FlowGate-Bridge 1.0.1

FlowGate-Bridge 1.0.1

A safety and reliability update to 1.0.0. The plugin remains a lightweight backend command-to-proxy bridge using the existing Bungee Connect format.

What's Changed

• Update from a Paper 1.21.11 snapshot API to stable Paper 26.3 build 194; remove obsolete development-server targeting and unnecessary Guava serialization.
• Add reproducible unshaded builds, regression tests, license packaging and automated release publishing.

Bug Fixes

• Preserve target-server case; normalize command names independently of the system locale.
• Keep working routes after invalid reloads, remove owned commands/aliases on reload or shutdown, and preserve other plugins' commands.
• Use Paper's public command map with legacy fallbacks; fix cleanup on command-map views that reject iterator removal.
• Clean up per-player cooldowns/channels and provide administrator tab completion.

Security Improvements

• Validate route types, command/target syntax, control characters, length and duplicate normalized commands.
• Add flowgatebridge.use (default true, preserving existing access) and a 500 ms per-player request cooldown.
• Keep messages outgoing-only and destinations configuration-bound. Command arguments cannot select arbitrary destinations or dispatch proxy console commands. Proxy-side permissions and backend trust remain essential.

Compatibility

• Minecraft Java 26.3 verified on Paper 26.3/194 with actual backend-to-proxy switching through BungeeCord 2104 + FlowGate Lite and Velocity 4.2.0/30 with its Bungee compatibility channel enabled.
• Current Paper requires Java 25; plugin bytecode remains Java 21 with api-version: 1.21. This is a backend plugin, not a proxy plugin.
• Validation: 5 passing regression tests, real protocol-777 switching, forged-client-message rejection and valid/invalid route reload/removal checks.

Installation / Updating

Stop the backend, back up the plugin/configuration, replace the old JAR with FlowGate-Bridge-1.0.1.jar, and restart. No configuration migration is required for valid routes. Commands allow letters, digits, _ and - (up to 64 characters); targets additionally allow . (up to 128). Match target case to the proxy configuration. Verify the SHA-256 file; source archives are not installable plugins. Secure backend access and configure forwarding according to your proxy's documentation.

Known Limitations

Proxy policy determines whether a switch succeeds; the existing protocol has no delivery acknowledgment. Tests used isolated offline-mode hosts and legacy forwarding for Velocity. Online-mode authentication, production forwarding setups, older Spigot/Paper, Folia, Citizens integration and sustained load were not tested.