macroEngine 1.21.2: strict_gating permission enforcement + experimental flags

packs/macroEngine-Datapack-1.21.2/data/macroengine/function/api/cb/cancel.mcfunction

@@ -10,6 +10,11 @@
 #   function macroengine:api/cb/cancel
 # ─────────────────────────────────────────────────────────────────
 
+# Security gate — see core/internal/security/check_all.
+# No-op (always passes) unless flags.experimental.strict_gating is on.
+scoreboard players set $cbc_gate macroengine.tmp 1
+execute store success score $cbc_gate macroengine.tmp run function macroengine:core/internal/security/check_all {required:"cmd_min_level"}
+execute if score $cbc_gate macroengine.tmp matches 0 run return 0
 
 data remove storage macroengine:engine cb_queue
 data modify storage macroengine:engine cb_queue set value []

packs/macroEngine-Datapack-1.21.2/data/macroengine/function/api/cb/run.mcfunction

@@ -16,7 +16,11 @@
 #   function macroengine:api/cb/run
 # ─────────────────────────────────────────────────────────────────
 
-# Security gate
+# Security gate — see core/internal/security/check_all.
+# No-op (always passes) unless flags.experimental.strict_gating is on.
+scoreboard players set $cbr_gate macroengine.tmp 1
+execute store success score $cbr_gate macroengine.tmp run function macroengine:core/internal/security/check_all {required:"cmd_min_level"}
+execute if score $cbr_gate macroengine.tmp matches 0 run return 0
 
 # Verify required input
 execute unless data storage macroengine:input cb.cmd run tellraw @s [{"text":"[MACROENGINE/cb] ","color":"#00AAAA","bold":true},{"text":"cb.cmd not set","color":"red"}]

packs/macroEngine-Datapack-1.21.2/data/macroengine/function/api/cb/run_delayed.mcfunction

@@ -16,7 +16,11 @@
 #   function macroengine:api/cb/run_delayed
 # ─────────────────────────────────────────────────────────────────
 
-# Security gate
+# Security gate — see core/internal/security/check_all.
+# No-op (always passes) unless flags.experimental.strict_gating is on.
+scoreboard players set $cbrd_gate macroengine.tmp 1
+execute store success score $cbrd_gate macroengine.tmp run function macroengine:core/internal/security/check_all {required:"cmd_min_level"}
+execute if score $cbrd_gate macroengine.tmp matches 0 run return 0
 
 # Verify required inputs
 execute unless data storage macroengine:input cb.cmd run tellraw @s [{"text":"[MACROENGINE/cb] ","color":"#00AAAA","bold":true},{"text":"cb.cmd not set","color":"red"}]

packs/macroEngine-Datapack-1.21.2/data/macroengine/function/api/cb/run_sequence.mcfunction

@@ -17,7 +17,11 @@
 #   function macroengine:api/cb/run_sequence
 # ─────────────────────────────────────────────────────────────────
 
-# Security gate
+# Security gate — see core/internal/security/check_all.
+# No-op (always passes) unless flags.experimental.strict_gating is on.
+scoreboard players set $cbrs_gate macroengine.tmp 1
+execute store success score $cbrs_gate macroengine.tmp run function macroengine:core/internal/security/check_all {required:"cmd_min_level"}
+execute if score $cbrs_gate macroengine.tmp matches 0 run return 0
 
 # Verify required input
 execute unless data storage macroengine:input cb.cmds[0] run tellraw @s [{"text":"[MACROENGINE/cb] ","color":"#00AAAA","bold":true},{"text":"cb.cmds is empty or not set","color":"red"}]

packs/macroEngine-Datapack-1.21.2/data/macroengine/function/api/toggle/experimental/false.mcfunction

