Merge commit 'f22d1edc7824f9a8e8321b6d6784b236223a09fb' into HEAD

- A secret belongs to the first address that authenticates with it: an
  Authenticate copied and sent from another address is refused however long
  the client was quiet (the 5 s move rule is gone). Exact replays are dropped
  too: the last 64 control packets' nonces per player, and a 64-wide window
  on voice packets' sequence numbers.
- A client the server stops hearing for 10 keep-alives gets a fresh secret
  over the game connection (Complex Voice Chat 2.1.0 reconnects on any
  voicechat:secret), keeping its group; the old key then opens nothing. So
  a NAT that rebinds recovers without a rejoin (2.1.0 never re-sends
  Authenticate after its ack, so the old move rule never helped it).
- Secret requests: one answer a second a player (more requests meanwhile
  get one answer), the snapshot replaces what still waited. Group and state
  changes 2 a second (burst 10). At most 512 messages wait per player.
- Client pings aren't echoed (the server never pings; SVC's server doesn't
  echo either), and the relay thread never spins on a socket error.
- The glue lists the players on a message only when the sender is new, not
  on every voice chat message.
- native.py package puts native/<mod>/LICENSE into the .hnmod as
  mixins/<id>/LICENSE (Horizon's bundle reader accepts LICENSE* there); the
  CI check requires it. Every native mod's package now carries its licence.

Tests: a_replayed_handshake_after_a_silence_moves_nothing,
a_client_the_server_stops_hearing_gets_a_fresh_secret,
repeated_secret_requests_and_group_changes_stay_bounded.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.github/workflows/native-compat.yml

@@ -1,103 +0,0 @@
-# Native mods on the newest Nightly, as players' launchers build them (scripts/native_compat.py):
-# - on a pull request, each new native-mod version, applied together with the most downloaded native mods
-#   and compiled (`cargo check`); its support modules' names against every registry mod's;
-# - every day after the Nightly, every native mod's newest version, applied, then the rest compiled
-#   (`cargo check`): the ones horizon-mixins refuses alone and the ones whose own code doesn't compile go
-#   to the `native-health` release, which publish adds to the index (`broken_on`) so the launcher warns
-#   before an install.
-# The check compiles the submission, whose crates may have build scripts: it runs with a token that can
-# only read, and main's script, never the pull request's.
-name: native-compat
-on:
-  pull_request:
-    branches: [main]
-    paths: ["mods/*.toml"]
-  schedule:
-    - cron: "40 18 * * *"
-  workflow_dispatch:
-    inputs:
-      horizon:
-        description: "Horizon commit, or `latest` (the newest Nightly)"
-        default: latest
-      upload:
-        description: "Publish the result (native-health release); `false` for a trial run"
-        default: "true"
-permissions:
-  contents: read
-concurrency:
-  group: native-compat-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-env:
-  # The Rust the launcher builds native mods with (Horizon's launcher/src/rust_toolchain.rs).
-  RUST: "1.99.1"
-jobs:
-  check:
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    timeout-minutes: 120
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.base.sha }}
-          path: base
-      - uses: actions/checkout@v4
-        with:
-          path: head
-          persist-credentials: false
-      - name: Does it change a native mod?
-        id: native
-        run: |
-          if [ -n "$(python3 base/scripts/native_compat.py new base head)" ]; then
-            echo "changed=true" >> "$GITHUB_OUTPUT"
-          fi
-      - if: steps.native.outputs.changed == 'true'
-        run: rustup toolchain install $RUST --profile minimal && rustup default $RUST
-      - if: steps.native.outputs.changed == 'true'
-        run: sudo apt-get update && sudo apt-get install -y libasound2-dev libudev-dev pkg-config
-      - if: steps.native.outputs.changed == 'true'
-        name: On the newest Nightly, with the popular native mods
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: |
-          set -o pipefail
-          python3 base/scripts/native_compat.py check base head | tee -a "$GITHUB_STEP_SUMMARY"
-  health:
-    if: github.event_name != 'pull_request'
-    runs-on: ubuntu-latest
-    # Each mod horizon-mixins refuses costs one more apply of the whole set.
-    timeout-minutes: 300
-    permissions:
-      contents: write
-    env:
-      GH_TOKEN: ${{ github.token }}
-      GH_REPO: ${{ github.repository }}
-    steps:
-      - uses: actions/checkout@v4
-      - run: python3 -m unittest discover -s scripts -p 'test_*.py'
-      - run: rustup toolchain install $RUST --profile minimal && rustup default $RUST
-      - run: sudo apt-get update && sudo apt-get install -y libasound2-dev libudev-dev pkg-config
-      # Yesterday's dependencies, checked, and horizon-mixins: only Horizon's own crates and the mods compile again.
-      - uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry/index
-            ~/.cargo/registry/cache
-            ~/.cargo/git/db
-            native/target/compat/cargo
-            native/target/horizon-mixins
-          key: native-health-${{ env.RUST }}-${{ github.run_id }}
-          restore-keys: native-health-${{ env.RUST }}-
-      - name: Every native mod's newest version on the newest Nightly
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-          HORIZON: ${{ inputs.horizon || 'latest' }}
-        run: |
-          set -o pipefail
-          python3 scripts/native_compat.py health --horizon "$HORIZON" --out native-health.json | tee -a "$GITHUB_STEP_SUMMARY"
-      - name: Keep it for publish
-        if: inputs.upload != 'false'
-        run: |
-          gh release view native-health >/dev/null 2>&1 \
-            || gh release create native-health --prerelease --title "Native mods' health" \
-                 --notes "native-health.json: the native mods that don't apply on the newest Nightly (native-compat.yml). publish adds them to the index as broken_on."
-          gh release upload native-health native-health.json --clobber

