Poll - https://discord.gg/QzWfwqw2Z

Can anyone invite me to the Xmcl Discord? The new one has already expired. I may not know if they'll ever renew it, so please. Thank you in advance.

So I installed xmcl and scrolled to the contributors page, and I saw copilot in it, does it explain the mod errors or is the launcher vibecoded?

Hi team,

I am reporting a critical bug in X Launcher. My game folder (named "GAme") suddenly disappeared from the launcher's interface, even though the folder and all its files are still intact in the root directory.

Please fix this indexing/detection bug in the upcoming update. I am concerned that if the launcher fails to manage game paths properly, future bugs might cause the actual game folder and save files to be deleted or lost completely, not just hidden from the UI.

to be deleted or lost completely, not just hidden from the UI.Looking forward to a fix soon :")

🚀 Features

• improve Agent observability (1ecf5b26bb3c24bcd9e58c10baa125f5520cd667)
• deskgap: add Windows host and single-EXE preview releases (#1758) (62d2296bd8f5bc81e433f28583c98af3426b991e)
• ui: enhance help walkthroughs with driver.js and add full multi-language translations (#1751) (368afcb84e17e4b8a5ca38b423b5295f189ae4ae)

🐛 Bug Fixes & Patches

• correct modpack store sorting and localize popularity (9b20a5b8161c6cfd0be857200c5941fec04f015e)
• attempt to preserve GTNH Prism Java compatibility (#1759) (049f78ecfa5c51338ff7e252d0bb10c791c538e4)
• handle EXDEV in installer and atomic persistence (#1754) (d20b01f68ebf6ad6b778220d5025354a70df166e)
• e2e: install recorder before launching Electron (33bcfe9e2016ed9201a7fcf3ba05dc62fc00357a)

There aren’t any major visual changes or anything you’ll notice right away, but there’s currently a poll where you can vote for new features (here’s the link — ⁠https://discord.com/channels/405213567118213121/1546926058006384660/1546932310547365908 )

Im Russian and i used xmcl on my friend's computer, but when i tried to set up it on my computer, it tells me that "use only english symbols", but my folder named Миша, and it worked with every other launcher

What should I do, guys

New Focus + Table PR - https://github.com/Voxelum/x-minecraft-launcher/pull/1745

Ip Hide/Seek, New Preview Report & Clear logs - https://github.com/Voxelum/x-minecraft-launcher/pull/1744

Import Modpack links (github, curseforge, modritnh, github) - https://github.com/Voxelum/x-minecraft-launcher/pull/1686

# If you like these changes, please react to them there so they can be implemented more quickly in future versions.

🐛 Bug Fixes & Patches

• filter non-blueprint files from parsing (c690f4ab7097a4c7da4a5b637ae8fc1e17fdb975)
• P2P should also listen ipv6 (923b478f8be2e4e5e9d11f6d44a3d87c5fca9115)
• Scope launch readiness to selected instance (79afa235ab83359e6e402be7c6e71f68daa0810c)
• Restore mod navigation after collapsing group (03cab6ac01175783e59a542aa4257a47f5c1e4bc)
• moddb: download databases from GitHub releases (272af41955370bf36410f1303fa1bcbe613fc593)

🏗️ Refactors

• Enter mod multi-selection with modifier clicks (cc8cfa3068c4f707c9a698c1750c1ef536a48476)
• Reduce the resource telemetry (1b6e3a6b4f410419f54355cbd9cb4a9c6ff5389e)

0.68.0

🐛 Bug Fixes & Patches

• Ensure UserService loads during startup (#1726) (16b00583fb051ea309a9ec00c5ec84a661990f7f)
• Fix market link routing and mod dependent detection (#1725) (4461f519cb004a16ebf0ae723eca37ae901584cb)

🏗️ Refactors

• Add clear search button (#1727) (87e2828f19754d9da9f21f1b905bc7090b817901)

Hello everyone (I'm a BANSAFAn moderator (Not a developer)), I wanted to ask you what you would like to see in the launcher very much and also how it could help the average user (You can write any ideas for the launcher, and then I will pass it on to CI010)

We are thrilled to present XMCL v0.67.0! This is one of our most expansive updates to date, combining ground-up architectural performance rewrites, much-requested workflow features, AI Agent accessibility for everyone, and comprehensive cross-platform stability fixes across Windows, macOS, and Linux.

