ultimate-jekyll-manager 1.9.4 → 1.9.5

package/CHANGELOG.md

@@ -14,6 +14,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - `Fixed` for any bug fixes.
 - `Security` in case of vulnerabilities.
 
+---
+## [1.9.5] - 2026-06-22
+
+### Changed
+- **FormManager: CSS-based loading guard replaces per-element `disabled`.** All FM-managed forms now use `data-form-state="initializing"` + a CSS rule (`pointer-events: none; opacity: 0.65`) instead of `disabled` attributes on individual inputs. FM sets the attribute in `_init()` and the CSS unblocks when state transitions to `ready`. Removed loading-guard `disabled` from inputs across all 41 forms (auth, contact, checkout, hero demo, account, admin, etc.) and 7 test forms. Submit buttons retain `disabled` in HTML — FM excludes `type="submit"` from the snapshot by design.
+
+### Added
+- **Supply-chain security via Socket Firewall.** New `safeInstall()` helper (`src/lib/safe-install.js`) wraps npm install with `sfw` (Socket Firewall) when available, scanning the full transitive dependency tree for malware before download. `npx mgr install` and `npx mgr setup` now route through it. CI `build.yml` installs sfw globally and runs `sfw npm install`.
+
+### Fixed
+- **Footer language switcher no longer links to excluded pages.** The language dropdown now checks `translation.exclude` before rendering language links. Pages matching an exclude entry (e.g. blog posts when `"blog"` is excluded) only show the default language, preventing dead `/es/blog/...` links that 404.
+
 ---
 ## [1.9.4] - 2026-06-20
 

package/CLAUDE.md

@@ -2,6 +2,8 @@
 
 > **Note for contributors and Claude:** This file is the architectural overview — identity, top-level conventions, and a map to deep references. The **meat** (per-subsystem APIs, page customization recipes, theming, behavior tables, defaults lists) lives in `docs/<topic>.md`. When extending or adding content, write it in the matching `docs/*.md` file and cross-link from here — do NOT inline it. If a topic doesn't have a doc yet, create one. Goal: keep this file under 250 lines.
 
+> **Mirrored structure:** BEM, UJM, BXM, and EM CLAUDE.md files mirror each other — shared sections (Supply-Chain Security, Development Workflow, File Conventions, etc.) appear in the **same order at the same position** across all four. When adding a section that applies to multiple frameworks, insert it in the same spot in all of them.
+
 ## Identity
 
 Ultimate Jekyll Manager (UJM) is a comprehensive framework for building modern Jekyll-powered static sites. Sister project to Electron Manager (EM) and Browser Extension Manager (BXM). Provides:
@@ -176,6 +178,10 @@ Note: `-t` short alias belongs to `translation`. The `test` command uses `--test
 - **🚫 NEVER run `npm start` in a consumer project** — the user runs the dev server; running it again kills theirs. Assume it's already running; if it isn't, **instruct the user to run it** rather than running it yourself. Instead, **check `logs/dev.log`** after editing files to confirm the watcher recompiled successfully (`Reloading Browsers...` = success; `errored` = fix the error) — never tail/attach to the process. If editing multiple files, check the log once after the last edit. A change that breaks the build is not a completed change. Running `npx mgr test` is fine.
 - **Live-test UI changes via CDP.** After code changes compile, use the `chrome-devtools` MCP tools (screenshots, click, evaluate JS, console logs) to verify the change works in the running browser. This is the primary way to confirm UI changes — type-checking and test suites verify code correctness, not feature correctness. Read the URL from the consumer's `.temp/_config_browsersync.yml`. Prefer `https://localhost:4000`; fall back to the local network IP (e.g. `https://192.168.x.x:4000`) if localhost doesn't connect. See [docs/cdp-debugging.md](docs/cdp-debugging.md) + `~/.claude/mcp-server/servers/chrome-devtools/CLAUDE.md`.
 
+## Supply-Chain Security
+
+All `npm install` calls in CLI commands (`npx mgr i`, `npx mgr setup`) route through the `safeInstall()` helper (`src/lib/safe-install.js`). It prefixes `sfw` (Socket Firewall) when installed — blocking confirmed malware at the network level before packages reach disk. Falls back to plain npm if sfw isn't available. CI workflows install sfw globally and run `sfw npm install`. Installs will **fail if sfw detects confirmed malware** in any package in the dependency tree; non-critical CVEs and quality warnings pass through.
+
 ## File Conventions
 
 - **CommonJS** in build-time / Node files (gulp tasks, commands, lib/). **ESM** in `src/index.js` (frontend Manager — webpack-bundled).

package/PROGRESS.md

@@ -6,7 +6,7 @@
 * **Current Phase:** Phase 1 — implementation + tests complete, docs pending
 * **Priority:** Medium
 * **Last Updated:** 2026-06-20 11:03 PM PDT
-* **Notes:** FM disabled-state refactor done + comprehensive FM test suite added (110 tests total, up from 80). Blog post ad insertion fix applied (Phase 2). Docs (javascript-libraries.md, CHANGELOG) still need updating before shipping.
+* **Notes:** FM disabled-state refactor done + comprehensive FM test suite added (110 tests total, up from 80). Blog post ad insertion fix applied (Phase 2). Auth form HTML fixed to remove `disabled` from inputs (loading guards that conflicted with FM snapshot). Docs (javascript-libraries.md, CHANGELOG) still need updating before shipping.
 
 ## Active Task List
 * [ ] Phase 1: FormManager disabled-state snapshot-and-restore
@@ -16,10 +16,19 @@
   * [x] Task 1.4: All 85 tests passing
   * [x] Task 1.5: Add visual Test 7 to FM test page (form-manager.html + JS) with permanently disabled fields + rapid-cycle demo
   * [x] Task 1.6: Write comprehensive FM page-layer tests — getData/setData (12 tests), validation/honeypot/file-accept (13 tests). 110 total.
+  * [x] Task 1.7a: Full audit + fix: remove `disabled` from all loading-guard inputs across UJM forms (auth signin/signup/reset, email-preferences, hero-demo-form input/select/textarea)
+  * [x] Task 1.7b: Add `data-form-state="initializing"` to all 34 FM-managed forms + 7 test forms, CSS guard in `_initialize.scss`, FM sets attribute in `_init()`. Remove loading-guard `disabled` from test form inputs (tests 1-6).
   * [ ] Task 1.7: Update `docs/javascript-libraries.md` — replace `data-fm-keep-disabled` docs with new snapshot pattern + `onsubmit="return false"` + `data-form-state="initializing"` CSS guard
   * [ ] Task 1.8: Update CHANGELOG with the change
   * [ ] Task 1.9: Ship (commit, push, publish)
 
+* [ ] Phase 3: Fix translation exclude list not respected by footer language switcher
+  * [x] Task 3.1: Diagnose root cause — footer renders dead `/es/blog/...` links for excluded pages
+  * [x] Task 3.2: Fix footer template (`classy/frontend/sections/footer.html`) to check exclude list
+  * [x] Task 3.3: Fix `uj_translation_url` Ruby tag in `jekyll-uj-powertools` gem v1.7.11 (defense-in-depth)
+  * [ ] Task 3.4: Validate on a consumer site (rebuild + check footer on blog post)
+  * [ ] Task 3.5: Ship both repos (commit, push, publish gem + UJM)
+
 * [x] Phase 2: Fix blog post ad insertion inside blockquotes
   * [x] Task 2.1: Filter out `<p>` elements inside `<blockquote>`, `<details>`, `<figure>` from ad insertion candidates in `post.js`
 

package/dist/assets/css/core/_initialize.scss

@@ -20,6 +20,17 @@ body {
   padding: 0;
 }
 
+// ============================================
+// FormManager Loading Guard
+// ============================================
+
+// Forms with data-form-state block interaction until FormManager sets state
+// to "ready". Replaces per-element disabled attributes as the loading guard.
+form[data-form-state]:not([data-form-state="ready"]) {
+  pointer-events: none;
+  opacity: 0.65;
+}
+
 // ============================================
 // Font Display Configuration
 // ============================================

package/dist/assets/js/libs/form-manager.js

@@ -93,6 +93,10 @@ export class FormManager {
    * Initialize the form manager
    */
   _init() {
+    // Set the form state attribute immediately so the CSS loading guard
+    // kicks in even if the HTML didn't include data-form-state.
+    this.$form.setAttribute('data-form-state', this.state);
+
     // Snapshot elements that are disabled in HTML markup BEFORE the first
     // blanket disable. These are business-logic disabled (e.g. "coming soon"
     // options) and must stay disabled through every state transition.

