Fake Player Plugin 2.0 (FPP)

Added - /fpp spawn --location

- Admins (fpp.spawn) can now spawn a bot at an arbitrary spot instead of only their own location: /fpp spawn --location <x> <y> <z> <world>, combinable with --name. User-tier spawns (fpp.spawn.user) are unaffected and still always spawn at the sender's own location. Tab-completes coordinates and world names.

Improved - Left/Right-Click Overhaul

- Auto tool-switch: before mining a block, /fpp left-click now auto-equips the best available tool (highest tier of the right category - pickaxe/axe/shovel/hoe) already in the bot's inventory, the way a competent player would. Toggle via left-click.auto-tool-switch in config.yml (default on). Reuses the same tool-selection logic /fpp find's auto-mining already relied on, instead of a second copy of it. - Off-hand fallback for right-click: a bot's right-click now tries the main hand first and, only if that action had no effect, retries with the off-hand item - mirroring the vanilla client's own hand-loop exactly. Bots carrying a shield or food off-hand can now actually use it; previously the off-hand was never touched by right-click at all. - Fixed: a bare /fpp right-click <bot> (no --once/--repeat/--hold flag) skipped the mode-specific permission check entirely - a player holding only fpp.right-click.stop could still start a default click. Now always gated on the resolved mode's permission, matching left-click. - Fixed: /fpp right-click's task-resume path silently did nothing if its cached aim state was missing (e.g. after certain restart races) - the task stayed registered but never actually ran. It now rebuilds a fresh aim from the bot's own view and resumes normally, matching left-click. - Internal: LeftClickCommand/RightClickCommand now share one base class for aim geometry, stand-location search, and the stop/cleanup/save-restore lifecycle instead of two nearly-identical ~1000-line copies; the three parallel ONCE/REPEAT/HOLD/STOP mode enums collapsed into one.

Added — Bot Auth System

Bots can now play along with a login-wall plugin instead of sitting there unauthenticated. Off by default (auth.enabled: false); needs database.enabled: true to remember passwords across joins. - Auto-register / auto-login: on a bot's first join it generates a strong random password, encrypts and stores it (AES-256/GCM, key in auth.key in the plugin data folder, never in config.yml or logs), then sends auth.register-command as the bot after a randomized human-like delay. Every later join sends auth.login-command with the same remembered password instead. - Works against any login plugin built around a /register <password> <password> / /login <password> command shape — the defaults already match nLogin, AuthMe, LoginSecurity, CrazyLogin, and xAuth. Commands are replayed exactly like a real client's typed chat command (through PlayerCommandPreprocessEvent), not a bare command dispatch, so plugins that hook that event directly (most login plugins, including nLogin) still see the attempt. - Dedicated nLogin integration: nLogin's command path throws for a bot's connection no matter what, so it's authenticated through nLogin's own public API instead — fully optional, inert if nLogin isn't installed. - A bot stands still and doesn't turn its head from the moment it joins until its register/login outcome is known (read from the login plugin's own reply — chat, title, subtitle, or action bar), exactly like a real not-yet-authenticated player; auth.pending-timeout-ticks is the hard fallback so an unrecognized response never leaves a bot stuck frozen. - New `/fpp auth` command: on/off, status [bot], reset <bot>, setpassword <bot> <password>. New permission fpp.auth (default op, included in fpp.op). - New settings GUI category (🔐 ᴀᴜᴛʜ): toggle, register/login command templates, delay/timeout ticks, and password length/complexity — see [Configuration](Configuration).

Added — "Bot Console" Color Theme

Every chat message, GUI, and console log now pulls from one consistent violet/lime palette instead of the scattered ad-hoc colors (blue accents, plain named colors, mismatched grays) used previously. Purely visual — no config or permission changes. - Chat/GUI text: violet (#A78BFA) primary accent, lime (#BAFF4F) success/highlight, red (#FF6A5C) errors, plus a consistent ink/mute/mute-2/line neutral scale for body text, captions, and dividers. - Console output (FppLogger, the startup/shutdown banners) recolored to match with true-color ANSI. - language/en.yml's header now documents the full palette for anyone customizing messages by hand.

