FragStealers

26.2-6-beta.2

Full Changelog: https://github.com/mccreeper1318/fragstealers/compare/26.2-6-beta.1...26.2-6-beta.2

Added

• Added UUID-based trusted-player access stored in trusted-players.yml.
• Added /fs trust <player> [access|manage] for granting or updating access on the protection the owner is targeting.
• Added /fs untrust <player> for removing access from the targeted protection.
• Added /fs trusted for listing trusted players and their access levels.
• Added the fragstealers.trust.manage permission with a default of true.
• Added access and manage trust levels.
• Added trusted access to ordinary protected locks.
• Added access-level shop restocking without stock withdrawal or payment collection.
• Added manage-level shop stock withdrawal, restocking, payment collection, and unconfigured-shop setup.
• Added access-level mailbox collection through a restricted pickup view.
• Added manage-level mailbox-content controls.
• Added automatic trust-entry cleanup when a lock, shop, or mailbox protection is removed.

Changed

• Changed trust commands to operate on the FragStealers sign or protected container the owner is looking at within six blocks.
• Changed shop management menus to distinguish owner, manage-level, access-level, customer, and Master Key access.
• Changed access-level trusted shop sessions to accept only the configured sale material.
• Changed access-level trusted mailbox pickup sessions to allow collection while blocking insertion and rearrangement.
• Changed active lock, shop, and mailbox sessions to recheck authorization so revoked trust is enforced without waiting for a reconnect.
• Changed the Gradle build to prepare the trusted-access source overlay before Java compilation.

Fixed

• Fixed hotbar move-and-readd actions not being included in protected shop and mailbox inventory safeguards.
• Fixed the 26.2-6-beta.2 build failing because MailboxMenuService was missing a closing parenthesis when reading the active mailbox viewer.

Security

• Restricted trust-list changes to the protection owner; Master Key administrators cannot alter another player's trust list.
• Prevented trusted players from editing or removing protection signs.
• Prevented trusted players from breaking protected containers.
• Prevented trusted players from attaching an additional chest half to another player's protection.
• Prevented access-level shop users from removing stock through clicks, shift-clicks, number keys, offhand swaps, drops, cloning, or collect-to-cursor actions.
• Prevented access-level mailbox users from inserting or rearranging items through clicks, shift-clicks, hotbar swaps, offhand swaps, or inventory drags.
• Preserved Master Key-in-hand validation for active administrative inventory sessions.
• Continued rejecting Master Keys from shop stock and mailbox contents.

Documentation

• Rewrote the README as a server-owner and player usage guide.
• Added installation, configuration, commands, permissions, data-file, trust-level, shop, mailbox, Master Key, and audit-log documentation.
• Removed repository-development and automated-build instructions from the public-facing README.
• Reorganized the changelog into Added, Changed, Fixed, Security, Documentation, and Build and Release categories.
• Split the 26.2-6 prerelease history into separate 26.2-6-beta.1 and 26.2-6-beta.2 sections.

Build and Release

• Builds continue to use Java 25 and the pinned Paper API 26.2.build.62-beta.
• Added build-time preparation of the trusted-access source overlay before compileJava.
• Kept the project source version at the stable base version 26.2-6, allowing prerelease workflows to apply the full beta version only inside the build workspace.

Beta builds are considered unstable and may have unforseen bugs.

These are for testing and bug reporting only. Use release stable builds for public servers. If you do see any bugs or have any problems with the plugin or even suggestions, please visit the github and create an issue report.