Any plugin Brig command with a req. predicate is now restricted with no opt-out

[MartinRedheLind]

Expected behavior

Command nodes with requirements that that only check if the sender is a player (and don't use Commands.restricted()) should remain clickable in chat when used in click events.

Observed/Actual behavior

Any command node that requires the sender to be a player is treated as restricted, causing a confirmation menu to appear when executed from a click event.

Steps/models to reproduce

1. Register any brigadier command that requires the sender to be a player (example below)
2. Send a chat message with a click event that runs the newly registered command
3. Click the message and observe the confirmation menu

Example code

getLifecycleManager().registerEventHandler(LifecycleEvents.COMMANDS, event -> event.registrar().register(Commands.literal("test")
        .requires(source -> source.getSender() instanceof Player)
        .executes(context -> {
            context.getSource().getSender().sendMessage(Component.text("Click me!").clickEvent(ClickEvent.runCommand("test")));
            return 1;
        })
        .build()));

Plugin and Datapack List

[11:41:29 INFO]: Server Plugins (1):
[11:41:29 INFO]: Bukkit Plugins:
[11:41:29 INFO]: - TestPlugin

[11:41:31 INFO]: There are 3 data pack(s) enabled: [vanilla (built-in)], [file/bukkit (world)], [paper (built-in)]
[11:41:31 INFO]: There are no more data packs available

Paper version

This server is running Paper version 1.21.11-100-main@4873e3f (2026-01-29T11:02:49Z) (Implementing API version 1.21.11-R0.1-SNAPSHOT)
You are running the latest version
Previous version: 1.21.11-97-b5e7257 (MC: 1.21.11)

Other

No response

[electronicboy]

Mojang just checks if the requirement field is set. We have 0 understanding of what you're putting in there. If you want to just restrict execution to players without impacting the restricted flag, you're likely just going to have to deal with that in the execution rather than in the requirements

[MartinRedheLind]

Mojang just checks if the requirement field is set.

During my tests I found that a simple hasPermission() check does not cause the confirmation menu to appear.

I asked about this in the Discord a couple of weeks ago, and got the impression from jmp and Owen that this might be unintended behavior.

[jpenilla]

Yes I believe it's an unintended side effect for Brigadier API consumers, because of Vanilla changes any node with a requirement predicate will be restricted instead of the old opt-in behavior.

[Warriorrrr]

As far as I can tell this isn't just due to the presence of a requires predicate (i.e., _ -> true works & source.getSender().hasPermission("some.permission") does too (NullCommandSender#hasPermission always returns true)), but more that instanceof Player returns false for the NullCommandSender used when testing whether the node is restricted.

As a workaround you could additionally test if the sender's name is empty when wanting to restrict commands to only

[MartinRedheLind]

As far as I can tell this isn't just due to the presence of a requires predicate (i.e., _ -> true works & source.getSender().hasPermission("some.permission") does too (NullCommandSender#hasPermission always returns true)), but more that instanceof Player returns false for the NullCommandSender used when testing whether the node is restricted.

As a workaround you could additionally test if the sender's name is empty when wanting to restrict commands to only

Yeah, our current workaround is to wrap our requirements with an instanceof-check for NullCommandSender:

public static Predicate<CommandSourceStack> req(Predicate<CommandSourceStack> requirement) {
    return source -> source.getSender() instanceof NullCommandSender || requirement.test(source);
}

public void registerExampleCommand() {
    getLifecycleManager().registerEventHandler(LifecycleEvents.COMMANDS, event -> event.registrar().register(Commands.literal("test")
            .requires(req(source -> source.getSender() instanceof Player))
            .executes(context -> {
                context.getSource().getSender().sendMessage(Component.text("Click me!").clickEvent(ClickEvent.runCommand("test")));
                return Command.SINGLE_SUCCESS;
            })
            .build()));
}