@mokoenterprises/mokossh-mcp 3.8.1 → 3.9.0

package/.mokogit/ISSUE_TEMPLATE/config.yml

@@ -2,16 +2,16 @@
 blank_issues_enabled: true
 contact_links:
   - name: 💼 Enterprise Support
-    url: https://mokoconsulting.tech/enterprise
+    url: https://mokoenterprises.us/enterprise
     about: Enterprise-level support and consultation services
   - name: 💬 Ask a Question
-    url: https://mokoconsulting.tech/
+    url: https://mokoenterprises.us/
     about: Get help or ask questions through our website
   - name: 📚 MokoCLI Documentation
-    url: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+    url: https://git.mokoenterprises.us/MokoEnterprises/mokocli
     about: View our coding standards and best practices
   - name: 🔒 Report a Security Vulnerability
-    url: https://git.mokoconsulting.tech/MokoConsulting/.github-private/security/advisories/new
+    url: https://git.mokoenterprises.us/MokoEnterprises/.github-private/security/advisories/new
     about: Report security vulnerabilities privately (for critical issues)
   - name: 💡 Community Discussions
     url: https://github.com/orgs/mokoconsulting-tech/discussions

package/.mokogit/ISSUE_TEMPLATE/feature_request.md

@@ -37,7 +37,7 @@ If you have ideas about how this could be implemented, share them here:
 Add any other context, mockups, or screenshots about the feature request here.
 
 ## Relevant Standards
-Does this relate to any standards in [MokoCLI](https://git.mokoconsulting.tech/MokoConsulting/mokocli)?
+Does this relate to any standards in [MokoCLI](https://git.mokoenterprises.us/MokoEnterprises/mokocli)?
 - [ ] Accessibility (WCAG 2.1 AA)
 - [ ] Localization (en_US/en_GB)
 - [ ] Security best practices

package/.mokogit/ISSUE_TEMPLATE/security.md

@@ -35,7 +35,7 @@ Use this template only for:
 <!-- Describe how this could be addressed -->
 
 ## Standards Reference
-Does this relate to security standards in [MokoCLI](https://git.mokoconsulting.tech/MokoConsulting/mokocli)?
+Does this relate to security standards in [MokoCLI](https://git.mokoenterprises.us/MokoEnterprises/mokocli)?
 - [ ] SPDX license identifiers
 - [ ] Secret management
 - [ ] Dependency security

package/.mokogit/actions/resolve-source-dir/action.yml

@@ -1,4 +1,4 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 name: "Resolve source dir"

package/.mokogit/workflows/apidocs.yml

@@ -1,10 +1,10 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGIT.Workflow
 # INGROUP: MokoCLI.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoenterprises.us/MokoEnterprises/Template-Generic
 # PATH: /.mokogit/workflows/apidocs.yml
 #
 # apidocs.yml — UNIVERSAL API-docs → wiki (synced to every repo via the universal
@@ -62,9 +62,9 @@ jobs:
             sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1 || true
           fi
           rm -rf /tmp/mokocli
-          REG='{"type":"composer","url":"https://git.mokoconsulting.tech/api/packages/MokoConsulting/composer"}'
+          REG='{"type":"composer","url":"https://git.mokoenterprises.us/api/packages/MokoEnterprises/composer"}'
           if composer create-project --no-install --no-interaction --no-progress --quiet \
-               --repository="${REG}" mokoconsulting/mokocli /tmp/mokocli >/dev/null 2>&1 \
+               --repository="${REG}" mokoenterprises/mokocli /tmp/mokocli >/dev/null 2>&1 \
              && [ -f /tmp/mokocli/cli/docs_php_reference.php ]; then
             echo "MOKO_CLI=/tmp/mokocli/cli" >> "$GITHUB_ENV"
             echo "Installed mokocli fresh from the Composer registry."
@@ -128,12 +128,12 @@ jobs:
           if [ -z "$TOKEN" ]; then echo "::warning::no MOKOGIT_TOKEN — skipping wiki publish"; exit 0; fi
           REPO="${{ github.event.repository.name }}"; OWNER="${{ github.repository_owner }}"
           rm -rf /tmp/wiki
-          if ! git clone -q "https://x-access-token:${TOKEN}@git.mokoconsulting.tech/${OWNER}/${REPO}.wiki.git" /tmp/wiki 2>/dev/null; then
+          if ! git clone -q "https://x-access-token:${TOKEN}@git.mokoenterprises.us/${OWNER}/${REPO}.wiki.git" /tmp/wiki 2>/dev/null; then
             echo "::warning::wiki clone failed (wiki may not be initialised) — skipping"; exit 0
           fi
           cp "$FILE" "/tmp/wiki/${PAGE}.md"
           cd /tmp/wiki
-          git config user.name "Moko Consulting"; git config user.email "hello@mokoconsulting.tech"
+          git config user.name "Moko Enterprises"; git config user.email "hello@mokoenterprises.us"
           git add -A
           if git diff --cached --quiet; then echo "wiki already up to date"; exit 0; fi
           git commit -q -m "docs(wiki): update ${PAGE} (moko ${{ steps.gen.outputs.kind }} docs) [skip ci]"

package/.mokogit/workflows/auto-assign.yml

@@ -1,4 +1,4 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION

package/.mokogit/workflows/auto-dev-issue.yml

@@ -1,6 +1,6 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 #
-# This file is part of a Moko Consulting project.
+# This file is part of a Moko Enterprises project.
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 #

