Matt
ad9a261627
Post-review consolidation PR. All four open issues from the parallel code/security/hotkey/NPC audits resolved in one ship. Key user-facing changes: UI - Single keybind: B opens a hub screen with buttons to the 5 sub-screens. - K/J/N/H/M direct shortcuts default to UNBOUND so they no longer compete with the ~100 other mods. Rebindable in vanilla controls menu. - M used to clash with vanilla Social Interactions + FTB Chunks fullscreen map; fully resolved. NPC dialogue + scripting integration - New /bns open <screen> command. Easy NPC dialogue COMMAND actions can now open any bnstoolkit screen on the clicking player. - FTB Quests reward commands, command blocks, and /trigger objectives can all route into bnstoolkit screens via the same command. - config/easy_npc/security.cfg ships with executeAsUserCommandAllowList .ALL=bns so dialogue-triggered /bns commands actually run. Bug fix (this is the load-bearing item) - Bounty board + plot office screens were reading NBT keys that don't exist in KubeJS, so they always showed "no active bounties" and "all plots free" no matter what was actually in the world. Fixed by reading the real per-player keys (bnsBountyPool/Active/Completed) and the server-scope bnsPlots compound via KubeJS' MinecraftServer mixin (reflective, no compileOnly dep on KubeJS). Hardening (no behavior change, defense-in-depth) - Per-player token bucket on C2S packets (10/s sustain, 20 burst). - All STRING_UTF8 codec fields capped at sane sizes (≤80 chars). - Verb whitelist replaced with structured parse + per-verb regex validation + rebuilt command. No prefix-startsWith surprises. - Tier-upgrade in-flight guard closes the concurrent-packet double-spend race window. - Log lines sanitised to prevent control-char injection. Plus the nits caught by review: - Per-player tick counter for HUD push (was a shared static) - VillagerTradeRebalance try/catch + null-cost-A passthrough + round-to-nearest denom split (was floor — ~10% silent price haircut) - SpurHud component cache (was allocating per frame) - BountyBoardScreen dead branch removed Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
51 lines
2.9 KiB
INI
51 lines
2.9 KiB
INI
#Easy NPC Security Configuration
|
|
#
|
|
#Permission values use enum names: ALL, MODERATORS, GAMEMASTERS, ADMINS, OWNERS.
|
|
#Legacy numeric Minecraft command permission levels are accepted and rewritten to enum names.
|
|
#
|
|
#normalPlayerCommandLevel: Max command level for normal player-owned imports (default: ALL)
|
|
#creativePlayerCommandLevel: Max command level for creative non-admin imports (default: MODERATORS)
|
|
#maxAdminImportedCommandLevel: Max command level for admin imports (default: ADMINS)
|
|
#serverTrustedCommandLevel: Max command level for server-side trusted imports without player context (default: ADMINS)
|
|
#blockUnsafeNpcCommands: Blocks critical server management commands from NPC command execution (default: true)
|
|
#npcSpawnRateLimitCreative: Max new NPCs a creative (non-admin) player may spawn via browser per minute (default: 5)
|
|
#npcSpawnRateLimitAdmin: Max new NPCs an admin player may spawn via browser per minute (default: 20)
|
|
#Feature values use enum names: NORMAL_PLAYER, CREATIVE_PLAYER, ADMIN, SERVER_TRUSTED.
|
|
#feature.SPAWN_NPC: Minimum role required to spawn new NPCs from the preset browser (default: CREATIVE_PLAYER)
|
|
#feature.WORLD_PRESET: Minimum role required to import/export world presets (default: CREATIVE_PLAYER)
|
|
#feature.CUSTOM_PRESET: Minimum role required to import/export custom server presets (default: CREATIVE_PLAYER)
|
|
#feature.LOCAL_PRESET: Minimum role required to export presets locally to the client (default: NORMAL_PLAYER)
|
|
#feature.DEFAULT_PRESET_IMPORT: Minimum role required to import built-in default presets (default: CREATIVE_PLAYER)
|
|
#feature.URL_RESOURCE: Minimum role required to use URL-based skin loading (default: CREATIVE_PLAYER)
|
|
#Sat Jun 06 23:34:43 UTC 2026
|
|
blockUnsafeNpcCommands=true
|
|
creativePlayerCommandLevel=MODERATORS
|
|
executeAsUserCommandAllowList.ADMINS=
|
|
executeAsUserCommandAllowList.ALL=bns
|
|
executeAsUserCommandAllowList.GAMEMASTERS=
|
|
executeAsUserCommandAllowList.MODERATORS=
|
|
executeAsUserCommandAllowList.OWNERS=
|
|
feature.BASE_ATTRIBUTE=CREATIVE_PLAYER
|
|
feature.COMBAT_ATTRIBUTE=CREATIVE_PLAYER
|
|
feature.COMMAND_ACTION=CREATIVE_PLAYER
|
|
feature.CUSTOM_PRESET=CREATIVE_PLAYER
|
|
feature.DEFAULT_PRESET_IMPORT=CREATIVE_PLAYER
|
|
feature.DIALOG=NORMAL_PLAYER
|
|
feature.INTERACT_BLOCK_ACTION=CREATIVE_PLAYER
|
|
feature.LOCAL_PRESET=NORMAL_PLAYER
|
|
feature.MOVEMENT=CREATIVE_PLAYER
|
|
feature.OBJECTIVE=CREATIVE_PLAYER
|
|
feature.OPEN_TRADING_ACTION=CREATIVE_PLAYER
|
|
feature.POSITION=CREATIVE_PLAYER
|
|
feature.SCOREBOARD_ACTION=CREATIVE_PLAYER
|
|
feature.SPAWN_NPC=CREATIVE_PLAYER
|
|
feature.TRADING=CREATIVE_PLAYER
|
|
feature.URL_RESOURCE=CREATIVE_PLAYER
|
|
feature.WORLD_PRESET=CREATIVE_PLAYER
|
|
maxAdminImportedCommandLevel=ADMINS
|
|
normalPlayerCommandLevel=ALL
|
|
npcSpawnRateLimitAdmin=20
|
|
npcSpawnRateLimitCreative=5
|
|
serverTrustedCommandLevel=ADMINS
|
|
unsafeNpcCommands=ban,ban-ip,banlist,debug,deop,difficulty,forceload,function,gamerule,kick,op,pardon,reload,save-all,save-off,save-on,schedule,setidletimeout,setworldspawn,spawnpoint,spreadplayers,stop,whitelist
|