missing: key]` errors. All 23 keys now present with proper English translations. - **Velocity — messages_en.yml: 6 missing kick keys added**: `kick.ddos-seviye`, `kick.ddos-subnet`, `kick.ddos-parmak-izi`, `kick.ddos-itibar`, `kick.ddos-slot`, and `kick.genel` were present in the Turkish file but absent from English. Added with corresponding English text.

### ✨ New Features - **Velocity — BurstAllowance system**: New `BurstAllowance` class detects legitimate short-lived traffic spikes (server restarts, event starts) and temporarily multiplies all rate limits by a configurable `burst-multiplier` (default 3×). Activation requires CPS to exceed `burst-threshold` (default 30) **and** the verified-player ratio to be above `min-verified-ratio-percent` (default 30%). At most `max-bursts-per-hour` (default 10) activations are permitted per hour to prevent abuse. Configurable under `modules.ddos-protection.burst-allowance`. - **Velocity — DDoS protection dry-run mode**: New `modules.ddos-protection.dry-run: false` config key. When set to `true`, connections that would be blocked are only logged (`[DRY-RUN] Engellenecekti: <ip> | Sebep: <reason>`) and counted under the `ddos_dryrun_would_block` statistic, but are not actually rejected. Allows safe threshold tuning on live servers before fully enabling protection. - **Velocity — `network-protection.enabled` now defaults to `true`**: The master toggle for all Velocity network protections (DDoS, AntiBot, VPN, Firewall) is now enabled out of the box. False-positive root causes have been resolved (see Fixes below), making it safe to ship protection on by default. ### 🔧 Improvements - **Velocity — Threshold recalibration (false-positive prevention)**: All DDoS protection thresholds raised to tolerate normal multi-player reconnect patterns. `attack-mode.threshold` 30 → **50** CPS, `attack-mode.min-unique-ips` 10 → **15**, `connection-limit.per-ip-per-minute` 5 → **10**, `smart-throttle.normal-limit` 10 → **15** / `cautious-limit` 5 → **8** / `lockdown-limit` 0 → **1**. `attack-levels.hysteresis-rise-seconds` 3 → **5** s, `hysteresis-fall-seconds` 15 → **30** s. `rate-limit.connections-per-second.per-ip-max` 3 → **5**, `global-max` 50 → **100**. - **Velocity — AttackLevelManager CPS multipliers raised**: Level transition thresholds increased so that small concurrent join bursts (6–7 players) no longer trigger ELEVATED mode. ELEVATED now requires 2× base CPS (was 1.5×), HIGH 3× (was 2×), CRITICAL 5× (was 3×), LOCKDOWN 8× (was 5×). - **Velocity — SmartThrottleEngine: sliding window replaces cumulative counter**: The per-IP throttle counter was a Caffeine `AtomicInteger` that only reset after a 5-minute TTL, allowing a player who reconnected 11 times within 5 minutes to be permanently throttled until the window expired. Replaced with `ConcurrentLinkedDeque<Long>` timestamps and a 60-second sliding window — only connections within the last 60 seconds count toward the limit. - **Velocity — ConnectionThrottler: verified-player bypass**: `tryConnect(ip, isVerified)` and `tryConnectAttackMode(ip, isVerified)` overloads added. Verified players (those who have previously logged in successfully) receive `max(limitPerMinute × 3, 15)` connections per minute in normal mode and `limitPerMinute` (instead of `limitPerMinute / 2`) in attack mode, eliminating throttle-caused reconnect loops for returning players. ### 🐛 Bug Fixes - **Velocity — DDoSProtectionModule config completely disconnected from `config.yml`**: The module was registered under the name `"ddos-koruma"` but `config.yml` uses `modules.ddos-protection`. Additionally, all 43 config keys in `onEnable()` were Turkish (e.g. `saldiri-modu.esik`, `akilli-throttle.normal-limit`) while the YAML uses English keys. As a result, every config read fell through to the Java hardcoded default and `config.yml` edits had no effect on DDoS behaviour. The module name is now `"ddos-protection"` and all keys are aligned with `config.yml`. - **Velocity — VelocityAntiBotModule config keys mismatched**: `onEnable()` read Turkish keys (`analiz-penceresi`, `supheli-esik`, `yuksek-risk-esik`, `captcha.aktif`, etc.) while `config.yml` uses English (`analysis-window`, `suspicious-threshold`, `high-risk-threshold`, `captcha.enabled`). All 11 keys corrected. Additionally, the `bot-protection` YAML section was at the top level of the file while `VelocityModule.getConfigXxx()` prefixes with `modules.`; the section has been moved under `modules:` so reads now resolve correctly. - **Velocity — NicknameBlocker read from wrong YAML path**: `NicknameBlocker.reload()` read from `bot-protection.nick-engelleme.*` (top-level). After moving `bot-protection` under `modules:`, all paths updated to `modules.bot-protection.nick-engelleme.*`. - **Velocity — FirewallModule config keys mismatched**: `onEnable()` and `onConfigReload()` used Turkish keys (`oto-yasak-esik`, `oto-yasak-sure`, `kalici-yasak-esik`, `decay-dakika`); these now match the YAML (`auto-ban-threshold`, `auto-ban-duration`, `permanent-ban-threshold`, `decay-minutes`). `permanent-ban-threshold: 500` added to `config.yml`. - **Velocity — VPNDetectionModule `premium-vpn-politikasi` key never read**: The premium-bypass policy was hardcoded to `"izin-ver"` because the config key didn't exist in `config.yml`. Key renamed to `premium-vpn-policy: "allow"` and added to the `modules.vpn-proxy-block` section. - **Velocity — ProxyExploitModule config section missing**: The module was registered as `"exploit-koruma"` with no matching `modules.exploit-koruma` section in `config.yml`. Module renamed to `"exploit-protection"`, Turkish keys (`sohbet-limit`, `tekrar-mesaj-limit`, `komut-limit`, `sunucu-degistirme-limit`) corrected to English, and a full `modules.exploit-protection` block added to `config.yml`.

### ✨ New Features - **Velocity — BurstAllowance system**: New `BurstAllowance` class detects legitimate short-lived traffic spikes (server restarts, event starts) and temporarily multiplies all rate limits by a configurable `burst-multiplier` (default 3×). Activation requires CPS to exceed `burst-threshold` (default 30) **and** the verified-player ratio to be above `min-verified-ratio-percent` (default 30%). At most `max-bursts-per-hour` (default 10) activations are permitted per hour to prevent abuse. Configurable under `modules.ddos-protection.burst-allowance`. - **Velocity — DDoS protection dry-run mode**: New `modules.ddos-protection.dry-run: false` config key. When set to `true`, connections that would be blocked are only logged (`[DRY-RUN] Engellenecekti: <ip> | Sebep: <reason>`) and counted under the `ddos_dryrun_would_block` statistic, but are not actually rejected. Allows safe threshold tuning on live servers before fully enabling protection. - **Velocity — `network-protection.enabled` now defaults to `true`**: The master toggle for all Velocity network protections (DDoS, AntiBot, VPN, Firewall) is now enabled out of the box. False-positive root causes have been resolved (see Fixes below), making it safe to ship protection on by default. ### 🔧 Improvements - **Velocity — Threshold recalibration (false-positive prevention)**: All DDoS protection thresholds raised to tolerate normal multi-player reconnect patterns. `attack-mode.threshold` 30 → **50** CPS, `attack-mode.min-unique-ips` 10 → **15**, `connection-limit.per-ip-per-minute` 5 → **10**, `smart-throttle.normal-limit` 10 → **15** / `cautious-limit` 5 → **8** / `lockdown-limit` 0 → **1**. `attack-levels.hysteresis-rise-seconds` 3 → **5** s, `hysteresis-fall-seconds` 15 → **30** s. `rate-limit.connections-per-second.per-ip-max` 3 → **5**, `global-max` 50 → **100**. - **Velocity — AttackLevelManager CPS multipliers raised**: Level transition thresholds increased so that small concurrent join bursts (6–7 players) no longer trigger ELEVATED mode. ELEVATED now requires 2× base CPS (was 1.5×), HIGH 3× (was 2×), CRITICAL 5× (was 3×), LOCKDOWN 8× (was 5×). - **Velocity — SmartThrottleEngine: sliding window replaces cumulative counter**: The per-IP throttle counter was a Caffeine `AtomicInteger` that only reset after a 5-minute TTL, allowing a player who reconnected 11 times within 5 minutes to be permanently throttled until the window expired. Replaced with `ConcurrentLinkedDeque<Long>` timestamps and a 60-second sliding window — only connections within the last 60 seconds count toward the limit. - **Velocity — ConnectionThrottler: verified-player bypass**: `tryConnect(ip, isVerified)` and `tryConnectAttackMode(ip, isVerified)` overloads added. Verified players (those who have previously logged in successfully) receive `max(limitPerMinute × 3, 15)` connections per minute in normal mode and `limitPerMinute` (instead of `limitPerMinute / 2`) in attack mode, eliminating throttle-caused reconnect loops for returning players. ### 🐛 Bug Fixes - **Velocity — DDoSProtectionModule config completely disconnected from `config.yml`**: The module was registered under the name `"ddos-koruma"` but `config.yml` uses `modules.ddos-protection`. Additionally, all 43 config keys in `onEnable()` were Turkish (e.g. `saldiri-modu.esik`, `akilli-throttle.normal-limit`) while the YAML uses English keys. As a result, every config read fell through to the Java hardcoded default and `config.yml` edits had no effect on DDoS behaviour. The module name is now `"ddos-protection"` and all keys are aligned with `config.yml`. - **Velocity — VelocityAntiBotModule config keys mismatched**: `onEnable()` read Turkish keys (`analiz-penceresi`, `supheli-esik`, `yuksek-risk-esik`, `captcha.aktif`, etc.) while `config.yml` uses English (`analysis-window`, `suspicious-threshold`, `high-risk-threshold`, `captcha.enabled`). All 11 keys corrected. Additionally, the `bot-protection` YAML section was at the top level of the file while `VelocityModule.getConfigXxx()` prefixes with `modules.`; the section has been moved under `modules:` so reads now resolve correctly. - **Velocity — NicknameBlocker read from wrong YAML path**: `NicknameBlocker.reload()` read from `bot-protection.nick-engelleme.*` (top-level). After moving `bot-protection` under `modules:`, all paths updated to `modules.bot-protection.nick-engelleme.*`. - **Velocity — FirewallModule config keys mismatched**: `onEnable()` and `onConfigReload()` used Turkish keys (`oto-yasak-esik`, `oto-yasak-sure`, `kalici-yasak-esik`, `decay-dakika`); these now match the YAML (`auto-ban-threshold`, `auto-ban-duration`, `permanent-ban-threshold`, `decay-minutes`). `permanent-ban-threshold: 500` added to `config.yml`. - **Velocity — VPNDetectionModule `premium-vpn-politikasi` key never read**: The premium-bypass policy was hardcoded to `"izin-ver"` because the config key didn't exist in `config.yml`. Key renamed to `premium-vpn-policy: "allow"` and added to the `modules.vpn-proxy-block` section. - **Velocity — ProxyExploitModule config section missing**: The module was registered as `"exploit-koruma"` with no matching `modules.exploit-koruma` section in `config.yml`. Module renamed to `"exploit-protection"`, Turkish keys (`sohbet-limit`, `tekrar-mesaj-limit`, `komut-limit`, `sunucu-degistirme-limit`) corrected to English, and a full `modules.exploit-protection` block added to `config.yml`.

### 🐛 Bug Fixes - **Core — TrustScoreManager: `IllegalStateException` on player quit**: `PostVerificationEvent` is declared as an async event (`super(true)`), but `recalculate()` was firing it synchronously via `Bukkit.getPluginManager().callEvent()` from the main server thread. This was triggered on every player disconnect through the `PlayerQuitEvent → recordQuit() → recalculate()` call chain, as well as from `recordViolation()` and `recordKick()`. Paper 1.21.4 enforces that async events may only be called from off-thread, throwing `IllegalStateException` and leaving the trust score partially updated. The event dispatch in `recalculate()` is now wrapped in `Bukkit.getScheduler().runTaskAsynchronously()`, covering all three call sites at once.

### 🐛 Bug Fixes - **Core — TrustScoreManager: `IllegalStateException` on player quit**: `PostVerificationEvent` is declared as an async event (`super(true)`), but `recalculate()` was firing it synchronously via `Bukkit.getPluginManager().callEvent()` from the main server thread. This was triggered on every player disconnect through the `PlayerQuitEvent → recordQuit() → recalculate()` call chain, as well as from `recordViolation()` and `recordKick()`. Paper 1.21.4 enforces that async events may only be called from off-thread, throwing `IllegalStateException` and leaving the trust score partially updated. The event dispatch in `recalculate()` is now wrapped in `Bukkit.getScheduler().runTaskAsynchronously()`, covering all three call sites at once.

