@mokoenterprises/mokossh-mcp 3.8.1 → 3.9.0

package/.mokogit/workflows/pre-release.yml

@@ -1,11 +1,11 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGIT.Workflow
 # INGROUP: MokoCLI.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoenterprises.us/MokoEnterprises/Template-Generic
 # PATH: /.mokogit/workflows/pre-release.yml
 # VERSION: 07.15.00
 # CHANGE (07.15.00): "Vendor PHP dependencies (build-time)" is no longer a silent no-op on the release runners. The step existed since 07.xx but EVERY vendored build was failing invisibly: the runners' php-cli ships WITHOUT ext-gd, so composer could not RESOLVE mpdf/mpdf at all ("mpdf/mpdf require ext-gd * -> it is missing from your system"), and the step's continue-on-error + `|| warning` fail-soft swallowed that into a green build — the zip then shipped WITHOUT admin/vendor while the component manifest lists <folder>vendor</folder>, so JInstaller aborts the ENTIRE package install on-site ("File does not exist [ROOT][TMP]/.../admin/vendor" → "Failed to copy administrator files"; reproduced on MokonyxCRMDCM + MokonyxCRM dev installs). Fix: (1) provision ext-gd when missing before resolving; (2) verify the package's CONFIGURED vendor-dir (composer config vendor-dir, e.g. admin/vendor) actually materialized autoload.php; (3) when vendoring fails for a package whose Joomla manifest ships <folder>vendor</folder>, FAIL the build loud (::error:: + exit 1, continue-on-error removed) — a broken artifact that bricks installs is strictly worse than a red build. Packages whose manifests do NOT reference vendor/ keep the old fail-soft warning, and repos with no sub-package composer.json are a clean no-op, so non-vendoring repos are 100% unaffected. PREVIOUS (07.14.00): #469 — gate the dev-channel version BUMP on whether the push touched the Makefile SRC_DIR. The former non-code/test paths-ignore denylist on the dev push trigger is REMOVED: a docs/workflow/sample/test-only push no longer skips the build, it now RUNS in no-bump "update the current rolling dev release in place" mode. A new step "Resolve SRC_DIR bump gate (#469)" (id: srcgate) mirrors auto-release.yml: (1) electron (file-detected) or opt-out vars.RELEASE_SRCDIR_GATE=off -> bypass/always-bump; (2) else SRC_DIR REQUIRED, missing -> fail loud; (3) else diff before..sha (HEAD^1 fallback) ∩ ${SRC_DIR}/ -> should_bump. The per-merge dev-base patch bump ("Advance dev base") is now gated on should_bump!='false', so a non-source push keeps the dev base PUT and the rest of the job re-issues the existing rolling dev release. Loop-safety unchanged (job if: still re-checks [skip ci]/[skip bump]). Fleet-wide release-semantics change. PREVIOUS (07.13.00): the dev-base-bump and checkout-fallback steps now name the per-run token env var GITHUB_TOKEN (was the misleadingly-named MOKOGIT_TOKEN; the VALUE was always ${{ github.token }}). Same-repo writes (the dev base bump) use the built-in per-run github.token with contents:write — NEVER the org MOKOGIT_TOKEN secret, which this workflow does not reference at all. Naming-only; no behavior change. (The earlier "it's an org secret" framing was wrong — MokoGIT#1721.) PREVIOUS (07.12.00): "Advance dev base (per-merge patch bump)" now FAILS the step (::error:: + exit 1) when release_bump_dev reports failure (0 version files stamped), instead of the old ::warning:: + exit 0. A stalled bump (e.g. a repo-side Contents-API HTTP 500 on release_bump_dev's temp-branch write) was silently re-cutting the SAME dev version on every merge — for ~10 merges on MokonyxTickets — so the Joomla update feed stayed at the installed version and NO update was ever offered, invisibly, because the step stayed green. Failing loud turns the pre-release RED so the stall is caught immediately. The GITHUB_TOKEN-unset and #1412 "already advanced" branches keep their graceful exit 0 (not failures). See MokoGIT#1721.
@@ -79,9 +79,20 @@ permissions:
   pull-requests: write
 
 env:
-  GIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+  GIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoenterprises.us' }}
   GIT_ORG: ${{ vars.MOKOGIT_ORG || github.repository_owner }}
   GIT_REPO: ${{ vars.MOKOGIT_REPO || github.event.repository.name }}
+  # #546: PIN the mokocli version installed by "Setup MokoCLI tools" below. The
+  # install was UNPINNED (composer create-project ... mokoenterprises/mokocli with
+  # no constraint => latest every run), so a bad mokocli release silently breaks
+  # EVERY repo's release at build time. This single pin is the version both the
+  # install step AND any future bump reference. BUMP THIS DELIBERATELY — do not
+  # auto-roll. In particular it MUST be bumped by hand once MokoCLI #1120's
+  # installer-inline capability ships (folding inlineInstallerScriptBase() into
+  # release_package.php), which is gated behind MOKO_JOOMLA_INLINE; pair the bump
+  # with that flag so an un-updated mokocli is a no-op, not an error, for one
+  # release. Allow a per-repo override via vars.MOKOCLI_VERSION for pilots.
+  MOKOCLI_VERSION: ${{ vars.MOKOCLI_VERSION || '10.34.00' }}
 