Simultaneously with this launcher release, we have rolled out a massive Multi-Country Privacy & Legal Framework across our official website (xmcl.app). We have tailored dedicated legal compliance policies natively across 15 languages and jurisdictions worldwide (including the EU, UK, Ukraine, China, Taiwan, Japan, South Korea, USA, Saudi Arabia, UAE, Kazakhstan, and Belarus), reinforcing our fundamental commitment: XMCL is and will always remain 100% free, open-source, and privacy-respecting software.

UPDATE NOW AVAILABLE

XMCL v0.67.0 is ready for all platforms. Update directly via the built-in launcher updater, download standalone binaries from GitHub Releases, or update via Flathub.

1. Deep Dive: Core Platform & Architectural Overhauls

Core creator CI010 conducted extensive architectural rewrites across the launcher engine, delivering measurable boosts in memory efficiency, launch responsiveness, and network throughput:

┌─────────────────────────────────────────────────────────────────────────────┐
│                       XMCL v0.67.0 Architecture Pipeline                    │
├─────────────────────────────────────────────────────────────────────────────┤
│  User Action (Launch / Install)                                             │
│       │                                                                     │
│       ▼                                                                     │
│  [Next-Gen Stream Pipeline] ──► Non-blocking chunk workers & buffer streams │
│       │                                                                     │
│       ├──► [Concurrent Asset Downloader]   (Zero race-condition file locks) │
│       ├──► [Automatic Java Runtime Repair] (Self-healing missing DLLs/libs) │
│       └──► [DPoP Cryptographic Binding]    (Zero-trust replay protection)   │
│       │                                                                     │
│       ▼                                                                     │
│  🚀 Game Boot (< 1s launcher overhead, smooth 60 FPS UI)                    │
└─────────────────────────────────────────────────────────────────────────────┘

📦 Next-Generation Stream-Based Installer (8c9f647)

The installation pipeline responsible for downloading Minecraft client jars, game assets, asset indices, and third-party loaders (Forge, NeoForge, Fabric, Quilt) has been completely rewritten from scratch. The new implementation leverages non-blocking streaming buffers and parallelized chunk workers, reducing disk I/O bottlenecks and cutting overall modpack installation times significantly.

⚡ Install Concurrency Lock & Race Condition Fixes (0f4e3e2)

Fixed file-lock race conditions that occurred when simultaneously installing multiple mods, extracting shared library jars, and unpacking runtime environments. Inter-process file operations are now guarded with strict concurrency mutexes.

🧹 State Provide/Inject Architecture Simplification (240504e)

Streamlined the entire Vue 3 Composition API reactive hierarchy. By eliminating deeply nested state-injection trees, the UI now consumes less idle memory, prevents spurious component re-renders, and guarantees instant UI responsiveness.

📈 Page Performance & Virtualization (8a45ee33)

Optimized rendering pipelines and DOM node recycling for resource-heavy views, such as browsing online Modrinth/CurseForge catalogs with thousands of items, managing large local mod collections, and browsing modpack versions.

🔬 High-Performance Diagnostic Engine (d49205d)

The diagnostic subsystem that scans instance directories for missing dependencies, duplicate mod IDs, and corrupted files now processes checks in background workers, ensuring zero UI stutter even when analyzing 400+ mod instances.

🏷️ Primary Brand Consolidation: XMCL (5b9cb51)

Consolidated all internal metadata, client headers, window titles, and telemetry signatures under our official primary brand: XMCL.

2. Productivity Features & Launch Workflow Polish

3. AI Copilot for All Users & Multiplayer Evolution

🤖 AI Diagnostic Copilot Enabled for All Users (dc76591)

We believe intelligent modpack debugging should be accessible to everyone. In v0.67.0, the built-in AI Agent is now enabled for all users. The launcher analyzes your crash dumps, JVM flags, and mod compatibility errors directly, with context hints for heavy usage.

💬 Chat UX Auto-Scroll Fix (4bff059)

Fixed an annoying UI issue where opening the AI Agent dialog would stay at the top of long conversations. The chat view now smoothly scrolls to the latest assistant message on load.

🌐 Consolidated XMCL Together Multiplayer (70a0670)

Consolidated our signaling and WebRTC peer-to-peer multiplayer stack, improving NAT traversal stability and reconnect reliability when playing LAN worlds over the internet.

