chore(version): pre-release bump to 02.58.34-dev [skip ci]

.mokogitea/CLAUDE.md

@@ -7,7 +7,7 @@ Full-site backup and restore for Joomla — database, files, and configuration.
 | Field | Value |
 |---|---|
 | **Package** | `pkg_mokosuitebackup` |
-| **Language** | PHP 8.3+ |
+| **Language** | PHP 8.1+ |
 | **Branch** | develop on `dev`, merge to `main` (protected) |
 | **Wiki** | [MokoSuiteBackup Wiki](https://git.mokoconsulting.tech/MokoConsulting/MokoSuiteBackup/wiki) |
 
@@ -29,7 +29,7 @@ Joomla **package** with four sub-extensions:
 ### com_mokosuitebackup (Component)
 - Admin backend for managing backup profiles and records
 - Backup engine: `Engine/BackupEngine`, `Engine/DatabaseDumper`, `Engine/FileScanner`, `Engine/Archiver`
-- Joomla 6 MVC: Controllers, Models, Views, Tables
+- Joomla 4/5 MVC: Controllers, Models, Views, Tables
 - Namespace: `Joomla\Component\MokoSuiteBackup\Administrator`
 - DB tables: `#__mokosuitebackup_profiles`, `#__mokosuitebackup_records`
 - CLI: `cli/mokosuitebackup.php` for cron-based backups
@@ -64,8 +64,8 @@ Joomla **package** with four sub-extensions:
 
 ## Coding Standards
 
-- PHP 8.3+ minimum (Joomla 6)
-- Joomla 6 DI container pattern: `services/provider.php` → Extension class
+- PHP 8.1+ minimum
+- Joomla 4/5 DI container pattern: `services/provider.php` → Extension class
 - Legacy stub `.php` file required for plugin loader but empty
 - `SubscriberInterface` for event subscription (not `on*` method naming)
 - `bind() → check() → store()` for Table operations (not `save()`)

.mokogitea/workflows/auto-bump.yml

@@ -4,7 +4,7 @@
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoCLI.Release
+# INGROUP: mokocli.Release
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogitea/workflows/auto-bump.yml
 # VERSION: 09.02.00
@@ -44,7 +44,7 @@ jobs:
           token: ${{ secrets.MOKOGITEA_TOKEN }}
           fetch-depth: 1
 
-      - name: Setup MokoCLI tools
+      - name: Setup mokocli tools
         run: |
           if ! command -v composer &> /dev/null; then
             sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
@@ -53,7 +53,7 @@ jobs:
             echo "MOKO_CLI=/opt/mokocli/cli" >> "$GITHUB_ENV"
           else
             git clone --depth 1 --branch main --quiet \
-              "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/mokocli.git" \
+              "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/MokoCLI.git" \
               /tmp/mokocli
             cd /tmp/mokocli && composer install --no-dev --no-interaction --quiet
             echo "MOKO_CLI=/tmp/mokocli/cli" >> "$GITHUB_ENV"

.mokogitea/workflows/auto-release.yml

@@ -4,17 +4,17 @@
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoCLI.Release
+# INGROUP: mokocli.Release
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogitea/workflows/auto-release.yml
 # VERSION: 05.01.00
-# BRIEF: Universal build & release � detects platform from metadata API
+# BRIEF: Universal build & release � detects platform from manifest.xml
 #
 # +=======================================================================+
 # |              UNIVERSAL BUILD & RELEASE PIPELINE                        |
 # +=======================================================================+
 # |                                                                        |
-# |  Reads metadata API (joomla|dolibarr|generic) to branch logic.       |
+# |  Reads manifest.xml (joomla|dolibarr|generic) to branch logic.       |
 # |                                                                        |
 # |  Platform-specific:                                                    |
 # |    joomla:   XML manifest, type-prefixed packages                      |
@@ -81,7 +81,7 @@ jobs:
           fetch-depth: 1
           submodules: recursive
 
-      - name: Setup MokoCLI tools
+      - name: Setup mokocli tools
         env:
           MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
@@ -95,7 +95,7 @@ jobs:
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
             rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
             git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
             cd /tmp/mokocli
             composer install --no-dev --no-interaction --quiet
@@ -115,17 +115,20 @@ jobs:
           SRC_SHA=$(printf '%s' "$SRC_JSON" | python3 -c "import sys, json; print(json.load(sys.stdin)['commit']['id'])" 2>/dev/null || true)
           [ -n "$SRC_SHA" ] || { echo "::error::Could not resolve HEAD of ${FROM}"; exit 1; }
 
-          # Point rc at the source commit via git push. Gitea's git/refs PATCH API
-          # returns HTTP 405 on ANY protected branch (force or not, even for a user in
-          # the force-push allowlist), so it cannot move a protected rc. git push honors
-          # the push + force-push allowlists and creates rc if it is absent.
-          PUSH_URL="https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@${MOKOGITEA_URL#https://}/${GITEA_ORG}/${GITEA_REPO}.git"
-          git config --global user.name "mokogitea-actions[bot]"
-          git config --global user.email "actions@mokoconsulting.tech"
-          git fetch --no-tags "$PUSH_URL" "${FROM}"
-          git push --force "$PUSH_URL" "FETCH_HEAD:refs/heads/rc" \
-            || { echo "::error::Failed to point rc at ${FROM} (${SRC_SHA}) via git push"; exit 1; }
-          echo "rc set to ${FROM} (${SRC_SHA})"
+          # Point rc at the source commit. If rc already exists (a protected branch that
+          # cannot be deleted), force-update its ref in place instead of delete+recreate:
+          # deleting a protected branch fails, which then makes the recreate return HTTP 409.
+          if curl -sf -o /dev/null -H "$AUTH" "${API_BASE}/branches/rc"; then
+            echo "rc exists - force-updating to ${FROM} (${SRC_SHA})"
+            curl -sf -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
+              "${API_BASE}/git/refs/heads/rc" -d "{\"sha\":\"${SRC_SHA}\",\"force\":true}" \
+              || { echo "::error::Failed to force-update rc (CI token needs force-push on the protected rc branch)"; exit 1; }
+          else
+            echo "Creating rc from ${FROM}"
+            curl -sf -X POST -H "$AUTH" -H "Content-Type: application/json" \
+              "${API_BASE}/branches" -d "{\"new_branch_name\":\"rc\",\"old_branch_name\":\"${FROM}\"}" \
+              || { echo "::error::Failed to create rc from ${FROM}"; exit 1; }
+          fi
 
           # Repoint the PR at rc, then delete the old source branch (non-fatal).
           if [ -n "$PR" ]; then
@@ -228,7 +231,7 @@ jobs:
           fi
           echo "No conflict markers found"
 
-      - name: Setup MokoCLI tools
+      - name: Setup mokocli tools
         env:
           MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
@@ -243,7 +246,7 @@ jobs:
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
             rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
             git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
             cd /tmp/mokocli
             composer install --no-dev --no-interaction --quiet
@@ -374,47 +377,16 @@ jobs:
           if [ -n "$VERSION" ] && [ -f "CHANGELOG.md" ]; then
             DATE=$(date +%Y-%m-%d)
             python3 -c "
-          import sys, re
+          import sys
           version, date = sys.argv[1], sys.argv[2]
-          lines = open('CHANGELOG.md').read().split('\n')
-          h2 = re.compile(r'^##\s+\[([^\]]+)\]')
-          header, sections, cur = [], [], None
-          for ln in lines:
-              m = h2.match(ln)
-              if m:
-                  if cur: sections.append(cur)
-                  cur = {'label': m.group(1).strip(), 'head': ln, 'body': []}
-              elif cur is None:
-                  header.append(ln)
-              else:
-                  cur['body'].append(ln)
-          if cur: sections.append(cur)
-          def nonempty(b): return any(x.strip() for x in b)
-          def trim(b):
-              b = b[:]
-              while b and not b[0].strip(): b.pop(0)
-              while b and not b[-1].strip(): b.pop()
-              return b
-          unreleased, order, bykey = [], [], {}
-          for s in sections:
-              key = s['label'].lower()
-              if key == 'unreleased':
-                  if nonempty(s['body']): unreleased += s['body']
-                  continue
-              if not nonempty(s['body']): continue                 # drop blank release sections
-              if key in bykey: bykey[key]['body'] += [''] + s['body']  # merge duplicate heading (never drop content)
-              else: bykey[key] = s; order.append(key)
-          rest, seen = [bykey[k] for k in order], set(order)
-          out = []
-          htxt = '\n'.join(header).rstrip()
-          if htxt: out += [htxt, '']
-          out += ['## [Unreleased]', '']
-          promote = bool(unreleased) and version.lower() not in seen
-          if unreleased and not promote: out += trim(unreleased) + ['']
-          if promote: out += ['## [%s] --- %s' % (version, date), ''] + trim(unreleased) + ['']
-          for s in rest: out += [s['head'], ''] + trim(s['body']) + ['']
-          res = re.sub(r'\n{3,}', '\n\n', '\n'.join(out)).rstrip('\n') + '\n'
-          open('CHANGELOG.md', 'w').write(res)
+          content = open('CHANGELOG.md').read()
+          marker = f'## [{version}]'
+          # Idempotent: only promote when this version header isn't already present,
+          # otherwise re-runs (or same-version builds) create empty duplicate headers.
+          if marker not in content:
+              new = f'## [Unreleased]\n\n{marker} --- {date}'
+              content = content.replace('## [Unreleased]', new, 1)
+              open('CHANGELOG.md', 'w').write(content)
           " "$VERSION" "$DATE"
             git add CHANGELOG.md
             git commit -m "chore: promote changelog [Unreleased] → [${VERSION}]" || true

.mokogitea/workflows/branch-cleanup.yml

@@ -4,7 +4,7 @@
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoCLI.Universal
+# INGROUP: MokoStandards.Universal
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogitea/workflows/branch-cleanup.yml
 # VERSION: 01.00.00

.mokogitea/workflows/cascade-dev.yml

@@ -4,11 +4,11 @@
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoCLI.Cascade
+# INGROUP: MokoStandards.Cascade
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogitea/workflows/cascade-dev.yml
-# VERSION: 02.01.00
-# BRIEF: Cascade main -> dev; auto-merge clean, auto-resolve VERSION-stamp-only conflicts, else notify
+# VERSION: 02.00.00
+# BRIEF: Cascade main -> dev via PR; auto-merge only if conflict-free, else notify
 
 name: "Cascade Main -> Dev"
 
