-------------------------------------------------------------- !!! PLEASE REPORT ERRORS IMMEDIATELY TO [dbradac] on Slack !!! --- Please also include any relevant steps to replicate --- -------------------------------------------------------------- ___ _ _ ___ _ _ _ __(_) / __| | | |/ __| | | | '__| | \__ \ |_| | (__| |_| | | | | |___/\__,_|\___|\__,_|_| |_| v3.7.1 August 12, 2026 *Log Inspect* ### Improved - Expanded requests in the AI Agents view can now be filtered. Type any part of a request — a status code, a path, a user-agent — to narrow a long list to what matters, and Copy hands back exactly what the filter left on screen. v3.7.0 August 12, 2026 *Log Inspect* ### New - The AI Agents mode now identifies search and indexing crawlers alongside AI agents. Google, Bing, Meta, Applebot and CCBot appear in a section of their own, each checked against the address ranges that vendor is known to use. ### Improved - Crawler verification now covers IPv6. A visit arriving over IPv6 is checked against the vendor's ranges rather than reported as unverifiable. - Addresses forging more than one crawler identity are now caught across all eight vendors, so an impersonator posing as both an AI agent and a search crawler is surfaced. v3.6.8 August 11, 2026 *Gravity* ### Changed - UI refinements. v3.6.7 August 9, 2026 *Gravity* ### Fixed - The dots in the loading orb looked uneven once they were made larger. The pattern reads evenly again, at the same size. v3.6.6 August 9, 2026 *Gravity* ### Fixed - The orb could stall part-way through and then jump while a tool was running. It now runs smoothly from the moment a check starts until its results appear. ### Improved - Tool pages now appear as soon as a check begins, instead of staying on the previous screen until it has finished. v3.6.5 August 9, 2026 *Gravity* ### Fixed - The orbs could freeze part-way through their animation while a tool was running. They now keep moving until the results appear. v3.6.4 August 9, 2026 *Gravity* ### New - Running a tool now shows an animated orb while it works, so a check that takes a few seconds no longer looks like nothing happened. Log Inspect and Lens keep their own progress displays. ### Improved - The orb beside the logo no longer restarts on every tab change, and its scripts are now kept by the browser instead of being downloaded again on each page. v3.6.3 August 9, 2026 *Gravity* ### Changed - The Gravity logo now leads with a small animated orb alongside the wordmark. The wordmark itself is unchanged. The animation stops on its own whenever the tab is in the background or the header is scrolled out of sight, and holds a single still frame for anyone who has asked their system to reduce motion. v3.6.2 August 5, 2026 *Log Inspect* ### Fixed - In the AI Agents view, expanding an address's raw requests showed only the first 50 with no way to reach the rest. The list now loads further batches on request, and Copy hands over every request from that address rather than only the ones currently on screen. v3.6.1 August 5, 2026 *Log Inspect* ### Fixed - In the AI Agents view, the 307 status label was rendering in plain text rather than its intended color, making redirected requests hard to pick out of a busy list. All four status labels are now color-coded and set in a heavier weight, so the requests the firewall acted on stand out from traffic that simply passed. - Choosing AI Agents for a CSV upload ran the entire analysis and then opened the Search dashboard instead, as though the selection had changed itself. Log Inspect now explains up front that AI Agents reads Lumberjack/Lumberjeff logs uploaded as .log or .log.gz, and offers General Stats or Search / Filter for the CSV at hand — before any time is spent uploading. ### Improved - AI Agents is marked beta while the feature settles. - The [Upload another] link on the AI Agents screen now matches the one in General Stats and Search / Filter. v3.6.0 August 5, 2026 *Log Inspect* ### New - Log Inspect adds an AI Agents analysis mode. Point it at a log and it identifies traffic from OpenAI, Perplexity, and Anthropic crawlers, verifies each request against the vendors' published address ranges, and flags impersonators — including a dedicated view of addresses forging multiple crawler identities. Vendor address lists refresh automatically. v3.5.5 August 5, 2026 *Gravity* ### Improved - The Log Inspect IP filter now accepts CIDR notation, so results can be narrowed to an entire address range rather than a single address. v3.5.4 July 30, 2026 *Gravity / VISTA* ### Fixed - Routed all PHP and Node.js dependencies through GoDaddy's approved internal registry and regenerated both lockfiles. Dependency versions unchanged. Ref: AVIT0058650, AVIT0058651 ### Improved - The VISTA screenshot engine has been updated to the latest Playwright release for continued browser compatibility and reliability. v3.5.3 July 24, 2026 *Log Inspect* ### Improved - Searching by URL, User-Agent, or Referrer on large logs now shows live progress again ("Searching… N matched"), so a search across millions of entries gives clear feedback as it runs instead of appearing to hang. v3.5.2 July 24, 2026 *Log Inspect* ### Fixed - Very large logs now finish analyzing reliably. Uploads that reached the final stage of processing could previously stall or fail on the largest files; they now complete dependably, and an interrupted analysis resumes instead of starting over. v3.5.1 July 24, 2026 *Log Inspect* ### Improved - Compressed logs (.log.gz) now start analyzing almost immediately. Large compressed uploads that previously spent several minutes preparing before analysis now begin right away. v3.5.0 July 24, 2026 *Log Inspect* ### Improved - Log Inspect now handles very large log files smoothly. Multi-gigabyte .log and .log.gz uploads that could previously stall or fail now analyze reliably, with fast search, filtering, and stats even on logs with millions of entries. v3.4.9 July 23, 2026 *Log Inspect* ### Changed - Log Inspect now accepts .log / .log.gz uploads up to 600 MB (previously 500 MB). CSV uploads remain at 500 MB. ### Fixed - Fixed a Firefox-only layout issue where the file "Browse" button could appear beside the field label instead of below it at wider window sizes. The upload fields now stack consistently across browsers. v3.4.8 July 23, 2026 *Usage Reports* ### Fixed - CSV Inspect activity is now counted and displayed as Log Inspect in Usage Reports, matching how the two share a single tool experience. Previously CSV uploads appeared as a separate, unstyled entry in the execution logs, tool-usage chart, activity trend, and time-saved totals. v3.4.7 July 23, 2026 *Log Inspect* ### New - Log Inspect now accepts CSV exports in addition to .log / .log.gz. Upload a .csv (or .csv.gz) and the same General Stats and Search / Filter experience applies, adapted to the CSV format. - The Search / Filter results now include a Node column showing the CloudProxy node each request was served from. - Row detail for CSV rows presents each record as a clean, labeled field list, omitting fields that have no value for that request. v3.4.6 July 21, 2026 *Node TTFB, Node 502* ### Improved - Node checks now test both the apex and www forms of a domain on every node. Because the firewall can route each form to origin from a different source address, a problem affecting only one form is now caught where a single combined result could previously hide it. Forms without a DNS record are noted and skipped. - A notice above the results now shows when the apex or www form redirects (to the other form, to a path, or off-domain), so a redirect that lands on a working page is no longer mistaken for the entered address being the live target. Ref: WAFCDNSRE-2438 v3.4.5 July 18, 2026 *Gravity* ### Improved - Refined the Gravity homepage header for a cleaner, more focused look. v3.4.4 July 18, 2026 *Log Inspect* ### Fixed - An issue was identified where the From/To time-range filter interpreted the entered time in the viewer's own timezone, so the selected range could differ from the times shown in the log rows. This has been corrected — the filter now matches the Eastern Time shown in the logs, so a time you enter selects exactly the rows at that time. v3.4.3 July 18, 2026 *Log Inspect* ### Improved - Log Inspect's second iteration is a ground-up rebuild on a dedicated parsing engine that reads the full Sucuri/OpenResty access-log field set — SNI, host header, client IP, upstream address and status, WAF exit, cache result, and request time — so far more detail is available for every request. - Large logs are now processed once into a cached, indexed parse: re-analyzing the same file returns instantly with no reprocessing, and multi-gigabyte logs parse noticeably quicker thanks to a streamed, chunked pipeline and a faster timestamp path. Identical uploads are de-duplicated