Update plugin fabric-loom to v1.17.10

Reviewed-on: #6

.gitea/workflows/dev-verify.yml

@@ -12,18 +12,26 @@ on:
 jobs:
   verify:
     runs-on: ubuntu-latest
+    container:
+      image: gradle:8.14.5-jdk21
+    env:
+      GITEA_TOKEN: ${{ github.token }}
+      GITEA_API_URL: ${{ github.server_url }}/api/v1
+      GITEA_REPO: ${{ github.repository }}
+      GITEA_REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
     steps:
-      - name: Check out
-        uses: actions/checkout@v4
+      - name: Prepare source
+        shell: bash
+        run: |
+          set -euo pipefail
 
-      - name: Set up Java
-        uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: 21
+          if [ ! -f build.gradle ]; then
+            git -c http.extraHeader="Authorization: token ${GITEA_TOKEN}" \
+              clone --depth 1 "${GITEA_REPO_URL}" .
+          fi
 
       - name: Verify
         shell: bash
         run: |
           set -euo pipefail
-          bash ./gradlew --no-daemon compileClientJava
+          gradle --no-daemon compileClientJava

.gitea/workflows/main-release.yml

@@ -1,4 +1,4 @@
-name: Main Release
+name: Build and Release
 
 on:
   push:
@@ -6,6 +6,7 @@ on:
       - main
     tags:
       - "v*"
+  pull_request:
   workflow_dispatch:
 
 permissions:
@@ -14,47 +15,151 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
+    container:
+      image: gradle:8.14.5-jdk21
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - minecraft_version: "1.21.1"
+            yarn_mappings: "1.21.1+build.3"
+            fabric_version: "0.116.10+1.21.1"
+          - minecraft_version: "1.21.2"
+            yarn_mappings: "1.21.2+build.1"
+            fabric_version: "0.106.1+1.21.2"
+          - minecraft_version: "1.21.3"
+            yarn_mappings: "1.21.3+build.2"
+            fabric_version: "0.114.1+1.21.3"
+          - minecraft_version: "1.21.4"
+            yarn_mappings: "1.21.4+build.8"
+            fabric_version: "0.119.4+1.21.4"
+          - minecraft_version: "1.21.5"
+            yarn_mappings: "1.21.5+build.1"
+            fabric_version: "0.128.2+1.21.5"
+          - minecraft_version: "1.21.6"
+            yarn_mappings: "1.21.6+build.1"
+            fabric_version: "0.128.2+1.21.6"
+          - minecraft_version: "1.21.7"
+            yarn_mappings: "1.21.7+build.8"
+            fabric_version: "0.129.0+1.21.7"
+          - minecraft_version: "1.21.8"
+            yarn_mappings: "1.21.8+build.1"
+            fabric_version: "0.136.1+1.21.8"
+          - minecraft_version: "1.21.9"
+            yarn_mappings: "1.21.9+build.1"
+            fabric_version: "0.134.1+1.21.9"
+          - minecraft_version: "1.21.10"
+            yarn_mappings: "1.21.10+build.3"
+            fabric_version: "0.138.4+1.21.10"
+          - minecraft_version: "1.21.11"
+            yarn_mappings: "1.21.11+build.4"
+            fabric_version: "0.141.3+1.21.11"
+    env:
+      GITEA_TOKEN: ${{ github.token }}
+      GITEA_API_URL: ${{ github.server_url }}/api/v1
+      GITEA_REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
     steps:
-      - name: Check out
-        uses: actions/checkout@v4
+      - name: Prepare source
+        shell: bash
+        run: |
+          set -euo pipefail
 
-      - name: Set up Java
-        uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: 21
+          if [ ! -f build.gradle ]; then
+            git -c http.extraHeader="Authorization: token ${GITEA_TOKEN}" \
+              clone --depth 1 "${GITEA_REPO_URL}" .
+          fi
 
       - name: Build
         shell: bash
         run: |
           set -euo pipefail
-          bash ./gradlew --no-daemon build
+
+          echo "Building Minecraft ${{ matrix.minecraft_version }}"
+          gradle --no-daemon clean build \
+            -Pminecraft_version="${{ matrix.minecraft_version }}" \
+            -Pyarn_mappings="${{ matrix.yarn_mappings }}" \
+            -Pfabric_version="${{ matrix.fabric_version }}"
+
+          mkdir -p release-artifacts
+
+          jar_path=""
+          shopt -s nullglob
+          for candidate in build/libs/*.jar; do
+            case "$(basename "${candidate}")" in
+              *-sources.jar|*-dev.jar)
+                continue
+                ;;
+            esac
+
+            jar_path="${candidate}"
+            break
+          done
+
+          if [ -z "${jar_path}" ]; then
+            echo "No build jar found for Minecraft ${{ matrix.minecraft_version }}"
+            exit 1
+          fi
+
+          cp "${jar_path}" "release-artifacts/sign-leak-shield-${{ matrix.minecraft_version }}.jar"
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: sign-leak-shield-${{ matrix.minecraft_version }}
+          path: release-artifacts/sign-leak-shield-${{ matrix.minecraft_version }}.jar
+          if-no-files-found: error
+          retention-days: 7
+
+  publish:
+    needs: build
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    container:
+      image: gradle:8.14.5-jdk21
+    env:
+      GITEA_TOKEN: ${{ github.token }}
+      GITEA_API_URL: ${{ github.server_url }}/api/v1
+      GITEA_REPO: ${{ github.repository }}
+      GITEA_REF_NAME: ${{ github.ref_name }}
+      GITEA_SHA: ${{ github.sha }}
+    steps:
+      - name: Download build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: versioned-jars
+          pattern: sign-leak-shield-*
+          merge-multiple: true
 
       - name: Publish Gitea release
-        if: github.event_name != 'pull_request'
         shell: bash
         run: |
           set -euo pipefail
 