@@ -16,10 +16,6 @@ on:
   push:
     branches:
       - main
-  # Daily safety net: catches drift even when main only received [skip ci] pushes
-  # (which never fire the push trigger above). Off-round minute to avoid a fleet-wide spike.
-  schedule:
-    - cron: '23 7 * * *'
   workflow_dispatch:
 
 permissions:
@@ -37,13 +33,7 @@ jobs:
     name: Cascade main -> dev
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout (full history for merge/resolve)
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
-
-      - name: Cascade main -> dev (auto-resolve version stamps, else notify)
+      - name: Open main -> dev PR (auto-merge if clean, else notify)
         env:
           TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           REPO: ${{ github.repository }}
@@ -51,7 +41,7 @@ jobs:
           set -uo pipefail
           API="${MOKOGITEA_URL}/api/v1/repos/${REPO}"
           AUTH="Authorization: token ${TOKEN}"
-          jqget() { python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('$1',''))" 2>/dev/null; }
+          jqnum() { python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('$1',''))" 2>/dev/null; }
 
           # 0. dev must exist
           if ! curl -sf -H "$AUTH" "${API}/branches/dev" >/dev/null 2>&1; then
@@ -71,8 +61,8 @@ jobs:
             | python3 -c "import sys,json; d=json.load(sys.stdin); print(next((str(p['number']) for p in d if p.get('head',{}).get('ref')=='main'), ''))" 2>/dev/null || echo "")
           if [ -z "$PR" ]; then
             RESP=$(curl -s -H "$AUTH" -H "Content-Type: application/json" -X POST "${API}/pulls" \
-              -d '{"head":"main","base":"dev","title":"chore(sync): cascade main -> dev","body":"Automated cascade of main into dev. Auto-merges when conflict-free, auto-resolves VERSION-stamp-only conflicts, otherwise left open for manual resolution."}')
-            PR=$(printf '%s' "$RESP" | jqget number)
+              -d '{"head":"main","base":"dev","title":"chore(sync): cascade main -> dev","body":"Automated cascade of main into dev. Auto-merges only if conflict-free; otherwise left open for manual resolution."}')
+            PR=$(printf '%s' "$RESP" | jqnum number)
             if [ -z "$PR" ]; then
               echo "::warning::Could not open cascade PR: $RESP"; exit 0
             fi
@@ -81,6 +71,15 @@ jobs:
             echo "Reusing open cascade PR #${PR}"
           fi
 
+          # 3. wait for MokoGitea to compute mergeability (conflict detection)
+          MERGEABLE=""
+          for _ in 1 2 3 4 5 6; do
+            MERGEABLE=$(curl -sf -H "$AUTH" "${API}/pulls/${PR}" | jqnum mergeable)
+            case "$MERGEABLE" in True|False) break ;; esac
+            sleep 3
+          done
+          echo "mergeable=${MERGEABLE}"
+
           notify() {
             curl -sS \
               -H "Title: ${REPO}: dev cascade needs manual merge" \
@@ -91,100 +90,17 @@ jobs:
               "${NTFY_URL}/${NTFY_TOPIC}" || true
           }
 
-          # 3. wait for MokoGitea to compute mergeability (conflict detection)
-          MERGEABLE=""
-          for _ in 1 2 3 4 5 6; do
-            MERGEABLE=$(curl -sf -H "$AUTH" "${API}/pulls/${PR}" | jqget mergeable)
-            case "$MERGEABLE" in True|False) break ;; esac
-            sleep 3
-          done
-          echo "mergeable=${MERGEABLE}"
-
-          # 4a. conflict-free -> merge via API (existing behaviour)
+          # 4. auto-merge only if conflict-free; otherwise notify
           if [ "$MERGEABLE" = "True" ]; then
             CODE=$(curl -s -o /tmp/merge.json -w "%{http_code}" -H "$AUTH" -H "Content-Type: application/json" \
               -X POST "${API}/pulls/${PR}/merge" -d '{"Do":"merge","merge_when_checks_succeed":true}')
             if [ "$CODE" -ge 200 ] && [ "$CODE" -lt 300 ]; then
               echo "Cascade PR #${PR} merged (or scheduled to merge when checks pass)."
-              exit 0
+            else
+              echo "::warning::Auto-merge returned HTTP ${CODE}: $(cat /tmp/merge.json)"
+              notify "could not be auto-merged (HTTP ${CODE})."
             fi
-            echo "::warning::Auto-merge returned HTTP ${CODE}: $(cat /tmp/merge.json)"
-            notify "could not be auto-merged (HTTP ${CODE})."
-            exit 0
+          else
+            echo "::warning::Cascade PR #${PR} has conflicts (mergeable=${MERGEABLE}); sending notification."
+            notify "has conflicts and cannot be merged automatically."
           fi
-
-          # 4b. conflicts -> try to auto-resolve if they are ONLY VERSION-stamp lines.
-          echo "PR not cleanly mergeable; checking whether conflicts are VERSION-stamp-only..."
-          git config user.name  "MokoGitea Cascade"
-          git config user.email "actions@mokoconsulting.tech"
-          git fetch --quiet origin main dev
-          git checkout -B dev origin/dev
-
-          if git merge --no-ff --no-commit origin/main >/dev/null 2>&1; then
-            # Became clean at git level (e.g. mergeability was still computing) -> commit + push.
-            git commit -m "chore(sync): cascade main -> dev [skip ci]" >/dev/null
-            git push origin dev
-            echo "Cascade merged cleanly at git level and pushed to dev."
-            exit 0
-          fi
-
-          CONFLICTS=$(git diff --name-only --diff-filter=U)
-          echo "Conflicted files:"; echo "${CONFLICTS}"
-
-          # A conflict is "stamp-only" when every line inside every conflict block matches
-          # a version-stamp pattern (VERSION: header, <version> element, or CHANGELOG title).
-          is_stamp_only() {
-            awk '
-              /^<<<<<<< /   { inc=1; next }
-              inc && /^=======$/ { next }
-              /^>>>>>>> /   { inc=0; next }
-              inc { if ($0 !~ /(VERSION:|<version>|# Changelog)/) { bad=1 } }
-              END { exit(bad ? 1 : 0) }
-            ' "$1"
-          }
-          # Resolve a stamp-only file by keeping dev (ours) for the conflicting lines,
-          # preserving all auto-merged content around them.
-          keep_ours() {
-            awk '
-              /^<<<<<<< /   { inc=1; side="ours"; next }
-              inc && /^=======$/ { side="theirs"; next }
-              /^>>>>>>> /   { inc=0; next }
-              { if (!inc) { print; next } if (side=="ours") print }
-            ' "$1" > "$1.resolved" && mv "$1.resolved" "$1"
-          }
-
-          ALL_STAMP=1
-          for f in ${CONFLICTS}; do
-            if ! is_stamp_only "$f"; then
-              echo "::notice::$f has non-stamp conflicts -> manual resolution required."
-              ALL_STAMP=0; break
-            fi
-          done
-
-          if [ "$ALL_STAMP" != "1" ]; then
-            git merge --abort || true
-            notify "has non-version-stamp conflicts and cannot be auto-resolved."
-            exit 0
-          fi
-
-          echo "All conflicts are VERSION-stamp-only; resolving in favour of dev."
-          for f in ${CONFLICTS}; do
-            keep_ours "$f"
-            git add "$f"
-          done
-
-          # Best-effort: normalise stamps to dev's version if mokocli is available.
-          if [ -f /opt/mokocli/cli/version_check.php ]; then
-            php /opt/mokocli/cli/version_check.php --fix || true
-            git add -A
-          fi
-
-          git commit -m "chore(sync): cascade main -> dev (auto-resolved version stamps) [skip ci]" >/dev/null
-          git push origin dev
-          echo "Cascade auto-resolved and pushed to dev."
-
-          # Close the now-redundant PR (its changes are in dev) with an explanatory comment.
-          curl -s -H "$AUTH" -H "Content-Type: application/json" -X POST "${API}/issues/${PR}/comments" \
-            -d '{"body":"Auto-resolved VERSION-stamp-only conflicts and pushed the merge to dev. Closing."}' >/dev/null || true
-          curl -s -H "$AUTH" -H "Content-Type: application/json" -X PATCH "${API}/pulls/${PR}" \
-            -d '{"state":"closed"}' >/dev/null || true

.mokogitea/workflows/ci-generic.yml

@@ -4,7 +4,7 @@
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoCLI.CI
+# INGROUP: MokoStandards.CI
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogitea/workflows/ci-generic.yml
 # VERSION: 01.00.00
@@ -131,11 +131,10 @@ jobs:
   test:
     name: Tests
     runs-on: ubuntu-latest
-    # Independent job (no `needs: lint`): the MokoGitea Actions scheduler does not
-    # offer the dependent 2nd job of a needs-chain to runners, so it stalls in
-    # "waiting" and is reaped by ABANDONED_JOB_TIMEOUT. Guard template repos
-    # directly (same condition lint uses) instead of gating on lint's result.
-    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
+    needs: lint
+    # Run only when lint succeeded; always() forces evaluation so a skipped
+    # lint (e.g. template repos) skips this job cleanly instead of hanging.
+    if: ${{ always() && needs.lint.result == 'success' }}
 
     steps:
       - name: Checkout

.mokogitea/workflows/ci-issue-reporter.yml

@@ -4,7 +4,7 @@
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoCLI.Universal
+# INGROUP: mokocli.Universal
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogitea/workflows/ci-issue-reporter.yml
 # VERSION: 01.00.00
@@ -52,7 +52,7 @@ jobs:
           MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
         run: |
           MOKOGITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
-          git clone --depth 1 --filter=blob:none --sparse "${MOKOGITEA_URL}/MokoConsulting/mokocli.git" /tmp/mokocli
+          git clone --depth 1 --filter=blob:none --sparse "${MOKOGITEA_URL}/MokoConsulting/MokoCLI.git" /tmp/mokocli
           cd /tmp/mokocli && git sparse-checkout set cli/ci_issue_reporter.sh
 
