Changelog

2e945aa fixed backend/api/auto-refresh.php, but the caller in production is tools/scheduled-refresh.php, run from cron every 30 minutes. Minutes after the deploy it started a refresh for a "user" named player_all_packages_76561198162354937 - a cache key the player pages write, read back as a username by the same str_replace bug. It now requires the expected prefix and skips anything else, and the name reaches the shell through escapeshellarg rather than bare double quotes.

The same pattern is in tools/cron-refresh.php, tools/refresh-endpoint.php, tools/cleanup-invalid-cache.php and admin/refresh-status.php. None of them run: they are not in the crontab, nothing references them, and the admin page only displays. Left alone.

The first deploy to run tools/deploy-prune.sh printed

tools/deploy-prune.sh: line 29: /dev/fd/62: No such file or directory prune: moved 0 file(s) deleted since 09cea795

The host's bash has no /dev/fd, so the process substitution feeding the loop failed and the loop read nothing. "moved 0 file(s)" was true only because this deploy deleted nothing; a deploy that removed files would have reported the same and left them live. The list now goes through a temp file. Redirecting a pipeline also exposes its exit status to set -e, and git check-ignore exits 1 when no path is ignored, so the pipeline is guarded.

Verified on the server: process substitution fails there, the temp-file pipeline lists all 14 files deleted in 09cea79. The test now also rejects process substitution, which no local shell would have caught.

The background refresh failed 204 of its last 218 runs and retried the same handful of orgs every few seconds, attempt 309 and counting. Three bugs:

• BackoffStrategy cast 30 * 2^(n-1) to int before capping it. Past ~58 failures the float no longer fits and PHP casts it to 0, so the wait collapsed to nothing. It now caps first; a long streak waits 30 minutes.
• The worker treated an org with no packages as a failed fetch. codira, shadowstudio and lore are real orgs with zero packages, so they could never succeed. Only a failed request is a failure now; an empty list is cached.
• auto-refresh read every TYPE_USER_PACKAGES cache key as a username, including the player_all_packages_{steamid} keys the player pages write, and started workers for a user of that name. Keys without the expected prefix are skipped, and the name now reaches the shell through escapeshellarg.

The worker also re-queried eleven types for every org, one of them "texture", which Facepunch ignores and answers with the whole catalogue. The per-type sweep now runs only when the first pass hit its 2,000 cap, over the types that exist, including clothing, sound, vsnd and tmat, which it never asked for.

Deploys never removed anything: rsync has no --delete, so all 14 files removed in 09cea79 stayed live, and the dropped 2027 theme stayed in the theme picker. tools/deploy-prune.sh moves files deleted in git since the recorded build into ~/sbox-backups, skipping whatever .deployignore excludes, so server-owned paths are never touched. It does not use .gitignore, which ignores /tools/* and would have left deleted cron scripts executable. A failure only reports; the deploy carries on.

Also: browse chips for Addons, Collections, Entities and Terrain Materials (each larger than the Prefab or Shader lists), German "Prefabs" and "Sounds" in place of "Fertighäuser" and "Klingt", a successful webhook no longer written to error_log, and the comments removed from code deployed earlier.

• Org links: org pages and the classic package sidebar read website, X and Discord off the Org object inside package results, which Facepunch now fills with Ident, Title and Thumb only. No org page showed its links or summary. They now come from the organization record (fetchOrganization, already cached 5 minutes), through orgSocialLinks(), which also stops owner-typed non-http(s) values becoming links and points handles at x.com rather than twitter.com.
• Sound Files filter: it asked for type:soundfile, which does not exist, and Facepunch ignores an unknown type - so it listed all 33,000 packages. It now asks for vsnd (8,876 sound files); /t/soundfile/ redirects there, and the label key is renamed in all 30 languages.
• Empty search: the advice to "try different boolean operators" was wrong - Facepunch search matches AND, OR and NOT as words ("car AND boat" finds more than "car"). A search with no results now says so, instead of suggesting the server might be down.
• Error state: the heading rendered as the raw key "common.errorLoadingPackages", and "contact support" pointed nowhere.
• Translations: a key missing from a language rendered raw, because the English fallback applied only when a whole file was missing. Every one of the 29 languages lacked the same 66 keys. Languages are now layered over English key by key.

