cpanel-doctor 0.2.0__tar.gz

cpanel_doctor-0.2.0/.gitignore

@@ -0,0 +1,23 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+build/
+dist/
+.venv/
+venv/
+env/
+
+# Tooling
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.coverage
+htmlcov/
+
+# Editors / OS
+.idea/
+.vscode/
+*.swp
+.DS_Store

cpanel_doctor-0.2.0/CHANGELOG.md

@@ -0,0 +1,30 @@
+# Changelog
+
+All notable changes to **cPanel Doctor** are documented here.
+The format follows [Keep a Changelog](https://keepachangelog.com/).
+
+## [0.2.0] — 2026-06-26
+### Added
+- `account-startdate` patch — fixes newly created cPanel accounts being recorded
+  with a creation date in the **past** (`STARTDATE` in `/var/cpanel/users/<user>`,
+  surfaced as `unix_startdate`) even though the OS clock is correct. Installs a
+  `Whostmgr::Accounts::Create` (post) hook that rewrites `STARTDATE` to the
+  authoritative system date (read via `/usr/bin/date` in a clean child process)
+  through `Cpanel::Config::CpUserGuard`, updating both the datastore and the
+  `users.cache`. Components `hook_script` and `hook_registration`; self-heals via
+  `reapply` / the post-upcp hook if either is dropped.
+
+## [0.1.0] — 2026-06-25
+### Added
+- Patch engine: component-based patches with applicable / not-applied / **drifted**
+  / applied state detection, idempotent apply and clean reverse-removal.
+- `pg-cpses` patch — fixes phpPgAdmin/PostgreSQL "Authentication failed" caused by
+  a broken vendor `pam_cpses.so`, without weakening per-account isolation.
+- `https-redirect-date` patch — fixes the greyed-out **Force HTTPS Redirect** toggle
+  in cPanel » Domains when the SSL-validity check (`ssl_call.pm`) perceives a past
+  date and treats valid certificates as not-yet-valid; the check is made to read the
+  authoritative system date instead.
+- Interactive **Textual** TUI and a scriptable CLI (`list`, `status`, `apply`,
+  `remove`, `reapply`, `test`, `hook`), with `--dry-run`.
+- Post-`upcp` self-heal hook (`hook install`) that re-applies drifted patches
+  after cPanel updates.

cpanel_doctor-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 crocky.host
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