package/dist/commands/install.js

@@ -1,7 +1,7 @@
 // Libraries
 const Manager = new (require('../build.js'));
 const logger = Manager.logger('install');
-const { execute } = require('node-powertools');
+const { safeInstall } = require('../lib/safe-install');
 const os = require('os');
 
 // Load package
@@ -48,5 +48,5 @@ module.exports = async function (options) {
 };
 
 function install(command) {
-  return execute(command, { log: true });
+  return safeInstall(command);
 }

package/dist/commands/setup.js

@@ -6,6 +6,7 @@ const jetpack = require('fs-jetpack');
 const version = require('wonderful-version');
 const fetch = require('wonderful-fetch');
 const { execute } = require('node-powertools');
+const { safeInstall } = require('../lib/safe-install');
 const NPM = require('npm-api');
 const glob = require('glob').globSync;
 const detectGitHubRepository = require('../gulp/tasks/utils/detect-github-repo');
@@ -652,7 +653,7 @@ function npmInstall(pkg, ver, location) {
 
   logger.log('Installing:', command);
 
-  return execute(command, { log: true })
+  return safeInstall(command)
     .then(() => {
       const projectUpdated = jetpack.read(path.join(process.cwd(), 'package.json'), 'json');
 

package/dist/defaults/.github/workflows/build.yml

@@ -60,8 +60,10 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
+      - name: Install Socket Firewall
+        run: npm install -g sfw
       - name: Run node install
-        run: npm install
+        run: sfw npm install
       - name: Log dependency versions
         run: |
           echo "🖥️ Unix Versions: "

package/dist/defaults/dist/_includes/themes/classy/frontend/sections/footer.html

@@ -86,7 +86,15 @@
               </button>
               <ul class="dropdown-menu">
                 {% assign default_language = site.translation.default | default: "en" %}
-                {% if site.translation.enabled and site.translation.languages.size > 0 %}
+                {% assign page_excluded_from_translation = false %}
+                {% for exclude in site.translation.exclude %}
+                  {% assign exclude_folder = "/" | append: exclude | append: "/" %}
+                  {% assign exclude_page = "/" | append: exclude %}
+                  {% if page.url == exclude_page or page.url contains exclude_folder %}
+                    {% assign page_excluded_from_translation = true %}
+                  {% endif %}
+                {% endfor %}
+                {% if site.translation.enabled and site.translation.languages.size > 0 and page_excluded_from_translation != true %}
                   {% assign all_languages = site.translation.languages | push: default_language %}
                 {% else %}
                   {% assign all_languages = "" | split: "" | push: default_language %}

package/dist/defaults/dist/_layouts/blueprint/admin/calendar/index.html

@@ -85,7 +85,7 @@ prerender_icons:
         <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
       </div>
       <div class="modal-body">
-        <form id="campaign-editor-form" novalidate onsubmit="return false">
+        <form id="campaign-editor-form" novalidate data-form-state="initializing" onsubmit="return false">
 
           <!-- Campaign Type -->
           <h6 class="mb-3">

package/dist/defaults/dist/_layouts/blueprint/admin/firebase/index.html

@@ -87,7 +87,7 @@ prerender_icons:
         <hr class="my-2">
 
         <!-- Custom Collection Input -->
-        <form id="collection-form" onsubmit="return false">
+        <form id="collection-form" data-form-state="initializing" onsubmit="return false">
           <div class="input-group input-group-sm">
             <input type="text" class="form-control" name="collection.path" placeholder="Collection path..." aria-label="Collection path" required>
             <button type="submit" class="btn btn-outline-adaptive">
@@ -104,7 +104,7 @@ prerender_icons:
         <h6 class="mb-0">{% uj_icon "magnifying-glass", "fa-sm me-2" %} Query</h6>
       </div>
       <div class="card-body">
-        <form id="query-form" onsubmit="return false">
+        <form id="query-form" data-form-state="initializing" onsubmit="return false">
           <div class="mb-2">
             <label for="query-field" class="form-label small mb-1">Field</label>
             <input type="text" class="form-control form-control-sm" name="query.field" id="query-field" placeholder="e.g. auth.email" required>

package/dist/defaults/dist/_layouts/blueprint/admin/studio/index.html

@@ -36,7 +36,7 @@ web_manager:
     <div class="studio-clips" id="studio-clips">
       <!-- Populated by JS from registered clips -->
     </div>
-    <form id="studio-controls-form" class="studio-controls">
+    <form id="studio-controls-form" class="studio-controls" data-form-state="initializing" onsubmit="return false">
       <fieldset id="studio-fieldset">
         <!-- Aspect ratio toggle -->
         <label class="studio-label">

package/dist/defaults/dist/_layouts/blueprint/admin/users/index.html

@@ -101,7 +101,7 @@ prerender_icons:
 </div>
 
 <!-- Search Form -->
-<form id="user-search-form" onsubmit="return false">
+<form id="user-search-form" data-form-state="initializing" onsubmit="return false">
   <div class="row mb-3">
     <div class="col">
       <div class="input-group">
@@ -252,7 +252,7 @@ prerender_icons:
         <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
       </div>
       <div class="modal-body">
-        <form id="user-edit-form" onsubmit="return false">
+        <form id="user-edit-form" data-form-state="initializing" onsubmit="return false">
           <!-- UID (read-only) -->
           <div class="mb-3">
             <label class="form-label small text-muted">UID</label>

package/dist/defaults/dist/_layouts/blueprint/admin/users/new.html

@@ -39,7 +39,7 @@ meta:
         <h5 class="mb-0">Create new user</h5>
       </div>
       <div class="card-body">
-        <form id="create-user-form" novalidate onsubmit="return false">
+        <form id="create-user-form" novalidate data-form-state="initializing" onsubmit="return false">
           <div class="mb-3">
             <label for="email" class="form-label">Email address <span class="text-danger">*</span></label>
             <input type="email" class="form-control" id="email" name="user.email" required autofocus>

package/dist/defaults/dist/_layouts/themes/classy/frontend/pages/account/index.html

@@ -239,7 +239,7 @@ badges:
       <section id="profile-section" class="account-section d-none">
         <h2 class="h3 mb-4" >My profile</h2>
 
