Since upgrading from Laravel 8 to Laravel 13 on August 18, 2026, ToolsAPI has undergone extensive development across security, AI, automation, integrations, and administration. The list below is a “short” summary of what has happened since then.

This overview covers development through October 25, 2026.

Platform, Infrastructure and Security

• Upgraded from Laravel 8 to Laravel 13 and modernized PHP dependencies (a real nightmare that was solved in less than 16 hours).
• Raised the minimum PHP requirement to PHP 8.3.
• Updated framework dependencies and PHPUnit compatibility.
• Replaced obsolete Laravel packages and compatibility layers.
• Replaced Laravel Mix with direct Webpack 5 builds.
• Removed vulnerable and outdated frontend dependencies.
• Improved Composer and npm security auditing.
• Added stronger dependency checks before deployment.
• Hardened Laravel bootstrap and provider cache handling.
• Improved automatic cache recovery after deployments.
• Added Blade compilation and syntax validation.
• Improved runtime permission and ownership handling.
• Strengthened Git submodule recovery and synchronization.
• Added safer fallback handling for unavailable Git remotes.
• Improved deployment failure reporting to Slack.
• Added clearer runtime and platform version information.
• Expanded automated regression and integration testing.
• Improved validation of application health after deployment.
• Improved scheduled task monitoring and execution history.
• Added centralized service cadence administration.
• Improved administrator interfaces for scheduled jobs.
• Expanded structured audit logging and operational diagnostics.

Security, Privacy and Access Control

• Introduced Security Advisory Watch for vulnerability monitoring.
• Added scheduled CVE and security advisory searches.
• Added security findings, history, notifications, and RSS support.
• Improved security advisory administration and verification.
• Strengthened API token ownership and scope enforcement.
• Improved session and authentication handling.
• Added stronger protection for internal worker APIs.
• Improved validation of publicly accessible URLs.
• Expanded server-side request protection against unsafe destinations.
• Improved handling of browser and API authentication failures.
• Added safer operational error reporting to #toolsapi.
• Separated operational diagnostics from audit logging.
• Improved protection against credential exposure in diagnostics.
• Added user-controlled retention and deletion of personal data.
• Improved Cloudflare Turnstile credential handling.
• Strengthened verification requirements for sensitive operations.
• Improved handling of inactive and unverified user accounts.
• Expanded public documentation of data processing and subprocessors.

User Accounts, Appearance and Notifications

• Expanded /me as the central personal account workspace.
• Improved account, membership, and payment information.
• Reduced unnecessary loading of unrelated profile data.
• Introduced personal Light, Dark, and Forum Green theme preferences.
• Added customizable account colors and appearance settings.
• Added live previews of appearance changes.
• Introduced reusable personal appearance presets.
• Added administrator-managed global appearance presets.
• Improved automatic text contrast for customized themes.
• Introduced persistent notifications for individual users.
• Added notification read and dismissal states.
• Improved notification history and ordering.
• Expanded the administrator notification inbox.
• Improved account-specific notification access controls.
• Added shared notification infrastructure for multiple services.

AI Infrastructure, Payments and Credits

• Expanded the shared OpenAI integration infrastructure.
• Introduced Deep Research support for selected AI workflows.
• Improved reasoning-model compatibility and response handling.
• Added safer recovery from incomplete OpenAI responses.
• Improved AI model discovery and selection.
• Modernized model handling as older OpenAI models were retired.
• Introduced per-user AI usage and cost tracking.
• Added prepaid AI Credits and balance accounting.
• Introduced centralized AI funding and debit policies.
• Added safer credit reservations for simultaneous requests.
• Improved accounting for administrator-funded AI requests.
• Added a shared Shop wallet and transaction history.
• Introduced provider-independent PaymentFactory infrastructure.
• Added purchase reconciliation and duplicate-payment protection.
• Integrated Ko-fi payments with AI Credit funding.
• Added Ko-fi payment confirmations and purchase visibility.
• Introduced Google Play Billing verification for Android purchases.
• Added recovery and reversal handling for Google Play payments.
• Improved payment diagnostics, auditing, and administrator tools.

Web Search Alerts and Alert Engine

• Expanded Web Search Alerts with scheduled AI-powered searches.
• Developed Alert Engine as shared monitoring infrastructure.
• Added reusable search profiles, execution history, and notifications.
• Improved search-result relevance assessment.
• Added clearer relevance percentages.
• Improved handling of duplicate search results.
• Added automatic recovery for interrupted monitoring jobs.
• Improved protection against overlapping scheduler executions.
• Expanded email and SMS notification support.
• Added test notification actions for search profiles.
• Improved alert frequency and schedule configuration.
• Introduced centralized management of monitoring schedules.
• Improved provider response parsing and incomplete-result recovery.
• Expanded monitoring integration with other ToolsAPI services.

