Changelog
Notable changes to sandstack, newest first. Breaking API changes are called out in bold.
v0.7 — AI features, analytics, mobile, signup polish
June 20, 2026- Auto-extract API —
POST /sessions/:id/extracttakes a JSON schema, pulls the live page DOM + screenshot via CDP, calls Claude Sonnet 4.6 with strict structured outputs, returns parsed JSON + token usage. Runs on AWS Bedrock via theus.anthropic.*cross-region inference profile. - Live demo agent at /demo (currently paused via
DEMO_ENABLEDflag pending billing). Anonymous, rate-limited (1/IP/day, 90s cap), uses a custom tool loop (navigate, click, type_text, get_page_text, wait, finish) driven by Claude. Streams thoughts and actions over SSE while user watches in embedded noVNC. - AI usage tracking — every Bedrock call lands in
ai_usagewith input/output tokens and retail cents (2.5× markup on pass-through cost).GET /me/ai-usagereports month-to-date. - Admin analytics panel on /admin — total users, signups today/week, active sessions, AI spend MTD, demo runs, open tickets, top users by activity.
GET /admin/statsis the underlying endpoint. Today/week/month tabs. - PostHog integration — autocapture + pageviews on every page once
POSTHOG_PUBLIC_KEYis configured. Server-side captures forsignup_started,email_verified,session_created,session_deleted./configendpoint exposes public PostHog config to the client. Optional embedded shared dashboard on /admin. - Mobile-friendly throughout — auto-injected hamburger nav below 720px, dashboard / admin / support panels stack, long IDs and URLs wrap, touch targets ≥40px, iOS-zoom-proof inputs (font-size 16px), footer collapses 4 → 2 → 1 columns.
- Signup polish — optional name field, confirm-password with live mismatch indicator, show/hide eye toggle on both password fields, explicit Terms + Privacy acknowledgement. Login page also gets the eye toggle. Dashboard greets by name when set.
- "Compare providers" link in the new-session form opens in a new tab.
- Bedrock IAM scoped to
us.anthropic.*inference profiles + Marketplace subscription actions for model enrollment.
v0.6 — Support, admin, contact, pricing
June 20, 2026- Contact page at /contact — public form, message goes to support@sandstack.site.
- Logged-in support at /support — bug reports + general help. Tickets are scoped to your account and surface a thread you can follow.
- Admin dashboard at /admin for designated admins. Tickets inbox with filters, in-app reply box that emails the user, status toggling.
- Pricing page at /pricing — Free / Hobby / Pro / Team tiers; paid tiers on a waitlist while we wire up Stripe.
- Custom 404 page at /404 with a built-in site search.
- "Compare providers" link in the new-session form opens in a new tab.
- Admin role is env-driven (
ADMIN_EMAILSon the control plane) — no DB migration required.
v0.5 — Proxy providers page (affiliate model)
June 20, 2026- New public /proxies page comparing Bright Data, Decodo, Oxylabs, and IPRoyal with honest pricing and use-case notes.
- Affiliate redirects live at
/r/<provider>— single place to update partner links as we sign up for each program. - Dashboard's BYO field links to
/proxiesso users without a proxy yet can find one in one click. - Footer and homepage nav now surface the Proxies link.
- Removed the in-progress managed-proxy code (zone management,
/capabilities, managed-* proxy types). The BYO pipeline remains the single, well-tested path. Managed proxies may return later as a premium tier.
v0.4 — Reliability, history, BYO proxy
June 20, 2026- BYO proxy: pass
proxyUrlinPOST /sessions(or via the dashboard) to route Chrome egress through your own HTTP/HTTPS/SOCKS proxy. - Session history: closed sessions are archived with id, duration, and reason — surfaced in a "Recent sessions" panel on the dashboard. Containers are not replayable; metadata only.
- POST /sessions now blocks until the noVNC port is responsive, so the view URL works on first click (~2s).
- Defensive Docker network reattach after container start, to prevent the orphan-502 state.
- HTTP (port 80) opened;
http://andwww.auto-redirect tohttps://sandstack.site. - Email content rewritten with Reply-To and List-Unsubscribe headers for better inbox placement.
- Marketing pages now have a proper multi-column footer linking to Terms, Privacy, Security, Changelog, Status.
- Deploys now go through an S3 bundle, lifting the SSM 16KB inline-parameter limit.
v0.3 — Accounts and dashboard
June 19, 2026- Email + password authentication with verification flow. SMTP via Zoho.
- Per-user API keys; sessions are now scoped to the user who created them.
- Dashboard at
/appwith API-key reveal/copy and session list. - Cookie auth accepted alongside
X-API-Keyon/sessions. - Marketing pages:
/terms,/privacy,/security,/status,/changelog.
v0.2 — Live view and homepage
June 18, 2026- Replaced browserless with a custom Chromium + Xvfb + x11vnc + noVNC image.
- Live view per session at
{id}.sandstack.site/view/. - Python CDP proxy rewrites
webSocketDebuggerUrlso PlaywrightconnectOverCDPworks from outside. - Landing page with live session counter and animated terminal.
- Apex (
sandstack.site) andwwwnow resolve;www301s to apex.
v0.1 — Initial deploy
June 18, 2026- EC2 + Docker + Caddy stack provisioned in us-east-1.
- Wildcard
*.sandstack.siteTLS via Let's Encrypt DNS-01 on Route 53. - Control plane API:
POST/GET/DELETE /sessions, idle reaper. - SSM Session Manager for ops (no SSH exposed).