-        <form id="profile-form" novalidate onsubmit="return false">
+        <form id="profile-form" novalidate data-form-state="initializing" onsubmit="return false">
           <!-- Avatar and Edit Button -->
           <div class="mb-4">
             <div class="d-flex align-items-center">
@@ -799,7 +799,7 @@ badges:
                     </div>
                   </div>
                   <div class="flex-shrink-0">
-                    <form id="signin-method-{{ method.id }}-form" class="d-grid d-sm-inline-block" novalidate onsubmit="return false">
+                    <form id="signin-method-{{ method.id }}-form" class="d-grid d-sm-inline-block" novalidate data-form-state="initializing" onsubmit="return false">
                       <input type="hidden" name="method" value="{{ method.id }}">
                       {% if method.id == "password" %}
                         <button type="submit" class="btn btn-primary btn-sm" data-action="change">
@@ -841,7 +841,7 @@ badges:
           <div class="card-body">
             <div class="d-flex justify-content-between align-items-center mb-3">
               <h5 class="card-title mb-0">Active sessions</h5>
-              <form id="signout-all-sessions-form" class="d-inline" novalidate onsubmit="return false">
+              <form id="signout-all-sessions-form" class="d-inline" novalidate data-form-state="initializing" onsubmit="return false">
                 <input type="hidden" name="action" value="signout-all">
                 <button type="submit" class="btn btn-outline-danger btn-sm">
                   {% uj_icon "right-from-bracket", "me-1" %}
@@ -967,7 +967,7 @@ badges:
                     </div>
                     <div class="text-start text-sm-end flex-shrink-0">
                       <div>
-                        <form id="connection-form-{{ connection.id }}" class="d-grid d-sm-inline-block" novalidate onsubmit="return false">
+                        <form id="connection-form-{{ connection.id }}" class="d-grid d-sm-inline-block" novalidate data-form-state="initializing" onsubmit="return false">
                           <input type="hidden" name="provider" value="{{ connection.id }}">
                           <!-- Connect button -->
                           <button type="submit" class="btn btn-sm btn-primary" data-action="connect">
@@ -1109,7 +1109,7 @@ badges:
                 If you cancel, your subscription will remain active until the end of your current billing period. After that, you'll be downgraded to the free plan and will lose access to premium features. You can resubscribe at any time.
               </p>
 
-              <form id="cancel-subscription-form" novalidate onsubmit="return false">
+              <form id="cancel-subscription-form" novalidate data-form-state="initializing" onsubmit="return false">
                 <!-- Cancellation Reasons (randomized by JS) -->
                 <div class="mb-3">
                   <label class="form-label">Why are you cancelling?</label>
@@ -1261,7 +1261,7 @@ badges:
           <div class="card-body">
             <h5 class="card-title">Email preferences</h5>
 
-            <form id="marketing-emails-form" novalidate>
+            <form id="marketing-emails-form" novalidate data-form-state="initializing" onsubmit="return false">
               <div class="form-check form-switch mb-3">
                 <input class="form-check-input" type="checkbox" id="marketing-emails" name="enabled">
                 <label class="form-check-label" for="marketing-emails">
@@ -1285,7 +1285,7 @@ badges:
             </div>
             <p class="text-muted small mb-3">Receive push notifications in your browser for important updates.</p>
 
-            <form id="push-subscribe-form" novalidate onsubmit="return false" style="display:none">
+            <form id="push-subscribe-form" novalidate data-form-state="initializing" onsubmit="return false" style="display:none">
               <button type="submit" class="btn btn-adaptive btn-sm" id="push-subscribe-btn">
                 {% uj_icon "bell", "me-1" %}
                 <span class="button-text">Enable push notifications</span>
@@ -1318,7 +1318,7 @@ badges:
           <div class="card-body">
             <div class="d-flex justify-content-between align-items-center mb-3">
               <h5 class="card-title mb-0">Your API key</h5>
-              <form id="reset-api-key-form" class="d-inline" novalidate onsubmit="return false">
+              <form id="reset-api-key-form" class="d-inline" novalidate data-form-state="initializing" onsubmit="return false">
                 <button type="submit" class="btn btn-outline-danger btn-sm" id="reset-api-key-btn">
                   {% uj_icon "rotate", "me-1" %}
                   <span class="button-text">
@@ -1619,7 +1619,7 @@ badges:
               </h5>
               <p id="data-request-status-message" class="card-text text-muted"></p>
               <div id="data-request-download" class="d-none">
-                <form id="data-request-download-form" onsubmit="return false">
+                <form id="data-request-download-form" data-form-state="initializing" onsubmit="return false">
                   <button type="submit" class="btn btn-primary btn-sm" id="data-request-download-btn">
                     {% uj_icon "download", "fa-sm me-2" %}
                     <span class="button-text">Download your data</span>
@@ -1627,7 +1627,7 @@ badges:
                 </form>
               </div>
               <div id="data-request-cancel" class="d-none">
-                <form id="data-request-cancel-form" onsubmit="return false">
+                <form id="data-request-cancel-form" data-form-state="initializing" onsubmit="return false">
                   <button type="submit" class="btn btn-primary btn-sm" id="data-request-cancel-btn">
                     {% uj_icon "rotate-left", "fa-sm me-2" %}
                     <span class="button-text">Request withdrawal</span>
@@ -1648,7 +1648,7 @@ badges:
                   Confirm data request
                 </h5>
 
-                <form id="data-request-form" novalidate onsubmit="return false">
+                <form id="data-request-form" novalidate data-form-state="initializing" onsubmit="return false">
                   <div class="mb-3">
                     <div class="form-check">
                       <input class="form-check-input" type="checkbox" id="data-request-confirm-checkbox" name="confirm_processing_time" required>
@@ -1751,7 +1751,7 @@ badges:
                 Confirm account deletion
               </h5>
 
-              <form id="delete-account-form" novalidate onsubmit="return false">
+              <form id="delete-account-form" novalidate data-form-state="initializing" onsubmit="return false">
                 <div class="mb-3">
                   <label for="delete-reason" class="form-label">Reason for leaving</label>
                   <textarea class="form-control" id="delete-reason" name="reason" rows="3" placeholder="Help us improve by sharing why you're leaving..."></textarea>
@@ -1879,7 +1879,7 @@ badges:
                 Confirm refund request
               </h5>
 
-              <form id="refund-form" novalidate onsubmit="return false">
+              <form id="refund-form" novalidate data-form-state="initializing" onsubmit="return false">
                 <!-- Refund reasons (randomized by JS) -->
                 <div class="mb-3">
                   <label class="form-label">Why are you requesting a refund? <span class="text-danger">*</span></label>

package/dist/defaults/dist/_layouts/themes/classy/frontend/pages/auth/reset.html

@@ -25,12 +25,12 @@ layout: themes/[ site.theme.id ]/frontend/core/cover
       {% capture initializing_spinner %}<span class="spinner-border spinner-border-sm me-2 form-initializing-spinner"></span>{% endcapture %}
 
       <!-- Reset Form -->
-      <form id="auth-form" autocomplete="on" novalidate onsubmit="return false">
+      <form id="auth-form" autocomplete="on" novalidate data-form-state="initializing" onsubmit="return false">
         <div class="mb-4 text-start">
           <label for="email" class="form-label fw-semibold">
             Email <span class="text-danger">*</span>
           </label>
-          <input type="email" class="form-control form-control-md" id="email" name="email" placeholder="Enter your email" autocomplete="email" autofocus required disabled>
+          <input type="email" class="form-control form-control-md" id="email" name="email" placeholder="Enter your email" autocomplete="email" autofocus required>
         </div>
 
         <button type="submit" class="btn btn-success _btn-lg w-100 mb-4" data-provider="email" disabled>

package/dist/defaults/dist/_layouts/themes/classy/frontend/pages/auth/signin.html

@@ -40,7 +40,7 @@ social_signin:
       {% capture initializing_spinner %}<span class="spinner-border spinner-border-sm me-2 form-initializing-spinner"></span>{% endcapture %}
 
       <!-- Sign in Form -->
-      <form id="auth-form" autocomplete="on" novalidate onsubmit="return false">
+      <form id="auth-form" autocomplete="on" novalidate data-form-state="initializing" onsubmit="return false">
         <!-- Hidden default submit button for Enter key -->
         <button type="submit" class="d-none" data-provider="email" aria-hidden="true" tabindex="-1"></button>
 
@@ -67,7 +67,7 @@ social_signin:
           <label for="email" class="form-label fw-semibold">
             Email <span class="text-danger">*</span>
           </label>
-          <input type="email" class="form-control form-control-md" id="email" name="email" placeholder="Enter your email" autocomplete="email" autofocus disabled>
+          <input type="email" class="form-control form-control-md" id="email" name="email" placeholder="Enter your email" autocomplete="email" autofocus>
         </div>
 