       - name: Report CI failure

.mokogitea/workflows/cleanup.yml

@@ -4,8 +4,8 @@
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoCLI.Maintenance
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# INGROUP: MokoStandards.Maintenance
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
 # PATH: /.mokogitea/workflows/cleanup.yml
 # VERSION: 01.00.00
 # BRIEF: Scheduled cleanup — delete merged branches and old workflow runs

.mokogitea/workflows/gitleaks.yml

@@ -4,8 +4,8 @@
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoCLI.Security
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# INGROUP: MokoStandards.Security
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards-API
 # PATH: /.mokogitea/workflows/gitleaks.yml
 # VERSION: 01.00.00
 # BRIEF: Secret scanning — detect leaked credentials, API keys, and tokens

.mokogitea/workflows/issue-branch.yml

@@ -4,8 +4,8 @@
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoCLI.Automation
-# VERSION: 02.63.03
+# INGROUP: mokocli.Automation
+# VERSION: 02.58.34
 # BRIEF: Auto-create feature branch when an issue is opened
 
 name: "Universal: Issue Branch"

.mokogitea/workflows/notify.yml

@@ -4,8 +4,8 @@
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoCLI.Notifications
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# INGROUP: MokoStandards.Notifications
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
 # PATH: /.mokogitea/workflows/notify.yml
 # VERSION: 01.00.00
 # BRIEF: Push notifications via ntfy on release success or workflow failure
@@ -46,13 +46,13 @@ jobs:
           WORKFLOW="${{ github.event.workflow_run.name }}"
           URL="${{ github.event.workflow_run.html_url }}"
 
-          curl -sS --retry 3 --retry-connrefused --retry-delay 2 --max-time 20 \
+          curl -sS \
             -H "Title: ${REPO} released" \
             -H "Tags: white_check_mark,package" \
             -H "Priority: default" \
             -H "Click: ${URL}" \
             -d "${WORKFLOW} completed successfully." \
-            "${NTFY_URL}/${NTFY_TOPIC}" || echo "::warning::ntfy notification could not be delivered (non-fatal)"
+            "${NTFY_URL}/${NTFY_TOPIC}"
 
       - name: Notify on failure
         if: github.event.workflow_run.conclusion == 'failure'
@@ -61,10 +61,10 @@ jobs:
           WORKFLOW="${{ github.event.workflow_run.name }}"
           URL="${{ github.event.workflow_run.html_url }}"
 
-          curl -sS --retry 3 --retry-connrefused --retry-delay 2 --max-time 20 \
+          curl -sS \
             -H "Title: ${REPO} workflow failed" \
             -H "Tags: x,warning" \
             -H "Priority: high" \
             -H "Click: ${URL}" \
             -d "${WORKFLOW} failed. Check the run for details." \
-            "${NTFY_URL}/${NTFY_TOPIC}" || echo "::warning::ntfy notification could not be delivered (non-fatal)"
+            "${NTFY_URL}/${NTFY_TOPIC}"

.mokogitea/workflows/pr-check.yml

@@ -4,7 +4,7 @@
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoCLI.CI
+# INGROUP: mokocli.CI
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogitea/workflows/pr-check.yml
 # VERSION: 09.23.00
@@ -210,7 +210,7 @@ jobs:
 
       - name: Check for merge conflict markers
         run: |
-          CONFLICTS=$(grep -rn '<<<<<<< \|>>>>>>> \|^=======$' --exclude-dir='.git' --exclude-dir='.mokogitea' --include='*.php' --include='*.xml' --include='*.css' --include='*.js' --include='*.json' --include='*.md' --include='*.yml' --include='*.yaml' --include='*.ini' --include='*.txt' . 2>/dev/null | grep -v '.git/' || true)
+          CONFLICTS=$(grep -rn '<<<<<<< \|>>>>>>> \|^=======$' --include='*.php' --include='*.xml' --include='*.css' --include='*.js' --include='*.json' --include='*.md' --include='*.yml' --include='*.yaml' --include='*.ini' --include='*.txt' . 2>/dev/null | grep -v '.git/' || true)
           if [ -n "$CONFLICTS" ]; then
             echo "::error::Merge conflict markers found in source files"
             echo "## Conflict Markers Found" >> $GITHUB_STEP_SUMMARY
@@ -224,7 +224,7 @@ jobs:
       - name: Detect platform
         id: platform
         run: |
-          # Platform comes from the MokoGitea metadata API (public GET).
+          # Platform comes from the MokoGitea metadata API (public GET); manifest.xml is no longer used.
           API="${GITHUB_SERVER_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${GITHUB_REPOSITORY}/metadata"
           PLATFORM="$(curl -sf "$API" 2>/dev/null | python3 -c "import sys, json; print(json.load(sys.stdin).get('platform') or '')" 2>/dev/null || true)"
           [ -z "$PLATFORM" ] && PLATFORM="generic"
@@ -258,9 +258,8 @@ jobs:
           while IFS= read -r -d '' file; do
             # Skip vendor, node_modules, and index.html stub files
             case "$file" in ./vendor/*|./node_modules/*) continue ;; esac
-            # Scan the whole file for the JEXEC/JPATH guard: it is placed after
-            # the SPDX/file-header docblock, which commonly runs past 20 lines.
-            if ! grep -qE "defined\s*\(\s*['\"](_JEXEC|JPATH_BASE|\\\\JPATH_PLATFORM)['\"]" "$file"; then
+            # Check first 10 lines for JEXEC or JPATH guard
+            if ! head -20 "$file" | grep -qE "defined\s*\(\s*['\"](_JEXEC|JPATH_BASE|\\\\JPATH_PLATFORM)['\"]"; then
               echo "::error file=${file}::Missing JEXEC guard: ${file}"
               ERRORS=$((ERRORS + 1))
             fi

.mokogitea/workflows/pre-release.yml

@@ -4,10 +4,10 @@
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoCLI.Release
+# INGROUP: mokocli.Release
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogitea/workflows/pre-release.yml
-# VERSION: 05.02.01
+# VERSION: 05.02.00
 # BRIEF: Auto pre-release on push to dev/alpha/beta/rc branches
 
 name: "Universal: Pre-Release"
@@ -69,7 +69,7 @@ jobs:
         run: |
           git submodule foreach --quiet 'git checkout main && git pull --quiet origin main' 2>/dev/null || true
 
-      - name: Setup MokoCLI tools
+      - name: Setup mokocli tools
         env:
           MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
@@ -84,7 +84,7 @@ jobs:
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
             rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
             git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
             cd /tmp/mokocli && composer install --no-dev --no-interaction --quiet
             echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
@@ -162,13 +162,7 @@ jobs:
           git add -A
           git diff --cached --quiet || {
             git commit -m "chore(version): pre-release bump to ${VERSION} [skip ci]"
-            # Push the bump commit, but do NOT fail the release if the target branch
-            # is protected and the release identity is not on the push allowlist.
-            # The build proceeds from the in-tree bumped version regardless; if the
-            # push is rejected, the next run simply re-bumps from the same base.
-            if ! git push origin HEAD 2>&1; then
-              echo "::warning::Version-bump commit could not be pushed (protected branch?). Building from in-tree version ${VERSION} anyway."
-            fi
+            git push origin HEAD 2>&1
           }
 
           # Auto-detect element via manifest_element.php
@@ -280,4 +274,4 @@ jobs:
           echo "| Version | \`${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
           echo "| Channel | ${STABILITY} |" >> $GITHUB_STEP_SUMMARY
           echo "| Package | \`${ZIP_NAME}\` |" >> $GITHUB_STEP_SUMMARY
-          echo "| SHA-256 | \`${SHA256:-n/a}\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| SHA-256 | \`${SHA256:-n/a}\` |" >> $GITHUB_STEP_SUMMARY

.mokogitea/workflows/rc-revert.yml

@@ -4,7 +4,7 @@
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoCLI.Universal
+# INGROUP: mokocli.Universal
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogitea/workflows/rc-revert.yml
 # VERSION: 09.23.00

.mokogitea/workflows/repo-health.yml

@@ -7,7 +7,7 @@
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoCLI.Validation
+# INGROUP: mokocli.Validation
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogitea/workflows/repo-health.yml
 # VERSION: 09.23.00

.mokogitea/workflows/sync-on-merge.yml

@@ -0,0 +1,32 @@
+name: Sync Workflows to Repos
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '.mokogitea/workflows/**'
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    if: ${{ startsWith(github.event.repository.name, 'Template-') }}
+    steps:
+      - name: Checkout mokocli
+        uses: actions/checkout@v4
+        with:
+          repository: MokoConsulting/MokoCLI
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
+
+      - name: Setup PHP
+        uses: https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/raw/branch/main/actions/setup-php@v1
+        with:
+          php-version: '8.1'
+
+      - name: Install dependencies
+        run: composer install --no-dev --no-interaction
+
+      - name: Sync workflows to generic repos
+        run: php automation/bulk_sync.php --platform generic --org MokoConsulting --workflows-only --auto-merge --token "${{ secrets.MOKOGITEA_TOKEN }}"
+        env:
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}

.mokogitea/workflows/version-set.yml

@@ -4,7 +4,7 @@
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGitea.Workflow.Template
-# INGROUP: MokoCLI.CI
+# INGROUP: MokoStandards.CI
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Joomla
 # PATH: /.mokogitea/workflows/version-set.yml
 # VERSION: 01.00.00

