Changelog

35 destructive actions were guarded by window.confirm(), which cannot show what is about to be deleted, looks different in every browser, and can be suppressed after a few dialogs, quietly turning a guarded action into an unguarded one. 23 inline handlers become data-confirm attributes and 12 JS call sites await adminConfirm().

The dashboard tool grid now renders from the nav registry, so all 29 tools appear grouped by section instead of a hand-picked 17.

The admin area had 31 pages each hand-rolling their own <head>, stylesheet list and footer, which is how the CSS list drifted, how five pages ended up never closing .admin-layout, and how the sidebar (29 tools), the dashboard grid (17) and reality (30) all disagreed about what exists.

• admin/includes/admin-nav.php is now the one list of tools
• admin/includes/admin-page.php renders the page shell
• Ctrl+K palette and a sidebar filter, for jumping between 30 tools
• adminConfirm() replaces native confirm() for destructive actions
• admin pages no longer pull the 8-script front-end vendor bundle

The footer now reads "1.0.0 [acc26c6]", so what is live is identifiable at a glance instead of having to be inferred from a git log.

The deploy already computed the hash for its own log line. It now also writes it to config/build.php, after the rsync and into the document root only. That file is generated and never committed, so rsync has nothing to overwrite it with and no install that was not deployed by the hook gets a stale value.

A generated PHP file rather than a text file read at runtime, so opcache holds it and no request pays for the I/O.

Degrades to the bare version when the stamp is absent, which is the case locally and on any manual install. The bracket is only rendered for a non-empty APP_BUILD, so it never shows an empty [].

Builds in the server-side clone, then rsyncs into the document root with .deployignore holding back everything the live site owns.

No -p on the rsync. With it, rsync stamps the source tree's permissions onto the destination including the document root itself. The repository cPanel creates is mode 700, so a -p deploy left the docroot at 700, the web server's group lost traverse, index.php stopped executing and Apache served a directory listing instead. Without -p, existing files keep their own permissions and --chmod applies only to files rsync creates. The explicit chmod 750 afterwards is belt and braces on the one permission that takes the site down.

Lives on dev. master is production: the deploy hook fires on a push to the checked-out branch there, so master is only ever reached by a deliberate merge.

Borrows the shape of the in-game menu (icon rail, filter pills, content rows with a lead tile, activity sidebar) but keeps this site's own visual language: our tokens, our type scale, our spacing. Deliberately not a reproduction of it.

The colours are a normal entry in frontend/css/ee/, so Settings > Appearance picks the theme up automatically like any other. The layout is server-rendered though, so the server has to know the choice before it renders; it learns it from a cookie theme-manager.js mirrors alongside localStorage. Resolution runs in bootstrap, before any output, because setcookie() silently fails once headers are sent.

The picker writes both cookies, which makes it authoritative. Without that, anyone who had ever opted out with ?beta=0 would pick the theme in Settings and keep getting the classic layout forever, with no way to fix it from the UI. ?beta=1 and ?beta=0 still work as shareable links and still win for the request they are on; they just no longer outlive the next theme change.

The homepage rows de-duplicate across each other, since the same package otherwise turns up in several of them and the page looks like it is repeating itself.

sbox.scmm.app stopped resolving (NXDOMAIN, not a transient outage), which left every /skins route rendering an empty page. sboxskins.gg exposes an equivalent JSON API, so the section is rebuilt on that instead of dropped.

Their robots.txt carries "Disallow: /api". The endpoints are public and unauthenticated, but that is a stated preference against automated use, so the cache TTLs are long, the User-Agent is identifiable, and the catalogue is paged through /api/items rather than making 221 detail calls.

Notes on their data, learned the hard way:

• priceHistory comes back newest-first, so it is reversed once on fetch rather than in each consumer. Left alone, the charts ran backwards and a "last N days" window returned the oldest N.
• sharePercent does not match the holdings it describes (92 units reported as 41.3%, 500 units as 0.9%), so shares are computed from quantity/totalSupply instead.
• ratingGrade is only returned by the list endpoint, never the detail one, so it is borrowed from the already-cached catalogue.
• priceChange24h is a percentage while priceChange6h is an absolute dollar delta, which is easy to render as the wrong unit.

