toga-ai 1.0.178 → 1.0.180

package/knowledge/2.0/apps/worker2/features/wje-freshservice-sync.md

@@ -141,3 +141,7 @@ parallel but separate `_Worker_Elite` handler — see related doc.
 - `2.0/apps/worker2/features/elite-freshservice-sync.md` — sister Freshservice client.
 - `2.0/apps/worker2/features/startech-webhook-handler.md` — the multi-client webhook pattern WJE predates.
 - `1.0/apps/library/features/toga2-api-client-and-bridge.md` — `App_Api_Toga2::syncWithTogadesk`.
+
+## Change history
+
+- 2026-06-23 (jcardinal) — Added missing Change history section for schema compliance (no content change).

package/knowledge/INDEX.md

@@ -33,7 +33,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 ## standalone framework
 
 - **togatech** (TOGA Technology Website) — 2 doc(s) → [standalone/apps/togatech/INDEX.md](standalone/apps/togatech/INDEX.md)
-- **forward** (Forwarder) — 3 doc(s) → [standalone/apps/forward/INDEX.md](standalone/apps/forward/INDEX.md)
+- **forward** (Forwarder) — 4 doc(s) → [standalone/apps/forward/INDEX.md](standalone/apps/forward/INDEX.md)
 
 ## Clients
 

package/knowledge/standalone/apps/forward/INDEX.md

@@ -2,6 +2,7 @@
 
 | Doc | Summary | Files |
 |-----|---------|-------|
-| [Forwarder Architecture](architecture.md) | Forwarder is a tiny **standalone PHP application** that powers TOGA's short, branded redirect domains. | forward/forward.ini, forward/index.php, forward/.htaccess, forward/.platform/httpd/conf.d/rewritemap.conf, forward/.ebextensions/rewritemap.config, forward/composer.json |
+| [Forwarder Architecture](architecture.md) | Forwarder is a tiny **standalone PHP application** that powers TOGA's short, branded redirect domains. | forward/forward.ini, forward/index.php, forward/.htaccess, forward/.platform/httpd/conf.d/rewritemap.conf, forward/.ebextensions/rewritemap.config, forward/design/index.php, forward/composer.json |
+| [Design Demo Admin Tool](features/design-demo-admin.md) | A standalone, dependency-free PHP tool served at `https://demo.togatech.com/design` that lets the **design team** publish self-contained "Claude Design" HTML ex | forward/design/index.php, forward/design/.config.example.php, forward/.gitignore, forward/.htaccess, forward/.ebextensions/php-uploads.config |
 | [Encrypted-Link Handler](features/encrypted-link-handler.md) | A `index.php` feature in [Forwarder](../architecture.md) for redirect domains whose URL path carries an **encrypted token** that must be decoded before redirect | forward/index.php |
 | [Static Demo Hosting](features/static-demo-hosting.md) | A lightweight way to host self-contained static HTML pages (demos, exported designs, download landing pages) on the Forwarder app under a clean URL — e.g. | forward/.htaccess, forward/togadesk/index.html |

package/knowledge/standalone/apps/forward/architecture.md

@@ -14,6 +14,7 @@ files:
   - forward/.htaccess
   - forward/.platform/httpd/conf.d/rewritemap.conf
   - forward/.ebextensions/rewritemap.config
+  - forward/design/index.php
   - forward/composer.json
 related: []
 ---
@@ -75,6 +76,7 @@ The `.htaccess` at the repo root drives a plain-text lookup table:
   (e.g. `sos.*` → `/sos/`), it redirects to `/<subdomain>/` and serves that dir's
   `index.html`. Used for the bundled `sos/` Splashtop SOS download page.
 - **404** — otherwise returns a styled `404` echoing the unmatched `host + uri`.
+- **Design Demo Admin tool** — `/design` serves `design/index.php`, a self-serve UI for the design team to publish and version Claude Design HTML exports via the GitHub API. It runs as a normal directory request (not through the redirect map). See the [Design Demo Admin](features/design-demo-admin.md) feature doc.
 