Added — Auth & Perf Settings/Help Categories

- The settings GUI (/fpp settings) gained a 🔐 ᴀᴜᴛʜ and a 📈 ᴘᴇʀꜰ category (general, body, auth, perf, debug) — the perf category exposes every performance.* config option, including the self-profiler, with changes restarting the monitor live instead of requiring /fpp reload. - The help GUI (/fpp help) split auth and perf out of the catch-all ᴄᴏʀᴇ category into their own tabs, each with a distinct accent color.

Added — Multitasking (Reverses the v2.0.0 Single-Action System)

Bots can now run multiple tasks at once instead of being limited to one. Starting a new task no longer cancels every other running task for that bot — move, find, left-click, right-click, attack, and PVE auto-combat are now independent systems that can all be active on the same bot simultaneously, the same way auto-eat already ran alongside a paused task. - PVE always runs. Auto-combat no longer stands down while a manual task is active; it only ever chases a target when nothing else currently owns the bot's movement. - Movement is arbitrated by priority, not cancellation. Only one navigation can drive the bot at a time: an explicit /fpp move always gets it, a manual hand-action's short walk-to-reach (left-click/right-click/find) outranks background movement (PVE's chase), and background movement never interrupts anything. A request that loses out declines gracefully instead of hijacking the bot mid-walk. - `/fpp find` no longer collides with `/fpp left-click` — each now has its own navigation owner. - Auto-eat is fully parallel when eating from the off-hand — mining, moving, and combat all continue untouched. Only the main-hand fallback still pauses briefly. - Restart persistence now resumes both click tasks if a bot had left-click and right-click both active when the server stopped, instead of restoring only one. - Every command's cleanup is now scoped to what it actually owns, so stopping one task can no longer silently cancel an unrelated concurrent task's navigation. What this doesn't change: a bot still has one head and one main hand — two hand-actions aimed at different targets will still visibly alternate the bot's aim between them each tick.

Added — Configurable Left/Right-Click Interval

The pacing of held /fpp left-click//fpp right-click automation (--repeat/--hold) is no longer a fixed constant — it's a server-wide default that every bot can individually override. - New config options: left-click.interval-ticks (default 4, matches vanilla's own block destroyDelay) and right-click.interval-ticks (default 4, matches the vanilla client's own rightClickDelay) in config.yml. Entity attacks are unaffected either way — those are still paced solely by the held weapon's real attack-speed cooldown, exactly like a real player. - Per-bot override: each bot's ⚙ ɢᴇɴᴇʀᴀʟ settings category now has ʟᴇꜰᴛ-ᴄʟɪᴄᴋ ɪɴᴛᴇʀᴠᴀʟ and ʀɪɢʜᴛ-ᴄʟɪᴄᴋ ɪɴᴛᴇʀᴠᴀʟ tiles (1–40 ticks); leaving a bot on the global default requires no configuration. Overrides persist across restarts (YAML and database, schema bumped to v27). - No new permission node — gated by the existing fpp.settings bot-ownership model, same as chunk-load-radius and the PVE range tile.

Fixed — Dead fpp.mine.* Permission Nodes

Removed fpp.mine, fpp.mine.start, fpp.mine.once, fpp.mine.stop, fpp.mine.area — leftovers from the old /fpp mine command that was replaced by /fpp left-click//fpp right-click several versions ago. They were still being silently granted through fpp.op's children list without ever having their own permission declaration, and nothing in the codebase checked them. A full audit confirmed every other permission in Perm.java now has exactly one plugin.yml declaration with no dangling wildcard references.

