SunshineCommandGuard 2.0.1

Privacy fix for the Live Web Editor. Recommended for everyone who uses /cmdguard editor.

Fixed

• /cmdguard editor no longer uploads secrets. Your pro-key and monitoring.discord.webhook-url are blanked before config.yml is sent to the web editor. /cmdguard apply puts your local values back, so applying a web config never wipes them. A value you type into the web editor still wins.
• /cmdguard editor refuses to upload a config.yml that is not valid YAML and tells you to fix it first, instead of sending the raw file.
• Commands from your server now show up in the web editor. Before, the editor could fall back to its demo command list.

If you ran /cmdguard editor on 2.0.0 with a Discord webhook configured, create a new webhook in Discord and replace the old URL.

This release also contains everything from 2.0.0:

2.0.0

Migration, integrations, a Live Web Command Editor, and execution-level argument filtering.

Upgrade notes

• Argument rules now block execution. args rules previously filtered only tab-completion; starting in 2.0.0, the first argument of an allowed command is checked when it runs as well. Review your args sections and test with /cmdguard test <player> <command> <arg> before upgrading a live server.
• API: BlockReason has a new constant, ARGUMENT_RULE.
• Existing config.yml files continue to work without changes.

Added

• Live Web Command Editor (/cmdguard editor & /cmdguard apply <code>): uploads your server's registered commands and current config.yml to https://sunshine-mc.net/en/cmdguard/ so you can allow, hide, or block commands per group in your browser and apply them live with automatic backup (includes a 3-day free trial per server, then unlocked with a pro-key; manual YAML export is always free).
• /cmdguard import commandwhitelist reads plugins/CommandWhitelist/config.yml and writes a reviewable config.imported.yml: groups, commands, and blocked sub-commands as args deny rules, plus the LuckPerms commands to grant each group. config.yml is never touched.
• Discord alerts for blocked attempts via webhook (monitoring.discord): per-player cooldown, per-minute cap, rate-limit (HTTP 429) back-off, mentions disabled, and an only-reconnaissance mode that posts only /plugins, /version, and namespaced probes. The webhook URL is never written to the log.
• PlaceholderAPI placeholders: %cmdguard_group%, %cmdguard_visible%, %cmdguard_filter%. They read cached data only, so they are safe on asynchronous scoreboards.
• Folia support (folia-supported: true). Per-player work runs on the player's own scheduler on Folia; behavior on Paper is unchanged.
• /cmdguard test <player> <command> [args...] shows whether the argument rule allows the first argument.

Fixed

• Security: args deny/allow rules are enforced on execution, including namespaced forms (/minecraft:gamemode creative) and /execute ... run payloads.