-          jar_path="$(ls -1 build/libs/*.jar | head -n 1)"
-          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
-            release_tag="${GITHUB_REF_NAME}"
-            release_name="${GITHUB_REF_NAME}"
-            prerelease=false
-          else
-            release_tag="build-${GITHUB_SHA:0:7}"
-            release_name="build-${GITHUB_SHA:0:7}"
-            prerelease=true
+          shopt -s nullglob
+          jar_paths=(versioned-jars/*.jar)
+          if [ "${#jar_paths[@]}" -eq 0 ]; then
+            echo "No build artifacts were downloaded"
+            exit 1
           fi
 
-          release_payload="$(printf '{"tag_name":"%s","name":"%s","body":"Automated build for %s.","draft":false,"prerelease":%s}' \
-            "${release_tag}" "${release_name}" "${release_name}" "${prerelease}")"
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            release_tag="${GITEA_REF_NAME}"
+            release_name="${GITEA_REF_NAME}"
+            prerelease=false
+          else
+            release_tag="build-${GITEA_SHA:0:7}"
+            release_name="build-${GITEA_SHA:0:7}"
+            prerelease=false
+          fi
+
+          release_payload="$(printf '{"tag_name":"%s","name":"%s","body":"Automated parallel build for Minecraft 1.21.1 through 1.21.11.","draft":false,"prerelease":%s}' \
+            "${release_tag}" "${release_name}" "${prerelease}")"
 
           release_json="$(curl -fsS \
-            -H "Authorization: token ${GITHUB_TOKEN}" \
+            -H "Authorization: token ${GITEA_TOKEN}" \
             -H "Content-Type: application/json" \
             -d "${release_payload}" \
-            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases")"
+            "${GITEA_API_URL}/repos/${GITEA_REPO}/releases")"
 
           release_id="$(printf '%s' "${release_json}" | sed -n 's/.*"id":[[:space:]]*\([0-9][0-9]*\).*/\1/p' | head -n 1)"
           if [ -z "${release_id}" ]; then
@@ -63,16 +168,10 @@ jobs:
             exit 1
           fi
 
-          if [[ "${GITHUB_SERVER_URL}" == "https://github.com" ]]; then
+          for jar_path in "${jar_paths[@]}"; do
             curl -fsS \
-              -H "Authorization: token ${GITHUB_TOKEN}" \
-              -H "Content-Type: application/octet-stream" \
-              --data-binary @"${jar_path}" \
-              "https://uploads.github.com/repos/${GITHUB_REPOSITORY}/releases/${release_id}/assets?name=$(basename "${jar_path}")"
-          else
-            curl -fsS \
-              -H "Authorization: token ${GITHUB_TOKEN}" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
               -H "Content-Type: multipart/form-data" \
               -F "attachment=@${jar_path}" \
-              "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/${release_id}/assets?name=$(basename "${jar_path}")"
-          fi
+              "${GITEA_API_URL}/repos/${GITEA_REPO}/releases/${release_id}/assets?name=$(basename "${jar_path}")"
+          done

.github/workflows/dev-verify.yml

@@ -1,29 +0,0 @@
-name: Dev Verify
-
-on:
-  push:
-    branches:
-      - dev
-  pull_request:
-    branches:
-      - dev
-  workflow_dispatch:
-
-jobs:
-  verify:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out
-        uses: actions/checkout@v4
-
-      - name: Set up Java
-        uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: 21
-
-      - name: Verify
-        shell: bash
-        run: |
-          set -euo pipefail
-          bash ./gradlew --no-daemon compileClientJava

.github/workflows/main-release.yml

@@ -1,78 +0,0 @@
-name: Main Release
-
-on:
-  push:
-    branches:
-      - main
-    tags:
-      - "v*"
-  workflow_dispatch:
-
-permissions:
-  contents: write
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out
-        uses: actions/checkout@v4
-
-      - name: Set up Java
-        uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: 21
-
-      - name: Build
-        shell: bash
-        run: |
-          set -euo pipefail
-          bash ./gradlew --no-daemon build
-
-      - name: Publish release
-        if: github.event_name != 'pull_request'
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          jar_path="$(ls -1 build/libs/*.jar | head -n 1)"
-          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
-            release_tag="${GITHUB_REF_NAME}"
-            release_name="${GITHUB_REF_NAME}"
-            prerelease=false
-          else
-            release_tag="build-${GITHUB_SHA:0:7}"
-            release_name="build-${GITHUB_SHA:0:7}"
-            prerelease=true
-          fi
-
-          release_payload="$(printf '{"tag_name":"%s","name":"%s","body":"Automated build for %s.","draft":false,"prerelease":%s}' \
-            "${release_tag}" "${release_name}" "${release_name}" "${prerelease}")"
-
-          release_json="$(curl -fsS \
-            -H "Authorization: token ${GITHUB_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "${release_payload}" \
-            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases")"
-
-          release_id="$(printf '%s' "${release_json}" | sed -n 's/.*"id":[[:space:]]*\([0-9][0-9]*\).*/\1/p' | head -n 1)"
-          if [ -z "${release_id}" ]; then
-            echo "Failed to parse release ID from response:"
-            printf '%s\n' "${release_json}"
-            exit 1
-          fi
-
-          if [[ "${GITHUB_SERVER_URL}" == "https://github.com" ]]; then
-            curl -fsS \
-              -H "Authorization: token ${GITHUB_TOKEN}" \
-              -H "Content-Type: application/octet-stream" \
-              --data-binary @"${jar_path}" \
-              "https://uploads.github.com/repos/${GITHUB_REPOSITORY}/releases/${release_id}/assets?name=$(basename "${jar_path}")"
-          else
-            curl -fsS \
-              -H "Authorization: token ${GITHUB_TOKEN}" \
-              -H "Content-Type: multipart/form-data" \
-              -F "attachment=@${jar_path}" \
-              "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/${release_id}/assets?name=$(basename "${jar_path}")"
-          fi