Added — Bot Rental Economy

Players can now pay real economy currency to rent a bot for a set number of hours; the bot auto-despawns the moment its paid time runs out. Off by default (economy.enabled: false). - New `/fpp rent` command family: buy <hours>, extend <bot> <hours>, info [bot], give <player> <bot|--new> <hours> (grant hours without charging — console-usable), clear <bot>. - Provider-agnostic economy layer: reflective, soft-dependency support for Vault, [Vault2.0](https://github.com/shalom25/Vault2.0) (same Economy interface, transparently covered by the Vault provider), and ExcellentEconomy (own API, configurable currency id), with zero compile-time dependency on any of them. - Shop-plugin friendly: /fpp rent give never touches an economy plugin itself — any shop plugin can run it as a purchase's console reward command with no FPP-side integration needed. - Expiry sweep: warns the owner before time runs out, then despawns safely at zero. fpp.rent.unlimited exempts a player's bots from expiring. - Settings GUI tile (⚙ ɢᴇɴᴇʀᴀʟ → ʀᴇɴᴛᴀʟ ᴛɪᴍᴇ) and new placeholders %fpp_rental_count%, %fpp_rental_remaining%. Persists across restarts (YAML + DB, schema bumped to v26). - New permissions: fpp.rent/fpp.rent.info (in fpp.use), fpp.rent.give, fpp.rent.unlimited (both default op). New wiki page: [Economy](Economy).

Hardened — Vanilla Nametag Hiding Now Self-Heals Unconditionally

The bot's real name is hidden via a packet-only scoreboard team, but anything that puts a bot on a different team (another plugin, an admin's /scoreboard teams join, …) silently evicts it, bringing the real name back. The re-assertion now fires on every nametag-refresh sweep (~10 ticks) for every active bot unconditionally, instead of only when the activity label changed — the hide no longer lapses for more than one sweep interval, regardless of cause.

v2.0.3 (Beta)

Fixed — Left-Click Mining Could Get a Bot Kicked ("Invalid Entity Attacked")

- While mining, a held left-click resolves its target with the same combined block+entity ray a real client uses — but unlike a real client, nothing stopped it from picking a **dropped item, XP orb, or arrow** floating near the block it was breaking and sending an attack packet at it. The vanilla server disconnects any client that attacks one of those (multiplayer.disconnect.invalid_entity_attacked) — a real client's own UI never lets you target them with left-click, so this path only existed because a bot drives raw packets directly. The crosshair ray trace in LeftClickCommand now excludes Item, ExperienceOrb, and AbstractArrow from valid attack targets, matching what AttackCommand's ray trace (via Entity#isAttackable()) already did.

Fixed — Bot Nametag Could Be Permanently Lost

- The bot's floating name tag is a real world entity (a TextDisplay), so anything capable of removing an entity — /kill, WorldEdit, another plugin's cleanup pass — could remove it. The periodic refresh loop only checked whether its cached reference was null, not whether the entity was still valid, so an externally-removed tag never came back. It now checks isValid() and respawns the tag within half a second (10 ticks) of it disappearing, making the tag effectively unremovable instead of merely "usually present."

Added — ViaVersion-Aware Bot Connections

- A bot's connection never performs a real handshake/login, so ViaVersion (when installed) had no record of it — any lookup of the bot's protocol version came back empty, which is the source of console warnings about not being able to determine a bot's client version. Bots are now registered with Via's connection manager as running the server's own native protocol version (i.e. "no translation needed"), using the same UserConnectionImpl + ProtocolPipelineImpl construction Via's own channel initializer uses for a real connection, and unregistered again on despawn. Entirely reflective and a no-op if ViaVersion isn't installed or its internals ever change shape.

v2.0.2 (Beta)

Fixed — Permissions No Longer Bypass LuckPerms

- Removed the hard-coded player.isOp() shortcuts (Perm.hasOrOp, BotAccess.isAdmin, BotListGui.isAdmin, BotSettingGui.isOp) that granted admin access to server operators even when a permissions plugin like LuckPerms explicitly denied the relevant fpp.* node. Every permission check now goes through hasPermission() only, so LuckPerms grants/denies are always respected, operators included. - Fixed canUse() gates that were stricter than the granular permission nodes they were meant to allow — players granted only fpp.left-click.once/.stop, fpp.right-click.once/.stop, fpp.despawn.own, fpp.move.to/.coords, or fpp.inventory.own were previously blocked at the command dispatcher before those fine-grained nodes were ever checked. - Added the missing fpp.inventory.own permission constant and wired it into the /fpp inventory command and the right-click-to-open-inventory listener — this node was documented in plugin.yml but had no effect at all.

