@mokoenterprises/mokossh-mcp 3.8.1 → 3.9.0

package/.mokogit/workflows/cleanup.yml

@@ -1,11 +1,11 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGIT.Workflow
 # INGROUP: MokoCLI.Maintenance
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoenterprises.us/MokoEnterprises/Template-Generic
 # PATH: /.mokogit/workflows/cleanup.yml
 # VERSION: 01.01.00
 # CHANGE (01.01.00): fail-open branch/run cleanup (#430) — the run token may lack REST read on some repos, returning an error OBJECT; `jq '.[]'` on it exit-5'd the job under pipefail (fleet-wide red). Guard type=="array" / `(.workflow_runs // [])` and skip gracefully; cleanup is best-effort housekeeping and must never red the run.
@@ -23,7 +23,7 @@ permissions:
   actions: write
 
 env:
-  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoenterprises.us' }}
 
 jobs:
   cleanup:

package/.mokogit/workflows/makefile-lint.yml

@@ -1,14 +1,15 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGIT.Workflow
 # INGROUP: MokoCLI.Validation
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoenterprises.us/MokoEnterprises/Template-Generic
 # PATH: /.mokogit/workflows/makefile-lint.yml
-# VERSION: 01.03.00
-# BRIEF: Makefile sanity lint -- identity fields + release contract (SRC_DIR, PROJECT_VERSION format, BUILD_DIR, required targets, parse). Release-contract checks are WARN by default; set vars.MAKEFILE_LINT_ENFORCE=enforce to hard-fail (JOOMLA_I18N_ENFORCE-style, per-repo opt-in). Also runs a Scaffold Placeholder Guard job that HARD-FAILS when leftover de-template placeholders ({{UPPER_SNAKE}} moustaches, Template-<Word> repo refs, and fixed literals like example_resources/CHANGEME/myproject) survive in the tracked tree; skipped on Template-* source repos and excludes .mokogit/** + CHANGELOG*.
+# VERSION: 01.05.01
+# CHANGE (01.05.00): Hardened the Scaffold Placeholder Guard against two false-positive classes. (1) Dropped MokonyxExample from LITERAL_ALT -- it is a documented @see example-class reference (e.g. MokonyxExampleInstallerScript) cited fleet-wide, not an un-de-templated scaffold leftover, so it false-positived legit PRs (mirrors the #524 com_example removal). (2) Excluded TRIPLE-brace from MOUSTACHE_RE -- a real placeholder is always exactly double-brace {{X}}, whereas {{{X}}} is Python f-string brace-escaping (e.g. {{{SODIPODI_NS}}} in inkscape-extensions), never a de-template leftover; the regex now uses PCRE (?<!\{)/(?!\}) lookarounds and scan() greps with -P instead of -E.
+# BRIEF: NEW (01.05.01): the Scaffold Placeholder Guard now also EXCLUDES Gitea-fork test-config fixtures `tests/*.ini.tmpl` (and `tests/**/*.ini.tmpl`). Their `{{TEST_*}}`/`{{GITEA_TEST_*}}` moustache tokens are legitimate test-harness templating rendered by Gitea's own test runner, NOT de-template leftovers; they were hard-failing the guard on every MokoGIT (Gitea fork) PR (#2059). PREVIOUS: Makefile sanity lint -- identity fields + release contract (SRC_DIR, PROJECT_VERSION format, BUILD_DIR, required targets, parse). Release-contract checks are WARN by default; set vars.MAKEFILE_LINT_ENFORCE=enforce to hard-fail (JOOMLA_I18N_ENFORCE-style, per-repo opt-in). Also runs a Scaffold Placeholder Guard job that HARD-FAILS when leftover de-template placeholders (exactly-double-brace {{UPPER_SNAKE}} moustaches and fixed literals like example_resources/CHANGEME/myproject) survive in the tracked tree; skipped on Template-* source repos and excludes .mokogit/** + CHANGELOG*. The moustache scan uses PCRE lookarounds so TRIPLE-brace {{{X}}} (Python f-string brace-escaping) is NOT flagged. The bare Template-<Word> content scan, the com_example literal, and the MokonyxExample literal were removed (#524 / 01.05.00) as they false-positived on legitimate standards-repo citations and documented example hints.
 #
 # +========================================================================+
 # |                     MAKEFILE IDENTITY LINT                             |
@@ -300,10 +301,18 @@ jobs:
 