package/.mokogit/workflows/auto-release.yml

@@ -1,14 +1,14 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGIT.Workflow
 # INGROUP: MokoCLI.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoenterprises.us/MokoEnterprises/Template-Generic
 # PATH: /.mokogit/workflows/auto-release.yml
-# VERSION: 07.24.00
-# BRIEF: NEW (07.24.00): npmjs.org publish now FAILS LOUD (::error:: + exit $rc) on an AUTHORIZATION error (404 "not in this registry" / 401 / 403 / ENEEDAUTH / EOTP) instead of swallowing EVERY failure as a non-failing ::warning:: — a missing-scope / unauthorized / revoked / expired NPM_TOKEN previously hid behind a green release fleet-wide (the "secondary registry, not failing the run" catch masked a 404 PUT, which is exactly how npm reports an unauthorized scoped write; CI had in fact NEVER successfully published any MCP package to npmjs while every run reported success). Transient/5xx/network failures still stay a non-failing ::warning:: (npmjs is the SECONDARY mirror; the MokoGIT registry is primary and already hard-fails), and an unset NPM_TOKEN still skips cleanly — so repos that do not publish to npmjs are 100% unaffected. PREVIOUS (07.23.00): "Vendor PHP dependencies (build-time)" added to BOTH publish legs (promote-rc + stable) — this workflow had NO build-time composer vendoring at all, so any component declaring runtime PHP deps via a sub-package composer.json (vendor-dir admin/vendor, e.g. mPDF in MokonyxCRM/MokonyxCRMDCM) shipped its rc/stable zip WITHOUT admin/vendor while the component manifest lists <folder>vendor</folder> — JInstaller then aborts the ENTIRE package install on-site ("File does not exist [ROOT][TMP]/.../admin/vendor" → "Failed to copy administrator files"). The step mirrors pre-release.yml 07.15.00: no-op without a sub-package composer.json; provisions ext-gd when missing (the release runners' php-cli lacks it, which failed mpdf dependency RESOLUTION outright); verifies the CONFIGURED vendor-dir (composer config vendor-dir) materialized autoload.php; FAILS the build loud when vendoring fails for a package whose manifest ships <folder>vendor</folder> (a green build with an install-bricking artifact is strictly worse than a red build); fail-soft warning for packages whose manifests do not reference vendor/. Runs before `moko publish` (release_publish.php → release_package.php zips the plain working tree; vendor/ was never excluded — the tree simply never had it in CI). PREVIOUS (07.22.00): #498 — the #469 SRC_DIR gate no longer self-traps, and the fast-merge guard is MINOR-identity aware (fixes stable version never advancing; MokoCLI stuck re-publishing v10.20.00). (1) The gate read SRC_DIR with grep|sed, capturing the LITERAL unexpanded `$(shell …)` from the fleet-standard `SRC_DIR := $(shell [ -d src ] && echo src || echo source)` — an unmatchable directory that forced should_bump=false on EVERY push even when source changed. It now resolves SRC_DIR via `make --eval` expansion, falls back to the grep|sed read only if make is unavailable, nulls out a still-unexpanded `$(...)`/backtick value, and treats a declared-but-NONEXISTENT SRC_DIR (repos with code in cli/lib/bin, not src/source) as the non-source denylist fallback instead of an unmatchable INCLUSION prefix. (2) The "Guarantee monotonic release version (fast-merge bump guard)" compared the FULL version, so dev's per-merge PATCH bumps (10.20.00→10.20.04) fooled it into "normal path, no heal" and it re-published the already-released vMAJOR.MINOR.00. It now compares the MINOR identity (MAJOR.MINOR), so a fast dev→stable merge with no promote-rc cuts a new MINOR. Fleet-wide release-semantics change — validate on one repo before syncing. PREVIOUS (07.21.00): #469 — gate the version BUMP on whether the push touched the Makefile SRC_DIR. The former non-code paths-ignore denylist on the push trigger is REMOVED: a docs/workflow/sample push no longer skips the pipeline, it now RUNS in no-bump "update the existing stable release in place" mode (re-stamps the UNCHANGED current version via the existing `moko publish --bump none --no-commit`, refreshes notes/assets, no version advance, no new vNN tag). A new early step "Resolve SRC_DIR bump gate (#469)" (id: srcgate) decides should_bump: (1) ELECTRON (file-detected) or opt-out vars.RELEASE_SRCDIR_GATE=off -> BYPASS, always bump as today (electron has NO source dir, so a naive SRC_DIR test would never bump — a release-breaking trap); (2) else SRC_DIR is REQUIRED — a non-electron repo with no resolvable SRC_DIR FAILS LOUD (::error:: + exit 1), never silently never-bump; (3) else diff the push range (github.event.before..GITHUB_SHA, with a HEAD^1 / merge-base fallback) intersected with ${SRC_DIR}/ — source hit -> should_bump=true, none -> should_bump=false. workflow_dispatch always bumps. The self-heal monotonic bump + the new vNN semver tag are now gated on should_bump!='false' so no-bump mode keeps the version PUT; the publish + "Update release notes and reconcile changelog" (channel-pointer resolution) run on BOTH paths to refresh the current release. Loop-safety is unchanged: the job if: still re-checks [skip ci]/[skip sync], so the workflow's own commits never re-trigger. Fleet-wide release-semantics change — validate on one repo before syncing. PREVIOUS (07.20.00): the dev/promote bump + release steps now name the per-run token env var GITHUB_TOKEN (was the misleadingly-named MOKOGIT_TOKEN; the VALUE was always ${{ github.token }}). All token use in this workflow is SAME-REPO (release API, the release_bump_dev dev base bump, pushes to its own repo) — the org MOKOGIT_TOKEN secret is not referenced here. Naming-only; no behavior change. Mirrors the pre-release.yml fix (MokoGIT#1721). PREVIOUS: NEW (07.19.00): #1621 Phase 6 / .mokogit-private#76 — resolve the CURRENT stable release by its CHANNEL POINTER, not by a fixed tag_name=stable. Under version-primary releases (a release is born with the immutable tag_name=vNN and `stable`/`rc` attached as movable is_channel tags), GET /releases/tags/stable no longer resolves the current stable release, which would break two steps that read "the last released version". Both now call GET /repos/{owner}/{repo}/releases/channel/stable (#1702 — resolves whichever release the `stable` channel points at via ReleaseStreamMap) with a GRACEFUL FALLBACK to the legacy GET /releases/tags/stable for forges predating #1702 (the channel route 404s pre-rollout and the rolling `stable` tag still exists). (1) The monotonic-version guard ("Guarantee monotonic release version") resolves ROLLING_LAST by parsing the same `VERSION: NN.NN.NN` out of the channel-resolved release NAME. (2) "Update release notes and reconcile changelog" resolves the stable RELEASE_ID + VERSION the same channel-first way. The #386 integrity gate is UNCHANGED (it already keys off the immutable vNN version tag). SEQUENCING unchanged: do NOT enable in prod until #1702 server support is on stable/prod; works pre-#1702 via the fallback. PREVIOUS (07.18.00): #1621 Phase 6 — version/* BRANCHES retired in favor of dual-tagged version RELEASES. REMOVED three now-redundant steps: "Step 12: Create version branch from main", "Step 13: Prune superseded-major version branches", and "Advance rolling channel tag via git". A release's permanent version identity is now the git tag v<version>, attached by the publish as a MOVABLE channel tag on the dual-tagged release (MokoCLI release_publish -> release_create channel_tags[]/update_stream; the forge attaches/moves the tag at the release commit via AttachChannelTag server-side) — so a new cut is born dual-tagged (rolling `stable`/`release-candidate` primary tag + permanent v<version> channel tag) and the channel tag MOVES onto the new release instead of a new version/* branch being created. The rolling `stable` tag is still pinned by release_create forceTagRef() (#808), so the "Advance rolling channel tag" force-push was redundant. KEPT UNCHANGED: "Create semver tag" (v<version>), the #386 integrity gate (still resolves tags/stable to the built commit), and the monotonic guard (still reads the stable release name VERSION: NN.NN.NN). Pruning EXISTING version/* branches is a SEPARATE one-time manual reconcile — not done here. SEQUENCING: do NOT enable in prod until the #1621 SERVER channel_tags support is on stable/prod. PREVIOUS (07.17.00): Setup MokoCLI tools no longer installs a STALE mokocli during the registry publish-lag window (#1671). After the fresh registry install, the step now compares the installed /tmp/mokocli PROJECT_VERSION against the /opt/mokocli failsafe and PREFERS whichever is NEWER (sort -V), and the opportunistic /opt refresh is gated to only move FORWARD (never downgrade /opt when it is the newer, just-deployed copy). Backward-compatible: runners with no /opt/mokocli use the registry copy exactly as before. PREVIOUS (07.16.00): release-integrity + dev-channel fixes. (1) A new pre-publish "no stale (pre-merge) tree" guard (#428/MokoCLI#901) hard-FAILS the release if the triggering GITHUB_SHA is an ANCESTOR of the current branch tip (a concurrent merge landed mid-run) -- otherwise a green, version-bumped release silently ships old code missing that merge (reproduced: built ef8c1a5d while tip was 2740342). Fail-open on any unresolved/replica-lagged tip so a good release is never falsely blocked. Complements the mokocli engine assertion (packaged-tree == GITHUB_SHA), which cannot see that GITHUB_SHA itself trails the tip. (2) The "Post-release: Reset dev version" safety-net (#309/MokoCLI#900) no longer swallows failure: a failed dev-advance now emits ::error:: + a job-summary block (dev-channel would trail stable), and a SUCCESSFUL advance dispatches pre-release.yml (development) to actually publish the leading dev build -- the advance commit is [skip ci]+paths-ignored and never auto-fires. Stays green (continue-on-error) since stable already published. NEW (07.15.00): the rolling stable channel tag is now advanced via a git force-push BEFORE