.mokogitea/workflows/workflow-sync-trigger.yml

@@ -0,0 +1,82 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGitea.Workflow
+# INGROUP: mokocli.Universal
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# PATH: /.mokogitea/workflows/workflow-sync-trigger.yml
+# VERSION: 01.01.00
+# BRIEF: Trigger workflow sync to live repos when a PR is merged to main
+
+name: "Universal: Workflow Sync Trigger"
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [closed]
+    branches:
+      - main
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  sync:
+    name: Sync workflows to live repos
+    runs-on: ubuntu-latest
+    if: >-
+      startsWith(github.event.repository.name, 'Template-') &&
+      (github.event_name == 'workflow_dispatch' ||
+      (github.event.pull_request.merged == true &&
+      !contains(github.event.pull_request.title, '[skip sync]')))
+
+    steps:
+      - name: Determine platform from repo name
+        id: platform
+        run: |
+          REPO="${{ github.event.repository.name }}"
+          case "$REPO" in
+            Template-Joomla)   PLATFORM="joomla" ;;
+            Template-Dolibarr) PLATFORM="dolibarr" ;;
+            Template-Go)       PLATFORM="go" ;;
+            Template-MCP)      PLATFORM="mcp" ;;
+            Template-Generic)  PLATFORM="" ;;
+            *)                 PLATFORM="" ;;
+          esac
+          echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
+          echo "Platform: ${PLATFORM:-all}"
+
+      - name: Clone mokocli
+        env:
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+        run: |
+          MOKOGITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
+          git clone --depth 1 "${MOKOGITEA_URL}/MokoConsulting/MokoCLI.git" /tmp/mokocli
+
+      - name: Install PHP
+        run: |
+          if ! command -v php &> /dev/null; then
+            apt-get update -qq && apt-get install -y -qq php-cli php-json php-curl > /dev/null 2>&1
+          fi
+
+      - name: Install dependencies
+        run: |
+          cd /tmp/mokocli
+          composer install --no-dev --no-interaction --quiet 2>/dev/null || true
+
+      - name: Run workflow sync
+        env:
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+        run: |
+          ARGS="--token ${MOKOGITEA_TOKEN}"
+          ARGS="${ARGS} --org ${{ vars.GITEA_ORG || github.repository_owner }}"
+          ARGS="${ARGS} --phase repos"
+
+          PLATFORM="${{ steps.platform.outputs.platform }}"
+          if [ -n "$PLATFORM" ]; then
+            ARGS="${ARGS} --platform-filter ${PLATFORM}"
+          fi
+
+          php /tmp/mokocli/cli/workflow_sync.php ${ARGS}

CHANGELOG.md

@@ -1,25 +1,14 @@
 # Changelog
+
 ## [Unreleased]
 
-## [02.63.00] --- 2026-07-13
-
-## [02.62.00] --- 2026-07-13
-
-## [02.61.00] --- 2026-07-13
-
-## [02.60.00] --- 2026-07-12
-
-
-## [02.59.00] --- 2026-07-12
-
 ### Fixed
-- Pre-update backup now fires for **every** extension update/uninstall, not just the first one in a 10-minute window. A coarse 600-second session throttle (armed after any pre-action backup — even after updating MokoSuiteBackup itself or a core Joomla update) was disabling the client-side interceptor **and** the server-side fallback for *all* extensions for 10 minutes, so distinct updates silently went un-backed-up (looked like "only the backup extension triggers it"). Replaced with **one backup per Update action**: a single batch/click still backs up once (deduped per-request), the client re-fire is skipped via a **one-shot** action-keyed flag (consumed once), and the core-update path uses its own dedicated key so it no longer suppresses extension backups.
 - Pre-update backup on the **Joomla Update** page is now **seamless** (Akeeba-style): after the full-screen backup runs, the plugin auto-ticks Joomla's "I have taken a backup" checkbox and clicks Install, so the update continues automatically instead of stopping for a second manual click.
 - Pre-update full-screen backup now actually fires on the **Joomla Update** page. The "Install the update" button posts to `option=com_joomlaupdate&layout=update` (Joomla's confirm/updating page) — carrying **only `layout=update`**, no `view`/`task` — so the previous match on `view=update`/`update.install` never triggered. The plugin now intercepts `layout=update` (as well as `view=update` and the legacy `update.install`) and returns the browser there flagged `is_backed_up=1`.
 
 ### Added
 - **Snapshot transfer + master→slave injection (#237):** download a content snapshot as a portable **`.msbsnap`** file (zip of `manifest.json` + `snapshot.json` + a sha256 integrity check); **import** one on another site via a new Import button on the Snapshots page (materialises a local snapshot record you can then restore); and a **direct injection API** — `POST /api/index.php/v1/mokosuitebackup/snapshot/inject` — so a **master** site can push a snapshot straight into a **slave**'s Web Services API. Two conflict modes ship now: **overwrite** (replace matching items by ID — master wins) and **create** (skip existing, add only new), selectable per inject call or defaulted in **Options → Snapshot Transfer**. A receiving site must opt in via the new *Allow Snapshot Injection* setting. A third **duplicate** mode inserts everything as brand-new records with **remapped IDs** (articles, categories, modules — plus their tags, custom-field values and featured flags) using Joomla's Table API so assets/UCM/nested-sets stay valid; each item is inserted defensively (a bad item is skipped and logged, never fatal).
-- Full-screen backup now also fronts **extension updates and uninstalls** (Extensions → Update / Manage), not just core Joomla updates. Because `com_installer`'s `update.update` / `manage.remove` are POST actions (CSRF token + a checked `cid[]` list) that a server-side redirect can't cleanly resume, this is done client-side: the toolbar Update/Uninstall click is intercepted, the selection is captured, the full-screen backup runs, and on return the original selection is restored and the real POST form is re-submitted. Gated by `backup_before_update` / `backup_before_uninstall`, super-user only, and deduped to one backup per Update action.
+- Full-screen backup now also fronts **extension updates and uninstalls** (Extensions → Update / Manage), not just core Joomla updates. Because `com_installer`'s `update.update` / `manage.remove` are POST actions (CSRF token + a checked `cid[]` list) that a server-side redirect can't cleanly resume, this is done client-side: the toolbar Update/Uninstall click is intercepted, the selection is captured, the full-screen backup runs, and on return the original selection is restored and the real POST form is re-submitted. Gated by `backup_before_update` / `backup_before_uninstall`, super-user only, and skipped if a backup already ran this session.
 - Manual **"Backup Now"** completion now offers a **View backup record** button (links straight to the record that was just created). It appears only for manual backups — the pre-update / pre-uninstall flow hands control back to Joomla instead.
 - **Full-screen backup screen** (`view=runbackup`) for both pre-update and manual backups, modelled on Akeeba's Backup-on-Update — replaces the earlier popup-modal approach. Clicking Joomla's **Install the update** now redirects (server-side, Akeeba-style) to a dedicated full-page backup screen that runs the stepped backup with a real progress bar and then **automatically continues the update** via a validated `returnurl` (flagged `is_backed_up=1` so the backup isn't repeated). Crucially, **no backup runs synchronously inside the update request** — which is what white-screened large sites. The dashboard **Backup Now** now opens the same full-screen screen instead of an inline modal. (#196)
 - Retention now prunes **remote** copies too: when a backup is pruned by age/count, its archive is deleted from every enabled remote destination (SFTP / FTP / S3 / Google Drive), not just the local copy. Each uploader gained an idempotent `delete()` method (already-absent file = success), and removal is best-effort — a failing destination is logged but never blocks local pruning. The shared standalone `restore.php` is intentionally left in place (every backup overwrites it, so newer backups still depend on it). (#229)
@@ -37,3 +26,56 @@
 - Archive names for **CLI/console-triggered backups** no longer come out as `joomla.invalid_…`. The `[HOST]` placeholder took `$_SERVER['HTTP_HOST']` verbatim, but Joomla's console fills that with the reserved sentinel host `joomla.invalid`; the resolver now treats that (like empty/`localhost`) as unusable and falls back to the configured `live_site` host, then the system hostname. (Set the site's *live_site* to get the exact domain in CLI-built names.)
 - Standalone restore script generation no longer aborts backups with `str_replace() expects at least 3 arguments, 2 given`. `MokoRestore::generateStandaloneScript()` had a `str_replace()` call (the "Backup Archive" pre-check rewrite) that was missing its `$php` subject argument, so **every** standalone-mode backup fatally errored while "Generating standalone restore.php…" — the archive still finalized and uploaded, but no `restore.php` was ever produced (the true root cause behind #226). (#226)
 - Remote upload: the standalone restore script upload is no longer silent — its result is now checked and logged, and a failed restore-script upload marks the backup as `warning` (previously the result was discarded, so a missing restore script on the remote went unreported while the archive still showed success). (#226)
+
+## [02.58.00] --- 2026-07-06
+
+### Added
+- SFTP destinations: **upload an SSH private key file** in the Add/Edit Destination modal instead of pasting it (reads the file into the key field client-side; pasting still works).
+
+### Changed
+- Add/Edit Destination modal: wrap the content in a Bootstrap `.container-fluid` and give it a 1rem padding frame via the WAM stylesheet (Bootstrap's `.modal-content` has no padding of its own).
+
+### Fixed
+- Pre-update backup now shows an admin notification on **every** outcome (success / warning / failure) — previously a *successful* pre-update backup fired nothing, so it looked like the notification wasn't working. (#192)
+
+### Changed
+- Component admin CSS now loads via the Joomla **Web Asset Manager** (`media/com_mokosuitebackup/` + `joomla.asset.json`) instead of an inline `<style>` block.
+- "Keep local copy" is configured **per remote destination** (in the Add/Edit Destination modal); the redundant profile-level field and its "Remote" tab are removed.
+- Add/Edit Destination modal: cleaned up the cramped padding/margins.
+
+### Fixed
+- Admin menu / duplicate-component fallout: (a) the orphaned `com_component-mokosuitebackup` is now removed in **preflight** too, so its "Backup" menu no longer collides on install ("The alias backup is already being used"); (b) `ensureSubmenuItems()` **recreates the top-level "Backup" menu** if it was deleted, instead of giving up — so Backup no longer disappears from the admin menu (and the cPanel module / MokoSuiteClient can find it again); (c) the component menu label now uses the short constant `COM_MOKOJOOMBACKUP_SHORT`. (#213 fallout)
+- Installer no longer aborts on MySQL 8 with "This command is not supported in the prepared statement protocol yet" (error 1295). The legacy remote-column purge migration (`02.56.01.sql`) used `PREPARE`/`EXECUTE`/`DEALLOCATE`, which Joomla's installer rejects; the drop now runs in the package installer script via an INFORMATION_SCHEMA-gated plain `ALTER` (portable across MariaDB and MySQL 8). (#213 update path)
+
+## [02.57.00] --- 2026-07-05
+
+### Added
+- `BackupRunner` service — a single synchronous entry point for backups that unifies final status and notification gating across the pre-update, web-cron, pre-install, scheduled-task and CLI triggers (delegates to `BackupEngine`; no double-notify). Returns a normalized result including the real complete/warning/fail status. Dashboard "Backup Now" (AJAX) unchanged; installer progress popup deferred to #196. (#214)
+
+### Fixed
+- Release automation: the changelog-promote step is now idempotent — it only inserts a `## [version]` header when that version isn't already present, preventing the empty, duplicated version headers that repeated/same-version builds were producing. (workflow)
+
+## [02.56.11] --- 2026-07-05
+
+### Fixed
+- Package `postflight` now removes the orphaned `com_component-mokosuitebackup` registration (stray extension record, admin menu items, schema rows, and `administrator/` folder) left behind by the old "Type - Name" component `<name>` — self-healing on update so affected sites reconcile to the real `com_mokosuitebackup`. (#213 follow-up)
+
+## [02.56.08] --- 2026-07-05
+
+### Fixed
+- Component manifest `<name>` reverted to the element-safe `MokoSuiteBackup`. The "Type - Name" convention derived element `com_component-mokosuitebackup`, registering a duplicate component and leaving the real `com_mokosuitebackup` orphaned on the old version. (#213)
+
+## [02.56.07] --- 2026-07-05
+
+### Security
+- Mask the FTP password in `AjaxController::maskSecrets()`/`mergeExistingSecrets()` — stored FTP remotes no longer leak their password via `listRemotes`. (#169)
+- Stop the API single-item view (`Backups/JsonapiView`) leaking the server `absolute_path`. (#187)
+- SFTP uploader uses `StrictHostKeyChecking=accept-new` instead of `no`. (#182)
+
+### Fixed
+- `DatabaseDumper` writes a real newline after `DROP TABLE` (was a literal `\n`). (#179)
+- Profile-picker forms order by `id` instead of the dropped `ordering` column. (#180)
+- `uninstall.mysql.sql` now drops the snapshots table. (#181)
+- CLI snapshot delete uses the `data_file` column (was non-existent `file_path`). (#184)
+- Remove the duplicate pre-update backup (content plugin no longer subscribes to `onExtensionBeforeUpdate`). (#186)
+- `DatabaseImporter` collects non-fatal statement errors (`getErrors()`/`hasErrors()`). (#188)