         <div class="mb-3 text-start">
@@ -75,7 +75,7 @@ social_signin:
             Password <span class="text-danger">*</span>
           </label>
           <div class="input-group">
-            <input type="password" class="form-control form-control-md" id="password" name="password" placeholder="Enter your password" autocomplete="current-password" disabled>
+            <input type="password" class="form-control form-control-md" id="password" name="password" placeholder="Enter your password" autocomplete="current-password">
             <button class="btn border uj-password-toggle px-3" type="button" aria-label="Toggle password visibility">
               <span class="uj-password-show">{% uj_icon "eye", "fa-fw" %}</span>
               <span class="uj-password-hide d-none">{% uj_icon "eye-slash", "fa-fw" %}</span>

package/dist/defaults/dist/_layouts/themes/classy/frontend/pages/auth/signup.html

@@ -40,7 +40,7 @@ social_signup:
       {% capture initializing_spinner %}<span class="spinner-border spinner-border-sm me-2 form-initializing-spinner"></span>{% endcapture %}
 
       <!-- Sign up Form -->
-      <form id="auth-form" autocomplete="on" novalidate onsubmit="return false">
+      <form id="auth-form" autocomplete="on" novalidate data-form-state="initializing" onsubmit="return false">
         <!-- Hidden default submit button for Enter key -->
         <button type="submit" class="d-none" data-provider="email" aria-hidden="true" tabindex="-1"></button>
 
@@ -77,7 +77,7 @@ social_signup:
           <label for="email" class="form-label fw-semibold">
             Email <span class="text-danger">*</span>
           </label>
-          <input type="email" class="form-control form-control-md" id="email" name="email" placeholder="Enter your email" autocomplete="email" autofocus disabled>
+          <input type="email" class="form-control form-control-md" id="email" name="email" placeholder="Enter your email" autocomplete="email" autofocus>
         </div>
 
         <div class="mb-3 text-start">
@@ -85,7 +85,7 @@ social_signup:
             Password <span class="text-danger">*</span>
           </label>
           <div class="input-group">
-            <input type="password" class="form-control form-control-md" id="password" name="password" placeholder="Create a strong password" autocomplete="new-password" disabled>
+            <input type="password" class="form-control form-control-md" id="password" name="password" placeholder="Create a strong password" autocomplete="new-password">
             <button class="btn border uj-password-toggle px-3" type="button" aria-label="Toggle password visibility">
               <span class="uj-password-show">{% uj_icon "eye", "fa-fw" %}</span>
               <span class="uj-password-hide d-none">{% uj_icon "eye-slash", "fa-fw" %}</span>

package/dist/defaults/dist/_layouts/themes/classy/frontend/pages/blog/index.html

@@ -340,7 +340,7 @@ newsletter_cta:
         {% endiftruthy %}
 
         <!-- Newsletter Form -->
-        <form id="newsletter-form" class="newsletter-form" novalidate onsubmit="return false">
+        <form id="newsletter-form" class="newsletter-form" novalidate data-form-state="initializing" onsubmit="return false">
           <div class="row g-3 justify-content-center">
             <div class="col-md-7">
               <input

package/dist/defaults/dist/_layouts/themes/classy/frontend/pages/contact.html

@@ -178,7 +178,7 @@ faqs:
               {% endiftruthy %}
             </div>
 
-            <form id="contact-form" autocomplete="on" onsubmit="return false">
+            <form id="contact-form" autocomplete="on" data-form-state="initializing" onsubmit="return false">
               <div class="row g-3 mb-4">
                 <div class="col-md-6">
                   <label for="first_name" class="form-label fw-semibold">First name <span class="text-danger">*</span></label>

package/dist/defaults/dist/_layouts/themes/classy/frontend/pages/download.html

@@ -351,7 +351,7 @@ cta:
               {% else %}
                 {% if platform.id == "android" or platform.id == "ios" %}
                   <div class="mb-4 text-start">
-                    <form id="mobile-email-form-{{ platform.id }}" class="mobile-email-form" data-platform="{{ platform.id }}" onsubmit="return false">
+                    <form id="mobile-email-form-{{ platform.id }}" class="mobile-email-form" data-platform="{{ platform.id }}" data-form-state="initializing" onsubmit="return false">
                       <label for="email-{{ platform.id }}" class="form-label">Email address</label>
                       <div class="row g-3">
                         <div class="col-12 col-md-8">

package/dist/defaults/dist/_layouts/themes/classy/frontend/pages/feedback.html

@@ -84,7 +84,7 @@ prerender_icons:
               {% endiftruthy %}
             </div>
 
-            <form id="feedback-form" autocomplete="off" onsubmit="return false">
+            <form id="feedback-form" autocomplete="off" data-form-state="initializing" onsubmit="return false">
               <!-- Rating Selection -->
               <div class="feedback-rating-group mb-4">
                 <input type="hidden" name="rating" id="feedback-rating-input" required>

package/dist/defaults/dist/_layouts/themes/classy/frontend/pages/index.html

@@ -226,7 +226,7 @@ cta:
     <!-- Input Demo: Single input with button -->
     <div class="card bg-glassy border-0 {% unless is_side_layout %}mx-auto{% endunless %} {{ demo.options.class }}">
       <div class="card-body">
-        <form id="hero-demo-form" class="d-flex flex-column {% unless is_side_layout %}flex-sm-row justify-content-center{% endunless %} gap-3" {% iftruthy demo.options.redirect %}data-redirect="{{ demo.options.redirect }}"{% endiftruthy %} onsubmit="return false">
+        <form id="hero-demo-form" class="d-flex flex-column {% unless is_side_layout %}flex-sm-row justify-content-center{% endunless %} gap-3" {% iftruthy demo.options.redirect %}data-redirect="{{ demo.options.redirect }}"{% endiftruthy %} data-form-state="initializing" onsubmit="return false">
           <input
             type="{{ demo.options.input_type | default: 'text' }}"
             name="{{ demo.options.name | default: 'input' }}"
@@ -234,7 +234,6 @@ cta:
             placeholder="{{ demo.options.placeholder }}"
             {% iftruthy demo.options.required %}required{% endiftruthy %}
             autofocus
-            disabled
           >
           {% assign demo_btn_class = demo.options.button.class | default: "btn-adaptive-inverse" %}
           <button type="submit" class="btn {{ demo_btn_class }} btn-lg text-nowrap flex-shrink-0" disabled>
@@ -250,7 +249,7 @@ cta:
   {% elsif demo.type == "form" %}
     <!-- Form Demo: Multiple fields with card styling -->
     <div class="{% unless is_side_layout %}mx-auto{% endunless %} {{ demo.options.class }}">
-      <form id="hero-demo-form" {% iftruthy demo.options.redirect %}data-redirect="{{ demo.options.redirect }}"{% endiftruthy %} onsubmit="return false">
+      <form id="hero-demo-form" {% iftruthy demo.options.redirect %}data-redirect="{{ demo.options.redirect }}"{% endiftruthy %} data-form-state="initializing" onsubmit="return false">
         <div class="row g-3 {% unless is_side_layout %}justify-content-center{% endunless %}">
           {% assign autofocus_set = false %}
           {% for field in demo.options.fields %}
@@ -273,7 +272,6 @@ cta:
                       name="{{ field.name }}"
                       class="form-select form-select-lg border-0"
                       {% iftruthy field.required %}required{% endiftruthy %}
-                      disabled
                     >
                       <option value="" disabled selected>{{ field.placeholder }}</option>
                       {% for option in field.options %}
@@ -289,7 +287,6 @@ cta:
                       rows="{{ field.rows | default: 3 }}"
                       {% iftruthy field.required %}required{% endiftruthy %}
                       {% unless autofocus_set %}autofocus{% assign autofocus_set = true %}{% endunless %}
-                      disabled
                     ></textarea>
                   {% else %}
                     <input
@@ -300,7 +297,6 @@ cta:
                       placeholder="{{ field.placeholder }}"
                       {% iftruthy field.required %}required{% endiftruthy %}
                       {% unless autofocus_set %}autofocus{% assign autofocus_set = true %}{% endunless %}
-                      disabled
                     >
                   {% endif %}
                 </div>

package/dist/defaults/dist/_layouts/themes/classy/frontend/pages/payment/checkout.html

