From 777932153fde82c79e38d4a8b64948361eb8549d Mon Sep 17 00:00:00 2001
From: TheWitness <thewitness@cacti.net>
Date: Thu, 8 Oct 2026 16:14:54 -0400
Subject: [PATCH 1/3] Skin ApexCharts from the active Cacti theme's rrdtheme
 colors

The By Method/By Table charts and the import upload donut hard-coded a single light palette and a two-theme light/dark switch that mislabeled several core themes (e.g. paper-plane and deepness are dark but rendered with light text/grid). Derive the ApexCharts foreColor, gridline color and light/dark mode from the active theme's own include/themes/<theme>/rrdtheme.php - mirroring Cacti core's rrdtheme loading, honoring the CactiColorMode cookie's dark/light variants, and inferring mode from the theme font luminance so every current and future theme is covered.
---
 includes/slowlog_functions.php | 86 ++++++++++++++++++++++++++++++++++
 slowlog.php                    | 31 +++++-------
 2 files changed, 98 insertions(+), 19 deletions(-)

diff --git a/includes/slowlog_functions.php b/includes/slowlog_functions.php
index 433eedc..ba21241 100644
--- a/includes/slowlog_functions.php
+++ b/includes/slowlog_functions.php
@@ -3096,3 +3096,89 @@ function slowlog_get_chart_scope_items(string $chart_type, int $id): array {
 
 	return $scope_items;
 }
+
+/**
+ * Resolves the active Cacti theme's chart surface colors so the plugin's
+ * ApexCharts match whatever core theme (and dark/light color mode) the user has
+ * selected, instead of a single hard-coded palette.
+ *
+ * Mirrors Cacti core's own rrdtheme loading (lib/rrd.php): the selected theme is
+ * validated against the themes allowlist, its rrdtheme.php is included for the
+ * canonical font/grid colors, and the CactiColorMode cookie's dark/light
+ * variants are honored when a theme defines them. The light/dark ApexCharts mode
+ * is derived from the luminance of the theme's own font color, so every current
+ * and future theme is covered without a hand-maintained theme-name list.
+ *
+ * Called from slowlog_import() and slowlog_view_charts() to skin the upload
+ * donut and the By Method/By Table charts.
+ *
+ * @return array{mode:string,foreColor:string,gridColor:string} ApexCharts theme
+ *               mode ('light'|'dark') plus '#rrggbb' text and gridline colors.
+ *
+ * @global array $config Cacti global configuration array; used to locate the
+ *                       active theme's rrdtheme.php.
+ */
+function slowlog_apex_theme(): array {
+	global $config;
+
+	$theme = get_selected_theme();
+	$theme = function_exists('cacti_validate_theme') ? cacti_validate_theme($theme) : basename($theme);
+
+	$rrdcolors = [];
+	$themefile = $config['base_path'] . '/include/themes/' . $theme . '/rrdtheme.php';
+
+	if (is_readable($themefile)) {
+		include($themefile);
+
+		// Themes such as midwinter ship dark/light variants selected by the same
+		// CactiColorMode cookie core keys off of; prefer the matching variant.
+		if (isset($_COOKIE['CactiColorMode']) && in_array($_COOKIE['CactiColorMode'], ['dark', 'light'], true)) {
+			$variant = 'rrdcolors_' . $_COOKIE['CactiColorMode'];
+
+			if (isset($$variant) && is_array($$variant)) {
+				$rrdcolors = array_merge($rrdcolors, $$variant);
+			}
+		}
+	}
+
+	$font = slowlog_normalize_hex_color($rrdcolors['font'] ?? '', '000000');
+	$grid = slowlog_normalize_hex_color($rrdcolors['grid'] ?? '', 'cccccc');
+
+	// A light font implies a dark theme; ApexCharts' mode drives the tooltip surface.
+	$r = hexdec(substr($font, 0, 2));
+	$g = hexdec(substr($font, 2, 2));
+	$b = hexdec(substr($font, 4, 2));
+
+	$luminance = (0.299 * $r) + (0.587 * $g) + (0.114 * $b);
+
+	return [
+		'mode'      => ($luminance >= 128) ? 'dark' : 'light',
+		'foreColor' => '#' . $font,
+		'gridColor' => '#' . $grid
+	];
+}
+
+/**
+ * Normalizes a Cacti rrdtheme color (which may carry an RRDtool alpha suffix or
+ * be shorthand) into a plain 6-digit lowercase hex string usable by CSS/SVG.
+ *
+ * Called from slowlog_apex_theme() to sanitize the theme's font/grid colors.
+ *
+ * @param string $value    Raw rrdtheme color, e.g. 'FFFFffaa' or '21212400'.
+ * @param string $fallback 6-digit hex to return when $value has no usable hex.
+ *
+ * @return string A 6-character lowercase hex string (no leading '#').
+ */
+function slowlog_normalize_hex_color(string $value, string $fallback): string {
+	$hex = preg_replace('/[^0-9A-Fa-f]/', '', $value);
+
+	if (strlen($hex) >= 6) {
+		return strtolower(substr($hex, 0, 6));
+	}
+
+	if (strlen($hex) === 3) {
+		return strtolower($hex[0] . $hex[0] . $hex[1] . $hex[1] . $hex[2] . $hex[2]);
+	}
+
+	return strtolower($fallback);
+}
diff --git a/slowlog.php b/slowlog.php
index 10bb8fb..fb48074 100644
--- a/slowlog.php
+++ b/slowlog.php
@@ -340,6 +340,7 @@ function slowlog_import(): void {
 	global $config;
 
