Changelog

• feat: implement unused API data fields across the application

• Add ReviewStats rating distribution histogram on package detail page (new section showing star breakdown like Steam/Google Play)
• Add Org social links (Twitter, Discord, WebUrl) on org page with org description display
• Add 'Latest Update' callout using Version.Changes from package/get (shows changelog snippet without extra API call)
• Use ThumbWide as preferred hero banner image on package detail
• Add ThumbWide srcset to package grid cards for responsive loading
• Re-enable Version info block in package-details.php (was disabled)
• Add FileSize and API Version from /status endpoint to footer
• Add Author.Online indicator (green dot) on news posts
• Add Author.Score badge on news author displays
• Add CSS for all new components (rating bars, social links, callout, online dot, score badge)

• fix: cast EngineVersion to string for htmlspecialchars (PHP 8.4 TypeError)

• refactor: move latest update into version history section, remove duplicates

• Remove standalone latest-update.php callout (was awkward mid-page)
• Integrate 'Latest Update' as a highlighted banner inside Version History
• Remove duplicate Version.Changes from package-details.php
• Replace callout CSS with version-current-banner CSS (themed properly)
• Reduces duplicate info: version data now only shows in Version History and the technical Package Details section

• fix: restyle org description and social links with proper themed component

• Replace inline styles with new .org-about-bar component
• Description + social links now sit in a unified bordered card
• Properly themed with border, backdrop-blur, hover states
• Responsive: stacks and compresses on mobile
• Color-coded hover states for Twitter (blue), Discord (indigo), Website (green)

• feat: improve package detail view UX

• Remove duplicate Organization section (already in sidebar)
• Remove duplicate Summary section (already in header)
• Add VotesDown and Referenced counts to header stats
• Add relative time badge ('Updated 3d ago') to header meta row
• Add quick info pills below header (size, file count, engine version, freshness)
• Add 'Copy ID' button with clipboard feedback animation
• Add expandable description with gradient fade + Show more/less toggle
• CSS: quick info pills, updated badge, copy button, negative stat, expandable description

• fix: move quick info pills into pkg-header instead of floating below

• fix: set pkg-pill border-radius to 4px

---------

• feat(mcp): implement 16 MCP integration improvements

Critical Fixes:

• Wrap insertApproved(), approveContribution(), approvePendingContribution() in beginTransaction()/commit()/rollBack() for slug uniqueness safety
• Fix AdminService::rebuildRelationships() to call buildRelationships() instead of non-existent rebuildAll()
• Fix cleanupDeadSources() to check $result['is_reachable'] (array return)
• Add force:true requirement for deleteAllEntries when >100 entries

Schema & Migration:

• Add static $schemaChecked flag so createSchema() runs once per request
• Add view_count, quality_score, last_viewed columns to mcp_knowledge
• Create mcp_knowledge_history and mcp_audit_log tables
• Add pg_trgm extension and GiST index on title for fuzzy matching

Code Quality:

• Replace O(n) PHP similar_text() loop with PostgreSQL similarity() in findStrictDuplicate()
• Remove duplicate alias resolution from ToolRegistry::call() (McpToolRegistry already handles it)
• Fix string interpolation: single quotes to double quotes for $action var
• Wire up version history: call createHistoryRecord() before edits in AdminService::editEntry()

Performance:

• DB-level pagination in mcp-knowledge.php using searchAdvanced() with LIMIT/OFFSET instead of loading 200 results and slicing with array_slice()

Developer Experience:

• Add X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset headers after rate limit checks; add Retry-After: 60 on 429 responses

Frontend Cleanup:

• Add DocsService::clearCache() method for cache invalidation
• Remove duplicate .kb-page ::selection CSS rule
• Update $toolIcons to current consolidated tool names (sbox_kb, sbox_docs, sbox_admin, sbox_contribute, sbox_stats)

• feat(mcp): security, performance & DX improvements (batch 2)

Security:

• SSRF protection in KBService::ingestFromUrl() with private IP blocklist and domain allowlist (sbox.game, github.com, etc.)
• DocsService slug sanitization to prevent path traversal (../ stripping, character validation)
• Fail-closed rate limiting and duplicate checks in contribute.php — DB errors now reject submissions instead of silently bypassing

Performance:

• Replace O(n2) findAllDuplicates() with pg_trgm SQL self-join (capped at 100 results)
• Replace findRelated() full-table load with category-scoped searchAdvanced + PHP tag intersection
• Add 45-second cache TTL to stats tool to reduce DB hits
• Fix clearCache() to only delete known MCP doc cache keys instead of nuking all API response caches

