toga-ai 1.0.1139 → 1.0.1140

package/knowledge/1.0/apps/test/workflows/retiring-unused-legacy-elastic-beanstalk-environments.md

@@ -15,6 +15,7 @@ related:
   - ../../togaview/workflows/route53-cross-account-zone-migration.md
   - ../../../../2.0/apps/worker2/features/alb-target-group-auto-registration.md
   - ../../../../2.0/apps/api2/workflows/codepipeline-codeconnections-deploy.md
+  - ../../vision/workflows/deploy-to-elastic-beanstalk-al2023.md
 ---
 
 Runbook to prove an EB env in legacy account 502614707982 (us-west-2) is unused (DNS in two accounts + external, shared-ALB rules, CodePipeline) and tear it down in safe order; also the legacy cost picture, what was retired (TRUE-82821, TRUE-82983, TRUE-83123), and open cost follow-ups.
@@ -54,7 +55,7 @@ Use when cutting the legacy AWS bill or cleaning old envs. An env is **used** on
 - **Claude auto mode blocks destructive AWS deletes** even with `Bash(*)`. Allow rules in `settings.local.json` (`Bash(aws codepipeline:*)`, `Bash(aws elasticbeanstalk:*)`, `Bash(aws elbv2:*)`, `Bash(aws route53:*)`) unblock most. Still blocked (TRUE-83123): EB terminate / TG delete loops when names come from a file (list names inline in the command instead); ALL Route 53 record changes (developer runs them); writing a delete script file. `delete-load-balancer` was blocked in TRUE-82821, worked in TRUE-83123. The `start-gate` hook blocks Claude from editing `settings*.json`; the developer edits it.
 - **PowerShell `Del` is a built-in alias** of `Remove-Item` and beats a user function of that name — never name a helper `Del`/`rm`/`ls` etc. Multi-line PS commands pasted to the developer get joined — give one-liners with `;` between statements.
 - **`--output text` with multi-column queries breaks shell `read`** when a column has spaces (EB app `Landing Pages`) — query per env instead.
-- **Externally referenced envs look dead from AWS.** `agilant-vision-prod` (`vision.asisystem.com`) has no Route 53 record but is live (`asi-api-prod` / `api.asisystem.com` was the same until retired).
+- **Externally referenced envs look dead from AWS.** `agilant-vision-prod` (`vision.asisystem.com`, DNS in DNS Made Easy) had no Route 53 record but was live (`asi-api-prod` / `api.asisystem.com` was the same until retired).
 - **Target-group delete right after the ALB delete fails with `ResourceInUse`** for ~1 min — retry.
 - **Claude auto mode also blocks CodePipeline writes** (delete or edit) — the developer does them.
 
@@ -84,6 +85,7 @@ Legacy EB is now down to **only `agilant-worker`** (1.0 worker).
 - **Load balancers:** `SalesAdvisor`, `TestSharedLoadBalancer` deleted. Only the `AWSTransferFamily` NLB left (AS2 SFTP for agilant-as2 — keep). 41 unattached target groups deleted.
 - **DNS:** 50 Route 53 records removed across both accounts (agilantsolutions.com, truesolutions.com, truenetworksolutions.com, togacommerce.com, togatech.com, togahub.com incl. compass/nychh/spglobal/canon.api + apidoa, togaview.com walmart* hotfix/sprint/stage/ui). Outside DNS Made Easy: vision + visionbeta.asisystem.com removed by developer.
 - RDS out of scope (follow-up 2).
+- **Vision revived after (TRUE-83056):** `vision.asisystem.com` now runs on `togatech-legacy-vision-production` (prod account, us-east-1) — [Vision deploy](../../vision/workflows/deploy-to-elastic-beanstalk-al2023.md). `punchout-togacommerce-production` stays retired (no punchout needed).
 
 ## Retired 2026-10-22 (TRUE-83055 — moved, not unused)
 
@@ -100,6 +102,7 @@ Legacy EB is now down to **only `agilant-worker`** (1.0 worker).
 Closed: Bedrock spend rise = LLM-jacking with the leaked static key 2026-10-09..12, stopped at key deletion (TRUE-82705) — [playbook gotchas](./responding-to-a-php-security-release.md#gotchas).
 
