Changelog

• feat(mcp): add Streamable HTTP (SSE) transport support

• Add McpStreamResponse class for SSE event streaming
• Upgrade McpResponse with dual-mode output (JSON or SSE)
• Detect Accept: text/event-stream and stream for eligible tools
• Add per-file progress notifications to sbox_analyse
• Add fetch/search progress notifications to sbox_docs
• Advertise 'logging' capability in initialize response
• Bump server version to 2.2.0
• Fully backward-compatible: non-SSE clients unchanged

• docs(mcp): add Streamable HTTP (SSE) section to browser landing page

Explains how SSE streaming works, that it's automatic for modern clients, shows an example response for custom client developers, and notes backward compatibility.

• fix(mcp): SSE detection via X-MCP-Stream header opt-in

IDEs like Kiro/Cursor don't send Accept: text/event-stream. Instead of guessing, use explicit opt-in:

• Accept: text/event-stream (spec-compliant clients)
• X-MCP-Stream: true header (IDEs that support custom headers)

Without either signal, plain JSON is returned (safe default). Updated landing page docs to show how to enable streaming.

• feat(mcp): add prompts, completion, batch requests, and logging

New MCP protocol features:

1. prompts/list + prompts/get — 6 pre-built prompt templates:

• review_sbox_code: Performance/networking code review
• explain_component: Deep-dive on any s&box type
• network_this: Multiplayer networking plan for a feature
• scaffold_component: Generate full component from description
• debug_issue: Troubleshoot errors with KB/docs context
• whats_new: Latest KB entries and trending topics

2. completion/complete — Auto-completion hints for:

• All tool arguments (actions, categories, tags, slugs)
• All prompt arguments (component names, focus areas)
• Live slug completion from KB search

3. Batch requests — POST an array of JSON-RPC requests:

• Safe methods processed in one round-trip
• tools/call excluded from batch (requires streaming/auth)

4. logging/setLevel — Accepts client log level preference

5. Bumps server to v2.3.0, advertises prompts + completions capabilities in initialize response.

6. prompts/list and completion/complete are public methods (no auth required, like tools/list).

• fix(mcp): disable Apache/PHP-FPM buffering for SSE support

The server has no nginx (Apache 2.4.67 + PHP-FPM directly). SSE wasn't working because: 1. mod_deflate/mod_brotli buffer entire response for compression 2. PHP-FPM output_buffering holds output until script ends

Fixes:

• Root .htaccess: Exclude /mcp/ from gzip/brotli compression
• mcp/.htaccess: Disable output filters for the endpoint
• mcp/.user.ini: Disable PHP output_buffering and enable implicit_flush (read by PHP-FPM per-directory)

• fix(mcp): accept int|string request IDs in SSE stream

JSON-RPC id can be integer or string. The begin() method was typed as ?string but clients send integer IDs (e.g. id: 1). Changed to mixed to accept both.

• feat(mcp): enable SSE streaming for all tools

All 6 tools now respond via SSE when the client opts in. Fast tools (sbox_stats, sbox_contribute) just send the final result as a single SSE event. No behavior change for tools that already had progress notifications (analyse, docs, kb).

• docs: add continuation prompt for next MCP feature session

• feat(mcp): add scaffold, diagnose, changelog tools + semantic search, voting, code validation, context support

New tools:

• sbox_scaffold: Generate boilerplate C# for 8 template types (component, networked_component, game_resource, panel, game_mode, player_controller, npc, service)
• sbox_diagnose: Static analysis for s&box C# code — networking, lifecycle, performance, security, and common gotchas
• sbox_changelog: View recent KB activity (new entries, updates, contributions, summary)

New services:

• SemanticSearch: pgvector cosine similarity → pg_trgm fallback → fulltext search. Degrades gracefully on shared hosting without pgvector.
• VotingService: Upvote/downvote system with quality score integration. Auto-creates mcp_knowledge_votes table. One vote per user per entry.
• CodeValidator: Inline C# code validation in sbox_contribute — checks structure, naming, s&box API usage, and common mistakes.
• ContextService: Processes _context parameter across all tools for context-aware search enhancement, result ranking, and suggestions.