SECURITY.md

@@ -23,7 +23,7 @@ DEFGROUP: Template-Joomla
 INGROUP: Template-Joomla.Documentation
 REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Joomla
 PATH: /SECURITY.md
-VERSION: 02.63.03
+VERSION: 02.58.34
 BRIEF: Security vulnerability reporting and handling policy
 -->
 

composer.json

@@ -12,7 +12,7 @@
 		}
 	],
 	"require": {
-		"php": ">=8.3",
+		"php": ">=8.1",
 		"ext-zip": "*",
 		"ext-pdo": "*",
 		"ext-pdo_mysql": "*",

source/packages/com_mokosuitebackup/language/en-GB/com_mokosuitebackup.ini

@@ -349,8 +349,6 @@ COM_MOKOJOOMBACKUP_RUNBACKUP_CONTINUE_ANYWAY="Continue without backup"
 COM_MOKOJOOMBACKUP_RUNBACKUP_BACK_TO_DASHBOARD="Back to dashboard"
 COM_MOKOJOOMBACKUP_RUNBACKUP_VIEW_RECORD="View backup record"
 COM_MOKOJOOMBACKUP_RUNBACKUP_LEAVE_WARNING="A backup is in progress. Leaving now will cancel it."
-COM_MOKOJOOMBACKUP_RUNBACKUP_AUTOCONTINUE="Automatically continue the update when the backup finishes"
-COM_MOKOJOOMBACKUP_RUNBACKUP_CONTINUE_UPDATE="Continue the update"
 
 COM_MOKOJOOMBACKUP_CONFIG_CLEANUP="Cleanup Defaults"
 COM_MOKOJOOMBACKUP_CONFIG_MAX_AGE="Max Backup Age (days)"

source/packages/com_mokosuitebackup/language/en-US/com_mokosuitebackup.ini

@@ -71,8 +71,6 @@ COM_MOKOJOOMBACKUP_RUNBACKUP_CONTINUE_ANYWAY="Continue without backup"
 COM_MOKOJOOMBACKUP_RUNBACKUP_BACK_TO_DASHBOARD="Back to dashboard"
 COM_MOKOJOOMBACKUP_RUNBACKUP_VIEW_RECORD="View backup record"
 COM_MOKOJOOMBACKUP_RUNBACKUP_LEAVE_WARNING="A backup is in progress. Leaving now will cancel it."
-COM_MOKOJOOMBACKUP_RUNBACKUP_AUTOCONTINUE="Automatically continue the update when the backup finishes"
-COM_MOKOJOOMBACKUP_RUNBACKUP_CONTINUE_UPDATE="Continue the update"
 
 COM_MOKOJOOMBACKUP_CONFIG_CLEANUP="Cleanup Defaults"
 COM_MOKOJOOMBACKUP_CONFIG_MAX_AGE="Max Backup Age (days)"

source/packages/com_mokosuitebackup/media/css/runbackup.css

@@ -1,86 +0,0 @@
-/*
- * @package     MokoSuiteBackup
- * @subpackage  com_mokosuitebackup
- * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
- * @license     GNU General Public License version 3 or later; see LICENSE
- *
- * Full-screen backup progress screen (view=runbackup). Loaded via the Joomla
- * Web Asset Manager (asset com_mokosuitebackup.runbackup).
- */
-
-/* Full-screen backup runs on a black backdrop. */
-html,
-body {
-	background-color: #000 !important;
-}
-
-/* Colours are pulled from the Atum admin template's own CSS custom properties
-   so the screen matches whatever theme the site runs, with Bootstrap and then
-   a literal as progressive fallbacks. */
-.msb-runbackup {
-	--msb-accent: var(--template-link-color, var(--bs-link-color, #2a69b8));
-	--msb-accent2: var(--template-special-color, var(--msb-accent));
-	--msb-success: var(--template-success-color, var(--bs-success, #2f7d32));
-	--msb-danger: var(--template-danger-color, var(--bs-danger, #c52128));
-	--msb-track: var(--template-bg-light, var(--bs-gray-200, #edf0f5));
-
-	padding: 0 1rem;
-}
-
-/* overflow:hidden clips the full-bleed bar to the card's rounded corners.
-   The card's gray background comes from a Bootstrap utility class on the
-   element itself (see the template), not a rule here. */
-.msb-runbackup .card {
-	overflow: hidden;
-}
-
-.msb-rb-progress {
-	height: 2.5rem;
-	background: var(--msb-track);
-	overflow: hidden;
-}
-
-.msb-rb-bar {
-	position: relative;
-	height: 100%;
-	width: 0;
-	display: flex;
-	align-items: center;
-	justify-content: center;
-	color: #fff;
-	font-weight: 600;
-	font-size: .95rem;
-	white-space: nowrap;
-	background-color: var(--msb-accent);
-	background-image: linear-gradient(90deg, var(--msb-accent), var(--msb-accent2));
-	transition: width .35s ease;
-}
-
-.msb-rb-bar.is-animated::after {
-	content: "";
-	position: absolute;
-	inset: 0;
-	background-image: linear-gradient(45deg, rgba(255, 255, 255, .18) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, .18) 50%, rgba(255, 255, 255, .18) 75%, transparent 75%, transparent);
-	background-size: 1rem 1rem;
-	animation: msb-rb-stripes 1s linear infinite;
-}
-
-.msb-rb-bar.is-success {
-	background-image: none;
-	background-color: var(--msb-success);
-}
-
-.msb-rb-bar.is-danger {
-	background-image: none;
-	background-color: var(--msb-danger);
-}
-
-@keyframes msb-rb-stripes {
-	from {
-		background-position: 1rem 0;
-	}
-
-	to {
-		background-position: 0 0;
-	}
-}

source/packages/com_mokosuitebackup/media/joomla.asset.json

@@ -9,11 +9,6 @@
 			"name": "com_mokosuitebackup.admin",
 			"type": "style",
 			"uri": "com_mokosuitebackup/css/admin.css"
-		},
-		{
-			"name": "com_mokosuitebackup.runbackup",
-			"type": "style",
-			"uri": "com_mokosuitebackup/css/runbackup.css"
 		}
 	]
 }

source/packages/com_mokosuitebackup/mokosuitebackup.xml

@@ -17,7 +17,7 @@
 		display label there.
 	-->
 	<name>MokoSuiteBackup</name>
-	<version>02.63.03</version>
+	<version>02.58.34</version>
 	<creationDate>2026-06-02</creationDate>
 	<author>Moko Consulting</author>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>

source/packages/com_mokosuitebackup/sql/updates/mysql/02.58.34.sql

@@ -0,0 +1 @@
+/* 02.58.34 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.58.35.sql

@@ -1 +0,0 @@
-/* 02.58.35 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.58.36.sql

@@ -1 +0,0 @@
-/* 02.58.36 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.58.37.sql

@@ -1 +0,0 @@
-/* 02.58.37 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.59.00.sql

@@ -1 +0,0 @@
-/* 02.59.00 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.59.01.sql

@@ -1 +0,0 @@
-/* 02.59.01 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.59.02.sql

@@ -1 +0,0 @@
-/* 02.59.02 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.59.03.sql

@@ -1 +0,0 @@
-/* 02.59.03 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.59.04.sql

@@ -1 +0,0 @@
-/* 02.59.04 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.59.05.sql

@@ -1 +0,0 @@
-/* 02.59.05 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.59.06.sql

@@ -1 +0,0 @@
-/* 02.59.06 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.59.07.sql

@@ -1 +0,0 @@
-/* 02.59.07 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.59.08.sql

@@ -1 +0,0 @@
-/* 02.59.08 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.59.09.sql

@@ -1 +0,0 @@
-/* 02.59.09 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.60.00.sql

@@ -1 +0,0 @@
-/* 02.60.00 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.60.01.sql

@@ -1 +0,0 @@
-/* 02.60.01 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.60.02.sql