@@ -164,7 +164,7 @@ web_manager:
       </div> -->
 
       <!-- Main Checkout Form -->
-      <form id="checkout-form" autocomplete="on" novalidate onsubmit="return false">
+      <form id="checkout-form" autocomplete="on" novalidate data-form-state="initializing" onsubmit="return false">
         <!-- Content Row -->
         <div class="row d-lg-flex">
           <!-- Section 1: Billing Cycle & Customer Info -->

package/dist/defaults/dist/_layouts/themes/classy/frontend/pages/portal/email-preferences.html

@@ -45,7 +45,7 @@ prerender_icons:
         </div>
 
         <!-- Email preferences Form -->
-        <form id="email-preferences-form" autocomplete="off" onsubmit="return false">
+        <form id="email-preferences-form" autocomplete="off" data-form-state="initializing" onsubmit="return false">
           <!-- Action selector -->
           <div class="mb-4">
             <div class="d-flex gap-2">
@@ -78,8 +78,7 @@ prerender_icons:
               placeholder="Type your email to confirm"
               autocomplete="email"
               autofocus
-              required
-              disabled>
+              required>
             <div class="invalid-feedback"></div>
           </div>
 

package/dist/defaults/dist/_layouts/themes/classy/frontend/pages/status.html

@@ -255,7 +255,7 @@ build_info:
                 {% endiftruthy %}
               </div>
               <div class="col-lg-5">
-                <form id="status-subscribe-form" class="d-flex flex-column flex-sm-row gap-2" novalidate onsubmit="return false">
+                <form id="status-subscribe-form" class="d-flex flex-column flex-sm-row gap-2" novalidate data-form-state="initializing" onsubmit="return false">
                   <input
                     type="email"
                     class="form-control flex-grow-1"

package/dist/defaults/dist/_layouts/themes/newsflash/frontend/pages/blog/index.html

@@ -332,7 +332,7 @@ newsletter_cta:
         {% endiftruthy %}
 
         <!-- Newsletter Form -->
-        <form id="newsletter-form" class="newsletter-form" novalidate onsubmit="return false">
+        <form id="newsletter-form" class="newsletter-form" novalidate data-form-state="initializing" onsubmit="return false">
           <div class="row g-3 justify-content-center">
             <div class="col-md-7">
               <input

package/dist/defaults/dist/_layouts/themes/newsflash/frontend/pages/contact.html

@@ -183,7 +183,7 @@ faqs:
               {% endiftruthy %}
             </div>
 
-            <form id="contact-form" autocomplete="on" onsubmit="return false">
+            <form id="contact-form" autocomplete="on" data-form-state="initializing" onsubmit="return false">
               <div class="row g-3 mb-4">
                 <div class="col-md-6">
                   <label for="first_name" class="form-label fw-semibold">First name <span class="text-danger">*</span></label>

