Post-review consolidation PR. All four open issues from the parallel
code/security/hotkey/NPC audits resolved in one ship.
Key user-facing changes:
UI
- Single keybind: B opens a hub screen with buttons to the 5 sub-screens.
- K/J/N/H/M direct shortcuts default to UNBOUND so they no longer
compete with the ~100 other mods. Rebindable in vanilla controls menu.
- M used to clash with vanilla Social Interactions + FTB Chunks
fullscreen map; fully resolved.
NPC dialogue + scripting integration
- New /bns open <screen> command. Easy NPC dialogue COMMAND actions
can now open any bnstoolkit screen on the clicking player.
- FTB Quests reward commands, command blocks, and /trigger objectives
can all route into bnstoolkit screens via the same command.
- config/easy_npc/security.cfg ships with executeAsUserCommandAllowList
.ALL=bns so dialogue-triggered /bns commands actually run.
Bug fix (this is the load-bearing item)
- Bounty board + plot office screens were reading NBT keys that don't
exist in KubeJS, so they always showed "no active bounties" and "all
plots free" no matter what was actually in the world. Fixed by reading
the real per-player keys (bnsBountyPool/Active/Completed) and the
server-scope bnsPlots compound via KubeJS' MinecraftServer mixin
(reflective, no compileOnly dep on KubeJS).
Hardening (no behavior change, defense-in-depth)
- Per-player token bucket on C2S packets (10/s sustain, 20 burst).
- All STRING_UTF8 codec fields capped at sane sizes (≤80 chars).
- Verb whitelist replaced with structured parse + per-verb regex
validation + rebuilt command. No prefix-startsWith surprises.
- Tier-upgrade in-flight guard closes the concurrent-packet
double-spend race window.
- Log lines sanitised to prevent control-char injection.
Plus the nits caught by review:
- Per-player tick counter for HUD push (was a shared static)
- VillagerTradeRebalance try/catch + null-cost-A passthrough +
round-to-nearest denom split (was floor — ~10% silent price haircut)
- SpurHud component cache (was allocating per frame)
- BountyBoardScreen dead branch removed
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Matt
ad9a261627