.github/workflows/publish.yml

@@ -1,9 +1,9 @@
 # Merging publishes: each new version's file becomes a release asset
-# (<id>-<version>/<file>), then index.json, the icons and the screenshots go to GitHub
-# Pages (https://horizon-rust.github.io/horizon-mods/index.json), which the launcher and
+# (<id>-<version>/<file>), then index.json and the icons go to GitHub Pages
+# (https://horizon-rust.github.io/horizon-mods/index.json), which the launcher and
 # playhorizon.dev/mods read. Nothing is published if any entry fails its checks.
-# Every hour it runs again to refresh each project's `downloads` (GitHub's download
-# counts of its release assets) and `stars` (its source repository's GitHub stars).
+# Every hour it runs again to refresh each project's `downloads`: GitHub's
+# download counts of its release assets.
 name: publish
 on:
   push:
@@ -73,48 +73,9 @@ jobs:
               | if $n > 0 then .downloads = $n else . end)' site/index.json > index.counted.json
           mv index.counted.json site/index.json
           jq -r '.projects[] | "\(.id) \(.downloads // 0)"' site/index.json
-      - name: GitHub stars
-        run: |
-          # A project's stars are its source repository's (owner/repo of a
-          # https://github.com/ source, a folder of it or .git included), asked
-          # once per repository. One that can't be read is left out, not zero.
-          jq -r '.projects[].source // empty' site/index.json \
-            | sed -nE 's#^https://github\.com/([A-Za-z0-9-]+)/([A-Za-z0-9._-]+).*#\1/\2#p' \
-            | sed -E 's/\.git$//' | tr 'A-Z' 'a-z' | sort -u \
-            | while read -r repo; do
-                n="$(gh api "repos/$repo" --jq .stargazers_count 2>/dev/null)" || continue
-                echo "{\"key\": \"$repo\", \"value\": $n}"
-              done | jq -s from_entries > stars.json
-          jq --slurpfile stars stars.json '
-            .projects |= map(
-              (first((.source // "") | ascii_downcase
-                | capture("^https://github[.]com/(?<r>[a-z0-9-]+/[a-z0-9._-]+)").r
-                | sub("[.]git$"; "")) // "") as $r
-              | ($stars[0][$r] // 0) as $n
-              | if $n > 0 then .stars = $n else . end)' site/index.json > index.starred.json
-          mv index.starred.json site/index.json
-          jq -r '.projects[] | "\(.id) \(.stars // 0)"' site/index.json
-      - name: Native mods that don't apply on the newest Nightly
-        run: |
-          # native-compat.yml's daily health: the version each names gets `broken_on`, the Horizon
-          # commit horizon-mixins refused it on and its code, so the launcher warns before an install.
-          if gh release download native-health --pattern native-health.json --dir health 2>/dev/null; then
-            jq --slurpfile h health/native-health.json '
-              $h[0] as $health
-              | .projects |= map(. as $p | .versions |= map(
-                  ($health.broken[$p.id] // null) as $b
-                  | if $b != null and $b.version == .version
-                    then .broken_on = [{horizon: $health.horizon, code: $b.code}] else . end))' \
-              site/index.json > index.health.json
-            mv index.health.json site/index.json
-            jq -r '.projects[] | select(.versions[0].broken_on) | "\(.id) \(.versions[0].version): \(.versions[0].broken_on[0].code)"' site/index.json
-          fi
       - name: The site
         run: |
           cp -R icons site/icons
-          # Screenshots are served beside the icons: the index lists them at
-          # <site>screenshots/<id>/<name>.
-          if [ -d screenshots ]; then cp -R screenshots site/screenshots; fi
           cat > site/index.html <<'HTML'
           <!doctype html><meta charset="utf-8"><title>Horizon mods</title>
           <meta http-equiv="refresh" content="0; url=https://playhorizon.dev/mods">