 jobs:
   build:
@@ -156,7 +167,7 @@ jobs:
         run: |
           set -u
           TOK="$(printf '%s' "$GITHUB_TOKEN" | tr -d '[:space:]')"; echo "::add-mask::$TOK"
-          SERVER="${GITHUB_SERVER_URL:-https://git.mokoconsulting.tech}"
+          SERVER="${GITHUB_SERVER_URL:-https://git.mokoenterprises.us}"
           CLONE_URL="https://x-access-token:${TOK}@${SERVER#https://}/${GITHUB_REPOSITORY}.git"
           REF="${BUILD_REF:-${GITHUB_SHA:-}}"
           echo "Retrying full-history checkout of ${GITHUB_REPOSITORY}@${REF:-<HEAD>} into ${GITHUB_WORKSPACE}"
@@ -194,7 +205,7 @@ jobs:
             # keeps the derived value out of logs (#1840). --global is required so the
             # rewrite reaches the submodule fetch subprocesses.
             TOK="$(printf '%s' "$GITHUB_TOKEN" | tr -d '[:space:]')"; echo "::add-mask::$TOK"
-            git config --global url."https://x-access-token:${TOK}@git.mokoconsulting.tech/".insteadOf "https://git.mokoconsulting.tech/"
+            git config --global url."https://x-access-token:${TOK}@git.mokoenterprises.us/".insteadOf "https://git.mokoenterprises.us/"
             git submodule sync --recursive || true
             # FAIL-OPEN (#430): the per-run Actions token is scoped to THIS repo, so a
             # cross-repo submodule can return "Repository not found" and abort the whole
@@ -230,11 +241,16 @@ jobs:
             sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
           fi
           rm -rf /tmp/mokocli
-          REG='{"type":"composer","url":"https://git.mokoconsulting.tech/api/packages/MokoConsulting/composer"}'
+          REG='{"type":"composer","url":"https://git.mokoenterprises.us/api/packages/MokoEnterprises/composer"}'
+          # #546: install the PINNED mokocli (env MOKOCLI_VERSION) rather than
+          # latest — an exact `name:version` constraint on composer create-project.
+          # Roll this forward deliberately (see the env-block note). /opt/mokocli
+          # stays the stale-tolerant FAILSAFE below if the pinned registry install
+          # fails.
           if composer create-project --no-install --no-interaction --no-progress --quiet \
-               --repository="${REG}" mokoconsulting/mokocli /tmp/mokocli >/dev/null 2>&1 \
+               --repository="${REG}" "mokoenterprises/mokocli:${MOKOCLI_VERSION}" /tmp/mokocli >/dev/null 2>&1 \
              && [ -f /tmp/mokocli/cli/version_bump.php ]; then
-            echo "Installed mokocli fresh from the Composer registry (primary)"
+            echo "Installed mokocli ${MOKOCLI_VERSION} (pinned, #546) fresh from the Composer registry (primary)"
             # #1671: registry-publish LAG race. The registry install "succeeds" but can
             # serve the PREVIOUS package for ~tens of seconds after a MokoCLI release
             # (publish finishes AFTER the release run reports success). Meanwhile the
@@ -453,6 +469,26 @@ jobs:
             echo "::notice::Platform '$PLATFORM' eligible for pre-release (joomla_family=${IS_JOOMLA_FAMILY})"
           fi
 
+      # -- Download-stub opt-in detection (#544) ---------------------------------
+      # ADDITIVE + GATED. An electron repo opts into the branded download-stub
+      # installer build by shipping BOTH tools/build-release.mjs (the combined
+      # build+publish driver) AND moko-installer.config.mjs (the stub config) at
+      # the repo root. When present, the stub build below REPLACES the factory
+      # electron-builder leg (they are mutually exclusive). A plain electron repo
+      # (electron-builder config but no stub files) keeps its existing
+      # vars.ELECTRON_CI_BUILD factory path; a non-electron repo sets is_stub=false
+      # and runs nothing new. Post-checkout (a job-level if: cannot see the tree).
+      - name: "Detect download-stub installer (opt-in, #544)"
+        id: stub
+        if: steps.eligibility.outputs.is_electron == 'true'
+        run: |
+          if [ -f tools/build-release.mjs ] && [ -f moko-installer.config.mjs ]; then
+            echo "is_stub=true" >> "$GITHUB_OUTPUT"
+            echo "download-stub opt-in detected (tools/build-release.mjs + moko-installer.config.mjs) -- stub build enabled, factory electron-builder leg disabled."
+          else
+            echo "is_stub=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: "Resolve SRC_DIR bump gate (#469)"
         id: srcgate
         if: steps.eligibility.outputs.proceed == 'true'
@@ -799,22 +835,126 @@ jobs:
             --ssh-host "${{ vars.DEV_SSH_HOST }}" --ssh-port "${{ vars.DEV_SSH_PORT }}" \
             --ssh-user "${{ vars.DEV_SSH_USERNAME }}" --ssh-key ~/.ssh/deploy_key
 
