From a891322c52792e7d44946d01f8f6e6d9478bd8da Mon Sep 17 00:00:00 2001
From: "0.7%" <mathtechstudio@gmail.com>
Date: Thu, 30 Apr 2026 05:16:11 +0700
Subject: [PATCH] feat(core): implement hardening and listener resilience

---
 src/Networking/Channel.luau |  4 +++-
 src/Networking/Packet.luau  |  4 +++-
 src/Types/init.luau         | 17 +++++++++++++++++
 src/init.luau               |  7 +++++++
 4 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/src/Networking/Channel.luau b/src/Networking/Channel.luau
index 4201ef8..9faacef 100644
--- a/src/Networking/Channel.luau
+++ b/src/Networking/Channel.luau
@@ -270,7 +270,9 @@ function Channel._applyUpdate(b: buffer)
 			state[field.name] = field.type.read(clientBuf, field.offset)
 		end
 		for _, callback in def.subscribers do
-			callback(entityId, state)
+			xpcall(callback, function(err)
+				warn(`[Satset] Channel '{def.name}' subscriber error: {err}`)
+			end, entityId, state)
 		end
 	end
 end
diff --git a/src/Networking/Packet.luau b/src/Networking/Packet.luau
index 694631d..616a6f5 100644
--- a/src/Networking/Packet.luau
+++ b/src/Networking/Packet.luau
@@ -113,7 +113,9 @@ function Packet._dispatchSingle(packetId: number, payload: buffer, sender: Playe
 	end
 
 	for _, listener in def.listeners do
-		listener(data, sender)
+		xpcall(listener, function(err)
+			warn(`[Satset] Packet '{def.name}' listener error: {err}`)
+		end, data, sender)
 	end
 end
 
diff --git a/src/Types/init.luau b/src/Types/init.luau
index cfaf68f..0d3211c 100644
--- a/src/Types/init.luau
+++ b/src/Types/init.luau
@@ -160,6 +160,9 @@ Types.u4 = {
 Types.string8 = {
 	read = function(b: buffer, cursor: number)
 		local len = readu8(b, cursor)
+		if cursor + 1 + len > buffer.len(b) then
+			return ""
+		end
 		return readstring(b, cursor + 1, len)
 	end,
 	write = function(b: buffer, cursor: number, value: string)
@@ -177,6 +180,9 @@ Types.string8 = {
 Types.string16 = {
 	read = function(b: buffer, cursor: number)
 		local len = readu16(b, cursor)
+		if cursor + 2 + len > buffer.len(b) then
+			return ""
+		end
 		return readstring(b, cursor + 2, len)
 	end,
 	write = function(b: buffer, cursor: number, value: string)
@@ -458,9 +464,13 @@ end
 function Types.array(elementType: Type<any>): Type<{ any }>
 	return {
 		read = function(b: buffer, cursor: number)
+			local bufLen = buffer.len(b)
 			local len = readu16(b, cursor)
 			local arr, pos = table.create(len), cursor + 2
 			for i = 1, len do
+				if pos + elementType.size > bufLen then
+					break
+				end
 				local val = elementType.read(b, pos)
 				arr[i] = val
 				pos += elementType.getSize(val)
@@ -492,11 +502,18 @@ end
 function Types.map(keyType: Type<any>, valueType: Type<any>): Type<{ [any]: any }>
 	return {
 		read = function(b: buffer, cursor: number)
+			local bufLen = buffer.len(b)
 			local count = readu16(b, cursor)
 			local result, pos = {}, cursor + 2
 			for _ = 1, count do
+				if pos + keyType.size > bufLen then
+					break
+				end
 				local key = keyType.read(b, pos)
 				pos += keyType.getSize(key)
+				if pos + valueType.size > bufLen then
+					break
+				end
 				local val = valueType.read(b, pos)
 				pos += valueType.getSize(val)
 				result[key] = val
diff --git a/src/init.luau b/src/init.luau
index 91fc433..c972dfc 100644
--- a/src/init.luau
+++ b/src/init.luau
@@ -22,6 +22,7 @@ local CHANNEL_UNRELIABLE_NAME = "__SatsetChannelUnreliable"
 
 -- [ State ]
 
+local _initialized = false
 local _guard: any = nil
 local channelReliable: RemoteEvent
 local channelUnreliable: UnreliableRemoteEvent
@@ -48,6 +49,12 @@ export type SatsetConfig = {
 	the client before using any packets or channels.
 ]]
 function Satset.start(config: SatsetConfig?)
+	if _initialized then
+		warn("[Satset] Already initialized. Ignoring duplicate start() call.")
+		return
+	end
+	_initialized = true
+
 	local context = if IS_SERVER then "Server" else "Client"
 	print(`[Satset v{VERSION}] Initializing on {context}`)