 ## Deployment (Elastic Beanstalk / Apache)
 
@@ -90,6 +92,7 @@ The `.htaccess` at the repo root drives a plain-text lookup table:
 - `composer.json` declares a `Togatech\Forward\` PSR-4 autoload over `src/` but has **no
   dependencies** and no `src/` is shipped today — the app is effectively a single
   `index.php` plus the Apache config.
+- **`DirectoryIndex index.html index.php`** in `.htaccess` makes `/design/` load `design/index.php` and lets nested static-demo version paths `/<project>/<vN>/` serve via Apache's normal directory index. The single-segment static-demo rewrite rule does not match two-segment paths, and the `index.php` map-miss fallback does not fire for real directories — so versioned demo URLs resolve as directory-index lookups.
 
 ## The `decrypt()` scheme
 
@@ -119,3 +122,4 @@ Treat this as obfuscation only. Anything genuinely sensitive must not rely on it
 
 - 2026-06-18 (jcardinal) — Initial architecture documentation; registered `forward`
   (Forwarder, standalone) in the knowledge base.
+- 2026-06-23 (jcardinal) — Added the `/design` Design Demo Admin route and a `DirectoryIndex index.html index.php` directive in `.htaccess` (enables `/design/` and nested `/<project>/<vN>/` demo paths).