           # Literal scaffold strings that must never survive de-templating,
           # as a single pre-built alternation (so this definition line is not
-          # itself a multi-token target the scanner would trip over). The
-          # Template-* names here are also covered by TEMPLATE_REPO_RE below;
-          # they are listed explicitly so the failure message is unambiguous.
-          LITERAL_ALT='example_resources|CHANGEME|myproject|myorg|your-project|com_example|MokonyxExample'
+          # itself a multi-token target the scanner would trip over).
+          #
+          # Deliberately NOT included (issue #524):
+          #  - com_example : a legitimate documentation/example token used in
+          #    real field hints (e.g. hint="/media/com_example/*.php"), the
+          #    matching _DESC language strings, and source/build/i18n-allow.txt.
+          #    It is an illustrative glob, not an un-de-templated scaffold token.
+          #  - MokonyxExample : a documented @see example-class reference (e.g.
+          #    MokonyxExampleInstallerScript) cited fleet-wide in installer
+          #    comments and docs. Like com_example above it is an illustrative
+          #    reference, not a de-template leftover, so it is likewise excluded.
+          LITERAL_ALT='example_resources|CHANGEME|myproject|myorg|your-project'
 
           # Regexes applied per tracked file. Kept as distinct patterns so the
           # failure message can name which class of placeholder was hit.
@@ -311,9 +320,24 @@ jobs:
           #     {{DISPLAY_NAME}}, {{ENV_PREFIX}}, and the general
           #     {{UPPER_SNAKE}} shape. Requires [A-Z0-9_] (at least one [A-Z]),
           #     so lowercase app tokens like {{tempFile}} do NOT match.
-          #  2) Template-<Word> repo-name references in docs/content.
-          MOUSTACHE_RE='\{\{[A-Z0-9_]*[A-Z][A-Z0-9_]*\}\}'
-          TEMPLATE_REPO_RE='Template-[A-Z][A-Za-z0-9]+'
+          #
+          # The moustache shape plus the explicit literal set are the reliable
+          # de-template signals. A bare Template-<Word> word-match was REMOVED
+          # (issue #524): it false-positived on every legitimate citation of the
+          # standards repos (Template-Joomla #377 in installer comments, README
+          # extension tables, @see wiki links, uninstall SQL banners), which are
+          # correct references, not leftover scaffolding. A genuinely
+          # un-de-templated repo still trips the moustache/literal rules.
+          #
+          # Triple-brace EXCLUSION (PCRE lookarounds): a real scaffold
+          # placeholder is always EXACTLY double-brace -- {{UPPER_SNAKE}}. A
+          # TRIPLE-brace {{{X}}} is Python f-string brace-escaping (e.g.
+          # {{{SODIPODI_NS}}} in inkscape-extensions, where {{ / }} emit literal
+          # braces around an interpolated value), never a de-template leftover.
+          # The (?<!\{) / (?!\}) lookarounds reject a {{...}} that is flanked by
+          # a third brace, so f-string escapes no longer false-positive. This
+          # requires PCRE, so scan() greps with -P (see below).
+          MOUSTACHE_RE='(?<!\{)\{\{[A-Z0-9_]*[A-Z][A-Z0-9_]*\}\}(?!\})'
 
