toga-ai 1.0.584 → 1.0.586

package/knowledge/1.0/apps/tools/INDEX.md

@@ -6,7 +6,7 @@
 | [ClickUp Sprint Dashboard (tools /clickup/react)](features/clickup-sprint-dashboard.md) | A native **ClickUp sprint dashboard** in the 1.0 `tools` app at route `/clickup/react`, built for a wall-mounted **TV display** ("TOGa IQ" internal sprint metri | tools/_/app/clickup/sprint.php, tools/v2/sprints/tile/index.php, tools/v2/sprints/current/index.php, tools/v2/sprints/status-breakdown/index.php, tools/v2/sprints/worktype-breakdown/index.php, tools/v2/sprints/points-by-dev/index.php, tools/v2/sprints/burndown/index.php, tools/assets/clickup/sprint-dashboard.html, tools/mvc/clickup/react/get.php, tools/mvc/login/get.php, tools/_/app/nav.php |
 | [CloudFront Client Setup](features/cloudfront-client-setup.md) | An SSO-gated admin tool at **`/devops/cloudfront-clients`** in the Tools 1.0 app that onboards a client onto **CloudFront + Route 53 across multiple AWS account | tools/_/app/devops/cloudfront.php, tools/mvc/devops/cloudfront-clients/get.php, tools/mvc/devops/cloudfront-clients/post.php, tools/assets/js/cloudfront-clients.js, tools/assets/css/cloudfront-clients.css, tools/_/app/nav.php, tools/_/app/frameworkindex.php, tools/config.production.ini |
 | [Design Demo Admin](features/design-demo-admin.md) | A self-serve admin UI at **`/design`** in the SSO-protected **Tools** app that lets the design team publish self-contained "Claude Design" HTML exports as **ver | tools/_/app/design/github.php, tools/mvc/design/get.php, tools/mvc/design/post.php, tools/assets/css/design.css, tools/assets/js/design.js, tools/_/app/frameworkindex.php, tools/_/app/nav.php, tools/composer.json |
-| [Tools — Developers Folder (UUID & Password Generators)](features/developer-tools.md) | The first two tools shipped in the Tools app, both under the **Developers** folder and gated to personas **Development Team** / **TOGa Technology**. | tools/mvc/developers/uuid/get.php, tools/mvc/developers/password/get.php |
+| [Tools — Developers Folder (UUID & Password Generators)](features/developer-tools.md) | The first two tools shipped in the Tools app, both under the **Developers** folder and gated to personas **Development Team** / **TOGa Technology**. | tools/mvc/developers/uuid/get.php, tools/mvc/developers/password/get.php, tools/mvc/developers/password/post.php |
 | [/errors Curation Console (Tools → shared Core Logs DB)](features/errors-curation-console.md) | Internal-only triage/curation screen for the 2.0 Issue/Event error-reporting pipeline, built as a 1.0 Tools MVC page reading the **shared Core Logs DB** through | tools/mvc/errors/get.php, tools/mvc/errors/post.php, tools/mvc/errors/issue/get.php, tools/assets/css/style.css, tools/_/app/nav.php, tools/config.production.ini |
 | [Legacy Email Notifier (tools /email-migration/notify)](features/legacy-email-notifier.md) | An SSO-gated admin tool at **`/email-migration/notify`** (nav group **Email Migration** > **Legacy Notifier**, personas `['TOGa Technology','Development Team']` | tools/mvc/email-migration/notify/get.php, tools/mvc/email-migration/notify/post.php, tools/_/app/nav.php |
 | [Tools MVC — Routing, CSRF & App_Database Access Patterns](features/mvc-data-access-patterns.md) | The load-bearing 1.0 (`App_`) framework conventions a developer needs when adding a page to the Tools app — URL routing, CSRF, and DB access through `App_Databa | tools/_/app/nav.php, tools/mvc/get.php, library/app/error.php, library/app/database.php |

package/knowledge/1.0/apps/tools/features/developer-tools.md

@@ -6,14 +6,16 @@ project: Tools
 client: shared
 type: feature
 status: active
-updated: 2026-06-25
+updated: 2026-08-14
 owners: [jcardinal]
 files:
   - tools/mvc/developers/uuid/get.php
   - tools/mvc/developers/password/get.php
+  - tools/mvc/developers/password/post.php
 related:
   - ../architecture.md
   - ./persona-gated-navigation.md
+  - ./mvc-data-access-patterns.md
 ---
 
