CombatGunSSS

[2.3.0] - 2026-07-18

Fixed

🔴 CustomItemManager — Ammo/component items craftable into real vanilla resources without a resource pack (Critical / Economy exploit)

• Root cause: Ammo and component items are built on top of vanilla Materials purely so a resource pack has something to visually re-skin — e.g. ar_ammo = Material.GOLD_NUGGET, smg_ammo (and the fallback case) = Material.IRON_NUGGET, sg_ammo = Material.CLAY_BALL, and ingot-type components = Material.IRON_INGOT. Without a resource pack installed, players see these exactly as plain vanilla nuggets/ingots — and worse, they are those vanilla materials underneath the custom name/lore/model data. The vanilla crafting grid recognised 9 ar_ammo items as 9 real GOLD_NUGGETs and happily crafted them into a real GOLD_INGOT (same for smg_ammo → iron ingot, and sg_ammo → brick via furnace smelting), letting players convert unlimited free ammo into real vanilla resources.
• Fix 1: Added CustomItemManager.isCustomItem(ItemStack) — a generic check for our custom_item_type PDC tag, true for any ammo/component/station item regardless of which vanilla Material it's built on.
• Fix 2: CraftingListener.onPrepareCraft() now blocks the vanilla crafting-table result (craftingInventory.setResult(null)) whenever the 3×3/2×2 grid contains any of our tagged items and the grid doesn't match one of our own recognised workbench recipes.
• Fix 3: New CraftingListener.onFurnaceSmelt() handler cancels FurnaceSmeltEvent (covers furnace, blast furnace, and smoker) whenever the item being smelted carries our custom tag — closing the same hole for materials with a vanilla smelting recipe (e.g. clay ball → brick).

🔴 GunListener.onMeleeAttack() — Melee weapons play the hit sound but deal no damage and don't affect the target (Critical)

• Root cause: onMeleeAttack() cancelled the original swing's EntityDamageByEntityEvent and then called target.damage(gun.getDamage(), player) to apply custom damage manually. That call fires its own fresh EntityDamageByEntityEvent with the same damager (the attacking player) and the same ENTITY_ATTACK cause — which re-enters onMeleeAttack() a second time, synchronously, before the outer call returns. On this inner call, ammoManager.tryMeleeAttack() always failed (the cooldown had just been consumed a few lines above in the outer call), so the inner call cancelled its event — which was the event actually carrying the damage. The outer call then continued on to play the hit sound and particles regardless, producing the exact symptom reported: audible hit, zero damage, target completely unaffected. This affected melee weapons only (ranged hitscan damage isn't triggered from a listened EntityDamageByEntityEvent, so it can't recurse the same way).
• Fix: Added a meleeInProgress reentrancy guard (Set<UUID>). The player's UUID is added immediately before calling target.damage(...) and removed in a finally block right after. If onMeleeAttack() re-enters for the same player while their UUID is already in the set, it now returns immediately without touching event.setCancelled() — letting the synthetic inner event proceed uncancelled so the damage actually applies.

---