automatically. - A new interactive Search & Filter dashboard queries the cached parse server-side — filter by IP, status, country, cache result, URL, user-agent, referrer, and Block ID, with results applied instantly and no re-upload as you refine, plus time-range scoping and paged loading for very large result sets. Block ID now distinguishes firewall blocks from origin responses. - The whole tool has been redesigned to match Gravity: a clean two-region upload view and a themed, consistent Search & Filter dashboard. ### Changed - Log Inspect now accepts .log and .log.gz files only; the older CSV workflow has been retired. v3.4.2 July 14, 2026 *Gravity* ### Improved - Node tools now route Frankfurt through its upgraded multi-server layout. *VISTA* ### Improved - Frankfurt tests now route to the upgraded multi-server cluster and show the correct outbound source IP for each node. Ref: WAFCDNSRE-2438 v3.4.1 July 9, 2026 *VISTA* ### Improved - The test detail page now presents a single, clear outbound source IP for each node. Ref: WAFCDNSRE-2438 v3.4.0 July 9, 2026 *VISTA* ### Added - The test detail page now shows the WAF's outbound source IP for each node, reflecting the upgraded multi-server infrastructure. Reports and PNG exports are unchanged. Ref: WAFCDNSRE-2438 v3.3.4 July 9, 2026 *Gravity* ### Improved - The node tools (Node TTFB, Node 502, SSL Node) now display the WAF's outbound source IP for each node, reflecting the upgraded multi-server infrastructure. Ref: WAFCDNSRE-2438 v3.3.3 July 4, 2026 *VISTA* ### Improved - Test rate limits now apply per user rather than per shared network, so teammates no longer affect one another's limits. v3.3.2 June 23, 2026 *VISTA* ### Improved - Tests against the San Jose node now route to its upgraded 8-server cluster groupings, matching the Ashburn, Chicago, Tokyo, Paris, and London layouts. v3.3.1 June 16, 2026 *VISTA* ### Improved - Tests against the Chicago and Tokyo nodes now route to their upgraded 8-server cluster groupings, matching the Ashburn, Paris, and London layouts. v3.3.0 June 13, 2026 *VISTA* ### Changed - Refreshed the Gravity logo with a new animated swallow mascot alongside the wordmark. - Tidied internal asset organization. v3.2.9 June 5, 2026 *VISTA* ### Added - Per-node screenshot failure reason. Redirect-loop failures now show "Screenshot unavailable — too many redirects" instead of a silent blank. ### Fixed - The live test page no longer shows a perpetual loading spinner when a node finishes without a screenshot. v3.2.8 June 5, 2026 *WAF Bypass* ### Fixed - An issue was identified where the cache-bypass parameter was being dropped after a redirect, so checks on redirecting sites could return cached results instead of the live page. This has been corrected — the parameter is now preserved through every redirect, so results always reflect the real destination. v3.2.7 June 3, 2026 *VISTA* ### Improved - The Washington, DC test location is now labeled Ashburn, Virginia, matching the actual server location. v3.2.6 June 3, 2026 *VISTA* ### Improved - Tests against the Washington DC node now route to the new Ashburn (IAD1) infrastructure with 8-server cluster groupings, matching the Paris and London PoP layouts. v3.2.5 May 30, 2026 *VISTA* ### Refined - Inputs on the dashboard now glow softly when you hover over them, and the focus ring is calmer and more confident. - The Test History card lifts gently on hover, matching the other cards on the page. v3.2.4 May 29, 2026 *VISTA* ### Added - Test detail page now shows the pinned CloudProxy node IP under each location name. Internal-visibility only — the report page and PNG export are unchanged. v3.2.3 May 29, 2026 *VISTA* ### Changed - Fixed an issue where the Test History header row (title + search box) was misaligned with the table content below it due to missing horizontal padding and an unscoped inherited border. v3.2.2 May 29, 2026 *VISTA* ### Changed - jupiter_events table now has an ON DELETE CASCADE foreign key to jupiter_tests, matching the existing pattern on jupiter_test_nodes and jupiter_artifacts. Events for hard-deleted tests now clean up automatically alongside node rows and artifacts. - Daily cleanup gained a defensive sweep that removes any orphan events whose parent test no longer exists. With the new FK in place this should normally find zero rows; the sweep is a safety net for any future code path that bypasses the cascade. ### Fixed - Cleaned up historical orphan events accumulated by v3.2.1's first hard-delete run — events whose parent tests were already gone and could not be recovered. Migration deletes them explicitly before adding the FK constraint. v3.2.1 May 28, 2026 *VISTA* ### Changed - Test History on the dashboard now spans the full 35-day retention window instead of the most recent 100 tests, so recently-expired tests stay visible for several days after they expire instead of disappearing the moment a hundred newer tests pushed them out. - Pagination is now server-driven: clicking Next/Prev fetches just that page (15 rows) from the server instead of slicing pre-rendered DOM. The dashboard scales cleanly to tens of thousands of tests without bloating the page payload. - Live heartbeat is now scoped to page 1 only. Pages 2+ contain finalized tests whose status will not change, so they are fetched once and stay static. When the user returns to page 1, the heartbeat resumes automatically. - Heartbeat cadence relaxed from 2s to 5s active (15s idle, 30s when tab is hidden) to reduce server load now that each tick covers exactly the rows currently visible. - Test History search now matches across the full 35-day window via a debounced server-side query (300ms), not just the rows currently rendered on the user's page. Search matches both domain AND test ID — pasting a full 32-char test ID hits an exact-match fast path. - User-driven dashboard fetches (pagination clicks, search) now show a subtle 150ms opacity dim on the table body while loading, so clicks feel responsive even on slower connections. Heartbeat fetches do not dim. - Database retention now hard-deletes test rows after 35 days. The daily cleanup runs three passes: rescue stuck tests (any active-status test older than 6 hours becomes failed), soft-expire at 30 days (existing — marks status, deletes artifacts), then hard-delete at 35 days. The ON DELETE CASCADE foreign keys on jupiter_test_nodes and jupiter_artifacts clean up child rows automatically. Database growth is now bounded. ### Fixed - Fixed a "Total Tests" flicker on the dashboard where the count would briefly show all-time test count on initial render, then drop to the 35-day-windowed count once the heartbeat fired. Both paths now use the same windowed query. - Hardened all dashboard fetches against response-ordering races. User-driven actions (pagination, search) are now treated as foreground and are never discarded by a concurrent background heartbeat — fixes a regression where clicking "Next" on page 1 would frequently fail silently because the activity tracker fired an immediate heartbeat in the same click event. - Removed the obsolete 'html' field from the dashboard heartbeat response (was retained for backward compatibility in v3.1.1, no consumer remained), cutting the response payload roughly in half. v3.2.0 May 28, 2026 *VISTA* ### Changed - Full dark theme refresh for VISTA: page, surfaces, headers, modals, toasts, status badges, and form inputs all redesigned for a Jupiter-adjacent dark palette (#0A0A0A page, #171717 cards, #EDEDED text). Brand orange remains the primary action color and brand green remains the identity accent across both pages. - Status badges and HTTP status pills inverted to a dark-friendly contrast model: translucent same-hue background with bright same-hue text, so they read as integrated chips on dark cards instead of glowing pastel pills. - Header bar lifted one elevation step above the page so it reads as elevated; modal overlay dimming strengthened and the modal panel gained an inset top-edge highlight and heavier outer shadow for depth on dark. - Test detail and report pages now share a single card-style page header with a unified meta strip (status badge · Test ID pill · Nodes · Cluster · Created/Generated · Expires). The previous Phase-7 flush header on the report page was replaced for consistency. The progress bar and error message remain test-detail-only. - Cluster input on the dashboard now accepts single-digit values (e.g. "3") and auto-pads them to two digits ("03") on blur and on form submit, instead of rejecting them with a browser pattern-match error. Letters, spaces, and empty values are still rejected. ### Fixed - Fixed a long-standing bug where the test detail progress bar could remain stuck at an intermediate width after a test reached a final status (completed / failed / expired). The bar now snaps to 100% and the candy-stripe animation