Deploy from CI, keep rollback history in the cloud, and see what your server can actually do.
New
System Health — Projects → System Health
Checks proc_open, PHP memory, free and total disk space, how much of it Code Builder is using, and every build tool with its version. Binaries are resolved against the web server's PATH, not your shell's — which is where "but node -v works when I SSH in" finally gets answered.
Deploy a pre-built archive from CI
POST /wp-json/code-builder/v1/deploy-artifact/{project-slug}
Build in GitHub Actions, post the zipped output. Needs no git, no Node and no proc_open, so it works on hosts that can't build at all. Send your CI log with it — gzipped or plain, detected automatically — and it shows up in the Logs tab. Same releases, rollback and access control as a git deploy.
Cloud storage for rollback history
AWS S3, Cloudflare R2, DigitalOcean Spaces, MinIO. Local disk keeps one hot-cache release — the one being served — and the rest live in the bucket. Visitors are never served from cloud storage, so an outage costs you old releases, never the site.
Web server file-send acceleration
X-Sendfile and X-Accel-Redirect hand the bytes to nginx or Apache and free the PHP worker. Off unless detected or configured; System Health prints the nginx block with your real paths filled in.
Sensitive flag on environment variables
Tick it for real secrets: masked on screen, stripped from build logs. Leave it off for ordinary config so you can still read the value. Names your bundler compiles into browser code (VITE_, NEXT_PUBLIC_, …) are flagged public, because no checkbox here can keep those out of your JavaScript.
Environment variables at runtime for PHP projects
PHP apps now get their variables when a visitor loads the page, not only during the build — via getenv()/$_ENV and a generated .env in the live directory. Rewritten on every deploy and rollback, never web-readable. Saving applies immediately; no redeploy needed to change a password.
Changed
⚠️ "Override Main Site" now replaces your WordPress front end.
Previously a URL with no matching file fell through to WordPress. It now returns the project's 404, so your pages and posts stop being reachable while the override is on.
wp-admin, login,wp-json, feeds and sitemaps are never taken over, so you can always switch it back off. An undeployed project takes over nothing. Nothing is deleted — unticking restores everything.
Build logs redact only variables marked Sensitive. Existing variables are all treated as sensitive on upgrade, so nothing is revealed and nothing changes until you untick some.
Cache headers now recognise Vite/Rollup hashes (index-BaR9xQ.css) alongside hex digests.
Fixed
- PHP 8 "Undefined variable
$file" warning on every 404 from a project route.
Upgrading
Plugins → Add New → Upload Plugin → Replace current with uploaded. Your projects, builds and settings are untouched — they live in wp-content/code-builder/ and the database.
If you run a PHP-runtime project with environment variables, redeploy once afterwards so the runtime .env is written.
Full Changelog: https://github.com/jeydweirdough/code-builder/commits/v1.1.0