 	$selected_theme = get_selected_theme();
+	$apex           = slowlog_apex_theme();
 
 	print get_md5_include_js('plugins/slowlog/js/apexcharts.js');
 
@@ -477,6 +478,7 @@ function slowlog_import(): void {
 	</div>
 	<script type="text/javascript" <?php print plugin_slowlog_csp_nonce(); ?>>
 	(function() {
+		var slowlogThemeColors = <?php print json_encode($apex, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP); ?>;
 		var xhrInFlight = null;
 		var donutChart  = null;
 
@@ -516,10 +518,11 @@ function initDonut() {
 				plotOptions: {
 					radialBar: {
 						hollow: { size: '65%' },
-						track: { background: '#e0e0e0' },
+						track: { background: slowlogThemeColors.gridColor },
 						dataLabels: {
 							name: { show: false },
 							value: {
+								color: slowlogThemeColors.foreColor,
 								fontSize: '22px',
 								formatter: function(val) {
 									return Math.round(val) + '%';
@@ -1015,24 +1018,8 @@ function slowlog_view_charts(string $method): void {
 	global $config;
 
 	$selected_theme = get_selected_theme();
-
-	switch($selected_theme) {
-		case 'classic':
-		case 'modern':
-		case 'paw':
-		case 'paper-plane':
-			$mode = 'light';
-
-			break;
-		case 'dark':
-		case 'sunrise':
-		case 'midwinter':
-			$mode = 'dark';
-
-			break;
-		default:
-			$mode = 'light';
-	}
+	$apex           = slowlog_apex_theme();
+	$mode           = $apex['mode'];
 
 	print get_md5_include_js('plugins/slowlog/js/apexcharts.js');
 
@@ -1153,6 +1140,8 @@ function slowlog_view_charts(string $method): void {
 	?>
 	<script type="text/javascript" <?php print plugin_slowlog_csp_nonce(); ?>>
 
+	var slowlogThemeColors = <?php print json_encode($apex, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP); ?>;
+
 	function convertLabel(value) {
 		var suffix = '';
 
@@ -1200,6 +1189,7 @@ function renderChart(chartid, title, yaxislabel, categories, data, mode, height,
 				type:    'bar',
 				height:  height,
 				width:   width,
+				foreColor: slowlogThemeColors.foreColor,
 				redrawOnParentResize: true,
 				redrawOnWindowResize: true,
 				events: {
@@ -1274,6 +1264,7 @@ function renderChart(chartid, title, yaxislabel, categories, data, mode, height,
 				}
 			},
 			grid: {
+				borderColor: slowlogThemeColors.gridColor,
 				padding: {
 					left: 5,
 					right: 5
@@ -1310,6 +1301,7 @@ function renderBoxChart(chartid, title, yaxislabel, categories, boxData, p95Data
 				type:    'boxPlot',
 				height:  height,
 				width:   width,
+				foreColor: slowlogThemeColors.foreColor,
 				redrawOnParentResize: true,
 				redrawOnWindowResize: true
 			},
@@ -1361,6 +1353,7 @@ function renderBoxChart(chartid, title, yaxislabel, categories, boxData, p95Data
 				}
 			},
 			grid: {
+				borderColor: slowlogThemeColors.gridColor,
 				padding: {
 					left: 5,
 					right: 5