the #386 integrity gate. MokoGIT's tags API 405s on the release-attached `stable` tag, so release_publish.php could not move it ("Could not pin tag stable ... HTTP 405") and every Joomla/electron stable cut left the tag lagging the freshly-built commit -- red-failing a correct release on the integrity gate. A new step git-force-pushes refs/tags/stable to the built HEAD (force-push allowlist -- the same escape hatch the rc BRANCH pin already uses), so the gate passes and no manual tag repoint is needed. PREVIOUS (07.14.00): integrity gate #386 no longer false-fails. It compared the published tag against GITHUB_SHA (the triggering commit), but the publish step commits the CHANGELOG entry ("build NN.NN.NN [skip ci]") and mokocli pins the channel tag + semver tag to that POST-PUBLISH HEAD -- so every cut whose CHANGELOG wasn't pre-seeded on dev (e.g. a version set straight on the release branch) diverged by one commit and red-failed a correct release. The gate now compares against the actual built/published HEAD (git rev-parse HEAD, falling back to GITHUB_SHA), which equals what the tag is pinned to in both the commit and no-commit cases while still catching a tag pinned to a commit we did NOT build; the semver tag is pinned to the same built HEAD for consistency. PREVIOUS (07.13.00): RC is ON-DEMAND ONLY. The `pull_request` trigger (RC-preview on a PR to main/stable) is REMOVED and the promote-rc job now runs solely on workflow_dispatch action=promote-rc. Only dev + stable release automatically (dev via pre-release.yml push->dev; stable via the push->main release job here); alpha/beta/rc never auto-cut. PREVIOUS (07.12.00): electron repos create NO release on ANY channel (RC enabled=false + stable publish/tag/notes/integrity guarded on is_electron; opt back in with vars.ELECTRON_CI_BUILD=true) and build NO installer in CI — always built locally + uploaded manually; the dev/promote version BUMP still runs. Template-Generic #390. NEW (07.11.00): the electron installer build/attach steps (electron-builder via Wine/Xvfb) are gated to MANUAL workflow_dispatch only (`&& github.event_name == 'workflow_dispatch'`). An automatic push no longer auto-builds electron installers (heavy ~90m, runner-fragile — OOM/Wine-zombie; migrating to mokocli ElectronPackager, MokoCLI #756/#758). The version bump, CHANGELOG, tag and npm publish STILL run on push — only the electron installer is skipped and pushed MANUALLY via dispatch. Non-electron platforms (joomla/go/npm) unaffected. Template-Generic #390. Universal build & release - BUMP-ON-DEV: base version + CHANGELOG promoted on dev pre-promotion (promote-rc), main publishes --bump none --no-commit so it never diverges from dev. MokoCLI build agent (moko publish). NEW (07.06.00): npm stable publishing ABSORBED here from Template-NPM's retired npm-publish.yml as npm-gated dual-registry steps (MokoGIT registry via per-run token + npmjs.org best-effort), replacing the former npm-publish.yml dispatch. No-Makefile repos SKIP the release job gracefully (green) instead of failing. Conflict-marker scan reads git-tracked files only (git ls-files | xargs grep) so vendored/generated trees can't false-match. NEW (07.07.00): npm stamp normalizes the zero-padded Makefile PROJECT_VERSION (NN.NN.NN) to strict semver via awk before `npm version`, and an unstampable version now HARD-FAILS instead of silently keeping the old package.json version (#382). NEW (07.00.00): `moko assets:optimize` artifact-time step added before publish (graceful-skip on non-asset repos); Setup MokoCLI tools makes the fresh `moko` executable + first on PATH to fix exit-126 (mokocli #650).
+# VERSION: 07.25.01
+# BRIEF: NEW (07.25.01): consistency follow-up to 07.25.00 — the monotonic self-heal's DEV CARRY-FORWARD now also bumps PATCH, not MINOR. After the self-heal patch-bumps the stable base, it carries that bump forward to dev via `release_bump_dev.php --path . --branch dev --bump patch` (was `--bump minor`), so a direct-push / fast-merge hotfix does NOT inflate the dev base by a full minor — dev and stable stay aligned on the PATCH heal. UNCHANGED: the promote-rc job's planned-release dev PRE-bump (`release_bump_dev.php --path . --branch dev --bump minor`) still stays MINOR; only the self-heal carry-forward inside the fast-merge bump guard changes minor->patch. PREVIOUS (07.25.00): the "Guarantee monotonic release version (fast-merge bump guard)" self-heal now bumps PATCH, not MINOR. On a push to stable whose version was NOT pre-bumped on dev — a direct admin push, or a fast dev->stable merge that landed before promote-rc ran its dev pre-bump — the monotonic guard previously self-healed with a MINOR bump (`version_bump.php --minor --min-version "$LAST"`), minting a new MINOR for an unplanned change. It now self-heals with a PATCH bump (`version_bump.php --patch --min-version "$LAST"`), matching hotfix / direct-admin-push semantics: `--min-version "$LAST"` still guarantees the healed version is strictly above the last release, so monotonicity is preserved. PLANNED ladder releases are UNCHANGED — the promote-rc dev pre-bump (`release_bump_dev.php --bump minor`) and the stable `moko publish --bump none --no-commit` are untouched; only the non-pre-bumped self-heal path changes minor->patch. The dev side already patch-bumps per push (pre-release.yml `release_bump_dev.php --branch dev --bump patch`), so the healed PATCH carries forward consistently. PREVIOUS (07.24.00): npmjs.org publish now FAILS LOUD (::error:: + exit $rc) on an AUTHORIZATION error (404 "not in this registry" / 401 / 403 / ENEEDAUTH / EOTP) instead of swallowing EVERY failure as a non-failing ::warning:: — a missing-scope / unauthorized / revoked / expired NPM_TOKEN previously hid behind a green release fleet-wide (the "secondary registry, not failing the run" catch masked a 404 PUT, which is exactly how npm reports an unauthorized scoped write; CI had in fact NEVER successfully published any MCP package to npmjs while every run reported success). Transient/5xx/network failures still stay a non-failing ::warning:: (npmjs is the SECONDARY mirror; the MokoGIT registry is primary and already hard-fails), and an unset NPM_TOKEN still skips cleanly — so repos that do not publish to npmjs are 100% unaffected. PREVIOUS (07.23.00): "Vendor PHP dependencies (build-time)" added to BOTH publish legs (promote-rc + stable) — this workflow had NO build-time composer vendoring at all, so any component declaring runtime PHP deps via a sub-package composer.json (vendor-dir admin/vendor, e.g. mPDF in MokonyxCRM/MokonyxCRMDCM) shipped its rc/stable zip WITHOUT admin/vendor while the component manifest lists <folder>vendor</folder> — JInstaller then aborts the ENTIRE package install on-site ("File does not exist [ROOT][TMP]/.../admin/vendor" → "Failed to copy administrator files"). The step mirrors pre-release.yml 07.15.00: no-op without a sub-package composer.json; provisions ext-gd when missing (the release runners' php-cli lacks it, which failed mpdf dependency RESOLUTION outright); verifies the CONFIGURED vendor-dir (composer config vendor-dir) materialized autoload.php; FAILS the build loud when vendoring fails for a package whose manifest ships <folder>vendor</folder> (a green build with an install-bricking artifact is strictly worse than a red build); fail-soft warning for packages whose manifests do not reference vendor/. Runs before `moko publish` (release_publish.php → release_package.php zips the plain working tree; vendor/ was never excluded — the tree simply never had it in CI). PREVIOUS (07.22.00): #498 — the #469 SRC_DIR gate no longer self-traps, and the fast-merge guard is MINOR-identity aware (fixes stable version never advancing; MokoCLI stuck re-publishing v10.20.00). (1) The gate read SRC_DIR with grep|sed, capturing the LITERAL unexpanded `$(shell …)` from the fleet-standard `SRC_DIR := $(shell [ -d src ] && echo src || echo source)` — an unmatchable directory that forced should_bump=false on EVERY push even when source changed. It now resolves SRC_DIR via `make --eval` expansion, falls back to the grep|sed read only if make is unavailable, nulls out a still-unexpanded `$(...)`/backtick value, and treats a declared-but-NONEXISTENT SRC_DIR (repos with code in cli/lib/bin, not src/source) as the non-source denylist fallback instead of an unmatchable INCLUSION prefix. (2) The "Guarantee monotonic release version (fast-merge bump guard)" compared the FULL version, so dev's per-merge PATCH bumps (10.20.00→10.20.04) fooled it into "normal path, no heal" and it re-published the already-released vMAJOR.MINOR.00. It now compares the MINOR identity (MAJOR.MINOR), so a fast dev→stable merge with no promote-rc cuts a new MINOR. Fleet-wide release-semantics change — validate on one repo before syncing. PREVIOUS (07.21.00): #469 — gate the version BUMP on whether the push touched the Makefile SRC_DIR. The former non-code paths-ignore denylist on the push trigger is REMOVED: a docs/workflow/sample push no longer skips the pipeline, it now RUNS in no-bump "update the existing stable release in place" mode (re-stamps the UNCHANGED current version via the existing `moko publish --bump none --no-commit`, refreshes notes/assets, no version advance, no new vNN tag). A new early step "Resolve SRC_DIR bump gate (#469)" (id: srcgate) decides should_bump: (1) ELECTRON (file-detected) or opt-out vars.RELEASE_SRCDIR_GATE=off -> BYPASS, always bump as today (electron has NO source dir, so a naive SRC_DIR test would never bump — a release-breaking trap); (2) else SRC_DIR is REQUIRED — a non-electron repo with no resolvable SRC_DIR FAILS LOUD (::error:: + exit 1), never silently never-bump; (3) else diff the push range (github.event.before..GITHUB_SHA, with a HEAD^1 / merge-base fallback) intersected with ${SRC_DIR}/ — source hit -> should_bump=true, none -> should_bump=false. workflow_dispatch always bumps. The self-heal monotonic bump + the new vNN semver tag are now gated on should_bump!