Updated tools:

• sbox_kb: Added semantic_search and vote actions, integrated ContextService for smarter search results
• sbox_contribute: Added CodeValidator checks before submission (blocks on errors, surfaces warnings)

Infrastructure:

• Bumped server version to 2.4.0
• Added completions for all new tools in McpCompletion
• All new services auto-create DB schemas on first use
• Full SSE streaming support in new tools

• fix(mcp): resolve audit failures — path resolution, class name, timeout, N+1 detection

• Fix require_once path in SemanticSearch.php, VotingService.php, and AdminService.php: use '/../../../backend/' (3 levels up from mcp/lib/services/) instead of '/../../backend/' (2 levels)
• Fix AdminService.php referencing non-existent 'QualityScorer' class — corrected to 'McpQualityScorer' (2 call sites)
• Rewrite changelog_summary to consolidate queries (4→3), wrap in try/catch for graceful timeout handling, fix array_sum on potential non-array from FETCH_KEY_PAIR
• Enhance diagnose_performance with N+1 loop detection: tracks foreach/for/while brace depth via loopStack and flags Scene.Trace, Components.Get, Clone/Instantiate, and RPC/Broadcast inside loops

• fix(mcp): resolve second audit round — N+1 detection, audit_logs, constructor checks, security

Diagnose tool:

• Fix loop depth tracking: start at 0 (not brace count on foreach line) so loops with opening brace on next line are correctly tracked
• Add iteration-pattern detection (GetAllObjects, GetAllComponents, etc.) to catch N+1 even when combined with foreach on the same line
• Broaden constructor detection regex to match any non-void/non-static method-like pattern without 'override', catching more constructor forms
• Add Components.Get detection in constructors (not just Transform/GO)
• Add HTTP exfiltration checks: HttpClient/WebRequest near user data, string interpolation of SteamId/PlayerId into URLs

Admin tool:

• Fix audit_logs handler: extract logs from AdminService wrapper result (was iterating the wrapper dict, causing 'array offset on true')
• Map correct DB column names (created_at not timestamp, target_id not entry_id, details.reason not top-level reason)

Contribute tool:

• Normalize literal '\n' escape sequences to real newlines before code block detection (fixes rejection when clients send escaped strings)

• refactor(mcp): rename sbox_changelog → sbox_updates, add browser UI examples for new tools

• Rename sbox_changelog to sbox_updates to avoid confusion with the official s&box game changelog. Description now explicitly states this tracks knowledge added to this MCP server, not Facepunch releases.
• No legacy alias needed (tool not yet public).
• Add entries for sbox_scaffold, sbox_diagnose, sbox_updates so they appear with clickable example JSON on the /mcp/ browser page.
• Add all 3 new tools to mapping (scaffold+diagnose → docs, updates → kb).
• Update Completion.php: rename completeChangelog → completeUpdates, match on 'sbox_updates' instead of 'sbox_changelog'.

• feat(mcp): add unified search tool, analyse+diagnose alignment, and Discord webhook notifications

New tool:

• sbox_search: Unified search across KB + official docs + API schema in one call. Merged ranked results with source icons, context boosting, and per-source filtering. Registered in index.php with browser example.

Improvements:

• AnalyseService now runs diagnose_performance, diagnose_lifecycle, diagnose_security, and diagnose_sbox_gotchas on each C# file during project analysis. Results are severity-mapped and merged into the health score. Fixes the 'sbox_analyse missed N+1' audit finding.

Discord webhook notifications for MCP events:

• New McpWebhookService (backend/includes/McpWebhookService.php) sends rich Discord embeds for: contribution submitted, approved, rejected, entry updated, entry deleted.
• Admin panel (admin/webhook-settings.php) extended with MCP section: separate webhook URL, enable toggle, 5 event checkboxes, test button.
• Settings stored in existing webhook_settings table with mcp_* prefix.
• Webhook calls wired into contribute.php, kb.php (update), and AdminService (approve/reject/delete). All wrapped in try/catch — webhook failures never block the primary action.
• Notifications logged to webhook_sent_notifications for history.