From 302094d2d585cef43723c440a6cb8993daffa8ed Mon Sep 17 00:00:00 2001
From: TheWitness <thewitness@cacti.net>
Date: Thu, 8 Oct 2026 16:53:32 -0400
Subject: [PATCH 2/3] Harden rrdtheme include and add apex theme unit coverage

Address review: use require() with a cacti_path_is_within() containment guard (defense-in-depth on top of cacti_validate_theme) so a poisoned theme name can never steer the include outside include/themes - closing a CVE-class path-traversal vector - and fail fast instead of silently using default colors. Add tests/Unit/ApexThemeTest.php covering 3/6/8-digit and invalid color normalization, luminance-based light/dark mode, CactiColorMode dark/light variant selection, and the missing-file fallback; stub get_selected_theme() in the unit bootstrap. Fixes the 100% changed-line coverage gate.
---
 includes/slowlog_functions.php |  19 +++--
 tests/Unit/ApexThemeTest.php   | 138 +++++++++++++++++++++++++++++++++
 tests/bootstrap-unit.php       |   6 ++
 3 files changed, 157 insertions(+), 6 deletions(-)
 create mode 100644 tests/Unit/ApexThemeTest.php

diff --git a/includes/slowlog_functions.php b/includes/slowlog_functions.php
index ba21241..3afa621 100644
--- a/includes/slowlog_functions.php
+++ b/includes/slowlog_functions.php
@@ -3103,7 +3103,7 @@ function slowlog_get_chart_scope_items(string $chart_type, int $id): array {
  * selected, instead of a single hard-coded palette.
  *
  * Mirrors Cacti core's own rrdtheme loading (lib/rrd.php): the selected theme is
- * validated against the themes allowlist, its rrdtheme.php is included for the
+ * validated against the themes allowlist, its rrdtheme.php is required for the
  * canonical font/grid colors, and the CactiColorMode cookie's dark/light
  * variants are honored when a theme defines them. The light/dark ApexCharts mode
  * is derived from the luminance of the theme's own font color, so every current
@@ -3124,11 +3124,18 @@ function slowlog_apex_theme(): array {
 	$theme = get_selected_theme();
 	$theme = function_exists('cacti_validate_theme') ? cacti_validate_theme($theme) : basename($theme);
 
-	$rrdcolors = [];
-	$themefile = $config['base_path'] . '/include/themes/' . $theme . '/rrdtheme.php';
-
-	if (is_readable($themefile)) {
-		include($themefile);
+	$rrdcolors   = [];
+	$themes_base = $config['base_path'] . '/include/themes';
+	$themefile   = $themes_base . '/' . $theme . '/rrdtheme.php';
+
+	// cacti_validate_theme() already allowlists the name, but confine the resolved
+	// path to the themes directory as defense-in-depth so a poisoned theme can
+	// never steer this require() outside the tree (CVE-class path traversal). Fail
+	// fast with require() once the file is confirmed readable and contained.
+	if (strpos($themefile, "\0") === false
+		&& is_readable($themefile)
+		&& (!function_exists('cacti_path_is_within') || cacti_path_is_within($themefile, $themes_base))) {
+		require($themefile);
 