='false' so no-bump mode keeps the version PUT; the publish + "Update release notes and reconcile changelog" (channel-pointer resolution) run on BOTH paths to refresh the current release. Loop-safety is unchanged: the job if: still re-checks [skip ci]/[skip sync], so the workflow's own commits never re-trigger. Fleet-wide release-semantics change — validate on one repo before syncing. PREVIOUS (07.20.00): the dev/promote bump + release steps now name the per-run token env var GITHUB_TOKEN (was the misleadingly-named MOKOGIT_TOKEN; the VALUE was always ${{ github.token }}). All token use in this workflow is SAME-REPO (release API, the release_bump_dev dev base bump, pushes to its own repo) — the org MOKOGIT_TOKEN secret is not referenced here. Naming-only; no behavior change. Mirrors the pre-release.yml fix (MokoGIT#1721). PREVIOUS: NEW (07.19.00): #1621 Phase 6 / .mokogit-private#76 — resolve the CURRENT stable release by its CHANNEL POINTER, not by a fixed tag_name=stable. Under version-primary releases (a release is born with the immutable tag_name=vNN and `stable`/`rc` attached as movable is_channel tags), GET /releases/tags/stable no longer resolves the current stable release, which would break two steps that read "the last released version". Both now call GET /repos/{owner}/{repo}/releases/channel/stable (#1702 — resolves whichever release the `stable` channel points at via ReleaseStreamMap) with a GRACEFUL FALLBACK to the legacy GET /releases/tags/stable for forges predating #1702 (the channel route 404s pre-rollout and the rolling `stable` tag still exists). (1) The monotonic-version guard ("Guarantee monotonic release version") resolves ROLLING_LAST by parsing the same `VERSION: NN.NN.NN` out of the channel-resolved release NAME. (2) "Update release notes and reconcile changelog" resolves the stable RELEASE_ID + VERSION the same channel-first way. The #386 integrity gate is UNCHANGED (it already keys off the immutable vNN version tag). SEQUENCING unchanged: do NOT enable in prod until #1702 server support is on stable/prod; works pre-#1702 via the fallback. PREVIOUS (07.18.00): #1621 Phase 6 — version/* BRANCHES retired in favor of dual-tagged version RELEASES. REMOVED three now-redundant steps: "Step 12: Create version branch from main", "Step 13: Prune superseded-major version branches", and "Advance rolling channel tag via git". A release's permanent version identity is now the git tag v<version>, attached by the publish as a MOVABLE channel tag on the dual-tagged release (MokoCLI release_publish -> release_create channel_tags[]/update_stream; the forge attaches/moves the tag at the release commit via AttachChannelTag server-side) — so a new cut is born dual-tagged (rolling `stable`/`release-candidate` primary tag + permanent v<version> channel tag) and the channel tag MOVES onto the new release instead of a new version/* branch being created. The rolling `stable` tag is still pinned by release_create forceTagRef() (#808), so the "Advance rolling channel tag" force-push was redundant. KEPT UNCHANGED: "Create semver tag" (v<version>), the #386 integrity gate (still resolves tags/stable to the built commit), and the monotonic guard (still reads the stable release name VERSION: NN.NN.NN). Pruning EXISTING version/* branches is a SEPARATE one-time manual reconcile — not done here. SEQUENCING: do NOT enable in prod until the #1621 SERVER channel_tags support is on stable/prod. PREVIOUS (07.17.00): Setup MokoCLI tools no longer installs a STALE mokocli during the registry publish-lag window (#1671). After the fresh registry install, the step now compares the installed /tmp/mokocli PROJECT_VERSION against the /opt/mokocli failsafe and PREFERS whichever is NEWER (sort -V), and the opportunistic /opt refresh is gated to only move FORWARD (never downgrade /opt when it is the newer, just-deployed copy). Backward-compatible: runners with no /opt/mokocli use the registry copy exactly as before. PREVIOUS (07.16.00): release-integrity + dev-channel fixes. (1) A new pre-publish "no stale (pre-merge) tree" guard (#428/MokoCLI#901) hard-FAILS the release if the triggering GITHUB_SHA is an ANCESTOR of the current branch tip (a concurrent merge landed mid-run) -- otherwise a green, version-bumped release silently ships old code missing that merge (reproduced: built ef8c1a5d while tip was 2740342). Fail-open on any unresolved/replica-lagged tip so a good release is never falsely blocked. Complements the mokocli engine assertion (packaged-tree == GITHUB_SHA), which cannot see that GITHUB_SHA itself trails the tip. (2) The "Post-release: Reset dev version" safety-net (#309/MokoCLI#900) no longer swallows failure: a failed dev-advance now emits ::error:: + a job-summary block (dev-channel would trail stable), and a SUCCESSFUL advance dispatches pre-release.yml (development) to actually publish the leading dev build -- the advance commit is [skip ci]+paths-ignored and never auto-fires. Stays green (continue-on-error) since stable already published. NEW (07.15.00): the rolling stable channel tag is now advanced via a git force-push BEFORE the #386 integrity gate. MokoGIT's tags API 405s on the release-attached `stable` tag, so release_publish.php could not move it ("Could not pin tag stable ... HTTP 405") and every Joomla/electron stable cut left the tag lagging the freshly-built commit -- red-failing a correct release on the integrity gate. A new step git-force-pushes refs/tags/stable to the built HEAD (force-push allowlist -- the same escape hatch the rc BRANCH pin already uses), so the gate passes and no manual tag repoint is needed. PREVIOUS (07.14.00): integrity gate #386 no longer false-fails. It compared the published tag against GITHUB_SHA (the triggering commit), but the publish step commits the CHANGELOG entry ("build NN.NN.NN [skip ci]") and mokocli pins the channel tag + semver tag to that POST-PUBLISH HEAD -- so every cut whose CHANGELOG wasn't pre-seeded on dev (e.g. a version set straight on the release branch) diverged by one commit and red-failed a correct release. The gate now compares against the actual built/published HEAD (git rev-parse HEAD, falling back to GITHUB_SHA), which equals what the tag is pinned to in both the commit and no-commit cases while still catching a tag pinned to a commit we did NOT build; the semver tag is pinned to the same built HEAD for consistency. PREVIOUS (07.13.00): RC is ON-DEMAND ONLY. The `pull_request` trigger (RC-preview on a PR to main/stable) is REMOVED and the promote-rc job now runs solely on workflow_dispatch action=promote-rc. Only dev + stable release automatically (dev via pre-release.yml push->dev; stable via the push->main release job here); alpha/beta/rc never auto-cut. PREVIOUS (07.12.00): electron repos create NO release on ANY channel (RC enabled=false + stable publish/tag/notes/integrity guarded on is_electron; opt back in with vars.ELECTRON_CI_BUILD=true) and build NO installer in CI — always built locally + uploaded manually; the dev/promote version BUMP still runs. Template-Generic #390. NEW (07.11.00): the electron installer build/attach steps (electron-builder via Wine/Xvfb) are gated to MANUAL workflow_dispatch only (`&& github.event_name == 'workflow_dispatch'`). An automatic push no longer auto-builds electron installers (heavy ~90m, runner-fragile — OOM/Wine-zombie; migrating to mokocli ElectronPackager, MokoCLI #756/#758). The version bump, CHANGELOG, tag and npm publish STILL run on push — only the electron installer is skipped and pushed MANUALLY via dispatch. Non-electron platforms (joomla/go/npm) unaffected. Template-Generic #390. Universal build & release - BUMP-ON-DEV: base version + CHANGELOG promoted on dev pre-promotion (promote-rc), main publishes --bump none --no-commit so it never diverges from dev. MokoCLI build agent (moko publish). NEW (07.06.00): npm stable publishing ABSORBED here from Template-NPM's retired npm-publish.yml as npm-gated dual-registry steps (MokoGIT registry via per-run token + npmjs.org best-effort), replacing the former npm-publish.yml dispatch. No-Makefile repos SKIP the release job gracefully (green) instead of failing. Conflict-marker scan reads git-tracked files only (git ls-files | xargs grep) so vendored/generated trees can't false-match. NEW (07.07.00): npm stamp normalizes the zero-padded Makefile PROJECT_VERSION (NN.NN.NN) to strict semver via awk before `npm version`, and an unstampable version now HARD-FAILS instead of silently keeping the old package.json version (#382). NEW (07.00.00): `moko assets:optimize` artifact-time step added before publish (graceful-skip on non-asset repos); Setup MokoCLI tools makes the fresh `moko` executable + first on PATH to fix exit-126 (mokocli #650).
 #
 # +=======================================================================+
 # |              UNIVERSAL BUILD & RELEASE PIPELINE                        |
@@ -57,9 +57,20 @@ on:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoenterprises.us' }}
   GIT_ORG: ${{ vars.MOKOGIT_ORG || github.repository_owner }}
   GIT_REPO: ${{ vars.MOKOGIT_REPO || github.event.repository.name }}
+  # #546: PIN the mokocli version installed by "Setup MokoCLI tools" below. The
+  # install was UNPINNED (composer create-project ... mokoenterprises/mokocli with
+  # no constraint => latest every run), so a bad mokocli release silently breaks
+  # EVERY repo's release at build time. This single pin is the version both the
+  # install step AND any future bump reference. BUMP THIS DELIBERATELY — do not
+  # auto-roll. In particular it MUST be bumped by hand once MokoCLI #1120's
+  # installer-inline capability ships (folding inlineInstallerScriptBase() into
+  # release_package.php), which is gated behind MOKO_JOOMLA_INLINE; pair the bump
+  # with that flag so an un-updated mokocli is a no-op, not an error, for one
+  # release. Allow a per-repo override via vars.MOKOCLI_VERSION for pilots.
+  MOKOCLI_VERSION: ${{ vars.MOKOCLI_VERSION || '10.34.00' }}
 