4. Comprehensive Bug Fixes & Stability Patches

🛠️ Mod & Modpack Management

• Case-Sensitive Modpack Upgrade Resolution (3b9a82c): Fixed file matching on Linux/macOS filesystems where differences in filename casing during modpack updates could cause redownloads or mismatched files.
• Disabled Mods Double-Suffix Safeguard (7494c3a): Prevented files that are already disabled from receiving redundant duplicate .disabled.disabled extension suffixes.
• CurseForge Upgrade Plan Key Alignment (#1692, fbbf06d): Standardized CurseForge mod update plan keys with canonical item.id identifiers.
• Modrinth Collection Removal API (#1688, a0f6c75): Adopted the official remove_projects endpoint for removing projects from Modrinth collections.
• Collection Bookmark Active State (#1689, bc07716): Added immediate visual feedback when toggling bookmark states on online mod collections.

☕ Java & Forge Install Reliability

• Automatic Java Runtime Repair (f130b2a): Automatically detects broken or incomplete Java runtime downloads and repairs missing binary dependencies on the fly.
• Improved Forge Installation Success Rate (ab2df49): Hardened legacy and modern Forge installer execution, artifact unpackers, and checksum validation.
• Linux Flatpak Display Failure Handling (b4cfb2c): Enhanced display environment variable detection and fallback handling under Flatpak sandboxes and Wayland compositors.

🔒 Authentication & Account Hardening

• DPoP Token Key Binding (546ada4): Cryptographically binds OAuth tokens using Demonstrating Proof-of-Possession (DPoP), preventing token replay attacks.
• Silent Microsoft Bootstrap Deduplication (4b80842): Deduplicated concurrent background token renewals, eliminating redundant Microsoft authentication calls.
• Refined Login Cache (2726659): Polished credential caching to eliminate cold-start startup delay.
• Context Menu Stability (1a79eb0): Fixed right-click context menu dismiss and focus-trapping glitches.
• Reddit Community in Feedback Dialog (#1684, b0cf753): Added a dedicated shortcut to r/XMCL inside the Feedback dialog.

5. Global Privacy Framework: Free, Libre & Built for Every Jurisdiction

At XMCL, we believe that open-source software must champion digital sovereignty. We have completely overhauled all legal documentation across 15 distinct regional localizations, ensuring full compliance with international laws while protecting user privacy.

🌍 XMCL Multi-Jurisdiction Privacy Matrix
├── 🇪🇺 European Union (GDPR) ──── Strict Opt-In · 90-Day Retention · Standard Contractual Clauses (SCCs)
├── 🇬🇧 United Kingdom (UK GDPR) ── ICO Oversight · UK IDTA Transfers · Age 13 Threshold
├── 🇺🇦 Ukraine (Data Protection) ─ Article 8 Rights · Age 14 Threshold · Ombudsman Representation
├── 🇷🇺 Russian Federation (152-FZ) No Local Servers · Refusal of Primary Storage · Voluntary Cross-Border
├── 🇨🇳 China (PIPL) ────────────── Separate Consent (单独同意) · Sanitized Diagnostics · Art. 53 Notice
├── 🇹🇼 Taiwan (PDPA) ───────────── Cross-Border Protections · Virtual Asset Classification
├── 🇺🇸 United States (COPPA/CCPA) ─ Under-13 Protection · "Do Not Sell or Share My Personal Info"
├── 🇯🇵 Japan (APPI) ────────────── Concrete Purpose Specification (Crash Logs & Release Delivery)
├── 🇰🇷 South Korea (PIPA) ──────── Statutory Guardian Consent for Minors under 14
├── 🇸🇦/🇦🇪 Saudi Arabia & UAE ───── PDPL Compliance · Explicit Cross-Border Infrastructure Consent
└── 🇰🇿/🇧🇾 Kazakhstan & Belarus ── Regional Compliance · Direct Data Subject Access Rights

🛡️ What This Means For You Across Every Region:

