research/08 方案 A:GUI 的微软登录改走授权码流(HMCL 主流做法),设备码流保留给 CLI/无浏览器场景。两条流只差「怎么拿到 MS access_token」,拿到之后共用 chain::complete_chain 与 MicrosoftSession,落盘/刷新语义没有第二套。 core(crates/core/src/auth/microsoft/) - endpoints:新增 authorize(…/consumers/oauth2/v2.0/authorize),与 token 同租户。 - authcode:RedirectUri 是 http://localhost:{port}/auth 的唯一来源(授权 URL、 token 请求体、实际监听三处共用,坑 5);AuthCodePolicy(回调超时 300s / 绑定重试 3 次 / 固定端口 / 固定 state);authorization_url(response_type=code + prompt=select_account + scope=XboxLive.signin%20offline_access);exchange_code 复用 flow 的 oauth_error/tokens_from。 - callback:本地 HTTP/1.1 回调服务器。内核分配端口(占用按次数退避重试);非 /auth 路径 (favicon、预连)404 后继续等;state 不匹配 400 后继续等;error=access_denied 归 Canceled; 单条连接读头超时 5s,半开连接拖不垮时间预算。 - MicrosoftAuth::authcode_login(present):绑端口 → present(宿主开浏览器)→ 等回调 → 换 token → 整链;失败与设备码流一样落 M38 失败日志。 app(crates/app) - AppCommand::StartBrowserLogin + host::accounts::start_browser_login;设备码/授权码共用 LoginJob 取消槽位、收尾入库(store_session)与面板 DTO。 - host::opener 用系统默认浏览器打开授权 URL(Windows rundll32 url.dll,FileProtocolHandler)。 - 账户页:主按钮「微软登录」走授权码流,「设备码登录」作备用;DeviceLoginView::browser_waiting 在面板里给出可复制的授权链接(user_code 留空)。 测试 - crates/core/tests/auth/microsoft_authcode.rs:授权 URL 向量(租户/编码/prompt)、 URI 一致性(授权 URL 与 token 表单同字面量)、mock 全链、favicon+陈旧 state 后仍拿到 code、 端口占用重试文案、超时、access_denied→Canceled、login_with_xbox 403 的 M38 诊断 (detail_code=login_with_xbox_403,真机白名单未批时验收止步于此)。 - 单测:authcode 编码/向量、callback query 解码与错误分流、DTO browser_waiting、conv 面板。 未做/未验证:真机完整登录需 Azure 公共客户端 id(ULL_MSA_CLIENT_ID)与 Minecraft API 许可, 本机只能到「授权页 302 到 login.live.com 且 redirect_uri/scope/prompt 原样保留」这一步。 AskaEth <i@yeij.top>
Unlucky Launcher (ULL)
English · 简体中文
Official project home: https://github.com/AskaEth/Unlucky-Launcher
Unlucky Launcher (ULL) is a free, open-source Minecraft: Java Edition launcher written in Rust (Apache-2.0, non-commercial), with a Slint + Metro UI. It embeds an AI agent client (chat / configuration / crash diagnosis) and integrates with the broader agent tooling ecosystem via MCP. Minimum baseline: Windows 10.
- Runtime: a single native Rust binary — no JVM, no WebView, no external runtime
- UI: Slint (Royalty-Free 2.0; GL preferred, CPU software-rendering fallback so older machines without a usable GPU still get the full UI)
- License: Apache-2.0 © AskaEth (YeiJ)
Compliance statement
Authentication uses only official Microsoft/Mojang endpoints — Microsoft OAuth 2.0 device code flow, Xbox Live, XSTS, and api.minecraftservices.com — so players sign in with their own Microsoft account and launch the game they already own. Account tokens are stored only on the user's local machine and are never sent to any server operated by the project. ULL does not distribute, mirror, proxy or modify any Minecraft game files. Online play always requires a Microsoft account with valid entitlements. Local offline profiles never contact Microsoft or Mojang services and cannot join online-mode servers. Not affiliated with Mojang or Microsoft.