 ## Summary
@@ -28,10 +30,28 @@ personas **Development Team** / **TOGa Technology**. They are the reference exam
 - Server generates an RFC 4122 **v4** UUID via `random_bytes(16)` with version/variant bits set.
 - UI is click-to-copy, then instant **client-side** regenerate using `crypto.getRandomValues`.
 
-### Generate Password (`mvc/developers/password/get.php`)
-- Reproduces the standalone `test/team/generate_password.php` script.
-- `App_String::generateSupportCode(8)` produces the password; `App_String::passwordHash()`
-  produces the bcrypt hash. The page shows **both** the password and the hash, each copyable.
+### Generate Password (`mvc/developers/password/get.php` + `post.php`)
+- **Random support-code card (default, on page load):** reproduces the standalone
+  `test/team/generate_password.php` script. `App_String::generateSupportCode(8)` produces the
+  password; `App_String::passwordHash()` produces the bcrypt hash. The page shows **both** the
+  password and the hash, each copyable. Unchanged.
+- **Hash-your-own-password card:** the user types a password and gets its bcrypt hash without a
+  full page reload. bcrypt cannot run client-side, so the UI `fetch`es a sibling
+  `post.php` — the framework routes any non-GET for `/developers/password` to
+  `mvc/developers/password/post.php` (folder == route 1:1). `post.php` exposes one JSON action
+  `hash`, guarded with the standard tools pair `App_Auth::requireAuth()` then
+  `App_Page::validateCrossSiteRequestForgery()`. That CSRF check is **Origin/Referer-based, not
+  a token**, so a same-origin `fetch` passes with no embedded token (see
+  [mvc-data-access-patterns](./mvc-data-access-patterns.md)).
+- **Security discipline:** the clear-text password is **never logged or persisted**. A
+  `MAX_PASSWORD_BYTES = 4096` guard bounds input, and the endpoint returns a `truncated` flag
+  because bcrypt only consumes the first 72 bytes — the UI shows a note when that is exceeded.
+
+## Gotcha — bcrypt's 72-byte limit
+`password_hash`/`App_String::passwordHash()` silently ignores everything past the first **72
+bytes** of the input. The hash-your-own card surfaces this to the user (`truncated` flag + UI
+note) rather than letting a longer password appear to "work" while extra characters are dead.
 
 ## Change history
+- 2026-08-14 — Added a "hash your own password" card to the Generate Password tool: a new sibling `mvc/developers/password/post.php` exposes one JSON `hash` action (requireAuth + Origin/Referer CSRF), so the UI bcrypt-hashes user-typed input via `fetch` without a page reload; clear-text is never logged/persisted, `MAX_PASSWORD_BYTES=4096` guard, and a `truncated` flag surfaces bcrypt's 72-byte limit. Also fixed missing inter-card spacing by adding a `tool--password` wrapper modifier + `.tool--password .card { margin-bottom }` (mirroring `.tool--errors`; note style.scss is dead — edit style.css directly). (jcardinal)
 - 2026-06-25 — Built the first two Developers tools: RFC 4122 v4 UUID generator and a password+bcrypt-hash generator (ported from test/team/generate_password.php), both gated to Development Team / TOGa Technology personas (jcardinal)

package/knowledge/1.0/apps/tools/features/oneuptime-monitor-status-panel.md

@@ -7,7 +7,7 @@ client: shared
 type: feature
 status: active
 updated: 2026-08-14
-owners: [kyalamarthi]
+owners: [kyalamarthi, jcardinal]
 files:
   - tools/assets/clickup/sprint-dashboard.html
   - tools/mvc/clickup/react/get.php
@@ -168,12 +168,22 @@ stays on the **base** hue, so the dashboard underneath stays readable instead of
 bright layer is written `var(--alert-bright, var(--alert-color))` so it **degrades to the base
 colour** if the property never reaches the element.
 