stops automatically without requiring a page refresh. - Fixed the percentage label on the right side of the test detail progress row, which was rendered once at page load and never updated during polling. The label now updates live alongside the bar width and the "Screenshots: X / Y nodes" text. aria-valuenow on the bar is now also kept in sync for screen readers. - Fixed three pre-existing CSS variable references in test_detail.php and node_result.php that pointed to undefined tokens (--status-failed, --status-failed-bg, --radius-xs, --muted) and silently rendered with no background, wrong color, or default border-radius on failed tests. They now resolve to the correct status-fail and tertiary-text tokens. ### Security - Report PNG export region (#jptExportArea) keeps its original document-friendly light surfaces (white background, dark text on white, light pastel status badges, original document-friendly status colors including the dark blood-red 5xx pill) regardless of the new dark theme. The export remains pixel-equivalent to v3.1.2 across every surface inside the export region. v3.1.2 May 27, 2026 *VISTA* ### Changed - Dashboard visual refresh: introduced a "drafting paper" page treatment (slate-blue base #B6C2D2 with a faint diagonal grid texture, a soft gradient under the top header, and a subtle radial vignette) that gives the page real depth and ties the dark header into the rest of the UI. - Card system overhaul: card surfaces softened from pure white to slate-tinted off-white (#F5F7FA), paired with a two-layer shadow (tight contact + soft ambient halo) so cards feel anchored to the page and lifted at the same time. Stat cards, Launch Test card, and Test History card all share the new treatment. - Refined visual language: removed decorative top stripes from stat cards and the green left bar from the Launch Test card; status is now conveyed by colored dots and labels alone. Established a two-color action language across the platform — green for identity (headings, brand cues), orange (#F97316) for primary actions (Run Test, View, View Report, Download Report, Generate Report). Secondary navigation (Dashboard, Back to Test, Cancel) stays neutral. - Typography and table polish: dashboard section headings ("Launch Test", "Test History") restyled to a larger, bolder dark treatment (1.35rem) with no underline and aligned left edges; Test History table gained stronger zebra striping, row hover, monospace pills for test IDs, a more prominent View button, and a unified badge palette (queued→orange, running/screenshotting/generating_report→blue, failed→red). Tabular numerals applied across all numeric columns to prevent jitter as values update. ### Fixed - Report PNG export now has 1.5rem internal padding so captured content has breathing room from the white edges, and the padding rule applies to both #jptExportArea and the export-time clone #jptExportAreaClone so the PNG and on-screen view stay consistent. v3.1.1 May 21, 2026 *VISTA* ### Security - Removed dynamic dashboard HTML injection from VISTA live updates. - Replaced 'innerHTML' dashboard row replacement with safe structured JSON rendering. - Dashboard rows are now built with browser-native DOM APIs and 'textContent'. - Added client-side row validation and status-class whitelisting for live dashboard updates. ### Changed - Updated the dashboard heartbeat API to return structured row data for safe rendering. - Preserved dashboard search, pagination, copy actions, live lifecycle updates, target URL display, and idle polling behavior. v3.1.0 May 21, 2026 *VISTA* ### Changed - Stopped VISTA dashboard and test detail live polling when the browser tab is hidden. - Stopped live polling after 3 minutes of visible-page user inactivity. - Live polling now resumes with one immediate refresh when the user returns to the tab or interacts with the page. ### Performance - Reduced unnecessary background 'dashboard_tests' and 'test_status' requests from idle browser tabs. - Preserved normal live updates while the user is actively using the dashboard or test detail page. v3.0.9 May 21, 2026 *VISTA* ### Added - Added support for testing specific URL paths in VISTA, not only site homepages. - Added normalized 'target_url' storage while preserving the existing host-only 'domain' field. - Added support for bare domain paths, full HTTPS URLs, and full HTTP URLs. - Added database migration '003_add_target_url.sql'. ### Changed - Updated discovery and screenshot capture to use the requested target path while preserving CloudProxy node pinning. - Updated dashboard, test detail, and report views to display the tested target. - Test Again now preserves the exact tested target URL/path. ### Security - Added strict URL normalization and SSRF protections for VISTA target input. v3.0.8 May 21, 2026 *VISTA* ### Changed - Updated VISTA progress tracking to represent screenshot-stage completion instead of discovery/warm-up completion. - Test detail and dashboard progress now track screenshot capture attempts per node. - Updated progress labels to clarify screenshot progress. ### Fixed - Fixed progress reaching 100% before screenshots were actually processed. - Fixed dashboard lifecycle updates so running tests transition live through RUNNING, SCREENSHOTTING, and COMPLETED without page refresh. - Improved dashboard heartbeat state tracking with stronger signature handling and defensive fallback behavior. - Removed the temporary Release Candidate validation notice from the VISTA dashboard. v3.0.7 May 21, 2026 *VISTA* ### Added - Added a live dashboard heartbeat for VISTA Test History. - The dashboard now discovers new tests created from other tabs or users without requiring a page refresh. - Status, progress, summary stats, and active test rows now update automatically. ### Changed - Reworked dashboard history updates to use a read-only snapshot endpoint. - Added adaptive polling to reduce server load when the dashboard is idle or hidden. - Preserved search, pagination, and copy button behavior across live row updates. v3.0.6 May 21, 2026 *VISTA* ### Added - Added a Test Again action for completed VISTA tests. - Test Again creates a brand-new queued test using the original test domain, node range, and cluster. - Added Test Again buttons on completed test detail and report pages. - Added event logging for Test Again traceability without modifying original test results. - Added live reveal behavior so Test Again appears automatically when a running test completes. ### Fixed - Fixed the VISTA top header disappearing after scrolling far down the page. - Adjusted header and report modal layering so modals remain above the sticky header. v3.0.5 May 20, 2026 *VISTA* - Extended VISTA/Jupiter report retention from 14 days to 30 days. - Updated the report cleanup TTL constants to keep generated VISTA reports available for a longer review window. v3.0.4 May 20, 2026 *VISTA Reports Integration* ### Added - Added VISTA/Jupiter completion tracking to the Gravity Reports system. - Added automatic audit logging when a VISTA test reaches the completed status. - Added VISTA to Reports charts, tool filters, execution logs, CSV export, and Estimated Time Saved breakdown. - Added a dedicated VISTA badge and chart color using a slate visual identity. - Added a Jupiter-to-Gravity audit bridge for writing completed VISTA tests into the shared 'audit.sqlite' logs table. - Added an idempotency guard using Jupiter events to prevent duplicate report entries for the same completed test. - Added a CLI-only backfill script for logging already-completed VISTA tests when needed. ### Changed - Extended the reporting benchmark configuration with VISTA using a fixed 1-minute manual-equivalent estimate. - Updated reporting display names so the internal 'jupiter' tool slug is shown as 'VISTA' in the UI. - Bumped the reporting schema version so existing installations receive the new VISTA Estimated Time Saved configuration automatically. ### Fixed - Prevented queued, running, screenshotting, report-generating, failed, or expired VISTA tests from appearing in Gravity Reports. - Ensured VISTA report logging happens only after a test is successfully marked as completed. v3.0.3 May 20, 2026 *VISTA* ### Fixed - Fixed intermittent blank screenshot areas in generated VISTA PNG reports. - Fixed a production-only report export issue where lower-location screenshots could appear correctly in View Report but be missing from the generated PNG. - Released the PHP session lock before read-only screenshot and PDF serving to prevent serialized screenshot requests during export. - Reworked PNG export to render an offscreen report clone with required screenshots inlined before html2canvas runs. - Fixed Jupiter asset cache busting so updated 'jupiter.js' is reliably loaded after deployment. ### Changed - Added VISTA export diagnostics for selected screenshot