### 🐛 Bug Fixes - **Core — DuplicationFixModule: ArrayIndexOutOfBoundsException on hotbar swap**: `InventoryClickEvent.getHotbarButton()` returns `-1` for non-hotbar keyboard clicks (including `SWAP_OFFHAND`), causing `PlayerInventory.getItem(-1)` to throw `ArrayIndexOutOfBoundsException`. The slot value is now validated with `>= 0 && < inventory.getSize()` before use. The `SWAP_OFFHAND` (`F` key) click type is now handled separately — if the item in the player's offhand is a Shulker Box while a Shulker Box inventory is open, the swap is cancelled, closing the shulker-in-shulker duplication vector. - **Core — HeuristicEngine: false-positive kicks for legitimate players**: Several thresholds were too aggressive for normal gameplay. `max-rotation-speed` default raised from `8.0` to `12.0` degrees/ms (high-DPI mice), `max-rotation-spikes` from `5` to `8`. Rotation suspicion added per burst lowered from `5.0` to `3.0`, click suspicion from `15.0` to `8.0`. The kick threshold in `checkSuspicionLevel()` raised from `100.0` to `150.0`; after a kick the suspicion score is now fully zeroed instead of only reducing by 50. Players with the `atomguard.bypass` permission now skip both rotation and click analysis entirely. Rotation analysis is skipped for the first 5 seconds after a player joins (session grace period) to avoid false spikes from initial position packets. Click intervals below 10 ms are filtered out as lag-induced packet merging artifacts. When speed falls below the threshold, spikes now decrement by 1 (`decrementRotationSpikes`) instead of resetting to zero, preventing a single normal packet from clearing accumulated evidence. The minimum click sample count raised from `10` to `15`. - **Core — HeuristicProfile: decay too slow and suspicion cap too low**: `DECAY_RATE_PER_SECOND` raised from `0.5` to `2.0` (4× faster natural decay), `MAX_CLICK_SAMPLES` from `20` to `30`. The `addSuspicion()` internal cap raised from `100.0` to `200.0` so the score can actually reach the new `150.0` kick threshold. New `sessionStartTime` field (set to `System.currentTimeMillis()` at profile creation) with getter/setter for grace period checks. New `decrementRotationSpikes()` method decrements `rotationSpikes` by 1 if positive (gradual cooldown instead of instant reset). - **Core — AbstractModule: blockExploit() applies uniform +1.0 heuristic weight regardless of module type**: High-frequency limiter modules (`piston-limiter`, `redstone-limiter`, `falling-block-limiter`, `explosion-limiter`) fire hundreds of times per second during normal lag spikes, causing innocent players to accumulate suspicion rapidly. These modules now contribute `+0.1` per block event; all other modules contribute `+0.5` (was always `+1.0`). ### 🔧 Improvements - **Config — New `heuristic` section**: Added a dedicated `heuristic:` block to `config.yml` (placed before `external-services:`) exposing all tunable thresholds: `action`, `kick-threshold` (150.0), `max-rotation-speed` (12.0), `max-rotation-spikes` (8), `min-spike-interval-ms` (150), `min-click-samples` (15), `min-click-variance` (5.0), `max-avg-click-interval` (100.0). These values were previously hard-coded in the engine; operators can now raise them on high-activity servers to further reduce false positives without touching the source.

### 🐛 Bug Fixes - **Core — DuplicationFixModule: ArrayIndexOutOfBoundsException on hotbar swap**: `InventoryClickEvent.getHotbarButton()` returns `-1` for non-hotbar keyboard clicks (including `SWAP_OFFHAND`), causing `PlayerInventory.getItem(-1)` to throw `ArrayIndexOutOfBoundsException`. The slot value is now validated with `>= 0 && < inventory.getSize()` before use. The `SWAP_OFFHAND` (`F` key) click type is now handled separately — if the item in the player's offhand is a Shulker Box while a Shulker Box inventory is open, the swap is cancelled, closing the shulker-in-shulker duplication vector. - **Core — HeuristicEngine: false-positive kicks for legitimate players**: Several thresholds were too aggressive for normal gameplay. `max-rotation-speed` default raised from `8.0` to `12.0` degrees/ms (high-DPI mice), `max-rotation-spikes` from `5` to `8`. Rotation suspicion added per burst lowered from `5.0` to `3.0`, click suspicion from `15.0` to `8.0`. The kick threshold in `checkSuspicionLevel()` raised from `100.0` to `150.0`; after a kick the suspicion score is now fully zeroed instead of only reducing by 50. Players with the `atomguard.bypass` permission now skip both rotation and click analysis entirely. Rotation analysis is skipped for the first 5 seconds after a player joins (session grace period) to avoid false spikes from initial position packets. Click intervals below 10 ms are filtered out as lag-induced packet merging artifacts. When speed falls below the threshold, spikes now decrement by 1 (`decrementRotationSpikes`) instead of resetting to zero, preventing a single normal packet from clearing accumulated evidence. The minimum click sample count raised from `10` to `15`. - **Core — HeuristicProfile: decay too slow and suspicion cap too low**: `DECAY_RATE_PER_SECOND` raised from `0.5` to `2.0` (4× faster natural decay), `MAX_CLICK_SAMPLES` from `20` to `30`. The `addSuspicion()` internal cap raised from `100.0` to `200.0` so the score can actually reach the new `150.0` kick threshold. New `sessionStartTime` field (set to `System.currentTimeMillis()` at profile creation) with getter/setter for grace period checks. New `decrementRotationSpikes()` method decrements `rotationSpikes` by 1 if positive (gradual cooldown instead of instant reset). - **Core — AbstractModule: blockExploit() applies uniform +1.0 heuristic weight regardless of module type**: High-frequency limiter modules (`piston-limiter`, `redstone-limiter`, `falling-block-limiter`, `explosion-limiter`) fire hundreds of times per second during normal lag spikes, causing innocent players to accumulate suspicion rapidly. These modules now contribute `+0.1` per block event; all other modules contribute `+0.5` (was always `+1.0`). ### 🔧 Improvements - **Config — New `heuristic` section**: Added a dedicated `heuristic:` block to `config.yml` (placed before `external-services:`) exposing all tunable thresholds: `action`, `kick-threshold` (150.0), `max-rotation-speed` (12.0), `max-rotation-spikes` (8), `min-spike-interval-ms` (150), `min-click-samples` (15), `min-click-variance` (5.0), `max-avg-click-interval` (100.0). These values were previously hard-coded in the engine; operators can now raise them on high-activity servers to further reduce false positives without touching the source.

### 🐛 Bug Fixes - **Velocity — HandshakeValidator: missing protocol IDs for 1.21.2–1.21.4**: Protocol numbers `769` (1.21.4), `768` (1.21.3), and `767` (1.21.2) were absent from `KNOWN_PROTOCOLS`. With `enforce-known-protocols: true`, every legitimate 1.21.2+ client received a `handshakeScore=50`, which combined with other categories could trigger a false-positive kick. A new `ek-protokoller` config list allows adding future protocol numbers without a plugin update. - **Velocity — BrandAnalyzer: unknown-brand false positives**: Many widely-used clients were missing from the legitimate brand list (`sodium`, `iris`, `fml,forge`, `fml`, `tlauncher`, `shiginima`, `pojav`, `meteor`, `wurst`). With `allow-unknown: false` these players received an unnecessary `brandScore=20`. A new `izinli-brandlar` config list allows operators to add their own allowed brands. - **Velocity — ConnectionListener.onBrand() race condition**: `PlayerClientBrandEvent` can fire before `LoginEvent`, meaning `isVerified(ip)` returns `false` at brand-check time even for legitimate players. If the player already has a backend server connection (`getCurrentServer().isPresent()`), the handler now calls `markVerified(ip)` and returns immediately instead of scoring and potentially kicking. - **Velocity — VelocityAntiBotModule: NicknameBlocker sets all 7 score categories to 100**: When a blocked nickname was detected, all categories (`connectionRate`, `handshake`, `brand`, `joinPattern`, `geo`, `protocol`) were forced to 100 in addition to `username`. This produced misleading audit logs and inflated `flagCount`, bypassing the single-category 60 % penalty in `ThreatScore.calculate()`. Now only `usernameScore=100` is set; `flagCount` stays at 1 and the penalty is applied correctly. - **Velocity — recordBrand() double analyze clears previous scores**: `recordBrand()` called a full `engine.analyze()` as a second pass, which triggered `resetForNewAnalysis()` and wiped all scores built by the initial `analyzePreLogin()`. Brand is now applied via the new `BotDetectionEngine.updateBrandScore()` method, which sets `brandScore` and calls `calculate()` without resetting other categories. - **Velocity — IPReputationEngine: grace-period race condition**: Two concurrent pipeline checks for the same IP could both pass the 3-violation grace period by reading `violations.get()` before either had incremented. The violation counter is now incremented atomically at the top of `addContextualScore()` and the method returns early if the IP is still within the grace window, preventing any score accumulation or downstream ban checks during the grace period. - **Velocity — PlayerBehaviorProfile: username-diversity penalty on offline-mode servers**: The trust score applied a −20 penalty when more than 3 different usernames were seen from the same IP. On offline-mode servers (cracked launchers, multiple household accounts) this is completely normal behaviour. The threshold is raised to 6 unique usernames, the penalty reduced to −10, and a new `offlineModeLenient` flag disables the penalty entirely when set. - **Velocity — LatencyCheckModule: fast-login threshold too aggressive**: The default minimum handshake-to-login duration was 15 ms, which caused false kicks for players connecting from the same data centre or through a local proxy. Default lowered to 5 ms. - **Core — HeuristicEngine: high-DPI mouse users flagged for rotation speed**: Default `max-rotation-speed` raised from 5.0 to 8.0 degrees/ms, and `max-rotation-spikes` raised from 3 to 5. A new `min-spike-interval-ms` guard (default 100 ms) ensures that rapid successive packets at high FPS are counted as at most one spike per interval, preventing false suspicion accumulation from legitimate 360° PvP movement.

### 🐛 Bug Fixes - **Velocity — HandshakeValidator: missing protocol IDs for 1.21.2–1.21.4**: Protocol numbers `769` (1.21.4), `768` (1.21.3), and `767` (1.21.2) were absent from `KNOWN_PROTOCOLS`. With `enforce-known-protocols: true`, every legitimate 1.21.2+ client received a `handshakeScore=50`, which combined with other categories could trigger a false-positive kick. A new `ek-protokoller` config list allows adding future protocol numbers without a plugin update. - **Velocity — BrandAnalyzer: unknown-brand false positives**: Many widely-used clients were missing from the legitimate brand list (`sodium`, `iris`, `fml,forge`, `fml`, `tlauncher`, `shiginima`, `pojav`, `meteor`, `wurst`). With `allow-unknown: false` these players received an unnecessary `brandScore=20`. A new `izinli-brandlar` config list allows operators to add their own allowed brands. - **Velocity — ConnectionListener.onBrand() race condition**: `PlayerClientBrandEvent` can fire before `LoginEvent`, meaning `isVerified(ip)` returns `false` at brand-check time even for legitimate players. If the player already has a backend server connection (`getCurrentServer().isPresent()`), the handler now calls `markVerified(ip)` and returns immediately instead of scoring and potentially kicking. - **Velocity — VelocityAntiBotModule: NicknameBlocker sets all 7 score categories to 100**: When a blocked nickname was detected, all categories (`connectionRate`, `handshake`, `brand`, `joinPattern`, `geo`, `protocol`) were forced to 100 in addition to `username`. This produced misleading audit logs and inflated `flagCount`, bypassing the single-category 60 % penalty in `ThreatScore.calculate()`. Now only `usernameScore=100` is set; `flagCount` stays at 1 and the penalty is applied correctly. - **Velocity — recordBrand() double analyze clears previous scores**: `recordBrand()` called a full `engine.analyze()` as a second pass, which triggered `resetForNewAnalysis()` and wiped all scores built by the initial `analyzePreLogin()`. Brand is now applied via the new `BotDetectionEngine.updateBrandScore()` method, which sets `brandScore` and calls `calculate()` without resetting other categories. - **Velocity — IPReputationEngine: grace-period race condition**: Two concurrent pipeline checks for the same IP could both pass the 3-violation grace period by reading `violations.get()` before either had incremented. The violation counter is now incremented atomically at the top of `addContextualScore()` and the method returns early if the IP is still within the grace window, preventing any score accumulation or downstream ban checks during the grace period. - **Velocity — PlayerBehaviorProfile: username-diversity penalty on offline-mode servers**: The trust score applied a −20 penalty when more than 3 different usernames were seen from the same IP. On offline-mode servers (cracked launchers, multiple household accounts) this is completely normal behaviour. The threshold is raised to 6 unique usernames, the penalty reduced to −10, and a new `offlineModeLenient` flag disables the penalty entirely when set. - **Velocity — LatencyCheckModule: fast-login threshold too aggressive**: The default minimum handshake-to-login duration was 15 ms, which caused false kicks for players connecting from the same data centre or through a local proxy. Default lowered to 5 ms. - **Core — HeuristicEngine: high-DPI mouse users flagged for rotation speed**: Default `max-rotation-speed` raised from 5.0 to 8.0 degrees/ms, and `max-rotation-spikes` raised from 3 to 5. A new `min-spike-interval-ms` guard (default 100 ms) ensures that rapid successive packets at high FPS are counted as at most one spike per interval, preventing false suspicion accumulation from legitimate 360° PvP movement.

