CommandBridge

this update adds a public developer API for third-party plugins, hardens auth security, and fixes a bunch of stability issues across the board.

so whats new:

developer API

• new api module for third-party plugin integration, available on maven central
• typed message channels via CommandBridgeAPI.channel(Class) with send, request, broadcast, and listen
• delivery conditions on senders: requirePlayer(UUID) to gate on player presence, whenOnline(UUID) to queue until the player connects
• server lifecycle events via onServerConnected and onServerDisconnected (proxy only)
• connection state tracking via onConnectionStateChanged (all platforms)
• player locator service for resolving which server a player is on (proxy only)
• CommandBridgeProvider.get() and CommandBridgeProvider.get(Class) to obtain the API instance
• proxy-only methods return Optional<Subscription> instead of raw Subscription, returning Optional.empty() on backends
• full JDK-style JavaDocs across all API types

security

• hardened auth flow with constant-time HMAC comparison to prevent timing attacks
• fixed AUTH_OK race condition where messages could be sent before the client processed auth success
• added reconnect on failed server proof verification
• operator execution no longer grants wildcard permissions, only explicit ones

fixes

• fixed cooldown being applied before dispatch instead of after
• fixed MiniMessage tags in error messages not being escaped
• fixed script reload not being thread-safe
• fixed player join events firing for already-tracked players
• fixed polling not being reset on shutdown
• fixed auth check missing on config reload
• fixed Log varargs handling for single-argument messages
• fixed config name not being passed to ConfigManager in the velocity backend adapter
• fixed operator permission resolution being inconsistent across platform executors
• left-aligned all chat UI output and removed pixel-width centering
• various null guard and stability improvements across dispatch, registration, and player tracking

internals

• modernized codebase to java 21 idioms
• rebuilt test suite from scratch with 136 tests across core, velocity, and backends
• added CI test workflow and testing documentation

breaking changes:

• RunAs and ConnectionState moved to the api package, internal duplicates removed

latest commit: d7f43a1

this update is mostly about migration tooling, better player resolution, and support/debug quality of life. also had some internal cleanup and an important fix for velocity running in client mode.

so whats new:

• added /cb dump for support snapshots (sanitized upload + local file export)
• added /cb migrate to migrate script files to the current schema
• migration is script-only now. there was a short config migration path but that got reverted again
• added player-arg per command for target-required and schedule-online
• added remote uuid resolving between connected proxies (RESOLVE_UUID) + local UserCache + Mojang fallback
• added OFFLINE_PLAYER argument type with suggestions support
• reworked schedule-online / player tracking flow to be more reliable and added clearer warning logs when player resolution fails
• fixed double command descriptions in command registration output
• fixed velocity client mode startup crash (ClassNotFoundException: org.bukkit.command.CommandSender)

breaking changes:

• scripts now require version: 4
• older scripts must be migrated first
• internal runtime files moved into the data/ subdirectory

latest commit: e951a9e

this version brings some nice additions mostly around target-required and player tracking across proxies. the wiki has been fully rewritten for this version so make sure to check that out.

so whats new:

• target-required per command option. this makes sure the player is actually on the target server before dispatching the command. also works when a proxy is in client mode so it checks across all connected proxies not just the local one
• per-command cooldowns, the old pipeline cooldown stage is gone
• player presence tracking. backends and client mode proxies now sync their player lists to the proxy. the full list only gets sent once on auth and after that only join/leave deltas get sent so you dont have to worry about huge packets even with like 30k players
• added PLAYERS argument type for velocity
• scripts now require version 3

breaking changes:

• removed Server.timeout from the config
• removed some unused config values
• script version 3 is now required, older versions wont work anymore

latest commit: 37b29f5

well this is a big version jump because it has major rewrites to support a second backend. what do I mean by that? CommandBridge was(or still is) being powered by Websockets. but some users asked for the feature to implement redis. So here it is:

• full redis support as transport layer
• you can either use websockets or redis depends on what you select in the config

so big version because the config has major changes and the plugin architecture

fixed:

• example.yml was incorrect
• commandapi unregistration on shutdown threw exceptions

added:

• modrinth api - update checker