@@ -1 +0,0 @@
-/* 02.60.02 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.60.03.sql

@@ -1 +0,0 @@
-/* 02.60.03 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.60.04.sql

@@ -1 +0,0 @@
-/* 02.60.04 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.60.05.sql

@@ -1 +0,0 @@
-/* 02.60.05 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.60.06.sql

@@ -1 +0,0 @@
-/* 02.60.06 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.61.00.sql

@@ -1 +0,0 @@
-/* 02.61.00 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.61.01.sql

@@ -1 +0,0 @@
-/* 02.61.01 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.61.04.sql

@@ -1 +0,0 @@
-/* 02.61.04 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.61.05.sql

@@ -1 +0,0 @@
-/* 02.61.05 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.61.06.sql

@@ -1 +0,0 @@
-/* 02.61.06 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.62.00.sql

@@ -1 +0,0 @@
-/* 02.62.00 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.62.01.sql

@@ -1 +0,0 @@
-/* 02.62.01 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.62.02.sql

@@ -1 +0,0 @@
-/* 02.62.02 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.62.03.sql

@@ -1 +0,0 @@
-/* 02.62.03 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.63.00.sql

@@ -1 +0,0 @@
-/* 02.63.00 — no schema changes */

source/packages/com_mokosuitebackup/sql/updates/mysql/02.63.03.sql

@@ -1 +0,0 @@
-/* 02.63.03 — no schema changes */

source/packages/com_mokosuitebackup/src/Controller/AjaxController.php

@@ -89,11 +89,11 @@ class AjaxController extends BaseController
 	 *
 	 * Called by the full-screen backup screen after a successful backup so the
 	 * imminent server-side onExtensionBeforeUpdate / onExtensionBeforeUninstall
-	 * backup is skipped once — it sets a ONE-SHOT skip flag (keyed by the
-	 * `action` the backup was fronting) that plg_system_mokosuitebackup
-	 * consumes on the re-fired update/uninstall request, so exactly that one
-	 * action is not double-backed-up while later, distinct actions still are.
-	 * POST: task=ajax.preupdateAck&action=update|uninstall
+	 * backup is skipped — it arms the same 10-minute throttle keys the system
+	 * plugin checks, preventing a duplicate backup when the update / uninstall
+	 * then proceeds. Arms BOTH keys so a single ack covers whichever action the
+	 * full-screen backup was fronting.
+	 * POST: task=ajax.preupdateAck
 	 */
 	public function preupdateAck(): void
 	{
@@ -109,21 +109,11 @@ class AjaxController extends BaseController
 			return;
 		}
 
-		/* Set a ONE-SHOT skip flag for the specific action the full-screen backup
-		   was fronting. runPreActionBackup() consumes it on the re-fired
-		   update/uninstall request (once), so the synchronous backup is skipped
-		   that one time but the NEXT distinct action still backs up. Keyed by
-		   action so an update ack never suppresses a later, unrelated uninstall.
-		   For a core Joomla update (no action) neither flag is set — a core
-		   update doesn't fire onExtensionBefore(Update|Uninstall). */
-		$action  = $this->app->getInput()->getCmd('action', '');
+		// Same keys + semantics as plg_system_mokosuitebackup::runPreActionBackup().
 		$session = Factory::getSession();
-
-		if ($action === 'update') {
-			$session->set('mokosuitebackup.skip_preaction_backup_before_update', true);
-		} elseif ($action === 'uninstall') {
-			$session->set('mokosuitebackup.skip_preaction_backup_before_uninstall', true);
-		}
+		$now     = time();
+		$session->set('mokosuitebackup.preaction_backup_before_update', $now);
+		$session->set('mokosuitebackup.preaction_backup_before_uninstall', $now);
 
 		$this->sendJson(['error' => false, 'message' => 'Pre-action backup acknowledged']);
 	}

source/packages/com_mokosuitebackup/src/Engine/MokoRestore.php

@@ -480,8 +480,8 @@ function actionPreflight(): array
     $checks[] = [
         'label' => 'PHP Version',
         'value' => PHP_VERSION,
-        'ok'    => version_compare(PHP_VERSION, '8.3', '>='),
-        'hint'  => 'Joomla 6 requires PHP 8.3+',
+        'ok'    => version_compare(PHP_VERSION, '8.1', '>='),
+        'hint'  => 'Joomla 4/5 requires PHP 8.1+',
     ];
 
     $checks[] = [

source/packages/com_mokosuitebackup/src/Engine/SnapshotRestoreEngine.php

@@ -125,23 +125,11 @@ class SnapshotRestoreEngine
 		$prefix = $db->getPrefix();
 		$totalRows = 0;
 
-		// Build list of tables to restore based on selected types
-		$tablesToRestore = $this->getTablesToRestore($restoreTypes);
-
-		/* Duplicate mode inserts brand-new records through Joomla's Table API,
-		   whose Nested tables (categories, tags) issue LOCK TABLES — which
-		   implicitly COMMITS any open transaction in MySQL/InnoDB. Wrapping it
-		   in transactionStart()/Rollback() would be a false atomicity promise:
-		   the first category/tag store would commit and defeat the rollback.
-		   Duplicate mode is therefore best-effort and per-item defensive (a bad
-		   item is skipped and logged, never fatal) rather than all-or-nothing.
-		   The raw-DB modes (replace/create/merge) remain fully transactional. */
-		$useTransaction = ($mode !== 'duplicate');
-
 		try {
-			if ($useTransaction) {
-				$db->transactionStart();
-			}
+			$db->transactionStart();
+
+			// Build list of tables to restore based on selected types
+			$tablesToRestore = $this->getTablesToRestore($restoreTypes);
 
 			if ($mode === 'duplicate') {
 				$totalRows = $this->restoreDuplicate($data, $restoreTypes);
@@ -168,9 +156,7 @@ class SnapshotRestoreEngine
 			}
 			}
 
-			if ($useTransaction) {
-				$db->transactionCommit();
-			}
+			$db->transactionCommit();
 
 			$this->log('Restore complete: ' . $totalRows . ' total rows');
 
@@ -202,15 +188,11 @@ class SnapshotRestoreEngine
 				'log'     => implode("\n", $this->log),
 			];
 		} catch (\Throwable $e) {
-			if ($useTransaction) {
-				try {
-					$db->transactionRollback();
-					$this->log('Transaction rolled back');
-				} catch (\Exception $rollbackEx) {
-					$this->log('Rollback failed: ' . $rollbackEx->getMessage());
-				}
-			} else {
-				$this->log('Duplicate mode is not transactional; records already inserted are left in place.');
+			try {
+				$db->transactionRollback();
+				$this->log('Transaction rolled back');
+			} catch (\Exception $rollbackEx) {
+				$this->log('Rollback failed: ' . $rollbackEx->getMessage());
 			}
 
 			$this->log('FATAL: ' . $e->getMessage());

source/packages/com_mokosuitebackup/src/Model/DashboardModel.php

@@ -104,7 +104,7 @@ class DashboardModel extends BaseDatabaseModel
 		// PHP version
 		$checks[] = (object) [
 			'label'  => 'PHP Version',
-			'status' => version_compare(PHP_VERSION, '8.3.0', '>='),
+			'status' => version_compare(PHP_VERSION, '8.1.0', '>='),
 			'detail' => PHP_VERSION,
 		];
 

source/packages/com_mokosuitebackup/src/View/Runbackup/HtmlView.php

@@ -40,9 +40,6 @@ class HtmlView extends BaseHtmlView
 
 	public bool $autostart = true;
 
-	/** Which action the backup fronts ('update' | 'uninstall' | ''); drives the completion ack skip flag. */
-	public string $action = '';
-
 	public function display($tpl = null): void
 	{
 		$input = Factory::getApplication()->getInput();
@@ -51,7 +48,6 @@ class HtmlView extends BaseHtmlView
 		$this->description  = $input->getString('description', '');
 		$this->returnUrl    = $input->getRaw('returnurl', '');
 		$this->autostart    = (bool) $input->getInt('autostart', 1);
-		$this->action       = $input->getCmd('msb_action', '');
 
 		if ($this->profileId <= 0) {
 			$this->profileId = 1;

source/packages/com_mokosuitebackup/tmpl/profile/edit.php

@@ -14,18 +14,13 @@ use Joomla\CMS\HTML\HTMLHelper;
 use Joomla\CMS\Language\Text;
 use Joomla\CMS\Router\Route;
 use Joomla\CMS\Session\Session;
-use Joomla\CMS\Uri\Uri;
 
 HTMLHelper::_('behavior.formvalidator');
 HTMLHelper::_('behavior.keepalive');
 HTMLHelper::_('bootstrap.modal');
 
-/* Component CSS. Registered in media/joomla.asset.json, but this component's WAM
-   styles don't emit on the admin document (asset resolves without error yet no
-   <link> renders), so attach the external stylesheet directly — reliably output
-   via <jdoc:include type="styles" />. */
+/* Component CSS via the Web Asset Manager (declared in media/joomla.asset.json) */
 $this->getDocument()->getWebAssetManager()->useStyle('com_mokosuitebackup.admin');
-$this->getDocument()->addStyleSheet(Uri::root(true) . '/media/com_mokosuitebackup/css/admin.css');
 
 $profileId = (int) $this->item->id;
 $token     = Session::getFormToken();

source/packages/com_mokosuitebackup/tmpl/runbackup/default.php

@@ -34,14 +34,6 @@ if ($this->returnUrl !== '') {
 	$decoded = base64_decode($this->returnUrl, true);
 	$raw     = ($decoded !== false && $decoded !== '') ? $decoded : $this->returnUrl;
 
-	/* Reject any backslash or control char outright: legitimate Joomla admin
-	   return URLs never contain them, and a browser normalises a leading "/\"
-	   to "//", turning a would-be root-relative path into a protocol-relative
-	   open redirect (e.g. "/\evil.com" → "//evil.com"). */
-	if (preg_match('/[\x00-\x1f\x7f\\\\]/', $raw)) {
-		$raw = '';
-	}
-
 	$isAbsoluteHttp = (bool) preg_match('#^https?://#i', $raw);
 	$isRootRelative = isset($raw[0]) && $raw[0] === '/' && (!isset($raw[1]) || $raw[1] !== '/');
 
