v26.1-Alpha.3 — Control-plane security token

BCDebugJavaAgent v26.1-Alpha.3

Pre-Release — Alpha builds are functional but unstable. Do not run in production environments.

Highlights

Control-plane security token:

• New httpToken=<secret> config: when set, every control-plane endpoint
  requires the token — presented as the X-BCDebug-Token header or the
  token query parameter. Empty keeps the loopback-only open default.
• Constant-time comparison (MessageDigest.isEqual); enforced on BOTH
  frontends (JDK HttpServer + raw socket — the raw frontend now parses
  request headers).
• TokenGuard unit tests cover open/required/trim semantics; 46 tests green.

True-Java-8 validation

Portable Temurin 8u504 JRE (zip extraction, no system install) ran the
1.12.2/Forge instance via mdl launch --java-path:

Check	Result
Attach on real Java 8	banner v26.1-Alpha.3, 8 hooks, init complete
Instrumentation	launchwrapper + com.mojang classes recorded
Lifecycle	graceful shutdown export (31 method records)
A/B isolation	game's LaunchClassLoader failure reproduces identically without the agent — mdl 1.12.2 instance issue, agent innocent

Token live-proof awaits a stable 1.12.2 game session (instance issue above);
guard logic is covered by unit tests.

Build Information

Item	Value
Artifact	bcdebug-javaagent-v26.1-Alpha.3.jar (bytecode 52 — JDK 8+)
Commit	f07123f (SSH-signed, Verified)
Tag	v26.1-Alpha.3 (SSH-signed, Verified)

安装说明（中文）

1. 下载 bcdebug-javaagent-v26.1-Alpha.3.jar。
2. 多用户主机建议启用令牌：httpToken=<secret>，请求携带
   X-BCDebug-Token: <secret> 头或 ?token=<secret>。
3. Alpha 版本不稳定，请勿用于生产环境。

---

MIT License — Copyright (c) 2026 BlockConnect