Tools API - Changelog

This changelog highlights user-facing improvements across the Tools platform.

Formal main-platform version markers start with Tools 1.10.0 on 2026-08-27. Older dated entries predate formal Tools platform version tracking.

2026-08-31

Tools platform version: 1.36.1

Hidden-feed RSS magazine links (#1476): Per-site Cards links now keep hidden feeds on their existing public-hash path instead of exposing a numeric feed id that could only lead to a 404.
Magazine analysis controls (#1476): Switching between the selected analysis and all analysis variants now preserves the current pagination and history query controls instead of resetting the magazine view.

Previous Tools platform version: 1.36.0

2026-08-31

Tools platform version: 1.28.0 Tools platform version: 1.36.2

Consistent release history (#1448): The public and canonical Tools changelogs now follow one corrected release sequence after several concurrent merges had duplicated, skipped and reused recent version markers. The valid Tools 1.29.1 release is restored, the never-finalized 1.29.2 marker is retired, and its Whisper completion-report improvements are recorded under the valid Tools 1.32.1 release.
Stable public changelog rendering (#1448): The public changelog now renders the canonical current release together with one corrected recent-release archive instead of combining overlapping release fragments and archives that could duplicate or reorder versions. Older archive files remain preserved as historical snapshots.

Previous Tools platform version: 1.36.1

2026-08-31

Tools platform version: 1.36.1

Ko-fi payment visibility and transfer reconciliation (#1374): Support administrators can see real Ko-fi payments matched to an individual Tools user, including support-only donations. Membership payments keep their configured AI Credit and project-support allocation, while external cash transfers can be reconciled separately without replaying payment processing or changing AI Credits.
Image Generator maintenance (#1477): The live publishing and automatic publication behavior introduced in 1.36.0 is unchanged. This maintenance follow-up aligns release metadata and verification coverage with the behavior already shipped.

Previous Tools platform version: 1.36.0

2026-08-31

Tools platform version: 1.36.0

Live Image Generator publishing (#1463): The image publication manager saves individual image, prompt, reference/source and category visibility changes over AJAX and applies bulk publication changes without reloading the page. The returned stored state is reflected immediately in the controls.
Automatic publication profile (#1463): Signed-in users can opt into automatic publication from /me/image-generator/profile. The setting is off by default, affects only future owned Image Generator results and does not change existing, guest or unrelated integration images.
Per-site RSS magazine cards (#1473): Expanded RSS Watch site cards include a Cards action that opens a magazine view scoped to the selected site while preserving pagination, article history and diffs.

Previous Tools platform version: 1.35.5

2026-08-31

Tools platform version: 1.35.5

Reliable Slack image delivery (#1453): Slack AI Bot follows Slack's documented external raw-byte upload flow. If Slack still cannot complete delivery after Tools has stored an image, the bot can provide an authenticated Tools link to the saved result.
Natural Slack image model names (#1453): Image requests can use names such as image 1.5, GPT Image 1.5 and image 2 in addition to canonical gpt-image-* IDs, while the normal Tools/OpenAI access policy remains authoritative.

Previous Tools platform version: 1.35.4

2026-08-31

Tools platform version: 1.35.4

Large RSS history cleanup (#1458): Noisy duplicate cleanup streams the selected article history instead of loading every stored title, description and content body into memory at once, reducing memory pressure for very large histories while keeping the same meaningful-text comparison and AJAX workflow.

Previous Tools platform version: 1.35.3

2026-08-31

Tools platform version: 1.35.3

RSS noisy history cleanup (#1456): Entry-level noisy duplicate purge uses the noise-tolerant meaningful text hash it advertises, so punctuation-only and URL-only churn can be removed while real text changes remain separate.
AJAX RSS purge (#1456): Purging noisy duplicates reports the result inline and refreshes the entry/history card without a page reload. The normal POST/redirect path remains available when JavaScript is unavailable.

Previous Tools platform version: 1.35.2

2026-08-31

Tools platform version: 1.35.2

Whisper audit diagnostics: Whisper audit history exposes operator-friendly event, status, message and meta_json fields alongside the existing structured audit fields so recent job events can be inspected without column-name failures.

Previous Tools platform version: 1.35.1

2026-08-31

Tools platform version: 1.35.1

Slack image retry format override (#1445): Follow-up image retries such as Try again in portrait format and Generate it again square remain in image generation, reuse the previous prompt and apply the newly requested size. Retries without a new size keep the previous dimensions.