SKINS_ENABLED gates the whole section for the next time a source dies. With it off, /skins used to fall through to the org handler and fuzzy-match an unrelated org page with a 200; it now returns a real 404 page.

Also fixes the homepage carousels, which all showed near-identical packages. The API ignores a &sort= parameter entirely: sorting is a token inside the query ("type:game sort:trending"). Sending it as a parameter meant every carousel got the same default ordering.

• Multi-strategy URL resolution: env var → cached → scraping → CDN → fallback
• Fixed CDN probing: HEAD returns 200 for any URL, switched to GET+Range with JSON check
• Fixed 206 Partial Content acceptance (CDN returns 206 for Range requests)
• Parallelized probing with curl_multi (20 concurrent connections)
• Added refresh_schema admin action for manual refresh
• Persisted URL cache with 1-year TTL

Major improvements:

• Add MCP tool annotations (readOnlyHint, destructiveHint, etc.) to Registry
• Add isError flagging on tool execution errors in index.php and StreamResponse
• Add negative guidance (Do NOT use for...) to all 16 tool descriptions
• Add additionalProperties: false to all tool inputSchemas
• Add pagination metadata (has_more, total_count) to list endpoints
• Add dry-run pattern for admin delete_all operation
• Add outputSchema to 5 structured tools (stats, package, kb, search, docs)
• Add cache metadata to cached responses in stats and package tools
• Add _context parameter to search, refactor, and contribute tools
• Add full audit trail logging to all admin operations
• Add sbox_tool_search meta-tool for progressive tool discovery
• Trim all tool descriptions to 100-150 chars optimal for AI agents
• Update MCP_TOOLS_AUDIT.md with all changes (17 tools documented)

• feat(mcp): add Streamable HTTP (SSE) transport support

• Add McpStreamResponse class for SSE event streaming
• Upgrade McpResponse with dual-mode output (JSON or SSE)
• Detect Accept: text/event-stream and stream for eligible tools
• Add per-file progress notifications to sbox_analyse
• Add fetch/search progress notifications to sbox_docs
• Advertise 'logging' capability in initialize response
• Bump server version to 2.2.0
• Fully backward-compatible: non-SSE clients unchanged

• docs(mcp): add Streamable HTTP (SSE) section to browser landing page

Explains how SSE streaming works, that it's automatic for modern clients, shows an example response for custom client developers, and notes backward compatibility.

• fix(mcp): SSE detection via X-MCP-Stream header opt-in

IDEs like Kiro/Cursor don't send Accept: text/event-stream. Instead of guessing, use explicit opt-in:

• Accept: text/event-stream (spec-compliant clients)
• X-MCP-Stream: true header (IDEs that support custom headers)

Without either signal, plain JSON is returned (safe default). Updated landing page docs to show how to enable streaming.

• feat(mcp): add prompts, completion, batch requests, and logging

New MCP protocol features:

1. prompts/list + prompts/get — 6 pre-built prompt templates:

• review_sbox_code: Performance/networking code review
• explain_component: Deep-dive on any s&box type
• network_this: Multiplayer networking plan for a feature
• scaffold_component: Generate full component from description
• debug_issue: Troubleshoot errors with KB/docs context
• whats_new: Latest KB entries and trending topics

2. completion/complete — Auto-completion hints for:

• All tool arguments (actions, categories, tags, slugs)
• All prompt arguments (component names, focus areas)
• Live slug completion from KB search

3. Batch requests — POST an array of JSON-RPC requests:

• Safe methods processed in one round-trip
• tools/call excluded from batch (requires streaming/auth)

4. logging/setLevel — Accepts client log level preference

5. Bumps server to v2.3.0, advertises prompts + completions capabilities in initialize response.

6. prompts/list and completion/complete are public methods (no auth required, like tools/list).