cpanel_doctor-0.2.0/PATCHES.md

@@ -0,0 +1,105 @@
+# Patches
+
+Every fix in cPanel Doctor is a **patch** built from independent **components**
+(a file, a service, a config edit, a hook …). The doctor derives each patch's
+status from its components, so *applicable / not-applied / **drifted** / applied*
+detection, idempotent apply, surgical re-apply and clean removal all come for free.
+
+| ID | Fixes |
+|----|-------|
+| [`account-startdate`](#account-startdate--new-accounts-get-a-past-creation-date) | new accounts recorded with a creation date in the past |
+| [`https-redirect-date`](#https-redirect-date--force-https-redirect-greyed-out) | greyed-out **Force HTTPS Redirect** toggle |
+| [`pg-cpses`](#pg-cpses--phppgadmin--postgresql-cpses-login) | phpPgAdmin *"Authentication failed"* (broken `pam_cpses.so`) |
+
+---
+
+## `account-startdate` — new accounts get a past creation date
+When an account is created in WHM, its creation date (`STARTDATE` in
+`/var/cpanel/users/<user>`, shown as `unix_startdate` by `whmapi1 listaccts`) is
+written with a timestamp in the **past**, even though the host's OS clock is
+correct — so every freshly created account shows a wrong creation date in WHM.
+The patch installs a `Whostmgr::Accounts::Create` **post** hook that, right after
+creation, rewrites `STARTDATE` to the **authoritative system date** (`/usr/bin/date`
+in a clean child process, bypassing the bad in-process clock) via
+`Cpanel::Config::CpUserGuard`, updating both the datastore and the `users.cache`
+entry. It only corrects a date that is clearly wrong (off by more than a day) and
+always reports success, so it can never block account creation.
+
+Components `hook_script` (the Perl hook on disk) and `hook_registration` (the
+`manage_hooks` entry). It fixes accounts created **after** it is applied; it does
+not rewrite pre-existing dates. Neither component is a vendor file, but if either
+goes missing it reads as **DRIFTED** and is healed by `reapply` / the post-upcp hook.
+
+## `https-redirect-date` — Force HTTPS Redirect greyed out
+The **Force HTTPS Redirect** toggle in *cPanel » Domains* is greyed out even
+though AutoSSL issues valid certificates. cPanel only enables it when it judges
+the certificate *currently valid*; that check (`_ssl_actually_valid` in
+`Cpanel/Admin/Modules/Cpanel/ssl_call.pm`) compares the **process clock** against
+the cert's `not_before`/`not_after`. When this process perceives a date in the
+**past**, valid certs read as "not yet valid", `ssl_valid` is false, and the UI
+disables the toggle (AutoSSL is unaffected). The patch makes that check read the
+**authoritative system date** (`/usr/bin/date` in a clean child process), falling
+back to `time()` if the clock can't be read.
+
+Single component `ssl_call`: the vendor file is edited in place (original backed
+up to `ssl_call.pm.orig`). A cPanel update overwrites it → the patch reads as
+**NOT APPLIED** and is restored by `reapply` / the post-upcp hook.
+
+## `pg-cpses` — phpPgAdmin / PostgreSQL cpses login
+On affected builds the vendor `pam_cpses.so` rejects **every** valid PostgreSQL
+cpses session, so phpPgAdmin shows *"Authentication failed"* for all accounts
+(MySQL/phpMyAdmin are fine). The patch routes the `postgresql_cpses` PAM service
+through a validator that accepts only **recent, genuine** cpses session secrets,
+and points phpPgAdmin at the cpses PAM IP (`127.0.0.200`).
+
+**Security:** `pg_hba`'s `samerole` is left untouched (per-account DB isolation is
+preserved); the path is loopback-only; the 32-char session secret lives in
+`/var/cpanel/cpses/keys` (`root:cpses 0750`) and is unreadable by ordinary users,
+so it can't be forged. Components: `validator`, `pam` (backs up the original),
+`loopback`, `phppgadmin`.
+
+---
+
+## Writing a new patch
+Drop a `Patch` subclass under `cpanel_doctor/patches/`; it's auto-discovered. A
+patch is a list of `Component`s, each with `present` / `apply` / `remove`. Because
+status is derived from the components, drift detection and surgical re-apply are
+automatic.
+
+```python
+from cpanel_doctor.core import Component, Patch, Runner
+
+class MyPatch(Patch):
+    id = "my-fix"
+    name = "Short title"
+    summary = "One line shown in `list`."
+    description = "Longer text shown in the TUI detail pane."
+
+    def applicable(self, r: Runner):
+        return r.exists("/some/marker"), "why not, if not"
+
+    def components(self):
+        return [
+            Component(
+                key="thing",
+                description="what it is",
+                present=lambda r: r.exists("/etc/thing"),
+                apply=lambda r: r.write("/etc/thing", "...", 0o644),
+                remove=lambda r: r.remove("/etc/thing"),
+            ),
+        ]
+
+    def self_test(self, r: Runner):     # optional functional check after apply
+        return True, "ok"
+```
+
+Guidelines:
+
+* **Idempotent** — `present` must be cheap and side-effect free; `apply` only
+  touches what's missing.
+* **Reversible** — `remove` undoes `apply`; back up vendor files (`Runner.backup`)
+  so removal can restore them.
+* **Honest applicability** — return `NOT_APPLICABLE` rather than editing a file you
+  don't recognise (see `https-redirect-date`, which refuses an unfamiliar build).
+* **Never break the host** — a hook/patch should fail safe (always report success
+  to cPanel where relevant) and prefer correcting only clearly-wrong state.

