docs: weekly sync

docs/drupal-settings.md

@@ -12,7 +12,7 @@ Both files share most of their baseline overrides:
 - Overrides the Search API Solr connector to use the local `solr` service (`http://solr:8983/`, core `dev`).
 - Overrides SMTP settings to point at `localhost:1025` (a local mail-capture tool such as Mailhog), with blank credentials.
 - Defaults `file_private_path` to `../private` if not already set.
-- Disables Shield, TFA, IP restriction (`restrict_ip`), OpenTelemetry (`opentelemetry.settings.disable`), and clears the Fastly API key/site ID — security/CDN/observability modules that shouldn't be active locally.
+- Disables Shield, TFA, IP restriction (`restrict_ip`), route-by-IP restriction (`restrict_route_by_ip` — locks specific routes to server IPs, meaningless on local infra), OpenTelemetry (`opentelemetry.settings.disable`), and clears the Fastly API key/site ID — security/CDN/observability modules that shouldn't be active locally.
 - Sets `rebuild_access = TRUE` and `skip_permissions_hardening = TRUE`.
 - Excludes `devel`, `devel_a11y`, `devel_php`, `stage_file_proxy`, `twig_vardumper`, `upgrade_status`, and `drush_endpoint` from configuration sync (`config_exclude_modules`), so these dev-only modules never leak into exported config.
 - Includes an optional `settings.project.php` (in the same directory) if present, for project-specific overrides.

docs/git-hooks.md

@@ -14,12 +14,14 @@ Enforces that every commit message references a Teamwork ticket.
 
 ## pre-commit
 
-A multi-check guard over staged files. Any failing check blocks the commit (exit 1) unless noted:
+A multi-check guard over staged files. Any failing check blocks the commit (exit 1) unless noted.
+
+All checks that scan `system.performance.yml` or `core.extension.yml` exclude paths under `config/install/` or `config/optional/` (module-shipped default config that is not the site's active config, e.g. `web/core/modules/system/config/install/system.performance.yml`).
 
 1. Rejects staged `system.performance.yml` containing `preprocess: false` (CSS/JS aggregation disabled).
 2. Rejects staged `system.performance.yml` (excluding paths under `tests/`) containing `max_age: 0` (browser caching disabled).
 3. Rejects staged `system.performance.yml` (excluding `tests/`) containing `gzip: true` (AdvAgg GZIP enabled).
-4. Rejects staged `core.extension.yml` (excluding paths under `tests/`) enabling forbidden modules: `devel: 0`, `devel_php: 0`, `drush_endpoint: 0` (Drupal's YAML convention where `: 0` means "enabled"). If `.ddev/.env.anner` exists and `DDEV_UPSTREAM_PROVIDER` is `platform` or `upsun`, it additionally forbids enabling ` page_cache: 0` (the leading space is intentional, to avoid matching `dynamic_page_cache`).
+4. Rejects staged `core.extension.yml` (excluding paths under `tests/`) enabling forbidden modules: `devel: 0`, `devel_php: 0`, `drush_endpoint: 0` (Drupal's YAML convention where `: 0` means "enabled"). If `.ddev/.env.anner` exists, `DDEV_UPSTREAM_PROVIDER` is `platform` or `upsun`, **and** a CDN module (`fastly` or `cloudflare`) is enabled in `config/sync/core.extension.yml`, it additionally forbids enabling ` page_cache: 0` (the leading space is intentional, to avoid matching `dynamic_page_cache`). Without an invalidatable CDN, `page_cache` is a useful extra caching layer and is no longer forbidden.
 5. Checks for a CDN module (Fastly or Cloudflare) enabled in `config/sync/core.extension.yml` while `.platform/routes.yaml` exists; if a CDN is enabled but the routes file doesn't disable Upsun's route cache (`enabled: false` under cache), it blocks with a warning that route cache must be disabled behind a CDN.
 6. Rejects commits with staged files under a `devel_php/` folder.
 7. If `.ddev/addon-metadata/annertech-ddev/manifest.yaml` is staged with no/empty `version:` field, blocks — this implies a dev/unpublished version of the addon is in use.