 permissions:
   contents: write
@@ -132,7 +143,7 @@ jobs:
         run: |
           set -u
           TOK="$(printf '%s' "$GITHUB_TOKEN" | tr -d '[:space:]')"; echo "::add-mask::$TOK"
-          SERVER="${GITHUB_SERVER_URL:-https://git.mokoconsulting.tech}"
+          SERVER="${GITHUB_SERVER_URL:-https://git.mokoenterprises.us}"
           CLONE_URL="https://x-access-token:${TOK}@${SERVER#https://}/${GITHUB_REPOSITORY}.git"
           REF="${GITHUB_SHA:-${GITHUB_REF_NAME:-}}"
           echo "Retrying checkout of ${GITHUB_REPOSITORY}@${REF:-<HEAD>} into ${GITHUB_WORKSPACE}"
@@ -177,11 +188,16 @@ jobs:
             sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
           fi
           rm -rf /tmp/mokocli
-          REG='{"type":"composer","url":"https://git.mokoconsulting.tech/api/packages/MokoConsulting/composer"}'
+          REG='{"type":"composer","url":"https://git.mokoenterprises.us/api/packages/MokoEnterprises/composer"}'
+          # #546: install the PINNED mokocli (env MOKOCLI_VERSION) rather than
+          # latest — an exact `name:version` constraint on composer create-project.
+          # Roll this forward deliberately (see the env-block note). /opt/mokocli
+          # stays the stale-tolerant FAILSAFE below if the pinned registry install
+          # fails.
           if composer create-project --no-install --no-interaction --no-progress --quiet \
-               --repository="${REG}" mokoconsulting/mokocli /tmp/mokocli >/dev/null 2>&1 \
+               --repository="${REG}" "mokoenterprises/mokocli:${MOKOCLI_VERSION}" /tmp/mokocli >/dev/null 2>&1 \
              && [ -f /tmp/mokocli/cli/version_bump.php ]; then
-            echo "Installed mokocli fresh from the Composer registry (primary)"
+            echo "Installed mokocli ${MOKOCLI_VERSION} (pinned, #546) fresh from the Composer registry (primary)"
             # #1671: registry-publish LAG race. The registry install "succeeds" but can
             # serve the PREVIOUS package for ~tens of seconds after a MokoCLI release
             # (publish finishes AFTER the release run reports success). Meanwhile the
@@ -320,7 +336,7 @@ jobs:
           # the push + force-push allowlists and creates rc if it is absent.
           PUSH_URL="https://x-access-token:${PUSH_TOK}@${MOKOGIT_URL#https://}/${GIT_ORG}/${GIT_REPO}.git"
           git config --global user.name "mokogit-actions[bot]"
-          git config --global user.email "actions@mokoconsulting.tech"
+          git config --global user.email "actions@mokoenterprises.us"
           git fetch --no-tags "$PUSH_URL" "${FROM}"
           git push --force "$PUSH_URL" "FETCH_HEAD:refs/heads/rc" \
             || { echo "::error::Failed to point rc at ${FROM} (${SRC_SHA}) via git push"; exit 1; }
@@ -355,9 +371,9 @@ jobs:
           # `git fetch origin rc` / `git checkout rc` is ambiguous and could grab the tag.
           git fetch origin "+refs/heads/rc:refs/remotes/origin/rc"
           git checkout -B rc origin/rc
-          git config --local user.email "mokogit-actions[bot]@mokoconsulting.tech"
+          git config --local user.email "mokogit-actions[bot]@mokoenterprises.us"
           git config --local user.name "mokogit-actions[bot]"
-          git remote set-url origin "https://x-access-token:${PUSH_TOK}@git.mokoconsulting.tech/${{ github.repository }}.git"
+          git remote set-url origin "https://x-access-token:${PUSH_TOK}@git.mokoenterprises.us/${{ github.repository }}.git"
 