Previous Tools platform version: 1.35.0

2026-08-31

Tools platform version: 1.35.0

Conversational Slack image retries (#1437): Slack AI Bot can reuse the most recent explicit image request from bounded conversation context for short retry follow-ups instead of falling back to ordinary text generation.
Slack image model selection (#1437): Slack image requests and retries can explicitly name another supported OpenAI image model while gpt-image-1 remains the default when no model is named.

Previous Tools platform version: 1.34.1

2026-08-31

Tools platform version: 1.34.1

DNSBL maintenance and release consistency (#1438): The typed DNSBL/FraudBL behavior from 1.34.0 remains unchanged while the displayed platform version and public release history are kept aligned.
Whisper re-transcription runtime diagnostics (#1414): Local and authenticated remote-worker failures during a re-transcription pass are reported through the dedicated operational diagnostics path with safe job, model, revision and correlation context. Retryable failures remain visible, while successful manual recovery is not reported as a false runtime failure.

Previous Tools platform version: 1.34.0

2026-08-31

Tools platform version: 1.34.0

Typed DNSBL badges in Online Users (#1412): The authenticated administrative Online Users view shows one badge per current DNSBL/FraudBL reputation category returned for a visitor IP. The public online view remains masked and does not expose DNSBL details.
Shared DNSBL lookup reliability (#1412): Online-session enrichment and registration/user-editor checks share resolver failover and short-lived caching, and incomplete resolver responses are not treated or cached as clean results.
Longer Fact Verify research output (#1389): Fact Verify deepening keeps a larger bounded output allowance through finalization while mandatory web search and source evidence remain required.
AJAX Fact Verify workbench (#1389): Deepening, follow-up and translation actions show running, error and success state in place and refresh the updated fact-check without a full page navigation.

Previous Tools platform version: 1.33.0

2026-08-31

Tools platform version: 1.33.0

Standalone ReputationFactory API (#1419): Reputation is exposed through the canonical unversioned GET /api/reputation and POST /api/reputation/reports endpoints. Existing /api/socialgpt/reputation endpoints remain compatible aliases with the same authentication and response contract.
Neutral reputation surfaces (#1419): New public and administrative links use /reputation and /admin/reputation, while existing /trust routes remain available for compatibility.
Reputation boundaries preserved (#1419): Community reports remain non-authoritative, people and profiles remain invalid targets, and public records continue to hide pending/rejected reports and private Fact Verify material.

Previous Tools platform version: 1.32.1

2026-08-31

Tools platform version: 1.32.1

Bearer-authenticated Whisper mutations (#1413): JWT/bearer clients can use the existing unversioned /api/whisper/* mutation endpoints without a browser CSRF token. Browser/session mutations remain CSRF-protected and normal Whisper authentication, permission and ownership checks still apply.
Whisper revision cleanup on deletion (#1413): Deleting a Whisper job removes the archived re-transcription revisions owned by that job in the same transaction.
Whisper completion reports (#1394): Completion and failure emails use the public Tools job link instead of a worker-local localhost address and include the requested/final speaker-diarization state, provider, detected speaker and labelled-segment counts when available, plus safe warnings or errors.

Previous Tools platform version: 1.32.0

2026-08-31

Tools platform version: 1.32.0

Whisper re-transcription with another model (#468): Owners of completed Whisper jobs can queue another transcription pass from retained source media using another model available in the configured runtime. URL-based jobs do not silently download the external source again.
Read-only transcript revision history (#468): Before a new pass starts, the completed transcript and related transcript state are archived as a readable revision and remain available from the job page and additive unversioned API endpoints.
Owner and concurrency safeguards (#468): Re-transcription remains owner-only, concurrent requests cannot archive the same completed pass twice, and pending translation or diarization blocks a new pass until that work reaches a safe state.

Previous Tools platform version: 1.31.1

2026-08-31

Tools platform version: 1.31.1

Appearance maintenance (#1408): Existing saved themes, colors and reusable appearance styles continue to work while the maintenance follow-up keeps compatibility and verification aligned with the live Appearance editor introduced in 1.31.0.

Previous Tools platform version: 1.31.0

2026-08-31

Tools platform version: 1.31.0

Live Appearance editor (#1397): /me/appearance applies valid theme and color changes to the page and preview immediately while saving them to the signed-in account in the background. Resetting custom colors follows the same immediate save behavior.
Automatic readable foreground colors (#1397): When custom page, card, navigation or primary-action backgrounds change, Tools derives a readable foreground color unless the corresponding text color was explicitly selected.
Reusable personal and global styles (#1397): Users can save, apply and delete named personal styles, while administrators can manage site-default custom colors and reusable global styles from /admin/appearance.