-Standing and blinking differ only in intensity, which is what keeps "steady = still broken"
-distinguishable from "pulsing = something just changed":
+Standing and blinking differ in intensity **and in animation tempo**, which is what keeps
+"still broken" distinguishable from "something just changed":
 
-- `.alert-flash` (standing) — 12px rim, `opacity: .85`, no animation. It may sit on screen for
-  hours.
-- `.alert-flash.is-blinking` (event) — 20px rim, `opacity: 1`, plus the 0.7s pulse.
+- `.alert-flash` (standing) — 12px rim, **slowly breathes** its opacity 0 → 1 → 0 on a
+  **7-second ease-in-out loop** (`@keyframes alert-breathe { 0%,100% { opacity: 0 } 50% {
+  opacity: 1 } }`, applied `animation: alert-breathe 7s ease-in-out infinite`). It may sit on
+  screen for hours, so the gentle 7s breathe draws a distant eye without reading as urgent. The
+  tempo is deliberately slow: the values were tuned with the developer (0.5→0.92 over 10s was
+  too subtle, full 0→1 over 10s too slow) to settle on full 0→1 over 7s.
+- `.alert-flash.is-blinking` (event) — 20px rim, `opacity: 1`, plus the fast **0.7s** pulse.
+  Its compound selector (0,2,0) out-specifies the standing breathe (0,1,0), so a just-changed
+  monitor shows the urgent fast blink, not the slow breathe.
+
+The base `.alert-flash { opacity: .85 }` is the **reduced-motion fallback**, not the animated
+default — see the `prefers-reduced-motion` gotcha. It is deliberately non-zero so a
+reduced-motion viewer never lands on a fully-invisible (opacity 0) glow.
 
 ## Gotchas
 
@@ -192,7 +202,9 @@ distinguishable from "pulsing = something just changed":
   Once the blink moved to `.alert-flash.is-blinking` (specificity 0,2,0), a reduced-motion rule
   on `.alert-flash` alone (0,1,0) **could no longer override it** and the screen kept pulsing.
   The rule must list both: `.alert-flash, .alert-flash.is-blinking { animation: none; }`. Any
-  future state/modifier CSS split has the same trap.
+  future state/modifier CSS split has the same trap. Because it already names `.alert-flash`,
+  this same rule **also covers the new slow `alert-breathe` breathe** — a reduced-motion viewer
+  falls back to the static `opacity: .85` glow with **no separate rule needed**.
 - **A parse failure currently looks calmer than an outage** (known issue, not fixed). If the
   OneUptime call returns HTTP 200 with a malformed or empty body, `buildMonitorModel` yields
   total 0, empty buckets and empty rows. The status pill correctly degrades to "Unknown", but
@@ -219,6 +231,13 @@ summary, and caches ~5s. Rationale:
   alerting really wants (today the baseline resets every time a tab reloads).
 
 ## Change history
+- 2026-08-14 — The standing (level-triggered) edge tint now **slowly breathes** its opacity
+  0→1→0 on a 7s ease-in-out loop (`@keyframes alert-breathe`) instead of holding a static tint,
+  so a still-broken screen draws a distant eye. The fast 0.7s `.is-blinking` event pulse still
+  out-specifies it, keeping "just changed" (fast) distinct from "still broken" (slow breathe);
+  tempo tuned with the developer (0.5→0.92/10s too subtle, 0→1/10s too slow → 0→1/7s). The
+  existing `prefers-reduced-motion` compound-selector rule already covers the new animation, so
+  reduced-motion falls back to the deliberately non-zero static `opacity: .85` glow. (jcardinal)
 - 2026-08-14 — Built the monitor status column on `/clickup/react` (split layout, solid status
   circle + legend + degraded/offline card) as components in the same document rather than a
   nested iframe, sharing one 5s poll; documented the OneUptime public status-page overview API

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.584",
+  "version": "1.0.586",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",