[MiddleSokilAI]

Problem

make:site update copied the archive's manager/ directory without honoring EVO_MANAGER_PATH. On installations with a renamed Manager, the core was updated while the active Manager remained outdated and a second manager/ directory appeared. In particular, the new core CSRF middleware rejected submissions from the old system settings form because it did not contain _token.

The command also unconditionally set COMPOSER_HOME to core/composer. This prevented Composer from finding existing global authentication, such as ~/.config/composer/auth.json, causing private dependency updates to fail with HTTP 401.

Target Branch

This PR was prepared directly from the current 3.6.x branch and targets 3.6.x.

Changes

• Route the archive's top-level manager/ tree to the active EVO_MANAGER_PATH instead of always copying it to the default directory. All other archive paths retain their original layout.
• Add an optional third argument to moveFiles(), preserving compatibility with existing two-argument calls.
• Preserve existing Manager includes/config.inc.php, .htaccess, and .user.ini files. Do not delete additional local files. Reject a missing configured Manager directory before replacing site files, and report file transfer failures instead of silently skipping them.
• Replace the unconditional Composer home override with respect for explicit COMPOSER_HOME and COMPOSER_AUTH. When no site-local auth file is present, retain Composer's normal global/XDG authentication lookup.
• Keep support for existing core/composer/auth.json. Retain a site-local home fallback for headless environments without HOME or Windows APPDATA, including when inline authentication is supplied. The updater does not read or copy credential contents.
• Update command help and add regression tests that overlay real temporary directory trees and compile the current CSRF-enabled settings form.

Files

• core/src/Console/SiteUpdateCommand.php
• core/tests/Unit/Console/SiteUpdateLayoutTest.php

Validation

PHP 8.4.20, Pest 5.3.4: 213 tests passed, 600 assertions:

cd core
php8.4 vendor/bin/pest tests/Unit/Console \
  tests/Feature/SiteUpdateE2ETest.php \
  tests/Feature/InstallerManagerDirTest.php \
  tests/Unit/Security/ManagerCsrfMiddlewareTest.php \
  tests/Unit/Security/ManagerCsrfCoverageTest.php --compact --colors=never

• New scenarios cover default, renamed, nested, and external Manager directories; a leftover default manager/; repeated overlays; local configuration preservation; rejection before writes for an invalid Manager path; CSRF form compilation; and global, explicit, legacy, and headless Composer environments.
• composer analyze -- --no-progress --error-format=json: 0 errors, 0 file errors, PHPStan level 0.
• php8.4 -l passes for both changed PHP files.
• git diff --check passes.
• Installing the existing core/composer.lock in the local test environment required --ignore-platform-req=php: the locked roave/security-advisories requires a newer PHP patch release than the available 8.4.20. This was only used to bootstrap local tests; the production command and lock file are unchanged. Root PHPStan was installed separately using the standard composer install.

Scope And Risks

• Filesystem tests use temporary directories; database integration tests use isolated SQLite. This PR's updater has not been run against production.
• An extra manager/ directory created by an earlier updater is not automatically deleted. Removing it remains an explicit operator action after checking the active Manager directory.
• Local access-control files are preserved. Upstream changes to their templates must be reviewed and merged separately.
• Updating remains a file overlay, not an atomic deployment. A pre-update backup and access-permission checks remain necessary.
• Composer manifests, lock files, dependencies, and site business logic are unchanged.