• fix(mcp): disable Apache/PHP-FPM buffering for SSE support

The server has no nginx (Apache 2.4.67 + PHP-FPM directly). SSE wasn't working because: 1. mod_deflate/mod_brotli buffer entire response for compression 2. PHP-FPM output_buffering holds output until script ends

Fixes:

• Root .htaccess: Exclude /mcp/ from gzip/brotli compression
• mcp/.htaccess: Disable output filters for the endpoint
• mcp/.user.ini: Disable PHP output_buffering and enable implicit_flush (read by PHP-FPM per-directory)

• fix(mcp): accept int|string request IDs in SSE stream

JSON-RPC id can be integer or string. The begin() method was typed as ?string but clients send integer IDs (e.g. id: 1). Changed to mixed to accept both.

• feat(mcp): enable SSE streaming for all tools

All 6 tools now respond via SSE when the client opts in. Fast tools (sbox_stats, sbox_contribute) just send the final result as a single SSE event. No behavior change for tools that already had progress notifications (analyse, docs, kb).

• docs: add continuation prompt for next MCP feature session

• feat(mcp): add scaffold, diagnose, changelog tools + semantic search, voting, code validation, context support

New tools:

• sbox_scaffold: Generate boilerplate C# for 8 template types (component, networked_component, game_resource, panel, game_mode, player_controller, npc, service)
• sbox_diagnose: Static analysis for s&box C# code — networking, lifecycle, performance, security, and common gotchas
• sbox_changelog: View recent KB activity (new entries, updates, contributions, summary)

New services:

• SemanticSearch: pgvector cosine similarity → pg_trgm fallback → fulltext search. Degrades gracefully on shared hosting without pgvector.
• VotingService: Upvote/downvote system with quality score integration. Auto-creates mcp_knowledge_votes table. One vote per user per entry.
• CodeValidator: Inline C# code validation in sbox_contribute — checks structure, naming, s&box API usage, and common mistakes.
• ContextService: Processes _context parameter across all tools for context-aware search enhancement, result ranking, and suggestions.

Updated tools:

• sbox_kb: Added semantic_search and vote actions, integrated ContextService for smarter search results
• sbox_contribute: Added CodeValidator checks before submission (blocks on errors, surfaces warnings)

Infrastructure:

• Bumped server version to 2.4.0
• Added completions for all new tools in McpCompletion
• All new services auto-create DB schemas on first use
• Full SSE streaming support in new tools

• fix(mcp): resolve audit failures — path resolution, class name, timeout, N+1 detection

• Fix require_once path in SemanticSearch.php, VotingService.php, and AdminService.php: use '/../../../backend/' (3 levels up from mcp/lib/services/) instead of '/../../backend/' (2 levels)
• Fix AdminService.php referencing non-existent 'QualityScorer' class — corrected to 'McpQualityScorer' (2 call sites)
• Rewrite changelog_summary to consolidate queries (4→3), wrap in try/catch for graceful timeout handling, fix array_sum on potential non-array from FETCH_KEY_PAIR
• Enhance diagnose_performance with N+1 loop detection: tracks foreach/for/while brace depth via loopStack and flags Scene.Trace, Components.Get, Clone/Instantiate, and RPC/Broadcast inside loops

• fix(mcp): resolve second audit round — N+1 detection, audit_logs, constructor checks, security

Diagnose tool:

• Fix loop depth tracking: start at 0 (not brace count on foreach line) so loops with opening brace on next line are correctly tracked
• Add iteration-pattern detection (GetAllObjects, GetAllComponents, etc.) to catch N+1 even when combined with foreach on the same line
• Broaden constructor detection regex to match any non-void/non-static method-like pattern without 'override', catching more constructor forms
• Add Components.Get detection in constructors (not just Transform/GO)
• Add HTTP exfiltration checks: HttpClient/WebRequest near user data, string interpolation of SteamId/PlayerId into URLs

Admin tool:

• Fix audit_logs handler: extract logs from AdminService wrapper result (was iterating the wrapper dict, causing 'array offset on true')
• Map correct DB column names (created_at not timestamp, target_id not entry_id, details.reason not top-level reason)