@@ -0,0 +1,11 @@
+# macroengine:api/toggle/experimental/false [MACRO] — Disable one experimental flag
+# Called by the experimental flags menu, or directly:
+#   function macroengine:api/toggle/experimental/false {flag:"hologram"}
+# Caller: macroengine.admin tag required
+
+execute unless entity @s[tag=macroengine.admin] run return 0
+
+$function macroengine:systems/flag/experimental/set {flag:"$(flag)",value:"0b"}
+
+$tellraw @s ["",{"text":"[MACROENGINE] ","color":"#00AAAA","bold":true},{"text":"experimental/","color":"gray"},{"text":"$(flag)","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"disabled","color":"red"}]
+$tellraw @a[tag=macroengine.debug] ["",{"text":"[MACROENGINE] ","color":"#00AAAA","bold":true},{"text":"toggle/experimental ","color":"aqua"},{"text":"$(flag)","color":"white"},{"text":" → ","color":"#555555"},{"text":"false","color":"red"}]

packs/macroEngine-Datapack-1.21.2/data/macroengine/function/api/toggle/experimental/show.mcfunction

@@ -0,0 +1,39 @@
+# macroengine:api/toggle/experimental/show
+# Prints a clickable experimental-flag enable/disable menu.
+#
+# Usage:  function macroengine:api/toggle/experimental/show
+# Caller: macroengine.admin tag required
+#
+# Each button runs:
+#   /function macroengine:api/toggle/experimental/<true|false> {flag:"<name>"}
+#
+# Flags:
+#   strict_gating   — enables core/internal/security/check_all enforcement
+#                      (cmd_min_level / sandbox_cmd_min_level / admin_min_level).
+#                      Turn this OFF immediately if permission checks start
+#                      blocking things that should work — every threshold
+#                      defaults to 0 (everyone passes) so it's safe to leave
+#                      on, but it's the flag that previously caused problems
+#                      and got removed, so it ships OFF by default.
+#   hologram        — experimental/hologram/* (floating text display entities)
+#   particle_trail  — experimental/particle_trail/* (player movement trails)
+#   crafting_ui     — experimental/crafting_ui/* (custom crafting menu)
+#   waypoint        — experimental/waypoint/* (set/track/compass waypoints)
+#   combat_tag      — experimental/combat_tag/* (temporary PvP-tag on hit)
+#   scoreboard_hud  — experimental/scoreboard_hud/* (sidebar HUD toggle)
+#
+# BACKPORT NOTE (1.21.2): same constraint as api/toggle/show.mcfunction —
+# no `dialog show` (added 1.21.6 / pack format 80) available here, so this
+# is a fixed clickable tellraw menu, not a native dialog screen.
+
+execute unless entity @s[tag=macroengine.admin] run return 0
+
+tellraw @s ["",{"text":"═══════ ","color":"dark_gray"},{"text":"macroEngine — Experimental Flags","color":"aqua","bold":true},{"text":" ═══════","color":"dark_gray"}]
+tellraw @s ["",{"text":"strict_gating  ","color":"white"},{"text":"[ON] ","color":"green","bold":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/experimental/true {flag:\"strict_gating\"}"}},{"text":"[OFF]","color":"red","bold":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/experimental/false {flag:\"strict_gating\"}"}}]
+tellraw @s ["",{"text":"hologram       ","color":"white"},{"text":"[ON] ","color":"green","bold":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/experimental/true {flag:\"hologram\"}"}},{"text":"[OFF]","color":"red","bold":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/experimental/false {flag:\"hologram\"}"}}]
+tellraw @s ["",{"text":"particle_trail ","color":"white"},{"text":"[ON] ","color":"green","bold":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/experimental/true {flag:\"particle_trail\"}"}},{"text":"[OFF]","color":"red","bold":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/experimental/false {flag:\"particle_trail\"}"}}]
+tellraw @s ["",{"text":"crafting_ui    ","color":"white"},{"text":"[ON] ","color":"green","bold":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/experimental/true {flag:\"crafting_ui\"}"}},{"text":"[OFF]","color":"red","bold":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/experimental/false {flag:\"crafting_ui\"}"}}]
+tellraw @s ["",{"text":"waypoint       ","color":"white"},{"text":"[ON] ","color":"green","bold":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/experimental/true {flag:\"waypoint\"}"}},{"text":"[OFF]","color":"red","bold":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/experimental/false {flag:\"waypoint\"}"}}]
+tellraw @s ["",{"text":"combat_tag     ","color":"white"},{"text":"[ON] ","color":"green","bold":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/experimental/true {flag:\"combat_tag\"}"}},{"text":"[OFF]","color":"red","bold":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/experimental/false {flag:\"combat_tag\"}"}}]
+tellraw @s ["",{"text":"scoreboard_hud ","color":"white"},{"text":"[ON] ","color":"green","bold":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/experimental/true {flag:\"scoreboard_hud\"}"}},{"text":"[OFF]","color":"red","bold":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/experimental/false {flag:\"scoreboard_hud\"}"}}]
+tellraw @s ["",{"text":"═════════════════════════════════════════","color":"dark_gray"}]

packs/macroEngine-Datapack-1.21.2/data/macroengine/function/api/toggle/experimental/true.mcfunction

