Version: 262.0.4

83ad6042a7 & b267cd6fb4

Does not include test code to avoid risking merge conflicts.

(cherry picked from commit 415585a30d74fcae61f581808220a7aaeca3eaf5)
(cherry picked from commit e36628a6d436ea08d6d31441c101a88a5504c515)

Directory.Packages.props

@@ -57,7 +57,7 @@
     <PackageVersion Include="SharpZstd.Interop" Version="1.5.2-beta2" />
     <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.7" />
     <PackageVersion Include="SpaceWizards.HttpListener" Version="0.1.1" />
-    <PackageVersion Include="SpaceWizards.NFluidsynth" Version="0.1.1" />
+    <PackageVersion Include="SpaceWizards.NFluidsynth" Version="0.2.2" />
     <PackageVersion Include="SpaceWizards.SharpFont" Version="1.0.2" />
     <PackageVersion Include="SpaceWizards.Sodium" Version="0.2.1" />
     <PackageVersion Include="TerraFX.Interop.Windows" Version="10.0.26100.1" />

MSBuild/Robust.Engine.Version.props

@@ -1,4 +1,4 @@
 <Project>
 
-    <!-- This file automatically reset by Tools/version.py -->
+    <!-- This file automatically reset by Tools/version.py -->
 

RELEASE-NOTES.md

@@ -54,6 +54,37 @@ END TEMPLATE-->
 *None yet*
 
 
+## 262.0.4
+
+
+## 262.0.3
+
+
+## 262.0.2
+
+
+## 262.0.1
+
+
+## 262.0.0
+
+### Breaking changes
+
+* Toolshed commands will now validate that each non-generic command argument is parseable (i.e., has a corresponding type parser). This check can be disabled by explicitly marking the argument as unparseable via `CommandArgumentAttribute.Unparseable`.
+
+### New features
+
+* `ToolshedManager.TryParse` now also supports nullable value types.
+* Add an ignoredComponents arg to IsDefault.
+
+### Bugfixes
+
+* Fix `SpriteComponent.Layer.Visible` setter not marking a sprite's bounding box as dirty.
+* The audio params in the passed SoundSpecifier for PlayStatic(SoundSpecifier, Filter, ...) will now be used as a default like other PlayStatic overrides.
+* Fix windows not saving their positions correctly when their x position is <= 0.
+* Fix transform state handling overriding PVS detachment.
+
+
 ## 261.2.0
 
 ### New features

Robust.Client.WebView/Cef/Program.cs

@@ -6,7 +6,7 @@ using Xilium.CefGlue;
 
 namespace Robust.Client.WebView.Cef
 {
-    public static class Program
+    internal static class Program
     {
         // This was supposed to be the main entry for the subprocess program... It doesn't work.
         public static int Main(string[] args)

Robust.Client.WebView/Cef/WebViewManagerCef.cs

@@ -5,6 +5,7 @@ using System.Net;
 using System.Reflection;
 using System.Text;
 using Robust.Client.Console;
+using Robust.Client.Utility;
 using Robust.Shared.Configuration;
 using Robust.Shared.ContentPack;
 using Robust.Shared.IoC;
@@ -24,6 +25,7 @@ namespace Robust.Client.WebView.Cef
 
         [Dependency] private readonly IDependencyCollection _dependencyCollection = default!;
         [Dependency] private readonly IPrototypeManager _prototypeManager = default!;
+        [Dependency] private readonly IGameControllerInternal _gameController = default!;
         [Dependency] private readonly IResourceManagerInternal _resourceManager = default!;
         [Dependency] private readonly IClientConsoleHost _consoleHost = default!;
         [Dependency] private readonly IConfigurationManager _cfg = default!;
@@ -61,7 +63,10 @@ namespace Robust.Client.WebView.Cef
 
             var cachePath = "";
             if (_resourceManager.UserData is WritableDirProvider userData)
-                cachePath = userData.GetFullPath(new ResPath("/cef_cache"));
+            {
+                var rootDir = UserDataDir.GetRootUserDataDir(_gameController);
+                cachePath = Path.Combine(rootDir, "cef_cache", "0");
+            }
 
             var settings = new CefSettings()
             {

Robust.Client/ComponentTrees/SpriteTreeSystem.cs

@@ -21,7 +21,7 @@ public sealed class SpriteTreeSystem : ComponentTreeSystem<SpriteTreeComponent,
     protected override Box2 ExtractAabb(in ComponentTreeEntry<SpriteComponent> entry, Vector2 pos, Angle rot)
     {
         // TODO SPRITE optimize this
-        // Because the just take the BB of the rotated BB, I'mt pretty sure we do a lot of unnecessary maths.
+        // Because the just take the BB of the rotated BB, I'm pretty sure we do a lot of unnecessary maths.
         return _sprite.CalculateBounds((entry.Uid, entry.Component), pos, rot, default).CalcBoundingBox();
     }
 

Robust.Client/GameController/GameController.cs

@@ -387,7 +387,7 @@ namespace Robust.Client
 
             _prof.Initialize();
 
-            _resManager.Initialize(Options.LoadConfigAndUserData ? userDataDir : null);
+            _resManager.Initialize(Options.LoadConfigAndUserData ? userDataDir : null, hideUserDataDir: true);
 
             var mountOptions = _commandLineArgs != null
                 ? MountOptions.Merge(_commandLineArgs.MountOptions, Options.MountOptions)

Robust.Client/GameObjects/Components/Renderable/SpriteComponent.cs

@@ -1224,6 +1224,8 @@ namespace Robust.Client.GameObjects
                         return;
                     _visible = value;
 