Status
The core engine is complete (workspace: 983+ tests passing):
- Microsoft sign-in: OAuth 2.0 device code flow → Xbox Live → XSTS → Minecraft Services, with entitlement verification
- Account credentials are stored only on the local machine — never uploaded, and inaccessible to the AI features
- Mod loaders: Forge / NeoForge / Fabric / Quilt, verified on real machines
- Java management: Temurin / Oracle / Microsoft / Zulu with a regional fallback chain
- Multi-source download engine; YAML rule-based crash diagnosis
- Usable as an MCP server for external agent tooling (
ull agent serve) - Local offline profiles: for local / isolated-network testing only; they perform no Microsoft authentication and cannot join servers with online-mode enabled
CLI (ull) is fully usable: install / launch / accounts / java / diagnose / agent.
GUI in development: crates/app is currently a Slint + Metro skeleton; the theme system and
the full interface ship with subsequent versions — use the CLI until then.
Module map
Unlucky-Launcher (cargo workspace)
├── crates/core # domain library, zero UI dependencies, eight modules
├── crates/agent # AI agent: ToolSpec registry + built-in client + MCP server (one shared core)
├── crates/app # Slint UI: the only crate allowed to depend on a UI framework
├── crates/cli # CLI (bin `ull`): headless, zero UI, depends on core + agent
└── packaging # single-file artifact matrix and packaging assets (planned)
The eight modules of crates/core:
| Module | Responsibility |
|---|---|
setting |
three data-directory modes, schema-based config, atomic writes, migrations |
download |
multi-source health scoring, mirrors, chunked downloads, hash-while-downloading |
game |
version / instance repository, snapshots and inheritance resolution |
launch |
10-stage launch pipeline, processes, JSONL event stream |
auth |
Microsoft sign-in / local offline profiles |
addon |
mod loader installation, modpacks, CurseForge / Modrinth |
diagnose |
five signal collectors, YAML rule engine, hs_err parsing |
platform |
OS abstraction: paths, processes, file locks, capability probing, runtime OS detection |
Building
Prerequisites:
- Rust stable (
rust-toolchain.tomlselects the toolchain automatically; componentsrustfmt/clippy) - Windows: MSVC toolchain (used by CI) or MinGW-w64 (
x86_64-pc-windows-gnu) - Linux:
libxkbcommon-dev libfontconfig1-dev libgl1-mesa-dev libegl1-mesa-dev libwayland-dev libxcb1-dev(Slint winit backend + femtovg build dependencies)
cargo fmt --all --check # formatting
cargo clippy --workspace --all-targets -- -D warnings # lints (zero-warning gate)
cargo test --workspace # tests
cargo build --release # artifact: target/release/unlucky-launcher[.exe]
Software-rendering switch (machines without a usable GPU / with broken drivers):
unlucky-launcher --software-renderer (equivalent to SLINT_BACKEND=winit-software).
Dependency license check (optional locally, required in CI):
cargo deny check licenses bans sources.
CI gates
| Workflow | Content |
|---|---|
.github/workflows/ci.yml |
fmt + clippy + test + build, Windows / Linux matrix |
.github/workflows/guards.yml |
zero-UI guard for core, 400-line-per-file guard, cargo-deny license guard |
Platform baseline
Minimum baseline: Windows 10. Windows 8.1 / 8 / 7 are not supported:
- Windows 10/11 builds use the standard toolchain (MSVC / GNU) — no custom target specs, no
-Zbuild-std, no import-table allowlists - Other platforms: macOS 12+ first class; Linux x64 with X11 preferred, Wayland as the long-term direction; Android Termux experimental, not committed
- UI fallback: Slint software rendering (fully usable on machines without a GPU or with broken drivers)
- Platform independence is expressed through separate test matrices, not separate artifact pipelines; capability differences use feature gates with runtime probing
License and acknowledgements
- This project: Apache License 2.0, see LICENSE; third-party notices in NOTICE
- The GUI uses Slint (Royalty-Free 2.0 track). Per the RF 2.0 obligations an
AboutSlintwidget will be placed on the about page (P2); until then NOTICE and this section serve the attribution duty.
Thanks to HMCL and PCL2 (both GPL-3.0) — these two launchers have accompanied the vast majority of Minecraft players for many years. ULL learned a great deal about design and implementation from them, and this project is dedicated to those two pioneers.