T3 Craft 0.2.1

T3 Craft 0.2.1 fixes local MCP request validation, launcher shutdown ownership and connection recovery.

• MCP rejects browser Origin headers and noncanonical Host headers. Native clients on loopback keep working. Malformed messages return HTTP 400; bodies over 64 KiB return HTTP 413. Agent world commands still require the player's explicit permission.
• The Mac launcher sends stop through its own server invocation's stdin so the world saves before exit. Cleanup uses an ownership marker instead of broad process matching. Reused worlds and other server profiles remain running, including when the client fails.
• The client negotiates T3's declared protocol before choosing routes and rechecks it after reconnect. Expired/revoked pairings and unsupported protocols display recovery instructions above cached conversations. Offline threads are clearly labelled, and drafts survive reconnects.

Requires: Minecraft Java 26.3, Fabric Loader 0.19.5+, Fabric API 0.161.0, Java 25+. Replace the previous T3 Craft jar in mods/. Local MCP programs still share the enabled command permission; this endpoint is not intended for remote exposure.

Verified: exact-commit Java 25 CI, legacy and protocol 2 fixture checks, launcher lifecycle regression checks; actual Minecraft MCP HTTP boundary checks; packaged Minecraft auth/protocol failure and recovery screens with a healthy second environment and preserved draft; real two-world launcher shutdown with saved world and unaffected peer; installed T3 checkpoint retrieval and in-game review/feedback.

The jar comes from CI at 0b43848ae25eddfd5c25c18d95b50b9f03861639. T3's client protocol is not a documented public API and may change.

SHA-256 (t3craft-0.2.1.jar): c3d34ebd9efc58aa629a8c7ed4d20745301fac6d9b3d41388ce10cd5fb23769c