.gitignore

@@ -1,31 +1,31 @@
-# ---> Java
-# Compiled class file
-*.class
-
-# Log file
-*.log
-
-# BlueJ files
-*.ctxt
-
-# Mobile Tools for Java (J2ME)
-.mtj.tmp/
-
-# Package Files #
-*.jar
-*.war
-*.nar
-*.ear
-*.zip
-*.tar.gz
-*.rar
-
-# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
-hs_err_pid*
-replay_pid*
-
-.gradle/*
-.gradle/
-build/*
-build/
-
+# ---> Java
+# Compiled class file
+*.class
+
+# Log file
+*.log
+
+# BlueJ files
+*.ctxt
+
+# Mobile Tools for Java (J2ME)
+.mtj.tmp/
+
+# Package Files #
+*.jar
+*.war
+*.nar
+*.ear
+*.zip
+*.tar.gz
+*.rar
+
+# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
+hs_err_pid*
+replay_pid*
+
+.gradle/*
+.gradle/
+build/*
+build/
+

README.md

@@ -4,12 +4,13 @@
 >
 > This mod was built with the help of AI.
 
-![Main Release](https://dock-it.dev/OnniSystems/ModBlockBypass/actions/workflows/main-release.yml/badge.svg?branch=main)
-![Dev Verify](https://dock-it.dev/OnniSystems/ModBlockBypass/actions/workflows/dev-verify.yml/badge.svg?branch=dev)
+![Main Release](https://dock-it.dev/OnniSystems/SignShield/actions/workflows/main-release.yml/badge.svg?branch=main)
 
-This is a Fabric client mod for Minecraft 1.21.1 that defensively patches forced sign-editor translation and keybind leak probes.
+![Dev Verify](https://dock-it.dev/OnniSystems/SignShield/actions/workflows/dev-verify.yml/badge.svg?branch=dev)
 
-Bypass's Anti Mod systems on Donut SMP and otehr like it.
+This is a Fabric client mod for Minecraft 1.21.11 that defensively patches forced sign-editor translation and keybind leak probes.
+
+Bypass's Anti Mod systems on Donut SMP and others like it.
 
 Build:
 
@@ -20,5 +21,5 @@ Build:
 
 Notes:
 
-- The project targets Fabric for Minecraft 1.21.1.
+- The project targets Fabric for Minecraft 1.21.11.
 - The implementation is scoped to forced sign editor traffic and only rewrites matching outgoing sign update packets.

build.gradle

@@ -6,6 +6,7 @@ plugins {
 version = project.mod_version
 group = project.maven_group
 def modVersion = project.version.toString()
+def minecraftVersion = project.minecraft_version.toString()
 
 base {
     archivesName = project.archives_base_name
@@ -40,9 +41,13 @@ dependencies {
 
 processResources {
     inputs.property "version", modVersion
+    inputs.property "minecraft_version", minecraftVersion
 
     filesMatching("fabric.mod.json") {
-        expand "version": modVersion
+        expand([
+                "version": modVersion,
+                "minecraft_version": minecraftVersion
+        ])
     }
 }
 

gradle.properties

@@ -2,14 +2,14 @@ org.gradle.jvmargs=-Xmx2G -Dfile.encoding=UTF-8
 org.gradle.parallel=true
 org.gradle.caching=true
 org.gradle.daemon=true
-org.gradle.configuration-cache=true
+org.gradle.configuration-cache=false
 
-minecraft_version=1.21.1
-yarn_mappings=1.21.1+build.3
+minecraft_version=1.21.11
+yarn_mappings=1.21.11+build.4
 loader_version=0.18.4
-loom_version=1.9.1
-fabric_version=0.116.8+1.21.1
+loom_version=1.17.10
+fabric_version=0.141.3+1.21.11
 
-mod_version=1.0.1
+mod_version=1.0.2
 maven_group=com.example
-archives_base_name=sign-leak-shield
+archives_base_name=sign-leak-shield

renovate.json

@@ -0,0 +1,3 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
+}

src/client/java/com/example/signleakshield/SignLeakShieldClient.java

@@ -1,16 +1,16 @@
-package com.example.signleakshield;
-
-import net.fabricmc.api.ClientModInitializer;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public final class SignLeakShieldClient implements ClientModInitializer {
-    public static final String MOD_ID = "signleakshield";
-    public static final Logger LOGGER = LoggerFactory.getLogger(MOD_ID);
-
-    @Override
-    public void onInitializeClient() {
-        SignLeakShieldTraceLog.reset();
-        SignLeakShieldTraceLog.info("Sign Leak Shield initialized");
-    }
-}
+package com.example.signleakshield;
+
+import net.fabricmc.api.ClientModInitializer;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public final class SignLeakShieldClient implements ClientModInitializer {
+    public static final String MOD_ID = "signleakshield";
+    public static final Logger LOGGER = LoggerFactory.getLogger(MOD_ID);
+
+    @Override
+    public void onInitializeClient() {
+        SignLeakShieldTraceLog.reset();
+        SignLeakShieldTraceLog.info("Sign Leak Shield initialized");
+    }
+}