@@ -71,7 +63,6 @@ $config = [
 	'profileId'    => $this->profileId,
 	'description'  => $this->description,
 	'returnUrl'    => $safeReturnUrl,
-	'action'       => $this->action,
 	'dashboardUrl' => $dashboardUrl,
 	'recordUrl'    => Route::_('index.php?option=com_mokosuitebackup&view=backup&id=__MSBID__', false),
 	'autostart'    => $this->autostart,
@@ -86,22 +77,57 @@ $config = [
 		'dashboard'  => Text::_('COM_MOKOJOOMBACKUP_RUNBACKUP_BACK_TO_DASHBOARD'),
 		'viewRecord' => Text::_('COM_MOKOJOOMBACKUP_RUNBACKUP_VIEW_RECORD'),
 		'leaveWarn'  => Text::_('COM_MOKOJOOMBACKUP_RUNBACKUP_LEAVE_WARNING'),
-		'continueUpdate' => Text::_('COM_MOKOJOOMBACKUP_RUNBACKUP_CONTINUE_UPDATE'),
 	],
 ];
-
-// Screen CSS lives in an external media stylesheet (media/com_mokosuitebackup/
-// css/runbackup.css), not an inline <style> block. It is registered in
-// media/joomla.asset.json, but this component's Web Asset Manager styles do not
-// emit on the admin document (the asset resolves without error yet no <link> is
-// produced — the same is true of com_mokosuitebackup.admin), so we attach the
-// stylesheet directly to the document, which reliably renders via <jdoc:include
-// type="styles" />.
-$this->getDocument()->getWebAssetManager()->useStyle('com_mokosuitebackup.runbackup');
-$this->getDocument()->addStyleSheet(Uri::root(true) . '/media/com_mokosuitebackup/css/runbackup.css');
 ?>
+<style>
+	/* Colours are pulled from the Atum admin template's own CSS custom
+	   properties so the screen matches whatever theme the site runs, with
+	   Bootstrap and then a literal as progressive fallbacks. */
+	.msb-runbackup {
+		--msb-accent:  var(--template-link-color, var(--bs-link-color, #2a69b8));
+		--msb-accent2: var(--template-special-color, var(--msb-accent));
+		--msb-success: var(--template-success-color, var(--bs-success, #2f7d32));
+		--msb-danger:  var(--template-danger-color, var(--bs-danger, #c52128));
+		--msb-track:   var(--template-bg-light, var(--bs-gray-200, #edf0f5));
+		padding: 0 1rem;
+	}
+	/* overflow:hidden clips the full-bleed bar to the card's rounded corners. */
+	.msb-runbackup .card { overflow: hidden; }
+	.msb-rb-progress {
+		height: 2.5rem;
+		background: var(--msb-track);
+		overflow: hidden;
+	}
+	.msb-rb-bar {
+		height: 100%;
+		width: 0;
+		display: flex;
+		align-items: center;
+		justify-content: center;
+		color: #fff;
+		font-weight: 600;
+		font-size: .95rem;
+		white-space: nowrap;
+		background-color: var(--msb-accent);
+		background-image: linear-gradient(90deg, var(--msb-accent), var(--msb-accent2));
+		transition: width .35s ease;
+	}
+	.msb-rb-bar.is-animated::after {
+		content: "";
+		position: absolute;
+		inset: 0;
+		background-image: linear-gradient(45deg, rgba(255,255,255,.18) 25%, transparent 25%, transparent 50%, rgba(255,255,255,.18) 50%, rgba(255,255,255,.18) 75%, transparent 75%, transparent);
+		background-size: 1rem 1rem;
+		animation: msb-rb-stripes 1s linear infinite;
+	}
+	.msb-rb-bar { position: relative; }
+	.msb-rb-bar.is-success { background-image: none; background-color: var(--msb-success); }
+	.msb-rb-bar.is-danger  { background-image: none; background-color: var(--msb-danger); }
+	@keyframes msb-rb-stripes { from { background-position: 1rem 0; } to { background-position: 0 0; } }
+</style>
 <div class="msb-runbackup">
-	<div class="card shadow-sm bg-body-secondary">
+	<div class="card shadow-sm">
 		<div class="card-body p-4 pb-3">
 			<h1 class="h4 mb-1" id="msb-rb-title">
 				<span class="icon-archive" aria-hidden="true"></span>
@@ -118,17 +144,7 @@ $this->getDocument()->addStyleSheet(Uri::root(true) . '/media/com_mokosuitebacku
 			</p>
 
 			<div id="msb-rb-phase" class="fw-bold mb-1"></div>
-			<div id="msb-rb-status" class="mb-0"><?php echo htmlspecialchars(Text::_('COM_MOKOJOOMBACKUP_RUNBACKUP_STARTING'), ENT_QUOTES, 'UTF-8'); ?></div>
-
-			<?php if ($safeReturnUrl !== '') : ?>
-			<!-- Pre-update/uninstall flow: opt in to auto-continue, or get a manual "Continue" button on completion. -->
-			<div class="form-check mt-3" id="msb-rb-autocontinue-wrap">
-				<input class="form-check-input" type="checkbox" id="msb-rb-autocontinue" checked>
-				<label class="form-check-label" for="msb-rb-autocontinue">
-					<?php echo htmlspecialchars(Text::_('COM_MOKOJOOMBACKUP_RUNBACKUP_AUTOCONTINUE'), ENT_QUOTES, 'UTF-8'); ?>
-				</label>
-			</div>
-			<?php endif; ?>
+			<div id="msb-rb-status" class="text-muted small mb-0"><?php echo htmlspecialchars(Text::_('COM_MOKOJOOMBACKUP_RUNBACKUP_STARTING'), ENT_QUOTES, 'UTF-8'); ?></div>
 
 			<div id="msb-rb-actions" class="d-none mt-3">
 				<button type="button" id="msb-rb-retry" class="btn btn-primary d-none"></button>
@@ -140,7 +156,7 @@ $this->getDocument()->addStyleSheet(Uri::root(true) . '/media/com_mokosuitebacku
 
 		<!-- Full-bleed progress bar, edge-to-edge along the bottom of the card. -->
 		<div class="msb-rb-progress" role="progressbar" aria-valuemin="0" aria-valuemax="100" aria-valuenow="0">
-			<div id="msb-rb-bar" class="msb-rb-bar is-animated">0%</div>
+			<div id="msb-rb-bar" class="msb-rb-bar is-animated" style="width:0;">0%</div>
 		</div>
 	</div>
 </div>
@@ -164,9 +180,7 @@ $this->getDocument()->addStyleSheet(Uri::root(true) . '/media/com_mokosuitebacku
 		retry:     document.getElementById('msb-rb-retry'),
 		record:    document.getElementById('msb-rb-record'),
 		continue:  document.getElementById('msb-rb-continue'),
-		dashboard: document.getElementById('msb-rb-dashboard'),
-		autocontinue:     document.getElementById('msb-rb-autocontinue'),
-		autocontinueWrap: document.getElementById('msb-rb-autocontinue-wrap')
+		dashboard: document.getElementById('msb-rb-dashboard')
 	};
 
 	function setBar(pct, striped) {
@@ -205,37 +219,16 @@ $this->getDocument()->addStyleSheet(Uri::root(true) . '/media/com_mokosuitebacku
 		setBar(100, false);
 		el.title.textContent = L.complete || 'Backup complete';
 
-		/* Set the one-shot skip flag for THIS action so the following
-		   server-side onExtensionBefore(Update|Uninstall) backup is skipped once
-		   (no duplicate backup) without suppressing later, distinct actions.
+		/* Arm the pre-action throttles so a following server-side onExtension
+		   Before(Update|Uninstall) backup is skipped (no duplicate backup).
 		   Awaited so it lands before we hand back to the update/uninstall. */
-		try { await post({ task: 'ajax.preupdateAck', action: CFG.action || '' }); } catch (e) {}
+		try { await post({ task: 'ajax.preupdateAck' }); } catch (e) {}
 
 		if (CFG.returnUrl) {
-			/* Pre-update / pre-uninstall flow. If "auto-continue" is ticked
-			   (default) hand back to Joomla automatically; otherwise stop here
-			   and offer a link to the new backup record plus a manual
-			   "Continue the update" button. */
-			if (el.autocontinueWrap) { el.autocontinueWrap.classList.add('d-none'); }
-
-			var autoContinue = !el.autocontinue || el.autocontinue.checked;
-
-			if (autoContinue) {
-				setStatus(L.continuing || 'Continuing…');
-				window.setTimeout(function () { window.location.href = CFG.returnUrl; }, 1200);
-			} else {
-				setStatus(L.complete || 'Backup complete');
-				showActions();
-
-				if (lastRecordId > 0 && CFG.recordUrl) {
-					showBtn(el.record, L.viewRecord || 'View backup record',
-						CFG.recordUrl.replace('__MSBID__', String(lastRecordId)));
-				}
-
-				el.continue.classList.remove('btn-warning');
-				el.continue.classList.add('btn-success');
-				showBtn(el.continue, L.continueUpdate || 'Continue the update', CFG.returnUrl);
-			}
+			/* Pre-update / pre-uninstall flow: continue the original action.
+			   No "view record" button here — we're handing back to Joomla. */
+			setStatus(L.continuing || 'Continuing…');
+			window.setTimeout(function () { window.location.href = CFG.returnUrl; }, 1200);
 		} else {
 			/* Manual "Backup Now": offer to view the record that was just made. */
 			setStatus(L.complete || 'Backup complete');

source/packages/mod_mokosuitebackup_cpanel/mod_mokosuitebackup_cpanel.xml

@@ -8,7 +8,7 @@
  -->
 <extension type="module" client="administrator" method="upgrade">
 	<name>Module - MokoSuiteBackup - cPanel</name>
-	<version>02.63.03</version>
+	<version>02.58.34</version>
 	<creationDate>2026-06-23</creationDate>
 	<author>Moko Consulting</author>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>

source/packages/plg_actionlog_mokosuitebackup/mokosuitebackup.xml

@@ -7,7 +7,7 @@
  -->
 <extension type="plugin" group="actionlog" method="upgrade">
 	<name>Action Log - MokoSuiteBackup</name>
-	<version>02.63.03</version>
+	<version>02.58.34</version>
 	<creationDate>2026-06-04</creationDate>
 	<author>Moko Consulting</author>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>