chore(views): drop the comments added with the stale-copy fixes

Found by reading error_log, the app log and ~/error_log on the server:

• Client errors: ~90% of the app log was unactionable. One crawler's bare "Script error." (154 in ten days), Applebot and Mediapartners-Google running tippy before Popper had loaded (107), and ResizeObserver loop notices. client-errors.php now drops those three before logging.
• form-validation.js called matches() on window/document, which Firefox hands a captured blur listener: 51 TypeErrors in ten days.
• The Facepunch circuit breaker counted only in Redis, so it did nothing in exactly the outage it exists for. It now falls back to APCu, verified on the production host with Redis absent.
• Bots asking for ?page=913198702 became skip=22829967525 and a 400 from Facepunch. getCurrentPage() caps at 10,000 (Facepunch lists ~33,000 packages, ~1,300 pages), and hidden gems uses it.
• 404s on org news posts join the suppression list; their links outlive the posts.
• fetchPackagesBatch remembers a failed ident for five minutes instead of refetching and relogging it on every view, and a 404 is not an error.
• Webhook "cooldown active" skips were ~2,000 error_log lines a month of the cooldown working; they go to debugLog.
• newspost.css used --text-color, which nothing defines. It resolved to the inherited --text-secondary, so that is now named explicitly and the CSS integrity check passes again.
• CSP (report-only): AdSense's googlesyndication, doubleclick and adtrafficquality hosts, and a frame-src, whose absence sent every ad iframe to default-src 'self'. The live .htaccess is patched by hand as before.

The "PHP Startup: session.gc_divisor must be greater than 0" lines were not the site. getCliPhpBinary() started background jobs with the host's /usr/local/bin/ea-php84, whose php.ini sets the divisor to 0; the site itself serves from alt-php84, which is fine. Each spawn inherited the docroot as its working directory, so the warning landed in our error_log roughly every half hour. The CLI next to the serving PHP (PHP_BINDIR/php) now comes first: same version, same ini, no warning.

Steam outages also logged full request URLs, and every Steam Web API URL carries the account key. HttpService and SteamHttpClient now replace the key= value before a URL reaches a log line or exception message.

"Unable to load skins data right now" was showing most of the time, and it was mostly this site rather than sboxskins.gg, which answers every page in about 0.2s. Two faults, each enough on its own.

The fallback never worked. Production caches in SQLite, and there a plain CacheManager::get() of an expired entry deletes it. fetchSkinsCatalogue() did that read first, then - once the fetch had failed - asked for a stale copy of the entry it had just destroyed. So any failure upstream reached visitors as an empty market for the ten minutes the failure was remembered. The last catalogue that loaded is now kept as its own entry for a week and served whenever a fetch fails; tests/test_skins_fallback.php reproduces the old behaviour against those SQLite semantics and fails on master.

The address pinning discarded the one address that works. sboxskins.gg's DNS rotates through a pool, and from this host part of it is unreachable: 216.150.16.1 and .16.129 time out every time, .16.65 and .1.129 answer in 0.2s. The remembered good address was only used when the current DNS answer happened to contain it, and it expired after ten minutes - shorter than the fifteen between catalogue refreshes - so each refresh gambled on the rotation again, and an answer of two dead addresses failed outright. It is now tried first regardless and kept for a day; it is re-proven on every use, and TLS still checks the certificate against the hostname.

fetchCachedEndpoint(), added for the jam and platform-stats pages, had the same stale-read pattern and so the same hole. It keeps a last-good copy too, so an outage at Facepunch shows slightly old jam data rather than none.

Second pass over the report-only log, from a package detail page rather than the listings.

cdnjs is a real dependency, not stray markup: Font Awesome loads on the profile and package pages and highlight.js on /mcp-knowledge, so it needs script, style and font rather than removing.

media-src was never declared at all, so the loading-screen videos fell back to default-src 'self' and every package page with one logged a violation.