src/client/java/com/example/signleakshield/SignLeakShieldTraceLog.java

@@ -1,58 +1,58 @@
-package com.example.signleakshield;
-
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.Paths;
-import java.nio.file.StandardOpenOption;
-import java.time.OffsetDateTime;
-import java.time.format.DateTimeFormatter;
-
-public final class SignLeakShieldTraceLog {
-    private static final Path LOG_PATH = Paths.get("logs", "signleakshield-trace.log");
-
-    private SignLeakShieldTraceLog() {
-    }
-
-    public static synchronized void reset() {
-        try {
-            Files.deleteIfExists(LOG_PATH);
-        } catch (IOException ignored) {
-        }
-    }
-
-    public static void info(String message) {
-        SignLeakShieldClient.LOGGER.info(message);
-        append(message);
-    }
-
-    public static void info(String format, Object... args) {
-        info(String.format(format, args));
-    }
-
-    private static synchronized void append(String message) {
-        try {
-            Path parent = LOG_PATH.getParent();
-            if (parent != null) {
-                Files.createDirectories(parent);
-            }
-
-            String line = String.format(
-                "%s %s%n",
-                DateTimeFormatter.ISO_OFFSET_DATE_TIME.format(OffsetDateTime.now()),
-                message
-            );
-
-            Files.writeString(
-                LOG_PATH,
-                line,
-                StandardCharsets.UTF_8,
-                StandardOpenOption.CREATE,
-                StandardOpenOption.APPEND,
-                StandardOpenOption.WRITE
-            );
-        } catch (IOException ignored) {
-        }
-    }
-}
+package com.example.signleakshield;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.nio.file.StandardOpenOption;
+import java.time.OffsetDateTime;
+import java.time.format.DateTimeFormatter;
+
+public final class SignLeakShieldTraceLog {
+    private static final Path LOG_PATH = Paths.get("logs", "signleakshield-trace.log");
+
+    private SignLeakShieldTraceLog() {
+    }
+
+    public static synchronized void reset() {
+        try {
+            Files.deleteIfExists(LOG_PATH);
+        } catch (IOException ignored) {
+        }
+    }
+
+    public static void info(String message) {
+        SignLeakShieldClient.LOGGER.info(message);
+        append(message);
+    }
+
+    public static void info(String format, Object... args) {
+        info(String.format(format, args));
+    }
+
+    private static synchronized void append(String message) {
+        try {
+            Path parent = LOG_PATH.getParent();
+            if (parent != null) {
+                Files.createDirectories(parent);
+            }
+
+            String line = String.format(
+                "%s %s%n",
+                DateTimeFormatter.ISO_OFFSET_DATE_TIME.format(OffsetDateTime.now()),
+                message
+            );
+
+            Files.writeString(
+                LOG_PATH,
+                line,
+                StandardCharsets.UTF_8,
+                StandardOpenOption.CREATE,
+                StandardOpenOption.APPEND,
+                StandardOpenOption.WRITE
+            );
+        } catch (IOException ignored) {
+        }
+    }
+}

src/client/java/com/example/signleakshield/TextSanitizer.java

@@ -1,72 +1,86 @@
-package com.example.signleakshield;
-
-import net.minecraft.text.KeybindTextContent;
-import net.minecraft.text.PlainTextContent;
-import net.minecraft.text.Text;
-import net.minecraft.text.TextContent;
-import net.minecraft.text.TranslatableTextContent;
-
+package com.example.signleakshield;
+
+import net.minecraft.text.KeybindTextContent;
+import net.minecraft.text.PlainTextContent;
+import net.minecraft.text.Text;
+import net.minecraft.text.TextContent;
+import net.minecraft.text.TranslatableTextContent;
+
 public final class TextSanitizer {
-    private static final String[] BLACKLISTED_KEY_PARTS = {
+    private static final String[] SUSPICIOUS_KEY_PARTS = {
         "gey.glazed.",
+        "key.meteor-client.",
+        "meteor-client",
         "meteorline",
         "meteorclient",
         "metiorclient",
+        "meteordevelopment.meteorclient",
         "itemscroller",
         "moremousetweaks",
         "invmove",
-        "autototem",
-        "smartoffhand",
-        "freecam",
-        "jsmacros",
-        "inventoryprofiles",
-        "tweakeroo",
-        "soundboard",
-        "accurateblockplacement"
-    };
-
-    private TextSanitizer() {
-    }
-
+        "autototem",
+        "smartoffhand",
+        "freecam",
+        "jsmacros",
+        "inventoryprofiles",
+        "tweakeroo",
+        "soundboard",
+        "accurateblockplacement"
+    };
+
+    private TextSanitizer() {
+    }
+
     public static boolean isSuspicious(Text text) {
         if (text == null) {
             return false;
         }
-
+
         TextContent content = text.getContent();
 
         if (content instanceof TranslatableTextContent translatable) {
-            return isBlacklistedKey(translatable.getKey());
+            if (isBlacklistedKey(translatable.getKey())) {
+                return true;
+            }
+
+            for (Object arg : translatable.getArgs()) {
+                if (isSuspiciousArgument(arg)) {
+                    return true;
+                }
+            }
+
+            return false;
         }
 
         if (content instanceof KeybindTextContent keybind) {
-            return isBlacklistedKey(keybind.getKey());
+            String key = keybind.getKey();
+            return key != null && !VanillaKeybinds.isVanillaKey(key);
         }
-
-        for (Text sibling : text.getSiblings()) {
-            if (isSuspicious(sibling)) {
-                return true;
-            }
-        }
-
-        return false;
-    }
-
-    public static String sanitize(Text text) {
-        StringBuilder out = new StringBuilder();
-        append(text, out);
-        return out.toString();
-    }
-
-    private static void append(Text text, StringBuilder out) {
-        if (text == null) {
-            return;
-        }
-
-        TextContent content = text.getContent();
-
-        if (content instanceof PlainTextContent plain) {
-            out.append(plain.string());
+
+        for (Text sibling : text.getSiblings()) {
+            if (isSuspicious(sibling)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    public static String sanitize(Text text) {
+        StringBuilder out = new StringBuilder();
+        append(text, out);
+        return out.toString();
+    }
+
+    private static void append(Text text, StringBuilder out) {
+        if (text == null) {
+            return;
+        }
+
+        TextContent content = text.getContent();
+
+        if (content instanceof PlainTextContent plain) {
+            out.append(plain.string());
         } else if (content instanceof TranslatableTextContent translatable) {
             String fallback = translatable.getFallback();
             if (fallback != null && !fallback.isEmpty()) {
@@ -75,23 +89,24 @@ public final class TextSanitizer {
                 out.append(translatable.getKey());
             }
         } else if (content instanceof KeybindTextContent keybind) {
-            out.append(text.getString());
+            String key = keybind.getKey();
+            out.append(key != null ? key : "");
         } else {
             out.append(text.getString());
         }
-
-        for (Text sibling : text.getSiblings()) {
-            append(sibling, out);
-        }
-    }
-
+
+        for (Text sibling : text.getSiblings()) {
+            append(sibling, out);
+        }
+    }
+
     private static boolean isBlacklistedKey(String key) {
         if (key == null || key.isEmpty()) {
             return false;
         }
 