Fact Verify, SocialGPT and Reputation

• Expanded Fact Verify with deeper AI-assisted research.
• Improved source verification and citation handling.
• Added larger output budgets for complex fact-checking.
• Improved research follow-ups and translations.
• Added AJAX progress reporting for fact-checking operations.
• Integrated research mode into existing Fact Verify workflows.
• Improved recovery when AI responses are incomplete.
• Expanded SocialGPT fact-checking capabilities.
• Improved SocialGPT response validation and error handling.
• Developed the Reputation service for web resources.
• Added reputation targets for domains, URLs, posts, and public content.
• Introduced moderated community reputation reports.
• Separated community reports from authoritative reputation decisions.
• Added standalone Reputation APIs and administration.
• Improved ownership and privacy controls for SocialGPT data.
• Expanded Android authentication support for SocialGPT.

Job Search

• Expanded AI-assisted job discovery and relevance matching.
• Improved individual search profiles and ownership controls.
• Added profile-specific priorities, exclusions, and instructions.
• Expanded Swedish job discovery across multiple sources.
• Integrated structured Arbetsförmedlingen JobTech searches.
• Added support for personal and global job-search sources.
• Introduced global preferred-employer lists.
• Added configurable employer registries with filtering rules.
• Improved verification of individual job advertisements.
• Improved detection of expired or removed listings.
• Added automatic revalidation of saved advertisements.
• Improved validation of redirected and canonical job URLs.
• Strengthened protection against misleading or generic search results.
• Improved job-listing deduplication.
• Added AI assistance for refining search profiles.
• Introduced guided analysis of irrelevant job matches.
• Added better suggestions for negative search keywords.
• Improved AI-generated profile instructions and names.
• Added personal CV and cover-letter storage.
• Introduced structured professional experience and qualification records.
• Added Markdown CV editing and document previews.
• Improved PDF and DOCX document extraction.
• Introduced document-aware AI search assistance.
• Developed AI-assisted job application drafts.
• Added follow-up questions for missing application details.
• Added application review and test-email functionality.
• Improved application delivery verification.
• Added safer handling of uploaded application documents.
• Introduced compact job tables with sorting and filtering.
• Added expandable profile-specific result sections.
• Improved search execution reports and history.
• Added clearer administrator inspection of search profiles.
• Expanded live search progress and execution diagnostics.
• Added limited parallel execution of multiple search profiles.
• Improved protection of shared AI budgets during parallel searches.
• Introduced administrator-funded search capacity and credit exceptions.
• Expanded email and SMS notifications for new jobs.
• Added public profile sharing and syndicated results.
• Introduced native Android Job Search authentication and API support.
• Added secure Android handoff to the existing application workspace.
• Improved handling of provider failures and rate limits.

Whisper and Transcription

• Expanded Whisper into a distributed transcription platform.
• Added support for external CPU and GPU workers.
• Introduced authenticated worker job claiming.
• Added worker capabilities, leases, and heartbeats.
• Improved remote worker status and progress reporting.
• Added automatic worker discovery and registration.
• Introduced historical records for inactive workers.
• Improved recovery of interrupted transcription jobs.
• Expanded model selection and runtime diagnostics.
• Added re-transcription using different models.
• Introduced readable transcript revision history.
• Improved speaker diarization using pyannote.
• Added live progress reporting for speaker separation.
• Improved speaker identification and correction.
• Added media playback alongside transcript segments.
• Introduced grouped speaker-turn displays.
• Expanded transcript editing and annotations.
• Improved AI analysis and follow-up questions.
• Added transcription and analysis recovery mechanisms.
• Introduced guest transcription with verification controls.
• Expanded public transcript sharing.
• Added public comments and visitor-specific AI interactions.
• Improved transcript privacy and access restrictions.
• Added original audio and video playback to public shares.
• Improved handling of URL-based media sources.
• Added better upload progress and duplicate-file detection.
• Improved recovery from interrupted media uploads.
• Reduced database session and worker lock contention.
• Improved retry handling for temporary database failures.
• Expanded diagnostic information for failed jobs.
• Improved worker and transcript administration.

Browserbot, Botstudio and Facebook

• Expanded browser automation using Playwright.
• Developed more reliable Browser Social workflows.
• Improved Facebook Page and group identity verification.
• Strengthened protection against posting from incorrect accounts.
• Added automatic scheduled Facebook feed publishing.
• Introduced curated article selection and publishing queues.
• Improved RSS-based article discovery for social publishing.
• Added category-aware feed selection.
• Expanded article preview and publishing history.
• Improved detection of article paywalls.
• Added read-only verification of uncertain Facebook submissions.
• Improved recovery after interrupted publishing attempts.
• Strengthened duplicate-publication protection.
• Added progress reporting for browser operations.
• Improved detection of Facebook comment and reply fields.
• Expanded handling of Facebook notifications and mentions.
• Introduced scheduled notification processing.
• Improved AI replies to direct questions in social discussions.
• Added automated follow-up checks of previous interactions.
• Improved browser diagnostics and failure reporting.

