fixing spotbugs and adding exclusions

Signed-off-by: salaboy <Salaboy@gmail.com>

Author: salaboy

quarkus/runtime/src/main/java/io/quarkiverse/dapr/langchain4j/agent/AgentRunContext.java

@@ -14,6 +14,7 @@
 package io.quarkiverse.dapr.langchain4j.agent;
 
 import java.lang.reflect.Method;
+import java.util.Arrays;
 import java.util.Map;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ConcurrentHashMap;
@@ -32,11 +33,38 @@ public class AgentRunContext {
    * Holds all the information needed for {@code ToolCallActivity} to execute the tool
    * and unblock the waiting agent thread.
    */
+  @SuppressWarnings("EI_EXPOSE_REP")
   public record PendingCall(
       Object target,
       Method method,
       Object[] args,
       CompletableFuture<Object> resultFuture) {
+
+    /**
+     * Creates a PendingCall with a defensive copy of args.
+     *
+     * @param target       the object instance on which the method will be invoked
+     * @param method       the reflective method handle
+     * @param args         the arguments to pass to the method
+     * @param resultFuture future to complete when the call finishes
+     */
+    public PendingCall(Object target, Method method, Object[] args,
+        CompletableFuture<Object> resultFuture) {
+      this.target = target;
+      this.method = method;
+      this.args = args == null ? null : Arrays.copyOf(args, args.length);
+      this.resultFuture = resultFuture;
+    }
+
+    /**
+     * Returns a defensive copy of args.
+     *
+     * @return copy of args array
+     */
+    @Override
+    public Object[] args() {
+      return args == null ? null : Arrays.copyOf(args, args.length);
+    }
   }
 
   private final String agentRunId;

quarkus/runtime/src/main/java/io/quarkiverse/dapr/langchain4j/agent/DaprChatModelDecorator.java

@@ -234,12 +234,12 @@ private String extractUserMessage(ChatRequest request) {
         if ("UserMessage".equals(msg.getClass().getSimpleName())) {
           try {
             return (String) msg.getClass().getMethod("singleText").invoke(msg);
-          } catch (Exception ex) {
+          } catch (ReflectiveOperationException ex) {
             return String.valueOf(msg);
           }
         }
       }
-    } catch (Exception ignored) {
+    } catch (ReflectiveOperationException ignored) {
       // intentionally empty
     }
     return null;
@@ -259,12 +259,12 @@ private String extractSystemMessage(ChatRequest request) {
         if ("SystemMessage".equals(msg.getClass().getSimpleName())) {
           try {
             return (String) msg.getClass().getMethod("text").invoke(msg);
-          } catch (Exception ex) {
+          } catch (ReflectiveOperationException ex) {
             return String.valueOf(msg);
           }
         }
       }
-    } catch (Exception ignored) {
+    } catch (ReflectiveOperationException ignored) {
       // intentionally empty
     }
     return null;

quarkus/runtime/src/main/java/io/quarkiverse/dapr/langchain4j/agent/activities/LlmCallActivity.java

@@ -126,7 +126,7 @@ private String extractResponseText(Object result) {
         Object text = aiMessage.getClass().getMethod("text").invoke(aiMessage);
         return String.valueOf(text);
       }
-    } catch (Exception ignored) {
+    } catch (ReflectiveOperationException ignored) {
       // Not a ChatResponse or missing expected methods — fall through.
     }
     return String.valueOf(result);

quarkus/runtime/src/main/java/io/quarkiverse/dapr/langchain4j/agent/workflow/AgentRunOutput.java

@@ -16,6 +16,7 @@
 import io.quarkiverse.dapr.langchain4j.agent.activities.LlmCallOutput;
 import io.quarkiverse.dapr.langchain4j.agent.activities.ToolCallOutput;
 
+import java.util.Collections;
 import java.util.List;
 
 /**
@@ -33,4 +34,14 @@ public record AgentRunOutput(
     String agentName,
     List<ToolCallOutput> toolCalls,
     List<LlmCallOutput> llmCalls) {
+
+  /**
+   * Creates an AgentRunOutput with unmodifiable defensive copies of the lists.
+   */
+  public AgentRunOutput(String agentName, List<ToolCallOutput> toolCalls,
+      List<LlmCallOutput> llmCalls) {
+    this.agentName = agentName;
+    this.toolCalls = toolCalls == null ? null : Collections.unmodifiableList(List.copyOf(toolCalls));
+    this.llmCalls = llmCalls == null ? null : Collections.unmodifiableList(List.copyOf(llmCalls));
+  }
 }

quarkus/runtime/src/main/java/io/quarkiverse/dapr/langchain4j/workflow/DaprWorkflowPlanner.java

@@ -72,6 +72,7 @@ public record AgentMetadata(String agentName, String userMessage, String systemM
    * The {@code agentRunId} is forwarded to the planner so it can set
    * {@link DaprAgentContextHolder} on the executing thread before tool calls begin.
    */
+  @SuppressWarnings({"EI_EXPOSE_REP", "EI_EXPOSE_REP2"})
   public record AgentExchange(AgentInstance agent, CompletableFuture<Void> continuation, String agentRunId) {
   }
 
@@ -353,6 +354,7 @@ public AgentMetadata getAgentMetadata(int index) {
    *
    * @return the agentic scope
    */
+  @SuppressWarnings("EI_EXPOSE_REP")
   public AgenticScope getAgenticScope() {
     return agenticScope;
   }
@@ -436,7 +438,7 @@ public void setTestExitAtLoopEnd(boolean testExitAtLoopEnd) {
    * @param conditions the conditions map
    */
   public void setConditions(Map<Integer, Predicate<AgenticScope>> conditions) {
-    this.conditions = conditions;
+    this.conditions = conditions == null ? Collections.emptyMap() : Map.copyOf(conditions);
   }
 
   private void cleanup() {

spotbugs-exclude.xml

@@ -63,4 +63,18 @@
         <Package name="~io\.dapr.*"/>
         <Bug pattern="NP_UNWRITTEN_FIELD"/>
     </Match>
+
+    <!--Quarkus extension uses io.quarkiverse.dapr.* packages — apply same exclusions-->
+    <Match>
+        <Package name="~io\.quarkiverse\.dapr.*"/>
+        <Bug pattern="EI_EXPOSE_REP"/>
+    </Match>
+    <Match>
+        <Package name="~io\.quarkiverse\.dapr.*"/>
+        <Bug pattern="EI_EXPOSE_REP2"/>
+    </Match>
+    <Match>
+        <Package name="~io\.quarkiverse\.dapr.*"/>
+        <Bug pattern="REC_CATCH_EXCEPTION"/>
+    </Match>
 </FindBugsFilter>