FakePlayer-CE.Build10

FakePlayer-CE.Build10

HTTP Admin API & Corrected Kick/Kill Semantics
This release introduces a built-in HTTP admin API for remote management (/list, /spawn, /kick, /kill, /say, with token auth and call logging), corrects the long-standing kick/kill semantics (/fp kill now truly kills, removal moves to /fp kick), and fixes the /fp say single-argument fallback.

Highlights

• Built-in HTTP Admin API: Optional remote management for web panels and automation — GET /list, /spawn, /kick, /kill, /say. Token auth via ?token= or Authorization: Bearer; every endpoint has its own switch under http-admin.interface; all calls are logged to the console with the token redacted.
• Corrected Kick/Kill Semantics: /fp kick (single) / /fp kickall (all) now take over the "remove" behavior, while /fp kill / /fp killall truly kill fake players through the real death flow and follow the kick-on-dead config.
• /fp say Single-Argument Fallback: /fp say once 1234 works again — a lone argument is treated as the message instead of a fake player name.

Breaking Changes

• /fp kill / /fp killall used to remove fake players; they now truly kill them (real death flow via setHealth(0)). Scripts and habits built on the old removal behavior should switch to /fp kick / /fp kickall.
• New permission node fakeplayer.command.kick; the fakeplayer.spawn permission group now grants kick instead of kill (the latter now gates the real kill commands).

Critical Fixes

• Fixed HTTP query parameters not being URL-decoded: messages with Chinese characters, spaces and other special characters (URL-encoded) now parse correctly — also fixes /spawn?name=中文名.
• Fixed thread safety of HTTP handlers: /kill and /say are dispatched to the main thread via Bukkit.getScheduler().callSyncMethod, no longer touching Bukkit API from HTTP worker threads.

Important Notes

• http-admin is disabled by default. If token is left empty, a random token is generated at startup and printed to the console; prefer the Authorization: Bearer header over ?token= (URLs are often logged by proxies) and restrict access at the firewall level.
• /fp kill follows kick-on-dead: by default the fake player is removed right after death (no loot); with kick-on-dead: false the corpse stays and can be revived via /fp respawn with normal loot rules.
• Repository layout only: version modules are consolidated under versions/ (no runtime impact).

Usage

• Java: 21+ (Java 25 recommended for 26.x support)
• Server: Paper / Leaf 1.20.1+ (Purpur compatible)
• API: CommandAPI 12.0.0+ (Mandatory dependency)

Credits

• CE Maintenance: @EndlessPixel

---

FakePlayer-CE.Build10 —— HTTP 远程管理接口与踢出/击杀语义修正

本次更新引入内置 HTTP 远程管理接口（/list、/spawn、/kick、/kill、/say，支持 token 鉴权与调用日志），修正长期存在的"踢出/击杀"语义混淆（/fp kill 现为真正杀死，移除功能交由 /fp kick），并修复 /fp say 单参数回退问题。

核心特性

• 内置 HTTP 管理接口：可选的远程管理能力，适用于 Web 面板与自动化脚本 —— GET /list、/spawn、/kick、/kill、/say。通过 ?token= 或 Authorization: Bearer 鉴权；各接口在 http-admin.interface 下独立开关；所有调用均输出控制台日志（token 已脱敏）。
• 踢出/击杀语义修正：/fp kick（单个）/ /fp kickall（批量）承接"移除假人"，/fp kill / /fp killall 则通过真实死亡流程真正击杀假人，并遵循 kick-on-dead 配置。
• /fp say 单参数回退：/fp say once 1234 恢复正常 —— 单独一个参数会被当作文本消息，而不是假人名。

破坏性变更

• /fp kill / /fp killall 原为"移除假人"，现为"真正杀死"（通过 setHealth(0) 走真实死亡流程）。依赖旧移除行为的脚本与习惯请改用 /fp kick / /fp kickall。
• 新增权限节点 fakeplayer.command.kick；fakeplayer.spawn 权限组现授予 kick 而非 kill（kill 现在对应真杀死命令）。

关键修复

• 修复 HTTP 参数未做 URL 解码：携带中文、空格等特殊字符（经 URL 编码）的消息现在可正确解析 —— 同时修复 /spawn?name=中文名。
• 修复 HTTP 处理线程的线程安全问题：/kill、/say 现通过 Bukkit.getScheduler().callSyncMethod 调度到主线程执行，不再从 HTTP 工作线程直接调用 Bukkit API。

重要说明

• http-admin 默认关闭。token 留空时启动会随机生成并打印到控制台；建议优先使用 Authorization: Bearer 请求头而非 URL 传递 token（URL 常被代理记录），并配合防火墙限制访问来源。
• /fp kill 遵循 kick-on-dead 配置：默认假人死亡后即被移除（不掉落物品）；kick-on-dead: false 时保留尸体，可用 /fp respawn 复活，掉落按服务端规则生效。
• 仓库结构变化：版本兼容模块统一收纳于 versions/ 目录（运行时无影响）。

使用要求

• Java: 21+（26.x 建议 Java 25）
• 服务端: Paper / Leaf 1.20.1+（兼容 Purpur）
• 前置依赖: CommandAPI 12.0.0 及以上（必需）

鸣谢

• CE 维护: @EndlessPixel