• refactor(admin): overhaul webhook-settings UI with tabs, action-grid, and data-table

• Add 3-tab navigation: Package Webhooks, MCP Webhooks, Notification History
• Convert actions section to action-grid with individual cards
• Convert notification log from custom divs to data-table
• Remove all inline style attributes and the style block
• Add switchTab() JavaScript function
• All 7 POST form actions preserved unchanged
• Backend PHP logic completely untouched

• chore: mark FEAT-001 webhook-settings-overhaul as completed

• fix(admin): use data-tab attributes and URL hash for tab persistence

• Replace brittle onclick-based tab selector with data-tab attributes
• Add URL hash persistence so tab state survives page reload
• Read hash on DOMContentLoaded to restore active tab
• Update MCP action redirects to use #mcp hash
• Update clear_notifications redirect to use #history hash

• feat: create MCP Tools documentation page at /mcp-tools

• Add /frontend/mcp-tools.php with full documentation for all 11 MCP tools
• Document sbox_search, sbox_kb, sbox_docs, sbox_contribute, sbox_diagnose, sbox_analyse, sbox_scaffold, sbox_admin, sbox_updates, sbox_stats, sbox_explain
• Include hero section, quick-start guide, tools overview with expandable cards, usage examples, common workflows, best practices, troubleshooting, and perf tips
• Add route in routing_logic.php for /mcp-tools
• Add /mcp-tools to maintenanceExempt list in index.php
• Use existing .mcp-* CSS design system classes throughout
• Add copy-to-clipboard and expand/collapse JS interactions

• chore: mark FEAT-001 mcp-tools documentation page as completed

• feat: add sbox_package and sbox_explain MCP tools

• sbox_package: search, get, popular, dependencies, health actions
• Uses fetchPackagesBySearch from api_functions.php
• Streaming for search and popular actions
• CacheManager for popular/health results (60s TTL)
• Rich error messages with what/how/related format

• sbox_explain: tools, recommend, workflow, error actions
• Lists all registered tools from ToolRegistry::list()
• Keyword-based intent matching for recommendations
• 5 predefined workflow guides
• Detailed error code explanations from McpToolRegistry::ERROR_CODES

• Registered both in mcp/index.php

• chore: mark FEAT-002 sbox_package and sbox_explain tools as completed

• feat: add sbox_migrate and sbox_refactor MCP tools

• chore: mark FEAT-003 sbox_migrate and sbox_refactor tools as completed

• feat: improve existing MCP tools with new actions, dynamic scoring, and rich errors

• sbox_diagnose: add fix/batch actions, populate fix fields in diagnostics
• sbox_search: replace hardcoded relevance with dynamic scoring, add did_you_mean
• sbox_stats: add kb_health/community/tool_usage actions, increase cache to 60s
• sbox_scaffold: add from_description/test/multi templates
• All tools: rich error messages with what/how/related format

• chore: mark FEAT-004 existing tools improvement as completed

• feat: add streaming progress support to kb, docs, admin, and contribute tools

• chore: mark FEAT-005 streaming progress support as completed

• fix: address review issues in MCP tools (fabricated data labels, fallback warnings, thresholds)

• stats.php: Label estimated values with ~ prefix and (estimated) suffix, add disclaimer when KnowledgeDB methods are unavailable
• package.php: Warn when falling back to non-exact match in package_get(), include actual ident of returned package for verification
• search.php: Tighten did_you_mean threshold from max(3, len*0.6) to max(2, len*0.4) for better suggestion quality
• migrate.php: Add note about lines with multiple deprecated patterns needing multiple passes

• feat: add tool cards for sbox_package, sbox_explain, sbox_migrate, sbox_refactor to MCP tools page

• Add sbox_package to Search & Discovery group with actions, params, examples
• Replace sbox_explain Coming Soon placeholder with full tool card in Search & Discovery
• Add new Code Transformation group with sbox_migrate and sbox_refactor
• Remove sbox_explain from Administration group
• Update hero stats from 11 to 15 tools, 50+ to 60+ actions
• Update group counts: Search & Discovery 5, Administration 1, Code Transformation 2

• refactor: replace Available tools section with compact CTA linking to /mcp-tools