Developer Experience:

• Wire up QualityScorer::suggestTags() — auto-tags contributions when no tags provided
• Add audit logging to kb_handleUpdate (with history snapshot)
• Add audit log retention: pruneOldEntries(90 days) called during cleanup
• Add clear_doc_cache admin action to sbox_admin tool
• Add prune_audit_logs to cleanup task enum

• feat(kb): visual improvements — reading time, quality badges, sort, featured entries, tag cloud, stagger animation, helpful button

Listing View:

• Add sort dropdown (newest/oldest/quality/popular) with pill-style buttons
• Add featured entries section (top 3 by quality score) on the first page
• Add tag cloud in sidebar showing 15 most popular tags with size scaling
• Add contribute CTA link in sidebar (green accent)
• Add quality score badge on cards (shown when >= 60)
• Add view count indicator on cards (eye icon + number)
• Add 'Updated' badge on cards modified within the last 7 days
• Add staggered fade-in animation for cards (0.04s delay per card)
• Include sort parameter in URL persistence

Entry View:

• Add reading time indicator (~X min read) in the header meta
• Add quality score indicator in header
• Add breadcrumb navigation (Knowledgebase > Category)
• Add 'Was this helpful?' vote button (localStorage-based)

Hero Section:

• Add IntersectionObserver-powered count-up animation on stat pills

Empty State:

• Add prominent 'Contribute an entry' CTA button alongside clear filters

• Update mcp-knowledge.php

---------

• Add helpful_count column to mcp_knowledge table (idempotent migration)
• Add KnowledgeDB::incrementHelpfulCount() method with RETURNING clause
• Create POST /backend/api/kb-vote.php endpoint with session-based rate limiting
• Update frontend JS to POST vote and sync count from server response
• Display live helpful count badge in the button UI
• Add CSS styling for the count badge in both default and voted states

Listing View:

• Add sort dropdown (newest/oldest/quality/popular) with pill-style buttons
• Add featured entries section (top 3 by quality score) on the first page
• Add tag cloud in sidebar showing 15 most popular tags with size scaling
• Add contribute CTA link in sidebar (green accent)
• Add quality score badge on cards (shown when >= 60)
• Add view count indicator on cards (eye icon + number)
• Add 'Updated' badge on cards modified within the last 7 days
• Add staggered fade-in animation for cards (0.04s delay per card)
• Include sort parameter in URL persistence

Entry View:

• Add reading time indicator (~X min read) in the header meta
• Add quality score indicator in header
• Add breadcrumb navigation (Knowledgebase > Category)
• Add 'Was this helpful?' vote button (localStorage-based)

Hero Section:

• Add IntersectionObserver-powered count-up animation on stat pills

Empty State:

• Add prominent 'Contribute an entry' CTA button alongside clear filters

Security:

• SSRF protection in KBService::ingestFromUrl() with private IP blocklist and domain allowlist (sbox.game, github.com, etc.)
• DocsService slug sanitization to prevent path traversal (../ stripping, character validation)
• Fail-closed rate limiting and duplicate checks in contribute.php — DB errors now reject submissions instead of silently bypassing

Performance:

• Replace O(n2) findAllDuplicates() with pg_trgm SQL self-join (capped at 100 results)
• Replace findRelated() full-table load with category-scoped searchAdvanced + PHP tag intersection
• Add 45-second cache TTL to stats tool to reduce DB hits
• Fix clearCache() to only delete known MCP doc cache keys instead of nuking all API response caches

Developer Experience:

• Wire up QualityScorer::suggestTags() — auto-tags contributions when no tags provided
• Add audit logging to kb_handleUpdate (with history snapshot)
• Add audit log retention: pruneOldEntries(90 days) called during cleanup
• Add clear_doc_cache admin action to sbox_admin tool
• Add prune_audit_logs to cleanup task enum

Critical Fixes:

• Wrap insertApproved(), approveContribution(), approvePendingContribution() in beginTransaction()/commit()/rollBack() for slug uniqueness safety
• Fix AdminService::rebuildRelationships() to call buildRelationships() instead of non-existent rebuildAll()
• Fix cleanupDeadSources() to check $result['is_reachable'] (array return)
• Add force:true requirement for deleteAllEntries when >100 entries

Schema & Migration:

• Add static $schemaChecked flag so createSchema() runs once per request
• Add view_count, quality_score, last_viewed columns to mcp_knowledge
• Create mcp_knowledge_history and mcp_audit_log tables
• Add pg_trgm extension and GiST index on title for fuzzy matching

Code Quality:

• Replace O(n) PHP similar_text() loop with PostgreSQL similarity() in findStrictDuplicate()
• Remove duplicate alias resolution from ToolRegistry::call() (McpToolRegistry already handles it)
• Fix string interpolation: single quotes to double quotes for $action var
• Wire up version history: call createHistoryRecord() before edits in AdminService::editEntry()

Performance:

• DB-level pagination in mcp-knowledge.php using searchAdvanced() with LIMIT/OFFSET instead of loading 200 results and slicing with array_slice()

Developer Experience:

• Add X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset headers after rate limit checks; add Retry-After: 60 on 429 responses

Frontend Cleanup:

• Add DocsService::clearCache() method for cache invalidation
• Remove duplicate .kb-page ::selection CSS rule
• Update $toolIcons to current consolidated tool names (sbox_kb, sbox_docs, sbox_admin, sbox_contribute, sbox_stats)

Add a new admin API test page (admin/api-test.php) with a UI to run and inspect all API endpoints (concurrency, progress, history, previews). Improve backend resiliency: HttpClient gains in-memory caching, negative-cache for failures, adjusted TTLs, reduced timeouts/retries and extra cURL options to avoid hammering the s&box API. Make controllers and legacy routes more tolerant of missing/changed upstream endpoints (PlayerController, SearchController, SettingsController, StatsController, StatusController) by falling back to org-based lookups, safer DB access, better pagination and catching Throwables. Update legacy routes to use user_recently_viewed table and add a migration to create missing user tables. Overall these changes aim to handle upstream API inconsistencies, reduce load, and give admins tools to test and debug API health.

Add multiple page-specific CSS files (api-legacy.css, changelog.css, donate.css, nav-auth.css, news.css, org-layout.css, profile.css, public-pages.css) and update shared styles. Update compiled bundle (frontend/css/dist/bundle.min.css) and modify frontend/css/pages/pages.css and frontend/css/styles.css. Also apply changes to frontend/donate.php to match the new styling.

Remove obsolete footer links and enhance theme handling: deleted release-notes and changelog items from backend/includes/footer.php. Cleaned up api-doc.css (BOM/selector/spacing fixes), added dark-mode styles for Swagger UI, and normalized media query spacing. In frontend/js/theme-manager.js introduce DARK_THEMES, apply/remove a generic 'dark-mode' class when known dark themes are loaded or switched, and ensure body/ document classes are updated accordingly so external components (e.g. Swagger UI) follow the selected dark theme.

Add linting/formatting setup for JS, CSS and PHP: new eslint.config.js with frontend JS rules (browser/node/jquery globals, module + latest ECMAScript, 4-space indent, single quotes, semicolons, warn on unused vars, console allowed), .eslintignore and .stylelintignore to exclude node_modules/vendor/dist and minified files, and a php-cs-fixer.dist.php to run PSR12-based fixes across backend, frontend, includes and config (short array syntax, ordered imports, no unused imports, various spacing and PHPDoc rules). package.json was updated to include the linter devDependencies and package-lock.json regenerated.

Replace static copyright year with a dynamic placeholder (© 2025-{{year}} ...) across locale ui.json files and apply minor formatting fixes. Updates affect all localized footer copies (e.g. locales/*/ui.json) so the displayed year range is kept up-to-date.

Add daily chart history JSON snapshots for game and map data covering 2025-12-23 through 2026-04-01. Adds per-day files under data/chart_history/game/ and data/chart_history/map/ to record rankings, titles, orgs and favorites for historical charts and analysis.

• Add fetchPackageLeaderboardByStat() function to api_functions.php
• Create package-achievements-api.php and package-leaderboard-api.php endpoints
• Update LeaderboardController and AchievementController with structured JSON responses
• Register /package-achievements and /package-leaderboard routes in api.php
• Add achievements.php section with inline CSS for achievement cards grid
• Add leaderboards.php section with stat selector and player table
• Auto-hide sections when package has no achievements/leaderboards
• Add localization keys for new UI elements
• Include require_once for api_functions.php in api.php

Introduces multiple JSON schema files under schema/output_schemas/ to describe responses from various Facepunch API endpoints, including package queries, news, reviews, versions, and utility endpoints. Also adds schemav1.py and renames schema.py to schemav2.py for versioning.