README.md

@@ -11,10 +11,9 @@ with no file, network or clock access, and can only do what their page lists.
 Native source mods (`.hnmod`, kind `native-mod`) are built into an isolated game by
 a launcher with native-mod support. They run with the player’s account permissions.
 Their bundles pin the exact Horizon and Horizon Mixins revisions used for the build.
-Other revisions have not been validated. Registry checks inspect the source bundle and compile it
-on the newest Nightly with the most downloaded native mods (in a job whose token
-can only read) without running it; reviewers must also examine the source and
-pinned-build validation. Publishing these requires the native-mod changes to `cargo-horizon-mod`
+Other revisions have not been validated. Registry checks inspect the source bundle without
+executing native code; reviewers must also examine the source and pinned-build
+validation. Publishing these requires the native-mod changes to `cargo-horizon-mod`
 and the launcher to have shipped first.
 
 **Who is responsible.** Except the projects marked Official (made by the Horizon project), everything here is made and
@@ -66,7 +65,6 @@ why.
 | `.github/workflows/check.yml` | A pull request's checks |
 | `.github/workflows/publish.yml` | On merge: releases, then `index.json` on Pages |
 | `.github/workflows/cleanup.yml` | Weekly: staging files nobody needs any more |
-| `.github/workflows/native-compat.yml` | Native mods on the newest Nightly, as the launcher builds them: a pull request's new version applied and compiled with the most downloaded native mods, its module names against every mod's; daily, every mod's newest version, the ones that don't apply marked `broken_on` in the index (`scripts/native_compat.py`) |
 | `.github/workflows/native.yml` | Horizon's native mods: each changed one's tests, `.hnmod` and game check, all of them together, and weekly on the newest Nightly |
 | `native/<name>/` | Horizon's own native mods (Zoom, FPS Counter, Keystrokes, Minimap, Recipes, Coordinates HUD): the source of their `.hnmod` files |
 | `native/tools/` | Shared by them: apply on Horizon, check, build, package, prove (`native/tools/native.py`) |