           # Files to exclude from the scan:
           #  - .mokogit/**        : carries this workflow (its own token list)
@@ -321,10 +345,15 @@ jobs:
           #  - CHANGELOG*         : legitimately records historical names.
           #  - the moustache/literal patterns' own home is .mokogit, already out.
           # git ls-files honours .gitignore and only lists TRACKED files.
+          #  - tests/*.ini.tmpl : Gitea-fork test-config fixtures whose
+          #    {{TEST_*}}/{{GITEA_TEST_*}} moustaches are legitimate test-harness
+          #    templating (rendered by Gitea's test runner), not scaffold leftovers (#2059).
           mapfile -t FILES < <(git ls-files \
             ':(exclude).mokogit/**' \
             ':(exclude)CHANGELOG*' \
-            ':(exclude)**/CHANGELOG*')
+            ':(exclude)**/CHANGELOG*' \
+            ':(exclude)tests/*.ini.tmpl' \
+            ':(exclude)tests/**/*.ini.tmpl')
 
           HITS=0
 
@@ -332,19 +361,21 @@ jobs:
             local re="$1" label="$2" f
             for f in "${FILES[@]}"; do
               [ -f "$f" ] || continue
-              # grep -nE: line number + extended regex. Binary files skipped.
-              grep -nIE "$re" "$f" 2>/dev/null | while IFS= read -r line; do
+              # grep -nP: line number + PCRE. PCRE is required for the moustache
+              # pattern's (?<!\{)/(?!\}) lookarounds (triple-brace f-string
+              # exclusion). GNU grep on ubuntu-latest supports -P. The LITERAL_ALT
+              # plain a|b|c alternation works identically under -P. Binary skipped.
+              grep -nIP "$re" "$f" 2>/dev/null | while IFS= read -r line; do
                 echo "::error file=${f}::Leftover scaffold placeholder (${label}): ${f}:${line}"
               done
-              if grep -qIE "$re" "$f" 2>/dev/null; then
-                grep -nIE "$re" "$f" 2>/dev/null | sed "s|^|- [FAIL] ${f}:|" >> "$GITHUB_STEP_SUMMARY"
+              if grep -qIP "$re" "$f" 2>/dev/null; then
+                grep -nIP "$re" "$f" 2>/dev/null | sed "s|^|- [FAIL] ${f}:|" >> "$GITHUB_STEP_SUMMARY"
                 HITS=1
               fi
             done
           }
 
           scan "$MOUSTACHE_RE" "UPPER_SNAKE moustache placeholder"
-          scan "$TEMPLATE_REPO_RE" "Template-<Word> repo reference"
           scan "$LITERAL_ALT" "literal scaffold token"
 
           if [ "$HITS" -ne 0 ]; then

package/.mokogit/workflows/npm-build-test.yml

@@ -1,5 +1,5 @@
 # MCP Server Build & Validation
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # Builds the MCP server via the centralized MokoCLI build agent
@@ -32,7 +32,7 @@ permissions:
   issues: write            # folded-in Wiki Reminder posts a sticky PR comment
 
 env:
-  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoenterprises.us' }}
   GIT_ORG: ${{ vars.MOKOGIT_ORG || github.repository_owner }}
   GIT_REPO: ${{ vars.MOKOGIT_REPO || github.event.repository.name }}
 