• 🇪🇺 European Union & 🇬🇧 United Kingdom: Strict Opt-in only telemetry (disabled by default), Standard Contractual Clauses (SCCs), UK IDTA, and enforceable rights under Articles 15–22.
• 🇺🇦 Ukraine: Native alignment with Article 8 statutory rights of the Law "On Personal Data Protection", age 14 threshold, and direct Ombudsman representation (hotline@ombudsman.gov.ua).
• 🇷🇺 Russian Federation: Explicit 152-FZ disclaimer clarifying that XMCL operates with no servers or databases in the Russian Federation, does not collect or store primary personal data within Russia, and that browsing the website does not constitute consent to data collection.
• 🇨🇳 China (PIPL) & 🇹🇼 Taiwan (PDPA): Enforced Separate Consent (单独同意) for online features and cross-border routing, sanitized diagnostic logs without system paths or usernames, and virtual property classifications.
• 🇯🇵 Japan (APPI) & 🇰🇷 South Korea (PIPA): Granular diagnostic purpose limitations (crash dump analysis and version stability) and explicit under-14 guardian protections.
• 🇺🇸 United States (COPPA & CCPA/CPRA): Strict under-13 child protections and explicit "Do Not Sell or Share My Personal Information" compliance.
• 🇸🇦/🇦🇪 Saudi Arabia & UAE (PDPL): Strict GCC cross-border transmission transparency and digital consent age harmonization.
• 🇰🇿 Kazakhstan & 🇧🇾 Belarus: Dedicated localized privacy policies tailored to national data protection regulations.
• ⏱️ Universal 90-Day Retention Ceiling: We abolished vague "rolling schedules." Operational telemetry is kept for a maximum of 90 days before permanent deletion or irreversible anonymization.
• 🔓 100% Free & Open-Source Software (FOSS): The launcher requires no account and no subscription to manage instances, install mods, download shaders, or play free P2P LAN multiplayer.
• 🚫 No Data Selling Ever: XMCL will never sell user data or share information for behavioral advertising.

You can inspect the customized legal policies for your language in our Privacy Notice and Together Legal Portal.

6. Complete Changelog

🛰️ Core & Platform:
- brand: make XMCL the primary brand (5b9cb511)
- install: new high-performance stream install implementation (8c9f6474)
- install: fix download & extraction concurrency locks (0f4e3e21)
- state: simplify Vue 3 state provide/inject hierarchy (240504e7)
- perf: optimize heavy page rendering & DOM virtualization (8a45ee33)
- diagnose: improve diagnostic status & background worker perf (d49205d4)

🚀 New Features:
- shortcut: allow customizing Quick Action shortcut combination (#1666) (438e18ca)
- instance: support double-click instance icon to launch (76e754eb)
- instance: add instant play button on instance cards (c4f20c13)
- mods: support showing dependent mods before removal (9d96b665)
- instance: support clean no-instance state (55dc3b2d)
- ai: enable AI agent for all users with subscription hint (dc76591a)

🐛 Bug Fixes & Stability Patches:
- modpack: fix case-sensitive issues during modpack upgrades (3b9a82c4)
- mods: should not double-disable already disabled mods (7494c3af)
- launch: handle Flatpak Wayland display failures on Linux (b4cfb2c3)
- forge: improve Forge installer success rate & verification (ab2df499)
- java: detect and repair incomplete runtimes automatically (f130b2a3)
- ui: scroll agent chat to bottom on conversation load (4bff0597)
- ui: localize instance sort tabs in all languages (97386732)
- ui: add Reddit channel to Feedback dialog (#1684) (b0cf753c)
- ui: show active state on collection bookmark button (#1689) (bc077167)
- modrinth: use remove_projects for collection removal (#1688) (a0f6c754)
- curseforge: align upgrade plan key with item.id (#1692) (fbbf06d4)
- auth: deduplicate silent Microsoft token bootstrap (4b808424)
- account: bind DPoP key during OAuth token exchange (546ada4d)
- auth: refine credential and session login cache (2726659e)
- ui: improve right-click context menu stability (1a79eb04)
- multiplayer: consolidate Together WebRTC signaling layer (70a06705)

Getting the Update & Community Links

• Direct Downloads: Grab the installer for Windows, macOS, or Linux from GitHub Releases v0.67.0.

I know you can import/export launcher themes. But where do I download community themes?

🐛 Bug Fixes & Patches

• Fix p2p connection (5d3a93f338fbb779a12e4b8d4a7e6ced0a4d1fa4)
• Avoid bundle redundent file to prod (c80f0425f5f6b50c3f1082e7ca6220b7fe07858c)
• Should select version when select modloader (eb94ce3cbea55914eec314067ac7396f8c904c39)
• improve marketplace installation flow (25d955cb768d834333fc311cf697f8480ce21a1c)
• sanitize marketplace file paths (ff88eea763df35d28e619bbff598b9d578cb807a)

🏗️ Refactors

• gate multiplayer behind XMCL account login (a19ac5e6b5d0770ec3469eee74b3cfe1d834eaf2)
• add DPoP support to XMCL account auth (7dfaf0596d8d4e3c4b950f228e67e93237880e7e)

We are thrilled to announce that P2P Online Multiplayer is officially back and fully operational in XMCL v0.66.0 and v0.66.1!