mods/accurate_block_placement.toml

@@ -1,34 +0,0 @@
-id = "accurate_block_placement"
-kind = "native-mod"
-name = "Accurate Block Placement"
-summary = "Hold right click with a block and every new spot you look at gets one, however fast you move."
-description = """
-Placing blocks fast is all about timing: vanilla places a block every four ticks while you hold right click, so moving fast skips spots and moving slowly stacks extra blocks. **Accurate Block Placement** times it for you: hold right click and every *new* spot you look at gets a block at once.
-
-- **A new spot, a block**: bridging, building walls and floors, or sweeping along a row; no spot skipped, however fast you move.
-- **No extra blocks**: staring at one spot places nothing more.
-- **A single click stays a single block**: right after the click it waits as vanilla does, unless you turn the view.
-- **Building backwards**: walking backwards while placing toward yourself places one block per step.
-- Doors, chests, buttons and other blocks you click still work as usual.
-
-**Settings** (Options > Mods > Accurate Block Placement): turn it on or off, bind a key to toggle it (unbound by default), and choose whether it works on servers.
-
-Some servers see fast, accurate placing as a cheat: check their rules, or turn "Allowed on servers" off.
-
-A port of [Accurate Block Placement: Reborn](https://modrinth.com/mod/accurate-block-placement-reborn) (MIT) by Clayborn, Flourick, schwar and KadTheHunter, rewritten in Rust for Horizon."""
-authors = ["Lutziano888"]
-owners = ["Lutziano888"]
-owner_ids = [129792568]
-license = "MIT"
-source = "https://github.com/Lutziano888/horizon-accurate-block-placement"
-icon = "icons/accurate_block_placement.png"
-categories = ["utility", "game-mechanics"]
-tags = ["building", "block-placement", "bridging", "port"]
-
-[[versions]]
-version = "1.0.0"
-published = "2026-11-03"
-game = "26.3"
-file = "accurate_block_placement-1.0.0.hnmod"
-sha256 = "e631745f6d267360de6eb51995ee995bf1ab3d64393d287b7b93c332b85939ce"
-changelog = "First release."

