Release history
Changelog
Every new feature, fix and speed-up on s&box Explorer, newest first.
- Last 30 days
- 90
- Features shipped
- 233
- Fixes
- 218
- Days with changes
- 66
6 changes in July 2026 Clear filters
July 2026
2
-
Fix
10:55 PM
Render changelog on package page and add .htaccess API rewrite rules
69c34b7 -
Fix
10:53 PM
Format package links in code search as canonical /org/ident/ URLs
427751f
2
-
Fix
4:49 AM
10/10 MCP cleanup — tool mappings, dead code, naming
Details
- Added migrate, refactor, test, tool_search to explain.php toolMappings
- Removed unused KnowledgeDB::deleteEntry() (just called delete())
- Renamed changelog.php → updates.php (matches registered tool name)
- Updated all references in index.php and MCP_TOOLS_AUDIT.md
25eb187 -
Fix
4:39 AM
Remove mock api_diff tool, fix silent error swallowing
Details
- Removed sbox_api_diff (returned hardcoded mock data, not useful)
- Added error logging to mcpResolveAuthor empty catch block
- Updated tool counts: 17 → 16 tools, 123 → 120 parameters
- Updated MCP_TOOLS_AUDIT.md and index.php references
e89b069
1
-
Fix
8:25 PM
MCP toolset overhaul — bug fixes, security hardening, new tools
Details
- Fix duplicate sbox_search_docs alias in Registry
- Fix kb.php slug key bug (slug→url in update mapping)
- Fix admin.php single-quote string interpolation
- Fix contribute.php silent exception swallowing
- Fix package.php operator precedence in FullIdent
- Fix migrate.php false positive regex with word boundaries
- Add try/catch wrappers to 6 tool callbacks (search, stats, scaffold, refactor, diagnose, explain)
- Fix &\ reference leak in search.php
- Replace define() constants with static auth context in Auth.php
- Add timing-safe hash_equals for API key comparison
- Add DNS rebinding protection (safeFetch) in KBService
- Fix trending sort by engagement in KnowledgeDB
- Fix PDO type binding in SemanticSearch
- Hide internal errors in VotingService
- Fix dry_run and sortBy in AdminService
- Add sbox_test tool (NUnit test scaffold generator)
- Add sbox_api_diff tool (API version comparison)
- Wire new tools into index.php with Claude Code tab
64e655c
1
-
Fix
10:07 PM
CSP policy, MCP key generation, presence settings, and service worker resilience
Details
- SecurityMiddleware.php: add missing CSP domains (Google Analytics regional, AdSense, Steam avatars, Google Fonts, Facepunch services) to connect-src and script-src; add data: to font-src
- .htaccess: sync report-only CSP with enforced policy
- mcp.php: fix apiSuccess envelope mismatch (data.key -> data.data.key) that caused 'Cannot read properties of undefined (reading substring)'
- legacy-compat.php: auto-create user_presence_settings table on first access; log actual DB errors instead of generic message
- profile-api.php: change requireAuth() to requireAuthApi() on all API endpoints so unauthenticated fetch() calls get JSON 401 instead of HTML 302 redirect
- settings.js: make presence save non-blocking so a presence failure doesn't kill the entire settings save
- service-worker.js: null-check request/url before accessing properties, wrap new URL() in try/catch, bump cache version to v2
fb94470
Generated from the project's commit history whenever the site is deployed. Times are server time.