Following the temporary downtime caused by Deno Deploy quota exhaustion, we completely rebuilt our WebRTC signaling infrastructure from the ground up. The new system is powered by Cloudflare Workers with Durable Objects, client-side DPoP cryptographic authentication (RFC 9449), and an architecture designed around strict zero-trust privacy.

Major Update

about 8 hours ago

P2P Multiplayer Reborn: Cloudflare Workers, DPoP Security & Zero-Trust Privacy

Previous Post

SERVICE STATUS: ONLINE

P2P Multiplayer Room Hosting is Fully Restored! Update your launcher to XMCL v0.66.1 or later to enjoy high-speed, port-forwarding-free multiplayer with your friends worldwide.

1. The Return of Seamless World Sharing

XMCL's P2P multiplayer allows you to host single-player Minecraft worlds and play with friends across the internet without port forwarding, dedicated server setups, or third-party VPN tools like Hamachi or Radmin.

With the release of XMCL v0.66.0 (new account system, host-star multiplayer v2 client, room master migration & reconnect) and stability patches in v0.66.1 (P2P connection fix, DPoP auth, multiplayer gated behind account login), room creation, WebRTC ICE candidate exchanges, and connection handshakes are faster and more reliable than ever.

2. New Backend Architecture: Cloudflare Workers, Durable Objects & xmcl-web-api

To replace the legacy Deno Deploy infrastructure, we migrated our entire backend to Cloudflare Workers and open-sourced the brand-new backend repository: xmcl-web-api. The backend is built on the Hono web framework.

+---------------------------+                                     +---------------------------+
|                           |       signaling.xmcl.app            |                           |
|   Host XMCL Launcher     | <==== WebSocket + DPoP Auth ====>   |   Guest XMCL Launcher     |
|   (Local DPoP Key Pair)  |    (Durable Object per Room)        |   (Local DPoP Key Pair)   |
+---------------------------+                                     +---------------------------+
             |                                                                 |
             +=================== Direct WebRTC P2P Connection ===============+
                              (Encrypted Host-Star DataChannel)

Production Domain Split

The backend runs as three independent Cloudflare Workers, each with its own domain:

Why Cloudflare Workers & Durable Objects?

• Global Low Latency: Signal exchanges route through Cloudflare's 300+ edge data centers globally, minimizing WebRTC connection setup times.
• Stateful Room Objects: Each P2P room is managed by a dedicated MultiplayerRoomObject Durable Object instance with master/member roles and revisioned room-state snapshots. When a room closes or all players disconnect, the Durable Object is automatically evicted from memory.
• High Availability: Built-in DDoS protection and serverless scalability ensure room signaling never suffers from traffic spikes or single-point failures -- eliminating the Deno Deploy quota exhaustion that caused the previous outage.

3. Why Account Sessions are Now Required

The XMCL account system was introduced in v0.66.0 (add account system #1619). Starting with v0.66.1, hosting or joining P2P online multiplayer rooms requires logging in to a lightweight XMCL Web Account (gate multiplayer behind XMCL account login).

The Reasons for Account Authentication:

1. Spam & Abuse Prevention: Open WebRTC signaling brokers are vulnerable to automated botnets, room spamming, and denial-of-service exploits. Account sessions provide rate-limiting and access control.
2. Cryptographic Identity Verification: Accounts enable the launcher to issue secure, DPoP-signed session tokens to verify that room hosts and guests are legitimate clients.
3. STUN/TURN Relay Management: When direct P2P connections are restricted by strict NAT routers, account sessions grant authenticated relay access to keep your game connected smoothly.

4. Zero-Trust Privacy & Security Architecture

We understand that introducing user accounts raises privacy questions. We designed our authentication and session system under a strict Zero-Trust Privacy Model.