count, inlined screenshot count, canvas size, and final PNG size. - Improved PNG export behavior so failed screenshot preparation aborts the export instead of silently generating a report with blank screenshot cards. - Kept the live View Report page unchanged during export by applying location exclusions only to the temporary export clone. v3.0.0 May 8, 2026 *VISTA Release Candidate* ### Added - Introduced VISTA, a new Gravity-integrated visual node testing and reporting module. - Added support for running site checks across CloudProxy node locations with per-location HTTP status, screenshot capture, and report generation. - Added a VISTA dashboard with recent test history, status tracking, progress indicators, node range, cluster, and quick access to completed reports. - Added report pages with per-location screenshot cards, HTTP result visibility, and generated report artifacts. - Added a Download Report flow for PNG-based report exports. - Added a report-generation modal allowing users to exclude specific locations from the exported PNG when a location returns blank. - Added a professional warning notice when excluding locations from a generated report, reminding users that exclusions should only be used for blank locations and that visible issues such as 502, 504, 500, or 403 must not be hidden. - Added a Release Candidate notice for active VISTA test runs, instructing users to report unexpected behavior immediately to Daniel Bradac (dbradac) on Slack. ### Changed - Replaced the previous visible Download PDF action with a cleaner Download Report action. - Kept the canonical VISTA report page truthful: location exclusions only affect the generated PNG export and never modify the actual report data. - Improved report export UX by making all locations selected by default and requiring users to intentionally deselect locations only when needed. - Improved screenshot reliability by replacing Playwright’s native page.screenshot() call with Chrome DevTools Protocol Page.captureScreenshot. - Increased screenshot operation timeout handling to avoid premature failures on slower sites. - Added font request blocking during screenshot capture to reduce hangs caused by slow or unreachable web font resources. - Improved screenshot handling for problematic sites where Playwright could hang on 'waiting for fonts to load'. ### Fixed - Fixed an issue where screenshots could fail or remain blank for all locations on sites with slow or problematic font loading. - Fixed screenshot timeout behavior so the configured timeout is applied consistently instead of falling back to Playwright’s default screenshot timeout. - Fixed report generation edge cases where screenshots could fail even though the target site was reachable. - Fixed export behavior so hidden/excluded locations are always restored after PNG generation, even if the export fails. - Fixed duplicate-click risk during report generation by disabling the generate action while the PNG is being created. v2.8.0.1 May 8, 2026 *WAF Bypass* Platform - Refined silent 403 recovery to retry the cleaned final URL with HEAD before escalating to browser-like GET probes. - Prevented unnecessary HTTP 206 Range responses when a clean HEAD request already returns HTTP 200. - Preserved browser-like GET and X-Forwarded-Proto escalation for origins that block HEAD or require reverse-proxy headers. v2.8.0 May 8, 2026 *WAF Bypass* Platform - Cleaned up WAF Bypass output by hiding internal fallback diagnostics while preserving the original redirect chain and final reproducible curl result. - Added silent 403 recovery for origin/WAF responses by retrying with browser-like GET probes and reverse-proxy headers when appropriate. v2.7.9 May 2, 2026 *Router / Session Handling* Platform - Fixed same-browser tab blocking caused by PHP session file locking during long-running tools. v2.7.8 May 1, 2026 *Lens* Platform - Improved Edge / Error Status chart readability with clearer error marker colors and larger symbols. - Added horizontal dodge spacing for overlapping error-status lollipops in the same chart bucket. v2.7.7 May 1, 2026 *Lens* Platform - Fixed Security Alerts detail panels after recent large-report payload optimization. - Restored server-side internal hourly maps needed for Security Alert metrics and expanded details. - Kept frontend `reportData` slim by stripping heavy internal maps only from the JavaScript payload. - Preserved chart rollup, Traffic Scale selector, Edge / Error Status overlays, and 12-hour Lens cleanup behavior. - Confirmed Security Alerts now show correct Unique IPs, Top IP Share, Geo Entropy, and Top Country values on regenerated reports. v2.7.6 May 1, 2026 *Lens* Platform - Added automatic chart rollup for large Lens reports to improve readability on long-range logs. - Aggregates chart-only hourly data into 6-hour or 24-hour buckets when the raw chart has too many points. - Preserves raw hourly report data for analysis, findings, anomalies, and cached report logic. - Added a Traffic Scale selector with Linear and Logarithmic options. - Added zero-safe logarithmic traffic scaling so high-volume spike/DDoS-style logs remain readable. - Kept Edge / Error Status overlays aligned with rolled-up chart buckets and preserved the right-side error-count axis. v2.7.5 May 1, 2026 *Lens* Platform - Added session-scoped cache reuse for Lens reports using browser session, normalized filename, and file size. - Added pre-upload cache detection for large/job-mode uploads so repeated uploads can skip chunk upload and analysis. - Added sync-mode cache detection before analysis for smaller uploads. - Added 12-hour Lens disk cleanup for expired cached reports, job folders, uploaded chunks, decompressed files, and stale session entries. - Consolidated Lens job cleanup helpers into shared Lens engine logic. - Fixed deployment issues caused by a PHP docblock `*/` sequence and a stale `cleanupOldLensCache()` call. v2.7.4 April 30, 2026 *Lens* Platform - Improved Edge / Error Status overlays with lollipop-style event markers. - Replaced interpolated error-status lines with isolated stems and shaped markers to avoid implying continuous errors between sparse events. - Preserved null buckets for zero-error periods so no misleading zero baseline is drawn. - Kept selected error statuses on the right-side error-count axis with traffic series dimmed as context. - Improved readability for sparse 5xx / edge-error events while preserving existing Lens chart behavior. v2.7.3 April 30, 2026 *Lens* Platform - Improved Edge / Error Status chart readability with a dual Y-axis layout. - Moved selected error-status overlays to a right-side error-count axis while keeping traffic on the left axis. - Added automatic right-axis scaling so low-volume 5xx/error trends remain visible next to high traffic volumes. - Updated error-status colors to a higher-contrast palette for easier visual distinction. - Kept error-status overlays as line series even when the main chart type is switched to bar. - Sorted Edge / Error Status dropdown entries by finding count, showing the most relevant statuses first. v2.7.2 April 30, 2026 *Lens* Platform - Added an Edge / Error Status filter to the Lens chart controls. - Added selectable status overlays for 500, 501, 502, 503, 504, 520, 521, 522, 523, 524, 525, 526, and 530. - Added per-status counts in the dropdown so users can identify relevant errors from the uploaded log. - Added per-hour status aggregation for chart overlays in both sync and job-mode analysis. - Preserved default Lens chart behavior when no Edge / Error Status filters are selected. - Added compatibility handling for older cached Lens reports without the new status-count fields. v2.7.1 April 28, 2026 *Log Inspect* Platform - Improved Sucuri/CloudProxy log parsing for HTTP/2 and HTTP/3 request lines. - Fixed request/path extraction for high-volume blocked/JSFILTERED rows so Top URLs and related statistics are counted correctly. - Added parser-level request-field detection instead of relying only on fixed quoted-field positions. - Normalized Top URLs by stripping query strings/fragments so query variants are grouped under the same requested path. - Removed temporary parser diagnostics after validation. *Lens* Platform - Updated shared log parsing logic to match the Log Inspect parser improvements. - Improved HTTP/2 and HTTP/3 request parsing consistency for shared log-analysis flows. v2.7.0 April 28, 2026 *Log Inspect* Platform - Improved Sucuri/CloudProxy log parsing for HTTP/2 and HTTP/3 request lines. - Fixed request/path extraction for high-volume blocked/JSFILTERED rows so Top URLs and related statistics are counted correctly. - Added parser-level request-field detection instead of relying only on fixed quoted-field positions. - Added temporary parser diagnostics to verify parsed path coverage for 307 and JSFILTERED rows during