feat: 強化租借身分組/稱呼與 AI 聊天的安全防護

[itousouta15]

變更內容

cog/chat.py — AI 聊天防誘導 @everyone

• 新增 \sanitize_mentions()\：送出前破壞 @everyone/@here\（插入零寬空格）並移除 <@user>/<@&role>\ 提及語法
• \message.reply()\ 加入 \�llowed_mentions(everyone/roles/users=False)\ 雙層防護

cog/perk.py — 租借身分組與稱呼

• 身分組改為最高優先度：\ctx.guild.me.top_role.position - 1\（Discord 限制角色不能高於 bot top role，修正先前 400 Missing Permissions 導致指令卡住）
• 新增 \contains_forbidden()\：敏感詞篩選（讀 config \perk.forbidden\）
• 新增 \is_same_as_member()\：與其他成員 display_name 完全相同即拒絕（防撞名）
• /custom_role\ 與 /chat_nick\ 扣點前執行上述檢查

database/server.config.json

• 新增 \perk.forbidden\ 敏感詞清單（70 詞：會長/副會長/常見不雅詞彙）

驗證

• 本地 + 伺服器編譯通過
• sanitize/敏感詞/撞名邏輯單元測試通過
• 已部署至伺服器並重啟，bot 正常上線

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• main
• development

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 847a85ac-138d-4bb4-a8d6-182a613a0efd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}