• Removed all PHP tool-card rendering logic (, , arrays and foreach loops)
• Added compact stats grid (15 tools, 60+ actions, 5 categories, SSE streaming)
• Added 'View Full Tools Documentation' button linking to /mcp-tools
• Added 'Tools Reference' button in hero buttons area linking to /mcp-tools

• feat: hide Administration tool group on mcp-tools page for non-admin users

• feat: add /mcp-tools route to router.php

• refactor: rewrite router.php with clean table-driven routing patterns

• chore: remove excessive comments and separator lines from router and MCP tool files

• fix: remove debug error_log from production routing_logic.php

• feat: add MCP Resources support with registry and 7 registered resources

• chore: mark FEAT-001 as completed

• feat: add 4 new MCP prompts and enhance kb vote/feedback actions

• Add project_review, multiplayer_setup, performance_audit, migrate_code prompts
• Add optional reason field to sbox_kb vote action with logging
• Add new feedback action to sbox_kb with helpful/not_helpful signals

• chore: mark FEAT-002 as completed

• feat: add sbox://project/context resource and project_setup action to sbox_explain

• chore: mark FEAT-003 as completed

• feat: add IDE Integration Guides section with tabbed setup for Cursor, Continue, Claude Desktop, Windsurf, and Generic

• chore: mark FEAT-004 as completed

• fix: handle null type in resource handler and differentiate feedback from vote

• Return empty contents array when ApiSchemaService::getType() returns null instead of returning "null" as text content
• Make kb_handleFeedback() semantically distinct from kb_handleVote():
• Always log with [AI feedback] context marker (not just when reason given)
• Include entry title in the feedback log when available
• Return response message clearly identifying as AI quality feedback

• fix: resolve 6 MCP tool audit issues

• admin: add explicit 'approve' and 'reject' action cases that route to the moderation approval/rejection logic
• contribute: return the actual mcp_knowledge entry ID (not the mcp_contributions ID) when auto-approving trusted submissions
• stats: replace placeholder tool_usage output with actual tool listing showing all available tools and their actions
• diagnose fix: when issue line is 0, prepend the fix instead of silently returning unchanged code
• diagnose batch: add public field detection to diagnose_sbox_gotchas so batch and single-file modes both catch this pattern
• admin audit_logs: fix KnowledgeDB::getAuditLogs to properly bind the LIMIT parameter and decode JSON details column

---------

Add daily chart history data files for game (2026-05-04 to 2026-05-26) and map (2026-05-05 to 2026-05-27). Each JSON contains daily rankings with title, org, user counts and favorites for use in analytics/leaderboards.

Large-scale refactor and feature expansion across frontend, backend, API, schema, documentation, and MCP systems focused on improving maintainability, developer tooling, performance, and overall platform stability.

Frontend & UI:

• Reworked and cleaned CSS across multiple components
• Improved shared frontend architecture and reusable layouts
• Refined package sections and overall interface presentation
• Applied broad UI polish and styling consistency improvements
• Updated packages.css and related styling assets
• Improved settings pages and related components
• Refined user profile redesign elements
• Updated usage stats and global stats pages
• Refactored profile CSS/markup and removed duplicate styling rules
• Improved profile layout spacing, grids, and section structure
• Cleaned favorite games UI and condensed playtime display logic
• Fixed minor layout and margin inconsistencies
• Added Steam inventory UI with new card-based layout system
• Added inventory section rendering and fallback handling

Backend, API & Schema:

• Refactored API functions and related integrations
• Cleaned and updated schema systems
• Improved overall code organization and maintainability
• Added ApiSchemaService for schema fetching, caching, indexing, and search support
• Added schema chunking and improved type formatting and handling
• Improved API validation and detection of obsolete structures

Analysis & Developer Tooling:

• Added and enhanced AnalyseService for static project analysis
• Improved C#, UI, styles, and asset scanning capabilities
• Introduced structured optimization reports with severity scoring and suggestions
• Added autofix suggestions and richer issue payload output
• Integrated ApiSchemaService into analysis pipeline
• Added chunked/session-based analysis with merge and cleanup support
• Introduced audit.md report generation workflow
• Registered and refined sbox_analyse MCP tool integration

Documentation System:

• Expanded DocsService capabilities and tooling
• Added chunked documentation page fetching
• Improved documentation searching, categorisation, and snippet generation
• Improved caching layers and sanitisation handling
• Updated external request user-agent handling