X Bot and Social Automation

• Expanded the public X conversation archive.
• Added threaded conversation trees and navigation.
• Improved recovery of incomplete X conversation histories.
• Strengthened reply-context verification before AI generation.
• Improved detection of mentions within posts.
• Added administrator-controlled forced reply generation.
• Improved handling of manually retried conversations.
• Expanded support for referenced images in quoted posts.
• Improved separation of human questions and AI-generated conversations.
• Strengthened prevention of automated reply loops.
• Improved scheduled X posting diagnostics.

Image Generator and Media

• Expanded OpenAI image generation and editing.
• Added support for multiple reference images.
• Introduced additional output formats and aspect ratios.
• Expanded image archives and publication controls.
• Added private, unlisted, and public image visibility settings.
• Introduced automatic publication preferences.
• Improved image publication management with AJAX.
• Added support for GPT Image 2.5 Sunburst and Flare.
• Expanded image quality and transparency options.
• Improved image generation retry handling.
• Added better prompt history and provenance information.
• Improved visibility of automatically adjusted prompts.
• Introduced concurrent image generation jobs.
• Added notifications for completed image generations.
• Developed Quick Generator for social media cover images.
• Added page-specific image generation and context extraction.
• Introduced image history and reuse for Quick Generator.
• Added global fallback images for social sharing.
• Improved social media metadata and image previews.
• Expanded reusable image generation targets.

Slack and Communication

• Developed an installable Slack AI Bot.
• Added Slack workspace OAuth installation.
• Introduced multi-workspace bot configuration.
• Added support for direct messages and threaded conversations.
• Expanded AI-powered replies and web-search integration.
• Improved Slack event handling and polling fallback.
• Added configurable channel and workspace behavior.
• Introduced faster polling of known conversations.
• Added processing acknowledgements for incoming messages.
• Improved Slack image generation and delivery.
• Added conversational image retries and model selection.
• Expanded Slack error diagnostics and delivery verification.
• Improved log-routing configuration and severity thresholds.
• Added safer handling of Slack installation and authentication failures.

SMS, Email and Spam Protection

• Expanded the central SMS service.
• Improved incoming SMS storage and deduplication.
• Added automatic processing of incoming messages.
• Introduced conversational AI responses to SMS.
• Added manual handling of previously received SMS.
• Improved SMS delivery and queue progress reporting.
• Added account-wide mobile number verification.
• Improved SMS callback and device identification handling.
• Expanded Mail Support Assistant synchronization.
• Improved recovery from temporary mail database locks.
• Introduced clearer retry responses for synchronization failures.
• Expanded SpamAssassin integration and testing.
• Improved SpamAssassin response handling and timeout detection.
• Added personal mail and SpamAssassin configuration pages.

DNS, DNSBL and Infrastructure

• Expanded DNSBL proxy and Tor exit detection.
• Improved verification of real proxy connectivity.
• Introduced more detailed proxy metadata.
• Added safer lifecycle handling of removed proxies.
• Improved synchronization with Tor Project exit information.
• Added structured DNSBL and FraudBL classifications.
• Expanded DNSBL request statistics and diagnostics.
• Improved DNSBL integration with Online Users.
• Added shared DNSBL resolver caching and failover.
• Expanded DNS administration and zone management.
• Added DNSSEC management for BIND zones.
• Improved DNSSEC key and DS record handling.
• Improved DNS zone validation and rollback procedures.
• Expanded Dynamic DNS administration.
• Improved infrastructure and network inventory documentation.
• Expanded certificate administration and monitoring.
• Improved Let’s Encrypt certificate renewal detection.
• Added local reconciliation of renewed certificates.
• Improved certificate ownership and renewal notifications.
• Expanded geographic and network information using MaxMind.

Statuspage and System Monitoring

• Expanded Statuspage with historical service availability.
• Introduced daily uptime history and availability metrics.
• Improved component and incident administration.
• Added automatic status updates from operational errors.
• Improved recovery detection following successful deployments.
• Reduced incorrect or persistent degraded states.
• Improved synchronization between incidents and component status.
• Added clearer administrative status controls.
• Improved dark-mode readability and visual contrast.
• Expanded administrator monitoring and diagnostic views.

Additional Services and Integrations

• Expanded Guestbook into a hosted multi-book platform.
• Added legacy guestbook imports and historical archives.
• Introduced Guestbook APIs and external embedding.
• Added WordPress-oriented Guestbook integration support.
• Developed Votech with public, personal, and administrative workspaces.
• Added Votech polls, projects, communities, and candidate management.
• Expanded Votech identity and participation controls.
• Improved Votech media management.
• Developed Transit Planner with schedule-image analysis.
• Added Skånetrafiken station and route lookup.
• Improved timetable interpretation and travel planning.
• Introduced shorter Transit Planner sharing links.
• Added saved planning preferences and automatic link expiration.
• Developed a public Suggestions and Feedback service.
• Added service-specific feedback categories.
• Introduced GitHub issue lookup and linking for suggestions.
• Improved feedback moderation and administration.
• Expanded Recipes with recipe editing and dietary preferences.
• Added optional AI assistance for recipes.
• Introduced recipe publication controls and To Do integration.
• Started Tools Score for activities, routines, and progress tracking.
• Added configurable allowance tracking in Tools Score.
• Expanded personal and family functionality in Menstrual Tracking.
• Improved Menstrual Tracking history and SMS reminders.
• Improved RSS Watch article management and history cleanup.
• Added magazine-style RSS browsing.
• Expanded StorageAPI and legacy archive management.
• Improved the shared Services directory.
• Introduced searchable services and personalized pinned shortcuts.
• Expanded Android support across several ToolsAPI services.