validation. *Lens* Platform - Updated shared log parsing logic to match the Log Inspect parser improvements. - Improved HTTP/2 and HTTP/3 request parsing consistency for shared log-analysis flows. v2.6.8 April 28, 2026 *Log Inspect* Platform - Increased the upload limit from 100 MB to 500 MB. - Updated both the visible dashboard wording and backend validation to consistently allow uploads up to 500 MB. - Raised shared upload validation to match the new Log Inspect limit. - Updated PHP upload handling config to support larger requests. *Lens* Platform - Increased the compressed upload limit for supported .gz files from 100 MB to 500 MB. - Updated both the visible dashboard wording and backend/job-mode validation to consistently allow .gz uploads up to 500 MB. - Updated all related error messages to reflect the new 500 MB limit. v2.6.5 April 23, 2026 *Node 502* Platform - Updated Paris CP19 cluster association for the upgraded Paris PoP (8 nodes / 5 clusters each): NN 19 now maps to 37/32/27/22/17/12/07/02 based on input range. - PoP 18 remains on its existing 4-cluster mapping. *Node TTFB* Platform - Updated Paris CP19 cluster association for the upgraded Paris PoP (8 nodes / 5 clusters each): NN 19 now maps to 37/32/27/22/17/12/07/02 based on input range. - PoP 18 remains on its existing 4-cluster mapping. *SSL Node* Platform - Updated Paris CP19 cluster association for the upgraded Paris PoP (8 nodes / 5 clusters each): NN 19 now maps to 37/32/27/22/17/12/07/02 based on input range. - PoP 18 remains on its existing 4-cluster mapping. v2.6.3 April 2, 2026 *WAF bypass* Platform - Renamed the internal HTTP request helper from 'exec_one' to 'request_one'. - No behavior or logic changes. v2.6.2 April 1, 2026 *Node 502* Platform - Fixed redirect handling in node-pinned checks: 3xx responses are now followed manually instead of relying on cURL automatic redirect following. - Each redirect hop now stays pinned to the same CloudProxy node using cURL resolve rules, preventing follow-up requests from re-resolving through public DNS. - Fixed incorrect cross-node result chains where the initial request hit the intended node but the redirected request could be served by a different node. - Improved redirect parsing reliability by using a per-hop header buffer for 'Location' extraction instead of reading from one combined header stream. - Fixed relative redirect handling so paths like '/login', 'index.php', and '../path' are resolved against the logical request host instead of the transport node hostname. - Fixed an issue where relative redirects could incorrectly build the next hop against 'cloudproxy*.sucuri.net', causing invalid follow-up requests and false 404 results. - Preserved the original 'sucuri-test-*' cache-busting / trace token across redirect hops for consistent cache bypassing and easier request correlation in logs. - Added redirect loop protection to stop repeated/manual redirect cycles safely during multi-hop node tests. - Kept existing output behavior clean: the tool still prints the HTTP status chain without re-introducing raw 'Location' header output into the report body. v2.6.1 March 14, 2026 *SSL check* Platform - Added public DNS resolution notice to the SSL notice stack. - Improved SSL output consistency by showing resolved public IPs on the Leaf certificate line and simplifying Origin label formatting. v2.6.0 March 14, 2026 *SSL check* Platform - Upgraded SSL analysis UI/UX with top notification banners for certificate coverage, issuer/trust concerns, expiry, wildcard detection, and edge/origin differences. - Improved certificate coverage analysis for apex, www, and subdomain inputs, including correct wildcard handling and removal of false warnings on www/subdomain checks. - Added compact certificate chain presentation above the report box while keeping the raw SSL report clean and copyable. - Improved origin IP analysis: forced-origin certificates now generate their own relevant notices instead of only appearing in raw report output. - Fixed signature algorithm reporting to use actual certificate data instead of a hardcoded value. - Hardened SAN handling for missing/empty SAN cases and cleaned report output when SANs are absent. - Improved issuer/self-signed heuristics and chain role labeling for more reliable SSL warnings. v2.5.9 March 13, 2026 *DNS* Platform - Improved Firewall detection logic for Sucuri / CloudProxy and Cloudflare-powered setups. - Sucuri detection now validates both DNS evidence and response headers (x-sucuri-id / x-sucuri-cache), fixing false negatives on Cloudflare-fronted Sucuri sites. - Added Cloudflare-powered detection using secureserver.net DNS/PTR evidence + Cloudflare headers (server: cloudflare / cf-ray). - Detection priority updated: Sucuri takes precedence; Cloudflare is evaluated only when Sucuri is not active; otherwise the tool reports "No Firewall Found". - Added DNS bypass warnings for mismatched or mixed protected/unprotected records, and for broken/missing www resolution where relevant. - Fixed false www warning when testing hosts already starting with "www.". - For subdomain inputs, the NS Record section now resolves and displays NS from the registrable root/apex domain instead of showing blank. - UI/UX: added top notification banners above the results box for warnings and detection evidence, while keeping the DNS report body clean and copyable. v2.5.8 March 13, 2026 *Reports* Platform - Added new "Estimated Time Saved" dashboard to reports.php. - New benchmark cards: Estimated Manual Equivalent, Actual Tool Runtime, Estimated Time Saved, and Efficiency Ratio. - Added per-tool breakdown table and CSV export fields for benchmark estimates. - Added reporting backend under /lib for DB bootstrap, benchmark config, and calculation logic. - reports.php now auto-creates missing reporting DB/config if needed. - Implemented conservative per-tool benchmark estimates calibrated to current operator baselines. - Updated wording/UI to match the new benchmark section. - Added PDF overview documenting how the backend calculates Estimated Time Saved. Docs: https://gravity.bradac.ro/docs/gravity_estimated_time_saved_backend_overview_v7.pdf v2.5.6.3 March 13, 2026 *Node TTFB* Platform - Added optional per-node "Load" metric (toggleable): runs a static page-load crawl (same-origin assets only) per CloudProxy node and reports "Load: X.XXXs (N req / Y.Y MB)". - Implemented shared crawl engine in "lib/load_engine.php" (adapted from load.php) and integrated it into nodes.php without impacting the existing TTFB/Loss probing flow. - Improved Load reliability on node-pinned tests: added "insecure" mode for TLS verification bypass (load.php remains strict by default). - Improved diagnostics: Load failures now surface the underlying cURL error (errno/message) instead of collapsing to "n/a". - UI: added "Load" checkbox + aero-style info tooltip explaining behavior and performance impact; when disabled, nodes.php runs unchanged (no extra crawl work). v2.5.6.2 February 28, 2026 *Node TTFB* Platform - Implemented the same streaming keepalive + curl_multi heartbeat logic used in Node 502 check (n502.php) to prevent "silent" runs and upstream idle timeouts on long node loops. - Output parity with n502: added per-node "Testing on CloudProxy… - " progress lines, consistent "Report generated: … UTC" footer, and blank-line spacing between node blocks for readability. v2.5.6.1 February 28, 2026 *WAF bypass* Platform - Added Canonical Retry Engine: when the primary redirect chain ends in a non-acceptable terminal (not 2xx/403) and redirects stay on the same registrable domain, the tool now re-probes canonical entry points (/, /index.php) without the cache-busting 'nc' parameter. - Canonical retry follows redirects (up to the same 10-hop limit) and includes loop detection that ignores 'nc' query churn to prevent false "endless" retry behavior on tokenized redirects. - Improved success coverage on "error landing" flows (e.g. 301 → /406.shtml [404]): canonical retry can now recover a valid terminal 2xx/403 result where the origin is reachable on a clean root path. - Output clarity: prints "Canonical retry: attempted (...)"", "Canonical retry succeeded ..."" and (when relevant) the canonical retry redirect chain, while keeping the original redirect chain and final '$ curl ...'' output format unchanged. v2.5.6 January 17, 2026 *Node 502* Platform - Added streaming keepalive heartbeats (invisible HTML comment chunks) emitted every 10 seconds to prevent browser/origin idle timeouts during long runs. - Implemented curl_multi execution loop so heartbeats continue while waiting on slow/stalled nodes (no more "silent" periods during per-node requests). - Increased per-node cURL timeout to 65 seconds for slow nodes / strict firewall paths. - Output hygiene: removed heartbeat trailing newline to prevent occasional blank lines in 
 output.