Database & Knowledge Systems:

• Improved KnowledgeDB duplicate detection logic
• Added pg_trgm similarity support with safe fallback handling
• Reduced noisy error output when extensions are unavailable

MCP & Platform Services:

• Improved MCP client detection and capability negotiation
• Updated mcp/index.php with improved tool registration and UI examples
• Bumped MCP server version to v2.1.0
• Added demo analysis tool entry point
• Improved memory and upload limit handling
• Tightened .htaccess constraints for MCP stability

Steam Integration & Profile Systems:

• Added Steam inventory fetching via SteamIntegrationManager
• Implemented caching and merging improvements for Steam friend and presence data
• Added multi-cURL based Steam store image fetching (capsule/header assets)
• Enhanced Steam game data enrichment with public app ID filtering
• Improved Steam API caching, error handling, and data consistency
• Expanded profile UI to support Steam inventory display
• Added richer game media rendering on profiles (images, capsules, metadata)

Account System:

• Fixed account deletion related issues
• Added support for fully deleting all user account data
• Improved related account management flows

Organization System:

• Added and refined organization-related functionality
• Improved organization management systems and moderation flows
• Applied frontend and backend improvements for organization features

Misc:

• General project cleanup and polish
• Internal checkpoints and development progress saves
• Performance improvements, caching enhancements, and stability fixes across systems

• feat: implement unused API data fields across the application

• Add ReviewStats rating distribution histogram on package detail page (new section showing star breakdown like Steam/Google Play)
• Add Org social links (Twitter, Discord, WebUrl) on org page with org description display
• Add 'Latest Update' callout using Version.Changes from package/get (shows changelog snippet without extra API call)
• Use ThumbWide as preferred hero banner image on package detail
• Add ThumbWide srcset to package grid cards for responsive loading
• Re-enable Version info block in package-details.php (was disabled)
• Add FileSize and API Version from /status endpoint to footer
• Add Author.Online indicator (green dot) on news posts
• Add Author.Score badge on news author displays
• Add CSS for all new components (rating bars, social links, callout, online dot, score badge)

• fix: cast EngineVersion to string for htmlspecialchars (PHP 8.4 TypeError)

• refactor: move latest update into version history section, remove duplicates

• Remove standalone latest-update.php callout (was awkward mid-page)
• Integrate 'Latest Update' as a highlighted banner inside Version History
• Remove duplicate Version.Changes from package-details.php
• Replace callout CSS with version-current-banner CSS (themed properly)
• Reduces duplicate info: version data now only shows in Version History and the technical Package Details section

• fix: restyle org description and social links with proper themed component

• Replace inline styles with new .org-about-bar component
• Description + social links now sit in a unified bordered card
• Properly themed with border, backdrop-blur, hover states
• Responsive: stacks and compresses on mobile
• Color-coded hover states for Twitter (blue), Discord (indigo), Website (green)

• feat: improve package detail view UX

• Remove duplicate Organization section (already in sidebar)
• Remove duplicate Summary section (already in header)
• Add VotesDown and Referenced counts to header stats
• Add relative time badge ('Updated 3d ago') to header meta row
• Add quick info pills below header (size, file count, engine version, freshness)
• Add 'Copy ID' button with clipboard feedback animation
• Add expandable description with gradient fade + Show more/less toggle
• CSS: quick info pills, updated badge, copy button, negative stat, expandable description

• fix: move quick info pills into pkg-header instead of floating below

• fix: set pkg-pill border-radius to 4px

---------

• feat(mcp): implement 16 MCP integration improvements

Critical Fixes:

• Wrap insertApproved(), approveContribution(), approvePendingContribution() in beginTransaction()/commit()/rollBack() for slug uniqueness safety
• Fix AdminService::rebuildRelationships() to call buildRelationships() instead of non-existent rebuildAll()
• Fix cleanupDeadSources() to check $result['is_reachable'] (array return)
• Add force:true requirement for deleteAllEntries when >100 entries

Schema & Migration:

• Add static $schemaChecked flag so createSchema() runs once per request
• Add view_count, quality_score, last_viewed columns to mcp_knowledge
• Create mcp_knowledge_history and mcp_audit_log tables
• Add pg_trgm extension and GiST index on title for fuzzy matching

Code Quality:

• Replace O(n) PHP similar_text() loop with PostgreSQL similarity() in findStrictDuplicate()
• Remove duplicate alias resolution from ToolRegistry::call() (McpToolRegistry already handles it)
• Fix string interpolation: single quotes to double quotes for $action var
• Wire up version history: call createHistoryRecord() before edits in AdminService::editEntry()

Performance:

• DB-level pagination in mcp-knowledge.php using searchAdvanced() with LIMIT/OFFSET instead of loading 200 results and slicing with array_slice()

Developer Experience:

• Add X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset headers after rate limit checks; add Retry-After: 60 on 429 responses

Frontend Cleanup:

• Add DocsService::clearCache() method for cache invalidation
• Remove duplicate .kb-page ::selection CSS rule
• Update $toolIcons to current consolidated tool names (sbox_kb, sbox_docs, sbox_admin, sbox_contribute, sbox_stats)

• feat(mcp): security, performance & DX improvements (batch 2)

Security:

• SSRF protection in KBService::ingestFromUrl() with private IP blocklist and domain allowlist (sbox.game, github.com, etc.)
• DocsService slug sanitization to prevent path traversal (../ stripping, character validation)
• Fail-closed rate limiting and duplicate checks in contribute.php — DB errors now reject submissions instead of silently bypassing

Performance:

• Replace O(n2) findAllDuplicates() with pg_trgm SQL self-join (capped at 100 results)
• Replace findRelated() full-table load with category-scoped searchAdvanced + PHP tag intersection
• Add 45-second cache TTL to stats tool to reduce DB hits
• Fix clearCache() to only delete known MCP doc cache keys instead of nuking all API response caches

Developer Experience:

• Wire up QualityScorer::suggestTags() — auto-tags contributions when no tags provided
• Add audit logging to kb_handleUpdate (with history snapshot)
• Add audit log retention: pruneOldEntries(90 days) called during cleanup
• Add clear_doc_cache admin action to sbox_admin tool
• Add prune_audit_logs to cleanup task enum

• feat(kb): visual improvements — reading time, quality badges, sort, featured entries, tag cloud, stagger animation, helpful button

Listing View:

• Add sort dropdown (newest/oldest/quality/popular) with pill-style buttons
• Add featured entries section (top 3 by quality score) on the first page
• Add tag cloud in sidebar showing 15 most popular tags with size scaling
• Add contribute CTA link in sidebar (green accent)
• Add quality score badge on cards (shown when >= 60)
• Add view count indicator on cards (eye icon + number)
• Add 'Updated' badge on cards modified within the last 7 days
• Add staggered fade-in animation for cards (0.04s delay per card)
• Include sort parameter in URL persistence

Entry View:

• Add reading time indicator (~X min read) in the header meta
• Add quality score indicator in header
• Add breadcrumb navigation (Knowledgebase > Category)
• Add 'Was this helpful?' vote button (localStorage-based)

Hero Section:

• Add IntersectionObserver-powered count-up animation on stat pills

Empty State:

• Add prominent 'Contribute an entry' CTA button alongside clear filters

• Update mcp-knowledge.php

---------

• Add helpful_count column to mcp_knowledge table (idempotent migration)
• Add KnowledgeDB::incrementHelpfulCount() method with RETURNING clause
• Create POST /backend/api/kb-vote.php endpoint with session-based rate limiting
• Update frontend JS to POST vote and sync count from server response
• Display live helpful count badge in the button UI
• Add CSS styling for the count badge in both default and voted states

Listing View:

• Add sort dropdown (newest/oldest/quality/popular) with pill-style buttons
• Add featured entries section (top 3 by quality score) on the first page
• Add tag cloud in sidebar showing 15 most popular tags with size scaling
• Add contribute CTA link in sidebar (green accent)
• Add quality score badge on cards (shown when >= 60)
• Add view count indicator on cards (eye icon + number)
• Add 'Updated' badge on cards modified within the last 7 days
• Add staggered fade-in animation for cards (0.04s delay per card)
• Include sort parameter in URL persistence