Fixed — Folia Compatibility

- Fixed a TickThread crash ("Accessing entity state off owning region's thread") when refreshing a bot's floating name-tag activity line. The nametag refresh loop now dispatches to each bot's owning region thread on Folia instead of running on the global region thread. - Fixed bots showing their vanilla over-head name doubled up with the custom name-tag display on Folia. Folia's Scoreboard/Team API is a documented gap (global state the project hasn't implemented for regionised ticking), so hiding the vanilla name no longer touches Bukkit.getScoreboardManager()/Team at all — a PlayerTeam is built directly from NMS and its ClientboundSetPlayerTeamPackets are sent straight down each viewer's connection. - Fixed a client-crashing bug in that same rework: sending a "remove from team" packet for a bot whose name had never actually been added (e.g. a second bot's very first spawn) made the vanilla client throw and disconnect ("Network Protocol Error"). The plugin now only sends a removal for a name it actually tracked as hidden. - Fixed onDisable() crashing on Folia with IllegalPluginAccessException ("Plugin attempted to register task while disabled") when despawning bots during shutdown. FppScheduler now detects a disabled plugin and runs the work directly instead of scheduling it — safe, since Folia halts all region ticking before onDisable() runs. - Fixed Head-AI being hard-disabled on Folia entirely. The restriction predated the current per-bot region-thread dispatch and was never removed after the rest of the tick loop became Folia-safe; it now runs on Folia the same as on Paper.

Changed — /fpp spawn Is Now In-Game Only

- /fpp spawn can no longer be run from the server console (or dispatched as console) — it requires a real player sender, matching most other bot commands. - Removed world/coordinate targeting (/fpp spawn <world> [x y z]) — a bot always spawns at the commanding player's own location now. The fpp.spawn.coords permission node is gone along with it.

Performance

- Removed reflective Method.invoke() calls from every hot per-tick NMS path in NmsPlayerSpawner (doTick(), getHandle(), and everything built on it — setJumping, setHeadYaw, setMovementForward, setMovementStrafe, applyServerVelocity, and more) in favor of direct calls. ServerPlayer.tickPhysics()'s doTick() invocation alone accounted for ~69% of the plugin's own profiled self-time in benchmark reports; this scales linearly with bot count, so the win grows with server size.

v2.0.1 (Beta)

Changed — Left/Right-Click Are Now Real Clicks (Authentic Serverbound Packets)

The bot left-click and right-click systems no longer re-implement what the server does on a click. Every action is now dispatched as an authentic serverbound packet through the bot's real packet handler (FakeServerGamePacketListenerImpl), so the server performs the click exactly as it does for a real player — full reach/anti-cheat validation, native Bukkit events (BlockBreakEvent, PlayerInteractEvent, PlayerInteractEntityEvent, …), item durability, hunger, use-timing and every item's own behaviour. - New `BotClickDispatcher` builds and dispatches ServerboundPlayerActionPacket (dig), ServerboundAttackPacket, ServerboundInteractPacket, ServerboundUseItemOnPacket, ServerboundUseItemPacket and ServerboundSwingPacket through the connection's live handle* methods. It first sends a ServerboundPlayerLoadedPacket (what a real client sends) so the server's hasClientLoaded() gate lets bot interactions through. - Left-click mining now sends START_DESTROY_BLOCK and lets the server drive destroy progress, sending STOP_DESTROY_BLOCK on a client-faithful predictor (creative/instant-break complete on the START tick). Removed the hand-rolled progress loop and direct gameMode.destroyBlock calls. - Left-click attacks go through the real attack packet (respecting the attack-strength cooldown), replacing the performAttack + forced-attack-ticker hack. - Right-click routes block use, item use and entity interaction through the real handlers, and deletes the fake shortcuts: directly setType-ing planted crops from a hardcoded seed→crop table, applyBoneMeal, and the manual place/plant/bonemeal branches. The server's useItemOn now handles placement, planting, bone meal, hoeing, bucket use, etc. natively for any item. - Protection plugins (WorldGuard, etc.) now block bot clicks the same way they block real players, since the real events fire. - 1:1 vanilla click resolution — the bot's clicks now resolve targets exactly like a real client's pick: the combined block+entity ray from the bot's own eyes, nearest hit wins. Left-click attacks the entity directly under the crosshair (paced by the real attack-speed attribute) or digs the block; right-click interacts with the entity under the crosshair (armor-stand equip, feeding, breeding, trading, mounting) and, when that PASSes, falls through to the in-hand item use — the same order Minecraft.startUseItem follows. Removed all non-vanilla targeting: sender-aim entity picks (rayTraceHostileEntity, rayTraceEntity, the right-click rayTraceTargetPlayer entity branch), the left-click forward-cone auto-attack (findBestMobTarget), and target lock-on. An entity behind the aimed block is never picked; the sender's crosshair only designates which block to work on. - Full debug tracing — new left-click / left-click-head debug categories (in debug.yml, plus Config.debugLeftClick()/debugLeftClickHead()) mirroring right-click. Both systems now log the whole pipeline: target resolution, navigation, every dispatched packet (dig START/STOP/ABORT, attack, useItemOn, useItem, entity interact), consume detection and stop/cleanup.