 ## Change history
+- 2026-10-23 — Vision revived in the prod account after TRUE-83123 retirement; link to its deploy doc (TRUE-83056) (jcardinal)
 - 2026-10-23 — TRUE-83123 final legacy EB/pipeline/LB/TG teardown (jcardinal)
 - 2026-10-22 — TRUE-82983 teardown (8 envs, beta DNS, `true-alb-beta`); pre-terminate template + stack check, outside-DNS-first, TG `ResourceInUse` retry; Bedrock follow-up closed (jcardinal)
 - 2026-10-22 — Legacy prod envs + pipelines of the 5 1.0 web apps retired after the move to toga-prod; backup templates kept (TRUE-83055) (rgirish)

package/knowledge/1.0/apps/tools/workflows/deploy-to-elastic-beanstalk-al2023.md

@@ -6,7 +6,7 @@ project: Tools
 client: shared
 type: workflow
 status: active
-updated: 2026-10-22
+updated: 2026-10-23
 owners: [jcardinal, bala, rgirish]
 files:
   - tools/.ebextensions/004_http_to_https.config
@@ -66,12 +66,12 @@ Native PECL extensions are installed by `.platform/hooks/prebuild/*.sh` scripts,
 - **The package is `php8.5-pecl-redis6`** (phpredis major-version suffix `6`), **not** `php8.5-redis`.
 - **A plain `dnf install php8.5-pecl-redis6` drags in the php8.1 serializers.** It pulls the igbinary/msgpack deps built for **php8.1** → `php8.1-common`, which **conflicts with the platform's `php-common-8.5.6`** over `/etc/php.ini` and `/usr/lib64/php/modules/*.so` (the dnf transaction test aborts, failing the deploy). Install with `--setopt=install_weak_deps=False --exclude=php8.1-*`.
 - **The versioned package installs the `.so` into a non-platform module dir.** Even once installed, `redis.so` (and `pgsql.so`) lands in a dir the platform php does **not** scan. The platform php loads from its own `extension_dir` — discover it with `php -r 'echo ini_get("extension_dir");'`. The hook copies the `.so` there, writes a scan-dir ini enabling it, then **verifies with `php -m`** and fails the deploy on error.
-- **Escape hatch env property.** `02-install-php-redis.sh` honours `REDIS_HOOK_OPTIONAL=1` (EB env property) to skip on failure rather than block the whole deploy.
+- **Escape hatch env property — broken in tools.** `REDIS_HOOK_OPTIONAL=1` is meant to skip on failure. But EB env properties are NOT exported to platform hook processes, so the hook must read it with `/opt/elasticbeanstalk/bin/get-config environment -k REDIS_HOOK_OPTIONAL`. Tools' copy reads `$REDIS_HOOK_OPTIONAL` from the process env, so the hatch does nothing there (vision's copy is fixed, TRUE-83056). Same hook loads the extension ini twice → php-fpm warns "Module redis/igbinary/msgpack already loaded" (open).
 
 **Known-broken sibling — `01-install-php-pgsql.sh` (pgsql).** It has the *same* versioned-package / wrong-module-dir bug and currently **fails on fresh AL2023 instances**. It is presently **bypassed** via the EB env property `PGSQL_HOOK_OPTIONAL=1` (`.ebextensions/003_pgsql_hook_optional.config`). This is a **temporary** measure: it leaves the Talos "Knowledge Bases" create flow (the only pgsql consumer) broken. The fix is the same install-and-copy-into-`extension_dir` treatment `02-install-php-redis.sh` already received; once applied, **delete the `PGSQL_HOOK_OPTIONAL` bypass config.**
 
 ### Redis sessions (survive deploys & load balancing)
-Prod Tools runs multiple EB instances behind an ALB, so PHP sessions must live in a shared store, not per-instance local disk. Sessions use the **shared ElastiCache Redis cluster** (`asi-session-cache…clustercfg.usw2.cache.amazonaws.com:6379`, cluster-mode config endpoint — also used by the `vision` app) via the phpredis `rediscluster` handler.
+Prod Tools runs multiple EB instances behind an ALB, so PHP sessions must live in a shared store, not per-instance local disk. Sessions use the **shared ElastiCache Redis cluster** (`asi-session-cache…clustercfg.usw2.cache.amazonaws.com:6379`, cluster-mode config endpoint; `vision` now uses ElastiCache `togadesk-sessions` instead — see the [Vision deploy doc](../../vision/workflows/deploy-to-elastic-beanstalk-al2023.md)) via the phpredis `rediscluster` handler.
 