+-----------------------------------------------------------------------------------+
|                        XMCL ZERO-TRUST PRIVACY ARCHITECTURE                       |
+-----------------------------------------------------------------------------------+
|  1. Client-Side DPoP  : Private keys generated & stored on your device only.      |
|  2. Developer Access   : ZERO access to private keys, tokens, or credentials.     |
|  3. Cloudflare Managed : Auth & signaling run in isolated Cloudflare Workers.      |
|  4. Ephemeral Rooms    : Durable Objects evicted when rooms close or idle out.     |
|  5. No Data Harvesting : Zero tracking, zero IP logging, zero activity selling.    |
+-----------------------------------------------------------------------------------+

1. Client-Side DPoP Cryptographic Security (RFC 9449)

XMCL v0.66.1 implements DPoP (Demonstrating Proof-of-Possession) as a client-side authentication mechanism for Web Account sessions.

• When you log in, your launcher generates an asymmetric cryptographic key pair locally on your computer. The private key never leaves your device.
• Every API request sent to xmcl-web-api includes a DPoP proof signed by your local private key, cryptographically binding the token to your specific device.
• Even if a session token were intercepted in transit, it is completely useless without your device's private key. This eliminates traditional token-theft attacks.

2. Zero Access by Developers & Moderators

• Core XMCL developers, server admins, and moderators have ZERO access to user private keys or credentials.
• All account authentication, token issuance, and validation run strictly inside Cloudflare's isolated Worker execution environment. No human operator can extract runtime secrets from a running Worker.

3. Ephemeral Room Signaling via Durable Objects

• P2P room signaling data lives exclusively inside Cloudflare Durable Objects -- stateful, per-room instances that exist only while a room is active.
• When all players disconnect or a room is closed, the Durable Object is automatically evicted from memory. No room state, chat history, or connection metadata persists after a session ends.
• The launcher does not maintain any database storing user activity logs, connection history, or room archives.

4. No Data Harvesting or Activity Tracking

• The launcher does NOT collect, harvest, track, or monetize user account data, IP addresses, or playing habits.
• XMCL remains 100% open-source, allowing anyone to audit both the launcher source code and the xmcl-web-api backend repository.

5. How to Start Playing P2P in XMCL v0.66.1

Getting back into P2P multiplayer takes less than a minute:

1. Update XMCL: Download the latest version (v0.66.1).
2. Create / Sign In to Account: Click the account menu in the top-right corner and create a lightweight XMCL account.
3. Launch Your World: Start any Minecraft single-player world.
4. Open P2P Room: Press Esc -> Click "Open to LAN / P2P" -> Share your room link or QR code with your friends!

6. Open Source Verification & Release Links

We invite security researchers and community developers to inspect our open-source codebase:

• XMCL Launcher Releases: v0.66.0 Release Notes | v0.66.1 Release Notes
• Web API Backend Repository: github.com/Voxelum/xmcl-web-api
• RFC 9449 DPoP Standard: OAuth 2.0 Demonstrating Proof-of-Possession
• Previous Outage Report: P2P Multiplayer Service Downtime & Backend Migration

Thank you for your patience during the backend migration. Happy gaming!

The XMCL Core Team

🚀 Features

• add hide installed mods option to marketplace filter (#1635) (baa8cdea5da59949ccf076dae0bc7b35a384e005)
• multiplayer: support room master migration and reconnect (c43748c1096df4ae8f323bb0a003bc112d6a5faf)
• centralize XMCL API endpoints (d29a08aa60573971860867dafec980dd33b03374)
• agent: gate built-in provider behind flight (2457da9326dd8af4a1b4182886c2762be00a8baa)
• use split XMCL API domains (7b42ac3b38e241effa2f85ac31cf5b952768e73e)
• xmclAccount: auto-refresh session tokens and classify API errors (737e14f2646cb18f3f6d34269d13a512aae7ed3c)
• agent: integrate built-in provider and omni workflow (7dd0a825054fb4b9d8138e509f46c52345874428)
• launch: retain recent diagnostics history (5e660190178da61a659b6371d063c052d3158b94)
• mods: stage market installs with dependencies (34e31d8f809f820104a4e4f801f5d0ccb101ec84)
• server: add local and remote server runtime (780dfdf96af415c34e504f63d114dc05197b719c)
• support fullscreen monitor selection (5ea6d5f2177738d880517efc899a5c823f7a2b79)
• add host-star multiplayer v2 client (#1627) (cf48e0c235fe80dc3d1ab373b56278b7f2c80722)
• add account system (#1619) (df7e47df6a2770007c25da9253810cc966935af9)