mods/ae2.toml

@@ -1,59 +0,0 @@
-id = "ae2"
-kind = "native-mod"
-name = "Applied Energistics 2"
-summary = "Unofficial port of Applied Energistics 2 15.4.12: ME networks, autocrafting, spatial storage and more."
-description = """
-An unofficial port of Applied Energistics 2 15.4.12 to Horizon, not made or endorsed by its authors. Please report problems to this port, not to them.
-
-Rewritten in Rust: ME networks, storage cells, autocrafting, the cable bus with facades, P2P tunnels, spatial storage, the guide and the Fluix Researcher.
-
-**One file, no separate content mod.**
-
-### Optional integrations
-Each is compiled in only when its mod is in the same build, so adding or removing JEI or Jade takes effect at the next build.
-- **With JEI:** AE2's recipes and information pages, "+" transfer into terminals, and dragging items onto config slots.
-- **With Jade:** network state, channels, P2P links, charge, crafting and stored power.
-
-### Missing or not the same
-- **No spatial dimension.** Horizon mods can't add one. A player in a spatial cell goes to a walled plot far out in the End, so `/tp` and F3 say `minecraft:the_end`. A swap with a player takes up to about a second.
-- **No Java addons.** AE2's Java API isn't available, and the integrations work only with the Horizon ports of JEI and Jade.
-- **Two storage buses on one inventory:** only the first reaches it.
-- **Moving items** costs power through terminals, interfaces, export buses and wireless terminals. An IO port and the crafting terminal's refills pay nothing yet.
-- **Power** is judged once a second, so a network with too little goes down at the next look and comes back after about 40 ticks, where AE2's is at once and 32.
-- **Unformed crafting, quantum and spatial blocks** join a network before they're formed.
-- **Autocrafting gaps:** a pattern input of more than one is a single template, so some plans report items missing that AE2 would find. Blocking mode looks at all six sides, provider priority is ignored, and a machine's request for more than it can make crafts nothing.
-- **Other differences:** machines have 6 or 4 orientations rather than 24, menus are in English, fluix tools are diamond tools, and guide scenes have no annotations.
-- **Crafting ETA is an estimate:** 1.1% off on average on the test rig, 2.0% at worst.
-- **Nested P2P error** is an approximation.
-- **World height:** parts on cables assume -64 to 319.
-
-The Fluix Researcher and its trades rely on mixins, so they are the part most likely to break on a Horizon update.
-
-### Tested
-Tested on Horizon commit 6475f62, on Windows, in single player, on LAN with one guest, and on a dedicated server with one client, including attacks by a non-operator with a modified client. This version is built for Horizon commit 66f3981, where AE2 alone compiles but hasn't been run, and the JEI and Jade integrations haven't been compiled. Other platforms, more than one guest, pipes from other mods and speed against the Java mod were not tested.
-
-### Known issue
-In some test runs, placing a part into a cable cell did nothing. It isn't one specific part, and it's probably lost test clicks, but that isn't proven.
-
-Textures and models are CC BY-NC-SA 3.0: noncommercial use only."""
-authors = ["AlgorithmX2", "TeamAppliedEnergistics", "Joeypc6"]
-owners = ["Joeypc6"]
-owner_ids = [35495484]
-license = "LGPL-3.0-only AND CC-BY-NC-SA-3.0"
-source = "https://github.com/Joeypc6/AE2-Horizon"
-icon = "icons/ae2.png"
-categories = ["technology", "utility", "storage"]
-tags = ["ae2", "applied-energistics", "storage", "autocrafting", "automation"]
-
-[[versions]]
-version = "15.4.14"
-published = "2026-11-06"
-game = "26.3"
-file = "ae2-15.4.14.hnmod"
-sha256 = "584ec574b2620ccb9810a61f30b8bc4e639b5bf819bef7c3612835efbbdc278f"
-changelog = """
-First release on the registry, ported from AE2 15.4.12 (Fabric). 15.4.14 is this port's own version number, not an AE2 release.
-
-Built for Horizon commit 66f3981. It compiles on that Horizon but wasn't run there; it was last tested on 6475f62.
-
-One file: the blocks, items and textures, and the JEI and Jade integrations, are all in this mod. This replaces the earlier submissions, and fixes the `ae2:debug` vulnerability reported on them, along with others found by further reviews, and many defects from an outside review (PLAN.md, Rounds 24 to 26)."""

mods/appleskin.toml

@@ -3,53 +3,19 @@ kind = "native-mod"
 name = "AppleSkin"
 summary = "Shows how much HP, hunger, and saturation will be restored."
 description = """
-A port of [AppleSkin](https://github.com/squeek502/AppleSkin) by squeek502 for Horizon, as a native mod. It
-draws the hunger details AppleSkin shows over the food bar:
+AppleSkin for Horizon, a native mod.
 
-- **Saturation**: how much saturation you have, as food icons over the food bar.
-- **Exhaustion**: a thin strip showing how close you are to losing the next food point.
-- **Held food preview**: the food in your hand, with how much food and saturation it would restore.
-- **Animation**: fade in, pulse, or both (the default).
+Renders saturation, exhaustion, and held-food values over the hunger bar, as the original AppleSkin does.
 
