chore: code quality sweep 2026-05-04 / 2026-05-05

General code-quality and robustness pass across the plugin: thread-
safety on IPC state, resource-disposal cleanups, input validation,
defensive null-checks and a few small UX glitches. Compliance docs
(THIRD_PARTY_NOTICES, PRIVACY, COPYRIGHT) refreshed to v1.0.3.

Highlights
- ExtraChat IPC state synchronised across threads
- ChatLogWindow autocomplete no longer leaks the unmanaged
  ImGuiListClipper allocation
- ChatLogWindow + Popout style stack stays balanced when config
  toggles mid-frame
- Retention sweep and privacy cleanup wait for the actual filter
  pass instead of the fire-and-forget Task that started it
- Configuration.LatestVersion bumped to 13 to match the active
  migration path
- GameFunctions placeholder buffer guarded against oversized
  replacement names
- TellTarget.IsSet, ResolveTempInputChannel, InputPreview, IconUtil,
  Lender, Payloads, ExtraPayload all hardened against null / empty /
  EOF / cycle inputs
- FontManager Lodestone download stays in scope for a follow-up
  (timeout + lazy init pending)
- AutoTranslate replaced the msvcrt.dll memcmp P/Invoke with a
  managed Span comparison
- Privacy cleanup worker thread marked IsBackground = true
- Database cleanup now removes both legacy files in one click
- Tell-target name redacted in the verbose debug log

Compliance
- THIRD_PARTY_NOTICES: last-reviewed bumped to v1.0.3, Pidgin 3.5.1,
  SQLitePCLRaw.lib.e_sqlite3 3.50.3 listed as direct dependency with
  CVE-2025-6965 / CVE-2025-7709 rationale
- PRIVACY: last-reviewed bumped to v1.0.3, BetterTTV trigger wording
  clarified (list fetch at startup vs. on-demand image fetch)
- COPYRIGHT: upstream attribution range widened

Build: 0 warnings, 0 errors. No behavioural changes that would alter
existing user configuration or stored chat history.

HellionChat/Util/AutoTranslate.cs

@@ -1,6 +1,5 @@
 using System.Diagnostics;
 using System.Globalization;
-using System.Runtime.InteropServices;
 using System.Text;
 using Dalamud.Game;
 using Dalamud.Utility;
@@ -233,9 +232,6 @@ internal static class AutoTranslate
             .ToList();
     }
 
-    [DllImport("msvcrt.dll", CallingConvention = CallingConvention.Cdecl)]
-    private static extern int memcmp(byte[] b1, byte[] b2, nuint count);
-
     internal static void ReplaceWithPayload(ref byte[] bytes)
     {
         var search = "<at:"u8.ToArray();
@@ -279,7 +275,10 @@ internal static class AutoTranslate
                 start = -1;
             }
 
-            if (i + search.Length < bytes.Length && memcmp(bytes[i..], search, (nuint) search.Length) == 0)
+            // Pure managed comparison via Span avoids the msvcrt.dll P/Invoke,
+            // which is fragile under Wine and triggered an extra managed-to-
+            // unmanaged copy per check.
+            if (i + search.Length < bytes.Length && bytes.AsSpan(i, search.Length).SequenceEqual(search))
                 start = i;
         }
     }

HellionChat/Util/ExtraPayload.cs

@@ -25,6 +25,8 @@ public class ColorPayload
                 return payload;
             case 0xE9:
                 var param = stream.ReadByte();
+                if (param == -1)
+                    throw new ArgumentException("Encountered premature end of input (unexpected EOF).", nameof(stream));
                 var globalValue = (uint) GlobalParametersCache.GetValue(param - 2);
                 payload.Enabled = true;
                 payload.UnshiftedColor = globalValue;