The analytics host is the subtle one. connect-src already listed region1.google-analytics.com, but GA4 collects on region1.analytics.google.com

• a different domain - and picks the region by visitor location, so the

wildcard covers the other numbered hosts rather than waiting to learn each one from a fresh console.

The report-only policy has been logging two violations on every page load.

Both are false alarms in the sense that nothing is blocked, but they bury anything real. service-worker.js caches thumbnails through fetch(), and a service worker fetch is governed by connect-src even when the response is an image - img-src already permits these hosts, which is why the pictures render while the console fills up. Cloudflare injects its own beacon script, so static.cloudflareinsights.com was never going to be in a policy we wrote.

The docroot .htaccess is excluded from the rsync, so this file documents the policy rather than shipping it; the live header needs the same edit by hand.

The app log is 285 reports a day of "Can't find variable: requestIdleCallback", by an order of magnitude the largest entry in it. That is Safari's wording: Safari only shipped the API in 16.4 and older iOS has none, and three call sites used it bare.

The costly one is in theme-manager's UI init, which throws partway through, so date pickers, sliders, tags, the lightbox, charts, drag and drop, gridstack and masonry never initialise for those visitors. Nothing is visible in Chrome, which is why a full front-end audit went straight past it - it only showed up in the errors real browsers were reporting back.

Shimmed once at the top of main.js: it loads first in the shared runtime and everything after it is deferred, so it is defined before any caller, and a native implementation is left alone.

Reproduced against production with the API deleted before page scripts run - "ReferenceError: requestIdleCallback is not defined" - and confirmed gone against the same page with the shim.

sboxskins.gg is a small community server that is often slow, and its connect timeouts were the bulk of what was left in error_log - crowding out the faults that actually need someone to look.

They are not faults. Everything downstream already handles them: the failure is remembered for ten minutes and callers fall back to stale data, which is the whole point of the cache added earlier. So httpCode 0 from that host now goes through Logger::warning into logs/app-<date>.log, where it keeps more context than error_log ever had - endpoint, request id, IP, the cURL error - and stops sitting next to real problems.

A real status code still goes to error_log, because a 403 or a 500 means something changed upstream. So does a malformed body.

With the per-attempt suppression already in HttpService, an unreachable skins host now writes nothing to error_log at all.

RedisCache::init() guarded on $redis being null, but a failed connect sets $redis back to null in the catch - so the guard never tripped. Every isAvailable() call reconnected from scratch and logged again, which is why a 70-second outage on 4 September put roughly 140 identical "Connection refused" lines in error_log: one per cache lookup rather than one per request. Each of those also paid a connect attempt before failing.

Tracked with an explicit attempted flag now, set before anything that can throw, so one attempt is made per request whatever the outcome.

Also suppresses 404s for organization/ lookups, which the list beside it already does for player/, package/get/, package/versions/, news/package/ and package/stats/. A miss there means the ident does not exist upstream - a stale link or a bot walking the URL space - and because any unknown top-level path is resolved as an org ident, every probe for /env, /weapon or /crashes wrote a line. Non-404s from the same endpoints still log.

tests/test_log_noise.php pins both, including the exact state the storm ran in: no handle, but already attempted.

The route was registered only in router.php, which serves the dev server. Production goes through .htaccess into index.php and reaches routing_logic's list instead, so the page worked locally and returned 404 on the live site - found by sweeping production after the deploy rather than localhost.

Every other route in router.php's $frontendRoutes is already in routing_logic. claim-org was the one gap.

Verified by serving the site through a router that mimics .htaccess - straight to index.php, no dev-only route table - where it now redirects to login like its siblings instead of 404ing.

The docroot .htaccess is tracked here but is cPanel's file, not ours. It carries the MultiPHP handler block, which cPanel regenerates and marks do-not-edit, and which the repo copy has never contained - so a deploy overwrote it, AddHandler went away, .php stopped executing and the site served an Apache directory listing until the original was restored from backup.

That is recorded in the changelog but nothing stopped it happening again: the file was still tracked and still absent from .deployignore, so the next deploy would have repeated it exactly.