 		// Themes such as midwinter ship dark/light variants selected by the same
 		// CactiColorMode cookie core keys off of; prefer the matching variant.
diff --git a/tests/Unit/ApexThemeTest.php b/tests/Unit/ApexThemeTest.php
new file mode 100644
index 0000000..c8f5659
--- /dev/null
+++ b/tests/Unit/ApexThemeTest.php
@@ -0,0 +1,138 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDTool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * slowlog_apex_theme()/slowlog_normalize_hex_color() drive the per-theme ApexCharts
+ * skinning for the By Method/By Table charts and the import upload donut. They read the
+ * active Cacti theme's include/themes/<theme>/rrdtheme.php, so these tests sandbox
+ * $config['base_path'] to a temporary themes tree to exercise the require, the
+ * CactiColorMode variant selection, the luminance-based light/dark mode, the path
+ * containment fallback, and the color normalization branches without a real Cacti tree.
+ */
+
+uses(TestCase::class);
+
+beforeEach(function () {
+	TestCase::loadPluginSource('includes/slowlog_functions.php');
+
+	$this->orig_base = $GLOBALS['config']['base_path'];
+	$this->sandbox   = sys_get_temp_dir() . '/slowlog_theme_' . bin2hex(random_bytes(4));
+
+	$themes = $this->sandbox . '/include/themes';
+
+	foreach (array('lightx', 'darkx', 'alphax', 'variantx') as $theme) {
+		mkdir($themes . '/' . $theme, 0777, true);
+	}
+
+	file_put_contents($themes . '/lightx/rrdtheme.php', "<?php\n\$rrdcolors['font'] = '000000';\n\$rrdcolors['grid'] = 'cccccc';\n");
+	file_put_contents($themes . '/darkx/rrdtheme.php', "<?php\n\$rrdcolors['font'] = 'FFFFFF';\n\$rrdcolors['grid'] = '545454';\n");
+	file_put_contents($themes . '/alphax/rrdtheme.php', "<?php\n\$rrdcolors['font'] = 'FFFFffaa';\n\$rrdcolors['grid'] = '21212400';\n");
+	file_put_contents($themes . '/variantx/rrdtheme.php', "<?php\n\$rrdcolors['font'] = '000000';\n\$rrdcolors_dark['font'] = 'FFFFFF';\n\$rrdcolors_light['font'] = '000000';\n");
+
+	$GLOBALS['config']['base_path'] = $this->sandbox;
+});
+
+afterEach(function () {
+	$GLOBALS['config']['base_path'] = $this->orig_base;
+
+	unset($GLOBALS['__test_selected_theme']);
+	unset($_COOKIE['CactiColorMode']);
+
+	$themes = $this->sandbox . '/include/themes';
+
+	foreach (array('lightx', 'darkx', 'alphax', 'variantx') as $theme) {
+		@unlink($themes . '/' . $theme . '/rrdtheme.php');
+		@rmdir($themes . '/' . $theme);
+	}
+
+	@rmdir($themes);
+	@rmdir($this->sandbox . '/include');
+	@rmdir($this->sandbox);
+});
+
+it('expands 3-digit, keeps 6-digit and truncates alpha-suffixed colors', function () {
+	expect(slowlog_normalize_hex_color('abc', '000000'))->toBe('aabbcc');
+	expect(slowlog_normalize_hex_color('FFFFFF', '000000'))->toBe('ffffff');
+	expect(slowlog_normalize_hex_color('FFFFffaa', '000000'))->toBe('ffffff');
+	expect(slowlog_normalize_hex_color('21212400', '000000'))->toBe('212124');
+});
+
+it('falls back when a color has no usable hex', function () {
+	// Empty, a too-short remainder, and a value that strips to nothing all fall back.
+	expect(slowlog_normalize_hex_color('', 'cccccc'))->toBe('cccccc');
+	expect(slowlog_normalize_hex_color('zz', 'abcdef'))->toBe('abcdef');
+	expect(slowlog_normalize_hex_color('xx!!', '123456'))->toBe('123456');
+});
+
+it('resolves a light theme to light mode with its font/grid colors', function () {
+	$GLOBALS['__test_selected_theme'] = 'lightx';
+
+	$apex = slowlog_apex_theme();
+
+	expect($apex['mode'])->toBe('light');
+	expect($apex['foreColor'])->toBe('#000000');
+	expect($apex['gridColor'])->toBe('#cccccc');
+});
+
+it('resolves a dark theme to dark mode from its light font luminance', function () {
+	$GLOBALS['__test_selected_theme'] = 'darkx';
+
+	$apex = slowlog_apex_theme();
+
+	expect($apex['mode'])->toBe('dark');
+	expect($apex['foreColor'])->toBe('#ffffff');
+	expect($apex['gridColor'])->toBe('#545454');
+});
+
+it('strips RRDtool alpha suffixes from the resolved theme colors', function () {
+	$GLOBALS['__test_selected_theme'] = 'alphax';
+
+	$apex = slowlog_apex_theme();
+
+	expect($apex['foreColor'])->toBe('#ffffff');
+	expect($apex['gridColor'])->toBe('#212124');
+	expect($apex['mode'])->toBe('dark');
+});
+
+it('prefers the CactiColorMode dark variant when a theme defines one', function () {
+	$GLOBALS['__test_selected_theme'] = 'variantx';
+	$_COOKIE['CactiColorMode']        = 'dark';
+
+	$apex = slowlog_apex_theme();
+
+	expect($apex['mode'])->toBe('dark');
+	expect($apex['foreColor'])->toBe('#ffffff');
+});
+
+it('uses the light variant when CactiColorMode selects light', function () {
+	$GLOBALS['__test_selected_theme'] = 'variantx';
+	$_COOKIE['CactiColorMode']        = 'light';
+
+	$apex = slowlog_apex_theme();
+
+	expect($apex['mode'])->toBe('light');
+	expect($apex['foreColor'])->toBe('#000000');
+});
+
+it('falls back to default colors when the theme file is missing', function () {
+	$GLOBALS['__test_selected_theme'] = 'does_not_exist';
+
+	$apex = slowlog_apex_theme();
+
+	expect($apex['mode'])->toBe('light');
+	expect($apex['foreColor'])->toBe('#000000');
+	expect($apex['gridColor'])->toBe('#cccccc');
+});
diff --git a/tests/bootstrap-unit.php b/tests/bootstrap-unit.php
index b49e838..73a0db4 100644
--- a/tests/bootstrap-unit.php
+++ b/tests/bootstrap-unit.php
@@ -351,6 +351,12 @@ function is_realm_allowed($realm) {
 	}
 }
 