Contribute tool:

• Normalize literal '\n' escape sequences to real newlines before code block detection (fixes rejection when clients send escaped strings)

• refactor(mcp): rename sbox_changelog → sbox_updates, add browser UI examples for new tools

• Rename sbox_changelog to sbox_updates to avoid confusion with the official s&box game changelog. Description now explicitly states this tracks knowledge added to this MCP server, not Facepunch releases.
• No legacy alias needed (tool not yet public).
• Add entries for sbox_scaffold, sbox_diagnose, sbox_updates so they appear with clickable example JSON on the /mcp/ browser page.
• Add all 3 new tools to mapping (scaffold+diagnose → docs, updates → kb).
• Update Completion.php: rename completeChangelog → completeUpdates, match on 'sbox_updates' instead of 'sbox_changelog'.

• feat(mcp): add unified search tool, analyse+diagnose alignment, and Discord webhook notifications

New tool:

• sbox_search: Unified search across KB + official docs + API schema in one call. Merged ranked results with source icons, context boosting, and per-source filtering. Registered in index.php with browser example.

Improvements:

• AnalyseService now runs diagnose_performance, diagnose_lifecycle, diagnose_security, and diagnose_sbox_gotchas on each C# file during project analysis. Results are severity-mapped and merged into the health score. Fixes the 'sbox_analyse missed N+1' audit finding.

Discord webhook notifications for MCP events:

• New McpWebhookService (backend/includes/McpWebhookService.php) sends rich Discord embeds for: contribution submitted, approved, rejected, entry updated, entry deleted.
• Admin panel (admin/webhook-settings.php) extended with MCP section: separate webhook URL, enable toggle, 5 event checkboxes, test button.
• Settings stored in existing webhook_settings table with mcp_* prefix.
• Webhook calls wired into contribute.php, kb.php (update), and AdminService (approve/reject/delete). All wrapped in try/catch — webhook failures never block the primary action.
• Notifications logged to webhook_sent_notifications for history.

• refactor(admin): overhaul webhook-settings UI with tabs, action-grid, and data-table

• Add 3-tab navigation: Package Webhooks, MCP Webhooks, Notification History
• Convert actions section to action-grid with individual cards
• Convert notification log from custom divs to data-table
• Remove all inline style attributes and the style block
• Add switchTab() JavaScript function
• All 7 POST form actions preserved unchanged
• Backend PHP logic completely untouched

• chore: mark FEAT-001 webhook-settings-overhaul as completed

• fix(admin): use data-tab attributes and URL hash for tab persistence

• Replace brittle onclick-based tab selector with data-tab attributes
• Add URL hash persistence so tab state survives page reload
• Read hash on DOMContentLoaded to restore active tab
• Update MCP action redirects to use #mcp hash
• Update clear_notifications redirect to use #history hash

• feat: create MCP Tools documentation page at /mcp-tools

• Add /frontend/mcp-tools.php with full documentation for all 11 MCP tools
• Document sbox_search, sbox_kb, sbox_docs, sbox_contribute, sbox_diagnose, sbox_analyse, sbox_scaffold, sbox_admin, sbox_updates, sbox_stats, sbox_explain
• Include hero section, quick-start guide, tools overview with expandable cards, usage examples, common workflows, best practices, troubleshooting, and perf tips
• Add route in routing_logic.php for /mcp-tools
• Add /mcp-tools to maintenanceExempt list in index.php
• Use existing .mcp-* CSS design system classes throughout
• Add copy-to-clipboard and expand/collapse JS interactions

• chore: mark FEAT-001 mcp-tools documentation page as completed

• feat: add sbox_package and sbox_explain MCP tools

• sbox_package: search, get, popular, dependencies, health actions
• Uses fetchPackagesBySearch from api_functions.php
• Streaming for search and popular actions
• CacheManager for popular/health results (60s TTL)
• Rich error messages with what/how/related format