The rewrite rules the repo copy adds were checked after that incident and are redundant against the server copy, and the server copy's protections are confirmed live - config.php, logs/, data/, .git/ and .env all answer 403 while index.php renders. So the server keeps ownership of this one file.

config/.htaccess and mcp/.htaccess are ours and still deploy.

robots.txt advertises https://sbox.grimtech.co.uk/sitemap.xml. The file on the server listed thirteen URLs and every <loc> pointed at https://sbox.game/ - the upstream platform, not this site - so every URL handed to a crawler was the wrong domain. It also named /stats and /org/<name>, which are not routes here.

Nothing in the repo generated it, and .deployignore listed /sitemap.xml alongside .env and the server-owned config, so no deploy could ever correct it. tools/generate-sitemap.php builds it from this site's real routes and runs as part of npm run build, the same hook the changelog uses.

Package types come from the platform, filtered. Anyone can coin a type by publishing with it, so the raw list is mostly single-package noise - "exe", "jpg", and one obscenity that would have gone straight into a file submitted to Google. ShowOnIndex plus a count threshold leaves seventeen real ones. --verify checks every URL against a running server before writing, so a sitemap of 404s cannot ship; all 38 currently answer 200.

The same exclusion was hiding a second problem. meta/ holds dev tooling next to meta/changelog.json, which frontend/changelog.php reads at runtime, and the whole directory was excluded - so the build regenerated the file and rsync then dropped it. The live changelog stops at April 2, 2026 and shows ten commits. The tooling is excluded by name now and the data ships.

SITE_URL is defined rather than assumed: admin/warmup-redis.php already referenced it with a hardcoded fallback that was always the one being used.

composer.lock, package-lock.json, phpstan.neon, phpunit.xml, router.php and three JS configs were uploaded by hand before the deploy system existed and were serving 200 to anyone. .deployignore keeps them out of new deploys but the rsync has no --delete, so it cannot remove them. The lockfiles are the part that matters: they hand out exact dependency versions to check against known CVEs.

Named individually rather than by extension, because manifest.json and locales/*.json are fetched by the site itself.

Three faults surfaced by the production error log.

org/list has returned 404 since at least June and Facepunch has no bulk replacement (organization/<ident> serves one org at a time). Both callers caught the failure and returned an empty array, so organisation search quietly found nothing rather than reporting a problem, then cached that empty result for an hour. Orgs are now recovered from package search: q=org:<ident> is an exact lookup and a plain term surfaces the orgs owning matching packages. Verified live: "face" finds facepunch, "rat" finds rats and ratman, "studio" finds six, where all three returned nothing before. Both call sites now share one implementation.

package/find silently ignores page and count; only skip and take work. Four call sites sent page/count, so /player/packages returned the same first results on every page and handed back 200 items where the caller asked for 20, while the response advertised correct pagination. Now skip/take, with the offset from Pagination::offset so the existing int32 clamp applies.

mcp/tools/package.php read Org as a string in five places. It is an object everywhere else in the codebase, which is why the log carried a steady drip of "Array to string conversion" and the tool printed Array where the organisation name belongs.

Also stops the settings API writing two INFO lines to the error log on every request, which was most of that file's volume.

tests/test_api_params.php locks all of it in.

A submit button inside a form carrying data-confirm resolves through closest() to the form, not the button. The click handler then called .click() on the form, which has no activation behaviour, so nothing happened: the dialog appeared, you pressed Confirm, and the delete never ran. Fourteen actions across eight pages were affected (announcements, cleanup-invalid-users, donations, manifest-removals x3, mcp-api-keys x5, mcp-knowledge, moderation-logs, webhook-settings). The nine that put data-confirm on the button itself worked, which is why the dashboard and player-history tested fine.

The click handler now defers to the submit handler for forms.

tests/admin-confirm.test.js covers both entry points in jsdom, including cancel and Escape. Verified it fails without the fix.

CSRF: player-history, steam-friends-cache and warmup-redis handled POST with no token check at all. player-history's actions include TRUNCATE of all three player_history tables and exec() of the collector scripts, so a logged-in admin visiting a hostile page could be made to wipe that data. All three now validate and carry a token field, and badge-management drops its local 16-byte, !== comparison in favour of the shared 32-byte hash_equals helpers (its version also left csrf_token_time unset, disabling token expiry for every other page sharing the session).