Latest Fixes – October 19-25, 2026

• Reduced repeated Whisper missing-job error alerts.
• Improved Whisper worker claim locking and retry behavior.
• Added automatic discovery of connected Whisper workers.
• Preserved historical records of inactive Whisper workers.
• Added original recordings to public Whisper transcript shares.
• Fixed public video playback when MIME metadata is missing.
• Added clearer duplicate-upload warnings and existing-job links.
• Improved local Let’s Encrypt certificate renewal reconciliation.
• Fixed SpamAssassin response completion and timeout diagnostics.

Just Because We Can. 🍳

Sometimes we build things for fun. Sometimes because we actually need them.

The latest addition to ToolsAPI is an AI-powered recipe service, originally created to help our family adapt meals to different dietary needs, especially for the kids.

Why settle for standard recipes when you can tailor them to what you actually need?

Low-carb, high-protein, less sugar, specific ingredient requirements, batch cooking, or simply something quick for dinner.

The AI can research existing recipes and adapt them, or create something entirely new in WILD mode. Suggestions go through a second AI review, with shopping lists and estimated nutritional information included.

And if we’re building it for ourselves anyway, why not share it?

We may never be as good as ICA or Mathem at providing recipes. But damn, we’re going to get good at adapting them!

Still under development, but open for everyone to try.

https://tools.tornevall.net/recipes

ToolsAPI Score grew out of a simple frustration: everyday routines and agreements were not working, even though expectations had already been made clear.

I tried conversations, compromises, schedules, reminders, accommodations, and external support. Yet the same discussions kept returning, and the responsibility for getting things done often ended up with me.

Eventually, I realized something needed to change.

I cannot keep shielding a 16-year-old from everyday responsibilities by constantly repeating reminders or taking over tasks she is capable of managing herself.

That does not mean removing support or understanding. Expectations must remain reasonable, individual needs must be respected, and independence needs room to develop. But responsibility for completing an agreed task also needs to rest with the person expected to carry it out.

From Points System to Everyday Tool

My original idea was a simple points system for recording activities and tracking what had actually been completed.

Through discussions with Jessica, it evolved into something more practical: a system for routines, activities, documentation, and approval of completed days.

Score makes it possible to:

• Create activities adapted to different types of days.
• Record completed tasks, counts, and points.
• Track whether the day’s agreed responsibilities are finished.
• Manage voluntary rewards and financial agreements.
• Share progress and summaries with authorized people.

Essential care and statutory entitlements are, of course, not something that should have to be earned through points.

Less Nagging, More Independence

The idea is not for technology to replace parenting, relationships, or human support.

It is meant to reduce the need for constant reminders and arguments about what has actually been done.

When expectations and outcomes are documented, everyone can work from the same information. The person completing the tasks can track their own progress, while the person responsible for following up no longer has to keep everything in their head.

The goal of ToolsAPI Score is not more control. It is clearer responsibility, less conflict, and greater independence – with support where it is needed.

Job Search has continued to evolve, but the latest work has also exposed an old assumption that no longer belongs in the service.

One of the AI-assisted configuration functions was still checking whether the user had been granted a separate, generic OpenAI permission before it would run. That does not fit how Job Search is supposed to work. If a user has access to Job Search, the AI features belonging to Job Search should be handled by the service itself rather than requiring another unrelated permission on the account.

That legacy check has now been removed from the Job Search AI helpers.

This applies to functionality such as:

• AI-assisted job-search instruction suggestions
• suggested profile names
• negative keyword suggestions
• CV analysis and related professional-background helpers

The important part is that Job Search can now treat these features as part of Job Search itself instead of leaking an internal OpenAI access model into the user experience.

Better instructions, not just more keywords

The next step is less about adding another search field and more about making the search profile itself smarter.

A Job Search profile already contains quite a lot of information: keywords, locations, exclusions, relevance rules, instructions, previous searches and, where available, CV and application material.

The longer-term goal is to make better use of that information.

Instead of only asking the user to manually write more instructions, Tools should be able to analyse the existing profile and start a useful conversation around it.

For example:

What would you like the search to focus on more?

Are there types of jobs you keep seeing that are not useful?

Are we missing roles that would make sense based on your experience?