cpanel_doctor-0.2.0/PKG-INFO

@@ -0,0 +1,109 @@
+Metadata-Version: 2.4
+Name: cpanel-doctor
+Version: 0.2.0
+Summary: Intelligent, interactive doctor that diagnoses, applies and removes fixes (patches) for known cPanel/WHM problems.
+Project-URL: Homepage, https://github.com/CrockyHost/cpanel-doctor
+Project-URL: Issues, https://github.com/CrockyHost/cpanel-doctor/issues
+Author: crocky.host
+License: MIT
+License-File: LICENSE
+Keywords: cpanel,patch,phppgadmin,postgresql,sysadmin,tui,whm
+Classifier: Environment :: Console
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: System :: Systems Administration
+Requires-Python: >=3.8
+Requires-Dist: rich>=13.0
+Requires-Dist: textual>=0.40
+Provides-Extra: dev
+Requires-Dist: pytest>=7; extra == 'dev'
+Requires-Dist: ruff>=0.1; extra == 'dev'
+Requires-Dist: textual-dev>=1.2; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# cPanel Doctor
+
+**Diagnose and fix known cPanel/WHM problems — intelligently, interactively, reversibly.**
+
+cPanel Doctor models each fix as a **patch** made of independent **components**. It
+*knows* whether a patch is applicable, fully applied, not applied, or **drifted**
+(partly reset — e.g. by a cPanel update), and it can apply, re-apply only the
+drifted bits, or cleanly remove a patch. There's a colourful [Textual](https://textual.textualize.io/)
+TUI and a scriptable CLI.
+
+```
+┌ cPanel Doctor v0.2.0 ──────────────────────────────────────────────┐
+│ ID                   Status     Patch                              │
+│ account-startdate    APPLIED    New accounts' creation date (past)  │
+│ https-redirect-date  APPLIED    Force HTTPS Redirect (past date)    │
+│ pg-cpses             APPLIED    phpPgAdmin / PostgreSQL cpses login │
+│ post-upcp self-heal hook: installed (System::upcp post)            │
+└─────────────────────────────────────────────────────────────────────┘
+```
+
+## Install
+
+```bash
+pipx install cpanel-doctor        # recommended
+# or
+pip install cpanel-doctor
+```
+
+Requires **Python 3.8+** (cPanel's system Python may be older — use `pipx`,
+a venv, or your distro's newer Python). Most actions modify system files and
+need **root**.
+
+## Use
+
+```bash
+cpanel-doctor                 # interactive TUI (default)
+cpanel-doctor list            # one-line status per patch
+cpanel-doctor status pg-cpses # detailed, per-component status
+sudo cpanel-doctor apply pg-cpses
+sudo cpanel-doctor apply pg-cpses --dry-run   # preview, change nothing
+sudo cpanel-doctor remove pg-cpses
+cpanel-doctor test pg-cpses    # functional self-test
+sudo cpanel-doctor hook install # self-heal after cPanel updates
+```
+
+### TUI keys
+`a` apply · `r` remove · `h` re-apply drift · `t` self-test · `k` toggle hook ·
+`d` refresh · `q` quit.
+
+## Self-healing after `upcp`
+
+cPanel updates overwrite vendor-managed files (for `pg-cpses`, phpPgAdmin's
+`config.inc.php`/`intro.php`), which **drifts** a patch. Install the hook once:
+
+```bash
+sudo cpanel-doctor hook install
+```
+
+It registers a cPanel Standardized Hook on `System::upcp` (post stage) that runs
+`cpanel-doctor reapply` after every update, healing only the drifted components.
+
+## Patches
+
+Three patches ship today — see **[PATCHES.md](PATCHES.md)** for full descriptions,
+security notes and a guide to writing your own.
+
+| ID | Fixes |
+|----|-------|
+| `account-startdate` | new accounts recorded with a creation date in the past |
+| `https-redirect-date` | greyed-out **Force HTTPS Redirect** toggle |
+| `pg-cpses` | phpPgAdmin *"Authentication failed"* (broken `pam_cpses.so`) |
+
+New patches are auto-discovered — drop a `Patch` subclass in
+`cpanel_doctor/patches/` (see [PATCHES.md](PATCHES.md#writing-a-new-patch)).
+
+## Safety
+
+- `--dry-run` previews every action without touching the system.
+- `remove` reverses each component (restoring `.orig` backups where taken).
+- Read-only `status`/`list`/`test` never change anything and don't need root.
+
+## License
+
+MIT © crocky.host