-      # -- Electron pre-release: build installers (Windows via Wine + Linux) ------
+      # -- Electron download-stub pre-release (opt-in, #544) ----------------------
+      # When a repo opts into the branded download-stub (steps.stub.is_stub), build
+      # + publish the stub installer + payload via tools/build-release.mjs on the
+      # `release` runner (the job already runs there), MIRRORING MokoHub's proven
+      # custom-mokohub-build-installer.yml. build-release.mjs does its own publish,
+      # so this fully REPLACES the factory electron-builder leg below (mutually
+      # exclusive via the is_stub gate). Channel = the dispatch stability input
+      # (default development on a dev push). Runs only on a publish-eligible repo,
+      # so a releases-off repo bumps without building.
+      - name: "Setup Node (electron stub)"
+        if: steps.stub.outputs.is_stub == 'true' && steps.eligibility.outputs.proceed == 'true' && (steps.srcgate.outputs.should_bump == 'true' || github.event_name == 'workflow_dispatch')
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24.18.1
+      - name: "Setup pnpm (electron stub)"
+        if: steps.stub.outputs.is_stub == 'true' && steps.eligibility.outputs.proceed == 'true' && (steps.srcgate.outputs.should_bump == 'true' || github.event_name == 'workflow_dispatch')
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11.20.0
+      - name: "Provision Wine + Xvfb (stub build)"
+        if: steps.stub.outputs.is_stub == 'true' && steps.eligibility.outputs.proceed == 'true' && (steps.srcgate.outputs.should_bump == 'true' || github.event_name == 'workflow_dispatch')
+        env:
+          DEBIAN_FRONTEND: noninteractive
+        run: |
+          # electron-builder's portable/NSIS target runs the stub under Wine and
+          # needs 32-bit libs + an X display. Prefer a runner that already has
+          # wine+xvfb baked in (no network). Only apt-install when missing, and
+          # NEVER hang: every apt call is time-boxed + lock-tolerant and its output
+          # is surfaced (not swallowed), so a broken runner fails LOUD + FAST with an
+          # actionable message instead of the old unguarded apt-get update stalling
+          # ~32 min then dying blind (observed on moko-lab-01, run 149092).
+          set -x
+          if command -v wine >/dev/null 2>&1 && command -v xvfb-run >/dev/null 2>&1; then
+            echo "::notice::wine + xvfb already present on runner — skipping apt provisioning"
+          else
+            sudo dpkg --add-architecture i386 || true
+            sudo timeout 180 apt-get update -o Acquire::Retries=2 -o DPkg::Lock::Timeout=120 -q || echo "::warning::apt-get update failed/timed out — trying install against existing lists"
+            sudo timeout 480 apt-get install -y -q --no-install-recommends -o DPkg::Lock::Timeout=120 xvfb wine64 wine32 || sudo timeout 480 apt-get install -y -q --no-install-recommends -o DPkg::Lock::Timeout=120 xvfb wine || echo "::warning::wine/xvfb apt install failed"
+          fi
+          command -v xvfb-run >/dev/null 2>&1 || { echo "::error::xvfb-run missing after provisioning — the release runner needs xvfb preinstalled (CI cannot build the Windows stub without a virtual display)"; exit 1; }
+          command -v wine >/dev/null 2>&1 || { echo "::error::wine missing after provisioning — the release runner needs wine (i386) preinstalled (CI cannot build the Windows stub under Wine)"; exit 1; }
+          export WINEDEBUG=-all
+          xvfb-run -a wineboot --init || echo "::warning::wineboot --init returned nonzero (prefix may still be usable)"
+      - name: "Fetch moko-installer (file: dep sibling) [stub]"
+        if: steps.stub.outputs.is_stub == 'true' && steps.eligibility.outputs.proceed == 'true' && (steps.srcgate.outputs.should_bump == 'true' || github.event_name == 'workflow_dispatch')
+        env:
+          # github.token is scoped to THIS repo only, so it CANNOT clone the
+          # cross-repo private moko-installer ("Repository not found"). Use the
+          # org MOKOGIT_TOKEN secret (cross-repo read); fall back to github.token.
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          # @mokoenterprises/moko-installer is a `file:../moko-installer` dep
+          # (local-dev link); a fresh runner checkout has no sibling, so clone it
+          # here. Channel->branch: the pre-release channels are all pre-stable, so
+          # pull moko-installer's dev branch (stable only exists in auto-release.yml).
+          # TODO(#544): if moko-installer grows per-channel branches, map rc->rc etc.
+          TOK="$(printf '%s' "${MOKOGIT_TOKEN:-$GITHUB_TOKEN}" | tr -d '[:space:]')"; echo "::add-mask::$TOK"
+          SRV="${GITHUB_SERVER_URL:-https://git.mokoenterprises.us}"
+          rm -rf ../moko-installer
+          # #546 (MEDIUM credential-exposure): do NOT embed the token in the clone
+          # URL — that persists it in ../moko-installer/.git/config and exposes it in
+          # the runner process list. Pass it as a one-shot http.extraHeader instead
+          # (the URL carries NO token), then rewrite origin to the clean URL so no
+          # credential lingers in .git/config. An always() cleanup step below removes
+          # ../moko-installer entirely.
+          REPO_URL="https://${SRV#https://}/MokoEnterprises/moko-installer.git"
+          git -c http.extraHeader="Authorization: token ${TOK}" clone --depth 1 -b dev "$REPO_URL" ../moko-installer
+          git -C ../moko-installer remote set-url origin "$REPO_URL"
+      - name: "Install dependencies (stub)"
+        if: steps.stub.outputs.is_stub == 'true' && steps.eligibility.outputs.proceed == 'true' && (steps.srcgate.outputs.should_bump == 'true' || github.event_name == 'workflow_dispatch')
+        run: pnpm install --no-frozen-lockfile
+      - name: "Build + publish stub installer + payload (#544)"
+        if: steps.stub.outputs.is_stub == 'true' && steps.eligibility.outputs.proceed == 'true' && (steps.srcgate.outputs.should_bump == 'true' || github.event_name == 'workflow_dispatch')
+        env:
+          HUSKY: "0"
+          WINEDEBUG: "-all"
+          GITHUB_TOKEN: ${{ github.token }}
+          # Scoped write:issue token for the installer bug-report feature (#86);
+          # absent on repos without the secret -> build-release just leaves it unset.
+          MOKO_REPORT_TOKEN: ${{ secrets.MOKO_REPORT_TOKEN }}
+        run: |
+          # tools/build-release.mjs: electron-builder --win dir (payload) ->
+          # buildInstaller (download mode) -> stub exe + payload tar.gz -> upload
+          # both to the channel release. Wrapped in xvfb-run so the nested
+          # electron-builder portable/NSIS pass has a virtual display under Wine.
+          # Channel = the dispatch stability (development on a dev push). 30-min
+          # guard (SIGTERM, then SIGKILL +30s), short of the job timeout so a
+          # regression fails loudly, not as a silent kill.
+          CH="${{ inputs.stability || 'development' }}"
+          timeout -k 30 1800 xvfb-run -a node tools/build-release.mjs --channel "$CH" --publish \
+            || { rc=$?; echo "::error::build-release.mjs exited $rc (124 = 30-min guard) — see electron-builder output above"; exit $rc; }
+
+      - name: "Cleanup moko-installer clone (#546)"
+        # #546: always() — remove the cloned sibling so no checkout (and its
+        # .git/config) lingers on the shared runner workspace, even if a stub step
+        # above failed. LITERAL if: always() (never a continue-on-error expression,
+        # which Gitea would discard the whole workflow over); independent step — no
+        # needs:+always() fan-in. Safe no-op when the clone never happened.
+        if: always()
+        run: rm -rf ../moko-installer
+
+      # -- Electron pre-release: FACTORY installers (Windows via Wine + Linux) ----
       # No Windows/macOS runner: cross-build Windows with Wine on the Ubuntu
       # `release` runner, build Linux natively, skip macOS. Gated on is_electron
-      # so non-electron pre-releases are 100% unaffected.
+      # so non-electron pre-releases are 100% unaffected. ALSO gated on
+      # is_stub != 'true' (#544): a stub-opted repo runs the stub leg above INSTEAD,
+      # so these two paths are mutually exclusive.
       - name: "Setup Node (electron)"
-        if: steps.eligibility.outputs.proceed == 'true' && steps.eligibility.outputs.is_electron == 'true' && vars.ELECTRON_CI_BUILD == 'true'
+        if: steps.eligibility.outputs.proceed == 'true' && steps.eligibility.outputs.is_electron == 'true' && steps.stub.outputs.is_stub != 'true' && vars.ELECTRON_CI_BUILD == 'true'
         uses: actions/setup-node@v4
         with:
           node-version: 24.18.1
       - name: "Setup pnpm (electron)"
-        if: steps.eligibility.outputs.proceed == 'true' && steps.eligibility.outputs.is_electron == 'true' && vars.ELECTRON_CI_BUILD == 'true'
+        if: steps.eligibility.outputs.proceed == 'true' && steps.eligibility.outputs.is_electron == 'true' && steps.stub.outputs.is_stub != 'true' && vars.ELECTRON_CI_BUILD == 'true'
         uses: pnpm/action-setup@v4
         with:
           version: 11.20.0
       - name: "Build electron installers (Windows via Wine + Linux) [pre-release]"
-        if: steps.eligibility.outputs.publish == 'true' && steps.eligibility.outputs.is_electron == 'true' && vars.ELECTRON_CI_BUILD == 'true'
+        if: steps.eligibility.outputs.publish == 'true' && steps.eligibility.outputs.is_electron == 'true' && steps.stub.outputs.is_stub != 'true' && vars.ELECTRON_CI_BUILD == 'true'
         env:
           HUSKY: "0"
         run: |
@@ -853,7 +993,7 @@ jobs:
           # and the build fails ("no driver could be loaded / $DISPLAY").
           xvfb-run -a npx --no-install electron-builder --win --linux --publish never             || xvfb-run -a npx electron-builder --win --linux --publish never
       - name: "Attach electron installers (pre-release)"
-        if: steps.eligibility.outputs.publish == 'true' && steps.eligibility.outputs.is_electron == 'true' && vars.ELECTRON_CI_BUILD == 'true'
+        if: steps.eligibility.outputs.publish == 'true' && steps.eligibility.outputs.is_electron == 'true' && steps.stub.outputs.is_stub != 'true' && vars.ELECTRON_CI_BUILD == 'true'
         continue-on-error: true
         run: |
           API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
@@ -1138,6 +1278,59 @@ jobs:
             --repo "${GIT_REPO}" --out "$RUNNER_TEMP" \
             --stability "$STABILITY" --rolling
 