Should the search be broader in some areas and stricter in others?

That would make Job Search less of a static configuration form and more of an assistant that can help refine the search over time.

Learning from previous searches

Another part of that idea is to analyse what the searches have actually produced.

If a profile repeatedly returns jobs that are dismissed, poorly matched or clearly outside the user’s intentions, that should be useful information.

Likewise, if relevant jobs repeatedly appear under titles or technologies that were not originally included in the profile, Tools should be able to point that out.

The aim is not to silently rewrite someone’s search profile.

Instead, Job Search should be able to explain what it sees and suggest improvements that the user can review and approve.

That could eventually mean suggestions such as:

• broaden a role family that appears to produce good matches
• add a missing synonym or adjacent job title
• tighten an exclusion that repeatedly produces noise
• reconsider a geographical restriction
• distinguish between a hard requirement and something that is merely preferred
• identify skills in the CV that are not currently reflected in the search profile

Much better AI-generated instructions

The instruction field is also becoming increasingly important.

Short keyword-style AI suggestions are not enough for more advanced profiles. A useful instruction should be able to describe priorities, trade-offs, geography, role families, technical interests, exclusions and acceptable adjacent opportunities in a way that the search engine can actually work with.

The intention is therefore to make AI-generated instruction suggestions longer, more detailed and more useful as complete search strategies.

Rather than producing three slightly different versions of the same sentence, the suggestions should be able to represent genuinely different approaches, for example:

• a focused strategy based closely on the current profile
• a broader strategy that includes realistic adjacent roles
• an exploratory strategy that looks for opportunities the current configuration may be missing

The user’s own CV and other saved Job Search material can also become important evidence here, so the system can suggest broader searches without inventing experience that is not actually there.

Instruction history and undo

As the instructions become more advanced, simply overwriting the old version is not good enough.

A planned improvement is therefore to keep a history of instruction changes.

That would make it possible to see how a search profile has evolved, compare an older version with the current one and restore a previous version if a change turns out to make the search worse.

This is particularly important if Tools starts helping users refine their profiles over a longer period. Improvements should be reversible.

From configuration to ongoing refinement

The broader vision is that Job Search should not stop being useful once the initial profile has been created.

Creating the profile should only be the beginning.

Over time, Tools should be able to use the profile, previous searches and the user’s own feedback to help answer questions such as:

• What are we missing?
• What are we searching too narrowly for?
• What keeps generating bad matches?
• Which parts of the profile are actually working?
• Are there realistic roles that the current search never considers?
• Has the user’s focus changed since the profile was first created?

The user should remain in control of every meaningful change, but Tools can do a much better job of helping them understand and improve the search.

That is the direction I want Job Search to move in next: not simply more automated searching, but a search profile that can be reviewed, challenged, refined and improved together with the person using it.

Turn school timetable screenshots into a complete weekly Skånetrafiken travel plan, including travel margins, route preferences, alternatives and shareable results.

https://tools.tornevall.net/transit-planner

---

Planning a school week around public transport is easy until every weekday starts and ends at a different time. Transit Planner is a new service in Tornevall Tools designed to turn a weekly schedule into a practical travel plan using Skånetrafiken.

Instead of manually checking journeys for every school day, Transit Planner combines the timetable with public transport data and builds a weekly overview.

From a screenshot to a weekly travel plan

A school schedule can be uploaded as one or several screenshots. The images are analysed together using OpenAI vision, allowing overlapping screenshots to be combined into one week.

The service reads the actual timed lessons for each day and produces a simple schedule:

date,start,end
2026-09-28,10:00,14:45
2026-09-29,09:50,16:00
2026-09-30,09:40,14:05

The generated times remain editable before the journey search starts.

Skånetrafiken journey planning

Transit Planner then communicates with Skånetrafiken and searches for suitable journeys for every school day.

The planner takes into account:

• the first lesson of the day
• the final lesson of the day
• a configurable travel margin
• both the journey to school and the journey home
• preferred bus or train lines
• alternative journeys when several useful options exist

The same safety margin can be used in both directions.

The normal return journey is automatically based on the reverse of the morning route. If the journey home starts or ends somewhere else, a separate after-school route can be enabled.

Choose how you actually travel

Not every technically possible journey is equally useful.

Transit Planner can prefer specific services, such as a particular city bus, while still keeping other valid alternatives available. The selected journey also shows which train, regional bus or city bus is involved.

Additional journeys stay hidden until they are needed, keeping the weekly overview readable.

Searchable locations

Origin and destination fields use live searchable locations instead of requiring exact stop IDs or coordinates.

This makes it possible to search for places such as:

Klippan station
Studievägen 2, Helsingborg

without knowing how Skånetrafiken internally identifies the location.

Share the finished plan

A completed weekly plan can be given its own shareable URL.

The shared view can restore the timetable, route configuration and journey results. Uploaded timetable screenshots can also be retained with the plan, making it possible to compare the generated journeys with the original schedule later.