 Because the INI-file parser silently drops the `seed[]=host:port` save_path (see the PHP ini step above), the handler is configured at **runtime in `tools/_/app/framework.php`** (`App_Framework_Tools::startSession()`): `ini_set()` sets `session.save_handler=rediscluster`, `session.save_path=seed[]=<cluster cfg endpoint>:6379`, and `session.gc_maxlifetime=345600` (4 days), guarded by `extension_loaded('redis')`, then calls `session_start()` itself. The full outage story (sessions were previously on the file handler on local disk, so every deploy logged everyone out) and the graceful-degrade ordering vs. App_Error are in the [architecture doc](../architecture.md).
 
@@ -132,6 +132,7 @@ The deploy clones `agilantsolutions/library` and `resources` via `020_setup_git_
 - [TOGa Desk deploy (own Redis, offset/Medoo shims, syslog error visibility)](../../togadesk/workflows/deploy-to-elastic-beanstalk-al2023.md)
 
 ## Change history
+- 2026-10-23 — `REDIS_HOOK_OPTIONAL` hatch broken (hooks need `get-config`); double ini load warning (TRUE-83056) (jcardinal)
 - 2026-10-22 — Shared gotchas: `php --ini` scan folder on AL2023, dart-sass arm64 (TRUE-83055) (rgirish)
 - 2026-10-22 — Log-bundle gotcha corrected: `/var/log/messages` is included, custom logs are not; link Desk deploy (TRUE-83053) (rgirish)
 - 2026-10-22 — Correction: nginx-only claim holds only for the nginx proxy; s3fs 1.84 IMDSv2 risk noted (TRUE-83054) (jcardinal)

package/knowledge/1.0/apps/vision/INDEX.md

@@ -0,0 +1,6 @@
+# vision (Vision) — 1.0 knowledge
+
+| Doc | Summary |
+|-----|---------|
+| [Vision (1.0 App_ App) Architecture](architecture.md) | Vision 1.0 app: App_ app on library, served at vision.asisystem.com/vision, no front controller; open before any vision code or deploy work. |
+| [Deploying Vision to Elastic Beanstalk (PHP 8.5 / Amazon Linux 2023)](workflows/deploy-to-elastic-beanstalk-al2023.md) | How Vision (1.0) deploys on EB PHP 8.5 / AL2023 (Apache proxy) in the prod account — env + pipeline, `/vision` folder hook, Redis sessions, s3fs `asifiles`, den |