cpanel_doctor-0.2.0/README.md

@@ -0,0 +1,84 @@
+# cPanel Doctor
+
+**Diagnose and fix known cPanel/WHM problems — intelligently, interactively, reversibly.**
+
+cPanel Doctor models each fix as a **patch** made of independent **components**. It
+*knows* whether a patch is applicable, fully applied, not applied, or **drifted**
+(partly reset — e.g. by a cPanel update), and it can apply, re-apply only the
+drifted bits, or cleanly remove a patch. There's a colourful [Textual](https://textual.textualize.io/)
+TUI and a scriptable CLI.
+
+```
+┌ cPanel Doctor v0.2.0 ──────────────────────────────────────────────┐
+│ ID                   Status     Patch                              │
+│ account-startdate    APPLIED    New accounts' creation date (past)  │
+│ https-redirect-date  APPLIED    Force HTTPS Redirect (past date)    │
+│ pg-cpses             APPLIED    phpPgAdmin / PostgreSQL cpses login │
+│ post-upcp self-heal hook: installed (System::upcp post)            │
+└─────────────────────────────────────────────────────────────────────┘
+```
+
+## Install
+
+```bash
+pipx install cpanel-doctor        # recommended
+# or
+pip install cpanel-doctor
+```
+
+Requires **Python 3.8+** (cPanel's system Python may be older — use `pipx`,
+a venv, or your distro's newer Python). Most actions modify system files and
+need **root**.
+
+## Use
+
+```bash
+cpanel-doctor                 # interactive TUI (default)
+cpanel-doctor list            # one-line status per patch
+cpanel-doctor status pg-cpses # detailed, per-component status
+sudo cpanel-doctor apply pg-cpses
+sudo cpanel-doctor apply pg-cpses --dry-run   # preview, change nothing
+sudo cpanel-doctor remove pg-cpses
+cpanel-doctor test pg-cpses    # functional self-test
+sudo cpanel-doctor hook install # self-heal after cPanel updates
+```
+
+### TUI keys
+`a` apply · `r` remove · `h` re-apply drift · `t` self-test · `k` toggle hook ·
+`d` refresh · `q` quit.
+
+## Self-healing after `upcp`
+
+cPanel updates overwrite vendor-managed files (for `pg-cpses`, phpPgAdmin's
+`config.inc.php`/`intro.php`), which **drifts** a patch. Install the hook once:
+
+```bash
+sudo cpanel-doctor hook install
+```
+
+It registers a cPanel Standardized Hook on `System::upcp` (post stage) that runs
+`cpanel-doctor reapply` after every update, healing only the drifted components.
+
+## Patches
+
+Three patches ship today — see **[PATCHES.md](PATCHES.md)** for full descriptions,
+security notes and a guide to writing your own.
+
+| ID | Fixes |
+|----|-------|
+| `account-startdate` | new accounts recorded with a creation date in the past |
+| `https-redirect-date` | greyed-out **Force HTTPS Redirect** toggle |
+| `pg-cpses` | phpPgAdmin *"Authentication failed"* (broken `pam_cpses.so`) |
+
+New patches are auto-discovered — drop a `Patch` subclass in
+`cpanel_doctor/patches/` (see [PATCHES.md](PATCHES.md#writing-a-new-patch)).
+
+## Safety
+
+- `--dry-run` previews every action without touching the system.
+- `remove` reverses each component (restoring `.orig` backups where taken).
+- Read-only `status`/`list`/`test` never change anything and don't need root.
+
+## License
+
+MIT © crocky.host

