NovaSync

NovaSync 2.17.145 — Mojang-route resilience + Bedrock skin path fixes

Patch series 2.17.134 → 2.17.145 shipped in one day after a Hyperlayer SA → Mojang routing degradation broke player joins. End-to-end hardening of every outbound Mojang/Microsoft/Geyser endpoint NovaSync depends on.

MojangRetryProxy (compat shim)

• Multi-host coverage now wraps every flaky Mojang/Microsoft/Geyser endpoint that affects auth, secure-profile, Bedrock discovery, OpenID issuer, profile lookup, and skin textures: api.minecraftservices.com, *.minecraft-services.net, sessionserver.mojang.com, api.mojang.com, textures.minecraft.net, api.geysermc.org.
• Per-host wildcard matching (*.minecraft-services.net) covers the full Cloudburst discovery → issuer → jwks → token chain.
• Handshake-retry: setSoTimeout(handshakeMs) before startHandshake() plus a 6-attempt retry loop sharing the same budget as read-retries. JDK-clean way to interrupt a stuck TLS handshake (replaces the prior watchdog-thread approach that raced on the inner-socket field).
• Install hook moved from onEnable to onLoad so the shim is the JVM-wide default SSLSocketFactory before authlib's YggdrasilServicesKeyInfo class init runs its first publickeys fetch (~5s after ServerMain).
• JVM-wide sun.net.client.defaultConnectTimeout=8000 + defaultReadTimeout=10000 + http.keepAlive=false set at install (when not already operator-configured).
• SEVERE log on install failure so admins see when the shim is INACTIVE.

MojangPublicKeysCache (new)

• Disk-cache for /publickeys at plugins/NovaSyncPlugin/cache/mojang-publickeys.json. One successful fetch buys months of resilience (keys rotate rarely).
• On retry exhaustion, splices a synthesized HTTP/1.1 200 OK response (SequenceInputStream of headers + body) into RetryingSSLSocket.getInputStream() so the application-layer HTTP parser inside authlib's MinecraftClient reads cached bytes seamlessly.
• Atomic CacheEntry record so body + timestamp can never tear under concurrent reads.
• Strict JSON shape validation before save (requires {...}/[...] wrapping + publicKey/BEGIN substring + Content-Length-delimited body) — prevents a truncated upstream response from poisoning the cache for 90 days.
• Async file I/O dispatched to a daemon executor so saves don't block the auth hot-path.
• Early cache fallback once two upstream retries have failed AND the cache is warm — keeps total elapsed under Paper's ~30 s login window.
• Boot-time warmAsync() pre-fetches the cache in the background.

ConfigMigrator (Geyser auto-patch)

• New idempotent patch for bedrock.cooldown-type: disabled. Geyser's cooldown indicator renders via a translatable component (geyser.opt.cooldown.*); when the Bedrock locale-asset cache fails to load on a degraded route, the Bedrock client cannot resolve the key and renders the raw geyser.opt.cooldown:non literal as floating HUD text on every hotbar-slot change. Disabling the indicator avoids the broken-translation render.

BedrockSkinFix

• is_steve boolean parsing fixed (was using the string-only extractJsonString helper, which always returned a substring of the next quoted field; the equality check never matched). New extractJsonBoolean is whitespace-tolerant and word-boundary terminated.
• Stop overriding Floodgate's textures URL when is_steve=true. Geyser's is_steve flag reflects the player's Xbox Live persona skin, not their currently-active local Bedrock skin (Marketplace/custom). Floodgate has already uploaded the correct visual; preserve its URL.

Cross-vendor review

Findings consolidated from DeepSeek V4-Pro + Gemini 3.1-Pro (via OpenRouter) + java-plugin-specialist agent throughout the patch series.

Tested live on Hyperlayer SA (Paper 1.21.11, Java 21, Geyser-Spigot 2.10.0, Floodgate 2.2.5).