package/knowledge/1.0/apps/vision/architecture.md

@@ -0,0 +1,34 @@
+---
+title: Vision (1.0 App_ App) Architecture
+framework: "1.0"
+repo: vision
+project: Vision
+client: shared
+type: architecture
+status: active
+updated: 2026-10-23
+owners: ["jcardinal"]
+files:
+  - vision/_/app/framework.php
+  - vision/.htaccess
+  - vision/.platform/httpd/conf.d/deny_files.conf
+  - vision/config.prod.ini
+related:
+  - workflows/deploy-to-elastic-beanstalk-al2023.md
+  - ../library/features/error-capture-1-0.md
+  - ../library/features/app-cloud-aws-credentials.md
+---
+
+Vision 1.0 app: App_ app on library, served at vision.asisystem.com/vision, no front controller; open before any vision code or deploy work.
+
+## Summary
+
+Old 1.0 `App_` app bootstrapped from `library` (`App_Framework_Vision` in `_/app/framework.php`). Served at `https://vision.asisystem.com/vision/` from EB env `togatech-legacy-vision-production` (prod account, us-east-1) — deploy details in the [deploy doc](workflows/deploy-to-elastic-beanstalk-al2023.md). Used by Canon and Office Depot. PunchOut is retired (not revived).
+
+- **No front controller.** Every `.php` file is served directly. Root `.htaccess` + `.platform/httpd/conf.d/deny_files.conf` are the only guard for non-public files.
+- **Sessions** in Redis via env property `SESSION_REDIS_SAVE_PATH` (`startSession()`), file fallback.
+- **Files** on s3fs `asifiles` only.
+- **Config** = `config.<ENVIRONMENT>.ini`; prod uses `ENVIRONMENT=prod`.
+- **Errors** go to Sentry, not `Logs.Issue`.
+
+**Critical rules:** Any new non-public file or folder must be added to BOTH deny lists (`.htaccess` and `deny_files.conf`) — there is no router to protect it. Never store or log all of `$_SERVER` (env properties like `GITHUB_TOKEN` are in it). `ENVIRONMENT` is `prod`, not `production`. Known open security debt is listed in the deploy doc — check it before touching `ajax.php`, `ajax_nosession.php`, `external/`, or `portal/`.

package/knowledge/1.0/apps/vision/workflows/deploy-to-elastic-beanstalk-al2023.md