package/dist/defaults/dist/pages/test/libraries/form-manager.html

@@ -28,26 +28,26 @@ meta:
           <small class="text-muted">Success/failure toggle, nested dot notation, change events (check console)</small>
         </div>
         <div class="card-body">
-          <form id="test-form-main">
+          <form id="test-form-main" data-form-state="initializing" onsubmit="return false">
             <div class="row">
               <div class="col-md-6">
                 <div class="mb-3">
                   <label for="main-name" class="form-label">user.name</label>
-                  <input type="text" class="form-control" id="main-name" name="user.name" value="Ian" disabled autofocus>
+                  <input type="text" class="form-control" id="main-name" name="user.name" value="Ian" autofocus>
                 </div>
                 <div class="mb-3">
                   <label for="main-email" class="form-label">user.email</label>
-                  <input type="email" class="form-control" id="main-email" name="user.email" value="ian@example.com" disabled>
+                  <input type="email" class="form-control" id="main-email" name="user.email" value="ian@example.com">
                 </div>
                 <div class="mb-3">
                   <label for="main-city" class="form-label">user.address.city</label>
-                  <input type="text" class="form-control" id="main-city" name="user.address.city" value="NYC" disabled>
+                  <input type="text" class="form-control" id="main-city" name="user.address.city" value="NYC">
                 </div>
               </div>
               <div class="col-md-6">
                 <div class="mb-3">
                   <label for="main-outcome" class="form-label">Simulate outcome</label>
-                  <select class="form-select" id="main-outcome" name="settings.outcome" disabled>
+                  <select class="form-select" id="main-outcome" name="settings.outcome">
                     <option value="success">Success</option>
                     <option value="error">Error (throw Error)</option>
                   </select>
@@ -55,41 +55,41 @@ meta:
                 <div class="mb-3">
                   <label class="form-label d-block">preferences.notifications (radio group)</label>
                   <div class="form-check form-check-inline">
-                    <input type="radio" class="form-check-input" id="notif-all" name="preferences.notifications" value="all" checked disabled>
+                    <input type="radio" class="form-check-input" id="notif-all" name="preferences.notifications" value="all" checked>
                     <label class="form-check-label" for="notif-all">All</label>
                   </div>
                   <div class="form-check form-check-inline">
-                    <input type="radio" class="form-check-input" id="notif-important" name="preferences.notifications" value="important" disabled>
+                    <input type="radio" class="form-check-input" id="notif-important" name="preferences.notifications" value="important">
                     <label class="form-check-label" for="notif-important">Important</label>
                   </div>
                   <div class="form-check form-check-inline">
-                    <input type="radio" class="form-check-input" id="notif-none" name="preferences.notifications" value="none" disabled>
+                    <input type="radio" class="form-check-input" id="notif-none" name="preferences.notifications" value="none">
                     <label class="form-check-label" for="notif-none">None</label>
                   </div>
                 </div>
                 <div class="mb-3">
                   <label class="form-label d-block">preferences.features (checkbox group)</label>
                   <div class="form-check">
-                    <input type="checkbox" class="form-check-input" id="feat-darkmode" name="preferences.features" value="darkmode" disabled>
+                    <input type="checkbox" class="form-check-input" id="feat-darkmode" name="preferences.features" value="darkmode">
                     <label class="form-check-label" for="feat-darkmode">Dark Mode</label>
                   </div>
                   <div class="form-check">
-                    <input type="checkbox" class="form-check-input" id="feat-analytics" name="preferences.features" value="analytics" disabled>
+                    <input type="checkbox" class="form-check-input" id="feat-analytics" name="preferences.features" value="analytics">
                     <label class="form-check-label" for="feat-analytics">Analytics</label>
                   </div>
                   <div class="form-check">
-                    <input type="checkbox" class="form-check-input" id="feat-beta" name="preferences.features" value="beta" disabled>
+                    <input type="checkbox" class="form-check-input" id="feat-beta" name="preferences.features" value="beta">
                     <label class="form-check-label" for="feat-beta">Beta features</label>
                   </div>
                 </div>
                 <div class="mb-3 form-check">
-                  <input type="checkbox" class="form-check-input" id="main-subscribe" name="settings.subscribe" disabled>
+                  <input type="checkbox" class="form-check-input" id="main-subscribe" name="settings.subscribe">
                   <label class="form-check-label" for="main-subscribe">settings.subscribe (single checkbox)</label>
                 </div>
                 <!-- Honeypot field for bot detection (fill to trigger rejection) -->
                 <div class="mb-3">
                   <label for="main-honey" class="form-label">honey <span class="badge bg-warning text-dark">Honeypot</span></label>
-                  <input type="text" class="form-control" id="main-honey" name="honey" data-honey placeholder="Fill to trigger bot rejection" autocomplete="off" tabindex="-1" disabled>
+                  <input type="text" class="form-control" id="main-honey" name="honey" data-honey placeholder="Fill to trigger bot rejection" autocomplete="off" tabindex="-1">
                   <small class="text-muted">Hidden in production; fill here to test rejection</small>
                 </div>
               </div>
@@ -97,7 +97,7 @@ meta:
             <div class="d-flex gap-2">
               <button type="submit" data-action="save" class="btn btn-primary" disabled>Save</button>
               <button type="submit" data-action="draft" class="btn btn-outline-secondary" disabled>Save as Draft</button>
-              <button type="button" id="main-set-data" class="btn btn-outline-info" disabled>Set data</button>
+              <button type="button" id="main-set-data" class="btn btn-outline-info">Set data</button>
             </div>
           </form>
           <div class="mt-3 d-flex gap-3">
@@ -122,21 +122,21 @@ meta:
           <button type="button" id="validation-set-correct" class="btn btn-sm btn-outline-success">Set correct</button>
         </div>
         <div class="card-body">
-          <form id="test-form-validation">
+          <form id="test-form-validation" data-form-state="initializing" onsubmit="return false">
             <div class="mb-3">
               <label for="validation-name" class="form-label">Name (required)</label>
-              <input type="text" class="form-control" id="validation-name" name="name" required disabled>
+              <input type="text" class="form-control" id="validation-name" name="name" required>
             </div>
             <div class="mb-3">
               <label for="validation-email" class="form-label">Email (required, valid format)</label>
-              <input type="email" class="form-control" id="validation-email" name="email" required disabled>
+              <input type="email" class="form-control" id="validation-email" name="email" required>
             </div>
             <div class="mb-3">
               <label for="validation-age" class="form-label">Age (required, must be 18+)</label>
-              <input type="number" class="form-control" id="validation-age" name="age" required min="1" disabled>
+              <input type="number" class="form-control" id="validation-age" name="age" required min="1">
             </div>
             <div class="mb-3 form-check">
-              <input type="checkbox" class="form-check-input" id="validation-terms" name="terms" required disabled>
+              <input type="checkbox" class="form-check-input" id="validation-terms" name="terms" required>
               <label class="form-check-label" for="validation-terms">I agree to the terms (required)</label>
             </div>
             <button type="submit" class="btn btn-primary" disabled>Submit</button>
@@ -156,10 +156,10 @@ meta:
           <small class="text-muted">allowResubmit: false, resetOnSuccess: true</small>
         </div>
         <div class="card-body">
-          <form id="test-form-contact">
+          <form id="test-form-contact" data-form-state="initializing" onsubmit="return false">
             <div class="mb-3">
               <label for="contact-message" class="form-label">Message</label>
-              <textarea class="form-control" id="contact-message" name="message" rows="2" disabled>Hello!</textarea>
+              <textarea class="form-control" id="contact-message" name="message" rows="2">Hello!</textarea>
             </div>
             <button type="submit" class="btn btn-primary" disabled>Send message</button>
           </form>
@@ -178,10 +178,10 @@ meta:
           <small class="text-muted">autoReady: false, ready after 2 seconds</small>
         </div>
         <div class="card-body">
-          <form id="test-form-manual">
+          <form id="test-form-manual" data-form-state="initializing" onsubmit="return false">
             <div class="mb-3">
               <label for="manual-data" class="form-label">Data</label>
-              <input type="text" class="form-control" id="manual-data" name="data" disabled>
+              <input type="text" class="form-control" id="manual-data" name="data">
             </div>
             <button type="submit" class="btn btn-primary" disabled>Submit</button>
           </form>
@@ -200,18 +200,18 @@ meta:
           <small class="text-muted">setInputGroup() filters getData() - fields without data-input-group are global</small>
         </div>
         <div class="card-body">
-          <form id="test-form-groups">
+          <form id="test-form-groups" data-form-state="initializing" onsubmit="return false">
             <div class="row">
               <!-- Global settings (no data-input-group = always included) -->
               <div class="col-md-4">
                 <h6 class="text-muted mb-3">Global settings <span class="badge bg-secondary">Always included</span></h6>
                 <div class="mb-3">
                   <label for="groups-name" class="form-label">settings.name</label>
-                  <input type="text" class="form-control" id="groups-name" name="settings.name" value="My project" disabled>
+                  <input type="text" class="form-control" id="groups-name" name="settings.name" value="My project">
                 </div>
                 <div class="mb-3">
                   <label for="groups-theme" class="form-label">settings.theme</label>
-                  <select class="form-select" id="groups-theme" name="settings.theme" disabled>
+                  <select class="form-select" id="groups-theme" name="settings.theme">
                     <option value="light">Light</option>
                     <option value="dark" selected>Dark</option>
                   </select>
@@ -223,11 +223,11 @@ meta:
                 <h6 class="text-primary mb-3">Group A <span class="badge bg-primary">data-input-group="a"</span></h6>
                 <div class="mb-3">
                   <label for="groups-a-url" class="form-label">options.url</label>
-                  <input type="url" class="form-control" id="groups-a-url" name="options.url" data-input-group="a" value="https://example.com" disabled>
+                  <input type="url" class="form-control" id="groups-a-url" name="options.url" data-input-group="a" value="https://example.com">
                 </div>
                 <div class="mb-3">
                   <label for="groups-a-title" class="form-label">options.title</label>
-                  <input type="text" class="form-control" id="groups-a-title" name="options.title" data-input-group="a" value="My link" disabled>
+                  <input type="text" class="form-control" id="groups-a-title" name="options.title" data-input-group="a" value="My link">
                 </div>
               </div>
 
@@ -236,11 +236,11 @@ meta:
                 <h6 class="text-success mb-3">Group B <span class="badge bg-success">data-input-group="b"</span></h6>
                 <div class="mb-3">
                   <label for="groups-b-ssid" class="form-label">options.ssid</label>
-                  <input type="text" class="form-control" id="groups-b-ssid" name="options.ssid" data-input-group="b" value="MyWiFi" disabled>
+                  <input type="text" class="form-control" id="groups-b-ssid" name="options.ssid" data-input-group="b" value="MyWiFi">
                 </div>
                 <div class="mb-3">
                   <label for="groups-b-password" class="form-label">options.password</label>
-                  <input type="text" class="form-control" id="groups-b-password" name="options.password" data-input-group="b" value="secret123" disabled>
+                  <input type="text" class="form-control" id="groups-b-password" name="options.password" data-input-group="b" value="secret123">
                 </div>
               </div>
             </div>
@@ -273,7 +273,7 @@ meta:
           <small class="text-muted">data-file-drop (local) and data-file-drop="page"</small>
         </div>
         <div class="card-body">
-          <form id="test-form-file-drop">
+          <form id="test-form-file-drop" data-form-state="initializing" onsubmit="return false">
             <h6 class="text-muted mb-2">Local mode <span class="badge bg-secondary">default</span></h6>
             <div class="p-4 text-center mb-3" data-file-drop>
               <p class="mb-2">Drag & drop or click to browse</p>

package/dist/lib/safe-install.js

@@ -0,0 +1,13 @@
+const { execute } = require('node-powertools');
+
+let _hasSfw;
+async function safeInstall(command, options) {
+  if (_hasSfw === undefined) {
+    _hasSfw = await execute('sfw --version', { log: false }).then(() => true).catch(() => false);
+  }
+  const isInstall = /^npm\s+(install|i)\b/.test(command);
+  const prefix = (_hasSfw && isInstall) ? 'sfw ' : '';
+  return execute(`${prefix}${command}`, options || { log: true });
+}
+
+module.exports = { safeInstall };

package/logs/test.log

@@ -1,29 +1,29 @@
-# ujm log — 2026-06-18T20:43:18.296Z — pid=99488
-[13:43:18] 'test': Running tests (layer=all)
-[13:43:18] 'test': Test mode: normal (external APIs skipped)
+# ujm log — 2026-06-22T21:31:38.629Z — pid=3348
+[14:31:38] 'test': Running tests (layer=all)
+[14:31:38] 'test': Test mode: normal (external APIs skipped)
 