+                    Owner.Comp.BoundsDirty = true;
+
                     // ReSharper disable once ConditionalAccessQualifierIsNonNullableAccordingToAPIContract
                     if (_parent.Owner != EntityUid.Invalid)
                         Owner.Comp.Sys?.QueueUpdateIsInert(Owner);
@@ -1791,76 +1793,15 @@ namespace Robust.Client.GameObjects
         [Obsolete("Use SpriteSystem.GetPrototypeTextures() instead")]
         public static IEnumerable<IDirectionalTextureProvider> GetPrototypeTextures(EntityPrototype prototype, IResourceCache resourceCache, out bool noRot)
         {
-            var results = new List<IDirectionalTextureProvider>();
-            noRot = false;
-
-            // TODO when moving to a non-static method in a system, pass in IComponentFactory
-            if (prototype.TryGetComponent(out IconComponent? icon))
-            {
-                var sys = IoCManager.Resolve<IEntitySystemManager>().GetEntitySystem<SpriteSystem>();
-                results.Add(sys.GetIcon(icon));
-                return results;
-            }
-
-            if (!prototype.Components.TryGetValue("Sprite", out _))
-            {
-                results.Add(resourceCache.GetFallback<TextureResource>().Texture);
-                return results;
-            }
-
-            var entityManager = IoCManager.Resolve<IEntityManager>();
-            var dummy = entityManager.SpawnEntity(prototype.ID, MapCoordinates.Nullspace);
-            var spriteComponent = entityManager.EnsureComponent<SpriteComponent>(dummy);
-            EntitySystem.Get<AppearanceSystem>().OnChangeData(dummy, spriteComponent);
-
-            foreach (var layer in spriteComponent.AllLayers)
-            {
-                if (!layer.Visible) continue;
-
-                if (layer.Texture != null)
-                {
-                    results.Add(layer.Texture);
-                    continue;
-                }
-
-                if (!layer.RsiState.IsValid) continue;
-
-                var rsi = layer.Rsi ?? spriteComponent.BaseRSI;
-                if (rsi == null ||
-                    !rsi.TryGetState(layer.RsiState, out var state))
-                    continue;
-
-                results.Add(state);
-            }
-
-            noRot = spriteComponent.NoRotation;
-
-            entityManager.DeleteEntity(dummy);
-
-            if (results.Count == 0)
-                results.Add(resourceCache.GetFallback<TextureResource>().Texture);
-
-            return results;
+            var sys = IoCManager.Resolve<IEntitySystemManager>().GetEntitySystem<SpriteSystem>();
+            return sys.GetPrototypeTextures(prototype, out noRot);
         }
 
         [Obsolete("Use SpriteSystem.GetPrototypeIcon() instead")]
         public static IRsiStateLike GetPrototypeIcon(EntityPrototype prototype, IResourceCache resourceCache)
         {
             var sys = IoCManager.Resolve<IEntitySystemManager>().GetEntitySystem<SpriteSystem>();
-            // TODO when moving to a non-static method in a system, pass in IComponentFactory
-            if (prototype.TryGetComponent(out IconComponent? icon))
-                return sys.GetIcon(icon);
-
-            if (!prototype.Components.ContainsKey("Sprite"))
-                return sys.GetFallbackState();
-
-            var entityManager = IoCManager.Resolve<IEntityManager>();
-            var dummy = entityManager.SpawnEntity(prototype.ID, MapCoordinates.Nullspace);
-            var spriteComponent = entityManager.EnsureComponent<SpriteComponent>(dummy);
-            var result = spriteComponent.Icon ?? sys.GetFallbackState();
-            entityManager.DeleteEntity(dummy);
-
-            return result;
+            return sys.GetPrototypeIcon(prototype);
         }
     }
 }

Robust.Client/GameObjects/EntitySystems/SpriteSystem.Helpers.cs

@@ -56,10 +56,6 @@ public sealed partial class SpriteSystem
     /// </summary>
     public IRsiStateLike GetPrototypeIcon(string prototype)
     {
-        // Check if this prototype has been cached before, and if so return the result.
-        if (_cachedPrototypeIcons.TryGetValue(prototype, out var cachedResult))
-            return cachedResult;
-
         if (!_proto.TryIndex<EntityPrototype>(prototype, out var entityPrototype))
         {
             // The specified prototype doesn't exist, return the fallback "error" sprite.
@@ -67,11 +63,7 @@ public sealed partial class SpriteSystem
             return GetFallbackState();
         }
 
-        // Generate the icon and cache it in case it's ever needed again.
-        var result = GetPrototypeIcon(entityPrototype);
-        _cachedPrototypeIcons[prototype] = result;
-
-        return result;
+        return GetPrototypeIcon(entityPrototype);
     }
 
     /// <summary>
@@ -79,13 +71,19 @@ public sealed partial class SpriteSystem
     ///     This method does NOT cache the result.
     /// </summary>
     public IRsiStateLike GetPrototypeIcon(EntityPrototype prototype)
+    {
+        // This method may spawn & delete an entity to get an accruate RSI state, hence we cache the results
+        if (_cachedPrototypeIcons.TryGetValue(prototype.ID, out var cachedResult))
+            return cachedResult;
+
+        return _cachedPrototypeIcons[prototype.ID] = GetPrototypeIconInternal(prototype);
+    }
+
+    private IRsiStateLike GetPrototypeIconInternal(EntityPrototype prototype)
     {
         // IconComponent takes precedence. If it has a valid icon, return that. Otherwise, continue as normal.
-        if (prototype.Components.TryGetValue("Icon", out var compData)
-            && compData.Component is IconComponent icon)
-        {
+        if (prototype.TryGetComponent(out IconComponent? icon, _factory))
             return GetIcon(icon);
-        }
 
         // If the prototype doesn't have a SpriteComponent, then there's nothing we can do but return the fallback.
         if (!prototype.Components.ContainsKey("Sprite"))
@@ -102,6 +100,63 @@ public sealed partial class SpriteSystem
         return result;
     }
 
+    public IEnumerable<IDirectionalTextureProvider> GetPrototypeTextures(EntityPrototype proto) =>
+        GetPrototypeTextures(proto, out _);
+
+    public IEnumerable<IDirectionalTextureProvider> GetPrototypeTextures(EntityPrototype proto, out bool noRot)
+    {
+        var results = new List<IDirectionalTextureProvider>();
+        noRot = false;
+
+        if (proto.TryGetComponent(out IconComponent? icon, _factory))
+        {
+            results.Add(GetIcon(icon));
+            return results;
+        }
+
+        if (!proto.Components.ContainsKey("Sprite"))
+        {
+            results.Add(_resourceCache.GetFallback<TextureResource>().Texture);
+            return results;
+        }
+
+        var dummy = Spawn(proto.ID, MapCoordinates.Nullspace);
+        var spriteComponent = EnsureComp<SpriteComponent>(dummy);
+
+        // TODO SPRITE is this needed?
+        // And if it is, shouldn't GetPrototypeIconInternal also use this?
+        _appearance.OnChangeData(dummy, spriteComponent);
+
+        foreach (var layer in spriteComponent.AllLayers)
+        {
+            if (!layer.Visible)
+                continue;
+
+            if (layer.Texture != null)
+            {
+                results.Add(layer.Texture);
+                continue;
+            }
+
+            if (!layer.RsiState.IsValid)
+                continue;
+
+            var rsi = layer.Rsi ?? spriteComponent.BaseRSI;
+            if (rsi == null || !rsi.TryGetState(layer.RsiState, out var state))
+                continue;
+
+            results.Add(state);
+        }
+
+        noRot = spriteComponent.NoRotation;
+        Del(dummy);
+
+        if (results.Count == 0)
+            results.Add(_resourceCache.GetFallback<TextureResource>().Texture);
+
+        return results;
+    }
+
     [Pure]
     public RSI.State GetFallbackState()
     {