### 🐛 Bug Fixes - **Core — OfflinePacketModule auto-disable when no auth plugin detected**: If no known auth plugin (AuthMe, nLogin, OpeNLogin, LoginSecurity, JPremium, FastLogin, LimboAuth) is found at startup, OfflinePacketModule and AuthListener are no longer loaded. This was the root cause of players getting "timed out" on servers with custom login plugins. Can be force-enabled via `modules.offline-packet.zorla-aktif: true`. - **Core — OfflinePacketModule KEEP_ALIVE/PONG packet exemption**: KEEP_ALIVE, PONG, CLIENT_SETTINGS, RESOURCE_PACK_STATUS, and PLUGIN_MESSAGE packets are now unconditionally exempted from all checks. Previously, these connection-critical packets could be cancelled after the grace period expired, causing the server to think the player was unresponsive and kicking them for timeout. - **Core — OfflinePacketModule grace period check order fixed**: Grace period check now runs BEFORE IP validation. Previously, an IP mismatch (e.g. IPv4/IPv6 dual-stack) would cancel all packets including KEEP_ALIVE even during the grace period, because the IP check ran first. - **Core — OfflinePacketModule IPv4/IPv6 IP comparison fix**: IP validation now uses `getHostAddress()` string comparison instead of `InetAddress.equals()`, which fails on dual-stack connections (e.g. `127.0.0.1` vs `::ffff:127.0.0.1`). - **Core — AdvancedChatModule grace period bypass**: Chat rate limiting and spam detection now skip players in the auth grace period, preventing chat blocks during the login process. ### 🔧 Improvements - **Config — offline-packet.tolerance-ms**: Default increased from 30000ms (30s) to 60000ms (60s) to accommodate slower auth flows. - **Config — offline-packet.zorla-aktif**: New config key (default: `false`) to force-enable OfflinePacketModule even when no known auth plugin is detected.

### 🐛 Bug Fixes - **Core — OfflinePacketModule auto-disable when no auth plugin detected**: If no known auth plugin (AuthMe, nLogin, OpeNLogin, LoginSecurity, JPremium, FastLogin, LimboAuth) is found at startup, OfflinePacketModule and AuthListener are no longer loaded. This was the root cause of players getting "timed out" on servers with custom login plugins. Can be force-enabled via `modules.offline-packet.zorla-aktif: true`. - **Core — OfflinePacketModule KEEP_ALIVE/PONG packet exemption**: KEEP_ALIVE, PONG, CLIENT_SETTINGS, RESOURCE_PACK_STATUS, and PLUGIN_MESSAGE packets are now unconditionally exempted from all checks. Previously, these connection-critical packets could be cancelled after the grace period expired, causing the server to think the player was unresponsive and kicking them for timeout. - **Core — OfflinePacketModule grace period check order fixed**: Grace period check now runs BEFORE IP validation. Previously, an IP mismatch (e.g. IPv4/IPv6 dual-stack) would cancel all packets including KEEP_ALIVE even during the grace period, because the IP check ran first. - **Core — OfflinePacketModule IPv4/IPv6 IP comparison fix**: IP validation now uses `getHostAddress()` string comparison instead of `InetAddress.equals()`, which fails on dual-stack connections (e.g. `127.0.0.1` vs `::ffff:127.0.0.1`). - **Core — AdvancedChatModule grace period bypass**: Chat rate limiting and spam detection now skip players in the auth grace period, preventing chat blocks during the login process. ### 🔧 Improvements - **Config — offline-packet.tolerance-ms**: Default increased from 30000ms (30s) to 60000ms (60s) to accommodate slower auth flows. - **Config — offline-packet.zorla-aktif**: New config key (default: `false`) to force-enable OfflinePacketModule even when no known auth plugin is detected.

### 🐛 Hata Düzeltmeleri - **Core — VerificationManager tick sayacı düzeltildi**: Timer periyodu 40→20 tick'e düşürüldü; `cycleCounter` eklendi. `ticksSinceJoin` artık gerçek saniyeyle 1:1 eşleşiyor (önceki versiyonda 40x yavaştı; whitelist'e ulaşmak 20 dakika sürüyordu). - **Core — PlayerProfile client brand gerçekten okunuyor**: `recordPluginMessage()` artık `minecraft:brand` paketinin payload'ını VarInt prefix ile doğru parse ediyor. Configuration phase (`WrapperConfigClientPluginMessage`) ve Play phase ayrı ayrı handle ediliyor. Önceki versiyonda brand her zaman `"unknown"` döndürüyordu. - **Core — PlayerProfile volatile eksikliği giderildi**: `protocolVersion`, `clientBrand`, `handshakeHostname` field'larına `volatile` eklendi (Netty thread'inde yazılır, async timer thread'inde okunur). - **Core — KeepAlive ID bazlı eşleşme**: `recordKeepAliveSent()` / `recordKeepAliveResponse()` artık KeepAlive ID'sini kullanıyor. Önceki tek-timestamp yaklaşımı `0ms` response time üretiyor ve `+20` puan yazıyordu. - **Core — AntiBotModule getOrCreateProfile race condition**: Pre-login'de IP profili oluşturuluyordu; Login'de UUID ile farklı profil açılıyordu. `CLIENT_SETTINGS` IP profilinde kalıyor, UUID profilinde yoktu → `+15` puan. Artık UUID geldiğinde IP profili birleştiriliyor. - **Core — AttackTracker unique IP kontrolü**: Saldırı tespiti artık hem bağlantı sayısını hem de farklı IP sayısını kontrol ediyor (`attack-mode.min-unique-ips`, varsayılan: 10). Tek IP'den gelen 30 bağlantı artık saldırı olarak algılanmıyor. - **Core — GravityCheck TPS 19-20 edge case**: Kademeli tolerans hesaplaması eklendi (`tps < 20.0` için lineer lagFactor). Önceki versiyonda yalnızca `tps < 19.0` koşulu vardı; 19-20 arası TPS'de false positive oluşuyordu. - **Core — PostJoinBehaviorCheck mantık hatası**: Sohbet eden oyuncu muafiyeti düzeltildi (önceden dead code'du). AFK oyuncular artık cezalandırılmıyor; check yalnızca etkileşim olmayan ve hareketsiz oyuncuları puanlıyor. Maksimum skor 25→10'a düşürüldü. - **Core — WhitelistManager ulaşılamaz eşikler**: `verify-timeout-ticks` 600→300, `max-verify-score` 15→25. Position packet zorunluluğu kaldırıldı (auth plugin altında hareket edilemiyor; client settings yeterli). - **Core — PacketTimingCheck variance eşiği**: Variance eşiği `0.1 ms²`→`5.0 ms²` (önceki değer pratikte hiç tetiklenmiyordu). - **Core — ConnectionRateCheck online oyuncu**: `firstJoinTime > 0` ise erken dönüş eklendi; sunucuda aktif oyuncuya gereksiz bağlantı hızı puanı verilmiyordu. - **Core — ConfigManager NETWORK_MODULE_NAMES**: `"bot-protection"` eklendi; eski `BotProtectionModule` ağ koruma kontrolünden hariç tutuluyordu. ### 🔧 İyileştirmeler - **Config — Score eşikleri yükseltildi**: `allow: 40→45`, `delay: 70→75`, `kick: 90→100`, `blacklist: 120→150` (false positive sonrası bant genişletme). - **Config — AttackMode**: `shutdown-seconds` 30→60; `min-unique-ips: 10` yeni ayar eklendi. - **Config — Whitelist**: `verify-timeout-ticks: 300`, `max-verify-score: 25`. - **Config — Gravity**: `min-data-count` 8→10; `min-interval-ms` 30→25; `max-interval-ms` 150→200; `min-keepalive-ms` 2→1. - **Config — PostJoinBehavior**: `analysis-ticks` 1200→600 (tick düzeltmesi sonrası gerçek anlamı aynı: 10 dakika).

### 🐛 Hata Düzeltmeleri - **Core — VerificationManager tick sayacı düzeltildi**: Timer periyodu 40→20 tick'e düşürüldü; `cycleCounter` eklendi. `ticksSinceJoin` artık gerçek saniyeyle 1:1 eşleşiyor (önceki versiyonda 40x yavaştı; whitelist'e ulaşmak 20 dakika sürüyordu). - **Core — PlayerProfile client brand gerçekten okunuyor**: `recordPluginMessage()` artık `minecraft:brand` paketinin payload'ını VarInt prefix ile doğru parse ediyor. Configuration phase (`WrapperConfigClientPluginMessage`) ve Play phase ayrı ayrı handle ediliyor. Önceki versiyonda brand her zaman `"unknown"` döndürüyordu. - **Core — PlayerProfile volatile eksikliği giderildi**: `protocolVersion`, `clientBrand`, `handshakeHostname` field'larına `volatile` eklendi (Netty thread'inde yazılır, async timer thread'inde okunur). - **Core — KeepAlive ID bazlı eşleşme**: `recordKeepAliveSent()` / `recordKeepAliveResponse()` artık KeepAlive ID'sini kullanıyor. Önceki tek-timestamp yaklaşımı `0ms` response time üretiyor ve `+20` puan yazıyordu. - **Core — AntiBotModule getOrCreateProfile race condition**: Pre-login'de IP profili oluşturuluyordu; Login'de UUID ile farklı profil açılıyordu. `CLIENT_SETTINGS` IP profilinde kalıyor, UUID profilinde yoktu → `+15` puan. Artık UUID geldiğinde IP profili birleştiriliyor. - **Core — AttackTracker unique IP kontrolü**: Saldırı tespiti artık hem bağlantı sayısını hem de farklı IP sayısını kontrol ediyor (`attack-mode.min-unique-ips`, varsayılan: 10). Tek IP'den gelen 30 bağlantı artık saldırı olarak algılanmıyor. - **Core — GravityCheck TPS 19-20 edge case**: Kademeli tolerans hesaplaması eklendi (`tps < 20.0` için lineer lagFactor). Önceki versiyonda yalnızca `tps < 19.0` koşulu vardı; 19-20 arası TPS'de false positive oluşuyordu. - **Core — PostJoinBehaviorCheck mantık hatası**: Sohbet eden oyuncu muafiyeti düzeltildi (önceden dead code'du). AFK oyuncular artık cezalandırılmıyor; check yalnızca etkileşim olmayan ve hareketsiz oyuncuları puanlıyor. Maksimum skor 25→10'a düşürüldü. - **Core — WhitelistManager ulaşılamaz eşikler**: `verify-timeout-ticks` 600→300, `max-verify-score` 15→25. Position packet zorunluluğu kaldırıldı (auth plugin altında hareket edilemiyor; client settings yeterli). - **Core — PacketTimingCheck variance eşiği**: Variance eşiği `0.1 ms²`→`5.0 ms²` (önceki değer pratikte hiç tetiklenmiyordu). - **Core — ConnectionRateCheck online oyuncu**: `firstJoinTime > 0` ise erken dönüş eklendi; sunucuda aktif oyuncuya gereksiz bağlantı hızı puanı verilmiyordu. - **Core — ConfigManager NETWORK_MODULE_NAMES**: `"bot-protection"` eklendi; eski `BotProtectionModule` ağ koruma kontrolünden hariç tutuluyordu. ### 🔧 İyileştirmeler - **Config — Score eşikleri yükseltildi**: `allow: 40→45`, `delay: 70→75`, `kick: 90→100`, `blacklist: 120→150` (false positive sonrası bant genişletme). - **Config — AttackMode**: `shutdown-seconds` 30→60; `min-unique-ips: 10` yeni ayar eklendi. - **Config — Whitelist**: `verify-timeout-ticks: 300`, `max-verify-score: 25`. - **Config — Gravity**: `min-data-count` 8→10; `min-interval-ms` 30→25; `max-interval-ms` 150→200; `min-keepalive-ms` 2→1. - **Config — PostJoinBehavior**: `analysis-ticks` 1200→600 (tick düzeltmesi sonrası gerçek anlamı aynı: 10 dakika).

### ✨ Yeni Özellikler - **Core — Özel Login Plugini Uyumluluğu**: AtomGuard artık herhangi bir özel login plugini ile tam uyumlu. `AuthListener.markAuthenticated(UUID)` API'si üzerinden login plugin'leri auth tamamlandığında AtomGuard'a bildirimde bulunabilir. - **Core — Auth Grace Period (AntiBotModule)**: Auth bekleyen oyuncular artık bot olarak puanlanmıyor. `modules.anti-bot.checks.auth-grace-period-ms` (varsayılan: 120 saniye) süresince `ThreatScoreCalculator` auth bekleyen oyuncuyu serbest geçiriyor. - **Core — AtomGuard.getAuthListener()**: `AuthListener` instance'ı artık dışarıdan erişilebilir. Login pluginleri `AtomGuard.getInstance().getAuthListener().markAuthenticated(uuid)` ile auth tamamlandığını bildirebilir. - **Core — PlayerProfile.markAuthenticated()**: AntiBotModule player profiline auth durumu eklendi. Auth tamamlandığında profil işaretleniyor; tüm periyodik threat evaluation'lar bu durumu görerek skor hesaplamayı atlıyor. ### 🔧 İyileştirmeler - **Core — TokenBucketModule grace period muafiyeti**: Auth grace period'u aktif oyunculara movement paketleri de dahil olmak üzere hiçbir rate limit uygulanmıyor (önceki versiyonda yalnızca komut paketleri muaftı, hareket paketleri cezalandırılıyordu). - **Core — HeuristicEngine auth muafiyeti**: `PacketListener.handleLegacyIncoming()` artık auth grace period içindeki oyuncuların rotation/animation analizini atlıyor. Login ekranında fare hareketi artık yanlışlıkla suspicion olarak birikmiyor. - **Core — VerifiedPlayerCache auth öncesi koruma**: Grace period bittiğinde oyuncu hâlâ auth bekliyor olabilir. `BukkitListener` artık auth tamamlanmadan oyuncuyu "verified" olarak işaretlemiyor; tamamlanmamışsa +30 saniye daha bekleyerek ikinci kontrol yapıyor. - **Core — AntiBotModule.getPlayerProfile()**: `PlayerProfile` nesnesi artık dışarıdan erişilebilir public getter ile sunuluyor. - **Core — OfflinePacketModule auth komut listesi genişletildi**: Varsayılan fallback listesine `/sifre`, `/şifre`, `/auth`, `/2fa`, `/totp`, `/pin` eklendi. - **Core — config.yml**: `modules.anti-bot.checks.auth-grace-period-ms` ayarı eklendi (varsayılan: 120000 ms = 2 dakika).