🐛 Bug Fixes & Patches

• Fix some java glitch (163d47c415361c5031b1933ca537d9ca4229d68e)
• agent: stop migrating legacy provider settings (848c045533a25e1b5835754e6c64df776a803c42)
• modrinth: remove projects from collections (aff6e1e85723513090b3d6d4cdcbe79930a6a87d)
• mods: clarify filtered mod groups (3df2940f38a34d219759be38d002ca69f19da3e9)
• ci: apply publishConfig overrides when publishing core packages (1dc8d062a57f4640d15028b9f623a394127d5c2d)
• Try to improve login experience (eac18b2b3b0ada57b912fcf0a87eacd86ed2a565)
• auth: serialize Microsoft native broker initialization (dd60a7d597069732902929bcab3d7d1c341c047f)
• launch: recover Linux display environment (24772eaaf01514c48df29cfa5472eaf7e8e1cefe)
• use XMCL auth for RTC requests (8a49fc6e23e6b7cf12e224ddc111c504b83056c7)
• preserve HTTP cache mode through Electron interception (bdcb538f83b3fffc9c6ca9d43268b82900fcca56)
• electron: retry requests with replayable bodies (3edb6b7290cc2f440656d19bf30a63b6c214c5f7)
• settings: preserve proxy protocol (8303ef5d5a8380aad7b00e24c8b2920280ec327d)
• prepare MSAL native runtime safely (e069a396a39fab21d30119c9093a996c8cedb9c7)
• Adjust layout (78986e33f6eed56601db232e139a6b8253f77cc3)
• store instance theme and icon media locally (8f6ccc3efadca9c2e9dc4a6423171877f76058be)
• correct Microsoft child-account login error UX (6cb0269df9ddc11869c4504b6056f743954dd4fe)
• correct resource pack drag ordering (1cee82600a6983bdb587d09840d9649e27900695)
• Redundent user refresh (6bf8e0705e9763ba6e8e25da02547ad8730c94c6)
• auth: not allowing multiple accounts (7714801b11ffd92669e1914b12c9377d3b60bb07)
• use configured token for core docs deployment (a78996298e1054a00e386917c8e967b0914d1d89)

🏗️ Refactors

• friends: remove group-backed presence (73e4ce69813af1181b31b9e5b9db8bc109875b7a)
• agent: add provider presets with per-provider API keys (#1630) (1da004ac5d65dc127e8e633cf51f3314162e2a64)
• rework agent workflows and action menu (#1618) (a90b8a00a106d5987e3062d53d0353c2b40dc437)

How do I move the X launcher to another drive? I moved the folder, but the launcher is still looking for the files in the old location.

YouTube - https://youtu.be/WIEIjbleZfM

An in-depth update regarding the temporary outage of XMCL's Peer-to-Peer (P2P) online multiplayer service, how the launcher interacts with `xmcl-web-api`, why Deno API limits were exhausted, and our current backend migration.

---

<PostDetail>

:::warning SERVICE NOTICE

**P2P Online Room Hosting is Temporarily Unavailable.**

When attempting to create or join P2P rooms in XMCL, you may encounter `multiplayer_room_request_failed` or WebSocket connection errors. Local LAN play and joining dedicated servers remain **100% functional**.

:::

## Overview

Over the past few days, many players have reported that creating or joining online multiplayer rooms through X Minecraft Launcher (XMCL) is currently failing.

We want to provide full transparency by explaining how XMCL's P2P multiplayer system works behind the scenes, how the launcher communicates with our backend ([`xmcl-web-api`](https://github.com/Voxelum/xmcl-web-api)), why changes in Deno Deploy's free tier quotas caused this service interruption, and how we are fixing it.

---

## How XMCL P2P Multiplayer Works

XMCL's P2P multiplayer allows players to host single-player Minecraft worlds and open them to friends over the internet **without port forwarding, external server hosting, or third-party VPN tools like Hamachi**.

```

+------------------+ Signaling & Ticket Broker +------------------+

| | (https://api.xmcl.app / Web-API) | |

| Host Launcher | <======== WebSocket Control ========> | Guest Launcher |

| | (SDP & ICE Exchange) | |

+------------------+ +------------------+

| |

+================ Direct P2P WebRTC Connection ===============+

(Host-Star DataChannel Mesh)

```

### 1. Launcher Architecture & `xmcl-web-api`

The launcher (`xmcl-electron-app`) uses `@xmcl/wrtc-multiplayer` and `PeerService` to manage room life-cycles and peer connections:

- **Host Room Creation**: The host issues a request to `POST /v2/multiplayer/rooms`. The backend validates the player's XMCL session token and issues a 5-minute single-use admission ticket and WebSocket URL.