Robust.Client/GameObjects/EntitySystems/SpriteSystem.cs

@@ -34,8 +34,12 @@ namespace Robust.Client.GameObjects
         [Dependency] private readonly IPrototypeManager _proto = default!;
         [Dependency] private readonly IResourceCache _resourceCache = default!;
         [Dependency] private readonly ILogManager _logManager = default!;
+        [Dependency] private readonly IComponentFactory _factory = default!;
+
+        // Note that any new system dependencies have to be added to RobustUnitTest.BaseSetup()
         [Dependency] private readonly SharedTransformSystem _xforms = default!;
         [Dependency] private readonly SpriteTreeSystem _tree = default!;
+        [Dependency] private readonly AppearanceSystem _appearance = default!;
 
         public static readonly ProtoId<ShaderPrototype> UnshadedId = "unshaded";
         private readonly Queue<SpriteComponent> _inertUpdateQueue = new();

Robust.Client/GameStates/ClientGameStateManager.cs

@@ -631,7 +631,7 @@ namespace Robust.Client.GameStates
                         if (_sawmill.Level <= LogLevel.Debug)
                             _sawmill.Debug($"  A component was dirtied: {comp.GetType()}");
 
-                        if (compState != null)
+                        if ((meta.Flags & MetaDataFlags.Detached) == 0 && compState != null)
                         {
                             var handleState = new ComponentHandleState(compState, null);
                             _entities.EventBus.RaiseComponentEvent(entity, comp, ref handleState);

Robust.Client/UserInterface/CustomControls/DefaultWindow.xaml.cs

@@ -145,6 +145,11 @@ namespace Robust.Client.UserInterface.CustomControls
 
         protected override void FrameUpdate(FrameEventArgs args)
         {
+            // This is to avoid unnecessarily setting a position where our size isn't yet fully updated.
+            // This most commonly happens with saved window positions if your window position is <= 0.
+            if (!IsMeasureValid)
+                return;
+
             var (spaceX, spaceY) = Parent!.Size;
 
             var maxX = spaceX - ((AllowOffScreen & DirectionFlag.West) == 0 ? Size.X : WindowEdgeSeparation);

Robust.Server/BaseServer.cs

@@ -297,7 +297,7 @@ namespace Robust.Server
                 : null;
 
             // Set up the VFS
-            _resources.Initialize(dataDir);
+            _resources.Initialize(dataDir, hideUserDataDir: false);
 
             var mountOptions = _commandLineArgs != null
                 ? MountOptions.Merge(_commandLineArgs.MountOptions, Options.MountOptions) : Options.MountOptions;

Robust.Shared.Maths/Properties/AssemblyInfo.cs

@@ -6,4 +6,3 @@
 
 [assembly: InternalsVisibleTo("Robust.Client")]
 [assembly: InternalsVisibleTo("Robust.UnitTesting")]
-[assembly: InternalsVisibleTo("Content.Benchmarks")]

Robust.Shared/Audio/Systems/SharedAudioSystem.cs

@@ -665,7 +665,7 @@ public abstract partial class SharedAudioSystem : EntitySystem
     /// <param name="coordinates">The coordinates at which to play the audio.</param>
     public (EntityUid Entity, Components.AudioComponent Component)? PlayStatic(SoundSpecifier? sound, Filter playerFilter, EntityCoordinates coordinates, bool recordReplay, AudioParams? audioParams = null)
     {
-        return sound == null ? null : PlayStatic(ResolveSound(sound), playerFilter, coordinates, recordReplay, audioParams);
+        return sound == null ? null : PlayStatic(ResolveSound(sound), playerFilter, coordinates, recordReplay, audioParams ?? sound.Params);
     }
 
     /// <summary>

Robust.Shared/ContentPack/AssemblyTypeChecker.Config.cs

@@ -88,6 +88,7 @@ namespace Robust.Shared.ContentPack
             public string SystemAssemblyName = default!;
             public HashSet<VerifierError> AllowedVerifierErrors = default!;
             public List<string> WhitelistedNamespaces = default!;
+            public List<string> AllowedAssemblyPrefixes = default!;
             public Dictionary<string, Dictionary<string, TypeConfig>> Types = default!;
         }
 

Robust.Shared/ContentPack/AssemblyTypeChecker.cs

@@ -131,6 +131,16 @@ namespace Robust.Shared.ContentPack
                 return false;
             }
 
+#pragma warning disable RA0004
+            var loadedConfig = _config.Result;
+#pragma warning restore RA0004
+
+            if (!loadedConfig.AllowedAssemblyPrefixes.Any(allowedNamePrefix => asmName.StartsWith(allowedNamePrefix)))
+            {
+                _sawmill.Error($"Assembly name '{asmName}' is not allowed for a content assembly");
+                return false;
+            }
+
             if (VerifyIL)
             {
                 if (!DoVerifyIL(asmName, resolver, peReader, reader))
@@ -179,10 +189,6 @@ namespace Robust.Shared.ContentPack
                 return true;
             }
 
-#pragma warning disable RA0004
-            var loadedConfig = _config.Result;
-#pragma warning restore RA0004
-
             var badRefs = new ConcurrentBag<EntityHandle>();
 
             // We still do explicit type reference scanning, even though the actual whitelists work with raw members.

Robust.Shared/ContentPack/DirLoader.cs

@@ -60,9 +60,7 @@ namespace Robust.Shared.ContentPack
 
             internal string GetPath(ResPath relPath)
             {
-                return Path.GetFullPath(Path.Combine(_directory.FullName, relPath.ToRelativeSystemPath()))
-                    // Sanitise platform-specific path and standardize it for engine use.
-                    .Replace(Path.DirectorySeparatorChar, '/');
+                return PathHelpers.SafeGetResourcePath(_directory.FullName, relPath);
             }
 
             /// <inheritdoc />

Robust.Shared/ContentPack/IResourceManagerInternal.cs

@@ -14,7 +14,11 @@ namespace Robust.Shared.ContentPack
         /// The directory to use for user data.
         /// If null, a virtual temporary file system is used instead.
         /// </param>
-        void Initialize(string? userData);
+        /// <param name="hideUserDataDir">
+        /// If true, <see cref="IWritableDirProvider.RootDir"/> will be hidden on
+        /// <see cref="IResourceManager.UserData"/>.
+        /// </param>
+        void Initialize(string? userData, bool hideUserDataDir);
 
         /// <summary>
         ///     Mounts a single stream as a content file. Useful for unit testing.