source/packages/plg_console_mokosuitebackup/mokosuitebackup.xml

@@ -7,7 +7,7 @@
  -->
 <extension type="plugin" group="console" method="upgrade">
 	<name>Console - MokoSuiteBackup</name>
-	<version>02.63.03</version>
+	<version>02.58.34</version>
 	<creationDate>2026-06-04</creationDate>
 	<author>Moko Consulting</author>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>

source/packages/plg_content_mokosuitebackup/mokosuitebackup.xml

@@ -7,7 +7,7 @@
  -->
 <extension type="plugin" group="content" method="upgrade">
 	<name>Content - MokoSuiteBackup</name>
-	<version>02.63.03</version>
+	<version>02.58.34</version>
 	<creationDate>2026-06-04</creationDate>
 	<author>Moko Consulting</author>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>

source/packages/plg_quickicon_mokosuitebackup/mokosuitebackup.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <extension type="plugin" group="quickicon" method="upgrade">
 	<name>Quick Icon - MokoSuiteBackup</name>
-	<version>02.63.03</version>
+	<version>02.58.34</version>
 	<creationDate>2026-06-02</creationDate>
 	<author>Moko Consulting</author>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>

source/packages/plg_system_mokosuitebackup/media/js/installer-backup.js

@@ -70,27 +70,6 @@
 			return;
 		}
 
-		var ret = window.location.href;
-		ret += (ret.indexOf('?') === -1 ? '?' : '&') + 'msb_resume=1';
-
-		/* Tell the backup screen which action it is fronting so its completion
-		   ack sets the matching one-shot skip flag (and not the other). */
-		var action = (task === 'update.update') ? 'update' : 'uninstall';
-
-		/* Build the redirect BEFORE we swallow the click. btoa() throws on
-		   non-Latin1 input (e.g. a UTF-8 filter value in the query string), so
-		   encode as UTF-8 first; if it still fails, bail WITHOUT preventing the
-		   click so Joomla's own update/uninstall proceeds normally. */
-		var target;
-		try {
-			target = cfg.runbackupUrl
-				+ '&profile_id=' + encodeURIComponent(cfg.profileId)
-				+ '&msb_action=' + action
-				+ '&returnurl=' + encodeURIComponent(btoa(unescape(encodeURIComponent(ret))));
-		} catch (x) {
-			return;
-		}
-
 		e.preventDefault();
 		e.stopImmediatePropagation();
 
@@ -98,7 +77,12 @@
 			sessionStorage.setItem(STORAGE_KEY, JSON.stringify({ task: task, cids: cids }));
 		} catch (x) {}
 
-		window.location.href = target;
+		var ret = window.location.href;
+		ret += (ret.indexOf('?') === -1 ? '?' : '&') + 'msb_resume=1';
+
+		window.location.href = cfg.runbackupUrl
+			+ '&profile_id=' + encodeURIComponent(cfg.profileId)
+			+ '&returnurl=' + encodeURIComponent(btoa(ret));
 	}, true);
 
 	/* On return from the backup screen: restore the selection and re-fire. */

source/packages/plg_system_mokosuitebackup/mokosuitebackup.xml

@@ -7,7 +7,7 @@
  -->
 <extension type="plugin" group="system" method="upgrade">
 	<name>System - MokoSuiteBackup</name>
-	<version>02.63.03</version>
+	<version>02.58.34</version>
 	<creationDate>2026-06-02</creationDate>
 	<author>Moko Consulting</author>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>

source/packages/plg_system_mokosuitebackup/src/Extension/MokoSuiteBackup.php

@@ -28,12 +28,6 @@ final class MokoSuiteBackup extends CMSPlugin implements SubscriberInterface
 {
 	protected $autoloadLanguage = true;
 
-	/** @var array<string,bool> Per-request guard: at most one pre-action backup per request (dedupes a batch update). */
-	private array $preactionRan = [];
-
-	/** @var array<string,bool> Per-request cache of the one-shot "client already backed up" skip flag. */
-	private array $preactionSkip = [];
-
 	public static function getSubscribedEvents(): array
 	{
 		return [
@@ -229,20 +223,23 @@ final class MokoSuiteBackup extends CMSPlugin implements SubscriberInterface
 			return;
 		}
 
+		// Already backed up this session (throttle window)? Then the JS should
+		// let the action proceed without a fresh backup.
+		$session   = Factory::getSession();
+		$throttleK = $view === 'update'
+			? 'mokosuitebackup.preaction_backup_before_update'
+			: 'mokosuitebackup.preaction_backup_before_uninstall';
+		$lastRun   = (int) $session->get($throttleK, 0);
+		$recent    = $lastRun > 0 && (time() - $lastRun) < 600;
+
 		$doc->getWebAssetManager()->useScript('core');
 
-		/* No time-based "recently backed up" suppression here: each distinct
-		   Update/Uninstall click should get its own full-screen backup. The
-		   re-fired click after a backup is guarded client-side by
-		   window.__msbResuming, and the synchronous server-side fallback is
-		   deduped per-request + by a one-shot skip flag (see runPreActionBackup),
-		   so there is no double backup without blocking distinct actions. */
 		$doc->addScriptOptions('plg_system_mokosuitebackup.installer', [
 			'runbackupUrl'          => Route::_('index.php?option=com_mokosuitebackup&view=runbackup&tmpl=component&autostart=1', false),
 			'profileId'             => (int) $params->get('default_profile', 1),
 			'backupBeforeUpdate'    => $view === 'update' && (bool) $beforeUpdate,
 			'backupBeforeUninstall' => $view === 'manage' && (bool) $beforeUninst,
-			'recentBackup'          => false,
+			'recentBackup'          => $recent,
 		]);
 
 		$doc->addScript(Uri::root(true) . '/media/plg_system_mokosuitebackup/js/installer-backup.js', [], ['defer' => true]);
@@ -316,20 +313,16 @@ JS;
 
 		$session = Factory::getSession();
 
-		// Returned from the backup screen: mark this core update backed up so we
-		// don't redirect to the backup screen again on a page revisit, then let
-		// it proceed. Uses a DEDICATED core-update key — a core update does not
-		// fire onExtensionBefore(Update|Uninstall), so it must not touch the
-		// extension pre-action flags (which would suppress extension backups).
+		// Returned from the backup screen: arm the throttle so the synchronous
+		// onExtensionBeforeUpdate backup doesn't run again, then let it proceed.
 		if ((int) $input->getInt('is_backed_up', 0) === 1) {
-			$session->set('mokosuitebackup.core_update_backed_up', time());
+			$session->set('mokosuitebackup.preaction_backup_before_update', time());
 
 			return;
 		}
 
-		// Backed up this core update recently already — let the update proceed
-		// without redirecting to the backup screen again.
-		$lastRun = (int) $session->get('mokosuitebackup.core_update_backed_up', 0);
+		// Backed up recently already — let the update proceed.
+		$lastRun = (int) $session->get('mokosuitebackup.preaction_backup_before_update', 0);
 
 		if ($lastRun > 0 && (time() - $lastRun) < 600) {
 			return;
@@ -532,37 +525,17 @@ JS;
 			return;
 		}
 
-		/* One backup per Update action — NOT a 10-minute time throttle. The old
-		   600s window suppressed every extension's pre-action backup for 10
-		   minutes after any single one ran (e.g. after updating this very
-		   extension), so distinct updates silently went un-backed-up. Instead:
+		// Throttle: only run once per 10 minutes to prevent duplicate
+		// backups when multiple extensions are updated in a batch
+		$session    = Factory::getSession();
+		$sessionKey = 'mokosuitebackup.preaction_' . $paramName;
+		$lastRun    = $session->get($sessionKey, 0);
 
-		   (a) dedupe within a single request — a batch update fires this handler
-		       once per extension, all in the same request, so back up only once;
-		   (b) honour a one-shot session skip flag set by ajax.preupdateAck when
-		       the client-side full-screen backup already ran and is re-firing the
-		       real update/uninstall — consumed once, so the NEXT distinct action
-		       backs up again. */
-		if (!empty($this->preactionRan[$paramName])) {
+		if (time() - $lastRun < 600) {
 			return;
 		}
 
-		$session = Factory::getSession();
-		$skipKey = 'mokosuitebackup.skip_preaction_' . $paramName;
-
-		if (!array_key_exists($paramName, $this->preactionSkip)) {
-			$this->preactionSkip[$paramName] = (bool) $session->get($skipKey, false);
-			$session->set($skipKey, false);
-		}
-
-		if ($this->preactionSkip[$paramName]) {
-			// Client already backed up; skip this whole re-fired (possibly batch) request.
-			$this->preactionRan[$paramName] = true;
-
-			return;
-		}
-
-		$this->preactionRan[$paramName] = true;
+		$session->set($sessionKey, time());
 
 		$profileId = (int) $params->get('default_profile', 1);
 

source/packages/plg_task_mokosuitebackup/mokosuitebackup.xml

@@ -7,7 +7,7 @@
  -->
 <extension type="plugin" group="task" method="upgrade">
 	<name>Task - MokoSuiteBackup</name>
-	<version>02.63.03</version>
+	<version>02.58.34</version>
 	<creationDate>2026-06-02</creationDate>
 	<author>Moko Consulting</author>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>

source/packages/plg_webservices_mokosuitebackup/mokosuitebackup.xml

@@ -7,7 +7,7 @@
  -->
 <extension type="plugin" group="webservices" method="upgrade">
 	<name>Web Services - MokoSuiteBackup</name>
-	<version>02.63.03</version>
+	<version>02.58.34</version>
 	<creationDate>2026-06-02</creationDate>
 	<author>Moko Consulting</author>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>

source/pkg_mokosuitebackup.xml

@@ -8,7 +8,7 @@
 <extension type="package" method="upgrade">
 	<name>Package - MokoSuiteBackup</name>
 	<packagename>mokosuitebackup</packagename>
-	<version>02.63.03</version>
+	<version>02.58.34</version>
 	<creationDate>2026-06-02</creationDate>
 	<author>Moko Consulting</author>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>