pack: v0.36.0 — bnstoolkit 0.4.1 (NBT fix + hub UI + NPC integration + hardening)

Post-review consolidation PR. All four open issues from the parallel
code/security/hotkey/NPC audits resolved in one ship.

Key user-facing changes:

UI
- Single keybind: B opens a hub screen with buttons to the 5 sub-screens.
- K/J/N/H/M direct shortcuts default to UNBOUND so they no longer
  compete with the ~100 other mods. Rebindable in vanilla controls menu.
- M used to clash with vanilla Social Interactions + FTB Chunks
  fullscreen map; fully resolved.

NPC dialogue + scripting integration
- New /bns open <screen> command. Easy NPC dialogue COMMAND actions
  can now open any bnstoolkit screen on the clicking player.
- FTB Quests reward commands, command blocks, and /trigger objectives
  can all route into bnstoolkit screens via the same command.
- config/easy_npc/security.cfg ships with executeAsUserCommandAllowList
  .ALL=bns so dialogue-triggered /bns commands actually run.

Bug fix (this is the load-bearing item)
- Bounty board + plot office screens were reading NBT keys that don't
  exist in KubeJS, so they always showed "no active bounties" and "all
  plots free" no matter what was actually in the world. Fixed by reading
  the real per-player keys (bnsBountyPool/Active/Completed) and the
  server-scope bnsPlots compound via KubeJS' MinecraftServer mixin
  (reflective, no compileOnly dep on KubeJS).

Hardening (no behavior change, defense-in-depth)
- Per-player token bucket on C2S packets (10/s sustain, 20 burst).
- All STRING_UTF8 codec fields capped at sane sizes (≤80 chars).
- Verb whitelist replaced with structured parse + per-verb regex
  validation + rebuilt command. No prefix-startsWith surprises.
- Tier-upgrade in-flight guard closes the concurrent-packet
  double-spend race window.
- Log lines sanitised to prevent control-char injection.

Plus the nits caught by review:
- Per-player tick counter for HUD push (was a shared static)
- VillagerTradeRebalance try/catch + null-cost-A passthrough +
  round-to-nearest denom split (was floor — ~10% silent price haircut)
- SpurHud component cache (was allocating per frame)
- BountyBoardScreen dead branch removed

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

pack/overrides/config/easy_npc/security.cfg

@@ -0,0 +1,50 @@
+#Easy NPC Security Configuration
+#
+#Permission values use enum names: ALL, MODERATORS, GAMEMASTERS, ADMINS, OWNERS.
+#Legacy numeric Minecraft command permission levels are accepted and rewritten to enum names.
+#
+#normalPlayerCommandLevel: Max command level for normal player-owned imports (default: ALL)
+#creativePlayerCommandLevel: Max command level for creative non-admin imports (default: MODERATORS)
+#maxAdminImportedCommandLevel: Max command level for admin imports (default: ADMINS)
+#serverTrustedCommandLevel: Max command level for server-side trusted imports without player context (default: ADMINS)
+#blockUnsafeNpcCommands: Blocks critical server management commands from NPC command execution (default: true)
+#npcSpawnRateLimitCreative: Max new NPCs a creative (non-admin) player may spawn via browser per minute (default: 5)
+#npcSpawnRateLimitAdmin: Max new NPCs an admin player may spawn via browser per minute (default: 20)
+#Feature values use enum names: NORMAL_PLAYER, CREATIVE_PLAYER, ADMIN, SERVER_TRUSTED.
+#feature.SPAWN_NPC: Minimum role required to spawn new NPCs from the preset browser (default: CREATIVE_PLAYER)
+#feature.WORLD_PRESET: Minimum role required to import/export world presets (default: CREATIVE_PLAYER)
+#feature.CUSTOM_PRESET: Minimum role required to import/export custom server presets (default: CREATIVE_PLAYER)
+#feature.LOCAL_PRESET: Minimum role required to export presets locally to the client (default: NORMAL_PLAYER)
+#feature.DEFAULT_PRESET_IMPORT: Minimum role required to import built-in default presets (default: CREATIVE_PLAYER)
+#feature.URL_RESOURCE: Minimum role required to use URL-based skin loading (default: CREATIVE_PLAYER)
+#Sat Jun 06 23:34:43 UTC 2026
+blockUnsafeNpcCommands=true
+creativePlayerCommandLevel=MODERATORS
+executeAsUserCommandAllowList.ADMINS=
+executeAsUserCommandAllowList.ALL=bns
+executeAsUserCommandAllowList.GAMEMASTERS=
+executeAsUserCommandAllowList.MODERATORS=
+executeAsUserCommandAllowList.OWNERS=
+feature.BASE_ATTRIBUTE=CREATIVE_PLAYER
+feature.COMBAT_ATTRIBUTE=CREATIVE_PLAYER
+feature.COMMAND_ACTION=CREATIVE_PLAYER
+feature.CUSTOM_PRESET=CREATIVE_PLAYER
+feature.DEFAULT_PRESET_IMPORT=CREATIVE_PLAYER
+feature.DIALOG=NORMAL_PLAYER
+feature.INTERACT_BLOCK_ACTION=CREATIVE_PLAYER
+feature.LOCAL_PRESET=NORMAL_PLAYER
+feature.MOVEMENT=CREATIVE_PLAYER
+feature.OBJECTIVE=CREATIVE_PLAYER
+feature.OPEN_TRADING_ACTION=CREATIVE_PLAYER
+feature.POSITION=CREATIVE_PLAYER
+feature.SCOREBOARD_ACTION=CREATIVE_PLAYER
+feature.SPAWN_NPC=CREATIVE_PLAYER
+feature.TRADING=CREATIVE_PLAYER
+feature.URL_RESOURCE=CREATIVE_PLAYER
+feature.WORLD_PRESET=CREATIVE_PLAYER
+maxAdminImportedCommandLevel=ADMINS
+normalPlayerCommandLevel=ALL
+npcSpawnRateLimitAdmin=20
+npcSpawnRateLimitCreative=5
+serverTrustedCommandLevel=ADMINS
+unsafeNpcCommands=ban,ban-ip,banlist,debug,deop,difficulty,forceload,function,gamerule,kick,op,pardon,reload,save-all,save-off,save-on,schedule,setidletimeout,setworldspawn,spawnpoint,spreadplayers,stop,whitelist

pack/pack.lock.json

@@ -1,13 +1,13 @@
 {
   "$schema": "Brass-and-Sigil pack.lock.json - generated, do not edit by hand unless you know what you are doing",
   "name": "Brass and Sigil",
-  "version": "0.35.0",
+  "version": "0.36.0",
   "minecraft": "1.21.1",
   "loader": {
     "type": "neoforge",
     "version": "21.1.228"
   },
-  "lockedAt": "2026-06-07T02:33:07Z",
+  "lockedAt": "2026-06-07T09:27:18Z",
   "mods": [
     {
       "source": "modrinth",