### ✨ Yeni Özellikler - **Core — Özel Login Plugini Uyumluluğu**: AtomGuard artık herhangi bir özel login plugini ile tam uyumlu. `AuthListener.markAuthenticated(UUID)` API'si üzerinden login plugin'leri auth tamamlandığında AtomGuard'a bildirimde bulunabilir. - **Core — Auth Grace Period (AntiBotModule)**: Auth bekleyen oyuncular artık bot olarak puanlanmıyor. `modules.anti-bot.checks.auth-grace-period-ms` (varsayılan: 120 saniye) süresince `ThreatScoreCalculator` auth bekleyen oyuncuyu serbest geçiriyor. - **Core — AtomGuard.getAuthListener()**: `AuthListener` instance'ı artık dışarıdan erişilebilir. Login pluginleri `AtomGuard.getInstance().getAuthListener().markAuthenticated(uuid)` ile auth tamamlandığını bildirebilir. - **Core — PlayerProfile.markAuthenticated()**: AntiBotModule player profiline auth durumu eklendi. Auth tamamlandığında profil işaretleniyor; tüm periyodik threat evaluation'lar bu durumu görerek skor hesaplamayı atlıyor. ### 🔧 İyileştirmeler - **Core — TokenBucketModule grace period muafiyeti**: Auth grace period'u aktif oyunculara movement paketleri de dahil olmak üzere hiçbir rate limit uygulanmıyor (önceki versiyonda yalnızca komut paketleri muaftı, hareket paketleri cezalandırılıyordu). - **Core — HeuristicEngine auth muafiyeti**: `PacketListener.handleLegacyIncoming()` artık auth grace period içindeki oyuncuların rotation/animation analizini atlıyor. Login ekranında fare hareketi artık yanlışlıkla suspicion olarak birikmiyor. - **Core — VerifiedPlayerCache auth öncesi koruma**: Grace period bittiğinde oyuncu hâlâ auth bekliyor olabilir. `BukkitListener` artık auth tamamlanmadan oyuncuyu "verified" olarak işaretlemiyor; tamamlanmamışsa +30 saniye daha bekleyerek ikinci kontrol yapıyor. - **Core — AntiBotModule.getPlayerProfile()**: `PlayerProfile` nesnesi artık dışarıdan erişilebilir public getter ile sunuluyor. - **Core — OfflinePacketModule auth komut listesi genişletildi**: Varsayılan fallback listesine `/sifre`, `/şifre`, `/auth`, `/2fa`, `/totp`, `/pin` eklendi. - **Core — config.yml**: `modules.anti-bot.checks.auth-grace-period-ms` ayarı eklendi (varsayılan: 120000 ms = 2 dakika).

### 🐛 Hata Düzeltmeleri - **Core — Login/Timeout sorunu düzeltildi**: `TokenBucketModule` artık auth komutlarını rate limit'lemiyor. `CHAT_COMMAND` paketleri ayrı `KOMUT` kovasına yönlendirildi. Auth komut listesi `modules.token-bucket.auth-exempt-commands` ile özelleştirilebilir. - **Core — KeepAlive paketleri artık asla engellenmez**: `PacketDelayModule` ve `PacketExploitModule`, `KEEP_ALIVE` ve `PONG` paketlerini bypass ediyor. - **Core — Grace period 30 saniyeye çıkarıldı**: Auth komutu algılandığında grace period otomatik yenilenir; auth tamamlandığında anında biter. - **Core — Auth sistemi tamamen plugin-agnostic**: AuthMe hard-dependency kaldırıldı. `AuthListener` generic yeniden yazıldı — herhangi bir login plugini ile çalışır. - **Core — PacketExploitModule race condition düzeltildi**: Tür bazlı sayaçlarda `HashMap` → `ConcurrentHashMap` (Netty thread güvenliği). - **Core — CustomPayloadModule çifte kayıt kaldırıldı**: `AdvancedPayloadModule` zaten aynı işlevi kapsıyor; eski modülün kaydı `registerModules()`'den silindi. - **Core — `atomguard:auth` kanalı whitelist'e eklendi**: `AdvancedPayloadModule` artık `atomguard:` prefix'li kanalları engellemez; `CorePasswordCheckModule` çalışıyor. - **Core — NettyCrashHandler false positive düzeltildi**: `"buffer"` ve `"index"` tek başına crash tespiti tetiklemiyor; `"buffer overflow"` ve `"index out of bounds"` olarak daraltıldı. - **Core — VerifiedPlayerCache zamanlaması düzeltildi**: Oyuncu artık grace period dolmadan `verified` olarak işaretlenmiyor (`BukkitListener` geciktirildi). - **Velocity — Auth komut rate limiti düzeltildi**: `CommandFloodBlocker`'da login/register komutları artık 2 token değil, tamamen muaf tutuluyor. ### 🔧 İyileştirmeler - **Core — Unicode crash filtresi daraltıldı**: `AdvancedChatModule` artık Arapça, İbranice, Korece ve CJK karakterlerini engellemiyor; yalnızca gerçek crash vektörü olan Unicode yön kontrol karakterleri filtreleniyor. - **Core — SmartLagModule chunk tarama optimizasyonu**: Lag spike'ta tüm chunk'lar yerine rastgele `%20` örnekleme yapılıyor; maksimum 10 chunk freeze limiti eklendi. - **Core — `PacketExploitModule` CHAT_COMMAND limiti eklendi**: Type-based limitlerde `CHAT_COMMAND: 30/s` varsayılanı eklendi. - **Config — Yeni ayarlar**: - `modules.token-bucket.auth-exempt-commands` - `modules.token-bucket.buckets.command.kapasite` (varsayılan: 50) - `modules.token-bucket.buckets.command.dolum-saniye` (varsayılan: 20) - `modules.offline-packet.auth-commands` - `modules.offline-packet.tolerance-ms` varsayılanı `5000` → `30000` - `modules.packet-exploit.type-limits.CHAT_COMMAND` (varsayılan: 30)

### 🐛 Hata Düzeltmeleri - **Core — Login/Timeout sorunu düzeltildi**: `TokenBucketModule` artık auth komutlarını rate limit'lemiyor. `CHAT_COMMAND` paketleri ayrı `KOMUT` kovasına yönlendirildi. Auth komut listesi `modules.token-bucket.auth-exempt-commands` ile özelleştirilebilir. - **Core — KeepAlive paketleri artık asla engellenmez**: `PacketDelayModule` ve `PacketExploitModule`, `KEEP_ALIVE` ve `PONG` paketlerini bypass ediyor. - **Core — Grace period 30 saniyeye çıkarıldı**: Auth komutu algılandığında grace period otomatik yenilenir; auth tamamlandığında anında biter. - **Core — Auth sistemi tamamen plugin-agnostic**: AuthMe hard-dependency kaldırıldı. `AuthListener` generic yeniden yazıldı — herhangi bir login plugini ile çalışır. - **Core — PacketExploitModule race condition düzeltildi**: Tür bazlı sayaçlarda `HashMap` → `ConcurrentHashMap` (Netty thread güvenliği). - **Core — CustomPayloadModule çifte kayıt kaldırıldı**: `AdvancedPayloadModule` zaten aynı işlevi kapsıyor; eski modülün kaydı `registerModules()`'den silindi. - **Core — `atomguard:auth` kanalı whitelist'e eklendi**: `AdvancedPayloadModule` artık `atomguard:` prefix'li kanalları engellemez; `CorePasswordCheckModule` çalışıyor. - **Core — NettyCrashHandler false positive düzeltildi**: `"buffer"` ve `"index"` tek başına crash tespiti tetiklemiyor; `"buffer overflow"` ve `"index out of bounds"` olarak daraltıldı. - **Core — VerifiedPlayerCache zamanlaması düzeltildi**: Oyuncu artık grace period dolmadan `verified` olarak işaretlenmiyor (`BukkitListener` geciktirildi). - **Velocity — Auth komut rate limiti düzeltildi**: `CommandFloodBlocker`'da login/register komutları artık 2 token değil, tamamen muaf tutuluyor. ### 🔧 İyileştirmeler - **Core — Unicode crash filtresi daraltıldı**: `AdvancedChatModule` artık Arapça, İbranice, Korece ve CJK karakterlerini engellemiyor; yalnızca gerçek crash vektörü olan Unicode yön kontrol karakterleri filtreleniyor. - **Core — SmartLagModule chunk tarama optimizasyonu**: Lag spike'ta tüm chunk'lar yerine rastgele `%20` örnekleme yapılıyor; maksimum 10 chunk freeze limiti eklendi. - **Core — `PacketExploitModule` CHAT_COMMAND limiti eklendi**: Type-based limitlerde `CHAT_COMMAND: 30/s` varsayılanı eklendi. - **Config — Yeni ayarlar**: - `modules.token-bucket.auth-exempt-commands` - `modules.token-bucket.buckets.command.kapasite` (varsayılan: 50) - `modules.token-bucket.buckets.command.dolum-saniye` (varsayılan: 20) - `modules.offline-packet.auth-commands` - `modules.offline-packet.tolerance-ms` varsayılanı `5000` → `30000` - `modules.packet-exploit.type-limits.CHAT_COMMAND` (varsayılan: 30)

### ✨ Yeni Özellikler - ### 🔧 İyileştirmeler - ### 🐛 Hata Düzeltmeleri -

### ✨ Yeni Özellikler - ### 🔧 İyileştirmeler - ### 🐛 Hata Düzeltmeleri -

### 🐛 Hata Düzeltmeleri - **Core — Tek oyuncu saldırı modu yanlış tetiklemesi düzeltildi**: `AttackModeManager` artık hem hız eşiğini (`threshold`) hem de benzersiz IP sayısını (`min-unique-ips`, varsayılan: 10) kontrol ediyor. Tek bir oyuncunun hızlı çık/gir yapması artık saldırı modunu tetikleyemiyor. - **Velocity — Aynı düzeltme**: `SynFloodDetector`, benzersiz IP sayısı `min-unique-ips` altındaysa `effectiveCps=0` gönderiyor; `AttackLevelManager` NONE seviyesinde kalıyor. `DDoSProtectionModule.checkConnection()` artık IP'yi `recordConnection(ip)` ile iletiyor. ### 🔧 İyileştirmeler - **Yeni config ayarı**: `attack-mode.min-unique-ips` (core) ve `ddos-protection.attack-mode.min-unique-ips` (velocity) — varsayılan 10

### 🐛 Hata Düzeltmeleri - **Core — Tek oyuncu saldırı modu yanlış tetiklemesi düzeltildi**: `AttackModeManager` artık hem hız eşiğini (`threshold`) hem de benzersiz IP sayısını (`min-unique-ips`, varsayılan: 10) kontrol ediyor. Tek bir oyuncunun hızlı çık/gir yapması artık saldırı modunu tetikleyemiyor. - **Velocity — Aynı düzeltme**: `SynFloodDetector`, benzersiz IP sayısı `min-unique-ips` altındaysa `effectiveCps=0` gönderiyor; `AttackLevelManager` NONE seviyesinde kalıyor. `DDoSProtectionModule.checkConnection()` artık IP'yi `recordConnection(ip)` ile iletiyor. ### 🔧 İyileştirmeler - **Yeni config ayarı**: `attack-mode.min-unique-ips` (core) ve `ddos-protection.attack-mode.min-unique-ips` (velocity) — varsayılan 10