Fixed — Use Packets Silently Dropped by the Spam Limiter + Aim Drift

Two bugs that made --hold/--repeat clicks stop working after a few seconds: - Spam-limiter drop — handleUseItem/handleUseItemOn feed the packet's Spigot-added timestamp field into Paper's incoming-packet spam limiter (checkLimit). Directly-constructed packets leave that field 0, which looks like "no time passed since the last packet", so after ~8 uses the server permanently dropped every use packet (eating, placing, doors — everything). BotClickDispatcher now stamps System.currentTimeMillis() onto ServerboundUseItemPacket/ServerboundUseItemOnPacket (reflection-probed, no-op if the field ever disappears), so the limiter sees real inter-packet timing exactly as for a networked client. - Aim tracking — the bot's head was rotated once when the command started and could drift off the commanded target (knockback, entity interactions), leaving it staring at the wrong block forever. Both click loops now **re-aim at the commanded target every tick** (new aimTarget/aimPoint in the click state, never overwritten by transient per-tick picks): a passing entity still gets vanilla nearest-hit treatment, and the moment it's gone the crosshair is back on the commanded block.

Fixed — Left-Click Resumes Mining After the Crosshair Leaves an Entity

Block re-resolution in the left-click loop was gated behind a "dynamic target" flag that was false when the click started without a block pick (entity in front of the crosshair, a resumed task after restart, or a plain self-view click) — so once the entity was gone, the bot stopped instead of mining the block now under its crosshair. The loop now re-resolves the block pick unconditionally every tick, matching a real held click: entity in front → attack it; entity gone → seamlessly dig whatever the crosshair sees. The dead flag was removed.

Fixed — Full Weapon Damage & Right-Click Arm Swings

- Attacks now use the held weapon's real damage — bots aren't driven by the normal player tick path, so two things a real client gets for free never happened: the held weapon's attribute modifiers were never registered (ATTACK_DAMAGE stayed at fist level) and the attack-strength ticker never advanced (every hit was scaled to the ~20% spam-click minimum → a sword dealt ~1 damage). BotClickDispatcher.attack now calls detectEquipmentUpdates() and primes the attack-strength ticker before each attack; since the click loop already paces attacks at the real weapon cooldown, every hit lands at full strength — sword/axe damage, sweep, knockback and enchantments all apply. - Right-click now swings the arm — the server only broadcasts SERVER-sourced swings; for most interactions the vanilla client swings itself, which a bot has no client to do. The bot now sends its own swing on every consumed right-click (buttons, levers, bone meal, planting, placing, entity interactions) and on instant item uses (throwing pearls/eggs) — but not when a multi-tick use starts (eating, bow draw), matching the vanilla client exactly.