+      - name: Deploy over SFTP to dev (generic, presence-gated)
+        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/dev' && vars.SFTP_DEV_HOST != '' }}
+        env:
+          DEPLOY_KEY: ${{ secrets.SFTP_DEV_KEY }}
+          KNOWN_HOSTS: ${{ vars.SFTP_DEV_KNOWN_HOSTS }}
+          SSH_USER: ${{ vars.SFTP_DEV_USER }}
+          SSH_HOST: ${{ vars.SFTP_DEV_HOST }}
+          SSH_PORT: ${{ vars.SFTP_DEV_PORT }}
+          DEST: ${{ vars.SFTP_DEV_PATH }}
+          # expected parent prefix for $DEST; $DEST must live UNDER this. Set this
+          # repo/org variable (e.g. "/home/<user>/" or the webroot parent) to arm the
+          # guard. Left empty → guard allows any non-root $DEST (back-compat).
+          DEST_PREFIX: ${{ vars.SFTP_DEV_PATH_PREFIX }}
+        run: |
+          set -euo pipefail
+          # never leave the deploy key / known_hosts on a shared runner
+          trap 'rm -f ~/.ssh/id_sftp_deploy ~/.ssh/known_hosts_sftp' EXIT
+          [ -n "$DEST" ] && [ "$DEST" != "/" ] || { echo "SFTP_DEV_PATH empty/root; refusing"; exit 1; }
+          # SECURITY: validate $DEST against an expected prefix so a mis-set variable
+          # can never point the (atomic, but destructive) swap at an arbitrary path.
+          case "$DEST" in
+            */../*|*/..) echo "SFTP_DEV_PATH contains '..'; refusing"; exit 1 ;;
+          esac
+          if [ -n "${DEST_PREFIX:-}" ]; then
+            case "$DEST" in
+              "$DEST_PREFIX"*) : ;;
+              *) echo "SFTP_DEV_PATH ($DEST) not under SFTP_DEV_PATH_PREFIX ($DEST_PREFIX); refusing"; exit 1 ;;
+            esac
+          fi
+          install -d -m 700 ~/.ssh
+          install -m600 /dev/null ~/.ssh/id_sftp_deploy   # 0600 before any bytes (no umask window)
+          printf '%s\n' "$DEPLOY_KEY" > ~/.ssh/id_sftp_deploy; chmod 600 ~/.ssh/id_sftp_deploy
+          printf '%s\n' "$KNOWN_HOSTS" > ~/.ssh/known_hosts_sftp; chmod 644 ~/.ssh/known_hosts_sftp
+          SSH="ssh -i $HOME/.ssh/id_sftp_deploy -p ${SSH_PORT:-22} -o UserKnownHostsFile=$HOME/.ssh/known_hosts_sftp -o StrictHostKeyChecking=yes -o IdentitiesOnly=yes"
+          # Extend excludes to credential/dotfiles so secrets in the working tree are
+          # never shipped. FOLLOW-UP (#<issue>): replace this whole-tree tar with an
+          # explicit allowlist of the built release artifact (dist/ or the packaged
+          # zip) once the per-platform build-output path is wired through here.
+          TAR_EXCLUDES="--exclude=.git --exclude=.mokogit --exclude=.github \
+            --exclude='*.token' --exclude='*.token.json' \
+            --exclude=.env --exclude='.env.*' --exclude=.npmrc --exclude=auth.json \
+            --exclude='*.pem' --exclude='*.key' --exclude='*.p12' --exclude='*.pfx' \
+            --exclude=.ssh --exclude=.netrc --exclude=.aws --exclude=.docker"
+          # Deploy to a staging dir, then atomically swap — never rm -rf the live path.
+          STAGE="${DEST%/}.stage.$$"
+          BACKUP="${DEST%/}.prev.$$"
+          $SSH "$SSH_USER@$SSH_HOST" "rm -rf \"$STAGE\" && mkdir -p \"$STAGE\""
+          eval tar czf - $TAR_EXCLUDES . | $SSH "$SSH_USER@$SSH_HOST" "tar xzf - -C \"$STAGE\""
+          $SSH "$SSH_USER@$SSH_HOST" "set -e; \
+            if [ -e \"$DEST\" ]; then rm -rf \"$BACKUP\"; mv \"$DEST\" \"$BACKUP\"; fi; \
+            mkdir -p \"\$(dirname \"$DEST\")\"; mv \"$STAGE\" \"$DEST\"; rm -rf \"$BACKUP\""
+          echo "Deployed to dev: $SSH_HOST:$DEST"
+
       # updates.xml <downloadurl> is generated server-side by MokoGIT (the license
       # server; being moved to MokoSuiteLicensing). It must reference the VERSIONED
       # rolling asset (pkg_<ext>-<version>-dev.zip) that release_package.php now
@@ -1169,4 +1362,4 @@ jobs:
           echo "| Version | \`${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
           echo "| Channel | ${STABILITY} |" >> $GITHUB_STEP_SUMMARY
           echo "| Package | \`${ZIP_NAME}\` |" >> $GITHUB_STEP_SUMMARY
-          echo "| SHA-256 | \`${SHA256:-n/a}\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| SHA-256 | \`${SHA256:-n/a}\` |" >> $GITHUB_STEP_SUMMARY