cpanel_doctor-0.2.0/pyproject.toml

@@ -0,0 +1,47 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "cpanel-doctor"
+version = "0.2.0"
+description = "Intelligent, interactive doctor that diagnoses, applies and removes fixes (patches) for known cPanel/WHM problems."
+readme = "README.md"
+requires-python = ">=3.8"
+license = { text = "MIT" }
+authors = [{ name = "crocky.host" }]
+keywords = ["cpanel", "whm", "postgresql", "phppgadmin", "patch", "sysadmin", "tui"]
+classifiers = [
+    "Environment :: Console",
+    "Intended Audience :: System Administrators",
+    "License :: OSI Approved :: MIT License",
+    "Operating System :: POSIX :: Linux",
+    "Programming Language :: Python :: 3",
+    "Topic :: System :: Systems Administration",
+]
+dependencies = [
+    "textual>=0.40",
+    "rich>=13.0",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=7", "textual-dev>=1.2", "ruff>=0.1"]
+
+[project.urls]
+Homepage = "https://github.com/CrockyHost/cpanel-doctor"
+Issues = "https://github.com/CrockyHost/cpanel-doctor/issues"
+
+[project.scripts]
+cpanel-doctor = "cpanel_doctor.cli:main"
+cpdoctor = "cpanel_doctor.cli:main"
+
+[tool.hatch.build.targets.wheel]
+# Assets (.sh/.service/.pl) live inside the package and are included automatically.
+packages = ["src/cpanel_doctor"]
+
+[tool.hatch.build.targets.sdist]
+include = ["src/cpanel_doctor", "README.md", "LICENSE", "PATCHES.md", "CHANGELOG.md"]
+
+[tool.ruff]
+line-length = 100
+target-version = "py38"

cpanel_doctor-0.2.0/src/cpanel_doctor/__init__.py

@@ -0,0 +1,5 @@
+"""cPanel Doctor — diagnose and fix known cPanel/WHM problems, intelligently."""
+from __future__ import annotations
+
+__version__ = "0.2.0"
+__all__ = ["__version__"]

cpanel_doctor-0.2.0/src/cpanel_doctor/__main__.py

@@ -0,0 +1,4 @@
+from cpanel_doctor.cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