*Router* Platform
- Added n502 streaming mode in index.php: disables PHP output buffering/compression, drains active buffers, sets X-Accel-Buffering: no, and extends time limit for long-running node tests.

v2.5.5 January 1, 2026
*Node 502* Platform
- Updated London CP21 cluster association for the upgraded London PoP (8 nodes / 5 clusters each): NN 21 now maps to 37/32/27/22/17/12/07/02 based on input range.
- Standardized request signature: User-Agent is now "Firewall Test Request".
- Output clarity: printed node label now displays as "CloudProxy" (display-only; request hostnames remain "cloudproxy*.sucuri.net").

*Node TTFB* Platform
- Updated London CP21 cluster association for the upgraded London PoP (8 nodes / 5 clusters each): NN 21 now maps to 37/32/27/22/17/12/07/02 based on input range.
- Standardized request signature: added User-Agent "Firewall Test Request" for consistency with other node tools.
- Output clarity: results now label nodes as "CloudProxy..." instead of "firewall...".

*SSL Node* Platform
- Updated London CP21 cluster association for the upgraded London PoP (8 nodes / 5 clusters each): NN 21 now maps to 37/32/27/22/17/12/07/02 based on input range.
- Standardized request signature: added User-Agent "Firewall Test Request" for consistency with other node tools.
- Improved certificate details output: now includes Common Name, SANs, friendly validity range, serial number, signature algorithm, and issuer.