Previous Tools platform version: 1.30.1

2026-08-31

Tools platform version: 1.30.1

Personal SpamAssassin list handling (#1396): Browser list requests require the signed-in session. Regular users remain bound to their own mailbox, while the retained legacy administrator surface can target another mailbox only for an authenticated administrator.
Persistent My Profile mail shell (#1396): /me/mail and /me/spamassassin keep My Profile navigation visible while preserving the older administrator compatibility workflow.
Google Play Billing hardening (#1405): RTDN voided-purchase handling performs a fresh authoritative Google lookup before reversal, persists later-cancelled pending purchases as rejected and refuses to rewrite immutable product or AI Credit grant facts after a purchase has been recorded.

Previous Tools platform version: 1.30.0

2026-08-31

Tools platform version: 1.30.0

Google Play Billing for Shop AI Credits (#1020): Android clients can submit completed Google Play one-time purchases to the unversioned Shop API. Tools verifies the purchase with Google before crediting, uses durable idempotent purchase identity and prevents cross-user purchase claims.
Google Play RTDN, recovery and reversals (#1020): Pub/Sub notifications trigger authoritative Android Publisher lookup before accounting changes; pending purchases can reconcile later, and refunds/revocations use compensating immutable ledger transactions.
Deep Research mode for the OpenAI runtime (#1390): Internal OpenAI clients can request research mode through the existing unversioned /api/ai/openai/respond endpoint, forcing web search, stronger research instructions and source-aware evidence checks.
Deep Research in Fact Verify (#1390): Fact Verify's existing deepening action uses the research-aware runtime while preserving revisions, captured context and web-search citations.

Previous Tools platform version: 1.29.1

2026-08-31

Tools platform version: 1.29.1

Editable Menstrual Tracking history (#1392): Period duration and existing notes can be edited in place and saved with AJAX while retaining the same owner/admin scoping as the rest of Menstrual Tracking.
Personal mail configuration in My Profile (#1393): /me/mail shows the account mailbox and links to personal SpamAssassin settings, with /me/spamassassin as the canonical personal address while the older settings address remains available for compatibility.

Previous Tools platform version: 1.29.0

2026-08-31

Tools platform version: 1.29.0

Provider-neutral PaymentFactory backend (#1268): Shop funding providers use one shared orchestration contract before reaching canonical Shop accounting. Unknown or disabled providers are rejected before accounting and refunds/reversals use compensating immutable ledger transactions.
Payment diagnostics and audit boundary (#1268): PaymentFactory failures that could otherwise lose money or double-credit are reported through the always-on operational diagnostics path independently of structured payment audit records, with safe provider/resource/correlation context and no credentials.

Previous Tools platform version: 1.28.2

2026-08-30

Tools platform version: 1.28.2

Forced Tools funding without a reservation (#1385): OpenAI requests that explicitly use the Tools-funded contract keep their preflight funding source through usage accounting even when prepaid enforcement is disabled and no reservation row is created.

Previous Tools platform version: 1.28.1

2026-08-30

Tools platform version: 1.28.1

Personal custom colors in Dark mode (#1383): Personal color overrides from /me/appearance apply with the same theme selector specificity as the built-in Dark palette, so saved colors are no longer hidden when Dark is selected.

Previous Tools platform version: 1.28.0

2026-08-30

Tools platform version: 1.28.0

Personal themes and custom colors (#1381): Authenticated users can follow the administrator-selected site default or choose Light, Dark or Forum Green and store validated personal page, text, card, border, navigation and accent-color overrides from /me/appearance.

Previous Tools platform version: 1.27.2

2026-08-30

Tools platform version: 1.27.2

Request-scoped AI Credit reservation cleanup (#1378): Finishing or cleaning up one Tools-funded AI request can no longer release another overlapping request's prepaid reservation.
Forced Tools funding stays billable (#1378): When a client contract explicitly requires Tools-funded AI, the funding source selected during preflight is preserved through usage accounting and settlement.