@@ -0,0 +1,11 @@
+# macroengine:api/toggle/experimental/true [MACRO] — Enable one experimental flag
+# Called by the experimental flags menu, or directly:
+#   function macroengine:api/toggle/experimental/true {flag:"hologram"}
+# Caller: macroengine.admin tag required
+
+execute unless entity @s[tag=macroengine.admin] run return 0
+
+$function macroengine:systems/flag/experimental/set {flag:"$(flag)",value:"1b"}
+
+$tellraw @s ["",{"text":"[MACROENGINE] ","color":"#00AAAA","bold":true},{"text":"experimental/","color":"gray"},{"text":"$(flag)","color":"aqua"},{"text":" → ","color":"#555555"},{"text":"enabled","color":"green"}]
+$tellraw @a[tag=macroengine.debug] ["",{"text":"[MACROENGINE] ","color":"#00AAAA","bold":true},{"text":"toggle/experimental ","color":"aqua"},{"text":"$(flag)","color":"white"},{"text":" → ","color":"#555555"},{"text":"true","color":"green"}]

packs/macroEngine-Datapack-1.21.2/data/macroengine/function/api/toggle/show.mcfunction

@@ -27,3 +27,4 @@ tellraw @s ["",{"text":"perm       ","color":"white"},{"text":"[ON] ","color":"g
 tellraw @s ["",{"text":"wand       ","color":"white"},{"text":"[ON] ","color":"green","bold":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/wand/true"}},{"text":"[OFF]","color":"red","bold":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/wand/false"}}]
 tellraw @s ["",{"text":"geo        ","color":"white"},{"text":"[ON] ","color":"green","bold":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/geo/true"}},{"text":"[OFF]","color":"red","bold":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/geo/false"}}]
 tellraw @s ["",{"text":"cb         ","color":"white"},{"text":"[ON] ","color":"green","bold":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/cb/true"}},{"text":"[OFF]","color":"red","bold":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/cb/false"}}]
+tellraw @s ["",{"text":"› experimental flags","color":"yellow","italic":true,"clickEvent":{"action":"run_command","value":"/function macroengine:api/toggle/experimental/show"},"hoverEvent":{"action":"show_text","value":"Open the experimental feature-flag menu"}}]

packs/macroEngine-Datapack-1.21.2/data/macroengine/function/config.mcfunction

@@ -30,8 +30,27 @@ execute unless data storage macroengine:engine config.namespace_allowlist run da
 execute if data storage macroengine:engine config{sandbox:1b} run data modify storage macroengine:engine sandbox set value 1b
 execute unless data storage macroengine:engine config{sandbox:1b} run data modify storage macroengine:engine sandbox set value 0b
 
