Create: Re-Packager Fix

Create: Re-Packager Fix

A server-side fix mod for Create that patches a duplication exploit in the Re-Packager. When a fragmented package carries insufficient inventory to fulfill the crafting recipes of its order, the Re-Packager still generates a package entry with a quantity of 0 — which the packager's output logic then ejects as a real physical package containing a full copy of the recipe materials, allowing attackers to duplicate recipe materials infinitely. This mod patches PackageRepackageHelper.repackBasedOnRecipes via Mixin, eliminating the duplication at its root without affecting normal packaging behavior.

The Vulnerability

Affected versions: Create 6.0.8 (1.20.1), 6.0.10 (1.21.1), and the Create Fly ports (1.21.11 / 26.2).

• Crafting arrangements configured on the Factory Gauge are not bound by inventory validation — recipe materials are not required to match the requested items (Create only checks this consistency in the Redstone Requester path; the Factory Gauge path misses this check entirely).
• When inventory is insufficient, repackBasedOnRecipes still generates a package entry with packagesToCreate == 0.
• (The core issue) The packager's output logic PackagerBlockEntity.tick() copies the package out before checking its count (heldBox = entry.stack.copy() precedes count--), so a count-0 package is emitted as a real one — an empty inventory produces a package containing a full set of recipe materials out of thin air, infinitely exploitable via the Factory Gauge's recurring restock requests.

Related upstream issues (all still open): #8082, #8046, #8155. Upstream commit 3e662789 only fixed the oversized recipe-material variant (copyWithCount(1)); the core defect remains unfixed.

The Fix

Mixin patch on PackageRepackageHelper.repackBasedOnRecipes using a two-phase validation:

1. Check first — verify all recipe materials are available (NBT-exact match); if any is missing, abort the whole round without consuming anything.
2. Consume second — only after everything is confirmed available, deduct the inventory uniformly; no partial consumption, so players never lose invested materials.
3. Zero-count guard — when packagesToCreate == 0 (inventory cannot support even a single craft), no package is generated.

All normal behavior (sufficient stock, multi-recipe orders, etc.) remains fully identical to vanilla.

Features

• Server-side only — clients can join without installing it
• Does not affect normal packaging / re-packaging
• Materials are returned (via regular repackaging) instead of being swallowed when partially insufficient
• Coexists with other fix mods

Verification

Feed the Re-Packager an anomalous package (empty inventory + a crafting order claiming 64 crafts):

• Without this mod: 1 package containing a full set of recipe materials is output (duplication)
• With this mod: 0 packages are output (fixed)

Test package commands are documented in TEST_PACKAGES.md in the repository.