MiracleLoader 1.2.0: what mods reach for

What a mod reaches for, said out loud. Mods for 1.1 work as they are.

Reach

• At every start, the loader reads the mods' classes (without loading them). For each mod that names something notable outside the game, it writes one line:
  Reach: some-mod starts processes, uses the network. (miracle zandatsu shows where.)
  • Notable: processes, native code, the network, classes made from bytes, Unsafe, raw OpenGL/Vulkan, System.exit.
  • File writes and reflection are ordinary for mods, so they show only in zandatsu.
  • A mod that only uses the game and the library gets no line.
• miracle zandatsu some-mod.jar shows the whole label: each kind, the classes that name it, and what they name.
• Rendering goes through the game's own API (blaze3d, renderpearl). A mod that calls OpenGL or Vulkan directly breaks on the other backend and in other mods' rendering.
  • By default the loader warns and names the call.
  • -Dmiracle.rawGraphics=refuse won't start with such mods; allow keeps quiet.
  • miracle bake tells the author first.

It's a label, not a lock. It reads what the code names, not what it does: reflection can hide more, and naming the network may just mean checking for updates. Java 25 has no sandbox, so no loader can stop a mod from doing what Java allows. It can tell you what to ask about.

Checked

• test.sh: 449 of 449, also with the loader as a Java agent.
• Real 26.3 client: the trial passes 29 of 29, and the library, Event Horizon and hallelujah get no Reach line. Their self-tests no longer use System.exit, so their labels stay honest.