Previous Tools platform version: 1.27.1

2026-08-23

Web Search Alerts 403 verification fallback (#724): Public search results are no longer discarded solely because a publisher rejects Tools' direct verifier with HTTP 403 when the configured verification fallback can confirm the same public URL. Private/local destinations and unsafe redirects remain blocked.
Week 34 recaps are preserved as project history: ToolsAPI now keeps both a full development recap and a shorter straight-to-the-point recap for week 34 in Swedish and English. The recaps explain not only what changed, but why the Laravel 13 modernization, GitHub Actions workflow and larger service changes were made, while clearly marking work that still needs real provider or production verification as new problems are discovered.
Facebook Bug Bounty Lab 0.3.10 keeps the 0.3.9 persistent-control fixes and reduces stale-tab error noise after an unpacked extension reload or update. The live panel is now the single warning-level reporter for the expected invalidated content-script context, while bridge, diagnostics and React-linked cleanup still stop safely without creating duplicate Chrome extension warnings. Reload the Facebook tab afterwards to inject the fresh extension context.
The /services catalogue is now grouped into functional categories instead of mixing public, personal, delegated, integration, DNS and administrative entries in long grids. The Guestbook and DNSBL Proxy Registry are part of the catalogue itself; the dashboard quick-link block no longer appears above the Services page. Existing backend authorization remains unchanged.

Job Search Alert bridge recovery

Job Search now recovers when an older shared Alert Engine mirror was left running, so later searches can continue linking their results and notification state normally. Bridge failures also include safer operational diagnostics without interrupting the primary job search.

Job Search can now propose negative keywords from an irrelevant listing. Suggestions must be selected explicitly before they are saved to that listing's own search profile, while keyword exclusions can still be entered manually in the configuration. Visible listings that still match a saved negative keyword in the title, employer, or location now show a "Negativ: ..." badge. The badge is hidden while the listing is dismissed and shown again if the listing is restored.
Web Search Alerts exact-name search parity (#605): Production alerts now use the same proven deep web-search model contract as the real OpenAI release smoke. Exact multi-word names and explicit publisher/date qualifiers are preserved as search constraints, and the primary search is instructed to refine same-surname or wrong-subject results before returning an empty result set. The live smoke now verifies an exact-name search instead of only a simple documentation lookup.
Web Search Alerts now publish genuinely new verified hits to the normal Tools Notifications inbox and shared notification engine. Zero-new runs stay quiet, and the same completed Alert run cannot publish the shared notification twice.
Web Search Alerts now bound built-in provider web-search calls and can recover an incomplete primary response when that required search already exposed usable source metadata. Recovery classifies only those retrieved sources with web search disabled; an incomplete response without usable sources remains a failure. The Alert-specific request budget does not replace Job Search's own provider settings.
Web Search Alerts now recover cleanly from interrupted runs (#717): A scheduled alert no longer fails the whole Alert schedule just because the same alert still has an active run. Fresh overlaps are skipped safely, while an older unfinished run can be closed as failed so a later scheduled search can continue instead of leaving the alert permanently stuck.

2026-08-24

Platform Jobs service cadence: Administrators can centrally adjust automatic scheduling for Job Search and Web Search Alerts from Platform Jobs. Job Search can keep its daily schedule or use a recurring interval from 5 minutes through 7 days, while Web Search Alerts keep their per-alert intervals and existing owner permission limits.

2026-08-25

The public Tools front page now starts with a compact product introduction instead of duplicating service catalogues. /services is the central discovery page and retains entry points that previously lived only in the homepage shortcuts, including SoundCloud, public online sessions and the relevant RSS, DNS and social administration links. Guests get login/account actions directly in the intro, Chrome extensions and the upcoming mobile app are mentioned, and the external news section now uses News from Tornevall Networks while the old WordPress setup placeholder is hidden.

2026-08-27

Guestbook submission reliability (#1129): Public guestbook submissions now allow normal browser bursts instead of being blocked after only four requests per minute. The public routes remain rate-limited, but the limit has been raised to 60 submissions per minute so ordinary signing no longer gets stuck behind repeated HTTP 429 responses.
Slack traffic diagnostics (#476): RSS entry clicks now use their own configurable Slack log category and known crawler traffic is suppressed. External HTTP referers can be routed through a separate category, while sensitive token-like query values are redacted before forwarding.
The global footer now always shows the main Tools platform version as Tools v1.10.0, including for guests.
1.10.0 is the corrected formal baseline for the current post-modernization platform: the Laravel framework replacement was substantial internally but did not intentionally break the public Tools API contract.
Existing PHP and Laravel runtime details remain administrator-only diagnostics.
The main platform version uses semantic increments: patch for compatible fixes/maintenance, minor for backwards-compatible features, and major for intentionally incompatible public contract changes.
Version increments follow the released external contract rather than commit count. API and route URLs remain unversioned.
Client apps can read the same public platform version from GET /api/platform; framework/runtime diagnostics are not exposed there.
Clients should treat platform metadata as non-critical and cache it instead of adding a version lookup to every ordinary API request.