-# Admin min level storage (legacy readers; not enforced when gates removed)
+# Admin/cmd/sandbox min level storage. Enforced by core/internal/security/check_all
+# ONLY while flags.experimental.strict_gating is on (see below) — otherwise these
+# are read but never compared against anything, same as before that flag existed.
+# Threshold 0 = everyone passes even when strict_gating is on; raise these once
+# you've confirmed strict_gating is stable for your server.
 execute unless data storage macroengine:engine security run data modify storage macroengine:engine security set value {}
 execute unless data storage macroengine:engine security.admin_min_level run data modify storage macroengine:engine security.admin_min_level set value 0
 execute unless data storage macroengine:engine security.cmd_min_level run data modify storage macroengine:engine security.cmd_min_level set value 0
 execute unless data storage macroengine:engine security.sandbox_cmd_min_level run data modify storage macroengine:engine security.sandbox_cmd_min_level set value 0
+
+# ── Experimental feature flags (systems/flag/experimental/*) ──────
+# All default OFF. Each gates one piece of new/previously-removed
+# functionality so it can be toggled without editing files or /reload
+# stripping intent. See systems/flag/experimental/list.mcfunction for
+# the authoritative description of each flag.
+execute unless data storage macroengine:engine flags run data modify storage macroengine:engine flags set value {}
+execute unless data storage macroengine:engine flags.experimental run data modify storage macroengine:engine flags.experimental set value {}
+execute unless data storage macroengine:engine flags.experimental.strict_gating run data modify storage macroengine:engine flags.experimental.strict_gating set value 0b
+execute unless data storage macroengine:engine flags.experimental.hologram run data modify storage macroengine:engine flags.experimental.hologram set value 0b
+execute unless data storage macroengine:engine flags.experimental.particle_trail run data modify storage macroengine:engine flags.experimental.particle_trail set value 0b
+execute unless data storage macroengine:engine flags.experimental.crafting_ui run data modify storage macroengine:engine flags.experimental.crafting_ui set value 0b
+execute unless data storage macroengine:engine flags.experimental.waypoint run data modify storage macroengine:engine flags.experimental.waypoint set value 0b
+execute unless data storage macroengine:engine flags.experimental.combat_tag run data modify storage macroengine:engine flags.experimental.combat_tag set value 0b
+execute unless data storage macroengine:engine flags.experimental.scoreboard_hud run data modify storage macroengine:engine flags.experimental.scoreboard_hud set value 0b

packs/macroEngine-Datapack-1.21.2/data/macroengine/function/core/internal/api/wand/call_cmd.mcfunction

@@ -1,6 +1,13 @@
 # macroengine:api/wand/internal/call_cmd [MACRO]
 
-# SECURITY: central gate
+# SECURITY: central gate — see core/internal/security/check_all.
+# No-op (always passes) unless flags.experimental.strict_gating is on.
+# NOTE: `function <name> {args}` can only appear after `run` — it cannot
+# sit in an `execute if/unless` condition with inline NBT args, so the
+# call and the result check are two separate steps here.
+scoreboard players set $wcc_gate macroengine.tmp 1
+execute store success score $wcc_gate macroengine.tmp run function macroengine:core/internal/security/check_all {required:"sandbox_cmd_min_level"}
+execute if score $wcc_gate macroengine.tmp matches 0 run return 0
 
 tellraw @a[tag=macroengine.admin] [{"selector":"@s","color":"gold"},{"text":" - command executed","color":"yellow"}]
 

packs/macroEngine-Datapack-1.21.2/data/macroengine/function/core/internal/experimental/crafting_ui/check_ingredients.mcfunction

@@ -0,0 +1,17 @@
+# macroengine:core/internal/experimental/crafting_ui/check_ingredients [MACRO]
+# Called `with storage macroengine:engine _crafting_ui.active` — receives
+# the recipe compound (ingredients, result) as macro context. Recursively
+# checks each ingredient is present in sufficient count via
+# `clear @s <item> 0` (count-only, does not remove — see
+# player/inv/count_item.mcfunction for the same trick used elsewhere).
+# Sets _crafting_ui.ok to 0b on the first missing ingredient found.
+
+execute unless data storage macroengine:engine _crafting_ui.active.ingredients[0] run return 0
+
+data modify storage macroengine:engine _cui_ing set from storage macroengine:engine _crafting_ui.active.ingredients[0]
+data remove storage macroengine:engine _crafting_ui.active.ingredients[0]
+
+function macroengine:core/internal/experimental/crafting_ui/check_one_ingredient with storage macroengine:engine _cui_ing
+data remove storage macroengine:engine _cui_ing
+
+execute if data storage macroengine:engine _crafting_ui.active.ingredients[0] run function macroengine:core/internal/experimental/crafting_ui/check_ingredients with storage macroengine:engine _crafting_ui.active

packs/macroEngine-Datapack-1.21.2/data/macroengine/function/core/internal/experimental/crafting_ui/check_one_ingredient.mcfunction

