Rendering mods link against LWJGL, which a dedicated server does not have, so
Sodium in mods/ killed the server at boot with NoClassDefFoundError on
org/lwjgl/Version. The kit had nowhere else to put such a mod: it used the
server's own mods/ as the mirror, so reaching clients and not being loaded by
the server were mutually exclusive.
$SHARE/client-mods is now mirrored alongside mods/ and enters the pack with
side = "client", so packwiz-installer delivers it to players while the server
never loads it. packwiz url add always writes side = "both", so the field is
rewritten explicitly after each add — inserted when absent, replaced when
present, and re-asserted on unchanged mods in case it drifted.
Covers packwiz-setup.sh, mc-refresh-restart.sh (both directories synced through
one function), packwiz-http.py (allowlist) and mc-service-setup.sh (creates the
directory). Traversal out of client-mods/ is still refused.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Amir Alexander Abdelbaki
361d3ed82a