LuminaBox

Overview

This is a security-only patch release. No new features. The sole purpose of 1.0.1 is to satisfy CurseForge's automated security review, which rejected 1.0.0 with:

> Your file cannot be accepted as it runs Powershell. This is unsafe and a security risk.

What was wrong

CustomMusicManager.sendMediaKey(int) (in common/src/main/java/com/luminabox/audio/CustomMusicManager.java) launched a PowerShell process via ProcessBuilder to invoke WScript.Shell.SendKeys, sending system media keys (Play/Pause, Next, Previous) so the player UI in LuminaBox could remote-control whatever audio app the OS happened to be running (Spotify, etc.). The script itself was harmless, but the capability of spawning a system shell is what CurseForge's policy disallows.

What changed

• sendMediaKey(int) is removed entirely. The compiled .class no longer contains powershell, WScript.Shell, SendKeys, or ProcessBuilder references.
• The "RPC" methods now control LuminaBox's own player only:
  • rpcPlayPause() toggles internal pause() ↔ resume() based on PlaybackState.
  • rpcNext() → internal next().
  • rpcPrevious() → internal previous().
  • getRpcCurrentlyPlaying() returns the current track title (or ""), instead of the placeholder string.
• Caller sites in MusicPlayerScreen are unchanged; method signatures are preserved (binary-compatible for any external integration).
• No code-level obfuscation (string-splitting, Base64, reflection) was used to hide the PowerShell call — that would be treated as detection evasion and rejected harder.

User-visible behavior change

In 1.0.0, pressing Prev / Play-Pause / Next in LuminaBox's UI also sent OS-wide media keys, which would skip tracks in Spotify / Windows Media Player / Foobar / etc. running alongside Minecraft. From 1.0.1 onwards those buttons only affect LuminaBox.

Versions

• mod_version: 1.0.0 → 1.0.1
• Built with ./gradlew clean build.
• Artifacts:
  • main (MC 26.1.x): luminabox-fabric-26.1.x-1.0.1.jar, luminabox-neoforge-26.1.x-1.0.1.jar
  • 26.2-dev (MC 26.2.x): luminabox-fabric-26.2.x-1.0.1.jar, luminabox-neoforge-26.2.x-1.0.1.jar

Verification

unzip -p <jar> | grep -aciE 'powershell|pwsh|wscript\.shell|SendKeys'
# → 0  (for all four jars)

Source-tree grep over common/, fabric/, neoforge/ returns zero matches as well.

Re-upload to CurseForge

Upload the four 1.0.1 JARs as a fresh file. The previously rejected 1.0.0 entries do not need to be re-submitted.