XSS: Advanced Analytics rendered Steam usernames and avatar URLs into innerHTML unescaped, and Org Claims did the same for usernames, org idents and review notes, including an org ident spliced into an inline onclick="revokeOrg('...')". Steam personas and org idents are user controlled, so both were stored XSS into an authenticated admin session. The revoke button now passes its ident through a data attribute.

The activity heatmap's two third-party scripts get SRI hashes and crossorigin, so a compromised unpkg or d3js.org fails closed.

• api-test.css was written against --card-bg, --border-color, --hover-bg and --text-color, none of which exist. Every rule fell through to a hardcoded dark value, so API Test ignored the theme and was unreadable on the light ones. Rewritten against the real tokens.
• 11 buttons across five pages used class="btn-primary" and friends without the base .btn, which only supplies colour: no padding, radius or alignment.
• .btn-action on Refresh Status was defined nowhere at all.
• table-responsive (also undefined) becomes admin-table-container, so those tables scroll instead of overflowing on narrow screens.
• 32 <i class="material-symbols-rounded"> become <span>, matching the rest of the codebase.
• Adds the .admin-badge-info, .badge-sm, .org-cell, .org-link, .timestamp and .pending-card-* rules that markup referenced but nothing defined.

The Reputation page offered a 'Migrate Schema' button that POSTed to backend/api/migrate-reputation-schema.php, a file that does not exist and is not in git history; router.php carried a matching dead route. Removed both rather than inventing a schema migration.

Both reputation recalculation buttons now report through adminToast instead of alert(). Their endpoints are left alone: recalculate-reputation.php covers users with claimed orgs, recalculate-all-users-reputation.php covers everyone in batches, and they are not interchangeable.

/api/package-leaderboard had no rewrite rule, so it fell through the catch-all to backend/api/package-leaderboard, missed, and landed on the front controller. The browser asked for JSON and got the homepage back, at HTTP 200, so the In-Game Leaderboards panel showed zero entries with no error anywhere. It worked on localhost the whole time, because router.php has the route.

That is the real problem: router.php and .htaccess are two hand-kept lists of the same thing and they drifted, 13 routes against 5. Missing alongside package-leaderboard were manifest-removal-request, steam-friends, kofi-webhook and four reputation endpoints.

.htaccess now resolves by pattern, trying <name>-api.php then <name>.php, each guarded by an -f check so a name only resolves when the file exists. The character class allows no dot or slash, so neither rule can be walked out of the directory, and everything reachable this way was already reachable through the catch-all, so nothing is newly exposed.

Also drops the military_tech icon from the leaderboards heading: nine of the eleven package sections have no heading icon.

And wires ?refresh=1 into fetchSpecificPackage, admin-gated, matching the switch that already works on player profiles and org package lists. Package pages were the one place it silently did nothing, leaving no way to bypass the hour-long cache except waiting.

A crawler walking synthetic pagination reached

package/find/2/?skip=7202577550&take=25&q=849152367+type:model

and every hit logged an upstream 500.

Probed the endpoint: Facepunch holds skip in a signed 32-bit int. skip=2147483647 returns 200, skip=2147483648 returns 500. Anything past TotalCount returns 200 with zero packages, so deep offsets are useless long before they are harmful.

Pagination::parse floored the page at 1 but had no ceiling, so any integer a visitor put in the URL became an offset. Every controller reads its page from there, so the cap goes in the one place rather than in each of them. Page is clamped rather than the offset, so the page number a caller gets back still matches the results it is given.

browse-api.php and code-search-api.php read skip straight from the query string and bypass the parser; code-search-api did not even floor it at zero. Both now go through Pagination::clampOffset.

MAX_OFFSET is 100000: far below the overflow, and more than ten times the largest package type (model, under 10000 entries), so it can only clip requests that would have returned nothing.