Robust.Shared/ContentPack/IWritableDirProvider.cs

@@ -13,7 +13,7 @@ namespace Robust.Shared.ContentPack
     {
         /// <summary>
         /// The root path of this provider.
-        /// Can be null if it's a virtual provider.
+        /// Can be null if it's a virtual provider or the path is protected (e.g. on the client).
         /// </summary>
         string? RootDir { get; }
 

Robust.Shared/ContentPack/ModLoader.cs

@@ -93,19 +93,23 @@ namespace Robust.Shared.ContentPack
         {
             var sw = Stopwatch.StartNew();
             Sawmill.Debug("LOADING modules");
-            var files = new Dictionary<string, (ResPath Path, string[] references)>();
+            var files = new Dictionary<string, (ResPath Path, MemoryStream data, string[] references)>();
 
             // Find all modules we want to load.
             foreach (var fullPath in paths)
             {
                 using var asmFile = _res.ContentFileRead(fullPath);
-                var refData = GetAssemblyReferenceData(asmFile);
+                var ms = new MemoryStream();
+                asmFile.CopyTo(ms);
+
+                ms.Position = 0;
+                var refData = GetAssemblyReferenceData(ms);
                 if (refData == null)
                     continue;
 
                 var (asmRefs, asmName) = refData.Value;
 
-                if (!files.TryAdd(asmName, (fullPath, asmRefs)))
+                if (!files.TryAdd(asmName, (fullPath, ms, asmRefs)))
                 {
                     Sawmill.Error("Found multiple modules with the same assembly name " +
                                   $"'{asmName}', A: {files[asmName].Path}, B: {fullPath}.");
@@ -122,10 +126,10 @@ namespace Robust.Shared.ContentPack
 
                 Parallel.ForEach(files, pair =>
                 {
-                    var (name, (path, _)) = pair;
+                    var (name, (_, data, _)) = pair;
 
-                    using var stream = _res.ContentFileRead(path);
-                    if (!typeChecker.CheckAssembly(stream, resolver))
+                    data.Position = 0;
+                    if (!typeChecker.CheckAssembly(data, resolver))
                     {
                         throw new TypeCheckFailedException($"Assembly {name} failed type checks.");
                     }
@@ -137,14 +141,15 @@ namespace Robust.Shared.ContentPack
             var nodes = TopologicalSort.FromBeforeAfter(
                 files,
                 kv => kv.Key,
-                kv => kv.Value.Path,
+                kv => kv.Value,
                 _ => Array.Empty<string>(),
                 kv => kv.Value.references,
                 allowMissing: true); // missing refs would be non-content assemblies so allow that.
 
             // Actually load them in the order they depend on each other.
-            foreach (var path in TopologicalSort.Sort(nodes))
+            foreach (var item in TopologicalSort.Sort(nodes))
             {
+                var (path, memory, _) = item;
                 Sawmill.Debug($"Loading module: '{path}'");
                 try
                 {
@@ -156,9 +161,9 @@ namespace Robust.Shared.ContentPack
                     }
                     else
                     {
-                        using var assemblyStream = _res.ContentFileRead(path);
+                        memory.Position = 0;
                         using var symbolsStream = _res.ContentFileReadOrNull(path.WithExtension("pdb"));
-                        LoadGameAssembly(assemblyStream, symbolsStream, skipVerify: true);
+                        LoadGameAssembly(memory, symbolsStream, skipVerify: true);
                     }
                 }
                 catch (Exception e)
@@ -174,7 +179,7 @@ namespace Robust.Shared.ContentPack
 
         private (string[] refs, string name)? GetAssemblyReferenceData(Stream stream)
         {
-            using var reader = ModLoader.MakePEReader(stream);
+            using var reader = ModLoader.MakePEReader(stream, leaveOpen: true);
             var metaReader = reader.GetMetadataReader();
 
             var name = metaReader.GetString(metaReader.GetAssemblyDefinition().Name);

Robust.Shared/ContentPack/PathHelpers.cs

@@ -2,6 +2,7 @@
 using System.Collections.Generic;
 using System.IO;
 using System.Runtime.InteropServices;
+using Robust.Shared.Utility;
 
 namespace Robust.Shared.ContentPack
 {
@@ -63,5 +64,27 @@ namespace Robust.Shared.ContentPack
             !OperatingSystem.IsWindows()
             && !OperatingSystem.IsMacOS();
 
+
+        internal static string SafeGetResourcePath(string baseDir, ResPath path)
+        {
+            var relSysPath = path.ToRelativeSystemPath();
+            if (relSysPath.Contains("\\..") || relSysPath.Contains("/.."))
+            {
+                // Hard cap on any exploit smuggling a .. in there.
+                // Since that could allow leaving sandbox.
+                throw new InvalidOperationException($"This branch should never be reached. Path: {path}");
+            }
+
+            var retPath = Path.GetFullPath(Path.Join(baseDir, relSysPath));
+            // better safe than sorry check
+            if (!retPath.StartsWith(baseDir))
+            {
+                // Allow path to match if it's just missing the directory separator at the end.
+                if (retPath != baseDir.TrimEnd(Path.DirectorySeparatorChar))
+                    throw new InvalidOperationException($"This branch should never be reached. Path: {path}");
+            }
+
+            return retPath;
+        }
     }
 }

Robust.Shared/ContentPack/ResourceManager.cs

@@ -41,13 +41,13 @@ namespace Robust.Shared.ContentPack
         public IWritableDirProvider UserData { get; private set; } = default!;
 
         /// <inheritdoc />
-        public virtual void Initialize(string? userData)
+        public virtual void Initialize(string? userData, bool hideRootDir)
         {
             Sawmill = _logManager.GetSawmill("res");
 
             if (userData != null)
             {
-                UserData = new WritableDirProvider(Directory.CreateDirectory(userData));
+                UserData = new WritableDirProvider(Directory.CreateDirectory(userData), hideRootDir);
             }
             else
             {
@@ -379,6 +379,10 @@ namespace Robust.Shared.ContentPack
                 {
                     var rootDir = loader.GetPath(new ResPath(@"/"));
 
+                    // TODO: GET RID OF THIS.
+                    // This code shouldn't be passing OS disk paths through ResPath.
+                    rootDir = rootDir.Replace(Path.DirectorySeparatorChar, '/');
+
                     yield return new ResPath(rootDir);
                 }
             }

Robust.Shared/ContentPack/Sandbox.yml

@@ -17,6 +17,10 @@ WhitelistedNamespaces:
 - Content
 - OpenDreamShared
 
+AllowedAssemblyPrefixes:
+- OpenDream
+- Content
+
 # The type whitelist does NOT care about which assembly types come from.
 # This is because types switch assembly all the time.
 # Just look up stuff like StreamReader on https://apisof.net.