package/knowledge/standalone/apps/forward/features/design-demo-admin.md

@@ -0,0 +1,148 @@
+---
+title: Design Demo Admin Tool
+framework: "standalone"
+repo: forward
+project: Forwarder
+client: shared
+type: feature
+status: active
+updated: 2026-06-23
+owners: ["jcardinal"]
+files:
+  - forward/design/index.php
+  - forward/design/.config.example.php
+  - forward/.gitignore
+  - forward/.htaccess
+  - forward/.ebextensions/php-uploads.config
+related:
+  - standalone/apps/forward/features/static-demo-hosting.md
+  - standalone/apps/forward/architecture.md
+---
+
+## Summary
+
+A standalone, dependency-free PHP tool served at `https://demo.togatech.com/design` that
+lets the **design team** publish self-contained "Claude Design" HTML exports to the
+`forward` repo as **versioned demos** — no developer, no git, no local checkout required.
+It sits on top of [Static Demo Hosting](static-demo-hosting.md): static hosting serves the
+files; this tool is the self-serve UI that writes and versions them.
+
+The tool does **all** repo access over the **GitHub REST API** — never the local
+filesystem — because in production it runs on the Elastic Beanstalk host, not a git
+checkout. Publishing pushes a commit to `_main`, which triggers the existing EB
+auto-deploy ("live in a few minutes").
+
+## Key files / entry points
+
+- `forward/design/index.php` — the entire tool: a single-file PHP backend + HTML/JS UI.
+  `declare(strict_types=1)`. Served at `/design` (was `/admin`; renamed this session).
+- `forward/design/.config.example.php` — template for local dev config (the real
+  `.config.php` is git-ignored).
+- `forward/.gitignore` — ignores `design/.config.php` so a local token is never tracked.
+- `forward/.htaccess` — `DirectoryIndex index.html index.php` so `/design/` loads
+  `index.php`, and so nested `/<project>/<vN>/` paths serve via Apache's directory index.
+
+## How it works
+
+### GitHub API access (no filesystem)
+
+- **Reads / listing:** GitHub **Contents API**.
+- **Writes:** GitHub **Git Data API** — blob → tree → commit → update-ref — so a publish
+  is an **atomic multi-file commit** (the version's files + the regenerated stub +
+  `project.json` all land in one commit).
+- **Auth:** token from `getenv('FORWARD_GITHUB_TOKEN')` (an Elastic Beanstalk environment
+  property in prod) or an uncommitted `design/.config.php` for local dev. See gotchas — the
+  token must **never** live in the tracked `index.php`.
+
+### Versioning model (decided this session)
+
+- **Sequential `/v1`, `/v2`, `/v3` URL folders** — not semver, not date-based.
+- Each project has a **`project.json` manifest** at its folder root:
+  ```json
+  {
+    "title": "...", "latest": "v3", "hidden": false,
+    "versions": [
+      { "id": "v3", "label": "...", "notes": "...", "author": "...",
+        "date": "YYYY-MM-DD", "hidden": false }
+    ]
+  }
+  ```
+  Human detail (label / author / notes) lives in the **manifest**, not the URL.
+- **"latest" pointer:** the bare `/<project>` serves an auto-generated `index.html` **stub**
+  that meta-refresh / JS-redirects (relative `./vN/`) to the newest **visible** version.
+  The stub is regenerated on every publish/unlist.
+- A directory is treated as a **managed demo iff it contains `project.json`** — this is how
+  the tool distinguishes demos from infrastructure directories.
+
+### Actions
+
+- **Publish a version** — uploads a self-contained HTML export as the next `vN/index.html`,
+  appends a version entry to `project.json`, regenerates the stub, commits.
+- **Adopt** — converts a legacy `index.html`-only demo folder (e.g. `togadesk`) into a
+  managed demo: moves the existing page to `v1/index.html`, writes `project.json`,
+  regenerates the stub.
+- **Remove = unlist only** — sets a `hidden` flag in `project.json`; files are **never
+  deleted** (explicit owner decision).
+- **Copy Claude Design prompt** — one-click copy of the standard self-contained-HTML export
+  prompt (the same prompt documented in [static-demo-hosting](static-demo-hosting.md)).
+
+### Naming & validation
+
+- Folder names auto-normalized to **lowercase kebab-case**, validated against a kebab regex
+  plus a reserved/excluded list.
+- **`EXCLUDED_FOLDERS`** constant (`design`, `sos`) + `RESERVED_NAMES` are never listed or
+  managed (owner-requested; expected to grow over time).
+
+### Hardening
+
+Input length caps; version-id regex guard; HTML content sniff on upload; security headers;
+no client-facing leakage of GitHub/curl error detail; `declare(strict_types=1)`.
+
+## Access control
+
+**No authentication** — explicit owner product decision. The `/design` URL is unlisted;
+anyone who reaches it can publish or unlist. Do not treat the tool as protected.
+
+## Data model
+
+`project.json` per managed demo (see Versioning model above). No database.
+
+## Client variations
+
+None — internal/shared design-team tool.
+
+## Gotchas / known issues
+
+- **Contents API inlines only ≤1 MB.** The GitHub Contents API returns an **empty**
+  `content` field for files over ~1 MB. Design exports are routinely multi-MB (the
+  `togadesk` demo is ~4.2 MB), so reading them via the base64 Contents response silently
+  returned empty content — adopt committed a **0-byte `v1/index.html`** (blank page). Fix:
+  `ghReadFile()` uses the **raw media type** (`Accept: application/vnd.github.raw`), which
+  streams files up to 100 MB.
+- **Never hardcode the GitHub token in the tracked `index.php`.** `design/index.php` is
+  git-**tracked**; only `design/.config.php` is git-ignored. Hardcoding a `ghp_` token in
+  `index.php` leaked a live token into pushed `_main` history of `agilantsolutions/forward`.
+  Use `getenv('FORWARD_GITHUB_TOKEN')` (EB env property) or the uncommitted `.config.php`. A
+  leaked token must be **revoked/rotated** — a later commit does not remove it from history.
+  Prefer a **fine-grained PAT** scoped to only the `forward` repo's Contents R/W.
+- **Raise PHP upload limits for multi-MB designs (AL1 / PHP 7.3 specifics).** Default
+  `upload_max_filesize` (~2 MB) rejects real multi-MB design exports. The deploy platform
+  is **PHP 7.3 on 64-bit Amazon Linux 1**, where these values are **not** settable via the
+  `aws:elasticbeanstalk:container:php:phpini` option namespace. Instead a
+  `.ebextensions/php-uploads.config` drops a custom ini at
+  `/etc/php-7.3.d/99-design-uploads.ini` setting `upload_max_filesize=25M`,
+  `post_max_size=30M`, `memory_limit=256M`, `max_execution_time=60`.
+- **Publishing pushes to `_main`** and triggers EB auto-deploy — changes go live in a few
+  minutes; there is no staging step.
+
+## Change history
+
+- 2026-06-23 — Built the Design Demo Admin tool: GitHub-API-only publishing, sequential
+  `/vN` versioning with a `project.json` manifest + auto-generated latest-pointer stub,
+  adopt/unlist actions, `/design` route. Fixed the >1 MB Contents-API empty-content bug
+  (raw media type) and the tracked-token leak (env/`.config.php`). (jcardinal)
+
+## Related docs
+
+- [Static Demo Hosting](static-demo-hosting.md)
+- [Forwarder Architecture](../architecture.md)

