toga-ai 1.0.975 → 1.0.976

package/knowledge/1.0/apps/tools/features/design-demo-admin.md

@@ -6,7 +6,7 @@ project: Tools
 client: shared
 type: feature
 status: active
-updated: 2026-09-16
+updated: 2026-10-08
 owners: [jcardinal]
 files:
   - tools/_/app/design/github.php
@@ -17,6 +17,7 @@ files:
   - tools/_/app/frameworkindex.php
   - tools/_/app/nav.php
   - tools/composer.json
+  - tools/.ebextensions/009_setup_phpini.config
 related:
   - ../architecture.md
   - ../../../standards/frontend.md
@@ -87,6 +88,12 @@ Both sides are required: decoding only reads would make `renameTab()` compare a
 - Inline `window.DESIGN_CONFIG` uses `JSON_HEX_*` flags.
 - Input length caps, version-id regex guard, HTML content sniff on upload; no client-facing leakage of GitHub/curl error detail.
 
+### Upload size + timeout
+- Cap: `App_Design_Github::MAX_UPLOAD_BYTES` = 50 MB. GitHub warns on files >50 MB, blocks >100 MB.
+- php.ini (`.ebextensions/009_setup_phpini.config`): `upload_max_filesize=50M` / `post_max_size=55M`. **Keep these above `MAX_UPLOAD_BYTES`** — raise both together.
+- `ghApi` curl timeout = `GITHUB_TIMEOUT_SECONDS` (180s); a 50 MB file is ~67 MB as a base64 blob. If `json_encode` fails, `ghApi` logs and throws `RuntimeException` (never POSTs an empty body).
+- Apache has no `LimitRequestBody`; `memory_limit` 2G is enough.
+
 ### Access control
 Behind Tools SSO. The page self-guards with `App_Auth::requireAuth([...])` and `App_Page::validateCrossSiteRequestForgery()`; the nav action is gated to the `TOGa Technology` and `Development Team` personas. This is the key improvement over the old `forward` tool, which had **no** authentication.
 
@@ -98,6 +105,7 @@ Behind Tools SSO. The page self-guards with `App_Auth::requireAuth([...])` and `
 - **Contents API inlines only ≤1 MB** — read exports with the raw media type (see above).
 - **Publishing pushes to `forward`'s `_main`** and triggers EB auto-deploy; no staging.
 - **Double-escaped names (`H&H` shown literally, rename fails with "No such tab.")** — caused by values that arrived **already HTML-encoded** and were then correctly escaped once more at display. The render path was never wrong; no current code path produces the encoding (`createTab`/`createProject` and the JS transport `window.prompt` → `URLSearchParams` → `$postField` trim/`mb_substr` are clean), so encoded values entered from outside — a paste from rendered HTML, or a pre-fix build. Fixed defensively with `decodeEntities()` on both the read and request sides (see above). Generated project stubs were affected identically, because `buildStub()`'s single correct `htmlspecialchars()` was a *second* escape on a pre-encoded title; storing titles plain fixes the stubs too.
+- **Upload fails on a big export (e.g. 28 MB)** — hit the old 25 MB cap in php.ini and `MAX_UPLOAD_BYTES`. Fixed 2026-10-08 (now 50 MB). Change both places together.
 - Never hardcode the token in tracked source — a leaked `ghp_`/PAT must be rotated.
 
 ## Related

package/knowledge/1.0/apps/tools/workflows/deploy-to-elastic-beanstalk-al2023.md

@@ -6,7 +6,7 @@ project: Tools
 client: shared
 type: workflow
 status: active
-updated: 2026-09-16
+updated: 2026-10-08
 owners: [jcardinal, bala]
 files:
   - tools/.ebextensions/004_http_to_https.config
@@ -44,7 +44,7 @@ When migrating any 1.0 app's `.ebextensions` from AL2 to AL2023, rename/remove t
 
 The old approach ran `ebs/setup_phpini.php` (now superseded) which called `php_ini_scanned_files()`, parsed it to find the scan dir, and wrote there. On AL2023 that failed silently (it was wrapped in `ignoreErrors: true`), so `include_path` never picked up `/var/www/library`, producing fatal `require_once('_.php')` errors at runtime.
 
-The `application.ini` sets `include_path = ".:/var/www/library"`, upload/post limits (`upload_max_filesize=25M` / `post_max_size=30M`, raised from 16M so multi-MB design-demo HTML exports up to ~25MB post through — see `features/design-demo-admin.md`), `memory_limit = 2G`, `display_errors`, and loads the `redis.so` extension.
+The `application.ini` sets `include_path = ".:/var/www/library"`, upload/post limits (`upload_max_filesize=50M` / `post_max_size=55M`, kept above the design-demo 50 MB cap — see `features/design-demo-admin.md`), `memory_limit = 2G`, `display_errors`, and loads the `redis.so` extension.
 
 > **Do NOT configure the rediscluster session handler in `application.ini` (or any INI file) on this platform — it silently fails.** See "Redis sessions" below. Session `save_handler`/`save_path` are now set at **runtime via `ini_set()` in `tools/_/app/framework.php`**, not in `009_setup_phpini.config`. Two INI-file facts drove this (both verified 2026-08-14 on EB PHP 8.5 / AL2023):
 > - **The INI-file parser silently drops a `session.save_path` value of the form `"seed[]=host:port"`** — in *both* `/etc/php.d/*.ini` and the php-fpm pool (`www.conf` `php_value[...]`). `session.save_handler=rediscluster` applies but `save_path` stays `/tmp`, so `session_start()` fatals ("Failed to initialize storage module: rediscluster (path: /tmp)") on **every** request → full outage. CLI `php -d` with the same value works, confirming it is the INI-file parser, not the value itself.
@@ -93,7 +93,7 @@ The deploy clones `agilantsolutions/library` and `resources` via `020_setup_git_
 ### Config selection & DB wiring
 - **Which config file loads is chosen by the `ENVIRONMENT` env var, NOT the hostname.** `App_Config::getConfigFilename` resolves `config.<ENVIRONMENT>.ini`.
 - Config maps DB key **`db_<x>` → `[database_<x>]`** section; `App_Registry::get()` connects **lazily** on first use. `Client_True` is **`db_true`** (`reader1.client.database.togahub.com`).
-- Prod php.ini caps `upload_max_filesize=25M` / `post_max_size=30M` (`009_setup_phpini.config`) — multi-file uploads (e.g. the Legacy Email Notifier's xlsx trace exports) must stay under this.
+- Prod php.ini caps `upload_max_filesize=50M` / `post_max_size=55M` (`009_setup_phpini.config`) — multi-file uploads (e.g. the Legacy Email Notifier's xlsx trace exports) must stay under this.
 
 ### Local development
 - **Run locally with the `ENVIRONMENT` var pointing at your local config:**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.975",
+  "version": "1.0.976",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",