Changelog

Adds ai/query, ai/chat/create, ai/chat/query (401 without a game session), shader/1/{crc} and package/dll/1/{ident}/{rev} (engine-token binaries). None are usable by the site.

The repository is private and Actions minutes are billed. The checks the workflows ran are unchanged and run locally with npm run check; AUDIT.md records the decision.

/tools/* is ignored apart from a whitelist, so the deny file protecting the operator scripts and the PHPStan runner had not been committed; found by running the CI commands from a fresh clone.

• tests/run-php.sh [hermetic|integration|live|all]: assertions forced on, APCu on; a test that cannot run says why and exits 2, which fails the run; sections skipped inside a passing test are counted and shown
• test_player_history exited 0 when no database was available and test_tool_auth exited 0 with the example CRON_KEY: both silent passes, now exit 2 with a reason
• tests/_support.php: requireDatabase / requireLiveApi / requireAssertions; tests/setup-integration.sh writes a config.php for integration runs
• ci.yml: frontend (lint, tests, builds), php (syntax, hermetic tests, pinned PHPStan) and integration (PostgreSQL service, real site) jobs; no secrets, no external APIs, concurrency and timeouts set
• audit.yml (npm advisories) and live.yml (Facepunch API) are scheduled/manual so third parties cannot fail a pull request

phpstan.neon carried ~90 ignore patterns that hid every class of error; it now runs level 1 (unknown functions, classes, methods, constants; possibly-undefined variables) over backend, auth and mcp with seven narrow, commented ignores. tools/run-phpstan.sh (npm run analyse:php) uses the version pinned in composer.lock.

Real bugs found:

• obscureIpAddress() did not exist, so the personal-data export fataled for anyone with session history
• cache-management-api called CacheManager::getInstance(), which does not exist (the class is static), so invalidating by tag or pattern fataled; pattern LIKE wildcards in the input are now escaped
• search-api sent Cache-Control: public for the signed-in user's search history and the admin analytics
• two CompressionMiddleware classes (pages and API) shared a name; the API one is ApiCompressionMiddleware
• backend/controllers/ duplicated BaseController and PackageController and nothing loaded it; backend/services/PackageService.php called functions that do not exist and had no callers
• an invalid MCP tool example repeated the 'action' key

cache-management.js, dependency-graph.js, notification-bell.js, homepage-categories.js (an ES module the non-bundling build could never have run) and its only importer homepage-utils.js. Checked against templates, the core script list, imports and dynamic loads, the service worker, build config and tests. tests/test_js_referenced.php fails if a script in frontend/js is not referenced by another tracked file.

npm update within the existing semver ranges (package.json unchanged): postcss, esbuild, vitest/vite, browserslist, nanoid, js-yaml, svgo, undici, fast-uri, brace-expansion, colord and their transitive dependencies. npm audit now reports 0 with and without dev dependencies; the CSS bundle is byte-identical and lint, tests and builds pass. npm 10.9.4's resolver crashes on this tree, so the update was run with npm 11 via npx; the lockfile format is unchanged and npm ci accepts it.

• tests/run-php.sh (npm run test:php) runs the 32 standalone tests that need no config, database or network, with assertions forced on: test_global_stats_grid relies on assert() and passed vacuously under the default zend.assertions=-1
• .github/workflows/ci.yml runs ESLint, Stylelint, Vitest, the CSS build, a PHP syntax check and the PHP runner
• remove tabbable and fast-check, which nothing imports

Nothing called it; the versioned per-user leaderboard endpoints need a signed-in Steam user ID, which Explorer has no flow for.

.stylelintignore was already excluded; the rc file it pairs with was not, and .json is not covered by the .htaccess FilesMatch deny list, so it would have been publicly fetchable dev clutter.

tests/ was in .gitignore while twenty of its files were committed, so every new test needed git add -f. Nothing on disk there is untracked, so removing the entry changes no file, only the friction.

footer.version ('Perpetual betaa' and its 29 translations) is referenced nowhere: the badge renders APP_VERSION and the deploy's commit hash, and takes its aria-label from footer.versionLabel. Removed one line per locale; all 30 files still parse.

npm run lint:css could not run at all: .stylelintrc.json lives on the server but was gitignored, so it was never in the repo. Pulled the server copy verbatim (it is the authoritative one) and un-ignored it; the lint scripts now cover admin/assets too, and the admin CSS is clean.

eslint --fix takes frontend/js from 3,163 errors to 15, all of it quote and indent formatting. Verified by node --check on all 57 changed files plus the vitest suite. Of the rest, 57 were no-undef against vendor globals (Swal, Chart, tippy and friends load as plain script tags) which the config now declares, and admin/assets/*.js is linted for the first time.

What is left is real, not formatting: 7 empty catch blocks, 2 useless assignments and 1 rethrow without a cause. frontend/css still reports 2,601 style-guide errors; those are auto-fixable but rewriting every site stylesheet is well outside an admin audit.

The footer badge had read 'beta 0.0.3' for about a year. The site has a full feature set, a public API, an MCP server and 30 locales; the beta label stopped being accurate a long time ago.

APP_VERSION lives in config/config.php, which is gitignored and excluded from deployment, so the live value was changed on the server directly. This updates the template so a fresh install does not start at 0.0.1 again.

Names every path the live site owns and git must never write over: the SQLite databases and their write-ahead logs, everything under data/ (chart_history is appended to on ordinary page views), the caches, the logs, .env, config/config.php, and the config files the site rewrites at runtime. Also drops development-only files that have no business being publicly readable.

Committed ahead of .cpanel.yml on purpose. cPanel deploys on push as soon as it sees .cpanel.yml, so the exclusion list goes up first and gets verified with a dry run before anything is armed.

Audit of the 27 root-level files. Most were fine; these were not.

Dead ignore files ----------------- .eslintignore has been unsupported since ESLint 9, and package.json pins eslint ^10 with a flat config. Its four patterns move into an ignores block in eslint.config.js, which is what actually keeps frontend/js/dist out of the lint run: lint:js globs frontend/js/**/*.js, so dist was in scope.

.prettierignore had nothing to ignore for. There is no prettier dependency, script or config anywhere in the repo; formatting is php-cs-fixer, eslint and stylelint.

composer.lock ------------- The blanket *.lock rule was excluding it, so PHP dependency versions were not reproducible. This is an application, not a library, so the lockfile belongs in git. Narrowed the rule and generated the lock.

Database dumps -------------- A 38MB pg_dump of the production database was sitting in the webroot with no reference to it anywhere, kept out of git only by .git/info/exclude, which is per-clone and not shared. Moved out of the tree, and now ignored by name so the next one cannot be committed by someone whose clone lacks that local exclude.

Apache was not denying it either: the block list covered env, ini, log, sh, sql, bak and config, but not dump. Added.

Docs ---- facepunch.md and MCP_TOOLS_AUDIT.md move into docs/, which already exists and held one file.

facepunch.md also documented three things that are not true, which is what sent global-stats looking for live games in the wrong place. Verified against the live API and corrected: sort only works as a token inside q, not as a query parameter; downloads and rating come back in exactly the same order as an invented token, so they are not honoured; an unrecognised token silently falls back to popular rather than erroring; and take caps at 500, with 501 returning HTTP 400.

Also removed: SCMM.json, a 420KB OpenAPI spec for a service that shut down. Its consumer went with the skins rebuild and skins-retired.php now says as much on the page. It was never tracked.