         String lower = key.toLowerCase();
-        for (String part : BLACKLISTED_KEY_PARTS) {
+        for (String part : SUSPICIOUS_KEY_PARTS) {
             if (lower.contains(part)) {
                 return true;
             }
@@ -99,4 +114,36 @@ public final class TextSanitizer {
 
         return false;
     }
+
+    private static boolean isSuspiciousArgument(Object arg) {
+        if (arg == null) {
+            return false;
+        }
+
+        if (arg instanceof Text text) {
+            return isSuspicious(text);
+        }
+
+        if (arg instanceof KeybindTextContent keybind) {
+            return !VanillaKeybinds.isVanillaKey(keybind.getKey());
+        }
+
+        if (arg instanceof TranslatableTextContent translatable) {
+            if (isBlacklistedKey(translatable.getKey())) {
+                return true;
+            }
+
+            for (Object nested : translatable.getArgs()) {
+                if (isSuspiciousArgument(nested)) {
+                    return true;
+                }
+            }
+        }
+
+        if (arg instanceof CharSequence sequence) {
+            return isBlacklistedKey(sequence.toString());
+        }
+
+        return false;
+    }
 }

src/client/java/com/example/signleakshield/VanillaKeybinds.java

@@ -0,0 +1,81 @@
+package com.example.signleakshield;
+
+import net.minecraft.client.MinecraftClient;
+import net.minecraft.client.option.GameOptions;
+import net.minecraft.client.option.KeyBinding;
+
+import java.lang.reflect.Field;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+
+public final class VanillaKeybinds {
+    private static volatile Set<String> vanillaKeys;
+
+    private VanillaKeybinds() {
+    }
+
+    public static boolean isVanillaKey(String key) {
+        if (key == null || key.isEmpty()) {
+            return false;
+        }
+
+        Set<String> keys = vanillaKeys;
+        if (keys == null) {
+            keys = loadVanillaKeys();
+            if (keys != null) {
+                vanillaKeys = keys;
+            }
+        }
+
+        return keys != null && keys.contains(key);
+    }
+
+    private static Set<String> loadVanillaKeys() {
+        MinecraftClient client = MinecraftClient.getInstance();
+        if (client == null || client.options == null) {
+            return null;
+        }
+
+        Set<String> keys = new HashSet<>();
+
+        for (Field field : GameOptions.class.getDeclaredFields()) {
+            Class<?> type = field.getType();
+            if (!KeyBinding.class.isAssignableFrom(type) && !KeyBinding[].class.isAssignableFrom(type)) {
+                continue;
+            }
+
+            try {
+                field.setAccessible(true);
+                Object value = field.get(client.options);
+                collectKeyBindings(keys, value);
+            } catch (IllegalAccessException | RuntimeException ignored) {
+            }
+        }
+
+        return Collections.unmodifiableSet(keys);
+    }
+
+    private static void collectKeyBindings(Set<String> keys, Object value) {
+        if (value instanceof KeyBinding keyBinding) {
+            String translationKey = keyBinding.getTranslationKey();
+            if (translationKey != null && !translationKey.isEmpty()) {
+                keys.add(translationKey);
+            }
+            return;
+        }
+
+        if (value instanceof KeyBinding[] keyBindings) {
+            for (KeyBinding keyBinding : keyBindings) {
+                if (keyBinding == null) {
+                    continue;
+                }
+
+                String translationKey = keyBinding.getTranslationKey();
+                if (translationKey != null && !translationKey.isEmpty()) {
+                    keys.add(translationKey);
+                }
+            }
+        }
+    }
+}