Entry View:

• Add reading time indicator (~X min read) in the header meta
• Add quality score indicator in header
• Add breadcrumb navigation (Knowledgebase > Category)
• Add 'Was this helpful?' vote button (localStorage-based)

Hero Section:

• Add IntersectionObserver-powered count-up animation on stat pills

Empty State:

• Add prominent 'Contribute an entry' CTA button alongside clear filters

Security:

• SSRF protection in KBService::ingestFromUrl() with private IP blocklist and domain allowlist (sbox.game, github.com, etc.)
• DocsService slug sanitization to prevent path traversal (../ stripping, character validation)
• Fail-closed rate limiting and duplicate checks in contribute.php — DB errors now reject submissions instead of silently bypassing

Performance:

• Replace O(n2) findAllDuplicates() with pg_trgm SQL self-join (capped at 100 results)
• Replace findRelated() full-table load with category-scoped searchAdvanced + PHP tag intersection
• Add 45-second cache TTL to stats tool to reduce DB hits
• Fix clearCache() to only delete known MCP doc cache keys instead of nuking all API response caches

Developer Experience:

• Wire up QualityScorer::suggestTags() — auto-tags contributions when no tags provided
• Add audit logging to kb_handleUpdate (with history snapshot)
• Add audit log retention: pruneOldEntries(90 days) called during cleanup
• Add clear_doc_cache admin action to sbox_admin tool
• Add prune_audit_logs to cleanup task enum

Critical Fixes:

• Wrap insertApproved(), approveContribution(), approvePendingContribution() in beginTransaction()/commit()/rollBack() for slug uniqueness safety
• Fix AdminService::rebuildRelationships() to call buildRelationships() instead of non-existent rebuildAll()
• Fix cleanupDeadSources() to check $result['is_reachable'] (array return)
• Add force:true requirement for deleteAllEntries when >100 entries

Schema & Migration:

• Add static $schemaChecked flag so createSchema() runs once per request
• Add view_count, quality_score, last_viewed columns to mcp_knowledge
• Create mcp_knowledge_history and mcp_audit_log tables
• Add pg_trgm extension and GiST index on title for fuzzy matching

Code Quality:

• Replace O(n) PHP similar_text() loop with PostgreSQL similarity() in findStrictDuplicate()
• Remove duplicate alias resolution from ToolRegistry::call() (McpToolRegistry already handles it)
• Fix string interpolation: single quotes to double quotes for $action var
• Wire up version history: call createHistoryRecord() before edits in AdminService::editEntry()

Performance:

• DB-level pagination in mcp-knowledge.php using searchAdvanced() with LIMIT/OFFSET instead of loading 200 results and slicing with array_slice()

Developer Experience:

• Add X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset headers after rate limit checks; add Retry-After: 60 on 429 responses

Frontend Cleanup:

• Add DocsService::clearCache() method for cache invalidation
• Remove duplicate .kb-page ::selection CSS rule
• Update $toolIcons to current consolidated tool names (sbox_kb, sbox_docs, sbox_admin, sbox_contribute, sbox_stats)

Add a new admin API test page (admin/api-test.php) with a UI to run and inspect all API endpoints (concurrency, progress, history, previews). Improve backend resiliency: HttpClient gains in-memory caching, negative-cache for failures, adjusted TTLs, reduced timeouts/retries and extra cURL options to avoid hammering the s&box API. Make controllers and legacy routes more tolerant of missing/changed upstream endpoints (PlayerController, SearchController, SettingsController, StatsController, StatusController) by falling back to org-based lookups, safer DB access, better pagination and catching Throwables. Update legacy routes to use user_recently_viewed table and add a migration to create missing user tables. Overall these changes aim to handle upstream API inconsistencies, reduce load, and give admins tools to test and debug API health.

Add multiple page-specific CSS files (api-legacy.css, changelog.css, donate.css, nav-auth.css, news.css, org-layout.css, profile.css, public-pages.css) and update shared styles. Update compiled bundle (frontend/css/dist/bundle.min.css) and modify frontend/css/pages/pages.css and frontend/css/styles.css. Also apply changes to frontend/donate.php to match the new styling.