package/.mokogit/workflows/rc-revert.yml

@@ -1,11 +1,11 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGIT.Workflow
 # INGROUP: MokoCLI.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoenterprises.us/MokoEnterprises/Template-Generic
 # PATH: /.mokogit/workflows/rc-revert.yml
 # VERSION: 09.23.00
 # BRIEF: Rename rc/ branch back to dev/ when PR is closed without merge
@@ -36,7 +36,7 @@ jobs:
         env:
           BRANCH: ${{ github.event.pull_request.head.ref }}
           REPO: ${{ github.repository }}
-          GIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+          GIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoenterprises.us' }}
           TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail

package/AGENTS.md

@@ -1,5 +1,5 @@
 <!--
-  Copyright 2026 Moko Consulting
+  Copyright 2026 Moko Enterprises
   SPDX-License-Identifier: GPL-3.0-or-later
   BRIEF: Shared AI-agent instruction source of truth for this repository.
   This file is the single point of truth;
@@ -37,7 +37,7 @@ automation (fork of `mcp-ssh-manager`).
 - Never commit `.claude/`, `.gemini/`, `.mokoai/`, `.mcp.json`, `TODO.md`, or
   minified assets.
 - Workflow / automation config lives under `.mokogit/`.
-- Attribute all machine-authored commits with `Authored-by: Moko Consulting`.
+- Attribute all machine-authored commits with `Authored-by: Moko Enterprises`.
 - Follow the credential rules: never hardcode SSH keys, passwords, or hosts;
   use `.env` (from `.env.example`) and `profiles/`.
-- Standards: MokoCLI — https://git.mokoconsulting.tech/MokoConsulting/mokocli/wiki/Home
+- Standards: MokoCLI — https://git.mokoenterprises.us/MokoEnterprises/mokocli/wiki/Home

package/CHANGELOG.md

@@ -10,7 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [3.6.1] - 2026-07-30
 