src/client/java/com/example/signleakshield/mixin/ClientConnectionMixin.java

@@ -1,109 +1,121 @@
-package com.example.signleakshield.mixin;
-
-import com.example.signleakshield.ExploitState;
-import com.example.signleakshield.SignLeakShieldTraceLog;
-import com.example.signleakshield.TextSanitizer;
-import net.minecraft.network.ClientConnection;
-import net.minecraft.network.PacketCallbacks;
-import net.minecraft.network.packet.Packet;
-import net.minecraft.network.packet.c2s.play.UpdateSignC2SPacket;
-import net.minecraft.text.Text;
-import net.minecraft.util.math.BlockPos;
-import org.spongepowered.asm.mixin.Mixin;
-import org.spongepowered.asm.mixin.injection.At;
-import org.spongepowered.asm.mixin.injection.ModifyVariable;
-
-import java.util.Arrays;
-
-@Mixin(ClientConnection.class)
-public abstract class ClientConnectionMixin {
-    @ModifyVariable(method = "send(Lnet/minecraft/network/packet/Packet;)V", at = @At("HEAD"), argsOnly = true)
-    private Packet<?> signleakshield$rewriteOutgoing(Packet<?> packet) {
-        if (packet instanceof UpdateSignC2SPacket signPacket) {
-            ExploitState.ForcedOpenContext forcedOpen = ExploitState.pendingForcedOpen;
-            ExploitState.CapturedSignData captured = ExploitState.SIGNS.get(signPacket.getPos());
-            SignLeakShieldTraceLog.info(
-                "Outgoing sign packet observed: pos=%s front=%s forcedOpen=%s captured=%s packetText=%s",
-                signPacket.getPos(),
-                signPacket.isFront(),
-                forcedOpen == null ? "null" : forcedOpen.pos() + "/front=" + forcedOpen.front() + "/ageMs=" + (System.currentTimeMillis() - forcedOpen.timeMs()),
-                captured == null ? "null" : "suspicious=" + captured.isSuspicious(),
-                Arrays.toString(signPacket.getText())
-            );
-        }
-
-        if (!(packet instanceof UpdateSignC2SPacket signPacket)) {
-            return packet;
-        }
-
-        ExploitState.ForcedOpenContext forcedOpen = ExploitState.pendingForcedOpen;
-        if (forcedOpen == null) {
-            SignLeakShieldTraceLog.info(
-                "Outgoing sign packet not rewritten: no pending forced-open context for pos=%s front=%s",
-                signPacket.getPos(),
-                signPacket.isFront()
-            );
-            return packet;
-        }
-
-        BlockPos pos = signPacket.getPos();
-        if (!forcedOpen.pos().equals(pos)) {
-            SignLeakShieldTraceLog.info(
-                "Outgoing sign packet not rewritten: pos mismatch packet=%s forcedOpen=%s",
-                pos,
-                forcedOpen.pos()
-            );
-            return packet;
-        }
-
-        if (forcedOpen.front() != signPacket.isFront()) {
-            SignLeakShieldTraceLog.info(
-                "Outgoing sign packet not rewritten: front mismatch packet=%s forcedOpen=%s",
-                signPacket.isFront(),
-                forcedOpen.front()
-            );
-            return packet;
-        }
-
-        long ageMs = System.currentTimeMillis() - forcedOpen.timeMs();
-        if (ageMs < 0L || ageMs > 5000L) {
-            SignLeakShieldTraceLog.info(
-                "Outgoing sign packet not rewritten: forced-open age out of range pos=%s front=%s ageMs=%s",
-                pos,
-                signPacket.isFront(),
-                ageMs
-            );
-            return packet;
-        }
-
+package com.example.signleakshield.mixin;
+
+import com.example.signleakshield.ExploitState;
+import com.example.signleakshield.SignLeakShieldTraceLog;
+import com.example.signleakshield.TextSanitizer;
+import net.minecraft.network.ClientConnection;
+import net.minecraft.network.PacketCallbacks;
+import net.minecraft.network.packet.Packet;
+import net.minecraft.network.packet.c2s.play.UpdateSignC2SPacket;
+import net.minecraft.text.Text;
+import net.minecraft.util.math.BlockPos;
+import org.spongepowered.asm.mixin.Mixin;
+import org.spongepowered.asm.mixin.injection.At;
+import org.spongepowered.asm.mixin.injection.ModifyVariable;
+
+import java.util.Arrays;
+
+@Mixin(ClientConnection.class)
+public abstract class ClientConnectionMixin {
+    @ModifyVariable(method = "send(Lnet/minecraft/network/packet/Packet;)V", at = @At("HEAD"), argsOnly = true)
+    private Packet<?> signleakshield$rewriteOutgoing(Packet<?> packet) {
+        if (packet instanceof UpdateSignC2SPacket signPacket) {
+            ExploitState.ForcedOpenContext forcedOpen = ExploitState.pendingForcedOpen;
+            ExploitState.CapturedSignData captured = ExploitState.SIGNS.get(signPacket.getPos());
+            SignLeakShieldTraceLog.info(
+                "Outgoing sign packet observed: pos=%s front=%s forcedOpen=%s captured=%s packetText=%s",
+                signPacket.getPos(),
+                signPacket.isFront(),
+                forcedOpen == null ? "null" : forcedOpen.pos() + "/front=" + forcedOpen.front() + "/ageMs=" + (System.currentTimeMillis() - forcedOpen.timeMs()),
+                captured == null ? "null" : "suspicious=" + captured.isSuspicious(),
+                Arrays.toString(signPacket.getText())
+            );
+        }
+
+        if (!(packet instanceof UpdateSignC2SPacket signPacket)) {
+            return packet;
+        }
+
+        ExploitState.ForcedOpenContext forcedOpen = ExploitState.pendingForcedOpen;
+        if (forcedOpen == null) {
+            SignLeakShieldTraceLog.info(
+                "Outgoing sign packet not rewritten: no pending forced-open context for pos=%s front=%s",
+                signPacket.getPos(),
+                signPacket.isFront()
+            );
+            return packet;
+        }
+
+        BlockPos pos = signPacket.getPos();
+        if (!forcedOpen.pos().equals(pos)) {
+            SignLeakShieldTraceLog.info(
+                "Outgoing sign packet not rewritten: pos mismatch packet=%s forcedOpen=%s",
+                pos,
+                forcedOpen.pos()
+            );
+            return packet;
+        }
+
+        if (forcedOpen.front() != signPacket.isFront()) {
+            SignLeakShieldTraceLog.info(
+                "Outgoing sign packet not rewritten: front mismatch packet=%s forcedOpen=%s",
+                signPacket.isFront(),
+                forcedOpen.front()
+            );
+            return packet;
+        }
+
+        long ageMs = System.currentTimeMillis() - forcedOpen.timeMs();
+        if (ageMs < 0L || ageMs > 5000L) {
+            SignLeakShieldTraceLog.info(
+                "Outgoing sign packet not rewritten: forced-open age out of range pos=%s front=%s ageMs=%s",
+                pos,
+                signPacket.isFront(),
+                ageMs
+            );
+            return packet;
+        }
+
         ExploitState.CapturedSignData captured = ExploitState.SIGNS.get(pos);
         if (captured == null || !captured.isSuspicious()) {
             SignLeakShieldTraceLog.info(
                 "Outgoing sign packet allowed: captured sign missing or not blacklisted pos=%s front=%s capturedPresent=%s",
                 pos,
-                signPacket.isFront(),
-                captured != null
-            );
-            return packet;
+                signPacket.isFront(),
+                captured != null
+            );
+            return packet;
         }
 