**Dev Build #53** - [`b400e0f`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b400e0f9a40ecfe5ea819f35436588ad3147962c) 📝 Add Modrinth badge and link to README [skip ci] (ATOMGAMERAGA) - [`4219881`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/4219881c646bdd7a9b6f3c03f60ffdb3a0d00c9d) 📝 Update README to English with v2.0 features [skip ci] (ATOMGAMERAGA) - [`67fd400`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/67fd400a0db9c1966572f5060cbdcb8eb4b7aeaf) 🌐 Release v2.0.2 — Full Turkish → English config translation (ATOMGAMERAGA) - [`dceb1b6`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/dceb1b6d7df1faaab2a7bcef76608f6379ea961c) 🔖 Release v2.0.1 — Velocity Timed Out düzeltmesi (ATOMGAMERAGA) - [`80a4b8d`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/80a4b8d3e1f395d946f6da6d5882fe6a4de9bd82) 🔖 Release v2.0.0 — Major release (ATOMGAMERAGA) - [`3880888`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/3880888cf7d27b26cdfb09ebdf664f5ed877d979) 🔖 Release v1.2.9 — FrameCrashModule EntityRemoveEvent chunk crash fix (ATOMGAMERAGA) - [`bc5bdeb`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/bc5bdebdc21f4b66739feb71d98b23ddc365f562) 🔖 Release v1.2.8 — ThreatScoreChangedEvent async fix (ATOMGAMERAGA) - [`dffd9c3`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/dffd9c38d89eb2d2f25992c8c5387a9d16cdb7db) 🔖 Release v1.2.7 (ATOMGAMERAGA) - [`2e6e8b2`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/2e6e8b20cb0ed0e60155cccfa3ae9f8bded2bf60) 🔖 Release v1.2.6 — kod kalitesi & 32 hata düzeltmesi (ATOMGAMERAGA) - [`90937d3`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/90937d3d1812e142a8a0f6c74f9a43fafc07db93) fix(bump): CHANGELOG.md'ye tek bölüm ekleme hatası düzeltildi (ATOMGAMERAGA)

**Dev Build #53** - [`b400e0f`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/b400e0f9a40ecfe5ea819f35436588ad3147962c) 📝 Add Modrinth badge and link to README [skip ci] (ATOMGAMERAGA) - [`4219881`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/4219881c646bdd7a9b6f3c03f60ffdb3a0d00c9d) 📝 Update README to English with v2.0 features [skip ci] (ATOMGAMERAGA) - [`67fd400`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/67fd400a0db9c1966572f5060cbdcb8eb4b7aeaf) 🌐 Release v2.0.2 — Full Turkish → English config translation (ATOMGAMERAGA) - [`dceb1b6`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/dceb1b6d7df1faaab2a7bcef76608f6379ea961c) 🔖 Release v2.0.1 — Velocity Timed Out düzeltmesi (ATOMGAMERAGA) - [`80a4b8d`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/80a4b8d3e1f395d946f6da6d5882fe6a4de9bd82) 🔖 Release v2.0.0 — Major release (ATOMGAMERAGA) - [`3880888`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/3880888cf7d27b26cdfb09ebdf664f5ed877d979) 🔖 Release v1.2.9 — FrameCrashModule EntityRemoveEvent chunk crash fix (ATOMGAMERAGA) - [`bc5bdeb`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/bc5bdebdc21f4b66739feb71d98b23ddc365f562) 🔖 Release v1.2.8 — ThreatScoreChangedEvent async fix (ATOMGAMERAGA) - [`dffd9c3`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/dffd9c38d89eb2d2f25992c8c5387a9d16cdb7db) 🔖 Release v1.2.7 (ATOMGAMERAGA) - [`2e6e8b2`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/2e6e8b20cb0ed0e60155cccfa3ae9f8bded2bf60) 🔖 Release v1.2.6 — kod kalitesi & 32 hata düzeltmesi (ATOMGAMERAGA) - [`90937d3`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/90937d3d1812e142a8a0f6c74f9a43fafc07db93) fix(bump): CHANGELOG.md'ye tek bölüm ekleme hatası düzeltildi (ATOMGAMERAGA)

**Dev Build #52** - [`4219881`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/4219881c646bdd7a9b6f3c03f60ffdb3a0d00c9d) 📝 Update README to English with v2.0 features [skip ci] (ATOMGAMERAGA) - [`67fd400`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/67fd400a0db9c1966572f5060cbdcb8eb4b7aeaf) 🌐 Release v2.0.2 — Full Turkish → English config translation (ATOMGAMERAGA) - [`dceb1b6`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/dceb1b6d7df1faaab2a7bcef76608f6379ea961c) 🔖 Release v2.0.1 — Velocity Timed Out düzeltmesi (ATOMGAMERAGA) - [`80a4b8d`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/80a4b8d3e1f395d946f6da6d5882fe6a4de9bd82) 🔖 Release v2.0.0 — Major release (ATOMGAMERAGA) - [`3880888`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/3880888cf7d27b26cdfb09ebdf664f5ed877d979) 🔖 Release v1.2.9 — FrameCrashModule EntityRemoveEvent chunk crash fix (ATOMGAMERAGA) - [`bc5bdeb`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/bc5bdebdc21f4b66739feb71d98b23ddc365f562) 🔖 Release v1.2.8 — ThreatScoreChangedEvent async fix (ATOMGAMERAGA) - [`dffd9c3`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/dffd9c38d89eb2d2f25992c8c5387a9d16cdb7db) 🔖 Release v1.2.7 (ATOMGAMERAGA) - [`2e6e8b2`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/2e6e8b20cb0ed0e60155cccfa3ae9f8bded2bf60) 🔖 Release v1.2.6 — kod kalitesi & 32 hata düzeltmesi (ATOMGAMERAGA) - [`90937d3`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/90937d3d1812e142a8a0f6c74f9a43fafc07db93) fix(bump): CHANGELOG.md'ye tek bölüm ekleme hatası düzeltildi (ATOMGAMERAGA) - [`c3eea91`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c3eea91f3f4a910b6e2a5ea2182022991a4c11c2) 🔖 Release v1.2.5 — kritik thread safety & başlatma sırası düzeltmeleri (ATOMGAMERAGA)

**Dev Build #52** - [`4219881`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/4219881c646bdd7a9b6f3c03f60ffdb3a0d00c9d) 📝 Update README to English with v2.0 features [skip ci] (ATOMGAMERAGA) - [`67fd400`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/67fd400a0db9c1966572f5060cbdcb8eb4b7aeaf) 🌐 Release v2.0.2 — Full Turkish → English config translation (ATOMGAMERAGA) - [`dceb1b6`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/dceb1b6d7df1faaab2a7bcef76608f6379ea961c) 🔖 Release v2.0.1 — Velocity Timed Out düzeltmesi (ATOMGAMERAGA) - [`80a4b8d`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/80a4b8d3e1f395d946f6da6d5882fe6a4de9bd82) 🔖 Release v2.0.0 — Major release (ATOMGAMERAGA) - [`3880888`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/3880888cf7d27b26cdfb09ebdf664f5ed877d979) 🔖 Release v1.2.9 — FrameCrashModule EntityRemoveEvent chunk crash fix (ATOMGAMERAGA) - [`bc5bdeb`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/bc5bdebdc21f4b66739feb71d98b23ddc365f562) 🔖 Release v1.2.8 — ThreatScoreChangedEvent async fix (ATOMGAMERAGA) - [`dffd9c3`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/dffd9c38d89eb2d2f25992c8c5387a9d16cdb7db) 🔖 Release v1.2.7 (ATOMGAMERAGA) - [`2e6e8b2`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/2e6e8b20cb0ed0e60155cccfa3ae9f8bded2bf60) 🔖 Release v1.2.6 — kod kalitesi & 32 hata düzeltmesi (ATOMGAMERAGA) - [`90937d3`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/90937d3d1812e142a8a0f6c74f9a43fafc07db93) fix(bump): CHANGELOG.md'ye tek bölüm ekleme hatası düzeltildi (ATOMGAMERAGA) - [`c3eea91`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c3eea91f3f4a910b6e2a5ea2182022991a4c11c2) 🔖 Release v1.2.5 — kritik thread safety & başlatma sırası düzeltmeleri (ATOMGAMERAGA)

### 🌐 Full English Translation - **Config keys renamed (Turkish → English)** across all 40+ modules and all manager classes - **Top-level sections renamed**: `moduller` → `modules`, `genel` → `general`, `istatistik` → `statistics`, `dogrulanmis-onbellek` → `verified-cache`, `metrikler` → `metrics`, `tehdit-istihbarati` → `threat-intelligence`, `guven-skoru` → `trust-score`, `adli-analiz` → `forensics`, `bildirimler` → `notifications`, `forensik` → `packet-forensics`, `harici-servisler` → `external-services` - **Module names translated**: e.g. `cok-fazla-kitap` → `too-many-books`, `paket-exploit` → `packet-exploit`, `bot-koruma` → `anti-bot`, `bal-kupu` → `honeypot`, `jeton-kovasi` → `token-bucket`, and 40+ more - **Common sub-keys translated**: `aktif` → `enabled`, `eylem` → `action`, `max-paket-boyutu` → `max-packet-size`, and 100+ more - **Velocity config translated**: `depolama` → `storage`, `bot-koruma` → `bot-protection`, `moduller` → `modules`, all DDoS/VPN/firewall sub-keys - **Default language changed**: `dil: "tr"` → `language: "en"` (both core and velocity configs) - **Hardcoded Turkish strings** in Java source translated to English (AtomGuard.java, ForensicsManager, NettyCrashHandler, BukkitListener, ModuleManager, and others) - **Migration step added** (`Migration_2_0_1_to_2_0_2`) — automatically renames all Turkish config keys to English for existing installations - **Config version bumped** to `2.0.2`

### 🌐 Full English Translation - **Config keys renamed (Turkish → English)** across all 40+ modules and all manager classes - **Top-level sections renamed**: `moduller` → `modules`, `genel` → `general`, `istatistik` → `statistics`, `dogrulanmis-onbellek` → `verified-cache`, `metrikler` → `metrics`, `tehdit-istihbarati` → `threat-intelligence`, `guven-skoru` → `trust-score`, `adli-analiz` → `forensics`, `bildirimler` → `notifications`, `forensik` → `packet-forensics`, `harici-servisler` → `external-services` - **Module names translated**: e.g. `cok-fazla-kitap` → `too-many-books`, `paket-exploit` → `packet-exploit`, `bot-koruma` → `anti-bot`, `bal-kupu` → `honeypot`, `jeton-kovasi` → `token-bucket`, and 40+ more - **Common sub-keys translated**: `aktif` → `enabled`, `eylem` → `action`, `max-paket-boyutu` → `max-packet-size`, and 100+ more - **Velocity config translated**: `depolama` → `storage`, `bot-koruma` → `bot-protection`, `moduller` → `modules`, all DDoS/VPN/firewall sub-keys - **Default language changed**: `dil: "tr"` → `language: "en"` (both core and velocity configs) - **Hardcoded Turkish strings** in Java source translated to English (AtomGuard.java, ForensicsManager, NettyCrashHandler, BukkitListener, ModuleManager, and others) - **Migration step added** (`Migration_2_0_1_to_2_0_2`) — automatically renames all Turkish config keys to English for existing installations - **Config version bumped** to `2.0.2`

### 🐛 Hata Düzeltmeleri - **Velocity — Oyuncu "Timed Out" sorunu düzeltildi**: `ConnectionListener.onPreLogin()` artık `EventTask.resumeWhenComplete()` döndürüyor; önceki senkron `process()` çağrısı Velocity event executor thread'ini 5 saneye kadar blokluyordu (VPNCheck `.get(3s)` + AccountFirewallCheck `.get(2s)`). Bu blokaj Minecraft istemcisinin bağlantı zaman aşımına çarpmasına neden oluyordu - **VPNCheck — blokaj kaldırıldı**: `checkAsync()` override edildi; `.get(3, TimeUnit.SECONDS)` yerine `.orTimeout(3, TimeUnit.SECONDS).exceptionally(...).thenApply(...)` zinciri kullanılıyor - **AccountFirewallCheck — blokaj kaldırıldı**: `checkAsync()` override edildi; `.get(2, TimeUnit.SECONDS)` yerine `.orTimeout(2, TimeUnit.SECONDS).exceptionally(...).thenApply(...)` zinciri kullanılıyor ### 🔧 İyileştirmeler - **ConnectionCheck arayüzü**: `checkAsync(ctx)` default metodu eklendi — tüm mevcut check'ler uyumluluk bozmadan `CompletableFuture` desteği kazandı - **ConnectionPipeline**: `processAsync(ctx)` metodu eklendi — check'leri sıralı `CompletableFuture` zinciri olarak çalıştırır, ilk reddedilen sonuçta kısa devre yapar

### 🐛 Hata Düzeltmeleri - **Velocity — Oyuncu "Timed Out" sorunu düzeltildi**: `ConnectionListener.onPreLogin()` artık `EventTask.resumeWhenComplete()` döndürüyor; önceki senkron `process()` çağrısı Velocity event executor thread'ini 5 saneye kadar blokluyordu (VPNCheck `.get(3s)` + AccountFirewallCheck `.get(2s)`). Bu blokaj Minecraft istemcisinin bağlantı zaman aşımına çarpmasına neden oluyordu - **VPNCheck — blokaj kaldırıldı**: `checkAsync()` override edildi; `.get(3, TimeUnit.SECONDS)` yerine `.orTimeout(3, TimeUnit.SECONDS).exceptionally(...).thenApply(...)` zinciri kullanılıyor - **AccountFirewallCheck — blokaj kaldırıldı**: `checkAsync()` override edildi; `.get(2, TimeUnit.SECONDS)` yerine `.orTimeout(2, TimeUnit.SECONDS).exceptionally(...).thenApply(...)` zinciri kullanılıyor ### 🔧 İyileştirmeler - **ConnectionCheck arayüzü**: `checkAsync(ctx)` default metodu eklendi — tüm mevcut check'ler uyumluluk bozmadan `CompletableFuture` desteği kazandı - **ConnectionPipeline**: `processAsync(ctx)` metodu eklendi — check'leri sıralı `CompletableFuture` zinciri olarak çalıştırır, ilk reddedilen sonuçta kısa devre yapar