cpanel_doctor-0.2.0/src/cpanel_doctor/assets/cpanel_doctor_account_startdate.pl

@@ -0,0 +1,96 @@
+#!/usr/local/cpanel/3rdparty/bin/perl
+
+# cpanel-doctor:account-startdate
+# ------------------------------------------------------------------------------
+# cPanel Doctor :: account creation-date fix
+#
+# Registered as a cPanel Standardized Hook on Whostmgr::Accounts::Create (post
+# stage). On affected hosts the account creation date (STARTDATE in
+# /var/cpanel/users/<user>) is written with a timestamp in the *past* at
+# creation time, even though the OS clock is correct -- so freshly created
+# accounts show a wrong creation date in WHM. This hook runs right after an
+# account is created and rewrites STARTDATE to the real "now".
+#
+# The true current time is read from a CLEAN child process (env -i + /bin/date),
+# bypassing any per-process time override (e.g. an LD_PRELOAD/libfaketime
+# inherited from the account-creation process): a plain `date` on the host is
+# correct, so dropping the inherited environment is enough to get the real
+# epoch. Falls back to the in-process time() if the clock can't be read.
+#
+# Writing through Cpanel::Config::CpUserGuard updates BOTH the datastore
+# (/var/cpanel/users/<user>) and the cache (/var/cpanel/users.cache/<user>).
+#
+# Installed / removed automatically by:  cpanel-doctor apply|remove account-startdate
+# Managed by cpanel-doctor -- do not edit by hand.
+#
+# Fail-safe: any problem is logged and the hook still reports success (post
+# stage; it must never disrupt account creation).
+
+use strict;
+use warnings;
+
+use Cpanel::JSON                ();
+use Cpanel::Config::CpUserGuard ();
+
+my $LOG = '/var/log/cpanel-doctor.log';
+
+# Best-effort log line; never fatal.
+sub _log {
+    my ($msg) = @_;
+    eval {
+        open my $fh, '>>', $LOG or return;
+        my $ts = localtime();
+        print {$fh} "$ts account-startdate: $msg\n";
+        close $fh;
+    };
+    return;
+}
+
+# Always report success to cPanel (first line "1 <message>"), then exit.
+my $done = sub {
+    my ($msg) = @_;
+    _log($msg);
+    print "1 account-startdate: $msg\n";
+    exit 0;
+};
+
+# ---- read the hook payload (JSON on STDIN) ---------------------------------
+my $raw = do { local $/; <STDIN> };
+my $payload = eval { Cpanel::JSON::Load($raw) } || {};
+
+# Accounts::Create delivers the new account name under data.user.
+my $user =
+       $payload->{'data'}{'user'}
+    // $payload->{'data'}{'username'}
+    // $payload->{'user'};
+
+$done->("no user in payload, nothing to do") if !defined $user || $user eq '';
+
+$user =~ s/[^A-Za-z0-9._-]//g;    # sanitize
+$done->("invalid user name, skipping")        if $user eq '';
+$done->("no datastore for '$user', skipping") if !-e "/var/cpanel/users/$user";
+
+# ---- true current epoch, bypassing any inherited time faking ---------------
+my $now = '';
+{
+    my $out = `/usr/bin/env -i /bin/date +%s 2>/dev/null`;
+    ($now) = ( ( $out // '' ) =~ /(\d{9,})/ );
+}
+$now ||= time();    # last-resort fallback
+
+# ---- correct STARTDATE only if it is clearly wrong (off by > 1 day) --------
+my $guard = eval { Cpanel::Config::CpUserGuard->new($user) }
+    or $done->("could not open datastore for '$user'");
+
+my $cur = $guard->{'data'}{'STARTDATE'} // 0;
+
+if ( abs( $now - $cur ) <= 86400 ) {
+    $done->("STARTDATE for '$user' already current ($cur), leaving as-is");
+}
+
+$guard->{'data'}{'STARTDATE'} = $now;
+
+eval { $guard->save(); 1 }
+    or $done->("save failed for '$user': $@");
+
+$done->("STARTDATE for '$user' corrected: $cur -> $now");

cpanel_doctor-0.2.0/src/cpanel_doctor/assets/cpanel_doctor_posthook.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+#
+# cPanel Doctor :: post-upcp hook
+# ------------------------------------------------------------------------------
+# Registered as a cPanel Standardized Hook on System::upcp (post stage). cPanel
+# updates overwrite vendor-managed files (e.g. phpPgAdmin's config.inc.php), which
+# silently un-does parts of some patches. After every upcp this re-applies any
+# DRIFTED cpanel-doctor patch -- surgically, only the missing pieces.
+#
+# Registered/removed automatically by:  cpanel-doctor hook install | hook remove
+#
+# cPanel passes the hook context as JSON on stdin; we ignore it and just heal.
+cat >/dev/null 2>&1   # drain stdin
+
+LOG=/var/log/cpanel-doctor.log
+{
+    echo "=== $(date '+%F %T') post-upcp: re-applying drifted patches ==="
+    # Prefer the installed console script; fall back to module execution.
+    if command -v cpanel-doctor >/dev/null 2>&1; then
+        cpanel-doctor reapply --yes
+    elif command -v cpdoctor >/dev/null 2>&1; then
+        cpdoctor reapply --yes
+    else
+        "${CPANEL_DOCTOR_PYTHON:-python3}" -m cpanel_doctor reapply --yes
+    fi
+} >>"$LOG" 2>&1
+
+# Standardized hooks must print a JSON result and exit 0.
+echo '{"status":1,"message":"cpanel-doctor reapply complete"}'
+exit 0