@@ -0,0 +1,8 @@
+# macroengine:core/internal/experimental/crafting_ui/check_one_ingredient [MACRO]
+# INPUT (macro): $(item) -> item id string, $(count) -> required count
+# Uses `clear @s <item> 0` (count-only probe, nothing removed) to read
+# how many the caller holds, same trick as player/inv/count_item.mcfunction.
+
+scoreboard players set $cui_have macroengine.tmp 0
+$execute store result score $cui_have macroengine.tmp run clear @s $(item) 0
+$execute unless score $cui_have macroengine.tmp matches $(count).. run data modify storage macroengine:engine _crafting_ui.ok set value 0b

packs/macroEngine-Datapack-1.21.2/data/macroengine/function/core/internal/experimental/crafting_ui/consume_ingredients.mcfunction

@@ -0,0 +1,15 @@
+# macroengine:core/internal/experimental/crafting_ui/consume_ingredients [MACRO]
+# Called `with storage macroengine:engine _crafting_ui.active` AFTER
+# check_ingredients has already confirmed every ingredient is present —
+# this file does not re-check, only removes. Recursive pop-front,
+# same convention as check_ingredients.mcfunction.
+
+execute unless data storage macroengine:engine _crafting_ui.active.ingredients[0] run return 0
+
+data modify storage macroengine:engine _cui_ing set from storage macroengine:engine _crafting_ui.active.ingredients[0]
+data remove storage macroengine:engine _crafting_ui.active.ingredients[0]
+
+function macroengine:core/internal/experimental/crafting_ui/consume_one_ingredient with storage macroengine:engine _cui_ing
+data remove storage macroengine:engine _cui_ing
+
+execute if data storage macroengine:engine _crafting_ui.active.ingredients[0] run function macroengine:core/internal/experimental/crafting_ui/consume_ingredients with storage macroengine:engine _crafting_ui.active

packs/macroEngine-Datapack-1.21.2/data/macroengine/function/core/internal/experimental/crafting_ui/consume_one_ingredient.mcfunction

@@ -0,0 +1,3 @@
+# macroengine:core/internal/experimental/crafting_ui/consume_one_ingredient [MACRO]
+# INPUT (macro): $(item) -> item id string, $(count) -> amount to remove
+$clear @s $(item) $(count)

packs/macroEngine-Datapack-1.21.2/data/macroengine/function/core/internal/experimental/crafting_ui/give_result.mcfunction

@@ -0,0 +1,3 @@
+# macroengine:core/internal/experimental/crafting_ui/give_result [MACRO]
+# INPUT (macro): $(item) -> item id string, $(count) -> amount to give
+$give @s $(item) $(count)

packs/macroEngine-Datapack-1.21.2/data/macroengine/function/core/internal/experimental/waypoint/do_tp.mcfunction

@@ -0,0 +1,4 @@
+# macroengine:core/internal/experimental/waypoint/do_tp [MACRO]
+# Called with the waypoint compound itself as macro context
+# (x, y, z, dimension) — see experimental/waypoint/tp.mcfunction.
+$tp @s $(x) $(y) $(z)

packs/macroEngine-Datapack-1.21.2/data/macroengine/function/core/internal/load/loader/scoreboards.mcfunction

@@ -78,3 +78,17 @@ scoreboard objectives add macroengine.gamerule dummy
 
 # State scoreboard — per-player state machine (0=idle 1=combat 2=menu ...)
 scoreboard objectives add macroengine.state dummy
+
+# Permission level — read by core/internal/security/check_all against the
+# security.cmd_min_level / sandbox_cmd_min_level / admin_min_level thresholds
+# (only enforced while flags.experimental.strict_gating is on).
+# Default: 1 (base user). macroengine.admin tag always bypasses this
+# regardless of numeric value, so admins don't need it set manually.
+scoreboard objectives add macroengine.perm_level dummy
+
+# experimental/combat_tag — damage_dealt delta detection (same
+# stat-delta pattern as the hook_* objectives above), plus a countdown
+# timer per tagged player. Self-contained: only touched while
+# flags.experimental.combat_tag is on.
+scoreboard objectives add macroengine.exp_dmg_dealt minecraft.custom:minecraft.damage_dealt
+scoreboard objectives add macroengine.exp_combat_timer dummy