The test caught a bug in the first version of this fix: at PHP_INT_MAX the offset multiplication overflows to a float and the int-typed clamp threw a TypeError, which would have been a 500 of our own making.

cPanel will not deploy a repository whose working tree is dirty, and .cpanel.yml runs npm run build inside that clone. frontend/css/dist was untracked rather than ignored, so the build left the tree dirty and cPanel reported deployable: 0 with no error anywhere: the push was accepted, the checkout advanced, and the tasks silently never ran.

Ignoring both dist directories keeps the tree clean across builds. The old negation lines were inert anyway, since nothing ignored those paths in the first place.

The repo copy lacks the cPanel-generated PHP handler block, which is marked 'do not edit' because cPanel regenerates it on any MultiPHP change. Deploying the repo version therefore removed the AddHandler directive, .php stopped executing, and the site served an Apache directory listing until the original was restored from backup.

Verified afterwards that the five /api/* rewrite rules the repo copy adds are redundant: /api/code-search, /api/package-changelists, /api/organization-details and /api/player-extended all return 200 on the restored file. The only other difference was a .dump deny, which belongs on the server copy.

The error log was filling with lines like

HttpService Error (401): - URL: .../storage/query?steamid=...&package=...

one per visit to the storage tab of the data explorer.

Probed the endpoint directly. storage/query and storage/get return 401 for every package and every steamid, including pcjr.oreworks, whose package/stats/2 data is public and returns 200 from the same host. They answer only to a Bearer token minted by a live in-game client session, and Steam OpenID sign-in cannot produce one. storage-explorer.php has said as much in its own UI copy since it was written; the code just never acted on it.

So the request could never succeed. Both service methods now return the failure locally without leaving the process, keeping the exact shapes their three callers already switch on: the 401 array for query, null for get. The explorer page renders identically, because it gates on the httpCode key either way.

storage-api.php was separately answering 200 with "success": true wrapped around the failure payload, which told callers nothing. It now returns 501 with the reason.

Test asserts the shapes hold and that neither method makes a network call, using elapsed time as the proof: a real round trip measured about 200ms, these return in microseconds.

Rate limit counters and refresh locks were only ever cleaned up lazily, by the next request for the same identifier. An IP that visits once, or an org refreshed once and never again, left its file on disk permanently. That had grown to roughly 8000 files, which had to be deleted by hand. Redis is disabled in production, so the file fallback is the live path, not a contingency.

RateLimiter::gc() removes counters whose window has long closed, and runs on roughly 1 in 500 fallback writes so the directory maintains itself. It reads mtime rather than opening files, so clearing a backlog does not parse thousands of JSON blobs. mt_rand rather than random_int for the sampling: it needs no entropy guarantee and sits in a path that must never throw.

Refresh locks leak the same way but are written from five places into three directories, so cache-sweeper.php covers all of them in one place. It sweeps at 300s against a 120s lock timeout, leaving a wide margin so it can never pull a lock out from under a refresh that is still running. The test plants a 5-second-old lock and asserts it survives.

The sweep piggybacks on the existing scheduled-refresh cron rather than needing an entry of its own, and runs before the refresh work so a lock left by a killed run does not block the current one.

Also closes two holes found while making cleanup-cache.php reachable over HTTP, since nothing in .htaccess blocks backend/tools/:

• notify-package-update.php checked only that the X-Cron-Key header was present, never its value, so any value at all got in
• check-package-updates.php had no guard whatsoever

Both send push notifications to every follower. tool-auth.php is now the single check all four scripts route through: CLI, a signed-in admin, or CRON_KEY compared with hash_equals. It fails closed when the key is unset or still the placeholder, so the window between deploying and configuring is shut rather than open.

cleanup-cache.php preflights its own dependencies by name, because production runs with display_errors off and this deploys over FTP, where a half-finished upload otherwise surfaces as an unexplained blank 500.

Two separate bugs made the page look mostly empty.

The trending grid rendered every card at opacity 0. The CSS gates card opacity on a .visible class that nothing in the codebase ever added, so the cards were in the DOM, taking up layout space, and invisible. Only readers with prefers-reduced-motion saw them, because that media query forces opacity back to 1, which is presumably how it shipped. filter() already knows which cards should show, so it toggles the class there rather than adding an IntersectionObserver; that covers first paint, tag filtering, search and Show More in one place.