docs/host-commands.md

@@ -8,7 +8,7 @@ These commands run on the developer's host machine (via `ddev <command>`), from
 
 ## Commands
 
-- `ai-prompts` — Interactive fzf menu ("AI Prompts Operations Centre") offering BackstopJS-init prompt generation (extracts test/reference domains, feeds a templated prompt to a chosen AI agent: Gemini, Copilot, Claude, Antigravity via `agy --prompt`, or Prompt which echoes the raw text for manual use), access-log forensics (GDPR-safe IP masking via `mask_ips.py` before sending log excerpts to an LLM; supports Gemini, Copilot, and Claude), and CSP Violation Triage (requires `config/sync/seckit.settings.yml`; sends the templated prompt from `scripts/prompts/csp-violation-triage.md` — which has the chosen agent query the site's `watchdog` table for recent Security Kit CSP violation reports and update the `seckit_xss.csp` directives in `seckit.settings.yml` accordingly — to Gemini, Copilot, Claude (`claude --model sonnet --effort low`), Antigravity, or Prompt). Aliases: `ai`.
+- `ai-prompts` — Interactive fzf menu ("AI Prompts Operations Centre") offering three operations. The agent (Claude, Codex, Antigravity via `agy --prompt`, or Prompt which echoes the raw text) is selected once after the operation is chosen and applies to whichever operation runs. Operations: BackstopJS-init prompt generation (extracts test/reference domains from the DDEV container and feeds a templated prompt to the chosen agent); access-log forensics (GDPR-safe prefix-preserving IPv4 masking via `mask_ips.py` before sending log excerpts to the chosen agent — mapping kept locally for reverse lookup); CSP Violation Triage (requires `config/sync/seckit.settings.yml`; sends the templated prompt from `scripts/prompts/csp-violation-triage.md` — which has the agent query the site's `watchdog` table for recent Security Kit CSP violation reports and update the `seckit_xss.csp` directives in `seckit.settings.yml` accordingly — to the chosen agent). Aliases: `ai`.
 - `annertech-tip-of-the-day` — Installs (or removes with `-u`/`--uninstall`) a custom DDEV "tip of the day" remote-config entry in `~/.ddev/global_config.yaml` pointing at Annertech's tips repo, clearing DDEV state so the change takes effect. Note: header `## Usage` says `install-tips`, which is stale/inconsistent with the actual filename.
 - `backstop-public` — Copies the BackstopJS HTML report into the web root so it's reachable over HTTP, prints the URL, and deletes the copy automatically after 5 minutes.
 - `branch` — Creates a git branch named `YYYYMM_T-<taskid>__<description>` from a Teamwork card URL/ID and description. Blocks branching from forbidden base branches (dev/develop/development/stage/staging) and warns to pull first when branching from main/master. Aliases: `branch`, `br`.
@@ -23,7 +23,7 @@ These commands run on the developer's host machine (via `ddev <command>`), from
 - `env-setup` — Interactive fzf menu to set the Teamwork board (`TEAMWORK_PROJECT_ID`), toggle the project's LIVE/BUILD mode, or record the Teamwork people associated with the project — Guardian (`TEAMWORK_GUARDIAN_ID`), Deputy (`TEAMWORK_DEPUTY_ID`), DM (`TEAMWORK_DM_ID`), and AM (`TEAMWORK_AM_ID`) — for use by commands like `package-checker-and-card-maker --auto-assign`. All values are persisted to `.ddev/.env.anner` via `ddev dotenv set`.
 - `githooks` — Copies all files from `.ddev/scripts/git-hooks/` into `.git/hooks` to install the project's git hooks.
 - `glab-mr-link` — Opens the current branch's GitLab merge request in a browser (`-o`) or copies its URL to the clipboard. Aliases: `mr-link`.