-Each part can be turned on or off, and the animation changed, in the mod's settings (Options > Mods > AppleSkin).
-
-Based on AppleSkin by squeek502. See the LICENSE in the source for the original copyright and licence notices."""
-authors = ["sillysoufi"]
+Based on AppleSkin by squeek502. See the LICENSE in the source for the
+original copyright and licence notices."""
+authors = ["soufi"]
 owners = ["soufied"]
-owner_ids = [47915535]
 license = "MIT"
 source = "https://github.com/soufied/AppleSkin-Horizon"
 icon = "icons/appleskin.png"
-categories = ["utility", "food"]
-tags = ["hud", "hunger", "saturation", "food", "port"]
 key = "RWT6eNq4e5WfVDA2lzOOi6XCm/+jJgilqT1+HUUM33ie5MCjcRfSg760"
 
-[[versions]]
-version = "0.1.3"
-published = "2026-11-05"
-game = "26.3"
-file = "appleskin-0.1.3.hnmod"
-sha256 = "2dac91d4c4c4ab65684f41a3279c6b27beffa7407e5362b0d7a97c28c07914a6"
-signature = """
-untrusted comment: signature from minisign secret key
-RUT6eNq4e5WfVGmizdOQdqc3jXpjW/MxBBP/JE8iFYmkrE0cKbEOUP5t11senfkM2hkDW2JLSOEJCfQJT7PMS/LnYbXET1ux0Ag=
-trusted comment: timestamp:1793891067\tfile:appleskin-0.1.3.hnmod\thashed
-r7jcpfe0pAz6c2FZAuAd6EUJojhQ56mGoq/H9hYXyC8rZ6QuwErQt/nEM4ly1VjMIKS7pbn6vCz0wK7jIak+DQ=="""
-changelog = "Fix for https://github.com/horizon-rust/horizon-mods/issues/289"
-
-[[versions]]
-version = "0.1.2"
-published = "2026-11-02"
-game = "26.3"
-file = "appleskin-0.1.2.hnmod"
-sha256 = "627d1e7c4b4fa3dd191a4ff5887fe38b20ceb7d7d7f1197c1e03d1f25b6b6b92"
-signature = """
-untrusted comment: signature from minisign secret key
-RUT6eNq4e5WfVJqiP4tt8vQGW6sVLSxiLXLeVunyGuyfS9aZWqPilg77biu/2B+HUDS1FlBE31F/HOhBR2YWy0GSmdwhUO7xNAs=
-trusted comment: timestamp:1793633868\tfile:appleskin-0.1.2.hnmod\thashed
-IW9M2qJIktmQDlARS6ZTJ1IA9BoGCfMZvatnjIlSpVPkpeG/Qpr5QKRRRPFhnZa93a5KcUG34ok+cgFxipRjBg=="""
-changelog = "animation fix"
-
 [[versions]]
 version = "0.1.1"
 published = "2026-10-31"

mods/appleskin_horizon.toml

@@ -3,20 +3,16 @@ kind = "native-mod"
 name = "AppleSkin"
 summary = "1:1 Minecraft Java parity food value preview & saturation HUD overlay."
 description = """
-A port of AppleSkin for Horizon, as a native mod, drawn to match the Java Edition HUD.
+1:1 Minecraft Java parity port of AppleSkin for the native Horizon Rust client.
 
-- **Saturation overlay**: a golden border and glow around the drumsticks your saturation covers.
-- **Food value preview**: pulsing preview drumsticks, and a preview of the saturation border, while you hold
-  something you can eat.
-- **On or off** at any time in Options > Mods > AppleSkin."""
+Features
+Saturation Overlay: Golden border and glow around active saturation drumsticks matching original icons.png pixel art.
+Food Value Preview: Pulsing preview drumsticks and preview saturation border when holding edible items.
+Clean Integration: Easily toggled via Options > Mods > AppleSkin."""
 authors = ["CayMac"]
 owners = ["CayMac97"]
-owner_ids = [197672048]
 license = "MIT"
 source = "https://github.com/CayMac97/appleskin"
-icon = "icons/appleskin_horizon.png"
-categories = ["utility", "food"]
-tags = ["hud", "hunger", "saturation", "food", "port"]
 key = "RWS411U2KXdTN4/y5bQhqBYxNlZvCtSZ5lNy46eeSAcgy0cxSJo2+Sm3"
 
 [[versions]]