### ✨ Yeni Özellikler - **Genişletilmiş Public API**: `AtomGuardAPI` artık `ITrustService`, `IForensicsService`, `IConnectionPipeline` arayüzlerini sunuyor; harici eklentiler güven skoru, adli kayıt ve bağlantı hattına erişebilir - **Forensics Sistemi**: `ForensicsManager` / `PacketRecorder` / `RecordingSession` — paket kayıt oturumları, saldırı anı anlık görüntüleri disk üzerine kaydediliyor - **Traffic Intelligence Engine**: `AdaptiveThresholdManager`, `EWMADetector`, `IsolationForestDetector` — adaptif eşik ve anomali tespiti - **Notification Manager**: `NotificationManager` — çok sağlayıcılı bildirim yönlendirme (Discord, konsol, custom) - **Trust Score Manager**: `TrustScoreManager` (`ITrustService`) — oyuncu başına güven puanı, tier sistemi, JSON kalıcılığı - **Executor Manager**: `ExecutorManager` — paylaşımlı thread pool yönetimi - **Web Panel Yenilendi**: JWT kimlik doğrulama (`JWTAuthProvider`, `SessionManager`), API handler'ları, middleware katmanı - **Config Migration (Core)**: `ConfigMigrationManager` — `1.x → 2.0.0` otomatik yapılandırma göçü - **Config Migration (Velocity)**: `VelocityConfigMigrationManager` — Velocity yapılandırma göçü - **Velocity Bedrock Desteği**: `BedrockSupportModule` — Bedrock oyuncu kimlik tespiti ve bot ayırt etme - **Yeni API Olayları**: `NotificationSentEvent`, `PostVerificationEvent`, `PreConnectionCheckEvent`, `TrustScoreChangeEvent` - **IForensicsService / ITrustService API arayüzleri** api modülüne eklendi - **IConnectionPipeline API arayüzü** api modülüne eklendi ### 🔧 İyileştirmeler - **HttpClientUtil**: `HttpURLConnection` tabanlı yardımcı sınıf; `IPReputationManager`, `DiscordWebhookManager`, `ExternalListFetcher`, `GeoIPUpdater` tümü HttpClientUtil'e geçirildi - **Caffeine Önbelleği**: `CooldownManager`, `PacketListener` bypass cache, `IPReputationManager` API cache, `WebPanel` oran sınırlama — tüm el ile TTL yönetimi Caffeine ile değiştirildi - **Bypass Cache Basitleştirildi**: `Cache<UUID, Boolean>` Caffeine 10 dk TTL; Netty-safe, kilitsiz - **Javadoc**: `AtomGuard`, `AbstractModule`, `PacketListener`, `ModuleManager`, `TrustScoreManager`, `ForensicsManager`, `NotificationManager` — sınıf düzeyi İngilizce Javadoc eklendi - **Hardcoded URL'ler kaldırıldı**: Velocity VPN sağlayıcıları (`ProxyCheckProvider`, `IPApiProvider`, `AbuseIPDBProvider`, `IPHubProvider`) ve `AccountFirewallModule` Ashcon API URL'leri artık `harici-servisler` config bölümünden okunuyor - **Statik Analiz Araçları**: SpotBugs, PMD, Checkstyle, OWASP Dependency Check eklentileri parent POM'a eklendi (`pluginManagement`) - **Build Süreci**: GitHub Actions workflow güncellendi; Checkstyle doğrulaması CI'ya entegre edildi ### 🧪 Testler - **92 core testi** (TrustScoreManagerTest 21, HeuristicEngineTest 10, ConfigMigrationManagerTest 11, SessionManagerTest 10, JWTAuthProviderTest 10, vb.) - **51 velocity testi** (BedrockSupportModuleTest 21, VPNResultCacheTest 12, ConnectionPipelineTest 12, vb.) - **Yeni testler (bu sürüm)**: `ThreatScoreCalculatorTest`, `PacketTimingCheckTest`, `PingHandshakeCheckTest`, `PostJoinBehaviorCheckTest`, `ProtocolCheckTest`, `UsernamePatternCheckTest`, `RateLimiterTest` (velocity), `WhitelistManagerTest` (velocity), `AttackLevelManagerTest` (velocity) - **Toplam: 266 test**, 0 hata ### 🐛 Hata Düzeltmeleri - **@Override eksiklikleri giderildi**: Velocity `LatencyCheckModule`, `CountryFilterModule`, `ReconnectControlModule` — `onEnable()`/`onDisable()` üzerindeki `@Override` etiketleri zaten mevcuttu, doğrulandı

### ✨ Yeni Özellikler - **Genişletilmiş Public API**: `AtomGuardAPI` artık `ITrustService`, `IForensicsService`, `IConnectionPipeline` arayüzlerini sunuyor; harici eklentiler güven skoru, adli kayıt ve bağlantı hattına erişebilir - **Forensics Sistemi**: `ForensicsManager` / `PacketRecorder` / `RecordingSession` — paket kayıt oturumları, saldırı anı anlık görüntüleri disk üzerine kaydediliyor - **Traffic Intelligence Engine**: `AdaptiveThresholdManager`, `EWMADetector`, `IsolationForestDetector` — adaptif eşik ve anomali tespiti - **Notification Manager**: `NotificationManager` — çok sağlayıcılı bildirim yönlendirme (Discord, konsol, custom) - **Trust Score Manager**: `TrustScoreManager` (`ITrustService`) — oyuncu başına güven puanı, tier sistemi, JSON kalıcılığı - **Executor Manager**: `ExecutorManager` — paylaşımlı thread pool yönetimi - **Web Panel Yenilendi**: JWT kimlik doğrulama (`JWTAuthProvider`, `SessionManager`), API handler'ları, middleware katmanı - **Config Migration (Core)**: `ConfigMigrationManager` — `1.x → 2.0.0` otomatik yapılandırma göçü - **Config Migration (Velocity)**: `VelocityConfigMigrationManager` — Velocity yapılandırma göçü - **Velocity Bedrock Desteği**: `BedrockSupportModule` — Bedrock oyuncu kimlik tespiti ve bot ayırt etme - **Yeni API Olayları**: `NotificationSentEvent`, `PostVerificationEvent`, `PreConnectionCheckEvent`, `TrustScoreChangeEvent` - **IForensicsService / ITrustService API arayüzleri** api modülüne eklendi - **IConnectionPipeline API arayüzü** api modülüne eklendi ### 🔧 İyileştirmeler - **HttpClientUtil**: `HttpURLConnection` tabanlı yardımcı sınıf; `IPReputationManager`, `DiscordWebhookManager`, `ExternalListFetcher`, `GeoIPUpdater` tümü HttpClientUtil'e geçirildi - **Caffeine Önbelleği**: `CooldownManager`, `PacketListener` bypass cache, `IPReputationManager` API cache, `WebPanel` oran sınırlama — tüm el ile TTL yönetimi Caffeine ile değiştirildi - **Bypass Cache Basitleştirildi**: `Cache<UUID, Boolean>` Caffeine 10 dk TTL; Netty-safe, kilitsiz - **Javadoc**: `AtomGuard`, `AbstractModule`, `PacketListener`, `ModuleManager`, `TrustScoreManager`, `ForensicsManager`, `NotificationManager` — sınıf düzeyi İngilizce Javadoc eklendi - **Hardcoded URL'ler kaldırıldı**: Velocity VPN sağlayıcıları (`ProxyCheckProvider`, `IPApiProvider`, `AbuseIPDBProvider`, `IPHubProvider`) ve `AccountFirewallModule` Ashcon API URL'leri artık `harici-servisler` config bölümünden okunuyor - **Statik Analiz Araçları**: SpotBugs, PMD, Checkstyle, OWASP Dependency Check eklentileri parent POM'a eklendi (`pluginManagement`) - **Build Süreci**: GitHub Actions workflow güncellendi; Checkstyle doğrulaması CI'ya entegre edildi ### 🧪 Testler - **92 core testi** (TrustScoreManagerTest 21, HeuristicEngineTest 10, ConfigMigrationManagerTest 11, SessionManagerTest 10, JWTAuthProviderTest 10, vb.) - **51 velocity testi** (BedrockSupportModuleTest 21, VPNResultCacheTest 12, ConnectionPipelineTest 12, vb.) - **Yeni testler (bu sürüm)**: `ThreatScoreCalculatorTest`, `PacketTimingCheckTest`, `PingHandshakeCheckTest`, `PostJoinBehaviorCheckTest`, `ProtocolCheckTest`, `UsernamePatternCheckTest`, `RateLimiterTest` (velocity), `WhitelistManagerTest` (velocity), `AttackLevelManagerTest` (velocity) - **Toplam: 266 test**, 0 hata ### 🐛 Hata Düzeltmeleri - **@Override eksiklikleri giderildi**: Velocity `LatencyCheckModule`, `CountryFilterModule`, `ReconnectControlModule` — `onEnable()`/`onDisable()` üzerindeki `@Override` etiketleri zaten mevcuttu, doğrulandı

### 🐛 Hata Düzeltmeleri - **FrameCrashModule — EntityRemoveEvent chunk yükleme hatası düzeltildi**: `handleEntityRemoval()` içinde `entity.getLocation().getChunk()` çağrısı, chunk unload sırasında `IllegalStateException: Cannot update ticket level while unloading chunks` hatasına yol açıyordu. `getChunk()` yerine `Location` koordinatlarından bit-shift ile chunk koordinatı hesaplayan `ChunkKey.fromLocation()` metoduna geçildi.

### 🐛 Hata Düzeltmeleri - **FrameCrashModule — EntityRemoveEvent chunk yükleme hatası düzeltildi**: `handleEntityRemoval()` içinde `entity.getLocation().getChunk()` çağrısı, chunk unload sırasında `IllegalStateException: Cannot update ticket level while unloading chunks` hatasına yol açıyordu. `getChunk()` yerine `Location` koordinatlarından bit-shift ile chunk koordinatı hesaplayan `ChunkKey.fromLocation()` metoduna geçildi.

### 🐛 Hata Düzeltmeleri - **ThreatScoreChangedEvent async hatası düzeltildi**: `ThreatScoreCalculator`, `HeuristicEngine` (Rotation Spike ve Low Click Variance) içindeki `ThreatScoreChangedEvent` çağrıları main thread yerine `runTaskAsynchronously` ile çağrılacak şekilde düzeltildi (Paper 1.21.4 `IllegalStateException` hatası giderildi)

### 🐛 Hata Düzeltmeleri - **ThreatScoreChangedEvent async hatası düzeltildi**: `ThreatScoreCalculator`, `HeuristicEngine` (Rotation Spike ve Low Click Variance) içindeki `ThreatScoreChangedEvent` çağrıları main thread yerine `runTaskAsynchronously` ile çağrılacak şekilde düzeltildi (Paper 1.21.4 `IllegalStateException` hatası giderildi)