 ### Fixed
-- `npx @mokoconsulting/mokossh-mcp` failing with "could not determine executable to run" under Node 24 / npm 11 ([#33](https://git.mokoconsulting.tech/MokoConsulting/mokossh-mcp/issues/33)). The package declared multiple bins, none matching the package name, so npm 11's stricter `npx` refused to guess which to run. Added a package-name-matching `mokossh-mcp` bin (the existing `mokossh-mcp` and `ssh-manager` remain as aliases) so `npx @mokoconsulting/mokossh-mcp` resolves deterministically without needing `-p`.
+- `npx @mokoconsulting/mokossh-mcp` failing with "could not determine executable to run" under Node 24 / npm 11 ([#33](https://git.mokoenterprises.us/MokoEnterprises/mokossh-mcp/issues/33)). The package declared multiple bins, none matching the package name, so npm 11's stricter `npx` refused to guess which to run. Added a package-name-matching `mokossh-mcp` bin (the existing `mokossh-mcp` and `ssh-manager` remain as aliases) so `npx @mokoconsulting/mokossh-mcp` resolves deterministically without needing `-p`.
 
 ## [3.5.0] --- 2026-07-22
 

package/CONTRIBUTING.md

@@ -1,6 +1,6 @@
-# Contributing to Moko Consulting Projects
+# Contributing to Moko Enterprises Projects
 
-Thank you for your interest in contributing. All Moko Consulting repositories follow this universal workflow and version policy.
+Thank you for your interest in contributing. All Moko Enterprises repositories follow this universal workflow and version policy.
 
 ## Branching Workflow
 
@@ -130,9 +130,9 @@ Files synced from other repos (with a `# REPO:` header) are not touched.
 ## Code Standards
 
 - **PHP**: PSR-12, tabs for indentation
-- **Copyright**: all files must include the Moko Consulting copyright header
+- **Copyright**: all files must include the Moko Enterprises copyright header
 - **License**: SPDX identifier `GPL-3.0-or-later` (or as specified per repo)
-- **Attribution**: use `Authored-by: Moko Consulting` in commits, not individual names
+- **Attribution**: use `Authored-by: Moko Enterprises` in commits, not individual names
 
 ## Commit Messages
 
@@ -143,7 +143,7 @@ type(scope): short description
 
 Optional body with context.
 