Built for actual weekly use

Transit Planner is intended for situations where “just check the journey planner” becomes repetitive.

A changing school timetable is an obvious example, but the same approach can also be useful for recurring work schedules, courses and other weekly activities where departure and arrival requirements change from day to day.

Transit Planner is part of Tornevall Tools and is still being actively improved as real-world schedules and Skånetrafiken data expose new edge cases.

We have completed a set of server-side fixes for the Tornevall Networks DNSBL integration after identifying authentication and reliability problems affecting existing clients, including the currently released WordPress integration.

Existing WordPress installations remain supported

One of the most important requirements was that existing installations must continue working without forcing users to upgrade their plugin just because the server-side authentication model has evolved.

ToolsAPI therefore continues to recognize the authentication method used by released DNSBL clients. Existing DNSBL API keys remain valid through the legacy-compatible authentication path, while the newer DNSBL token model continues to work alongside it.

No API key rotation or WordPress plugin update should be required solely because of these changes.

Internal retries no longer lose authentication

We also found a separate problem in the DNSBL reliability system.

Failed DNSBL mutations can be buffered and retried internally. Those retries were executed inside an authorized server process, but the replayed request itself did not contain authentication in a form understood by the API controller.

The result could be misleading errors such as:

401 unauthenticated

even though the original operation had been properly authenticated.

The retry mechanism now carries a strictly internal, runtime-only authorization marker. It is accepted only while the trusted retry process is executing and cannot be reused as an external API credential.

Better handling of temporary DNS socket failures

Another source of failures was transient UDP socket conditions during direct DNS updates, particularly:

Resource temporarily unavailable

These conditions can occur while waiting for a DNS server response and do not necessarily mean that the DNS update itself is invalid.

The DNS update layer now recognizes transient conditions such as EAGAIN, EWOULDBLOCK and interrupted socket reads and performs bounded retries before treating the operation as failed.

Real DNS errors, authentication failures and TSIG errors are still reported normally.

Additional reliability improvements

The same operational review also uncovered a few related problems in ToolsAPI.

Transit Planner image uploads were too aggressively rate-limited for the intended multi-screenshot workflow. The upload limits have been adjusted while keeping abuse protection in place.

Deploy health reporting was also made page-wide instead of depending on a specific Statuspage component name, making recovery reporting more robust if components are renamed or reorganized.

What this means for users

For users of Tornevall Networks DNSBL integrations:

• Existing released WordPress clients remain supported.
• Existing DNSBL API keys continue to work.
• Internal retry operations no longer fail simply because authentication context was lost.
• Temporary DNS socket conditions receive bounded retries instead of immediately generating a server error.
• Missing or genuinely invalid credentials still fail normally.
• No new versioned API endpoint has been introduced.

The fixes were implemented in ToolsAPI and merged on September 27, 2026.

If you recently encountered unexpected 401 responses while adding or removing DNSBL records, or intermittent DNS update failures, the problem may have been related to the server-side issues addressed by this update.

Last week was hilariously busy.

On Sunday I was planning to write something reasonably detailed about the week that had just passed. The problem was that Sunday eventually turned into “still working on things from the week that just passed”, so I never really got there.

I have therefore decided to do what every responsible developer does when the documentation backlog becomes too large: make the documentation shorter. This is roughly what happened.

It started with a terrible Laravel idea

ToolsAPI was still running Laravel 8, which had been out of security support for quite some time. The sensible upgrade advice is to move through the major versions one at a time, dealing with package compatibility, framework changes, middleware, routing, PHPUnit and whatever else Laravel decided to move around between releases.

So naturally I upgraded directly from Laravel 8 to Laravel 13 because I didn’t care about the warnings. Instead, I trusted Copilot, I had very little time, and apparently this is how decisions are made now. It went almost well. At late evening, at 22, I was acutally passing thought last hell of caches. After that point it actually worked surprisingly well. Yes, production found some ancient cached Laravel state and briefly reminded me that software can remember things long after everyone involved would prefer it didn’t. But if just drop that little issue, everything was up again. Leaving copilot alone for 16 hours with destructive methods isn’t a very clever idea, so that was the first ruleset I had to add: DO NOT RUN DESTRUCTIVE CALLS IN PRODUCTION!

Because I did it in production…

What really happened

ToolsAPI – Laravel 13

The whole platform moved from Laravel 8 to Laravel 13, old compatibility baggage was removed, dependencies were modernized and Laravel Mix was replaced with Webpack 5. Production celebrated by throwing HTTP 500 errors because stale cache survived the upgrade, so deployment checks and cache handling were subsequently taught some manners.

GitHub Actions – “But did it actually work?”

The development flow became much more aggressively issue -> branch -> code -> test -> PR -> CI -> fix what exploded -> merge. Several integrations now perform real provider checks instead of receiving a participation trophy because a mock returned 200 OK. Problem is that I got some dumb integrity checks inside that system that practically ate my budget.