cpanel_doctor-0.2.0/src/cpanel_doctor/assets/cpses-postgres-ip.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=cPanel Doctor: cpses loopback 127.0.0.200 for phpPgAdmin/PostgreSQL
+Documentation=https://github.com/CrockyHost/cpanel-doctor
+After=network-pre.target
+Before=postgresql.service
+DefaultDependencies=no
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/bin/bash -c '/sbin/ip addr show dev lo | grep -qw 127.0.0.200 || /sbin/ip addr add 127.0.0.200/32 dev lo'
+ExecStop=-/sbin/ip addr del 127.0.0.200/32 dev lo
+
+[Install]
+WantedBy=multi-user.target

cpanel_doctor-0.2.0/src/cpanel_doctor/assets/pam_cpses_postgres.sh

@@ -0,0 +1,59 @@
+#!/bin/bash
+#
+# cPanel Doctor :: cpses PostgreSQL auth validator
+# ------------------------------------------------------------------------------
+# Drop-in replacement for the stock (broken) pam_cpses.so, wired ONLY into the
+# `postgresql_cpses` PAM service -- the cpses path on 127.0.0.200 that phpPgAdmin
+# uses. On affected cPanel builds the vendor module rejects every valid cpses
+# session, breaking phpPgAdmin/PostgreSQL for all accounts. This restores access
+# WITHOUT weakening per-account isolation:
+#
+#   * pg_hba's `samerole` restriction is UNCHANGED -> each cPanel user can still
+#     only reach databases of roles it belongs to (its own databases).
+#   * Reachable only from source 127.0.0.200 (loopback); never exposed externally.
+#   * A login as user X is accepted ONLY if the supplied credential proves
+#     knowledge of a RECENT (<= WINDOW s) cpses session secret for user X. The
+#     key files live in /var/cpanel/cpses/keys (root:cpses 0750) and are
+#     unreadable by ordinary cPanel users, so the secret cannot be forged.
+#   * The secret (otp) is 32 random characters, regenerated per session.
+#
+# Managed by cpanel-doctor (patch id: pg-cpses). Do not edit by hand.
+#
+exec 2>/dev/null
+KEYDIR=/var/cpanel/cpses/keys
+WINDOW=300   # seconds a session key remains valid
+
+user="$PAM_USER"
+pass="$(cat)"
+pass="${pass%$'\n'}"
+
+[ -z "$user" ] && { logger -t cpses_pg "deny: empty user"; exit 1; }
+[ -z "$pass" ] && { logger -t cpses_pg "deny user=$user: empty pass"; exit 1; }
+
+now=$(date +%s)
+rc=1
+shopt -s nullglob
+for kf in "$KEYDIR/$user:cpses_"*; do
+    [ -f "$kf" ] || continue
+    mt=$(stat -c %Y "$kf" 2>/dev/null) || continue
+    [ $(( now - mt )) -gt "$WINDOW" ] && continue
+    otp="$(cat "$kf" 2>/dev/null)"
+    tempuser="${kf##*:}"            # cpses_<2 acct chars><8 random>
+    [ -z "$otp" ] && continue
+
+    # cPanel's credential format is: <tempuser><1-char separator><otp>
+    # Verified exact: starts with tempuser, ends with the 32-char otp, exactly
+    # one separator char between -> requires knowledge of BOTH session secrets.
+    tl=${#tempuser}; ol=${#otp}
+    if [ "${#pass}" -eq $(( tl + 1 + ol )) ] \
+       && [ "${pass:0:tl}" = "$tempuser" ] \
+       && [ "${pass:$(( ${#pass} - ol ))}" = "$otp" ]; then rc=0; break; fi
+
+    # exact fallbacks for other possible cPanel credential formats
+    [ "$pass" = "$otp" ]              && { rc=0; break; }
+    [ "$pass" = "$tempuser" ]         && { rc=0; break; }
+    [ "$pass" = "${tempuser}${otp}" ] && { rc=0; break; }
+done
+
+logger -t cpses_pg "user=$user result=$([ $rc -eq 0 ] && echo ALLOW || echo DENY)"
+exit $rc