Client Inspector for Fabric

The client part. The same jar, installed on a client next to Fabric API, reports that client's mod list to the server while it joins. The list comes from Fabric Loader itself, so OpSec and other translation filters cannot hide anything from it: Meteor behind OpSec AUTO, invisible to the probe, now shows up as meteor-client and is kicked before the world loads.

• Optional by default. Clients with the jar report; everyone else joins as before and is not held up. The client hashes its jars once at startup in the background, writes one log line and has no settings or screens.
• Required mode (companion.mode: required, or /clientinspector companion required): clients without the jar are refused before they reach the world, with a message that says where to download it. Operators, clientinspector.bypass holders (while companion.exempt_bypass is on) and Geyser players are exempt. This also refuses vanilla and non-Fabric clients, so it suits private Fabric servers.
• Before the world loads. Kicks on the reported list and required-mode refusals happen during login, before the player reaches the world, also on a server that paused itself for being empty. Clients with the jar wait there until LuckPerms has answered the bypass lookup (at most companion.timeout_ticks).
• Cross-check. A report that leaves out a mod the probe just proved, or leaves out Fabric API, marks the client MISMATCH; the new companion-mismatch rule kicks.
• New default rules: reported-hack (Meteor Client, Meteor Rejects, Meteor+, Meteorist, ThunderHack, Wurst, LiquidBounce, BleachHack, Aoba, Shoreline; kick), reported-hider (OpSec, ExploitPreventer; alert), reported-disallowed (Freecam, Advanced XRay, SeedcrackerX; alert), companion-mismatch (kick).
• New rule conditions reported_mods_any (ids or globs) and companion_state, rule field mod_id, placeholder %reported%.
• /clientinspector online marks clients that reported, /clientinspector profile lists the reported mods, the join log line ends with companion=... reported=N, and Discord embeds show the client part state.
• The server half now runs only on dedicated servers: players who install the jar are never inspected in their own singleplayer or LAN worlds, and their client gets no config files.

What it cannot do: in optional mode it only covers players who chose to install it, and a modified client part can send any list it likes. The cross-check catches a forged list only when the probe sees the hidden mod. Required mode is the only mode that affects players who refuse to install it.

Upgrading from 0.1.x: replace the jar in the server's mods/ folder and restart. On the first start rules.json gets the four new rules and the mod_id of the probe rules once; rules you edited or added are kept. Players who want the client part put the same jar in their client's mods/ folder. Requires Fabric API on both sides; LuckPerms optional.