   Ultimate Jekyll Manager Tests
 
   Framework Tests
     ⤷ attach-log-file — tee stdout/stderr to a file
-      ✓ exports the expected surface (1ms)
+      ✓ exports the expected surface (0ms)
       ✓ stripAnsi removes color escape codes (0ms)
 hello world
 colored line
       ✓ attach + stdout.write + detach: file contains the writes (0ms)
-      ✓ idempotent: attaching twice with same name returns same fd (0ms)
-      ✓ attach with falsy name returns null and does nothing (1ms)
+      ✓ idempotent: attaching twice with same name returns same fd (1ms)
+      ✓ attach with falsy name returns null and does nothing (0ms)
     ⤷ CLI alias resolution
       ✓ cli.js exports a Main class (0ms)
       ✓ all expected commands exist on disk (0ms)
-      ✓ each command module exports an async function (3ms)
+      ✓ each command module exports an async function (4ms)
     ⤷ collectTextNodes (utils/collectTextNodes.js)
-      ✓ extracts page title (98ms)
+      ✓ extracts page title (101ms)
       ✓ skips <script> and <style> (0ms)
     ✓ spellcheck dictionary (utils/dictionary.js) (0ms)
     ⤷ expect() matcher set
       ✓ toBe + toEqual basics (0ms)
-      ✓ .not negates (1ms)
+      ✓ .not negates (0ms)
       ✓ toContain works on arrays and strings (0ms)
       ✓ toThrow catches sync + async throws (0ms)
       ✓ toBeGreaterThan / toBeLessThan (0ms)
@@ -50,9 +50,9 @@ colored line
     ⤷ mergeJekyllConfigs (utils/merge-jekyll-configs.js)
       ✓ merges collections from both configs (project additions win) (3ms)
       ✓ dedups defaults by scope key (project wins) (1ms)
-      ✓ returns null when there is nothing to merge (1ms)
+      ✓ returns null when there is nothing to merge (0ms)
     ⤷ mode-helpers (isTesting / isDevelopment / isProduction / getVersion)
-      ✓ helpers attach to Manager statically AND on prototype (0ms)
+      ✓ helpers attach to Manager statically AND on prototype (1ms)
       ✓ isTesting reflects UJ_TEST_MODE env (0ms)
       ✓ isDevelopment false / isProduction true when UJ_BUILD_MODE=true (and not testing) (0ms)
       ✓ environments are mutually exclusive — testing wins under UJ_TEST_MODE (0ms)
@@ -60,7 +60,7 @@ colored line
       ✓ getVersion returns a non-empty string when run from a package (0ms)
     ⤷ createTemplateTransform (utils/template-transform.js)
       ✓ replaces [site.theme.id] with config value in .html files (1ms)
-      ✓ leaves non-matching extensions untouched (e.g. .css) (1ms)
+      ✓ leaves non-matching extensions untouched (e.g. .css) (0ms)
       ✓ passes directories through untouched (0ms)
     ⤷ node-powertools templating brackets ({} and [])
       ✓ default { } brackets resolve nested keys (0ms)
@@ -69,57 +69,57 @@ colored line
     ⤷ theme contract (structure, swappability, cross-theme JS contracts)
       ✓ _template: entry files + config contract (1ms)
       ✓ classy: entry files + config contract (0ms)
-      ✓ neobrutalism: entry files + config contract (0ms)
+      ✓ neobrutalism: entry files + config contract (1ms)
       ✓ newsflash: entry files + config contract (0ms)
       ✓ _template: layouts swappable, markup clean (1ms)
-      ✓ classy: layouts swappable, markup clean (14ms)
-      ✓ neobrutalism: layouts swappable, markup clean (2ms)
-      ✓ newsflash: layouts swappable, markup clean (3ms)
+      ✓ classy: layouts swappable, markup clean (15ms)
+      ✓ neobrutalism: layouts swappable, markup clean (1ms)
+      ✓ newsflash: layouts swappable, markup clean (4ms)
       ✓ _template: cross-theme JS contracts (0ms)
       ✓ classy: cross-theme JS contracts (0ms)
       ✓ neobrutalism: cross-theme JS contracts (1ms)
       ✓ newsflash: cross-theme JS contracts (0ms)
-      ✓ page asset files match a declared asset_path shape (4ms)
+      ✓ page asset files match a declared asset_path shape (3ms)
     ⤷ validateYAMLFrontMatter (utils/_validate-yaml.js)
       ✓ returns { valid: true } for a file with valid frontmatter (0ms)
       ✓ returns { valid: true } when no frontmatter present (1ms)
       ✓ flags malformed YAML frontmatter as invalid with error message (0ms)
     ⤷ page-layer baseline (DOM + fetch + storage)
       ✓ document is interactive or complete (1ms)
-      ✓ fetch() works against the local harness server (8ms)
+      ✓ fetch() works against the local harness server (7ms)
       ✓ localStorage is available (1ms)
     ⤷ FormManager getData / setData / input groups
-      ✓ _setNested builds nested objects from dot paths (0ms)
+      ✓ _setNested builds nested objects from dot paths (1ms)
       ✓ _setNested accumulates duplicate keys into arrays (0ms)
       ✓ _getNested reads nested values and returns undefined for missing paths (0ms)
       ✓ _flattenObject converts nested objects to dot paths (1ms)
       ✓ getData collects text, select, radio, and textarea values with dot notation (5ms)
       ✓ getData handles single checkbox (boolean) and checkbox groups (object) (0ms)
       ✓ getData excludes honeypot fields (0ms)
-      ✓ input group filter includes matching + global fields, excludes others (1ms)
+      ✓ input group filter includes matching + global fields, excludes others (0ms)
       ✓ input group filter with multiple groups includes all matching (0ms)
-      ✓ setData populates text, select, textarea fields (0ms)
+      ✓ setData populates text, select, textarea fields (1ms)
       ✓ setData sets radio group to matching value (0ms)
       ✓ setData sets single checkbox boolean and checkbox group values (0ms)
     ⤷ FormManager disabled-state snapshot
       ✓ snapshot captures disabled non-submit elements, ignores submit buttons (1ms)
       ✓ setDisabled(true) disables everything (0ms)
       ✓ setDisabled(false) re-enables managed elements but keeps snapshotted ones disabled (0ms)
-      ✓ survives multiple disable/enable cycles (0ms)
+      ✓ survives multiple disable/enable cycles (1ms)
       ✓ onsubmit="return false" blocks native submission before FM loads (10ms)
     ⤷ FormManager validation + honeypot + file-accept
       ✓ required text field fails when empty, passes when filled (0ms)
-      ✓ required checkbox fails when unchecked (1ms)
+      ✓ required checkbox fails when unchecked (0ms)
       ✓ required radio group fails when none checked (0ms)
-      ✓ email validation rejects invalid formats and accepts valid ones (0ms)
-      ✓ number min/max validation catches out-of-range values (1ms)
+      ✓ email validation rejects invalid formats and accepts valid ones (1ms)
+      ✓ number min/max validation catches out-of-range values (2ms)
       ✓ minlength and maxlength validation (0ms)
       ✓ pattern attribute validation (0ms)
       ✓ honeypot detection catches [data-honey] and [name="honey"] fields (0ms)
       ✓ honeypot detects data-honey without name="honey" (0ms)
       ✓ file-accept matching: extension, wildcard MIME, exact MIME (0ms)
-      ✓ field error display adds is-invalid class and feedback element (0ms)
-      ✓ query param population skips UTM/tracking params (1ms)
+      ✓ field error display adds is-invalid class and feedback element (1ms)
+      ✓ query param population skips UTM/tracking params (0ms)
       ✓ data-form-state attribute reflects state transitions (0ms)
     ⤷ harness globals (window.Configuration + dataset)
       ✓ window.Configuration has brand + theme + web_manager (0ms)
@@ -129,16 +129,16 @@ colored line
       ✓ template#prerendered-icons exists and has the test icon (1ms)
       ✓ looking up a missing icon returns null (0ms)
     ⤷ boot tests (consumer _site/)
-      ✓ /service-worker.js served with javascript content type (130ms)
-      ✓ index.html registers SW and reaches activated state (182ms)
-      ✓ SW responds to get-cache-name message with brand-id pattern (86ms)
-      ✓ home page renders with title + body content (187ms)
-      ✓ /about resolves via Jekyll-style .html fallback (73ms)
-      ✓ build.json is served with brand metadata (76ms)
-      ✓ CSS bundle served with text/css content type (87ms)
+      ✓ /service-worker.js served with javascript content type (74ms)
+      ✓ index.html registers SW and reaches activated state (169ms)
+      ✓ SW responds to get-cache-name message with brand-id pattern (75ms)
+      ✓ home page renders with title + body content (176ms)
+      ✓ /about resolves via Jekyll-style .html fallback (67ms)
+      ✓ build.json is served with brand metadata (69ms)
+      ✓ CSS bundle served with text/css content type (62ms)
 
