CreeperWorks

Overview概述

What this application is这个程序是什么

Authentication身份验证

How sign-in works — the complete flow登录是怎么走的——完整链路

This is the part reviewers usually care about most, so here is every step. The launcher is a public OAuth 2.0 client using the device authorization grant of the Microsoft identity platform; an embedded-window flow is also available. There is no other path into a Minecraft account. 审核方最关心的一般是这一段，所以每一步都写清楚。启动器是微软身份平台的公共 OAuth 2.0 客户端，使用设备授权码（device code）流程；另外提供内置窗口的授权码流程。除此之外没有第三条进入 Minecraft 账号的路径。

1. You press “Sign in with Microsoft”你点「微软正版登录」 The app asks Microsoft for a device code. Microsoft returns an 8-character code and a verification URL, which the launcher displays and copies to the clipboard.程序向微软申请设备码，微软返回一个 8 位代码和一个验证网址，启动器把它显示出来并复制到剪贴板。
2. You enter that code at microsoft.com/link你到 microsoft.com/link 输入这个码 The code is entered on Microsoft's own page, in whatever browser you like. Alternatively the embedded window opens the same Microsoft page inside the app.代码是输在微软自己的页面上的，用哪个浏览器都行。也可以让内置窗口直接在程序里打开同一个微软页面。
3. You type your password — to Microsoft, not to us密码是输给微软的，不是输给我们的 CreeperWorks has no credential form of its own. It cannot see the password, the MFA prompt or any recovery information; it only polls Microsoft for the result.苦力怕工坊没有自己的账号密码输入框。它看不到密码、看不到二次验证、也拿不到任何找回信息，只是向微软轮询结果。
4. Microsoft issues OAuth tokens to the app微软把 OAuth 令牌发给程序 An access token plus a refresh token, for the scopes XboxLive.signin and offline_access. Nothing else is requested.一个访问令牌和一个刷新令牌，作用域只有 XboxLive.signin 和 offline_access，不多要一项。
5. Xbox Live, then XSTSXbox Live，然后 XSTS The Microsoft token is exchanged at user.auth.xboxlive.com for an Xbox Live token, then at xsts.auth.xboxlive.com for an XSTS token — the standard chain every Minecraft launcher uses.微软令牌先到 user.auth.xboxlive.com 换成 Xbox Live 令牌，再到 xsts.auth.xboxlive.com 换成 XSTS 令牌——所有 Minecraft 启动器都走这条链。
6. Minecraft servicesMinecraft 服务 login_with_xbox returns a Minecraft access token; the app then reads entitlements (does this account own Java Edition?) and the profile (name, UUID, skin).login_with_xbox 换回 Minecraft 访问令牌；再读权益（这个账号是否拥有 Java 版）和档案（名字、UUID、皮肤）。
7. The token is stored encrypted, on this PC only令牌加密存本机，仅此一处 The refresh token is written to tokens.json encrypted with Windows DPAPI (Electron safeStorage). It does not decrypt on another computer or under another Windows user, and it is never uploaded anywhere.刷新令牌写入 tokens.json，用 Windows DPAPI（Electron safeStorage）加密。换一台电脑、换一个系统账户都解不开，也从不往任何地方上传。

Every network endpoint the application contacts程序会访问的全部网络端点

No host outside this list is contacted. The application has no update server, no crash-reporting upload and no account backend of its own. 除这张表之外不访问任何主机。程序没有更新服务器、没有崩溃上报上传，也没有自己的账号后端。

Boundaries边界

What the application does not do程序明确不做的事

These are design constraints, not marketing statements — they are enforced in code. 这些是写进代码的设计约束，不是宣传口径。

• No game files are bundled or redistributed. The launcher downloads them from Mojang's official metadata and CDN, with the user's own entitlement.不内建、也不再分发任何游戏文件。文件由启动器从 Mojang 官方清单与 CDN 下载，凭用户自己的账号权益获取。
• No authentication bypass. “Offline mode” only launches a local single-player / LAN game; it cannot and does not attempt to join online-mode servers, and there is no code that forges Minecraft sessions.不绕过认证。「离线账号」只能启动本地单人 / 局域网游戏，不会也不能连入开启正版验证的服务器；代码里没有任何伪造 Minecraft 会话的逻辑。
• No passwords, MFA codes or recovery data. The app never asks for them and has nowhere to send them.不接触密码、二次验证码或找回信息。程序不会索要，也没有任何地方可以发送。
• No account trading or sharing features. No marketplace, no lending, no “account + password” import. Accounts stay in the user's own DPAPI-encrypted store.没有账号买卖或共享功能。没有账号市场、没有借号、不支持导入「账号+密码」；账号只存在用户本机由 DPAPI 加密的文件里。
• No ads, telemetry, analytics or auto-update. Nothing is reported back to the developer, because there is no developer server to report to.没有广告、遥测、统计或自动更新。不会向开发者回传任何东西——因为根本没有开发者服务器。
• No access outside its own scope. The app reads the game directory and its own data folder; it does not scan documents, browsers or other applications.不越界访问文件。只读写游戏目录和自己的数据目录，不扫描文档、浏览器或其他程序。

Data handling数据处理

Your game data stays on this PC你的游戏数据都在这台电脑上

The only thing that leaves the PC is the launcher account sign-in described above — a username, its password hash, the time and IP. Microsoft tokens never leave it. These are the files the application writes: 唯一会离开这台电脑的是上面说过的启动器账号登录——用户名、它的密码哈希、时间与 IP。微软令牌不会离开。程序只会写下面这几个文件：

Deleting the application's data folder removes every trace; uninstalling asks whether to keep it. Full policy: Privacy policy. 删掉程序的数据目录就删掉全部痕迹；卸载时会询问是否保留。完整说明见 隐私政策。

Feature tour功能一览

What it looks like界面实际长什么样

All screenshots are from a 4.x build, unedited apart from the local user name in file paths. 以下截图均来自 4.x 实机运行，除路径里的本机用户名外未作修改。

Download game versions and loaders下载游戏版本与加载器

Browse mods from Modrinth从 Modrinth 浏览模组

Content per installation按版本管理内容

Inspect and back up worlds查看并备份存档

All installations in one place所有版本一屏管理

And when something breaks出问题的时候

If the game exits abnormally the launcher raises its own window with the exit code, the crash-report excerpt and a list of likely causes (Java version mismatch, out of memory, missing dependency, mod conflict, GPU driver, incomplete files). One button saves a self-contained log you can hand to someone else.游戏异常退出时，启动器自己弹出窗口，给出退出码、崩溃摘要，以及按关键字匹配的可能原因（Java 版本不匹配、内存不足、缺前置、模组冲突、显卡驱动、版本文件不完整）。一个按钮就能保存自包含日志，可以直接发给别人看。

Normal exits and quitting from the launcher do not trigger it.正常退出、或从启动器点「结束游戏」不会弹窗。

Compliance合规

Notices and terms声明与条款

For reviewers审核信息

Facts you may need to fill in the form填表可能要用到的事实

Written so that a reviewer can answer the usual questions without installing anything. 为了让审核方不必先安装就能回答常见问题。

Download & contact下载与联系

Get the installer获取安装包