PlugMaster

First release.

PlugMaster keeps your plugins up to date, controls them at runtime, and can fetch new ones - all from in game, all without a restart you did not ask for.

Updates

• Modrinth matching over the SHA-1 of the installed file, every plugin in one bulk request, per-project fallback when the bulk endpoint answers with a channel that is not allowed
• Hangar matching in two stages: the website entry of the plugin.yml first, then a name search that is only accepted on an unambiguous hit, with the project owner checked against the plugin authors
• Downloads are capped during the transfer, then verified by checksum and by the plugin name inside the jar before anything is parked
• Parked updates are applied by the server on its next start; on BungeeCord PlugMaster applies them itself when the proxy shuts down

Control

• /pm list, /pm info, /pm enable, /pm disable, /pm load, /pm unload, /pm reload
• Enable and disable use public Bukkit API only; unload and reload additionally clean up listeners, tasks, services, commands, the dependency graph and the plugin classloader
• Works on both plugin systems: SimplePluginManager on Bukkit, Spigot and Paper up to 1.20.4, and Paper's own manager on 1.20.5 and newer. Where neither is found it refuses before touching the plugin instead of half unloading it

Installing something new (off by default)

• /pm search finds plugins on Modrinth that fit this server's loader and version
• /pm download fetches one into plugins/ and stops there; it does nothing until you load it or restart
• Separate permission, plugmaster.download, and a separate switch in config.yml

One jar for Bukkit, Spigot, Paper, Purpur, Folia, BungeeCord and Waterfall. The only bundled library is bStats, relocated; the JSON and YAML parsers are part of the project.

Tested against Paper 1.21.11 and Paper 1.20.6: the whole command set driven through the console, including two reloads in a row and a real download, with no exceptions. BungeeCord has not been through a live proxy yet, and the Hangar field names are reconstructed rather than verified against a recorded response.