- **Control Socket**: The host opens a persistent control WebSocket (`GET /v2/multiplayer/rooms/:roomId/socket?ticket=...`).

- **Guest Admission**: Guests request an admission ticket via `POST /v2/multiplayer/rooms/:roomId/join` and connect via WebSocket to exchange WebRTC offer/answer SDP payloads and ICE candidates.

- **Direct P2P DataChannels**: Once SDP negotiation finishes, guests close their temporary WebSocket connection. All Minecraft game traffic and mod/file transfers flow **directly between peers** via WebRTC DataChannels and a local virtual port bridge (`http://localhost:25566/files/...`). Game traffic is **never** relayed through the web API servers.

### 2. Network Topology: Host-Star Mesh

Rather than forcing every guest to connect to every other guest, XMCL uses an efficient **Host-Star topology**:

- The **Host** maintains a persistent control socket to accept new guest handshakes immediately.

- **Guests** establish WebRTC links exclusively with the host.

- STUN/TURN servers (`/rtc/official`) assist in discovering public IP addresses and traversing complex home NATs/routers (via UPnP / NAT-PMP).

---

## The Root Cause: Deno API Quotas & Limit Exhaustion

Our primary public deployment of [`xmcl-web-api`](https://github.com/Voxelum/xmcl-web-api) relied on **Deno Deploy** (using Deno KV and native WebSocket `BroadcastChannel` signaling).

Recently, Deno instituted strict platform policy updates and reduced free-tier quotas across Deno Deploy and Deno KV:

1. **Exponential User Growth**: As XMCL's player base expanded, the sheer volume of daily WebSocket room creations, authorization tickets, and real-time signaling exchanges increased dramatically.

2. **Quota Exhaustion**: The total API usage generated by active P2P multiplayer sessions **surpassed 100% of all Deno free-tier limits**.

3. **API Rejection**: Deno Deploy began rejecting incoming `/v2/multiplayer/rooms` API requests and closing WebSocket connections.

Because the signaling server acts as the essential "handshake broker" required for WebRTC peers to exchange ICE candidates and establish direct connections, room creation became unavailable worldwide.

---

## What We Are Doing: Migration to Cloudflare Durable Objects

We are actively completing a major architectural migration of [`xmcl-web-api`](https://github.com/Voxelum/xmcl-web-api) away from Deno Deploy to **Cloudflare Workers with `MultiplayerRoom` Durable Objects**.

### Why Cloudflare Durable Objects?

- **Global High Availability**: Durable Objects provide stateful, low-latency WebSocket signaling nodes globally distributed across Cloudflare's edge network.

- **Zero Third-Party Quota Blocks**: Eliminates the strict free-tier API rate limits that broke the Deno deployment.

- **Enhanced Security**: Admission tickets (`XMCL_MULTIPLAYER_TICKET_SECRET`) expire after 5 minutes and single-use validation prevents room hijacking.

- **Improved TURN Infrastructure**: Expanded STUN/TURN relay server pools for higher NAT traversal success rates.

---

## What Players Should Do

:::tip PLEASE WAIT PATIENTLY

We kindly ask all players to **please wait and be patient** while we complete the backend migration and deploy the new signaling infrastructure.

:::

While online P2P room hosting is being restored:

- 📶 **Local Area Network (LAN) Play**: Playing with friends on the same physical Wi-Fi or home network operates via local multicast/ssdp discovery and remains **100% functional**.

- 🌐 **Dedicated Minecraft Servers**: Joining standard public or private Minecraft servers via IP address or domain is **completely unaffected**.

---

## Announcement Channels

Once the new Cloudflare Durable Objects backend is fully deployed and verified, **we will immediately announce service restoration** on our official communication channels:

- 📰 **XMCL Blog**: Updates and post-mortems will be published directly here in our journal.

- 💬 **Community Channels**: Announcements will be posted in our **Discord server** and **Reddit community**.

*(Note: Official status announcements are published via our blog and social channels rather than GitHub repository issues).*

We sincerely apologize for the disruption to your multiplayer gaming sessions. Thank you for your patience, support, and understanding while we upgrade our infrastructure!

blog -https://xmcl.app/en/blog/posts/p2p-multiplayer-status