@@ -97,7 +97,7 @@ jobs:
       - name: Setup MokoCLI build agent (moko on PATH)
         env:
           MOKO_CLONE_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
-          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
+          MOKO_CLONE_HOST: git.mokoenterprises.us/MokoEnterprises
         run: |
           # Reach mokocli deterministically and expose `moko` on PATH (mokocli's cli/ dir)
           # so `moko build|test|lint` resolve. Prefer a pre-installed /opt/mokocli ONLY
@@ -120,8 +120,8 @@ jobs:
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
             rm -rf /tmp/mokocli
-            REG='{"type":"composer","url":"https://git.mokoconsulting.tech/api/packages/MokoConsulting/composer"}'
-            if composer create-project --no-dev --no-interaction --no-progress --quiet --repository="${REG}" mokoconsulting/mokocli /tmp/mokocli >/dev/null 2>&1 && { [ -x /tmp/mokocli/cli/moko ] || [ -f /tmp/mokocli/cli/moko ]; }; then
+            REG='{"type":"composer","url":"https://git.mokoenterprises.us/api/packages/MokoEnterprises/composer"}'
+            if composer create-project --no-dev --no-interaction --no-progress --quiet --repository="${REG}" mokoenterprises/mokocli /tmp/mokocli >/dev/null 2>&1 && { [ -x /tmp/mokocli/cli/moko ] || [ -f /tmp/mokocli/cli/moko ]; }; then
               echo "Bootstrapped mokocli from the Composer registry (tokenless)."
             else
               echo "Registry bootstrap unavailable; falling back to authenticated git clone."
@@ -355,7 +355,7 @@ jobs:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           PR_CREATED_AT: ${{ github.event.pull_request.created_at }}
-          SERVER: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+          SERVER: ${{ vars.MOKOGIT_URL || 'https://git.mokoenterprises.us' }}
           REPO: ${{ github.repository }}
           TOKEN: ${{ github.token }}
           DOCS_WIKI_WINDOW: ${{ vars.DOCS_WIKI_WINDOW || 'pr' }}
@@ -467,7 +467,7 @@ jobs:
       - name: Remind to update the wiki
         env:
           TOKEN: ${{ github.token }}
-          SERVER: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+          SERVER: ${{ vars.MOKOGIT_URL || 'https://git.mokoenterprises.us' }}
           REPO: ${{ github.repository }}
           PR: ${{ github.event.pull_request.number }}
         run: |
@@ -475,7 +475,7 @@ jobs:
           {
             echo "## Wiki Update Reminder"
             echo ""
-            echo "Docs are **wiki-first** at MokoConsulting. If this change affects behavior, usage, configuration, or standards, update the repo wiki:"
+            echo "Docs are **wiki-first** at MokoEnterprises. If this change affects behavior, usage, configuration, or standards, update the repo wiki:"
             echo ""
             echo "- ${SERVER}/${REPO}/wiki"
             echo ""

package/.mokogit/workflows/npm-sdk-check.yml

@@ -1,5 +1,5 @@
 # MCP SDK Version Check
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # Weekly check for MCP SDK updates. Creates an issue when a new version

package/.mokogit/workflows/npm-tool-inventory.yml

@@ -1,5 +1,5 @@
 # MCP Tool Inventory
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # Generates a tool inventory report on each push to main.
@@ -18,7 +18,7 @@ permissions:
   contents: read
 
 env:
-  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoenterprises.us' }}
   GIT_ORG: ${{ vars.MOKOGIT_ORG || github.repository_owner }}
   GIT_REPO: ${{ vars.MOKOGIT_REPO || github.event.repository.name }}
 