@@ -0,0 +1,79 @@
+---
+title: Deploying Vision to Elastic Beanstalk (PHP 8.5 / Amazon Linux 2023)
+framework: "1.0"
+repo: vision
+project: Vision
+client: shared
+type: workflow
+status: active
+updated: 2026-10-23
+owners: ["jcardinal"]
+files:
+  - vision/.ebextensions/009_setup_phpini.config
+  - vision/.ebextensions/020_setup_git_libraries.config
+  - vision/.platform/hooks/predeploy/20-setup-vision-folders.sh
+  - vision/.platform/hooks/prebuild/02-install-php-redis.sh
+  - vision/.platform/httpd/conf.d/deny_files.conf
+  - vision/.htaccess
+  - vision/_/app/framework.php
+  - vision/download_file.php
+  - vision/cr.php
+  - vision/ebs/s3fs.prod.json
+  - vision/composer.json
+related:
+  - ../../api/workflows/deploy-to-elastic-beanstalk-al2023.md
+  - ../../tools/workflows/deploy-to-elastic-beanstalk-al2023.md
+  - ../../togadesk/workflows/deploy-to-elastic-beanstalk-al2023.md
+  - ../../test/workflows/retiring-unused-legacy-elastic-beanstalk-environments.md
+  - ../../library/features/app-cloud-aws-credentials.md
+---
+
+How Vision (1.0) deploys on EB PHP 8.5 / AL2023 (Apache proxy) in the prod account — env + pipeline, `/vision` folder hook, Redis sessions, s3fs `asifiles`, deny rules (no front controller), open security debt; open before touching vision `.ebextensions`/`.platform` or deploying vision.
+
+## Summary
+
+TRUE-83056 revived Vision on "PHP 8.5 running on 64bit Amazon Linux 2023/4.13.13" (Apache proxy, php-fpm). Shared AL2023 rules live in the [Tools deploy doc](../../tools/workflows/deploy-to-elastic-beanstalk-al2023.md); s3fs 1.97, `GITHUB_TOKEN` clone, HTTPS listener and pipeline pattern in the [api deploy doc](../../api/workflows/deploy-to-elastic-beanstalk-al2023.md). This doc holds only what differs for vision.
+
+- Env `togatech-legacy-vision-production`, EB app `Vision`, us-east-1, prod account 654654170868, 2 × t4g.large. Old AL1 env `agilant-vision-prod` (legacy account, us-west-2) was terminated 2026-10-23 (TRUE-83123; saved config `pre-terminate-TRUE-83123-agilant-vision-prod`). `punchout-togacommerce-production` was not revived (no punchout needed).
+- Pipeline `Legacy-Vision-Production` (us-east-1), copied from `Legacy-API-Production`: CodeStar source `agilantsolutions/vision` branch `_production`, Manual approval, EB deploy.
+- Domain `vision.asisystem.com`: DNS in **DNS Made Easy** (not Route 53), CNAME → `togatech-legacy-vision-production.us-east-1.elasticbeanstalk.com`.
+- App served at `/vision/`; health check `/vision/helloworld.txt` (set in `009`).
+
+## Steps
+
+1. **Env properties:** `ENVIRONMENT=prod` (not `production` — library loads `config.<ENVIRONMENT>.ini` and the s3fs hook reads `ebs/s3fs.<ENVIRONMENT>.json`; only `.prod` files exist), `GITHUB_TOKEN`, `SESSION_REDIS_SAVE_PATH`. Values live in the EB env config only.
+2. **`020`** clones `library`, `dbchanges` and `resources` (`_production`) with `GITHUB_TOKEN` via `get-config` + `GIT_ASKPASS`. Runs before the folder hook.
+3. **Composer:** `composer.json` platform `8.5.0`; lock keeps the same package versions. EB runs `composer install` itself.
+4. **`.platform/hooks/predeploy/20-setup-vision-folders.sh`** (replaces AL1 `ebs/setup_vision.php`): moves everything except dotfiles and `ebs/` into `vision/`; copies root `.htaccess` into `vision/`; favicon to root; links `/portal` and `/resources` into `vision/`; root `index.php` 302 → `/vision/`; fails if `vision/vendor/autoload.php` is missing; marker file `.vision-layout-done`.
+5. **s3fs** (api's 1.97 build + predeploy/confighooks mount) mounts only `asifiles`; cache `/var/cache/s3fs`. `agilant-catalog` and `asidbarchives` dropped (unused).
+6. **Redis sessions:** `App_Framework_Vision::startSession()` (`_/app/framework.php`) reads `SESSION_REDIS_SAVE_PATH` like togadesk — `seed[]=` → `rediscluster`, else `redis` handler; `ini_set` before parent init; file-session fallback with `error_log`; SameSite=Lax + `use_strict_mode`. Prod points at ElastiCache `togadesk-sessions` (us-east-1, non-cluster, same VPC). Its SG `sg-03e79bcb9c105e100` needs inbound 6379 from the Vision instance SG.
+7. **Load balancer:** HTTPS:443 listener, ACM `*.asisystem.com` (us-east-1 / 654654170868), policy `ELBSecurityPolicy-TLS13-1-2-2021-06`, ALB idle timeout 900. All IPs allowed (developer decision; old env was limited to the Naperville office + Canon).
+8. **Verify:** env Green; `/vision/` login 200; assets 200; session cookie Secure/HttpOnly/SameSite=Lax; 403 on the deny list; `download_file.php` 401 when logged out; DNS + cert valid.
+
+## Security (no front controller)
+
+Vision serves every `.php` file directly, so deny rules are the only guard:
+- Root `.htaccess` (copied into `vision/`) AND `.platform/httpd/conf.d/deny_files.conf` (works without AllowOverride): `config.*`; ini/env/json/sh/lock/yaml/phar/bat/sql/log/bak/dist/md; dotfiles; all of `_/`, `vendor`, `old_scripts`, `php-saml-master`, `ebs`; `resendemail.php`, `clearsession.php`; `Options -Indexes`. Add any new non-public file or folder to BOTH.
+- `download_file.php` requires login (employee, portal user or punchout session); `downloadFileAction` only allows `Browser_Chat_Widget::downloadEventFile`.
+- `cr.php` stores only an allowlist of `$_SERVER` keys — env properties (e.g. `GITHUB_TOKEN`) reach `$_SERVER`, so never store or log all of it.
+- Files that held an AWS key, a GitHub token and SES SMTP keys were removed (`ebs/mount-s3fs-credentials-file.php`, `ebs/git.json`, `sendtestemail*.php`); still in git history — developer rotating.
+
+## Gotchas
+
+- **`create-pipeline` starts a run at once** on the current `_production`. Reject it at Approval if `_production` does not yet hold the new config.
+- **EB env properties are not exported to platform hook processes.** In `.platform/hooks/*` read them with `/opt/elasticbeanstalk/bin/get-config environment -k <NAME>` (vision's `02-install-php-redis.sh` does; tools' copy does not — see [Tools](../../tools/workflows/deploy-to-elastic-beanstalk-al2023.md)).
+- **Dropped from AL1 (do not re-add):** IMAP/LDAP (unused), composer AL1 hook, codecept tests, prefork tuning, `/tmp` cleaner cron, symlinks config, `DOAcron.yaml` (crons dead), HP PQWS certs + `/var/www/8x8`.
+- Vision errors go to Sentry, not `Logs.Issue` ([error capture](../../library/features/error-capture-1-0.md)).
+
+## Open follow-ups (pre-existing, not fixed)
+
+1. `ajax.php do=ajaxAction` lets a caller choose any `class::method`.
+2. `ajax_nosession.php` forgot-password change has no reset-token check and uses md5.
+3. `external/*.php` serve records by guessable ids.
+4. `portal/index.php` + `portal/franchise.php` `require_once` path traversal.
+5. ~100 `mysql_*` calls (dead since PHP 7.0).
+6. php-fpm warns "Module redis/igbinary/msgpack already loaded" — `02-install-php-redis.sh` loads the extension ini twice (same in tools).
+7. `config.prod.ini` still has old us-west-2 RDS hosts + unmounted catalog paths.
+
+## Change history
+- 2026-10-23 — Created: Vision revived on PHP 8.5 / AL2023 in the prod account; folder hook, Redis sessions, s3fs `asifiles`, deny rules, open security list (TRUE-83056) (jcardinal)