Error reporting – Fail loudly, please

Browser errors, API failures, workers, schedulers and other operational disasters can now report directly to #toolsapi, independently of ordinary audit settings. This has already proven useful because apparently software defects become much easier to fix once they stop hiding. Slack and massive Codex integrations really works nice! All errors are shown quickly and ChatGPT can read from those errors and fix them instantly!

Slack AI Bot – It has escaped into Slack

The Slack bot learned DMs, mentions, active thread continuation, images, multiple workspaces and a polling fallback for situations where Slack Events decides not to be particularly eventful. Public distribution also forced the polling logic to become considerably less enthusiastic about calling Slack’s API every ten seconds.

This wasn’t really planned, but since I was curious on other things, this is where I ended up.

Alert Engine – Scheduling things without creating a time paradox

A shared Alert Engine now handles recurring monitoring, runs, results, deduplication, notifications and history instead of every service inventing its own cron-shaped wheel. Real scheduler traffic immediately found stuck runs and overlaps, so locking, stale-run recovery and overlap protection were added before the scheduler could successfully fight itself.

Web Search Alerts – Google Alerts after drinking OpenAI

Web Search Alerts became considerably more serious: real OpenAI web search, source recovery, verification, deduplication, notifications, run history and better diagnostics. It also learned how to survive malformed output, incomplete provider responses and HTTP 403 results, because the Internet remains committed to being the Internet.

Job Search – Teaching AI what I don’t want

Job Search gained live progress, better search diagnostics, Alert Engine integration and profile-specific negative keywords. AI may suggest that “truck driver” is perhaps not the ideal result for a developer profile, but it still has to ask permission before permanently learning from its mistake.

Whisper – Please transcribe this somewhere else

Whisper gained multi-file uploads, better transfer progress, transcript-based titles and the ability to run speaker diarization after transcription. More importantly, transcription can now be handed to remote CPU/GPU workers using leases, heartbeats, progress reporting and capability negotiation, allowing the web server to concentrate on its traditional responsibility of having entirely different problems.

With that said, this is IF you have a GPU to run with. I really don’t. Besides, I’m trying to run with Diarization again.

Guestbook – Somehow this became a platform

What started as “let’s preserve some old guestbook data” turned into multiple owned guestbooks, imports, APIs, embeds, moderation and external client support. Public DNSBL badges were replaced with country flags, because publicly branding every visitor with internal abuse metadata turned out to be slightly more information than a guestbook actually needs.

WordPress – Tools has plugins now

The WordPress integration grew into a real Tools client with Guestbook support, direct Tools account pairing, DNSBL credential handling and proper Plugin Check coverage. The separate DNSBL plugin also started moving deeper into WooCommerce and fraud/event handling, because apparently DNS blacklists also needed a career change.

Security Advisory Watch – Because upgrading Laravel wasn’t enough security work

Products and technologies can now be monitored for advisories, CVEs and related security changes using the same search and notification foundations. It also gained dedicated GUI and regression coverage after discovering the classic enterprise security vulnerability known as “the form looks like shit”.

Security Probe Guard – The guard dog bit the owner

Automatic exploit-probe detection and temporary bans were added. Then an automatic ban managed to lock out the operator, which led to recovery routes, fail-open handling for old automatic bans and the revolutionary security concept of “maybe don’t automatically ban the administrator”.

SoundCloud – Zero is also a number

SoundCloud received OAuth reauthorization, chart fixes and several profile-insight repairs after real data demonstrated that a confidence value of 0 is perfectly valid and does not necessarily mean “the application should crash now”. This is why production data gets a vote.

SocialGPT / Facebook – Controlled chaos laboratory

SocialGPT gained for a long time ago a sidepanel instead of popup based requests. We haven’t realeased this extension for a while, so nobody knows about this yet.

Services – We have enough of them to need categories

/services was reorganized into actual categories because the previous architecture was rapidly approaching “here is a large wall of links, good luck”. A green forum-inspired theme called “Jessica” also appeared during all this, because clearly visual consistency was the urgent missing ingredient.

---

What is happening now?

Android Tools – SocialGPT leaves the browser

The Android app is gaining proper context capture, AI context cleanup, full context review, privacy-safe statistics, push notifications and the required Android/Google Play consent flows. The current objective appears to be turning “select some text and ask Tools” into “Tools is just there when I need it”, without turning the phone into spyware in the process.

Web Search Alerts – Apparently not finished being useful

Results are getting source exclusions, rejected-result inspection and restoration, searchable delegation, ownership transfers, location context and better source recovery through the shared SearchFactory. What used to be “search for this occasionally” is steadily becoming a small monitoring system with opinions.

Guestbook – Still refusing to remain a guestbook

Embed routing has been repaired after web servers managed to return a 404 status together with perfectly valid JavaScript, which is an impressively confusing achievement. Autosaved settings, ownership transfer, notifications, better pagination and visible service versioning are also being added around it.