### ✨ Yeni Özellikler - ### 🔧 İyileştirmeler - ### 🐛 Hata Düzeltmeleri -

### ✨ Yeni Özellikler - ### 🔧 İyileştirmeler - ### 🐛 Hata Düzeltmeleri -

### 🔧 İyileştirmeler - **VelocityStorageProvider — Kod Tekrarı Giderildi**: `saveBehaviorProfile()` ve `saveBehaviorProfileSync()` içindeki JSON inşa mantığı `buildProfileJson()` özel yardımcı metoduna taşındı; bakımı kolaylaştırıldı. - **AttackSnapshot — Koleksiyon Optimizasyonu**: Saldırı sırasında yoğun yazma yapılan `timeline` ve `triggeredModules` alanları `CopyOnWriteArrayList`'ten `Collections.synchronizedList(new ArrayList<>())` türüne değiştirildi; GC baskısı azaltıldı. - **ConfigManager — Gereksiz Değişken Kaldırıldı**: `loadMessages()` içindeki anlamsız `final String finalFileName = fileName` ataması temizlendi; `fileName` doğrudan kullanılıyor. ### 🐛 Hata Düzeltmeleri - **VelocityStatisticsManager / TempBanManager — TOCTOU Yarış Koşulu**: `save()` metodlarındaki `Files.exists()` ön kontrolü kaldırıldı; `Files.createDirectories()` doğrudan çağrılıyor (idempotent). Çok iş parçacıklı ortamda dizin oluşturma yarış koşulu giderildi. - **WebPanel — Düz Metin Şifre Loglama**: Varsayılan web panel şifresi artık loglara açık metin olarak yazılmıyor; yalnızca ilk 3 karakter ve maskelenmiş kısım gösteriliyor. - **AtomGuard — `onDisable()` Kapatma Sırası**: Modüller ve yöneticiler doğru sırayla kapatılıyor (modüller → yöneticiler → depolama → log); `discordWebhookManager.stop()`, `PacketEvents listener unregister`, outgoing/incoming plugin channel unregister eklendi. - **RedisManager — Daemon Thread ve PubSub Takılması**: PubSub thread'i daemon olarak işaretlendi; `stop()` artık `activePubSub.unsubscribe()` çağırarak JedisPubSub'ın `subscribe()` blokajını serbest bırakıyor. - **AttackModeManager — Sayaç Sıfırlama Thread Safety**: `lastReset` alanı `volatile long`'dan `AtomicLong`'a yükseltildi; `recordConnection()` CAS ile tek thread'in sıfırlama yapmasını garantiliyor. - **PanicCommand / BukkitListener — Null Address NPE**: Oyuncu IP adresi null kontrolü eklendi; bağlantı sırasında adresi henüz atanmamış oyuncularda `NullPointerException` önlendi. - **ConnectionPipeline — ArrayList Yerine CopyOnWriteArrayList**: Çok iş parçacıklı ortamda eş zamanlı okuma-yazma güvenliği sağlandı. - **SmartLagModule — Watchdog Görev Sızıntısı**: `onEnable()` içinde zamanlayıcı görev ID'si kaydediliyor; `onDisable()` bu ID ile `cancelTask()` çağırarak kaynakları doğru serbest bırakıyor. - **CorePasswordCheckModule — DoS Güvenlik Açığı**: 128 karakteri aşan şifreler için SHA-256 hesaplaması artık yapılmıyor; uzun girdilerle hash işlemi kötüye kullanımı engellendi. - **VelocityStorageProvider — Bağlantı Havuzu Boyutu**: SQLite için `MaximumPoolSize=1` (WAL modu zorunluluğu), MySQL için `MaximumPoolSize=5` olarak düzeltildi; önceki yanlış yapılandırma veritabanı hatalarına yol açabiliyordu. - **ConnectionListener — Çevrimdışı Mod UUID Null**: Velocity `PreLoginEvent` çevrimdışı modda UUID'yi null döndürebiliyor; `UUID.nameUUIDFromBytes` ile güvenli yedek atama yapıldı. - **ConfigManager — InputStream Kaynağı Sızıntısı**: `loadConfig()` ve `loadMessages()` içindeki `InputStream` / `InputStreamReader` nesneleri try-with-resources ile sarıldı; kaynaklar her durumda kapatılıyor. - **IPReputationManager — InputStreamReader Kaynağı Sızıntısı**: İki ayrı `InputStreamReader` kullanımı try-with-resources ile güvence altına alındı. - **AtomGuard — BotProtectionModule Kullanımdan Kaldırma**: `@Deprecated` `BotProtectionModule` `registerModules()` içinden kaldırıldı.

### 🔧 İyileştirmeler - **VelocityStorageProvider — Kod Tekrarı Giderildi**: `saveBehaviorProfile()` ve `saveBehaviorProfileSync()` içindeki JSON inşa mantığı `buildProfileJson()` özel yardımcı metoduna taşındı; bakımı kolaylaştırıldı. - **AttackSnapshot — Koleksiyon Optimizasyonu**: Saldırı sırasında yoğun yazma yapılan `timeline` ve `triggeredModules` alanları `CopyOnWriteArrayList`'ten `Collections.synchronizedList(new ArrayList<>())` türüne değiştirildi; GC baskısı azaltıldı. - **ConfigManager — Gereksiz Değişken Kaldırıldı**: `loadMessages()` içindeki anlamsız `final String finalFileName = fileName` ataması temizlendi; `fileName` doğrudan kullanılıyor. ### 🐛 Hata Düzeltmeleri - **VelocityStatisticsManager / TempBanManager — TOCTOU Yarış Koşulu**: `save()` metodlarındaki `Files.exists()` ön kontrolü kaldırıldı; `Files.createDirectories()` doğrudan çağrılıyor (idempotent). Çok iş parçacıklı ortamda dizin oluşturma yarış koşulu giderildi. - **WebPanel — Düz Metin Şifre Loglama**: Varsayılan web panel şifresi artık loglara açık metin olarak yazılmıyor; yalnızca ilk 3 karakter ve maskelenmiş kısım gösteriliyor. - **AtomGuard — `onDisable()` Kapatma Sırası**: Modüller ve yöneticiler doğru sırayla kapatılıyor (modüller → yöneticiler → depolama → log); `discordWebhookManager.stop()`, `PacketEvents listener unregister`, outgoing/incoming plugin channel unregister eklendi. - **RedisManager — Daemon Thread ve PubSub Takılması**: PubSub thread'i daemon olarak işaretlendi; `stop()` artık `activePubSub.unsubscribe()` çağırarak JedisPubSub'ın `subscribe()` blokajını serbest bırakıyor. - **AttackModeManager — Sayaç Sıfırlama Thread Safety**: `lastReset` alanı `volatile long`'dan `AtomicLong`'a yükseltildi; `recordConnection()` CAS ile tek thread'in sıfırlama yapmasını garantiliyor. - **PanicCommand / BukkitListener — Null Address NPE**: Oyuncu IP adresi null kontrolü eklendi; bağlantı sırasında adresi henüz atanmamış oyuncularda `NullPointerException` önlendi. - **ConnectionPipeline — ArrayList Yerine CopyOnWriteArrayList**: Çok iş parçacıklı ortamda eş zamanlı okuma-yazma güvenliği sağlandı. - **SmartLagModule — Watchdog Görev Sızıntısı**: `onEnable()` içinde zamanlayıcı görev ID'si kaydediliyor; `onDisable()` bu ID ile `cancelTask()` çağırarak kaynakları doğru serbest bırakıyor. - **CorePasswordCheckModule — DoS Güvenlik Açığı**: 128 karakteri aşan şifreler için SHA-256 hesaplaması artık yapılmıyor; uzun girdilerle hash işlemi kötüye kullanımı engellendi. - **VelocityStorageProvider — Bağlantı Havuzu Boyutu**: SQLite için `MaximumPoolSize=1` (WAL modu zorunluluğu), MySQL için `MaximumPoolSize=5` olarak düzeltildi; önceki yanlış yapılandırma veritabanı hatalarına yol açabiliyordu. - **ConnectionListener — Çevrimdışı Mod UUID Null**: Velocity `PreLoginEvent` çevrimdışı modda UUID'yi null döndürebiliyor; `UUID.nameUUIDFromBytes` ile güvenli yedek atama yapıldı. - **ConfigManager — InputStream Kaynağı Sızıntısı**: `loadConfig()` ve `loadMessages()` içindeki `InputStream` / `InputStreamReader` nesneleri try-with-resources ile sarıldı; kaynaklar her durumda kapatılıyor. - **IPReputationManager — InputStreamReader Kaynağı Sızıntısı**: İki ayrı `InputStreamReader` kullanımı try-with-resources ile güvence altına alındı. - **AtomGuard — BotProtectionModule Kullanımdan Kaldırma**: `@Deprecated` `BotProtectionModule` `registerModules()` içinden kaldırıldı.

**Dev Build #44** - [`90937d3`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/90937d3d1812e142a8a0f6c74f9a43fafc07db93) fix(bump): CHANGELOG.md'ye tek bölüm ekleme hatası düzeltildi (ATOMGAMERAGA) - [`c3eea91`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c3eea91f3f4a910b6e2a5ea2182022991a4c11c2) 🔖 Release v1.2.5 — kritik thread safety & başlatma sırası düzeltmeleri (ATOMGAMERAGA) - [`c989906`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c989906f74f395feba7416d28878098484cd1c41) 🔖 Release v1.2.4 — thread safety, NPE fix, cleanup (ATOMGAMERAGA) - [`7d4ae1d`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/7d4ae1dbce56db4b775e6663e1fa1b1c83642c38) fix(ci): PacketEvents Modrinth ID düzeltildi hkfCOMjf → HYKaKraK (ATOMGAMERAGA) - [`d058ee4`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d058ee442cf7866f57bdfe3d432687af7fb0593e) fix(ci): GitHub stage catchError eklendi, curl -sf → curl -s (ATOMGAMERAGA) - [`45d1bb5`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/45d1bb558411d4ec017ac2f340af6870500cfaec) fix(ci): python3 tamamen kaldırıldı — Groovy JsonOutput + grep ile değiştirildi (ATOMGAMERAGA) - [`8a26066`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/8a2606600c61259cebcf51488f2484db8e9f45b3) fix(ci): gh CLI → curl/python3 GitHub API, Setup GitHub CLI stage kaldırıldı (ATOMGAMERAGA) - [`42951d8`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/42951d87e436be30e9847d49c19d5b38601dbd4d) fix(ci): gh kurulum sh syntax düzeltildi, cleanWs→deleteDir (ATOMGAMERAGA) - [`a56ae8e`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/a56ae8e3326a978d3cdc20d41c6e99ecd401e825) fix(ci): timestamps() kaldırıldı — plugin kurulu değil (ATOMGAMERAGA) - [`700a43e`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/700a43e755fe211f819f2e1400991ff33932c9b5) fix(ci): Jenkinsfile Groovy backtick escape hataları düzeltildi (ATOMGAMERAGA)

**Dev Build #44** - [`90937d3`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/90937d3d1812e142a8a0f6c74f9a43fafc07db93) fix(bump): CHANGELOG.md'ye tek bölüm ekleme hatası düzeltildi (ATOMGAMERAGA) - [`c3eea91`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c3eea91f3f4a910b6e2a5ea2182022991a4c11c2) 🔖 Release v1.2.5 — kritik thread safety & başlatma sırası düzeltmeleri (ATOMGAMERAGA) - [`c989906`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/c989906f74f395feba7416d28878098484cd1c41) 🔖 Release v1.2.4 — thread safety, NPE fix, cleanup (ATOMGAMERAGA) - [`7d4ae1d`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/7d4ae1dbce56db4b775e6663e1fa1b1c83642c38) fix(ci): PacketEvents Modrinth ID düzeltildi hkfCOMjf → HYKaKraK (ATOMGAMERAGA) - [`d058ee4`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/d058ee442cf7866f57bdfe3d432687af7fb0593e) fix(ci): GitHub stage catchError eklendi, curl -sf → curl -s (ATOMGAMERAGA) - [`45d1bb5`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/45d1bb558411d4ec017ac2f340af6870500cfaec) fix(ci): python3 tamamen kaldırıldı — Groovy JsonOutput + grep ile değiştirildi (ATOMGAMERAGA) - [`8a26066`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/8a2606600c61259cebcf51488f2484db8e9f45b3) fix(ci): gh CLI → curl/python3 GitHub API, Setup GitHub CLI stage kaldırıldı (ATOMGAMERAGA) - [`42951d8`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/42951d87e436be30e9847d49c19d5b38601dbd4d) fix(ci): gh kurulum sh syntax düzeltildi, cleanWs→deleteDir (ATOMGAMERAGA) - [`a56ae8e`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/a56ae8e3326a978d3cdc20d41c6e99ecd401e825) fix(ci): timestamps() kaldırıldı — plugin kurulu değil (ATOMGAMERAGA) - [`700a43e`](https://github.com/ATOMGAMERAGA/AtomGuard/commit/700a43e755fe211f819f2e1400991ff33932c9b5) fix(ci): Jenkinsfile Groovy backtick escape hataları düzeltildi (ATOMGAMERAGA)

### 🔧 İyileştirmeler - **AbstractModule — Asenkron Ağır İşlemler**: `blockExploit()` içindeki olay fırlatma, heuristik güncelleme, güven skoru kaydı ve adli analiz kayıt adımları `runTaskAsynchronously` ile ana thread'den kaldırıldı; yüksek trafik altında gecikme azaltıldı. - **AtomGuard — Periyodik Temizlik**: Her 5 dakikada bir tüm modüllerin `cleanup()` ve `HeuristicEngine.cleanupOfflinePlayers()` çağrıları yapılıyor; bellek sızıntısı önlendi. - **BukkitListener — Bypass Önbelleği**: `PlayerJoinEvent`'te `checkAndCacheBypass()`, `PlayerQuitEvent`'te `removeBypassCache()` çağrıları eklendi; Netty thread'inden permission API çağrısı tamamen kaldırıldı. ### 🐛 Hata Düzeltmeleri - **AtomGuard — Başlatma Sırası Kritik Hata**: `PacketListener`, `registerModules()` ve `enableAllModules()` çağrılarından **önce** oluşturulmaya başlandı. Eski sıralamada modüller `registerReceiveHandler()` çağırırken `packetListener` null olduğundan sunucu açılışta `NullPointerException` ile çöküyordu. - **PacketListener — Netty Thread'den hasPermission() Çağrısı**: `hasBypass()` artık Bukkit permission API'sini çağırmıyor; tamamen önbellek tabanlı. Bypass olmayan oyuncular da `-1L` sentinel değeriyle önbelleğe alınıyor. `synchronized` liste `CopyOnWriteArrayList` ile değiştirildi. `getPlayer()` yalnızca rotasyon/animasyon paketleri için çağrılıyor. - **7 Modül — PacketListenerAbstract Bağımsız Kayıt**: `PacketExploitModule`, `PacketDelayModule`, `OfflinePacketModule`, `BookCrasherModule`, `BundleDuplicationModule`, `InvalidSlotModule`, `CustomPayloadModule` kendi `PacketListenerAbstract` örneklerini kaydetmek yerine `registerReceiveHandler()` korumalı metodunu kullanacak şekilde yeniden yazıldı; handler takibi ve merkezi temizlik düzgün çalışıyor. - **26 Modül — Çift Bukkit Olay Kaydı**: `AbstractModule.onEnable()` zaten `registerEvents()` çağırdığı halde bu modüller `onEnable()` override'larında ikinci kez manuel kayıt yapıyordu; tüm çift kayıtlar kaldırıldı. - **ModuleManager — Başlatma Hatasında Rollback Eksikliği**: `enableAllModules()` ve `enableModule()` içindeki `catch` blokları artık `module.onDisable()` çağırarak yarım kalan modülü geri alıyor; tutarsız aktif-listesi durumu önlendi. - **OfflinePacketModule — Güvenilmez Online Kontrolü**: `Bukkit.getPlayer(uuid)` yerine `player.isOnline()` kullanılıyor; null dereference riski ortadan kalktı. - **NBTCrasherModule / AdvancedPayloadModule — Yanlış Handler Kaydı**: `plugin.getPacketListener().registerReceiveHandler()` yerine `protected registerReceiveHandler()` kullanılıyor; handler listesi tutarsızlığı ve temizlik hataları giderildi. - **NettyCrashModule — Thread Safety**: `pipeline.addAfter()` ve `pipeline.remove()` çağrıları `channel.eventLoop().execute()` içine taşındı; Netty pipeline değişiklikleri artık kanal kendi event loop thread'inde yapılıyor.