       # Build-time PHP dependency vendoring (universal, guarded — mirrors
       # pre-release.yml 07.15.00). If a sub-package ships a composer.json, fetch its
@@ -589,7 +605,7 @@ jobs:
         run: |
           set -u
           TOK="$(printf '%s' "$GITHUB_TOKEN" | tr -d '[:space:]')"; echo "::add-mask::$TOK"
-          SERVER="${GITHUB_SERVER_URL:-https://git.mokoconsulting.tech}"
+          SERVER="${GITHUB_SERVER_URL:-https://git.mokoenterprises.us}"
           CLONE_URL="https://x-access-token:${TOK}@${SERVER#https://}/${GITHUB_REPOSITORY}.git"
           REF="${GITHUB_SHA:-${GITHUB_REF_NAME:-}}"
           echo "Retrying full-history checkout of ${GITHUB_REPOSITORY}@${REF:-<HEAD>} into ${GITHUB_WORKSPACE}"
@@ -647,15 +663,34 @@ jobs:
             echo "is_electron=false" >> "$GITHUB_OUTPUT"
           fi
 
+      # -- Download-stub opt-in detection (#544) ---------------------------------
+      # ADDITIVE + GATED. An electron repo opts into the branded download-stub
+      # installer build by shipping BOTH tools/build-release.mjs (the combined
+      # build+publish driver) AND moko-installer.config.mjs (the stub config) at
+      # the repo root. When present, the stub build below REPLACES the factory
+      # electron-builder leg (mutually exclusive via the is_stub gate). A plain
+      # electron repo keeps its existing vars.ELECTRON_CI_BUILD factory path; a
+      # non-electron repo sets is_stub=false and runs nothing new.
+      - name: "Detect download-stub installer (opt-in, #544)"
+        id: stub
+        if: steps.gate.outputs.has_makefile == 'true' && steps.electron.outputs.is_electron == 'true'
+        run: |
+          if [ -f tools/build-release.mjs ] && [ -f moko-installer.config.mjs ]; then
+            echo "is_stub=true" >> "$GITHUB_OUTPUT"
+            echo "download-stub opt-in detected (tools/build-release.mjs + moko-installer.config.mjs) -- stub build enabled, factory electron-builder leg disabled."
+          else
+            echo "is_stub=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Configure git for bot pushes
         if: steps.gate.outputs.has_makefile == 'true'
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           PUSH_TOK="$(printf '%s' "$GITHUB_TOKEN" | tr -d '[:space:]')"; [ -z "$PUSH_TOK" ] && PUSH_TOK="${{ github.token }}"; echo "::add-mask::$PUSH_TOK"
-          git config --local user.email "mokogit-actions[bot]@mokoconsulting.tech"
+          git config --local user.email "mokogit-actions[bot]@mokoenterprises.us"
           git config --local user.name "mokogit-actions[bot]"
-          git remote set-url origin "https://x-access-token:${PUSH_TOK}@git.mokoconsulting.tech/${{ github.repository }}.git"
+          git remote set-url origin "https://x-access-token:${PUSH_TOK}@git.mokoenterprises.us/${{ github.repository }}.git"
 
       - name: Check for merge conflict markers
         if: steps.gate.outputs.has_makefile == 'true'
@@ -689,11 +724,16 @@ jobs:
             sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
           fi
           rm -rf /tmp/mokocli
-          REG='{"type":"composer","url":"https://git.mokoconsulting.tech/api/packages/MokoConsulting/composer"}'
+          REG='{"type":"composer","url":"https://git.mokoenterprises.us/api/packages/MokoEnterprises/composer"}'
+          # #546: install the PINNED mokocli (env MOKOCLI_VERSION) rather than
+          # latest — an exact `name:version` constraint on composer create-project.
+          # Roll this forward deliberately (see the env-block note). /opt/mokocli
+          # stays the stale-tolerant FAILSAFE below if the pinned registry install
+          # fails.
           if composer create-project --no-install --no-interaction --no-progress --quiet \
-               --repository="${REG}" mokoconsulting/mokocli /tmp/mokocli >/dev/null 2>&1 \
+               --repository="${REG}" "mokoenterprises/mokocli:${MOKOCLI_VERSION}" /tmp/mokocli >/dev/null 2>&1 \
              && [ -f /tmp/mokocli/cli/version_bump.php ]; then
-            echo "Installed mokocli fresh from the Composer registry (primary)"
+            echo "Installed mokocli ${MOKOCLI_VERSION} (pinned, #546) fresh from the Composer registry (primary)"
             # #1671: registry-publish LAG race. The registry install "succeeds" but can
             # serve the PREVIOUS package for ~tens of seconds after a MokoCLI release
             # (publish finishes AFTER the release run reports success). Meanwhile the
@@ -1026,7 +1066,7 @@ jobs:
       - name: "Guarantee monotonic release version (fast-merge bump guard)"
         id: monotonic
         # #469: in no-bump mode (a non-source push updating the existing release in
-        # place) the version must stay PUT, so the self-healing minor bump must not
+        # place) the version must stay PUT, so the self-healing patch bump must not
         # run — skip this guard when steps.srcgate decided should_bump=false. On the
         # bump path (should_bump=true, or electron/opt-out/dispatch where srcgate is
         # bypassed/true) it runs exactly as before.
@@ -1078,20 +1118,26 @@ jobs:
           # already-released vMAJOR.MINOR.00 forever (observed: MokoCLI stuck at
           # v10.20.00 while dev reached 10.20.04), violating this guard's own "never
           # re-publish an already-released base" intent. Compare the MINOR identity
-          # (MAJOR.MINOR): heal (minor-bump) whenever CUR's minor has NOT advanced past
-          # the last release's minor. The normal promote-rc path (dev already
-          # minor-bumped) still no-ops.
+          # (MAJOR.MINOR): heal (PATCH-bump above --min-version LAST) whenever CUR's
+          # minor has NOT advanced past the last release's minor. An unplanned /
+          # non-pre-bumped stable change (a direct admin push, or a fast dev->stable
+          # merge that skipped the promote-rc dev pre-bump) is a hotfix-shaped event,
+          # so it bumps PATCH, not MINOR — --min-version "$LAST" still guarantees the
+          # healed version is strictly above the last release, and the dev carry-forward
+          # below is ALSO --bump patch (consistent with the stable patch heal, so a
+          # direct-push hotfix does not inflate dev by a full minor). The normal
+          # promote-rc path (dev already minor-bumped) still no-ops.
           CUR_MI=$(printf '%s' "$CUR"  | awk -F. '{printf "%s.%s", $1, $2}')
           LAST_MI=$(printf '%s' "$LAST" | awk -F. '{printf "%s.%s", $1, $2}')
           GREATEST_MI=$( { echo "$CUR_MI"; echo "$LAST_MI"; } | sort -V | tail -n1 || true)
           if [ "$CUR_MI" = "$LAST_MI" ] || [ "$GREATEST_MI" = "$LAST_MI" ]; then
-            echo "::warning::inherited minor ${CUR_MI} <= last release minor ${LAST_MI} (CUR=${CUR} LAST=${LAST}); minor-bump skipped -> self-healing"
-            if ! php ${MOKO_CLI}/version_bump.php --minor --min-version "$LAST" --path .; then
+            echo "::warning::inherited minor ${CUR_MI} <= last release minor ${LAST_MI} (CUR=${CUR} LAST=${LAST}); pre-bump skipped -> self-healing PATCH bump"
+            if ! php ${MOKO_CLI}/version_bump.php --patch --min-version "$LAST" --path .; then
               echo "::error::monotonic bump guard failed to advance the base"; exit 1
             fi
             NEW=$(php ${MOKO_CLI}/version_read.php --path . 2>/dev/null | sed 's/-\(dev\|alpha\|beta\|rc\)$//')
-            echo "healed ${CUR} -> ${NEW} (publishing fresh; carrying forward to dev)"
-            php ${MOKO_CLI}/release_bump_dev.php --path . --branch dev --bump minor \n              --repo "${{ github.repository }}" --token "${GITHUB_TOKEN:-${{ github.token }}}" \n              || echo "::warning::dev carry-forward failed (non-fatal; release still publishes the healed version)"
+            echo "healed ${CUR} -> ${NEW} (publishing fresh; carrying the PATCH forward to dev)"
+            php ${MOKO_CLI}/release_bump_dev.php --path . --branch dev --bump patch \n              --repo "${{ github.repository }}" --token "${GITHUB_TOKEN:-${{ github.token }}}" \n              || echo "::warning::dev carry-forward failed (non-fatal; release still publishes the healed version)"
           else
             echo "base ${CUR} > last release ${LAST}: normal path, no heal"
           fi
@@ -1239,6 +1285,37 @@ jobs:
           echo "branch=main" >> "$GITHUB_OUTPUT"
           echo "Published version: ${VERSION}"
 