v2.5.4 December 29, 2025
*Firewall Bypass* tool
- Fixed WAF bypass output formatting: terminal-style "$ curl ..." line, removed extra blank line before headers, and removed the unnecessary "Final status" / "Test finished" footer.
- Improved bypass engine reliability on shared hosting: removed dependency on disabled PHP functions (escapeshellarg) and eliminated protocol-selection warnings.
- Updated defaults and edge handling: protocol now deterministically defaults to HTTP (80) unless explicitly selected; Origin IP is optional (connect-to is only used when provided).
- Enhanced loop handling: safer redirect-loop fallback probe using X-Forwarded-Proto/Port and correct scheme/port when following a redirect in fallback mode.

v2.5.3 December 28, 2025
*Lens* Platform
- Fixed an issue where Lens Jobs were not consistently tracked in reports.php.

v2.5.2 December 28, 2025
*Lens* Platform
- Added Lens Jobs batching system for large uploads: chunked upload + batched decompression/analysis to prevent PHP timeouts and limit spikes.
- Introduced job-mode thresholds: .gz files switch to job mode at ≥ 2 MB; uncompressed .log/.csv switch at ≥ 50 MB.
- New job endpoints under /jobs (lens_job_start.php, lens_job_upload.php, lens_job_process.php) with per-job workspace under /cache/lens_jobs// (session-owned).
- Concurrency safety: per-job file locking + lastUpdate heartbeats; endpoints enforce session ownership to prevent cross-user interference.
- Automatic hygiene: finished job folders are removed on completion; opportunistic TTL cleanup removes completed jobs after 1h and abandoned jobs after 24h.
- Upload policy hardening: archived (.gz) uploads limited to 100 MB (UI + server-side enforcement).
- Modernized job UI: "Lens Job Status" stepper (Upload/Decompress/Analyze/Finalize), progress bar with engineer-friendly phase details; the "What is Lens?"" explainer hides while a job is running and returns on error.

v2.5.1 December 28, 2025
*UI/UX Improvements*
- Fixed tab highlighting bug: selecting "SSL check" no longer also highlights "SSL Node" (tab detection now matches the exact "tab" query parameter instead of substring matching).