package/knowledge/INDEX.md

@@ -17,7 +17,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 - **toga** (TOGa) — 4 doc(s) → [1.0/apps/toga/INDEX.md](1.0/apps/toga/INDEX.md)
 - **store** (Store) — 5 doc(s) → [1.0/apps/store/INDEX.md](1.0/apps/store/INDEX.md)
 - **tools** (Tools) — 25 doc(s) → [1.0/apps/tools/INDEX.md](1.0/apps/tools/INDEX.md)
-- **vision** (Vision) — 0 doc(s) → [1.0/apps/vision/INDEX.md](1.0/apps/vision/INDEX.md)
+- **vision** (Vision) — 2 doc(s) → [1.0/apps/vision/INDEX.md](1.0/apps/vision/INDEX.md)
 - **api** (API 1.0) — 3 doc(s) → [1.0/apps/api/INDEX.md](1.0/apps/api/INDEX.md)
 
 ## 2.0 framework

package/knowledge/clients/office-depot/profile.md

@@ -12,6 +12,7 @@ apps:
   - forward
   - store
   - worker1.5
+  - vision
 project: TOGa Voice
 client: office-depot
 type: profile

package/knowledge/standalone/apps/claude/workflows/clickup-ticket-workflow.md

@@ -6,7 +6,7 @@ project: Claude Harness
 client: shared
 type: workflow
 status: active
-updated: 2026-10-21
+updated: 2026-10-23
 owners: ["jcardinal", "rgirish"]
 files:
   - claude/skills/start/SKILL.md
@@ -171,9 +171,15 @@ All tested 2026-10-08:
   to paste. The SessionStart hook also returns it as `sessionTitle` when the developer has not
   named the session. Hook titles only work at SessionStart (per docs); VS Code support is
   unconfirmed; `/rename` works everywhere.
+- **A text-only reply ends Claude's turn.** `/start` once stalled after the `/rename` line
+  because SKILL.md said to send it "in its own message". Show the line and call the next step's
+  tool in the same response; `set-title` returns a `next` field and `kickoff-primed` prints a
+  keep-going line for this.
 
 ## Change history
 
+- 2026-10-23 — `/start` no longer stalls after the `/rename` line (same-response next step) (TRUE-83056). (jcardinal)
+
 - 2026-10-21 — TRUE-82674: macOS `/start` temp-dir block gotcha + workaround. (rgirish)
 - 2026-10-15 — Ticket writes need no approval: `/finish` writes fields itself, `/pseudocode`
   writes once the plan is agreed; the gate allows any field/status/tag/comment on the session

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.1139",
+  "version": "1.0.1140",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",