+      - name: Deploy over SFTP to stable/prod (generic, presence-gated)
+        # SECURITY: this is an unattended PROD deploy. Gate it as tightly as the
+        # sibling "Deploy to prod" step: (1) presence of SFTP_STABLE_HOST,
+        # (2) a successful release (version.skip != true), (3) the protected
+        # stable/main ref (never a feature branch), and (4) the makefile gate the
+        # prod step uses — so a repo without a build never SFTP-ships its raw tree.
+        # RECOMMENDED: additionally scope secrets.SFTP_STABLE_KEY to a GitHub/Gitea
+        # "environment" with required reviewers so the deploy credential cannot be
+        # used without a human approval on the deployment.
+        if: ${{ steps.version.outputs.skip != 'true' && vars.SFTP_STABLE_HOST != '' && steps.gate.outputs.has_makefile == 'true' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/stable') }}
+        env:
+          DEPLOY_KEY: ${{ secrets.SFTP_STABLE_KEY }}
+          KNOWN_HOSTS: ${{ vars.SFTP_STABLE_KNOWN_HOSTS }}
+          SSH_USER: ${{ vars.SFTP_STABLE_USER }}
+          SSH_HOST: ${{ vars.SFTP_STABLE_HOST }}
+          SSH_PORT: ${{ vars.SFTP_STABLE_PORT }}
+          DEST: ${{ vars.SFTP_STABLE_PATH }}
+        run: |
+          set -euo pipefail
+          # never leave the deploy key / known_hosts on a shared runner
+          trap 'rm -f ~/.ssh/id_sftp_deploy ~/.ssh/known_hosts_sftp' EXIT
+          [ -n "$DEST" ] && [ "$DEST" != "/" ] || { echo "SFTP_STABLE_PATH empty/root; refusing"; exit 1; }
+          install -d -m 700 ~/.ssh
+          install -m600 /dev/null ~/.ssh/id_sftp_deploy   # 0600 before any bytes (no umask window)
+          printf '%s\n' "$DEPLOY_KEY" > ~/.ssh/id_sftp_deploy; chmod 600 ~/.ssh/id_sftp_deploy
+          printf '%s\n' "$KNOWN_HOSTS" > ~/.ssh/known_hosts_sftp; chmod 644 ~/.ssh/known_hosts_sftp
+          SSH="ssh -i $HOME/.ssh/id_sftp_deploy -p ${SSH_PORT:-22} -o UserKnownHostsFile=$HOME/.ssh/known_hosts_sftp -o StrictHostKeyChecking=yes -o IdentitiesOnly=yes"
+          $SSH "$SSH_USER@$SSH_HOST" "rm -rf \"$DEST\" && mkdir -p \"$DEST\""
+          tar czf - --exclude=.git --exclude=.mokogit --exclude=.github --exclude='*.token' --exclude='*.token.json' . | $SSH "$SSH_USER@$SSH_HOST" "tar xzf - -C \"$DEST\""
+          echo "Deployed to stable: $SSH_HOST:$DEST"
+
       - name: "Deploy to prod (inline — replaces standalone deploy.yml, #1427)"
         if: steps.gate.outputs.has_makefile == 'true' && steps.version.outputs.skip != 'true' && vars.PROD_SSH_USERNAME != ''
         env:
@@ -1280,24 +1357,116 @@ jobs:
             --ssh-host "${{ vars.PROD_SSH_HOST }}" --ssh-port "${{ vars.PROD_SSH_PORT }}" \
             --ssh-user "${{ vars.PROD_SSH_USERNAME }}" --ssh-key ~/.ssh/deploy_key
 
-      # -- Electron: build installers (Windows via Wine + Linux) and attach ------
+      # -- Electron download-stub release (opt-in, #544) -------------------------
+      # When a repo opts into the branded download-stub (steps.stub.is_stub), build
+      # + publish the stub installer + payload via tools/build-release.mjs on the
+      # `release` runner (this job already runs there), MIRRORING MokoHub's proven
+      # custom-mokohub-build-installer.yml. build-release.mjs does its own publish,
+      # so this fully REPLACES the factory electron-builder leg below (mutually
+      # exclusive via the is_stub gate). Channel = stable (this is auto-release).
+      - name: "Setup Node (electron stub)"
+        if: steps.gate.outputs.has_makefile == 'true' && steps.stub.outputs.is_stub == 'true' && steps.version.outputs.skip != 'true'
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24.18.1
+
+      - name: "Setup pnpm (electron stub)"
+        if: steps.gate.outputs.has_makefile == 'true' && steps.stub.outputs.is_stub == 'true' && steps.version.outputs.skip != 'true'
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11.20.0
+
+      - name: "Provision Wine + Xvfb (stub build)"
+        if: steps.gate.outputs.has_makefile == 'true' && steps.stub.outputs.is_stub == 'true' && steps.version.outputs.skip != 'true'
+        run: |
+          # electron-builder's portable/NSIS target runs the stub under Wine and
+          # needs 32-bit libs + an X display; provision i386 Wine + Xvfb and init
+          # the prefix once so the first Wine call does not race prefix creation.
+          sudo dpkg --add-architecture i386 || true
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq xvfb >/dev/null 2>&1 || echo "::warning::xvfb install failed"
+          sudo apt-get install -y -qq wine64 wine32 >/dev/null 2>&1 || sudo apt-get install -y -qq wine >/dev/null 2>&1 || echo "::warning::wine install failed"
+          export WINEDEBUG=-all
+          xvfb-run -a wineboot --init >/dev/null 2>&1 || true
+
+      - name: "Fetch moko-installer (file: dep sibling) [stub]"
+        if: steps.gate.outputs.has_makefile == 'true' && steps.stub.outputs.is_stub == 'true' && steps.version.outputs.skip != 'true'
+        env:
+          # github.token is scoped to THIS repo only, so it CANNOT clone the
+          # cross-repo private moko-installer ("Repository not found"). Use the
+          # org MOKOGIT_TOKEN secret (cross-repo read); fall back to github.token.
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          # @mokoenterprises/moko-installer is a `file:../moko-installer` dep
+          # (local-dev link); a fresh runner checkout has no sibling, so clone it
+          # here. This is the STABLE release path, so pull moko-installer's stable
+          # branch (the matching toolchain for a stable build).
+          TOK="$(printf '%s' "${MOKOGIT_TOKEN:-$GITHUB_TOKEN}" | tr -d '[:space:]')"; echo "::add-mask::$TOK"
+          SRV="${GITHUB_SERVER_URL:-https://git.mokoenterprises.us}"
+          rm -rf ../moko-installer
+          # #546 (MEDIUM credential-exposure): do NOT embed the token in the clone
+          # URL — that persists it in ../moko-installer/.git/config and exposes it in
+          # the runner process list. Pass it as a one-shot http.extraHeader instead
+          # (the URL carries NO token), then rewrite origin to the clean URL so no
+          # credential lingers in .git/config. An always() cleanup step below removes
+          # ../moko-installer entirely.
+          REPO_URL="https://${SRV#https://}/MokoEnterprises/moko-installer.git"
+          git -c http.extraHeader="Authorization: token ${TOK}" clone --depth 1 -b stable "$REPO_URL" ../moko-installer
+          git -C ../moko-installer remote set-url origin "$REPO_URL"
+
+      - name: "Install dependencies (stub)"
+        if: steps.gate.outputs.has_makefile == 'true' && steps.stub.outputs.is_stub == 'true' && steps.version.outputs.skip != 'true'
+        run: pnpm install --no-frozen-lockfile
+
+      - name: "Build + publish stub installer + payload (#544)"
+        if: steps.gate.outputs.has_makefile == 'true' && steps.stub.outputs.is_stub == 'true' && steps.version.outputs.skip != 'true'
+        env:
+          HUSKY: "0"
+          WINEDEBUG: "-all"
+          GITHUB_TOKEN: ${{ github.token }}
+          # Scoped write:issue token for the installer bug-report feature (#86);
+          # absent on repos without the secret -> build-release just leaves it unset.
+          MOKO_REPORT_TOKEN: ${{ secrets.MOKO_REPORT_TOKEN }}
+        run: |
+          # tools/build-release.mjs: electron-builder --win dir (payload) ->
+          # buildInstaller (download mode) -> stub exe + payload tar.gz -> upload
+          # both to the stable release. Wrapped in xvfb-run so the nested
+          # electron-builder portable/NSIS pass has a virtual display under Wine.
+          # 30-min guard (SIGTERM, then SIGKILL +30s), short of the job timeout so
+          # a regression fails loudly, not as a silent kill.
+          timeout -k 30 1800 xvfb-run -a node tools/build-release.mjs --channel stable --publish \
+            || { rc=$?; echo "::error::build-release.mjs exited $rc (124 = 30-min guard) — see electron-builder output above"; exit $rc; }
+
+      - name: "Cleanup moko-installer clone (#546)"
+        # #546: always() — remove the cloned sibling so no checkout (and its
+        # .git/config) lingers on the shared runner workspace, even if a stub step
+        # above failed. LITERAL if: always() (never a continue-on-error expression,
+        # which Gitea would discard the whole workflow over); independent step — no
+        # needs:+always() fan-in. Safe no-op when the clone never happened.
+        if: always()
+        run: rm -rf ../moko-installer
+
+      # -- Electron: FACTORY installers (Windows via Wine + Linux) and attach ----
       # No Windows/macOS runner: the `release` runner is Ubuntu, so we cross-build
       # the Windows target with Wine and build Linux natively. macOS is skipped
       # (cannot be cross-built off a Mac). All four steps no-op on non-electron repos.
+      # ALSO gated on is_stub != 'true' (#544): a stub-opted repo runs the stub leg
+      # above INSTEAD, so these two paths are mutually exclusive.
       - name: "Setup Node (electron)"
-        if: steps.gate.outputs.has_makefile == 'true' && steps.electron.outputs.is_electron == 'true' && steps.version.outputs.skip != 'true' && vars.ELECTRON_CI_BUILD == 'true'
+        if: steps.gate.outputs.has_makefile == 'true' && steps.electron.outputs.is_electron == 'true' && steps.stub.outputs.is_stub != 'true' && steps.version.outputs.skip != 'true' && vars.ELECTRON_CI_BUILD == 'true'
         uses: actions/setup-node@v4
         with:
           node-version: 24.18.1
 