*Reports*
- Standardized Lens tool label casing: "Lens" now displays correctly (instead of "lens") across Tool Execution Logs, filters, charts, and CSV export.
- Added Lens badge styling and aligned the Reports chart color palette to match tool badge colors for consistent visuals across dashboards.

v2.5.0 December 26, 2025
*Lens* Platform
- Added new Lens tab: upload Sucuri/CloudProxy logs (.log/.csv/.gz) and generate an hourly traffic timeline for the selected period.
- Interactive dashboard (Chart.js): line/bar charts, series toggles (Requests / Allowed / Blocked / Bots), zoom + pan, and Download PNG export.
- Added Stats cards: HTTP Status Codes, Geo Location (Top 10), and Cache Results breakdown.
- Security Alerts: hourly anomaly detection with noise reduction (grouping repeated single-source events) and severity tiers for faster triage.
- Log Health Indicators: surfaces Edge timeouts (502/504) and Origin pressure (503/508) to correlate WAF timeouts vs backend resource issues.
- Exposure & Vulnerability Checks (auto-detected targets from uploaded logs):
  - Extracts Host header + Upstream/Origin IP from the log (no manual input required).
  - CloudProxy coverage check for apex + www via DNS intent.
  - Edge SSL validity + days remaining.
  - Edge HTTP→HTTPS redirect check tested via public routing (NOT via origin IP).
  - Origin Bypass Test tested directly against the extracted origin IP (Host header preserved); classifies Protected on blocked statuses (e.g., 403/421) and flags Exposed only when origin serves content directly.
- Added shared helper libraries for maintainability and reuse across tools:
  - lib/log_common.php (parsing + iterators + bot detection helpers)
  - lib/net_checks.php (DNS/SSL/redirect/bypass helpers)
- Implemented token-based caching for Lens reports + scan results (session-bound) to keep refreshes fast and avoid repeated network checks.

v2.4.8 December 17, 2025
*SSL Node* Platform
- Updated default End NN from 20 to 21 to include the new London PoP.
- Added skip logic for NN 13 (London PoP moved from CP13 to CP21).
- Implemented cluster mapping for NN 21 (London): clusters now map to 37/32/27/22 based on input range.

v2.4.7 December 17, 2025
*Node TTFB* Platform
- Updated default End NN from 20 to 21 to include the new London PoP.
- Added skip logic for NN 13 (London PoP moved from CP13 to CP21).
- Implemented cluster mapping for NN 21 (London): clusters now map to 37/32/27/22 based on input range.

v2.4.6 December 17, 2025
*Node 502* Platform
- Updated default End NN from 20 to 21 to include the new London PoP.
- Added skip logic for NN 13 (London PoP moved from CP13 to CP21).
- Implemented cluster mapping for NN 21 (London): clusters now map to 37/32/27/22 based on input range.

v2.4.5 December 5, 2025
*Node 502* Platform
- Implemented automatic HTTP/1.1 fallback for nodes experiencing HTTP/2 framing errors (error code 16).
- Enhanced reliability: when a node fails with HTTP/2 framing layer errors, the script automatically retries the request using HTTP/1.1.
- Added visual indicator "(retried with HTTP/1.1)" in output when fallback is triggered.
- Stopped printing redirect 'Location' headers and the HTTP 3xx redirect warning line in test output.

v2.4.4 November 29, 2025
*UI/UX Improvements*
- Various UI/UX improvements and visual polish for the navigation menu.
- Minor layout bug fixes.

v2.4.3 November 29, 2025
*UI/UX Improvements*
- Implemented a full-width navigation layout; tabs now dynamically expand to fill the available container space using Flexbox.
- Resolved visual artifacts on the last tab ("Log Inspect") by removing edge gradients, ensuring consistent rounded corners on both the left and right sides of the menu.
- Optimized view: tabs revert to their natural width to allow horizontal scrolling without label compression on smaller screens.
- Centralized tab text alignment for a balanced look across all screen sizes.

v2.4.2 November 20, 2025
*SSL Node & Node TTFB*
- Updated the cluster association logic, ensuring consistent behavior across the Singapore and Paris PoPs.
- PoP 18 and 19 now automatically "snap" to the correct cluster ranges (32 / 22 / 12 / 02), improving accuracy when inspecting SSL certificates on those clusters.
- Per-node hostnames are now generated dynamically using the adjusted cluster for each node, providing a more reliable view of SSL certificates across the entire CloudProxy network.

v2.4.1 October 30, 2025
*CAAS Stats*
- Fixes an issue where auto-run Ticket Analysis was recorded as Summarize Ticket in logs and charts.
- Records stats only for user-initiated actions via short-lived, IP-bound click tokens.
- Excludes Ticket Analysis (autorun) from all reports and CSV exports.
- Adds lightweight backend store for click tokens.
- Requirement: Updated Tampermonkey CAAS Tool script that requests a click token and includes it on POST.
You can download from here: https://gravity.bradac.ro/downloads/CAAS_Tampermonkey.zip

v2.4.0 October 30, 2025
*Introducing CAAS Stats*
- New CAAS Stats dashboard: Live, UTC-first view of CAAS activity.
- Familiar UI: Matches the Reports layout.
- CAAS userscript: Clean "CAAS" dropdown label and accurate Ticket ID capture from Admins (parsed from the header), with automatic logging to the CAAS endpoint.
- CAAS Stats requires the updated Tampermonkey CAAS Tool script with Ticket ID capture and logging enabled.
You can download from here: https://gravity.bradac.ro/downloads/CAAS_Tampermonkey.zip

v2.3.0 October 22, 2025
*Mixed-Content* Platform
Added SiteCheck integration (TLS/mixed-content only) alongside the existing Scan.
- Normalizes input to host (with IDN - ASCII support) and builds results/ URL.
- JSON-first retrieval (?format=json, .json, api/v4, api/v3, legacy) with HTML fallback when JSON is unavailable.
- Extracts only the TLS "HTTPS mixed content" pairs in the form [http://] on [https://].
- Deduplicates while preserving order; trims common scanner/false-positive paths (/.git/, /wp-includes/) to better match the UI.
- Renders a plain-text report inside 
 that mirrors exactly what’s visible.
- Adds a clear "Open SiteCheck in a new tab" link rendered outside the 
 block.
- Sensible cURL timeouts, redirect following, and a stable UA (GravityTools/SiteCheck-TLS 1.2).
- UTC Finished timestamp appended to the report.

v2.2.1 October 3, 2025
*WAF Settings* Platform
- removed.
*Node 502* Platform
- updated script to output the proper cluster for Singapore and Paris PoP.

v2.2.0 September 27, 2025
*WAF Settings* Platform
- beta.

v2.1.1 September 17, 2025
*Site Speed* Platform
- Fixed sticky header offset issues and the "floating down from the top" gap.
- Eliminated overlap with content below the table.
- Removed prior nested