         Text[] textLines;
         textLines = signPacket.isFront() ? captured.getFront() : captured.getBack();
+        String[] originalResponse = signPacket.getText();
 
         String line1 = TextSanitizer.sanitize(textLines[0]);
         String line2 = TextSanitizer.sanitize(textLines[1]);
         String line3 = TextSanitizer.sanitize(textLines[2]);
         String line4 = TextSanitizer.sanitize(textLines[3]);
+        String[] returnedResponse = new String[] { line1, line2, line3, line4 };
 
         SignLeakShieldTraceLog.info(
-            "Blocked forced sign translation event at %s front=%s: got=%s, returned=%s",
+            "Blocked forced sign translation event at %s front=%s: receivedSign=%s, unmodifiedResponse=%s, returned=%s",
             pos,
             signPacket.isFront(),
-            Arrays.toString(signPacket.getText()),
-            Arrays.toString(new String[] { line1, line2, line3, line4 })
+            describeTextLines(textLines),
+            Arrays.toString(originalResponse),
+            Arrays.toString(returnedResponse)
         );
 
         ExploitState.clearForcedOpen();
         return new UpdateSignC2SPacket(pos, signPacket.isFront(), line1, line2, line3, line4);
     }
+
+    private static String describeTextLines(Text[] lines) {
+        String[] values = new String[lines.length];
+        for (int i = 0; i < lines.length; i++) {
+            values[i] = lines[i] != null ? lines[i].getString() : "";
+        }
+
+        return Arrays.toString(values);
+    }
 }

src/client/java/com/example/signleakshield/mixin/ClientPlayNetworkHandlerBlockEntityUpdateMixin.java

@@ -1,30 +1,30 @@
-package com.example.signleakshield.mixin;
-
-import com.example.signleakshield.ExploitState;
-import com.example.signleakshield.SignLeakShieldTraceLog;
-import com.example.signleakshield.SignTextExtractor;
-import net.minecraft.block.entity.BlockEntityType;
-import net.minecraft.client.network.ClientPlayNetworkHandler;
-import net.minecraft.network.packet.s2c.play.BlockEntityUpdateS2CPacket;
-import net.minecraft.util.math.BlockPos;
-import org.spongepowered.asm.mixin.Mixin;
-import org.spongepowered.asm.mixin.injection.At;
-import org.spongepowered.asm.mixin.injection.Inject;
-import org.spongepowered.asm.mixin.injection.callback.CallbackInfo;
-
-@Mixin(ClientPlayNetworkHandler.class)
-public abstract class ClientPlayNetworkHandlerBlockEntityUpdateMixin {
-    @Inject(method = "onBlockEntityUpdate(Lnet/minecraft/network/packet/s2c/play/BlockEntityUpdateS2CPacket;)V", at = @At("HEAD"))
-    private void signleakshield$captureSign(BlockEntityUpdateS2CPacket packet, CallbackInfo ci) {
-        if (packet.getNbt() == null) {
-            return;
-        }
-
-        if (packet.getBlockEntityType() != BlockEntityType.SIGN && packet.getBlockEntityType() != BlockEntityType.HANGING_SIGN) {
-            return;
-        }
-
-        BlockPos pos = packet.getPos();
-        ExploitState.SIGNS.put(pos.toImmutable(), SignTextExtractor.fromNbt(packet.getNbt()));
-    }
-}
+package com.example.signleakshield.mixin;
+
+import com.example.signleakshield.ExploitState;
+import com.example.signleakshield.SignLeakShieldTraceLog;
+import com.example.signleakshield.SignTextExtractor;
+import net.minecraft.block.entity.BlockEntityType;
+import net.minecraft.client.network.ClientPlayNetworkHandler;
+import net.minecraft.network.packet.s2c.play.BlockEntityUpdateS2CPacket;
+import net.minecraft.util.math.BlockPos;
+import org.spongepowered.asm.mixin.Mixin;
+import org.spongepowered.asm.mixin.injection.At;
+import org.spongepowered.asm.mixin.injection.Inject;
+import org.spongepowered.asm.mixin.injection.callback.CallbackInfo;
+
+@Mixin(ClientPlayNetworkHandler.class)
+public abstract class ClientPlayNetworkHandlerBlockEntityUpdateMixin {
+    @Inject(method = "onBlockEntityUpdate(Lnet/minecraft/network/packet/s2c/play/BlockEntityUpdateS2CPacket;)V", at = @At("HEAD"))
+    private void signleakshield$captureSign(BlockEntityUpdateS2CPacket packet, CallbackInfo ci) {
+        if (packet.getNbt() == null) {
+            return;
+        }
+
+        if (packet.getBlockEntityType() != BlockEntityType.SIGN && packet.getBlockEntityType() != BlockEntityType.HANGING_SIGN) {
+            return;
+        }
+
+        BlockPos pos = packet.getPos();
+        ExploitState.SIGNS.put(pos.toImmutable(), SignTextExtractor.fromNbt(packet.getNbt()));
+    }
+}

src/client/java/com/example/signleakshield/mixin/ClientPlayNetworkHandlerChunkDataMixin.java