       - name: "Setup pnpm (electron)"
-        if: steps.gate.outputs.has_makefile == 'true' && steps.electron.outputs.is_electron == 'true' && steps.version.outputs.skip != 'true' && vars.ELECTRON_CI_BUILD == 'true'
+        if: steps.gate.outputs.has_makefile == 'true' && steps.electron.outputs.is_electron == 'true' && steps.stub.outputs.is_stub != 'true' && steps.version.outputs.skip != 'true' && vars.ELECTRON_CI_BUILD == 'true'
         uses: pnpm/action-setup@v4
         with:
           version: 11.20.0
 
       - name: "Build electron installers (Windows via Wine + Linux)"
-        if: steps.gate.outputs.has_makefile == 'true' && steps.electron.outputs.is_electron == 'true' && steps.version.outputs.skip != 'true' && vars.ELECTRON_CI_BUILD == 'true'
+        if: steps.gate.outputs.has_makefile == 'true' && steps.electron.outputs.is_electron == 'true' && steps.stub.outputs.is_stub != 'true' && steps.version.outputs.skip != 'true' && vars.ELECTRON_CI_BUILD == 'true'
         env:
           HUSKY: "0"
         run: |
@@ -1336,7 +1505,7 @@ jobs:
           xvfb-run -a npx --no-install electron-builder --win --linux --publish never             || xvfb-run -a npx electron-builder --win --linux --publish never
 
       - name: "Attach electron installers to the release"
-        if: steps.gate.outputs.has_makefile == 'true' && steps.electron.outputs.is_electron == 'true' && steps.version.outputs.skip != 'true' && vars.ELECTRON_CI_BUILD == 'true'
+        if: steps.gate.outputs.has_makefile == 'true' && steps.electron.outputs.is_electron == 'true' && steps.stub.outputs.is_stub != 'true' && steps.version.outputs.skip != 'true' && vars.ELECTRON_CI_BUILD == 'true'
         continue-on-error: true
         run: |
           API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
@@ -1721,7 +1890,7 @@ jobs:
           # Write the safely-extracted blob (NOT a copy of the possibly-symlinked file).
           install -m 0644 "${NOTES_CONTENT}" "${WIKI_DIR}/Release-Notes.md"
           cd "${WIKI_DIR}"
-          git config --local user.email "mokogit-actions[bot]@mokoconsulting.tech"
+          git config --local user.email "mokogit-actions[bot]@mokoenterprises.us"
           git config --local user.name  "mokogit-actions[bot]"
           git config --local commit.gpgsign false
           git add -- Release-Notes.md
@@ -1798,7 +1967,7 @@ jobs:
           rm -f .npmrc; echo "$out"
           if [ "$rc" -eq 0 ]; then echo "Published to npmjs.org."
           elif printf '%s' "$out" | grep -qiE 'already exists|cannot publish over|EPUBLISHCONFLICT|409 Conflict'; then echo "::notice::npmjs.org already has this version - no-op."
-          elif printf '%s' "$out" | grep -qiE 'not in this registry|ENEEDAUTH|EOTP|need auth|E401|E403|401 Unauthorized|403 Forbidden|404 Not Found|Forbidden'; then echo "::error::npmjs.org publish FAILED — authorization error (npm exit ${rc}). NPM_TOKEN lacks publish/create rights on the @mokoconsulting scope (new-scoped-name first publish, an unauthorized token, or a revoked/expired token). Failing loud so a broken publish token cannot hide behind a green release — a 404 PUT is how npm masks an unauthorized scoped write."; exit "$rc"
+          elif printf '%s' "$out" | grep -qiE 'not in this registry|ENEEDAUTH|EOTP|need auth|E401|E403|401 Unauthorized|403 Forbidden|404 Not Found|Forbidden'; then echo "::error::npmjs.org publish FAILED — authorization error (npm exit ${rc}). NPM_TOKEN lacks publish/create rights on the @mokoenterprises scope (new-scoped-name first publish, an unauthorized token, or a revoked/expired token). Failing loud so a broken publish token cannot hide behind a green release — a 404 PUT is how npm masks an unauthorized scoped write."; exit "$rc"
           else echo "::warning::npmjs.org publish failed (npm exit ${rc}) — transient/5xx/network issue; npmjs is the secondary mirror (MokoGIT registry is primary), not failing the run."; fi
 
       # -- VS Code extension: build .vsix -> attach to the release (Template-Generic#515)

package/.mokogit/workflows/branch-cleanup.yml

@@ -1,11 +1,11 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGIT.Workflow
 # INGROUP: MokoCLI.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoenterprises.us/MokoEnterprises/Template-Generic
 # PATH: /.mokogit/workflows/branch-cleanup.yml
 # VERSION: 01.00.00
 # BRIEF: Delete feature branches after PR merge
@@ -39,7 +39,7 @@ jobs:
         env:
           MOKOGIT_TOKEN: ${{ github.token }}
           REPO: ${{ github.repository }}
-          API_BASE: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+          API_BASE: ${{ vars.MOKOGIT_URL || 'https://git.mokoenterprises.us' }}
           BRANCH: ${{ github.event.pull_request.head.ref }}
         run: |
           set -euo pipefail

package/.mokogit/workflows/ci-issue-reporter.yml

@@ -1,11 +1,11 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGIT.Workflow
 # INGROUP: MokoCLI.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoenterprises.us/MokoEnterprises/Template-Generic
 # PATH: /.mokogit/workflows/ci-issue-reporter.yml
 # VERSION: 01.00.00
 # BRIEF: Reusable workflow � creates/updates a MokoGIT issue when a CI gate fails.
@@ -62,9 +62,9 @@ jobs:
             sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1 || true
           fi
           rm -rf /tmp/mokocli
-          REG='{"type":"composer","url":"https://git.mokoconsulting.tech/api/packages/MokoConsulting/composer"}'
+          REG='{"type":"composer","url":"https://git.mokoenterprises.us/api/packages/MokoEnterprises/composer"}'
           if composer create-project --no-install --no-interaction --no-progress --quiet \
-               --repository="${REG}" mokoconsulting/mokocli /tmp/mokocli >/dev/null 2>&1 \
+               --repository="${REG}" mokoenterprises/mokocli /tmp/mokocli >/dev/null 2>&1 \
              && [ -f /tmp/mokocli/cli/version_bump.php ]; then
             echo "Installed mokocli fresh from the Composer registry (primary)"
             echo "MOKO_CLI=/tmp/mokocli/cli" >> $GITHUB_ENV
@@ -83,7 +83,7 @@ jobs:
       - name: Report CI failure
         env:
           MOKOGIT_TOKEN: ${{ github.token }}
-          MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+          MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoenterprises.us' }}
           # Route all workflow_call inputs through env vars — referencing ${{ inputs.* }}
           # directly in a run: block interpolates at YAML-parse time and is a shell-injection
           # vector. Shell variables are not re-parsed, so a crafted input can't break out.