2026-08-22

SoundCloud Profile Insights now renders calculated growth predictions even when their confidence is 0%. The prediction payload explicitly distinguishes calculated results from insufficient-data results, so a flat or poor-fit series no longer falls into the missing-message error path.
Web Search Alerts and Job Search now tolerate nested OpenAI Responses metadata where type is non-scalar. Source-aware parsing keeps descending into nested response data without Array to string conversion failures while preserving web_search_call and url_citation detection.

2026-08-21

Slack AI Bot direct messages and addressed channel mentions can now generate images through the existing ToolsAPI image service, upload them into the same Slack thread, and answer image-capability questions accurately. Image delivery uses the current files:write Slack upload flow and records secret-safe image lifecycle audit events.
Job Search owner email and SMS for genuinely new listings now use the shared Alert Engine delivery ledger. Failed deliveries can retry without rerunning the search, SMS eligibility is rechecked before retry, zero-new runs stay quiet for the owner, and compatibility guards prevent the legacy and generic paths from sending the same result set twice.
Job Search profiles now participate in the shared Alert Engine run/result lifecycle while keeping the existing Job Search schedule, profile UI, and owner notification behavior. Searches still execute once, profile notification preferences stay synchronized, and profile transfers keep earlier alert history with the previous owner.
SocialGPT → Web Search Alerts (#541): A fact verification in SocialGPT can now be turned into an owned Web Search Alert from both the floating Verify result and the browser side panel. Tools prepares an editable monitoring instruction from the current verification and any follow-up question, and the user explicitly chooses the monitoring duration and check interval before creation. New SocialGPT-created alerts start with email notifications enabled and SMS disabled, while the handoff reuses the user's existing personal SocialGPT access instead of requiring broad Alert management permissions.
Web Search Alerts source recovery (#605): Search queries now keep response-format instructions separate from the search intent, request the complete web-search source list, and can recover candidates from already-retrieved sources when the structured result list is empty. Recovery does not perform a second web search, and recovered candidates still pass normal filtering, public-link verification, deduplication and notification rules. Audit distinguishes structured candidates, exposed sources and recovered candidates.
Personal SoundCloud connections that are expired, failed, or need reauthentication now show a direct Reauthorize SoundCloud action. It restarts OAuth with the existing app profile and replaces stale tokens without requiring the account to be disconnected first.
Web Search Alert form validation now stays in the form instead of being rendered as a service-unavailable HTTP 500 page. A duplicate alert name, for example, returns the normal validation message, preserves the submitted input for correction, and shows the feedback inside the Web Search Alerts view above the alert manager without duplicating the global page message.
Slack AI Bot workspace settings now save without a full page reload, report safe metadata-only changes to the configured Slack diagnostics channel, and record a dedicated structured audit event. The polling fallback now checks already known conversations about every 10 seconds while full conversation discovery stays bounded on a slower cadence, reducing the previous up-to-one-minute fallback wait while preserving native Event Subscriptions as the preferred immediate path.
Web Search Alert form validation now stays in the form instead of being rendered as a service-unavailable HTTP 500 page. A duplicate alert name, for example, returns the normal validation message and preserves the submitted input for correction.
The Guestbook API can now list the current Tools user's owned guestbooks for server-side clients and create new books remotely when a token has both guestbook.write and guestbook.moderate. Ownership always comes from the user behind the token, and WordPress clients can supply site URL, description, and language as context.
The public X-bot thread tree now exposes a permission-protected Force reply action for unanswered posts. It reuses the existing review flow and generates a reply candidate without publishing automatically.
Scheduled Job Search runs now isolate failures per profile. One broken profile no longer stops the rest of the batch, while Laravel/Slack receive actionable user, profile, run, and error context and the command still reports failure if any profile failed.
Documentation views were repaired after Blade compilation failures in production. The Template integrity gate now compiles the full Blade view cache, PHP-lints compiled views, and runs documentation lifecycle tests so the same class of syntax failure is caught before deployment.
Slack log routing now separates Tools/audit activity, API request logs, and Laravel/system logs more clearly. API thresholds follow HTTP status, Laravel categories expose only meaningful levels, and the UI uses explicit "and above" wording where a threshold actually applies.
Failed x-bot:poll-mentions runs now log the real cause through Laravel before the scheduler command returns an error. The log includes safe context such as account, stage, HTTP status, and rate-limit metadata without tokens, auth headers, or raw X payloads.