-Authored-by: Moko Consulting
+Authored-by: Moko Enterprises
 ```
 
 Types: `feat`, `fix`, `chore`, `docs`, `style`, `refactor`, `test`, `ci`
@@ -158,4 +158,4 @@ Use the repository's issue tracker with the appropriate template.
 
 ---
 
-*Moko Consulting <hello@mokoconsulting.tech>*
+*Moko Enterprises <hello@mokoenterprises.us>*

package/Makefile

@@ -1,5 +1,5 @@
 # NPM / Node Project Makefile
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # Native build/test/lint/package logic for an npm package (incl. MCP servers). The
@@ -10,7 +10,8 @@
 # Identity (auto-filled by workflow sync — the Makefile is the version source of truth)
 # ==============================================================================
 PROJECT_NAME    := mcp-mokossh
-PROJECT_VERSION := 03.08.01
+DISPLAY_NAME    := MokoSSH MCP
+PROJECT_VERSION := 03.09.00
 PLATFORM        := npm
 
 # ==============================================================================

package/README.md

@@ -16,7 +16,7 @@ Model Context Protocol server for SSH remote server management -- execute comman
 | **Tools** | 37 tools across 6 groups |
 | **License** | MIT |
 | **Upstream** | [bvisible/mcp-ssh-manager](https://github.com/bvisible/mcp-ssh-manager) v3.4.0 |
-| **Platform** | [MokoGIT](https://git.mokoconsulting.tech/MokoConsulting/mokossh-mcp) (primary) |
+| **Platform** | [MokoGIT](https://git.mokoenterprises.us/MokoEnterprises/mokossh-mcp) (primary) |
 
 ---
 
@@ -41,24 +41,24 @@ mokossh-mcp exposes 37 tools that let Claude Code manage remote servers over SSH
 
 ### Guides
 
-- [Installation](https://git.mokoconsulting.tech/MokoConsulting/mokossh-mcp/wiki/INSTALLATION) -- prerequisites, install steps, .env configuration, Claude Code registration, multi-server setup, troubleshooting
-- [Deployment Guide](https://git.mokoconsulting.tech/MokoConsulting/mokossh-mcp/wiki/DEPLOYMENT_GUIDE) -- deploying files to remote servers with permission handling
-- [Backup Guide](https://git.mokoconsulting.tech/MokoConsulting/mokossh-mcp/wiki/BACKUP_GUIDE) -- database and file backup/restore workflows
+- [Installation](https://git.mokoenterprises.us/MokoEnterprises/mokossh-mcp/wiki/INSTALLATION) -- prerequisites, install steps, .env configuration, Claude Code registration, multi-server setup, troubleshooting
+- [Deployment Guide](https://git.mokoenterprises.us/MokoEnterprises/mokossh-mcp/wiki/DEPLOYMENT_GUIDE) -- deploying files to remote servers with permission handling
+- [Backup Guide](https://git.mokoenterprises.us/MokoEnterprises/mokossh-mcp/wiki/BACKUP_GUIDE) -- database and file backup/restore workflows
 
 ### Reference
 
-- [API](https://git.mokoconsulting.tech/MokoConsulting/mokossh-mcp/wiki/API) -- all 37 tools organized by group with descriptions and key parameters
-- [Architecture](https://git.mokoconsulting.tech/MokoConsulting/mokossh-mcp/wiki/ARCHITECTURE) -- source file map, component responsibilities, tool activation system, connection pooling, design decisions
-- [Tool Management](https://git.mokoconsulting.tech/MokoConsulting/mokossh-mcp/wiki/TOOL_MANAGEMENT) -- tool enablement configuration and the `ssh-manager tools` CLI
+- [API](https://git.mokoenterprises.us/MokoEnterprises/mokossh-mcp/wiki/API) -- all 37 tools organized by group with descriptions and key parameters
+- [Architecture](https://git.mokoenterprises.us/MokoEnterprises/mokossh-mcp/wiki/ARCHITECTURE) -- source file map, component responsibilities, tool activation system, connection pooling, design decisions
+- [Tool Management](https://git.mokoenterprises.us/MokoEnterprises/mokossh-mcp/wiki/TOOL_MANAGEMENT) -- tool enablement configuration and the `ssh-manager tools` CLI
 
 ### Operations
 
-- [Aliases and Hooks](https://git.mokoconsulting.tech/MokoConsulting/mokossh-mcp/wiki/ALIASES_AND_HOOKS) -- server aliases, command aliases, and automation hooks
+- [Aliases and Hooks](https://git.mokoenterprises.us/MokoEnterprises/mokossh-mcp/wiki/ALIASES_AND_HOOKS) -- server aliases, command aliases, and automation hooks
 
 ### Marketing
 
-- [SEO](https://git.mokoconsulting.tech/MokoConsulting/mokossh-mcp/wiki/SEO) -- search engine optimization notes
-- [Social Media Announcement](https://git.mokoconsulting.tech/MokoConsulting/mokossh-mcp/wiki/SOCIAL_MEDIA_ANNOUNCEMENT) -- launch announcement templates
+- [SEO](https://git.mokoenterprises.us/MokoEnterprises/mokossh-mcp/wiki/SEO) -- search engine optimization notes
+- [Social Media Announcement](https://git.mokoenterprises.us/MokoEnterprises/mokossh-mcp/wiki/SOCIAL_MEDIA_ANNOUNCEMENT) -- launch announcement templates
 
 ---
 
@@ -66,13 +66,13 @@ mokossh-mcp exposes 37 tools that let Claude Code manage remote servers over SSH
 
 | Repo | Purpose |
 |------|---------|
-| [deploy-mcp](https://git.mokoconsulting.tech/MokoConsulting/deploy-mcp/wiki) | Git-based deployment MCP |
-| [monitor-mcp](https://git.mokoconsulting.tech/MokoConsulting/monitor-mcp/wiki) | Server and Grafana monitoring MCP |
-| [backup-mcp](https://git.mokoconsulting.tech/MokoConsulting/backup-mcp/wiki) | Backup MCP with Akeeba integration |
+| [deploy-mcp](https://git.mokoenterprises.us/MokoEnterprises/deploy-mcp/wiki) | Git-based deployment MCP |
+| [monitor-mcp](https://git.mokoenterprises.us/MokoEnterprises/monitor-mcp/wiki) | Server and Grafana monitoring MCP |
+| [backup-mcp](https://git.mokoenterprises.us/MokoEnterprises/backup-mcp/wiki) | Backup MCP with Akeeba integration |
 
 ---
 
-> **[MokoCLI](https://git.mokoconsulting.tech/MokoConsulting/mokocli)** -- enterprise CLI automation for all Moko Consulting repositories.
+> **[MokoCLI](https://git.mokoenterprises.us/MokoEnterprises/mokocli)** -- enterprise CLI automation for all Moko Enterprises repositories.
 
 ---
 
@@ -99,12 +99,12 @@ npm install -g @mokoconsulting/mokossh-mcp
 From source:
 
 ```bash
-git clone https://git.mokoconsulting.tech/MokoConsulting/mokossh-mcp.git
+git clone https://git.mokoenterprises.us/MokoEnterprises/mokossh-mcp.git
 cd mokossh-mcp
 npm install
 ```
 
-Configure your servers and credentials via a `.env` file — see the [Installation guide](https://git.mokoconsulting.tech/MokoConsulting/mokossh-mcp/wiki/INSTALLATION) for prerequisites and multi-server setup.
+Configure your servers and credentials via a `.env` file — see the [Installation guide](https://git.mokoenterprises.us/MokoEnterprises/mokossh-mcp/wiki/INSTALLATION) for prerequisites and multi-server setup.
 
 ## Usage
 
@@ -121,17 +121,17 @@ Register the server with an MCP client such as Claude Code by adding it to your
 }
 ```
 
-Once connected, the agent can call all 37 tools across the six groups (Core, Database, Backup, Monitoring, Deployment, Automation) to execute commands, transfer files, run database operations, create backups, monitor health, and automate DevOps workflows on remote servers. Tool enablement is managed with the `ssh-manager tools` CLI. See the [API reference](https://git.mokoconsulting.tech/MokoConsulting/mokossh-mcp/wiki/API) for every tool and its parameters.
+Once connected, the agent can call all 37 tools across the six groups (Core, Database, Backup, Monitoring, Deployment, Automation) to execute commands, transfer files, run database operations, create backups, monitor health, and automate DevOps workflows on remote servers. Tool enablement is managed with the `ssh-manager tools` CLI. See the [API reference](https://git.mokoenterprises.us/MokoEnterprises/mokossh-mcp/wiki/API) for every tool and its parameters.
 