• sbox_explain: tools, recommend, workflow, error actions
• Lists all registered tools from ToolRegistry::list()
• Keyword-based intent matching for recommendations
• 5 predefined workflow guides
• Detailed error code explanations from McpToolRegistry::ERROR_CODES

• Registered both in mcp/index.php

• chore: mark FEAT-002 sbox_package and sbox_explain tools as completed

• feat: add sbox_migrate and sbox_refactor MCP tools

• chore: mark FEAT-003 sbox_migrate and sbox_refactor tools as completed

• feat: improve existing MCP tools with new actions, dynamic scoring, and rich errors

• sbox_diagnose: add fix/batch actions, populate fix fields in diagnostics
• sbox_search: replace hardcoded relevance with dynamic scoring, add did_you_mean
• sbox_stats: add kb_health/community/tool_usage actions, increase cache to 60s
• sbox_scaffold: add from_description/test/multi templates
• All tools: rich error messages with what/how/related format

• chore: mark FEAT-004 existing tools improvement as completed

• feat: add streaming progress support to kb, docs, admin, and contribute tools

• chore: mark FEAT-005 streaming progress support as completed

• fix: address review issues in MCP tools (fabricated data labels, fallback warnings, thresholds)

• stats.php: Label estimated values with ~ prefix and (estimated) suffix, add disclaimer when KnowledgeDB methods are unavailable
• package.php: Warn when falling back to non-exact match in package_get(), include actual ident of returned package for verification
• search.php: Tighten did_you_mean threshold from max(3, len*0.6) to max(2, len*0.4) for better suggestion quality
• migrate.php: Add note about lines with multiple deprecated patterns needing multiple passes

• feat: add tool cards for sbox_package, sbox_explain, sbox_migrate, sbox_refactor to MCP tools page

• Add sbox_package to Search & Discovery group with actions, params, examples
• Replace sbox_explain Coming Soon placeholder with full tool card in Search & Discovery
• Add new Code Transformation group with sbox_migrate and sbox_refactor
• Remove sbox_explain from Administration group
• Update hero stats from 11 to 15 tools, 50+ to 60+ actions
• Update group counts: Search & Discovery 5, Administration 1, Code Transformation 2

• refactor: replace Available tools section with compact CTA linking to /mcp-tools

• Removed all PHP tool-card rendering logic (, , arrays and foreach loops)
• Added compact stats grid (15 tools, 60+ actions, 5 categories, SSE streaming)
• Added 'View Full Tools Documentation' button linking to /mcp-tools
• Added 'Tools Reference' button in hero buttons area linking to /mcp-tools

• feat: hide Administration tool group on mcp-tools page for non-admin users

• feat: add /mcp-tools route to router.php

• refactor: rewrite router.php with clean table-driven routing patterns

• chore: remove excessive comments and separator lines from router and MCP tool files

• fix: remove debug error_log from production routing_logic.php

• feat: add MCP Resources support with registry and 7 registered resources

• chore: mark FEAT-001 as completed

• feat: add 4 new MCP prompts and enhance kb vote/feedback actions

• Add project_review, multiplayer_setup, performance_audit, migrate_code prompts
• Add optional reason field to sbox_kb vote action with logging
• Add new feedback action to sbox_kb with helpful/not_helpful signals

• chore: mark FEAT-002 as completed

• feat: add sbox://project/context resource and project_setup action to sbox_explain

• chore: mark FEAT-003 as completed

• feat: add IDE Integration Guides section with tabbed setup for Cursor, Continue, Claude Desktop, Windsurf, and Generic

• chore: mark FEAT-004 as completed

• fix: handle null type in resource handler and differentiate feedback from vote

• Return empty contents array when ApiSchemaService::getType() returns null instead of returning "null" as text content
• Make kb_handleFeedback() semantically distinct from kb_handleVote():
• Always log with [AI feedback] context marker (not just when reason given)
• Include entry title in the feedback log when available
• Return response message clearly identifying as AI quality feedback