2026-08-20

Trust became a standalone public product at /trust with separate administration at /admin/trust, moderated reports, and authoritative statuses. Public results count only accepted community reports, unsafe URL schemes are rejected, and multiple targets can be checked in one run. Trust was also moved out of the global navbar into Services, Dashboard, and Admin.
The Guestbook platform expanded substantially: hosted books with their own slugs and themes, auto-refreshing embeds, DNSBL status indicators, full Miazma read-only previews, purge/delete controls, user-owned guestbooks with owner isolation, and site-context metadata. Token rotation no longer orphans historical entries because authorization follows the Tools user rather than one exact historical API key.
Slack gained instant-save log routing, severity thresholds, bot-first delivery with webhook fallback, an active outbound delivery test, and an :eyes: acknowledgement when a mention begins processing. The AI bot can be installed in multiple workspaces, use preferred source URLs, and optionally make conservative spontaneous replies in allowlisted channels. Direct mentions can also fall back to ordinary channel-message events when app_mention delivery is missing.
Deployment continued to stabilize after the Laravel modernization: runtime registry checks get one bounded local repair pass, remaining registry drift becomes a degraded warning before runtime reload and HTTP health verification, CLI and HTTP share one bootstrap-cache fallback, and Composer security audits run against the locked production dependency set before runtime mutation. Deployment results can be reported to Slack even when Laravel itself cannot boot.
Storage gained a cleaner user-facing legacy archive and a separate detailed administrator diagnostic view. Legacy import now has a real read-only dry run, browser-based admin workflow, idempotency, and a clearer distinction between verified locations and historical lookup hints instead of inventing clickable URLs.
The public X-bot conversation archive moved from a flat timeline to reply trees with parent relationships, branch expand/collapse controls, and more efficient database-backed pagination. Several production failures in statistics and thread views were contained with standalone Blade views and explicit controller data.
DNSBL gained per-token/per-user request statistics, machine-readable proxy/Tor TXT metadata, separate Tools-owned source TXT, reporting-site provenance, and ingestion of explicitly opt-in WordPress telemetry. Telemetry is aggregate-only and rejects data such as visitor IPs, comments, email addresses, and raw DNS responses. Visit tracking was also decoupled from a foreign key that could inherit lock contention from token rows.
A token-scoped SpamAssassin content-scan API was added with direct spamd protocol support, backend failover, and an admin tester. The implementation and tests existed, but the weekly recap explicitly marked real production traffic against spamd as not yet end-to-end verified at this point.
Documentation gained current, deprecated, and historical lifecycle states plus a safe Confluence archive workflow with dry-run and deny-by-default allowlisting. NetCurl 6.1 also received maintained English/Swedish documentation where recovered Confluence details were checked against current code before publication.
Admin gained a persistent action inbox/Notifications dropdown for pending DNSBL token requests, OpenAI access requests, and public suggestions. Microsoft To Do now treats transient Graph timeouts as retry/deferred events instead of generating repeated scheduler errors, and a production DynDNS page HTTP 500 was fixed.