Robust.Shared/ContentPack/WritableDirProvider.cs

@@ -10,17 +10,22 @@ namespace Robust.Shared.ContentPack
     /// <inheritdoc />
     internal sealed class WritableDirProvider : IWritableDirProvider
     {
-        /// <inheritdoc />
+        private readonly bool _hideRootDir;
+
         public string RootDir { get; }
 
+        string? IWritableDirProvider.RootDir => _hideRootDir ? null : RootDir;
+
         /// <summary>
         /// Constructs an instance of <see cref="WritableDirProvider"/>.
         /// </summary>
         /// <param name="rootDir">Root file system directory to allow writing.</param>
-        public WritableDirProvider(DirectoryInfo rootDir)
+        /// <param name="hideRootDir">If true, <see cref="IWritableDirProvider.RootDir"/> is reported as null.</param>
+        public WritableDirProvider(DirectoryInfo rootDir, bool hideRootDir)
         {
             // FullName does not have a trailing separator, and we MUST have a separator.
             RootDir = rootDir.FullName + Path.DirectorySeparatorChar.ToString();
+            _hideRootDir = hideRootDir;
         }
 
         #region File Access
@@ -119,7 +124,7 @@ namespace Robust.Shared.ContentPack
                 throw new FileNotFoundException();
 
             var dirInfo = new DirectoryInfo(GetFullPath(path));
-            return new WritableDirProvider(dirInfo);
+            return new WritableDirProvider(dirInfo, _hideRootDir);
         }
 
         /// <inheritdoc />
@@ -180,20 +185,7 @@ namespace Robust.Shared.ContentPack
 
             path = path.Clean();
 
-            return GetFullPath(RootDir, path);
-        }
-
-        private static string GetFullPath(string root, ResPath path)
-        {
-            var relPath = path.ToRelativeSystemPath();
-            if (relPath.Contains("\\..") || relPath.Contains("/.."))
-            {
-                // Hard cap on any exploit smuggling a .. in there.
-                // Since that could allow leaving sandbox.
-                throw new InvalidOperationException($"This branch should never be reached. Path: {path}");
-            }
-
-            return Path.GetFullPath(Path.Combine(root, relPath));
+            return PathHelpers.SafeGetResourcePath(RootDir, path);
         }
     }
 }

Robust.Shared/EntitySerialization/EntityDeserializer.cs

@@ -547,20 +547,20 @@ public sealed class EntityDeserializer :
         _stopwatch.Restart();
         foreach (var (entity, data) in Entities)
         {
+#if EXCEPTION_TOLERANCE
             try
             {
+#endif
                 CurrentReadingEntity = data;
                 LoadEntity(entity, _metaQuery.Comp(entity), data.Components, data.MissingComponents);
+#if EXCEPTION_TOLERANCE
             }
             catch (Exception e)
             {
-#if !EXCEPTION_TOLERANCE
-                throw;
-#else
                 ToDelete.Add(entity);
                 _log.Error($"Encountered error while loading entity. Yaml uid: {data.YamlId}. Loaded loaded entity: {EntMan.ToPrettyString(entity)}. Error:\n{e}.");
-#endif
             }
+#endif
         }
 
         CurrentReadingEntity = null;

Robust.Shared/GameObjects/EntityManager.cs

@@ -161,7 +161,7 @@ namespace Robust.Shared.GameObjects
         /// <summary>
         /// Returns true if the entity's data (apart from transform) is default.
         /// </summary>
-        public bool IsDefault(EntityUid uid)
+        public bool IsDefault(EntityUid uid, ICollection<string>? ignoredComps = null)
         {
             if (!MetaQuery.TryGetComponent(uid, out var metadata) || metadata.EntityPrototype == null)
                 return false;
@@ -195,6 +195,9 @@ namespace Robust.Shared.GameObjects
 
                 var compName = _componentFactory.GetComponentName(compType);
 
+                if (ignoredComps?.Contains(compName) == true)
+                    continue;
+
                 // If the component isn't on the prototype then it's custom.
                 if (!protoData.TryGetValue(compName, out var protoMapping))
                     return false;

Robust.Shared/GameObjects/Systems/SharedTransformSystem.Component.cs

@@ -1,16 +1,16 @@
+using System;
+using System.Diagnostics.CodeAnalysis;
+using System.Linq;
+using System.Numerics;
+using System.Runtime.CompilerServices;
 using JetBrains.Annotations;
+using Robust.Shared.Containers;
 using Robust.Shared.GameStates;
 using Robust.Shared.Map;
+using Robust.Shared.Map.Components;
 using Robust.Shared.Maths;
 using Robust.Shared.Physics;
 using Robust.Shared.Utility;
-using System;
-using System.Linq;
-using System.Runtime.CompilerServices;
-using Robust.Shared.Map.Components;
-using System.Diagnostics.CodeAnalysis;
-using System.Numerics;
-using Robust.Shared.Containers;
 
 namespace Robust.Shared.GameObjects;
 

Robust.Shared/Properties/AssemblyInfo.cs

@@ -9,7 +9,6 @@
 [assembly: InternalsVisibleTo("Robust.UnitTesting")]
 [assembly: InternalsVisibleTo("OpenToolkit.GraphicsLibraryFramework")]
 [assembly: InternalsVisibleTo("DynamicProxyGenAssembly2")] // Gives access to Castle(Moq)
-[assembly: InternalsVisibleTo("Content.Benchmarks")]
 [assembly: InternalsVisibleTo("Robust.Benchmarks")]
 [assembly: InternalsVisibleTo("Robust.Client.WebView")]
 [assembly: InternalsVisibleTo("Robust.Packaging")]

