Better Enchant Commands

Better Enchant Commands 1.1.0

A hardening + polish release. Every existing command still works the same way for valid input — this release is about making bad input safer and bulk operations more transparent.

Security

• Preset-name validation. /enchantpreset save <name> and /enchantpreset delete <name> now require 1–64 characters of A–Z, a–z, 0–9, _, or -. Previously any non-whitespace token was accepted, which made unbounded disk growth and log-injection via crafted names possible.
• Preset-level clamping on disk load. Preset entries read from the config file are now validated against MIN_LEVEL..MAX_LEVEL (1..255). A hand-edited or corrupted config can no longer push an out-of-range level into item NBT.
• Log-injection hardening. AuditLogger strips ASCII control characters (newlines, tabs, ANSI escapes) from operator names, target names, labels, and config values before they reach SLF4J {} placeholders. Crafted scoreboard names can no longer forge or break lines in the audit log.

Correctness

• Modded enchantment IDs with colons. EnchantmentParser now splits on the last : in a token, so IDs like mymod:some:path:10 parse correctly as namespace + path + level instead of being rejected with a confusing "too many parts" error.
• /enchantpreset apply empty-hand reporting. Previously, players in the selector with an empty main hand were silently skipped. They're now listed in the failure output, matching the pattern already used by /enchant and /unenchant.
• Build fix. A pre-existing compile error (IllegalArgumentException | CommandSyntaxException | RuntimeException multi-catch, which is invalid because IllegalArgumentException extends RuntimeException) is resolved, and two createItemStack call sites that newly throw CommandSyntaxException are properly handled.

Performance

• Cached /repair lookups. The reflective mending and unbreaking holder lookups in /repair are cached per enchantment registry, so they only run once per server session instead of on every command invocation.

Added

• ConfirmationManager.storeWithReplacement — an API variant callers can use to notify the operator when a prior pending confirmation is displaced. Not wired into any user-facing command yet, but available for downstream callers.

Unchanged

• Command surface, permission gates (op level 2), tab-completion behaviour, undo semantics, and preset JSON format are identical to 1.0.0.
• Compiled against 1.21 base, still compatible across all 1.21.x versions.