@@ -1,33 +1,33 @@
-package com.example.signleakshield.mixin;
-
-import com.example.signleakshield.ExploitState;
-import com.example.signleakshield.SignLeakShieldTraceLog;
-import com.example.signleakshield.SignTextExtractor;
-import net.minecraft.block.entity.BlockEntityType;
-import net.minecraft.client.network.ClientPlayNetworkHandler;
-import net.minecraft.network.packet.s2c.play.ChunkDataS2CPacket;
-import net.minecraft.nbt.NbtCompound;
-import net.minecraft.util.math.BlockPos;
-import org.spongepowered.asm.mixin.Mixin;
-import org.spongepowered.asm.mixin.injection.At;
-import org.spongepowered.asm.mixin.injection.Inject;
-import org.spongepowered.asm.mixin.injection.callback.CallbackInfo;
-
-@Mixin(ClientPlayNetworkHandler.class)
-public abstract class ClientPlayNetworkHandlerChunkDataMixin {
-    @Inject(method = "onChunkData(Lnet/minecraft/network/packet/s2c/play/ChunkDataS2CPacket;)V", at = @At("HEAD"))
-    private void signleakshield$captureChunkData(ChunkDataS2CPacket packet, CallbackInfo ci) {
-        packet.getChunkData().getBlockEntities(packet.getChunkX(), packet.getChunkZ()).accept((localPos, type, nbt) -> {
-            if (nbt == null) {
-                return;
-            }
-
-            if (type != BlockEntityType.SIGN && type != BlockEntityType.HANGING_SIGN) {
-                return;
-            }
-
-            BlockPos pos = localPos.toImmutable();
-            ExploitState.SIGNS.put(pos, SignTextExtractor.fromNbt((NbtCompound) nbt));
-        });
-    }
-}
+package com.example.signleakshield.mixin;
+
+import com.example.signleakshield.ExploitState;
+import com.example.signleakshield.SignLeakShieldTraceLog;
+import com.example.signleakshield.SignTextExtractor;
+import net.minecraft.block.entity.BlockEntityType;
+import net.minecraft.client.network.ClientPlayNetworkHandler;
+import net.minecraft.network.packet.s2c.play.ChunkDataS2CPacket;
+import net.minecraft.nbt.NbtCompound;
+import net.minecraft.util.math.BlockPos;
+import org.spongepowered.asm.mixin.Mixin;
+import org.spongepowered.asm.mixin.injection.At;
+import org.spongepowered.asm.mixin.injection.Inject;
+import org.spongepowered.asm.mixin.injection.callback.CallbackInfo;
+
+@Mixin(ClientPlayNetworkHandler.class)
+public abstract class ClientPlayNetworkHandlerChunkDataMixin {
+    @Inject(method = "onChunkData(Lnet/minecraft/network/packet/s2c/play/ChunkDataS2CPacket;)V", at = @At("HEAD"))
+    private void signleakshield$captureChunkData(ChunkDataS2CPacket packet, CallbackInfo ci) {
+        packet.getChunkData().getBlockEntities(packet.getChunkX(), packet.getChunkZ()).accept((localPos, type, nbt) -> {
+            if (nbt == null) {
+                return;
+            }
+
+            if (type != BlockEntityType.SIGN && type != BlockEntityType.HANGING_SIGN) {
+                return;
+            }
+
+            BlockPos pos = localPos.toImmutable();
+            ExploitState.SIGNS.put(pos, SignTextExtractor.fromNbt((NbtCompound) nbt));
+        });
+    }
+}

src/client/java/com/example/signleakshield/mixin/ClientPlayNetworkHandlerSignEditorOpenMixin.java

@@ -1,23 +1,23 @@
-package com.example.signleakshield.mixin;
-
-import com.example.signleakshield.ExploitState;
-import com.example.signleakshield.SignLeakShieldTraceLog;
-import net.minecraft.client.network.ClientPlayNetworkHandler;
-import net.minecraft.network.packet.s2c.play.SignEditorOpenS2CPacket;
-import org.spongepowered.asm.mixin.Mixin;
-import org.spongepowered.asm.mixin.injection.At;
-import org.spongepowered.asm.mixin.injection.Inject;
-import org.spongepowered.asm.mixin.injection.callback.CallbackInfo;
-
-@Mixin(ClientPlayNetworkHandler.class)
-public abstract class ClientPlayNetworkHandlerSignEditorOpenMixin {
-    @Inject(method = "onSignEditorOpen", at = @At("HEAD"))
-    private void signleakshield$rememberForcedOpen(SignEditorOpenS2CPacket packet, CallbackInfo ci) {
-        SignLeakShieldTraceLog.info(
-            "Sign editor open received: pos=%s front=%s",
-            packet.getPos(),
-            packet.isFront()
-        );
-        ExploitState.rememberForcedOpen(packet.getPos(), packet.isFront());
-    }
-}
+package com.example.signleakshield.mixin;
+
+import com.example.signleakshield.ExploitState;
+import com.example.signleakshield.SignLeakShieldTraceLog;
+import net.minecraft.client.network.ClientPlayNetworkHandler;
+import net.minecraft.network.packet.s2c.play.SignEditorOpenS2CPacket;
+import org.spongepowered.asm.mixin.Mixin;
+import org.spongepowered.asm.mixin.injection.At;
+import org.spongepowered.asm.mixin.injection.Inject;
+import org.spongepowered.asm.mixin.injection.callback.CallbackInfo;
+
+@Mixin(ClientPlayNetworkHandler.class)
+public abstract class ClientPlayNetworkHandlerSignEditorOpenMixin {
+    @Inject(method = "onSignEditorOpen", at = @At("HEAD"))
+    private void signleakshield$rememberForcedOpen(SignEditorOpenS2CPacket packet, CallbackInfo ci) {
+        SignLeakShieldTraceLog.info(
+            "Sign editor open received: pos=%s front=%s",
+            packet.getPos(),
+            packet.isFront()
+        );
+        ExploitState.rememberForcedOpen(packet.getPos(), packet.isFront());
+    }
+}

src/main/resources/fabric.mod.json

@@ -23,8 +23,8 @@
   ],
   "depends": {
     "fabricloader": ">=0.18.4",
-    "minecraft": "1.21.1",
+    "minecraft": "${minecraft_version}",
     "java": ">=21",
     "fabric-api": "*"
   }
-}
+}