Robust.Shared/Serialization/NetBitArraySerializer.cs

@@ -0,0 +1,78 @@
+using System;
+using System.Collections;
+using System.Collections.Generic;
+using System.IO;
+using System.Reflection;
+using System.Runtime.Serialization;
+using JetBrains.Annotations;
+using NetSerializer;
+
+namespace Robust.Shared.Serialization;
+
+/// <summary>
+/// Custom serializer implementation for <see cref="BitArray"/>.
+/// </summary>
+/// <remarks>
+/// <para>
+/// This type is necessary as, since .NET 10, the internal layout of <see cref="BitArray"/> was changed.
+/// The type now (internally) implements <see cref="ISerializable"/> for backwards compatibility with existing
+/// <c>BinaryFormatter</c> code, but NetSerializer does not support <see cref="ISerializable"/>.
+/// </para>
+/// <para>
+/// This code is designed to be backportable &amp; network compatible with the previous behavior on .NET 9.
+/// </para>
+/// </remarks>
+internal sealed class NetBitArraySerializer : IStaticTypeSerializer
+{
+    // For reference, the layout of BitArray before .NET 10 was:
+    // private int[] m_array;
+    // private int m_length;
+    // private int _version;
+    // NetSerializer serialized these in the following order (sorted by name):
+    // _version, m_array, m_length
+
+    public bool Handles(Type type)
+    {
+        return type == typeof(BitArray);
+    }
+
+    public IEnumerable<Type> GetSubtypes(Type type)
+    {
+        return [typeof(int[]), typeof(int)];
+    }
+
+    public MethodInfo GetStaticWriter(Type type)
+    {
+        return typeof(NetBitArraySerializer).GetMethod("Write", BindingFlags.Static | BindingFlags.NonPublic)!;
+    }
+
+    public MethodInfo GetStaticReader(Type type)
+    {
+        return typeof(NetBitArraySerializer).GetMethod("Read", BindingFlags.Static | BindingFlags.NonPublic)!;
+    }
+
+    [UsedImplicitly]
+    private static void Write(Serializer serializer, Stream stream, BitArray value)
+    {
+        var intCount = (31 + value.Length) >> 5;
+        var ints = new int[intCount];
+        value.CopyTo(ints, 0);
+
+        serializer.SerializeDirect(stream, 0); // _version
+        serializer.SerializeDirect(stream, ints); // m_array
+        serializer.SerializeDirect(stream, value.Length); // m_length
+    }
+
+    [UsedImplicitly]
+    private static void Read(Serializer serializer, Stream stream, out BitArray value)
+    {
+        serializer.DeserializeDirect<int>(stream, out _); // _version
+        serializer.DeserializeDirect<int[]>(stream, out var array); // m_array
+        serializer.DeserializeDirect<int>(stream, out var length); // m_length
+
+        value = new BitArray(array)
+        {
+            Length = length
+        };
+    }
+}

Robust.Shared/Serialization/RobustSerializer.cs

@@ -91,6 +91,7 @@ namespace Robust.Shared.Serialization
                     MappedStringSerializer.TypeSerializer,
                     new Vector2Serializer(),
                     new Matrix3x2Serializer(),
+                    new NetBitArraySerializer()
                 }
             };
             _serializer = new Serializer(types, settings);

Robust.Shared/Toolshed/Attributes.cs

@@ -46,8 +46,9 @@ public sealed class PipedArgumentAttribute : Attribute;
 [MeansImplicitUse]
 public sealed class CommandArgumentAttribute : Attribute
 {
-    public CommandArgumentAttribute(Type? customParser = null)
+    public CommandArgumentAttribute(Type? customParser = null, bool unparseable = false)
     {
+        Unparseable = unparseable;
         if (customParser == null)
             return;
 
@@ -56,6 +57,13 @@ public sealed class CommandArgumentAttribute : Attribute
             $"Custom parser {customParser.PrettyName()} does not inherit from {typeof(CustomTypeParser<>).PrettyName()}");
     }
 
+    /// <summary>
+    /// Command initialization will validate that all of a command's arguments are parseable (i.e., have a type parser).
+    /// In some niche situations you might want to have a command that accepts unparseable arguments that must be
+    /// supplied via a toolshed variable or command block, in which case the check can be disabled via this property.
+    /// </summary>
+    public bool Unparseable { get; }
+
     public Type? CustomParser { get; }
 }
 

Robust.Shared/Toolshed/Commands/Entities/World/TpCommand.cs

@@ -11,8 +11,11 @@ internal sealed class TpCommand : ToolshedCommand
 {
     private SharedTransformSystem? _xform;
 
+    // TODO TOOLSHED
+    // add EntityCoordinates parser
+
     [CommandImplementation("coords")]
-    public EntityUid TpCoords([PipedArgument] EntityUid teleporter, EntityCoordinates target)
+    public EntityUid TpCoords([PipedArgument] EntityUid teleporter, [CommandArgument(unparseable:true)] EntityCoordinates target)
     {
         _xform ??= GetSys<SharedTransformSystem>();
         _xform.SetCoordinates(teleporter, target);
@@ -20,7 +23,7 @@ internal sealed class TpCommand : ToolshedCommand
     }
 
     [CommandImplementation("coords")]
-    public IEnumerable<EntityUid> TpCoords([PipedArgument] IEnumerable<EntityUid> teleporters, EntityCoordinates target)
+    public IEnumerable<EntityUid> TpCoords([PipedArgument] IEnumerable<EntityUid> teleporters, [CommandArgument(unparseable:true)] EntityCoordinates target)
         => teleporters.Select(x => TpCoords(x, target));
 
     [CommandImplementation("to")]

Robust.Shared/Toolshed/ToolshedCommand.cs

@@ -124,12 +124,12 @@ public abstract partial class ToolshedCommand
             {
                 var hasAnyAttribute = false;
 
-                if (param.HasCustomAttribute<CommandArgumentAttribute>())
+                if (param.GetCustomAttribute<CommandArgumentAttribute>() is {} cmdAttr)
                 {
                     if (param.Name == null || !argNames.Add(param.Name))
                         throw new InvalidCommandImplementation($"Command arguments must have a unique name");
                     hasAnyAttribute = true;
-                    ValidateArg(param);
+                    ValidateArg(param, cmdAttr);
                 }
 
                 if (param.HasCustomAttribute<PipedArgumentAttribute>())
@@ -232,8 +232,18 @@ public abstract partial class ToolshedCommand
         }
     }
 