• fix: resolve 6 MCP tool audit issues

• admin: add explicit 'approve' and 'reject' action cases that route to the moderation approval/rejection logic
• contribute: return the actual mcp_knowledge entry ID (not the mcp_contributions ID) when auto-approving trusted submissions
• stats: replace placeholder tool_usage output with actual tool listing showing all available tools and their actions
• diagnose fix: when issue line is 0, prepend the fix instead of silently returning unchanged code
• diagnose batch: add public field detection to diagnose_sbox_gotchas so batch and single-file modes both catch this pattern
• admin audit_logs: fix KnowledgeDB::getAuditLogs to properly bind the LIMIT parameter and decode JSON details column

---------

Add daily chart history data files for game (2026-05-04 to 2026-05-26) and map (2026-05-05 to 2026-05-27). Each JSON contains daily rankings with title, org, user counts and favorites for use in analytics/leaderboards.

Large-scale refactor and feature expansion across frontend, backend, API, schema, documentation, and MCP systems focused on improving maintainability, developer tooling, performance, and overall platform stability.

Frontend & UI:

• Reworked and cleaned CSS across multiple components
• Improved shared frontend architecture and reusable layouts
• Refined package sections and overall interface presentation
• Applied broad UI polish and styling consistency improvements
• Updated packages.css and related styling assets
• Improved settings pages and related components
• Refined user profile redesign elements
• Updated usage stats and global stats pages
• Refactored profile CSS/markup and removed duplicate styling rules
• Improved profile layout spacing, grids, and section structure
• Cleaned favorite games UI and condensed playtime display logic
• Fixed minor layout and margin inconsistencies
• Added Steam inventory UI with new card-based layout system
• Added inventory section rendering and fallback handling

Backend, API & Schema:

• Refactored API functions and related integrations
• Cleaned and updated schema systems
• Improved overall code organization and maintainability
• Added ApiSchemaService for schema fetching, caching, indexing, and search support
• Added schema chunking and improved type formatting and handling
• Improved API validation and detection of obsolete structures

Analysis & Developer Tooling:

• Added and enhanced AnalyseService for static project analysis
• Improved C#, UI, styles, and asset scanning capabilities
• Introduced structured optimization reports with severity scoring and suggestions
• Added autofix suggestions and richer issue payload output
• Integrated ApiSchemaService into analysis pipeline
• Added chunked/session-based analysis with merge and cleanup support
• Introduced audit.md report generation workflow
• Registered and refined sbox_analyse MCP tool integration

Documentation System:

• Expanded DocsService capabilities and tooling
• Added chunked documentation page fetching
• Improved documentation searching, categorisation, and snippet generation
• Improved caching layers and sanitisation handling
• Updated external request user-agent handling

Database & Knowledge Systems:

• Improved KnowledgeDB duplicate detection logic
• Added pg_trgm similarity support with safe fallback handling
• Reduced noisy error output when extensions are unavailable

MCP & Platform Services:

• Improved MCP client detection and capability negotiation
• Updated mcp/index.php with improved tool registration and UI examples
• Bumped MCP server version to v2.1.0
• Added demo analysis tool entry point
• Improved memory and upload limit handling
• Tightened .htaccess constraints for MCP stability

Steam Integration & Profile Systems:

• Added Steam inventory fetching via SteamIntegrationManager
• Implemented caching and merging improvements for Steam friend and presence data
• Added multi-cURL based Steam store image fetching (capsule/header assets)
• Enhanced Steam game data enrichment with public app ID filtering
• Improved Steam API caching, error handling, and data consistency
• Expanded profile UI to support Steam inventory display
• Added richer game media rendering on profiles (images, capsules, metadata)

Account System:

• Fixed account deletion related issues
• Added support for fully deleting all user account data
• Improved related account management flows

Organization System:

• Added and refined organization-related functionality
• Improved organization management systems and moderation flows
• Applied frontend and backend improvements for organization features

Misc:

• General project cleanup and polish
• Internal checkpoints and development progress saves
• Performance improvements, caching enhancements, and stability fixes across systems