Fixed — Bots No Longer Lose Inventory & Active Task Across Restarts

Two persistence defects made every server restart / plugin update wipe bot inventories and running tasks: - Inventory/XP restore was a one-shot timer — applied a fixed 10–12 ticks after the restore chain spawned the bot, with a silent give-up if the body hadn't finished spawning yet (typical right after startup while chunks load). Both now use a retry loop (every 5 ticks, up to 30 s) that waits until the bot is online + valid, and log a warning instead of silently dropping if the bot never spawns. - Task persistence was hollow since the click-system migration — the task snapshot hardcoded every field to null/0 ("legacy mine/use/place removed") and the restore hook was an empty stub, so the active task was lost by design. The persistence layer now saves each bot's active left/right-click task (mode + world + exact aim point) to both the unified YAML and the fpp_bot_tasks DB table (LEFT_CLICK/RIGHT_CLICK rows), and resumes it after the restart: once the bot is fully spawned and its inventory (tools!) is restored, it re-aims at the saved point and restarts the same click mode via the normal task pipeline. New SavedClickTask snapshot + getSavedTask/resumeSavedTask APIs on both click commands; the dead 30-field legacy task model was replaced with a compact one.

Fixed — Block Interactions Blocked by the Unconfirmed-Teleport Gate

handleUseItemOn refuses every block interaction while `awaitingPos

v2.0.0

Added — Minecraft 26.2 Support

- Added support for Minecraft 26.2.x (Chaos Cubed). - CompatibilityChecker now supports 26.1.x and 26.2.x, while older versions remain supported up to 1.21.11. - Updated version warnings and documentation. - Continues compiling against Paper 26.1.2 while remaining compatible with 26.2.

Version 2.0

- Updated plugin version from 1.6.6.12.8 to 2.0.0. - Moved the Personality API into the core plugin.

Fixed — Right-Click Interaction

- Bots now only activate buttons, levers, and switches when directly aiming at them. - Clicking the block they are attached to no longer activates them.

Added — Better Out-of-Reach Clicking

- Bots now try to move near the player's position before searching around the target. - Console and bot-issued commands still use the original behavior. - Commands still report "no path" if no valid location is found.

Changed — Accurate Clicking

- Bots now click the exact point the player is aiming at instead of the center of the block. - The aim remains accurate even after moving. - Falls back to the block-face center if an exact hit point isn't available.

Documentation

- Updated the README, wiki, FAQ, configuration, permissions, placeholders, and other documentation. - Removed outdated information and references to removed features.

Permissions

- Removed the unused fpp.farm permission. - Added missing permissions to the admin wildcard. - Clarified how per-bot GUI permissions work.

Added — Task Pause & Single-Action System

- Bots can now perform only one task at a time. - Starting a new task automatically stops the current one. - Auto-combat pauses during manual tasks and resumes afterward. - Added a pause/resume system that allows interrupted tasks to continue where they left off.

Overhauled — Auto-Eat

- Replaced the old instant-eat system with a full Auto-Eat Controller. - Added: - Per-bot enable/disable toggle. - Configurable hunger threshold. - Selectable allowed foods. - Food priority (off-hand → hotbar → inventory). - Bots now eat naturally, pause their current task, then resume it afterward. - Nametags show when a bot is eating. - Auto-eat settings are saved across restarts.

v1.0.0 (2026-03-08)

- First stable release - Full permission system with fpp.user.*, fpp.bot.<num> limit nodes, and LuckPerms support - User-tier commands: /fpp spawn, /fpp tph, /fpp info (own bots only) - Bot persistence across server restarts (leave on shutdown, rejoin on startup at last position) - O(1) entity lookup via entity-id index (performance) - Reflection hot-path caching in PacketHelper (no per-call method scanning) - Allocation-free BotChatAI sync loop - Reservoir-sampling name picker (no full candidate list allocation per spawn) - Config default values aligned with config.yml; removed deprecated showSkin() method - Cleaned config.yml: removed unused spawn-count-presets.user section, fixed all comment inaccuracies