-    private void ValidateArg(ParameterInfo arg)
+    private void ValidateArg(ParameterInfo arg, CommandArgumentAttribute? cmdAttr = null)
     {
+        if (cmdAttr == null || cmdAttr.CustomParser == null && !cmdAttr.Unparseable)
+        {
+            // This checks that each argument has a corresponding type parser, as people have sometimes created a command
+            // without realising that the type is unparseable.
+            var t = Nullable.GetUnderlyingType(arg.ParameterType) ?? arg.ParameterType;
+            var ignore = t.IsGenericType || t.IsArray || t.ContainsGenericParameters;
+            if (!ignore && Toolshed.GetParserForType(t) == null)
+                throw new InvalidCommandImplementation($"{Name} command argument of type {t.PrettyName()} has no type parser. You either need to add a type parser or explicitly mark the argument as unparseable.");
+        }
+
         var isParams = arg.HasCustomAttribute<ParamArrayAttribute>();
         if (!isParams)
             return;

Robust.Shared/Toolshed/ToolshedManager.Parsing.cs

@@ -231,7 +231,10 @@ public sealed partial class ToolshedManager
     /// <returns>Success.</returns>
     public bool TryParse<T>(ParserContext parserContext, [NotNullWhen(true)] out T? parsed)
     {
-        var res = TryParse(parserContext, typeof(T), out var p);
+        var t = typeof(T);
+        t = Nullable.GetUnderlyingType(t) ?? t;
+        var res = TryParse(parserContext, t, out var p);
+
         if (p is not null)
             parsed = (T?) p;
         else

Robust.Shared/Toolshed/TypeParsers/Math/SpanLikeTypeParser.cs

@@ -81,7 +81,7 @@ public abstract class SpanLikeTypeParser<T, TElem> : TypeParser<T>
 
     public override CompletionResult? TryAutocomplete(ParserContext parserContext, CommandArgument? arg)
     {
-        return CompletionResult.FromHint(typeof(T).PrettyName());
+        return CompletionResult.FromHint(GetArgHint(arg));
     }
 }
 

Robust.UnitTesting/RobustUnitTest.cs

@@ -28,6 +28,7 @@ using Robust.Shared.Player;
 using Robust.Shared.Reflection;
 using Robust.Shared.Threading;
 using Robust.Shared.Utility;
+using AppearanceSystem = Robust.Client.GameObjects.AppearanceSystem;
 using InputSystem = Robust.Server.GameObjects.InputSystem;
 using MapSystem = Robust.Server.GameObjects.MapSystem;
 using PointLightComponent = Robust.Client.GameObjects.PointLightComponent;
@@ -141,6 +142,7 @@ namespace Robust.UnitTesting
                 systems.LoadExtraSystemType<RecursiveMoveSystem>();
                 systems.LoadExtraSystemType<SpriteSystem>();
                 systems.LoadExtraSystemType<SpriteTreeSystem>();
+                systems.LoadExtraSystemType<AppearanceSystem>();
                 systems.LoadExtraSystemType<GridChunkBoundsDebugSystem>();
             }
             else

Robust.UnitTesting/Server/GameStates/PvsPauseTest.cs

@@ -136,35 +136,39 @@ public sealed class PvsPauseTest : RobustIntegrationTest
         await RunTicks();
         AssertEnt(paused: true, detached: false, clientPaused: true);
 
-         // Unpause the entity while out of range
-         {
-             await server.WaitPost(() => xforms.SetCoordinates(sEntMan.GetEntity(player), farAway));
-             await RunTicks();
-             AssertEnt(paused: true, detached: true, clientPaused: true);
+        // Unpause the entity while out of range
+        {
+            await server.WaitPost(() => xforms.SetCoordinates(sEntMan.GetEntity(player), farAway));
+            await RunTicks();
+            AssertEnt(paused: true, detached: true, clientPaused: true);
 
-             await server.WaitPost(() => metaSys.SetEntityPaused(sEnt, false));
-             await RunTicks();
-             AssertEnt(paused: false, detached: true, clientPaused: true);
+            await server.WaitPost(() => metaSys.SetEntityPaused(sEnt, false));
+            await RunTicks();
+            AssertEnt(paused: false, detached: true, clientPaused: true);
 
-             await server.WaitPost(() => xforms.SetCoordinates(sEntMan.GetEntity(player), coords));
-             await RunTicks();
-             AssertEnt(paused: false, detached: false, clientPaused: false);
-         }
+            await server.WaitPost(() => xforms.SetCoordinates(sEntMan.GetEntity(player), coords));
+            await RunTicks();
+            AssertEnt(paused: false, detached: false, clientPaused: false);
+        }
 
-         // Pause the entity while out of range
-         {
-             await server.WaitPost(() => xforms.SetCoordinates(sEntMan.GetEntity(player), farAway));
-             await RunTicks();
-             AssertEnt(paused: false, detached: true, clientPaused: true);
+        // Pause the entity while out of range
+        {
+            await server.WaitPost(() => xforms.SetCoordinates(sEntMan.GetEntity(player), farAway));
+            await RunTicks();
+            AssertEnt(paused: false, detached: true, clientPaused: true);
 
-             await server.WaitPost(() => metaSys.SetEntityPaused(sEnt, true));
-             await RunTicks();
-             AssertEnt(paused: true, detached: true, clientPaused: true);
+            await server.WaitPost(() => metaSys.SetEntityPaused(sEnt, true));
+            await RunTicks();
+            AssertEnt(paused: true, detached: true, clientPaused: true);
 
-             await server.WaitPost(() => xforms.SetCoordinates(sEntMan.GetEntity(player), coords));
-             await RunTicks();
-             AssertEnt(paused: true, detached: false, clientPaused: true);
-         }
+            await server.WaitPost(() => xforms.SetCoordinates(sEntMan.GetEntity(player), coords));
+            await RunTicks();
+            AssertEnt(paused: true, detached: false, clientPaused: true);
+        }
+
+        await client.WaitPost(() => netMan.ClientDisconnect(""));
+        await server.WaitRunTicks(5);
+        await client.WaitRunTicks(5);
     }
 }
 