### 🔧 İyileştirmeler - **AbstractModule — Asenkron Ağır İşlemler**: `blockExploit()` içindeki olay fırlatma, heuristik güncelleme, güven skoru kaydı ve adli analiz kayıt adımları `runTaskAsynchronously` ile ana thread'den kaldırıldı; yüksek trafik altında gecikme azaltıldı. - **AtomGuard — Periyodik Temizlik**: Her 5 dakikada bir tüm modüllerin `cleanup()` ve `HeuristicEngine.cleanupOfflinePlayers()` çağrıları yapılıyor; bellek sızıntısı önlendi. - **BukkitListener — Bypass Önbelleği**: `PlayerJoinEvent`'te `checkAndCacheBypass()`, `PlayerQuitEvent`'te `removeBypassCache()` çağrıları eklendi; Netty thread'inden permission API çağrısı tamamen kaldırıldı. ### 🐛 Hata Düzeltmeleri - **AtomGuard — Başlatma Sırası Kritik Hata**: `PacketListener`, `registerModules()` ve `enableAllModules()` çağrılarından **önce** oluşturulmaya başlandı. Eski sıralamada modüller `registerReceiveHandler()` çağırırken `packetListener` null olduğundan sunucu açılışta `NullPointerException` ile çöküyordu. - **PacketListener — Netty Thread'den hasPermission() Çağrısı**: `hasBypass()` artık Bukkit permission API'sini çağırmıyor; tamamen önbellek tabanlı. Bypass olmayan oyuncular da `-1L` sentinel değeriyle önbelleğe alınıyor. `synchronized` liste `CopyOnWriteArrayList` ile değiştirildi. `getPlayer()` yalnızca rotasyon/animasyon paketleri için çağrılıyor. - **7 Modül — PacketListenerAbstract Bağımsız Kayıt**: `PacketExploitModule`, `PacketDelayModule`, `OfflinePacketModule`, `BookCrasherModule`, `BundleDuplicationModule`, `InvalidSlotModule`, `CustomPayloadModule` kendi `PacketListenerAbstract` örneklerini kaydetmek yerine `registerReceiveHandler()` korumalı metodunu kullanacak şekilde yeniden yazıldı; handler takibi ve merkezi temizlik düzgün çalışıyor. - **26 Modül — Çift Bukkit Olay Kaydı**: `AbstractModule.onEnable()` zaten `registerEvents()` çağırdığı halde bu modüller `onEnable()` override'larında ikinci kez manuel kayıt yapıyordu; tüm çift kayıtlar kaldırıldı. - **ModuleManager — Başlatma Hatasında Rollback Eksikliği**: `enableAllModules()` ve `enableModule()` içindeki `catch` blokları artık `module.onDisable()` çağırarak yarım kalan modülü geri alıyor; tutarsız aktif-listesi durumu önlendi. - **OfflinePacketModule — Güvenilmez Online Kontrolü**: `Bukkit.getPlayer(uuid)` yerine `player.isOnline()` kullanılıyor; null dereference riski ortadan kalktı. - **NBTCrasherModule / AdvancedPayloadModule — Yanlış Handler Kaydı**: `plugin.getPacketListener().registerReceiveHandler()` yerine `protected registerReceiveHandler()` kullanılıyor; handler listesi tutarsızlığı ve temizlik hataları giderildi. - **NettyCrashModule — Thread Safety**: `pipeline.addAfter()` ve `pipeline.remove()` çağrıları `channel.eventLoop().execute()` içine taşındı; Netty pipeline değişiklikleri artık kanal kendi event loop thread'inde yapılıyor.

### 🐛 Hata Düzeltmeleri - **AntiBotModule — NPE Düzeltme**: `getOrCreateProfile()` ve `handleIncomingPacket()` içinde `user.getAddress()` null döndürebiliyordu; pre-login paket işleyicilerinde sunucu çöküyordu. Null kontrolü eklendi, null durumda `"0.0.0.0"` kullanılıyor. - **PlayerProfile — Thread Safety**: PacketEvents thread'leriyle paylaşılan 8 alan (`sentClientSettings`, `sentPositionPacket`, `interactedWithInventory`, `interactedWithWorld`, `lastSeen`, `cachedFirstJoinScore`, `currentThreatScore`, `successfulSessionCount`) `volatile` yapıldı. `maxThreatScore` check-then-set yarış koşulu `AtomicInteger.updateAndGet()` ile çözüldü. - **AttackModeManager — Race Condition**: `attackModeStartTime` alanı birden fazla thread'den erişilirken `volatile` değildi; attack mode süre hesaplamaları yanlış olabiliyordu. `volatile` yapıldı. - **AntiBotModule — Hatalı Offline Kontrol**: `cleanupProfiles()` içinde `Bukkit.getOfflinePlayer(uuid).isOnline()` güvenilmezdi (disk erişimi yapar, pahalı). `Bukkit.getPlayer(uuid) == null` ile değiştirildi. ### 🔧 İyileştirmeler - `CHANGELOG.md` içindeki yinelenen boş `[1.2.3]` bölümleri temizlendi.

### 🐛 Hata Düzeltmeleri - **AntiBotModule — NPE Düzeltme**: `getOrCreateProfile()` ve `handleIncomingPacket()` içinde `user.getAddress()` null döndürebiliyordu; pre-login paket işleyicilerinde sunucu çöküyordu. Null kontrolü eklendi, null durumda `"0.0.0.0"` kullanılıyor. - **PlayerProfile — Thread Safety**: PacketEvents thread'leriyle paylaşılan 8 alan (`sentClientSettings`, `sentPositionPacket`, `interactedWithInventory`, `interactedWithWorld`, `lastSeen`, `cachedFirstJoinScore`, `currentThreatScore`, `successfulSessionCount`) `volatile` yapıldı. `maxThreatScore` check-then-set yarış koşulu `AtomicInteger.updateAndGet()` ile çözüldü. - **AttackModeManager — Race Condition**: `attackModeStartTime` alanı birden fazla thread'den erişilirken `volatile` değildi; attack mode süre hesaplamaları yanlış olabiliyordu. `volatile` yapıldı. - **AntiBotModule — Hatalı Offline Kontrol**: `cleanupProfiles()` içinde `Bukkit.getOfflinePlayer(uuid).isOnline()` güvenilmezdi (disk erişimi yapar, pahalı). `Bukkit.getPlayer(uuid) == null` ile değiştirildi. ### 🔧 İyileştirmeler - `CHANGELOG.md` içindeki yinelenen boş `[1.2.3]` bölümleri temizlendi.

### 🐛 Hata Düzeltmeleri - **BotProtectionModule — Yanlış "Timed Out" Atması**: `dogrulama.aktif` varsayılanı `true`'dan `false`'a değiştirildi. Saldırı modunda `bot-korumasi` modülünün otomatik devreye girmesi kaldırıldı (artık `otomatik-moduller` listesinde yok). Hareket tabanlı doğrulama artık sohbet ve komut kullanımını da doğrulama olarak kabul ediyor (`PlayerCommandPreprocessEvent` ve `AsyncPlayerChatEvent` eklendi). - **ActionExecutor — KEEP_ALIVE Race Condition**: `executePeriodic`'te kara listeye alma sırası düzeltildi. Artık önce oyuncu atılır (`player.kick()`), ardından 1 tick gecikmeyle IP kara listeye eklenir. Önceki sıralamada (kara liste → kick) KEEP_ALIVE yanıtları iptal edildiğinden sunucu "Timed Out" mesajı gösteriyordu. ### 🔧 İyileştirmeler - `moduller.bot-korumasi` config bölümü eklendi (varsayılan devre dışı, tam dokümantasyonlu) - `attack-mode.aksiyonlar.otomatik-moduller`'den `bot-korumasi` kaldırıldı; AtomShield protokol koruması `bot-koruma` (AntiBotModule) üzerinden zaten aktif

### 🐛 Hata Düzeltmeleri - **BotProtectionModule — Yanlış "Timed Out" Atması**: `dogrulama.aktif` varsayılanı `true`'dan `false`'a değiştirildi. Saldırı modunda `bot-korumasi` modülünün otomatik devreye girmesi kaldırıldı (artık `otomatik-moduller` listesinde yok). Hareket tabanlı doğrulama artık sohbet ve komut kullanımını da doğrulama olarak kabul ediyor (`PlayerCommandPreprocessEvent` ve `AsyncPlayerChatEvent` eklendi). - **ActionExecutor — KEEP_ALIVE Race Condition**: `executePeriodic`'te kara listeye alma sırası düzeltildi. Artık önce oyuncu atılır (`player.kick()`), ardından 1 tick gecikmeyle IP kara listeye eklenir. Önceki sıralamada (kara liste → kick) KEEP_ALIVE yanıtları iptal edildiğinden sunucu "Timed Out" mesajı gösteriyordu. ### 🔧 İyileştirmeler - `moduller.bot-korumasi` config bölümü eklendi (varsayılan devre dışı, tam dokümantasyonlu) - `attack-mode.aksiyonlar.otomatik-moduller`'den `bot-korumasi` kaldırıldı; AtomShield protokol koruması `bot-koruma` (AntiBotModule) üzerinden zaten aktif

## 🛡️ AtomGuard v1.2.2 Advanced Minecraft Server Security & Exploit Protection. ### 📝 What's New? We've added a lot of things since v1, but we're not going to release the versions in between. However, if you want, you can download them via our GitHub page. ### 📦 Installation 1. Stop your server. 2. Delete any old `AtomGuard` or `AtomSMPFixer` JARs from the plugins folder. 3. Upload the new `AtomGuard-core-v1.2.2.jar` to your Paper server's plugins folder. 4. (Optional) Upload `AtomGuard-velocity-v1.2.2.jar` to your Velocity proxy's plugins folder. 5. Start your server. --- *Made with ❤️ by ATOMLAND Studios* **Full Changelog**: https://github.com/ATOMGAMERAGA/AtomGuard/compare/v1.2.1...v1.2.2

## 🛡️ AtomGuard v1.2.2 Advanced Minecraft Server Security & Exploit Protection. ### 📝 What's New? We've added a lot of things since v1, but we're not going to release the versions in between. However, if you want, you can download them via our GitHub page. ### 📦 Installation 1. Stop your server. 2. Delete any old `AtomGuard` or `AtomSMPFixer` JARs from the plugins folder. 3. Upload the new `AtomGuard-core-v1.2.2.jar` to your Paper server's plugins folder. 4. (Optional) Upload `AtomGuard-velocity-v1.2.2.jar` to your Velocity proxy's plugins folder. 5. Start your server. --- *Made with ❤️ by ATOMLAND Studios* **Full Changelog**: https://github.com/ATOMGAMERAGA/AtomGuard/compare/v1.2.1...v1.2.2

## 🛡️ Atom Guard v1.0.0 Advanced Minecraft Server Security & Exploit Protection. ### 📦 Installation 1. Stop your server. 2. Delete any old `AtomGuard` or `AtomSMPFixer` JARs from the plugins folder. 3. Upload the new `AtomGuard-v1.0.0.jar`. 4. Start your server. --- *Made with ❤️ by AtomGuard Team Team* **Full Changelog**: https://github.com/ATOMGAMERAGA/AtomGuard/commits/v1.0.0

## 🛡️ Atom Guard v1.0.0 Advanced Minecraft Server Security & Exploit Protection. ### 📦 Installation 1. Stop your server. 2. Delete any old `AtomGuard` or `AtomSMPFixer` JARs from the plugins folder. 3. Upload the new `AtomGuard-v1.0.0.jar`. 4. Start your server. --- *Made with ❤️ by AtomGuard Team Team* **Full Changelog**: https://github.com/ATOMGAMERAGA/AtomGuard/commits/v1.0.0