package/.mokogit/workflows/pr-branch-check.yml

@@ -1,92 +1,92 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# Enforces branch merge policy:
-#   feature/* → dev only
-#   fix/*     → dev only
-#   hotfix/*  → dev or main (emergency)
-#   dev       → main only
-#   alpha/*   → dev only
-#   beta/*    → dev only
-#   rc/*      → main only
-
-name: Branch Policy Check
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, edited]
-
-jobs:
-  check-target:
-    name: Verify merge target
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check branch policy
-        env:
-          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-        run: |
-          HEAD="${{ github.head_ref }}"
-          BASE="${{ github.base_ref }}"
-
-          echo "PR: ${HEAD} → ${BASE}"
-
-          ALLOWED=true
-          REASON=""
-
-          case "$HEAD" in
-            feature/*|feat/*)
-              if [ "$BASE" != "dev" ]; then
-                ALLOWED=false
-                REASON="Feature branches must target 'dev', not '${BASE}'"
-              fi
-              ;;
-            fix/*|bugfix/*)
-              if [ "$BASE" != "dev" ]; then
-                ALLOWED=false
-                REASON="Fix branches must target 'dev', not '${BASE}'"
-              fi
-              ;;
-            hotfix/*)
-              if [ "$BASE" != "dev" ] && [ "$BASE" != "$DEFAULT_BRANCH" ]; then
-                ALLOWED=false
-                REASON="Hotfix branches can only target 'dev' or 'main', not '${BASE}'"
-              fi
-              ;;
-            alpha/*|beta/*)
-              if [ "$BASE" != "dev" ]; then
-                ALLOWED=false
-                REASON="Pre-release branches must target 'dev', not '${BASE}'"
-              fi
-              ;;
-            rc/*)
-              if [ "$BASE" != "$DEFAULT_BRANCH" ]; then
-                ALLOWED=false
-                REASON="Release candidate branches must target 'main', not '${BASE}'"
-              fi
-              ;;
-            dev)
-              if [ "$BASE" != "$DEFAULT_BRANCH" ]; then
-                ALLOWED=false
-                REASON="Dev branch can only merge into 'main', not '${BASE}'"
-              fi
-              ;;
-          esac
-
-          if [ "$ALLOWED" = false ]; then
-            echo "::error::${REASON}"
-            echo ""
-            echo "## Branch Policy Violation" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "${REASON}" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "### Allowed merge paths:" >> $GITHUB_STEP_SUMMARY
-            echo "- \`feature/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
-            echo "- \`fix/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
-            echo "- \`hotfix/*\` → \`dev\` or \`main\`" >> $GITHUB_STEP_SUMMARY
-            echo "- \`dev\` → \`main\`" >> $GITHUB_STEP_SUMMARY
-            echo "- \`rc/*\` → \`main\`" >> $GITHUB_STEP_SUMMARY
-            exit 1
-          fi
-
-          echo "Branch policy: OK (${HEAD} → ${BASE})"
-          echo "## Branch Policy: Passed" >> $GITHUB_STEP_SUMMARY
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# Enforces branch merge policy:
+#   feature/* → dev only
+#   fix/*     → dev only
+#   hotfix/*  → dev or main (emergency)
+#   dev       → main only
+#   alpha/*   → dev only
+#   beta/*    → dev only
+#   rc/*      → main only
+
+name: Branch Policy Check
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+
+jobs:
+  check-target:
+    name: Verify merge target
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check branch policy
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          HEAD="${{ github.head_ref }}"
+          BASE="${{ github.base_ref }}"
+
+          echo "PR: ${HEAD} → ${BASE}"
+
+          ALLOWED=true
+          REASON=""
+
+          case "$HEAD" in
+            feature/*|feat/*)
+              if [ "$BASE" != "dev" ]; then
+                ALLOWED=false
+                REASON="Feature branches must target 'dev', not '${BASE}'"
+              fi
+              ;;
+            fix/*|bugfix/*)
+              if [ "$BASE" != "dev" ]; then
+                ALLOWED=false
+                REASON="Fix branches must target 'dev', not '${BASE}'"
+              fi
+              ;;
+            hotfix/*)
+              if [ "$BASE" != "dev" ] && [ "$BASE" != "$DEFAULT_BRANCH" ]; then
+                ALLOWED=false
+                REASON="Hotfix branches can only target 'dev' or 'main', not '${BASE}'"
+              fi
+              ;;
+            alpha/*|beta/*)
+              if [ "$BASE" != "dev" ]; then
+                ALLOWED=false
+                REASON="Pre-release branches must target 'dev', not '${BASE}'"
+              fi
+              ;;
+            rc/*)
+              if [ "$BASE" != "$DEFAULT_BRANCH" ]; then
+                ALLOWED=false
+                REASON="Release candidate branches must target 'main', not '${BASE}'"
+              fi
+              ;;
+            dev)
+              if [ "$BASE" != "$DEFAULT_BRANCH" ]; then
+                ALLOWED=false
+                REASON="Dev branch can only merge into 'main', not '${BASE}'"
+              fi
+              ;;
+          esac
+
+          if [ "$ALLOWED" = false ]; then
+            echo "::error::${REASON}"
+            echo ""
+            echo "## Branch Policy Violation" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "${REASON}" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "### Allowed merge paths:" >> $GITHUB_STEP_SUMMARY
+            echo "- \`feature/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`fix/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`hotfix/*\` → \`dev\` or \`main\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`dev\` → \`main\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`rc/*\` → \`main\`" >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+
+          echo "Branch policy: OK (${HEAD} → ${BASE})"
+          echo "## Branch Policy: Passed" >> $GITHUB_STEP_SUMMARY