FragStealers Changelog

26.2-6

Added

• Added a dedicated shop-search refresh listener that reads the active anvil rename text while the search is open.
• Added GitHub Actions validation builds for main, agent/** branches, pull requests, and manual runs.
• Added automated GitHub Release packaging with the compiled JAR and a SHA-256 checksum.
• Added stable and prerelease tag support, including tags such as 26.2-6-beta.1, 26.2-6-alpha.2, and 26.2-6-rc.1.
• Added push-triggered prerelease publishing from agent/** branches through a [prerelease VERSION] commit-message marker.
• Added UUID-based trusted-player access stored in trusted-players.yml.
• Added /fs trust <player> [access|manage] for granting or updating access on the protection the owner is targeting.
• Added /fs untrust <player> for removing access from the targeted protection.
• Added /fs trusted for listing trusted players and their access levels.
• Added the fragstealers.trust.manage permission with a default of true.
• Added access and manage trust levels.
• Added trusted access to ordinary protected locks.
• Added access-level shop restocking without stock withdrawal or payment collection.
• Added manage-level shop stock withdrawal, restocking, payment collection, and unconfigured-shop setup.
• Added access-level mailbox collection through a restricted pickup view.
• Added manage-level mailbox-content controls.
• Added automatic trust-entry cleanup when a lock, shop, or mailbox protection is removed.

Changed

• Changed shop-search confirmation to use the exact query stored on the result compass instead of rereading a potentially stale anvil field.
• Changed the anvil search input item to use a visually blank name with instructions in its lore.
• Changed release validation to compare prerelease tags against the base version in build.gradle.kts.
• Changed prerelease builds to apply the full prerelease version only inside the Actions workspace, leaving the source version at its stable base value.
• Changed release validation to verify the JAR filename, embedded plugin.yml version, and required resource files before upload.
• Changed trust commands to operate on the FragStealers sign or protected container the owner is looking at within six blocks.
• Changed shop management menus to distinguish owner, manage-level, access-level, customer, and Master Key access.
• Changed access-level trusted shop sessions to accept only the configured sale material.
• Changed access-level trusted mailbox pickup sessions to allow collection while blocking insertion and rearrangement.
• Changed active lock, shop, and mailbox sessions to recheck authorization so revoked trust is enforced without waiting for a reconnect.
• Changed the Gradle build to prepare the trusted-access source overlay before Java compilation.

Fixed

• Fixed issue #1 where the shop anvil search could open without producing a clickable result.
• Fixed synthetic anvil searches not reliably firing PrepareAnvilEvent by actively restoring the result compass when the rename query changes or vanilla clears the result slot.
• Fixed search results becoming inconsistent when the clicked compass and current rename text briefly differed.
• Fixed prerelease builds failing when a tag such as 26.2-6-beta.1 was used while the project source remained at 26.2-6.
• Fixed hotbar move-and-readd actions not being included in protected shop and mailbox inventory safeguards.
• Fixed the 26.2-6-beta.2 build failing because MailboxMenuService was missing a closing parenthesis when reading the active mailbox viewer.

Build and Release

• Development builds verify that exactly one FragStealers JAR is produced and that it contains plugin.yml and config.yml.
• Release builds generate FragStealers-<version>.jar and FragStealers-<version>.jar.sha256.
• Release automation accepts 26.2-6, v26.2-6, v.26.2-6, and supported prerelease equivalents.
• Release automation verifies that prerelease-suffixed tags are published as GitHub prereleases and stable tags are published as normal releases.
• Builds continue to use Java 25 and the pinned Paper API 26.2.build.62-beta.
• Added build-time preparation of the trusted-access source overlay before compileJava.
• Kept the project source version at the stable base version 26.2-6, allowing prerelease workflows to apply the full beta version only inside the build workspace.

Security

• Restricted trust-list changes to the protection owner; Master Key administrators cannot alter another player's trust list.
• Prevented trusted players from editing or removing protection signs.
• Prevented trusted players from breaking protected containers.
• Prevented trusted players from attaching an additional chest half to another player's protection.
• Prevented access-level shop users from removing stock through clicks, shift-clicks, number keys, offhand swaps, drops, cloning, or collect-to-cursor actions.
• Prevented access-level mailbox users from inserting or rearranging items through clicks, shift-clicks, hotbar swaps, offhand swaps, or inventory drags.
• Preserved Master Key-in-hand validation for active administrative inventory sessions.
• Continued rejecting Master Keys from shop stock and mailbox contents.

Documentation

• Rewrote the README as a server-owner and player usage guide.
• Added installation, configuration, commands, permissions, data-file, trust-level, shop, mailbox, Master Key, and audit-log documentation.
• Removed repository-development and automated-build instructions from the public-facing README.
• Reorganized the changelog into Added, Changed, Fixed, Security, Documentation, and Build and Release categories.