2026-08-19

Deployment was further hardened after the Laravel 13 migration against stale bootstrap/package caches, incomplete vendor installs, package discovery failures, and HTTP 5xx responses after reload. Runtime permission repair now shows progress and preserves log files instead of risking truncation. The final routine-deploy behavior no longer automatically enables Laravel maintenance mode.
The frontend dependency chain moved from Laravel Mix to direct Webpack 5. This removed vulnerable transitive paths including elliptic, webpack-notifier, node-notifier, and the remaining old uuid dependency while preserving existing asset paths and development/HMR workflows.
Security Advisory Watch was added as a scheduled internal monitor using OpenAI web search, deduplicated advisories, CVE/source-URL identity, email/SMS thresholds, and an opt-in public RSS feed. The feature was still new and remained subject to practical verification.
The Laravel-native Guestbook gained public signing, private email fields, themes, a Shadow DOM embed, admin moderation, scoped server-client API access, live MySQL import with read-only preview, and DNSBL moderation. Import support then expanded to multiple historical books plus standalone bbvote, connie, pv, and simhouse tables.
OpenAI Images gained multiple numbered reference images, custom final formats including 4:3, 16:9, 9:16, 4K, and Spotify 3000x3000, a public image archive/publication manager, privacy controls for images/prompts/sources, and direct continuation editing from archived images. Reject/retry, callback flows, and deeper moderation diagnostics also began landing and were still under practical evaluation.
SocialGPT gained the first reputation backend for domains, URLs, posts, and public content while explicitly excluding person/profile reputation. URL canonicalization was centralized so known query parameters, including selected Facebook group parameters, can be removed before reputation identity is calculated.
SoundCloud OAuth gained PKCE, better refresh-token rotation, a clear needs_reauth state, and visibility directly from the user profile. Terminal refresh failures therefore stop recurring as though a broken connection were still healthy.
The official Meta/Facebook/Messenger integration was added with OAuth, Page connections, webhook signature verification, Messenger ingestion/send support, and a data-deletion callback. The weekly recap explicitly marked real Meta traffic as still untested at this point.
Online views now separate people from bots/crawlers and show local MaxMind-backed country flags without exposing IP/ASN details publicly. Admin navigation was centralized more clearly under the Admin hub, and BBVote archive routing was restored before Laravel when the web server forwards archive paths to the front controller.
yt-dlp deployment moved toward the official standalone binary instead of depending on system Python 3.10. gitsync --repair was also expanded to safely rebuild broken submodule metadata without discarding local content.

2026-08-18

ToolsAPI was modernized directly from Laravel 8 to Laravel 13 with PHP 8.3+ and updated framework integrations. The upgrade exposed stale bootstrap/provider caches in production and caused a significant outage involving old Ignition provider references. Cache, autoload, package discovery, runtime, and error-reference handling were hardened during the same release window.
Error references became useful even when ordinary Laravel logging is unavailable: safe technical details can be shown publicly, full context remains in operator logs, and the missing maintenance error view was restored so rendering an error does not trigger another error.
Slack gained an installable OpenAI bot at /slack-bot with encrypted workspace tokens, a signed Events endpoint, workspace-specific settings, thread replies, and DM support through the existing OpenAI Engine. OAuth completion was fixed so cookie-based session fallback still completes workspace installation correctly.
Whisper gained admin-controlled default models and a separate guest-transcription path with Turnstile, one-time email verification, media preflight, lower queue priority, token-protected results, and completion notifications.
The X-bot public archive gained a mini-X mode that groups and displays stored conversations where the bot actually published replies. Recalled historical X context can also link back to the public Tools mentions archive.
The DNSBL proxy/Tor flow became self-cleaning: ordinary proxies use a configurable failure threshold, checker-owned TXT contains verified endpoint/protocol/anonymity details, and authoritative Tor Project snapshots add/remove Tor exits without treating an unavailable feed as an empty snapshot.
Job Search became opt-in at the database-schema level for new accounts and profiles. Scheduled runs can also send separate administrator reports even when a healthy search finds zero new listings, while the owner's existing quiet zero-result behavior is preserved.
Unverified accounts gained scheduled reminders, automatic disabling, and final deletion with configurable timing. Verification before deletion can reactivate an account disabled specifically by this policy.
Shopify gained an initial Tools-hosted redirect system with merchant/admin UI, AJAX/API CRUD, 301/302/307/308 support, query preservation, expiry, and hit counters.
Submodule and deployment handling received multiple safety fixes for broken gitlinks, stale .gitmodules entries, runtime permissions, and log preservation. Admins can also see the active PHP/Laravel runtime versions in the footer.