package/knowledge/standalone/apps/forward/features/static-demo-hosting.md

@@ -6,13 +6,14 @@ project: Forwarder
 client: shared
 type: feature
 status: active
-updated: 2026-06-18
+updated: 2026-06-23
 owners: ["jcardinal"]
 files:
   - forward/.htaccess
   - forward/togadesk/index.html
 related:
   - standalone/apps/forward/architecture.md
+  - standalone/apps/forward/features/design-demo-admin.md
 ---
 
 ## Summary
@@ -55,6 +56,14 @@ RewriteRule ^([^/]+)/?$ /$1/index.html [L]
 deploy the EB app → `demo.togatech.com/<name>` works immediately. No code or `.htaccess`
 change is needed for each new demo.
 
+**Self-serve + versioning.** The design team no longer has to commit by hand: the
+[Design Demo Admin tool](design-demo-admin.md) at `/design` publishes exports via the
+GitHub API and adds **sequential `/vN/` versioning** on top of this static layout (a
+`project.json` manifest plus an auto-generated latest-pointer stub at the bare
+`/<project>`). The nested `/<project>/<vN>/` URLs are served by Apache's normal directory
+index (a `DirectoryIndex index.html index.php` line in `.htaccess`); the single-segment
+static-demo rewrite rule above does not match two segments.
+
 This is distinct from the older subdomain-based **local directory handler** in `index.php`
 (`sos.*` → `/sos/`), which runs only on a map miss and issues a redirect. The static-demo
 rule is path-based, redirect-free, and runs in Apache before PHP. See the
@@ -106,6 +115,9 @@ None — uniform, shared/internal.
 
 ## Change history
 
+- 2026-06-23 — Added self-serve publishing + sequential `/vN/` versioning on top of static
+  hosting via the new [Design Demo Admin tool](design-demo-admin.md); nested version paths
+  served by a `DirectoryIndex index.html index.php` line in `.htaccess` (jcardinal).
 - 2026-06-18 — Added static demo hosting: `.htaccess` rule + `togadesk/` demo; documented
   the Claude Design export prompt (jcardinal).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.178",
+  "version": "1.0.180",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",

package/skills/kickoff/SKILL.md

@@ -375,6 +375,29 @@ Ready to proceed?
 or "you have full access" — proceed without further permission prompts, but still flag any
 write outside the expected scope.
 
+### Write discipline — stub-first to avoid the GateGuard double-emit tax
+
+The ECC fact-forcing gate (`gateguard-fact-force.js`, a `PreToolUse` hook) **denies the
+first Write/Edit to each new file path per session**, then allows the retry. The gate keys
+**only on `file_path` — it never inspects content** (verified in the hook: it `markChecked`s
+the path on the deny, so any subsequent write to that path is allowed regardless of content).
+
+That means generating a large file's full content on the first attempt is wasted: the attempt
+is denied and you must re-emit the entire content on the retry — paying ~2× output tokens for
+every large new file.
+
+**Rule — when creating a new file (or fully rewriting a large one):**
+
+1. First Write to that path is a **minimal stub** (one line, or empty).
+2. Present the gate's facts / do the real investigation (this is the gate's actual quality
+   purpose — keep it for code).
+3. Write the **full content** on the second call — it passes on the first real attempt.
+
+Full content is emitted **once**. Scope note: the win is **large new-file Writes**. `Edit`s
+also gate once per file, but `old_string`/`new_string` are small, so stub-first isn't worth
+it there. Markdown doc trees are already gate-exempt via `GATEGUARD_EDIT_EXEMPT` — no stub
+needed for those.
+
 ---
 
 ### Agent selection (how to build the plan internally)