Statuspage – Yes, another platform

Tools is getting its own proper Statuspage foundation with public status pages, components, incidents, owner management, administration and a public read API. The WordPress integration is already growing a Statuspage block, because displaying whether Tools is broken should ideally continue working even when Tools is broken.

Votech – BBVote’s successor is waking up

Votech now has its proper architecture and dedicated database/model foundation, with the old BBVote data treated as historical input rather than something we should continue poking with sticks. The GUI, voting flows, administration and integrations come next. And no, the API will not suddenly grow /v1/, /v2/ and seventeen generations of archaeological sediment.

We have an election running in a few weeks. I was thinking of making a BBVote clone – PoliticalVote. Or something like that.

SocialGPT – Again – Context, but only after consent

A consent-gated context-analysis endpoint is being built so SocialGPT can correlate page content, selected text and bounded browser observations without silently shipping everything it sees somewhere else. The extension is simultaneously learning more generic DOM/XHR correlation, which sounds innocent until you remember what modern websites look like internally.

AI accounting / Ko-fi – Computers have discovered money

AI usage accounting is being connected to users, providers, token consumption and eventually prepaid credit. Ko-fi is part of the payment direction, because once AI starts consuming measurable amounts of money it becomes surprisingly important to know whose money it is consuming.

The reason for why I do this is actually, if I release an android app into Google Play Store, I don’t want to pay for other peoples AI usage. So this is going to get real. And I probably need to register myself as a firm or something very soon now.

Tools versioning – The footer now knows what it is

The main Tools platform is finally getting an explicit semantic version that everybody can see, while administrators still get the extra Laravel/PHP diagnostic information. Considering how much changed before the platform got a visible 1.0.0, this is possibly the most backwards software-release story in the entire list.

Image generation and file storage

This is also a concept that I’m working with right now. Image generation should be a platform-global feature, to make sure BBVote/Votech and other stuff can get hold of a very nice AI feature. Also storing those files somewhere, is a plan for which Filestorage could be perfect.

… and possibly some MCP services. Who knows?

---

This is a very short list actually. The more I think, the more crap I produce and I throw it at tools. If you have any suggestions, please feel free to contact med. The platform already features a lot more than I just presented, since this is only the NEW stuff coming up. Oh, did I mention a suggestion box? That’s also in the agenda…

We are building a centralized connector framework for Tools. The goal is simple: make integrations reusable, secure and easier to extend. Instead of every service having its own custom integration, Tools will provide a common framework where connectors can be added and managed consistently.

The first AI connectors will be:

• OpenAI Connector (Present)
• Microsoft Connector (Entra / Copilot, hopefully upcoming)

Future connectors will expand into areas such as…

• Social platforms
• Messaging services
• External APIs
• Enterprise integrations

Each connector will have a standardized way of handling…

• Authentication
• Permissions
• Configuration
• Logging
• API access

The foundation will support both internal services and user-owned integrations, where users can connect their own accounts and manage their own permissions.

The goal is to create an IFTTT-like integration layer, but built around something else where we keep expensive services separated from things that can be offered for free, AI services and enterprise authentication.

ToolsAPI is currently undergoing one of its larger platform upgrades.

The project has been running on Laravel 8 for several years. That version has long since reached the end of its official support lifecycle, while Laravel itself has continued through several major generations.

We’re therefore moving ToolsAPI directly from Laravel 8 to Laravel 13, the current generation of the framework.

This is significantly more than a version number change. The work includes updating and replacing dependencies, modernizing older application code, adjusting integrations, improving compatibility with current PHP versions and rebuilding parts of the test suite around the newer framework.

Security maintenance is naturally part of this work as well. Moving back onto a currently supported framework gives ToolsAPI access to ongoing upstream maintenance and security updates instead of relying on an obsolete framework generation.

The migration is being performed and tested in stages before it reaches the production environment. Existing ToolsAPI services are expected to remain available while that work continues.

Tools now has a working image-generation feature that is already in use and confirmed through the X-bot flow. It can generate images directly in Tools and store them in the project’s image archive for reuse in later workflows.

This is a practical feature for quick visual drafts, concept images, and supporting material without leaving the Tools environment.

Real use, not only a preview

The feature is not just a test setup. It is live and working in the current Tools setup, with generated images handled as background jobs so the request does not block the rest of the work.

That makes the feature useful both for normal web/API use and for X-bot-driven flows where an image is part of the response or follow-up content.

Easier to reuse and keep track of

Generated images can be saved in the built-in image archive and reused later, which helps when a concept or draft needs to be refined or referenced again. This makes the feature more useful than a one-off generation request.

Fair usage and responsible availability

AI image generation has a real cost per request. Access is therefore still managed with sensible limits and abuse protection so the service remains available for real users instead of being consumed by a single heavy script or workflow.

Support the project

Tools is kept available as a public service, but servers and AI usage still cost money. If you want to help keep the more expensive features running, donations and recurring support are very welcome.

Support the project through Ko-fi:

https://ko-fi.com/tornevall