2026-08-17

StorageAPI launched as a modern storage layer with canonical files, multiple locations, image variants, AI analyses, legacy import/reconciliation, metadata editing, soft delete/restore, and granular API scopes. The old filestorage schema remains compatibility/import data and is not written by new uploads.
Storage routes and interfaces were fully exposed: /storage, /admin/storage, and /storage/public became reachable with private, unlisted, and public semantics plus stable UUID links. Storage also became discoverable from Dashboard and Services.
Geo/network information moved from the initial Cloudflare/RIPEstat approach to local MaxMind GeoLite2 City/ASN databases with caching, geoip:maxmind-sync, and scheduled updating. Country, ASN, and network-owner data are diagnostic enrichment rather than an independent security authority.
DNSBL V5 proxy checking was rebuilt around real end-to-end HTTP/SOCKS verification, Tor Project exit checks, normalized proxy hosts/endpoints/history, scoped proxy-sync, public /dnsbl/proxies, a five-minute sweep, and an admin editor. MaxMind data is enrichment only and cannot by itself cause listing or delisting.
The BBVote/Votech archive gained index-friendly queries, 2011/2012 views, restored news links, Votech link markers, feature history, and verified historical screenshots. Migrations received additional compatibility for native MySQL prepares and old zero-date defaults without rewriting historical data.
Whisper can now receive an initial AI question when a transcription job is created, shows clearer progress for later AI questions, and permits owner-AI prompts up to 12,000 characters.
Job Search gained both immediate administrator assignment and user-initiated profile transfers that require recipient approval. Empty profile shells no longer count as active, new profiles start disabled, and administrators can rename/manage profiles without the earlier unrelated MCU permission dependency.
/admin/jobs became a platform-wide overview of Laravel scheduler and queue executions with status, duration, latest runs, and retention instead of only representing the custom scheduled_jobs table.
Dynamic DNS became discoverable from Services/DNS editor, while its admin view gained improved host/zone management and wildcard-certificate status. DNS admin was also rebuilt with a responsive card layout.
DNSBL's RFC1918 purge gained visible progress, the proxy checker became reachable from Admin/Dashboard/Services, and an earlier $key rendering crash on the personal API keys page was fixed.

2026-08-16

Let's Encrypt administration can now delete obsolete certificate records together with SAN/domain rows and the stored PEM bundle, with file restoration protection if the database deletion fails. Owner API tokens are retained because they may still be used by other certificates.
Scheduled Job Search behavior continued to become quieter for owners: empty/zero-result runs should not create unnecessary user mail, while later administrator reporting provides separate operational visibility.
Direct Admin and Let's Encrypt links were removed from the main navbar again; those functions remain reachable through their intended Admin/Services surfaces instead of consuming global navigation space.
Online-session views gained country/region and network-owner/ASN enrichment with bot grouping and caching. This first Cloudflare/RIPEstat implementation was replaced the following day by the local MaxMind stack.

2026-08-15

Public Whisper shares became resilient to missing interaction tables and Turnstile config caching. GET requests for comments/visitor AI degrade to empty lists instead of HTTP 500 when the migration is absent, and a dedicated repair migration can create missing tables even when an earlier migration was already recorded as executed.
Whisper shares gained public visit statistics, full-width form controls, and clearer disabled-state styling for Turnstile-gated actions.
Guest Whisper AI gained named rate limiters: signed-in visitors are scoped by account/share, while guests are scoped by session/share with a broader IP/share safety bucket. Separate legitimate guest sessions behind the same NAT therefore no longer share the small six-request bucket.
Job Search administrators can move an existing profile's configuration to another user transactionally, with profile-name conflict protection while historical runs/listings remain with the original user.

2026-08-14

X-bot reply context now requires complete same-thread ancestry to the conversation root, or a provably complete local chain, before AI reply generation. Missing ancestors and temporary X read failures defer processing instead of producing a reply from incomplete context.
Cross-thread memory became a separate AI decision with fail-closed rules. The current reply chain remains authoritative unless the user explicitly asks about another conversation, and technical/image-sensitive requests normally stay inside the current thread. Legacy memory is also filtered at provider level when cross-thread scope was not proven.
X image references now follow verified reply ancestry so the nearest real ancestor image wins over unrelated images from a larger forwarded list. A request that only asks to see or link an existing image can no longer accidentally trigger new image generation.
Image provenance moved to a shared layer for GUI, API, X, and internal image jobs. Prompt history, effective prompts, provider-revised prompts, reference images, source URLs, external IDs, and derived context can be stored separately from the result image, while historical backfills are explicitly marked partial instead of claiming complete provenance.
Whisper became a persistent transcription workbench: owner AI history survives multiple follow-up questions, transcript segments can be edited line-by-line with tags/notes, and edits update the canonical transcript used by later AI. Existing public share links show the current edited version.
Public Whisper shares can expose owner AI history, maintain separate visitor AI per signed-in user or guest session, and accept public comments. Interaction POSTs use Turnstile, CSRF, and throttling while visitor-AI history stays isolated between visitors.

Earlier changes

The earlier Tools release history through platform version 1.27.1 remains preserved in the pre-existing archive.

Tornevall Networks