-- `holdmybeer` — One-shot start-of-work automation: stashes local changes, pulls the default branch, fetches the Teamwork card title, creates a branch, starts DDEV, pulls the remote DB, and exports config. Requires `TEAMWORK_API_KEY`/`TEAMWORK_DOMAIN`. Aliases: `holdmybeer`, `hmb`.
+- `holdmybeer` — One-shot start-of-work automation: stashes local changes, pulls the default branch, fetches the Teamwork card title, creates a branch, starts DDEV, pulls the remote DB, exports config, and prints a one-time login link (`ddev drush uli`) before finishing. Requires `TEAMWORK_API_KEY`/`TEAMWORK_DOMAIN`. Aliases: `holdmybeer`, `hmb`.
 - `lints` — Checks for installed lint tooling and prints the command to run it; currently only checks for `vendor/bin/twig-cs-fixer` (Twig linting), despite the more generic description.
 - `loghound` — Stdlib-only Python tool for offline forensic analysis of Apache access logs: status-code breakdowns, 5xx/404 deep dives, IP subnet clustering, request-flood detection, crawler detection (using `known_ips.json`), traffic spike detection, and a severity-scored list of CIDR ranges worth blocking. Supports `--since/--until`, `--focus`, `--ip`, and `--json` flags; auto-discovers `logs/*access.log*` if no file is given.
 - `login` — Opens a `drush uli` one-time-login link in a browser (or prints the URL if `ANNERTECH_LOCAL_DEV` is set).
@@ -35,7 +35,7 @@ These commands run on the developer's host machine (via `ddev <command>`), from
 - `protect` — Enables/disables/resets HTTP basic-auth protection on a nixOS-hosted dev project via nginx config and htpasswd; no-ops unless `ANNERTECH_LOCAL_DEV` is set.
 - `remote-db` — Pulls the latest database (skipping files) from the configured upstream provider (`DDEV_UPSTREAM_PROVIDER` in `.ddev/.env.anner`) via `ddev pull <provider> --skip-files -y`.
 - `remote-files` — Pulls the latest files (skipping the DB) from the upstream provider via `ddev pull <provider> --skip-db -y`.
-- `sanity-check` — Runs a suite of Drupal/Composer/DDEV/Upsun health checks (version constraints, performance settings, extensions, composer audit, Solr, Upsun project config, APCu, CDN, botbuster) by sourcing scripts from `commands/host/_lib/`. The safe-uninstall check is currently disabled (commented out) pending a fix for a bug in it. Supports `-s` (silent), `-b`/`--best-practices`, `-o`/`--offline`; exits 2 on critical errors (used to block pushes), 1 on regular errors.
+- `sanity-check` — Runs a suite of Drupal/Composer/DDEV/Upsun health checks (version constraints, performance settings, extensions, field_group accordion deprecation, composer audit, Solr, Upsun project config, APCu, CDN, botbuster) by sourcing scripts from `commands/host/_lib/`. The safe-uninstall check is currently disabled (commented out) pending a fix for a bug in it. Supports `-s` (silent), `-b`/`--best-practices`, `-o`/`--offline`; exits 2 on critical errors (used to block pushes), 1 on regular errors.
 - `teamwork-operations` — Interactive fzf "Teamwork Operations Centre" dispatching to `open-issue`, `tw-comment`, `tw-timelog`, `tw-description`, `tw-new`, `tw-batch-card-maker`, plus branch creation/switching helpers. Aliases: `tw`.
 - `tests` — Detects which test suites (Backstop, Behat, Bruno, Cypress, PHPUnit) are configured in the project and prints the commands to run each; for Cypress it also reminds you to run `xhost +local:` and enable the `drush_endpoint` module first.
 - `timew` — Tags the current Timewarrior interval with the branch's `T-<id>` task and the project directory name.