Robust.UnitTesting/Server/GameStates/PvsResetTest.cs

@@ -0,0 +1,134 @@
+using System.Linq;
+using System.Numerics;
+using System.Threading.Tasks;
+using NUnit.Framework;
+using Robust.Shared;
+using Robust.Shared.GameObjects;
+using Robust.Shared.Map;
+using Robust.Shared.Network;
+
+namespace Robust.UnitTesting.Server.GameStates;
+
+public sealed class PvsResetTest : RobustIntegrationTest
+{
+    /// <summary>
+    /// Check that the client doesn't reset dirty detached entities. They should remain in nullspace.
+    /// </summary>
+    [Test]
+    public async Task ResetTest()
+    {
+        var server = StartServer();
+        var client = StartClient();
+
+        await Task.WhenAll(client.WaitIdleAsync(), server.WaitIdleAsync());
+
+        var sEntMan = server.EntMan;
+        var confMan = server.CfgMan;
+        var sPlayerMan = server.PlayerMan;
+        var xforms = sEntMan.System<SharedTransformSystem>();
+
+        var cEntMan = client.EntMan;
+        var cPlayerMan = client.PlayerMan;
+        var netMan = client.ResolveDependency<IClientNetManager>();
+
+        Assert.DoesNotThrow(() => client.SetConnectTarget(server));
+        client.Post(() => netMan.ClientConnect(null!, 0, null!));
+        server.Post(() => confMan.SetCVar(CVars.NetPVS, true));
+
+        async Task RunTicks()
+        {
+            for (int i = 0; i < 10; i++)
+            {
+                await server.WaitRunTicks(1);
+                await client.WaitRunTicks(1);
+            }
+        }
+
+        await RunTicks();
+
+        // Set up map and spawn player
+        EntityUid sMap = default;
+        EntityUid playerUid = default;
+        EntityUid sEnt = default;
+        EntityCoordinates coords = default;
+        await server.WaitPost(() =>
+        {
+            sMap = server.System<SharedMapSystem>().CreateMap();
+            coords = new(sMap, default);
+
+            playerUid = sEntMan.SpawnEntity(null, coords);
+            sEnt = sEntMan.SpawnEntity(null, coords);
+            // Attach player.
+            var session = sPlayerMan.Sessions.First();
+            server.PlayerMan.SetAttachedEntity(session, playerUid);
+            sPlayerMan.JoinGame(session);
+        });
+
+        await RunTicks();
+        var farAway = new EntityCoordinates(sMap, new Vector2(100, 100));
+        var netEnt = sEntMan.GetNetEntity(sEnt);
+        var player = sEntMan.GetNetEntity(playerUid);
+        Assert.That(player, Is.Not.EqualTo(NetEntity.Invalid));
+        Assert.That(netEnt, Is.Not.EqualTo(NetEntity.Invalid));
+
+        // Check player got properly attached, and has received the other entity.
+        Assert.That(cEntMan.TryGetEntity(netEnt, out var uid));
+        Assert.That(cEntMan.TryGetEntity(player, out var cPlayerUid));
+        var cEnt = uid!.Value;
+        Assert.That(cPlayerMan.LocalEntity, Is.EqualTo(cPlayerUid));
+        var cMap = cEntMan.GetEntity(sEntMan.GetNetEntity(sMap));
+
+        void AssertDetached(bool detached)
+        {
+            var cXform = client.Transform(cEnt);
+            var sXform = server.Transform(sEnt);
+            var meta = client.MetaData(cEnt);
+
+            Assert.That(sXform.MapUid, Is.EqualTo(sMap));
+            Assert.That(sXform.ParentUid, Is.EqualTo(sMap));
+
+            if (detached)
+            {
+                Assert.That(meta.Flags.HasFlag(MetaDataFlags.Detached));
+                Assert.That(cXform.MapUid, Is.Null);
+                Assert.That(cXform.ParentUid, Is.EqualTo(EntityUid.Invalid));
+            }
+            else
+            {
+                Assert.That(!meta.Flags.HasFlag(MetaDataFlags.Detached));
+                Assert.That(cXform.MapUid, Is.EqualTo(cMap));
+                Assert.That(cXform.ParentUid, Is.EqualTo(cMap));
+            }
+        }
+
+        // Entity is initially in view
+        AssertDetached(false);
+
+        // Move the player out of the entity's PVS range
+        await server.WaitPost(() => xforms.SetCoordinates(playerUid, farAway));
+        await RunTicks();
+
+        // Client should now have detached the entity, moving it into nullspace
+        AssertDetached(true);
+
+        // Marking the entity as dirty due to client-side prediction should have effect
+        await client.WaitPost(() => client.EntMan.Dirty(cEnt, client.Transform(cEnt)));
+        await RunTicks();
+        AssertDetached(true);
+
+        // Move the player back into range
+        await server.WaitPost( () => xforms.SetCoordinates(playerUid, coords));
+        await RunTicks();
+        AssertDetached(false);
+
+        // Marking the entity as dirty due to client-side prediction should have no real effect
+        await client.WaitPost(() => client.EntMan.Dirty(cEnt, client.Transform(cEnt)));
+        await RunTicks();
+        AssertDetached(false);
+
+        await client.WaitPost(() => netMan.ClientDisconnect(""));
+        await server.WaitRunTicks(5);
+        await client.WaitRunTicks(5);
+    }
+}
+

Robust.UnitTesting/Shared/Resources/WritableDirProviderTest.cs

@@ -24,7 +24,7 @@ namespace Robust.UnitTesting.Shared.Resources
             _testDir = Directory.CreateDirectory(_testDirPath);
             var subDir = Path.Combine(_testDirPath, "writable");
 
-            _dirProvider = new WritableDirProvider(Directory.CreateDirectory(subDir));
+            _dirProvider = new WritableDirProvider(Directory.CreateDirectory(subDir), hideRootDir: false);
         }
 
         [OneTimeTearDown]

Robust.UnitTesting/Shared/Toolshed/ToolshedValidationTest.cs

@@ -1,6 +1,7 @@
 using System;
 using System.Collections.Generic;
 using NUnit.Framework;
+using Robust.Shared.IoC;
 using Robust.Shared.Reflection;
 using Robust.Shared.Toolshed;
 using Robust.Shared.Toolshed.TypeParsers;
@@ -43,6 +44,7 @@ public sealed class ToolshedValidationTest : ToolshedTest
             foreach (var type in types)
             {
                 var instance = (ToolshedCommand)Activator.CreateInstance(type)!;
+                Server.Resolve<IDependencyCollection>().InjectDependencies(instance, oneOff: true);
                 Assert.Throws<InvalidCommandImplementation>(instance.Init, $"{type.PrettyName()} did not throw a {nameof(InvalidCommandImplementation)} exception");
             }
         });