Release history
Changelog
Every new feature, fix and speed-up on s&box Explorer, newest first.
- Last 30 days
- 90
- Features shipped
- 233
- Fixes
- 218
- Days with changes
- 66
12 changes in July 2026 Clear filters
July 2026
6
-
Feature
10:58 PM
Render detailed Facepunch API changelists with Added/Improved/Fixed categories in version history
1e4e028 -
Fix
10:55 PM
Render changelog on package page and add .htaccess API rewrite rules
69c34b7 -
Fix
10:53 PM
Format package links in code search as canonical /org/ident/ URLs
427751f -
Feature
10:52 PM
Update sbox_package tool with package_stats, steamid, and validated actions
b29a4cb -
Feature
10:46 PM
Add Package Data & Tools section to package detail sidebar
5b535a1 -
Feature
10:46 PM
Integrate Facepunch public APIs (Code Search, Package & Player Stats, Storage, Changelists, MCP actions)
25c8261
3
-
Fix
4:49 AM
10/10 MCP cleanup — tool mappings, dead code, naming
Details
- Added migrate, refactor, test, tool_search to explain.php toolMappings
- Removed unused KnowledgeDB::deleteEntry() (just called delete())
- Renamed changelog.php → updates.php (matches registered tool name)
- Updated all references in index.php and MCP_TOOLS_AUDIT.md
25eb187 -
Fix
4:39 AM
Remove mock api_diff tool, fix silent error swallowing
Details
- Removed sbox_api_diff (returned hardcoded mock data, not useful)
- Added error logging to mcpResolveAuthor empty catch block
- Updated tool counts: 17 → 16 tools, 123 → 120 parameters
- Updated MCP_TOOLS_AUDIT.md and index.php references
e89b069 -
Feature
1:17 AM
Schema auto-discovery — 5-strategy chain with parallel CDN probing
Details
- Multi-strategy URL resolution: env var → cached → scraping → CDN → fallback
- Fixed CDN probing: HEAD returns 200 for any URL, switched to GET+Range with JSON check
- Fixed 206 Partial Content acceptance (CDN returns 206 for Range requests)
- Parallelized probing with curl_multi (20 concurrent connections)
- Added refresh_schema admin action for manual refresh
- Persisted URL cache with 1-year TTL
50f5cd7
2
-
Feature
9:05 PM
Best-in-class MCP tooling — 17 tools, 11 improvements
Details
Major improvements:
- Add MCP tool annotations (readOnlyHint, destructiveHint, etc.) to Registry
- Add isError flagging on tool execution errors in index.php and StreamResponse
- Add negative guidance (Do NOT use for...) to all 16 tool descriptions
- Add additionalProperties: false to all tool inputSchemas
- Add pagination metadata (has_more, total_count) to list endpoints
- Add dry-run pattern for admin delete_all operation
- Add outputSchema to 5 structured tools (stats, package, kb, search, docs)
- Add cache metadata to cached responses in stats and package tools
- Add _context parameter to search, refactor, and contribute tools
- Add full audit trail logging to all admin operations
- Add sbox_tool_search meta-tool for progressive tool discovery
- Trim all tool descriptions to 100-150 chars optimal for AI agents
- Update MCP_TOOLS_AUDIT.md with all changes (17 tools documented)
f544a64 -
Fix
8:25 PM
MCP toolset overhaul — bug fixes, security hardening, new tools
Details
- Fix duplicate sbox_search_docs alias in Registry
- Fix kb.php slug key bug (slug→url in update mapping)
- Fix admin.php single-quote string interpolation
- Fix contribute.php silent exception swallowing
- Fix package.php operator precedence in FullIdent
- Fix migrate.php false positive regex with word boundaries
- Add try/catch wrappers to 6 tool callbacks (search, stats, scaffold, refactor, diagnose, explain)
- Fix &\ reference leak in search.php
- Replace define() constants with static auth context in Auth.php
- Add timing-safe hash_equals for API key comparison
- Add DNS rebinding protection (safeFetch) in KBService
- Fix trending sort by engagement in KnowledgeDB
- Fix PDO type binding in SemanticSearch
- Hide internal errors in VotingService
- Fix dry_run and sortBy in AdminService
- Add sbox_test tool (NUnit test scaffold generator)
- Add sbox_api_diff tool (API version comparison)
- Wire new tools into index.php with Claude Code tab
64e655c
1
-
Fix
10:07 PM
CSP policy, MCP key generation, presence settings, and service worker resilience
Details
- SecurityMiddleware.php: add missing CSP domains (Google Analytics regional, AdSense, Steam avatars, Google Fonts, Facepunch services) to connect-src and script-src; add data: to font-src
- .htaccess: sync report-only CSP with enforced policy
- mcp.php: fix apiSuccess envelope mismatch (data.key -> data.data.key) that caused 'Cannot read properties of undefined (reading substring)'
- legacy-compat.php: auto-create user_presence_settings table on first access; log actual DB errors instead of generic message
- profile-api.php: change requireAuth() to requireAuthApi() on all API endpoints so unauthenticated fetch() calls get JSON 401 instead of HTML 302 redirect
- settings.js: make presence save non-blocking so a presence failure doesn't kill the entire settings save
- service-worker.js: null-check request/url before accessing properties, wrap new URL() in try/catch, bump cache version to v2
fb94470
Generated from the project's commit history whenever the site is deployed. Times are server time.