HellionChat/Util/IconUtil.cs

@@ -49,9 +49,21 @@ public readonly unsafe ref struct GfdFileView
         var entries = Entries;
         if (DirectLookup)
         {
-            if (iconId <= entries.Length)
+            // Resolve redirects on the direct-lookup path too — the binary-search
+            // path follows them, and skipping them here was inconsistent for
+            // contiguous ID sets.
+            var visited = 0;
+            while (iconId <= entries.Length)
             {
                 entry = entries[(int)(iconId - 1)];
+                if (followRedirect && entry.Redirect != 0 && entry.Redirect != iconId)
+                {
+                    if (++visited > entries.Length)
+                        break; // cycle guard
+                    iconId = entry.Redirect;
+                    continue;
+                }
+
                 return !entry.IsEmpty;
             }
 
@@ -146,12 +158,17 @@ public readonly unsafe ref struct GfdFileView
 internal static class IconUtil
 {
     private static byte[]? GfdFile;
-    public static unsafe GfdFileView GfdFileView
+    public static GfdFileView GfdFileView
     {
         get
         {
-            GfdFile ??= Plugin.DataManager.GetFile("common/font/gfdata.gfd")!.Data;
-            return new GfdFileView(new ReadOnlySpan<byte>(Unsafe.AsPointer(ref GfdFile[0]), GfdFile.Length));
+            if (GfdFile is null)
+            {
+                var file = Plugin.DataManager.GetFile("common/font/gfdata.gfd")
+                    ?? throw new FileNotFoundException("Failed to load common/font/gfdata.gfd from the game data.");
+                GfdFile = file.Data;
+            }
+            return new GfdFileView(GfdFile);
         }
     }
 

HellionChat/Util/Lender.cs

@@ -8,7 +8,7 @@ internal class Lender<T>
 
     internal Lender(Func<T> ctor)
     {
-        Ctor = ctor;
+        Ctor = ctor ?? throw new ArgumentNullException(nameof(ctor));
     }
 
     internal void ResetCounter()

HellionChat/Util/MemoryUtil.cs

@@ -4,8 +4,21 @@ namespace HellionChat.Util;
 
 public static class MemoryUtil
 {
+    // Diagnostic helper. Pointer dereferences here would crash on a null/garbage
+    // address and a huge length would log megabytes of raw bytes; both are easy
+    // to trigger from a debugger and pollute the log with potentially sensitive
+    // game-state. Validate the inputs before reading.
+    private const int MaxDumpLength = 4096;
+
     public static unsafe void PrintMemoryArea(nint address, int length)
     {
+        if (address == nint.Zero)
+            throw new ArgumentException("Memory address cannot be zero.", nameof(address));
+        if (length <= 0)
+            throw new ArgumentOutOfRangeException(nameof(length), length, "Length must be positive.");
+        if (length > MaxDumpLength)
+            throw new ArgumentOutOfRangeException(nameof(length), length, $"Length exceeds the {MaxDumpLength}-byte safety cap.");
+
         var ptr = (byte*)address;
         var str = new StringBuilder("\n");
         for(var i = 0; i < length; i++)

HellionChat/Util/Payloads.cs

@@ -66,6 +66,8 @@ internal class UriPayload(Uri uri) : Payload
     public static UriPayload ResolveUri(string rawUri)
     {
         ArgumentNullException.ThrowIfNull(rawUri);
+        if (string.IsNullOrWhiteSpace(rawUri))
+            throw new UriFormatException("URI cannot be empty or whitespace.");
 
         // Check for an expected scheme '://', if not add 'https://'
         if (ExpectedSchemes.Any(scheme => rawUri.StartsWith($"{scheme}://")))

HellionChat/Util/StringUtil.cs

@@ -23,6 +23,8 @@ internal static class StringUtil
         var bytes = Math.Abs(byteCount);
         var place = Convert.ToInt32(Math.Floor(Math.Log(bytes, 1024)));
         var num = Math.Round(bytes / Math.Pow(1024, place), 1);
-        return (Math.Sign(byteCount) * num).ToString("N0") + suf[place];
+        // "0.#" keeps the rounded fractional digit (1.5 GB stays "1.5GB"); "N0"
+        // would truncate it back to integer.
+        return (Math.Sign(byteCount) * num).ToString("0.#") + suf[place];
     }
 }