   Results
     110 passing
 
-    Total: 110 tests in 3274ms
+    Total: 110 tests in 2945ms
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultimate-jekyll-manager",
-  "version": "1.9.4",
+  "version": "1.9.5",
   "description": "Ultimate Jekyll dependency manager",
   "main": "dist/index.js",
   "exports": {

package/plans/fix-translation-exclude-404s.md

@@ -0,0 +1,113 @@
+# Fix: Translation exclude list not respected by footer language switcher
+
+## Problem
+
+Every UJM site with translation enabled generates dead language links on excluded pages (e.g. blog posts), causing widespread 404s indexed by Google.
+
+**Root cause:** The footer language switcher and the `uj_translation_url` Ruby tag both generate language-prefixed URLs (`/es/blog/my-post`, `/ko/blog/my-post`) without checking the `translation.exclude` list. Meanwhile, the translation gulp task correctly skips excluded pages — so the translated HTML files are never generated, but the links to them are.
+
+**Impact:** Every blog post on every site with translation enabled has footer links to non-existent translated pages. Google discovers these via crawling, indexes them as 404s, and inflates "Page not found" stats in GA4 (often 40-50% of all pageviews). Also harms crawl budget.
+
+**Example (operst):**
+- Config: `translation.enabled: true`, `exclude: ["blog"]`, languages: `es`, `ko`
+- Footer on `/blog/my-post` links to `/es/blog/my-post` and `/ko/blog/my-post`
+- Neither of those pages exist — both return 404
+- GA4 shows "Oops! This page doesn't exist" as the #1 page at 45% of traffic
+
+## Fix 1: Footer template (DONE)
+
+**File:** `src/defaults/dist/_includes/themes/classy/frontend/sections/footer.html`
+
+**Change:** Before rendering the language dropdown, check the current page against the exclude list. If matched, only show the default language (same behavior as when translation is disabled).
+
+```liquid
+{% assign page_excluded_from_translation = false %}
+{% for exclude in site.translation.exclude %}
+  {% assign exclude_folder = "/" | append: exclude | append: "/" %}
+  {% assign exclude_page = "/" | append: exclude %}
+  {% if page.url == exclude_page or page.url contains exclude_folder %}
+    {% assign page_excluded_from_translation = true %}
+  {% endif %}
+{% endfor %}
+{% if site.translation.enabled and site.translation.languages.size > 0 and page_excluded_from_translation != true %}
+  {% assign all_languages = site.translation.languages | push: default_language %}
+{% else %}
+  {% assign all_languages = "" | split: "" | push: default_language %}
+{% endif %}
+```
+
+**Matching logic:** Uses the same pattern as `translation.js` — each exclude entry matches as both a folder prefix (`/blog/...`) and an exact page path (`/blog`).
+
+**Status:** Applied to `src/defaults/dist/_includes/themes/classy/frontend/sections/footer.html`. Needs `npm run prepare` to copy to `dist/`.
+
+## Fix 2: `uj_translation_url` Ruby tag (DONE)
+
+**File:** `jekyll-uj-powertools` gem, `lib/tags/translation_url.rb`
+
+**Current code (v1.7.9):** The `render` method generates language-prefixed URLs without checking the exclude list at all. When called with `{% uj_translation_url "es", page.url %}` on a blog post, it returns `/es/blog/my-post` regardless of whether blog is excluded.
+
+**Proposed change:** Add an exclude check in the `render` method. If the URL path matches an exclude entry, return the un-prefixed (default language) URL instead of the language-prefixed one. This is defense-in-depth — even if a template forgets to check, the tag itself won't generate dead links.
+
+```ruby
+def render(context)
+  # ... existing argument parsing ...
+
+  # Get site and translation config from context
+  site = context.registers[:site]
+  return '/' unless site
+
+  translation_config = site.config['translation'] || {}
+  default_language = translation_config['default'] || 'en'
+  available_languages = translation_config['languages'] || [default_language]
+
+  # NEW: Check if the URL path is excluded from translation
+  excludes = translation_config['exclude'] || []
+  normalized_path = normalize_path(url_path)
+  if page_excluded?(normalized_path, excludes)
+    # Return un-prefixed URL for excluded pages
+    return normalized_path.empty? ? '/' : "/#{normalized_path}"
+  end
+
+  # ... rest of existing logic (validate language, generate URL) ...
+end
+
+private
+
+# NEW: Check if a page path matches any exclude entry
+def page_excluded?(normalized_path, excludes)
+  return false if excludes.empty? || normalized_path.empty?
+
+  excludes.any? do |exclude|
+    # Match as exact page path or as folder prefix
+    normalized_path == exclude || normalized_path.start_with?("#{exclude}/")
+  end
+end
+```
+
+**Applied:** `jekyll-uj-powertools` v1.7.11. Version bumped in gemspec + CHANGELOG updated.
+
+## Fix 3: Consider — strip language dropdown entirely on excluded pages
+
+The current Fix 1 still renders a language dropdown with a single "English" option on excluded pages. An alternative is to hide the dropdown entirely when the page is excluded. This is a UX call — showing a single-language dropdown is harmless but arguably useless.
+
+To hide it entirely, wrap the `<div class="dropup uj-language-dropdown">` block in:
+```liquid
+{% unless page_excluded_from_translation and site.translation.enabled %}
+  <!-- language dropdown markup -->
+{% endunless %}
+```
+
+## Verification
+
+After applying Fix 1 and rebuilding a site:
+
+1. Visit a blog post → footer should show only "English" (or no language dropdown)
+2. Visit a non-excluded page (e.g. `/pricing`) → footer should show all languages
+3. View page source on a blog post → no `href="/es/blog/..."` links in footer
+4. After reindexing, GA4 "Page not found" percentage should drop significantly
+
+## Scope
+
+- Fix 1 covers ALL UJM sites (classy is the base footer for all themes)
+- Fix 2 covers any future template that uses `uj_translation_url` on excluded pages
+- The spam bot traffic (`/ar/`, `/fr/`, etc. from disabled languages) is separate — those are fabricated URLs from crawlers, not caused by UJM. A Cloudflare WAF rule can block those if desired.