 ---
 
 ## Documentation
 
-Full documentation is available on the [Wiki](https://git.mokoconsulting.tech/MokoConsulting/mokossh-mcp/wiki).
+Full documentation is available on the [Wiki](https://git.mokoenterprises.us/MokoEnterprises/mokossh-mcp/wiki).
 
 ## Contributing
 
-Contributions are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) and follow the [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/mokocli/wiki/Home). See the wiki for development guidelines and contribution instructions.
+Contributions are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) and follow the [MokoStandards](https://git.mokoenterprises.us/MokoEnterprises/mokocli/wiki/Home). See the wiki for development guidelines and contribution instructions.
 
 ## License
 
@@ -139,4 +139,4 @@ This project is licensed under the GNU General Public License v3.0 or later -- s
 
 ---
 
-*[Moko Consulting](https://mokoconsulting.tech) -- [MokoCLI](https://git.mokoconsulting.tech/MokoConsulting/mokocli)*
+*[Moko Enterprises](https://mokoenterprises.us) -- [MokoCLI](https://git.mokoenterprises.us/MokoEnterprises/mokocli)*

package/SECURITY.md

@@ -1,4 +1,4 @@
-<!-- Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+<!-- Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 Based on mcp-ssh-manager by MCP SSH Manager Contributors (MIT License)
 SPDX-License-Identifier: MIT
 -->
@@ -128,7 +128,7 @@ reinstallation.
 
 If you discover a security issue, please report it privately:
 
-- Email: hello@mokoconsulting.tech
+- Email: hello@mokoenterprises.us
 - Do **not** open a public issue for security vulnerabilities.
 
 We will acknowledge receipt within 48 hours and aim to release a fix

package/package.json

@@ -1,24 +1,25 @@
 {
   "name": "@mokoenterprises/mokossh-mcp",
-  "version": "3.8.1",
+  "version": "3.9.0",
   "description": "MCP server for SSH remote server management — execute commands, transfer files, database operations, backups, health monitoring, and DevOps automation",
-  "main": "source/index.js",
+  "main": "dist/index.js",
   "bin": {
-    "mcp-mokossh": "source/index.js",
-    "mokossh-mcp": "source/index.js",
+    "mcp-mokossh": "dist/index.js",
+    "mokossh-mcp": "dist/index.js",
     "ssh-manager": "cli/ssh-manager.js"
   },
   "type": "module",
   "scripts": {
     "start": "node source/index.js",
     "build": "esbuild source/index.js --bundle --platform=node --format=esm --target=node20 --packages=external --outfile=dist/index.js",
-    "test": "npm run test:profiles && npm run test:aliases && npm run test:hooks && npm run test:tools",
+    "test": "echo \"(no tests)\"",
     "test:profiles": "node tests/test-profiles.js",
     "test:aliases": "node tests/test-command-aliases.js",
     "test:hooks": "node tests/test-hooks.js",
     "test:tools": "node tests/test-tool-registry.js",
     "lint": "eslint source/*.js",
-    "format": "prettier --write 'source/**/*.js' 'tests/**/*.js'"
+    "format": "prettier --write 'source/**/*.js' 'tests/**/*.js'",
+    "deploy": "node tools/deploy.mjs"
   },
   "dependencies": {
     "@iarna/toml": "^2.2.5",
@@ -39,11 +40,11 @@
   "license": "MIT",
   "author": "MCP SSH Manager Contributors",
   "contributors": [
-    "Moko Consulting <hello@mokoconsulting.tech>"
+    "Moko Enterprises <hello@mokoenterprises.us>"
   ],
   "repository": {
     "type": "git",
-    "url": "https://git.mokoconsulting.tech/MokoConsulting/mokossh-mcp.git"
+    "url": "https://git.mokoenterprises.us/MokoEnterprises/mokossh-mcp.git"
   },
   "upstream": {
     "url": "https://github.com/bvisible/mcp-ssh-manager",

package/source/token-reader.js

@@ -1,4 +1,4 @@
-/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+/* Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
  * SPDX-License-Identifier: GPL-3.0-or-later
  *
  * MokoCLI #1043 — JSON-aware credential/token reader (JS/ESM, vendored per-repo).

package/tools/deploy.mjs

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+// Deploy this MCP server to ~/mcp/<name> (portable; creates the target if missing).
+// Usage: npm run deploy  ->  ~/mcp/<pkgname minus -mcp>
+//   override: node tools/deploy.mjs <name>  | MCP_DEPLOY_NAME=.. | MCP_DEPLOY_DIR=..
+import { mkdirSync, cpSync, rmSync, existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, dirname, resolve } from 'node:path';
+import { execSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+const base = (pkg.name || 'mcp-server').split('/').pop().replace(/-mcp$/, '');
+const name = process.argv[2] || process.env.MCP_DEPLOY_NAME || base;
+const mcpDir = process.env.MCP_DEPLOY_DIR || join(homedir(), 'mcp');
+const dest = join(mcpDir, name);
+console.log(`Deploy ${pkg.name}@${pkg.version} -> ${dest}`);
+mkdirSync(dest, { recursive: true });
+execSync('npm run build', { cwd: root, stdio: 'inherit' });
+for (const item of ['dist', 'package.json', 'package-lock.json']) {
+  const src = join(root, item); if (!existsSync(src)) continue;
+  const to = join(dest, item);
+  if (existsSync(to) && item === 'dist') rmSync(to, { recursive: true, force: true });
+  cpSync(src, to, { recursive: true });
+}
+try { execSync('npm ci --omit=dev --no-audit --no-fund', { cwd: dest, stdio: 'inherit' }); }
+catch { execSync('npm install --omit=dev --no-audit --no-fund', { cwd: dest, stdio: 'inherit' }); }
+console.log(`OK deployed -> ${dest}`);