Changelog v1.2.1

Special thanks to @user_u6e22x7opuna8x2r for discovering and reporting the client/server config sync bug. Fixed in v1.2.1!

Bug Fix

• Problem: the "self-learning" hash database only ever wrote to config/xraydetected/known_hashes.txt on the reporting client's own machine, because all scanning code runs client-side. This meant admins could never find the file on their server, and the discovered hash only ever benefited the single client that triggered the scan (which, in practice, is very often the cheater themselves) — not the server or its other players.
• Fix: the client now sends any hash candidates it discovers (SHA-256 + description) as part of the existing detection report packet. The server validates them (strict 64-character hex format, capped per report) and persists them to its own config/xraydetected/known_hashes.txt — the same file admins can already read/edit. The database is now genuinely shared across the whole server, and viewable/editable by the server operator, as originally intended.
• Expanded hash collection: previously, a hash candidate was only ever generated when a pack was flagged purely by transparent-texture analysis. Now, hash candidates are also collected (best-effort) when a pack is flagged by name (keyword: xray), by a suspicious pack.mcmeta description, or by hidden /xray/ model folders — any genuinely transparent blocking texture found in those packs is still fingerprinted and reported, instead of being skipped entirely.
• Fixed known_hashes.txt parsing: lines written in the hash # description format (the same format the mod itself writes) were previously loaded back including the # description part as if it were part of the hash, so they could never match anything. The parser now correctly strips inline comments and validates that only well-formed 64-character SHA-256 hex digests are loaded, logging a warning for any invalid line.
• Fixed resourcepacks folder detection on non-standard launchers: the mod used to resolve the resourcepacks folder from the JVM's user.dir system property, which some third-party launchers (Prism Launcher, ATLauncher, managed server panels, etc.) set to a working directory that does not match the actual game/instance folder. This silently caused the scanner to find zero resource packs. Now uses Forge's FMLPaths.GAMEDIR API, which always resolves correctly regardless of the launcher.
• Removed invalid placeholder hashes from the built-in hash database: the default hash list included the SHA-256 hash of an empty byte array (not of any real texture) plus two unverifiable placeholder strings with no known origin. All three could never produce a real detection and have been removed. Add your own verified hashes via /xraydetected detections (self-learning) or the known_hashes.txt file instead.
• Fixed a slow memory leak in the report rate limiter: RateLimiter tracked a cooldown timestamp and report counter per player UUID but never cleared them when a player disconnected. On servers with high player turnover this grew unbounded over time. Now cleared automatically on PlayerLoggedOutEvent.
• Fixed an orphaned background thread on server stop: the scheduled executor used to delay kick/ban actions (BanManager) was never shut down when the server stopped, leaving a live daemon-less thread pool in some environments (dev servers, quick restarts). It is now properly shut down in onServerStopping.

Security Fix — Server-Authoritative Configuration (BREAKING CHANGE)

• Config is now SERVER type instead of COMMON: Previously, every client read detection settings (checkIntervalMinutes, keywords, whitelist, scanPackContent, useHashDatabase, analyzePackMcmeta, etc.) from its own local config file. Any player could simply edit that file (e.g. set checkIntervalMinutes = 999 or clear the keywords list) to weaken or completely disable detection, without touching any code.
• The fix: the config is now registered as ForgeConfigSpec.Type.SERVER. Forge automatically pushes the server's config values to every connecting client, overriding whatever the client has locally. Players can no longer bypass detection by tampering with their own config file — only the server operator's values are ever used.
• ⚠️ Migration required: the old config/xraydetected-common.toml is no longer read. The new file lives at world/serverconfig/xraydetected-server.toml (or saves/<world>/serverconfig/xraydetected-server.toml for singleplayer/LAN) and is generated with default values on first server start. Re-apply your previous settings there.