The counts were also wrong. The API has no sort that surfaces live games: every sort: token it does not recognise (players, active, online, usersnow, hot) falls back to the same default order, and live games are scattered right through all 1600+ results. One take=100 page saw about a third of them. It now sweeps every page concurrently, with take=500 because that is the hard cap, deduplicating by FullIdent since pages are fetched in parallel and the result set shifts underneath them.

Playing Now 68 -> 148, Active Games 21 -> 63.

The grid slice was also a flat 50, which would cut live games off the bottom the moment more than 50 had players in them.

Four things were wrong about how we call public.facepunch.com:

The leaderboard endpoint was still on its pre-versioning shape and returned nothing. It now takes a stat name, defaulting to kills. The stat is validated against a character whitelist and, separately, rejected if it is made only of dots: curl normalises dot-segments in a path, so a stat of ".." would silently rewrite which endpoint the request actually hits.

The TTL map keyed leaderboard responses on "package/leaderboard", which stopped substring-matching once the stat moved into the path, quietly downgrading those entries from 600s to the 300s default. Keyed on "/leaderboard/" now.

package/find/2/ takes skip and take, not page and count, and caps take at 500 (take=1000 returns a 400). count=100 was being ignored, so the caller silently got the 200-item default.

Code search exposes the kind and year facets the API already supported. kind is matched against a whitelist because the API compares it case-sensitively and silently returns nothing for a near miss.

tests/test_facepunch_endpoints.php covers all of it, including that the kind buckets partition the total and the year buckets sum to it.

• Added migrate, refactor, test, tool_search to explain.php toolMappings
• Removed unused KnowledgeDB::deleteEntry() (just called delete())
• Renamed changelog.php → updates.php (matches registered tool name)
• Updated all references in index.php and MCP_TOOLS_AUDIT.md

• Removed sbox_api_diff (returned hardcoded mock data, not useful)
• Added error logging to mcpResolveAuthor empty catch block
• Updated tool counts: 17 → 16 tools, 123 → 120 parameters
• Updated MCP_TOOLS_AUDIT.md and index.php references

• Fix duplicate sbox_search_docs alias in Registry
• Fix kb.php slug key bug (slug→url in update mapping)
• Fix admin.php single-quote string interpolation
• Fix contribute.php silent exception swallowing
• Fix package.php operator precedence in FullIdent
• Fix migrate.php false positive regex with word boundaries
• Add try/catch wrappers to 6 tool callbacks (search, stats, scaffold, refactor, diagnose, explain)
• Fix &\ reference leak in search.php
• Replace define() constants with static auth context in Auth.php
• Add timing-safe hash_equals for API key comparison
• Add DNS rebinding protection (safeFetch) in KBService
• Fix trending sort by engagement in KnowledgeDB
• Fix PDO type binding in SemanticSearch
• Hide internal errors in VotingService
• Fix dry_run and sortBy in AdminService
• Add sbox_test tool (NUnit test scaffold generator)
• Add sbox_api_diff tool (API version comparison)
• Wire new tools into index.php with Claude Code tab

• SecurityMiddleware.php: add missing CSP domains (Google Analytics regional, AdSense, Steam avatars, Google Fonts, Facepunch services) to connect-src and script-src; add data: to font-src
• .htaccess: sync report-only CSP with enforced policy
• mcp.php: fix apiSuccess envelope mismatch (data.key -> data.data.key) that caused 'Cannot read properties of undefined (reading substring)'
• legacy-compat.php: auto-create user_presence_settings table on first access; log actual DB errors instead of generic message
• profile-api.php: change requireAuth() to requireAuthApi() on all API endpoints so unauthenticated fetch() calls get JSON 401 instead of HTML 302 redirect
• settings.js: make presence save non-blocking so a presence failure doesn't kill the entire settings save
• service-worker.js: null-check request/url before accessing properties, wrap new URL() in try/catch, bump cache version to v2