Changelog

[2.0.0] — released

• Dedicated servers must open TCP 25567 (mediaProxyPort) next to 25565. Video, subtitles, and library artwork go through this port. If it cannot bind, screens stay blank instead of sending keyed URLs to clients.
• Jellyfin / Emby API keys and Plex tokens are no longer sent to clients and are not written into world saves. VLC talks only to the Minecraft media proxy.
• /tv status and error text hide media-server hosts unless the player has permissionSeeMediaHosts (default op).
• /tv now uses the same permission gates as the in-game GUI.

Security

• Media proxy (MediaProxy) on port 25567. Clients receive http://pixelreel.invalid:<port>/m/<token>; the client rewrites that host to the Minecraft join host (or mediaProxyPublicHost).
• Hung library posters store provider + item id, not a keyed image URL.
• Channel logos are proxied so the media host is not in the playlist packet.
• Custom poster HTTP URLs reject loopback, LAN, link-local, and cloud-metadata addresses. Optional posterUrlHostAllowlist.
• Optional LuckPerms / fabric-permissions-api nodes (no hard dependency). You do not need to /op players to let them watch.
• README disclaimer: tunnel Jellyfin, Emby, Plex, and Tunarr (Cloudflare Tunnel, Tailscale, WireGuard, or a VPN). Do not publish those ports on a public IP. Use a non-admin library user.

Added

• Giant Cinema Screen (20×10, audio range 100).
• Movie Poster (2×3) and Huge Movie Poster (up to 10×15), craftable, with in-game picker.
• Poster artwork from Jellyfin / Emby / Plex, Watching (bound to a chosen nearby screen), and Custom (URL or file upload: png, jpg, animated gif).
• TV shows use the series poster, not episode stills. Watching posters follow the chosen screen.
• Theatre audio zones (/tv zone claim|mark|set|here|clear|status|cancel).
• Permission keys and nodes, including pixelreel.watch, pixelreel.hosts, pixelreel.audiozone, pixelreel.posters, pixelreel.posters.url.
• Config: mediaProxyPort (default 25567), mediaProxyPublicHost, audio-zone defaults, permissionSeeMediaHosts, permissionCustomPosterUrls, posterUrlHostAllowlist.

Changed

• permissionWatch stays everyone by default (watching does not require operator status).
• Playback and poster fetch go through the proxy; keys stay on the server in config/pixelreel.json.

Fixed (this working tree)

• Watching posters update from the bound screen; multiple screens no longer share the wrong art.
• Host / API-key leakage in stream URLs, chunk sync, and world data.