+if (!function_exists('get_selected_theme')) {
+	function get_selected_theme() {
+		return isset($GLOBALS['__test_selected_theme']) ? $GLOBALS['__test_selected_theme'] : 'modern';
+	}
+}
+
 if (!function_exists('raise_message')) {
 	function raise_message($id, $text = '', $level = 0) {
 	}

From 70de16bf386ec33163b3150398872143b9783455 Mon Sep 17 00:00:00 2001
From: TheWitness <thewitness@cacti.net>
Date: Thu, 8 Oct 2026 17:06:38 -0400
Subject: [PATCH 3/3] Rename includes/slowlog_functions.php to
 includes/functions.php

Match the Cacti plugin naming convention. Updates the require in slowlog.php/import_log.php, the Pest coverage <source> list in phpunit.xml, every TestCase::loadPluginSource()/source-scan reference across the test suite, and the .github/copilot-instructions.md tree. Adds an includes/slowlog_functions.php tombstone to manifest.json so slowlog_prune_files() removes the old file from existing installs on upgrade (subdirectory tombstones are supported - the prune joins the relative path under the plugin dir and realpath-confines it).
---
 .github/copilot-instructions.md                    |  4 ++--
 CHANGELOG.md                                       |  1 +
 import_log.php                                     |  2 +-
 includes/{slowlog_functions.php => functions.php}  |  0
 manifest.json                                      |  1 +
 phpunit.xml                                        |  2 +-
 slowlog.php                                        |  2 +-
 tests/Integration/ComputeStatsTest.php             |  2 +-
 tests/Integration/ImportLogfileParsingTest.php     |  2 +-
 tests/Integration/ImportLogfileReadErrorTest.php   |  2 +-
 tests/Integration/ImportPostProcessMethodsTest.php |  2 +-
 tests/Integration/ReprocessTest.php                |  2 +-
 tests/Security/OutputEscapingTest.php              |  4 ++--
 tests/Security/PreparedStatementUsageTest.php      | 10 +++++-----
 tests/Security/RawBulkInsertEscapingTest.php       |  2 +-
 tests/Security/RedirectSafetyTest.php              |  2 +-
 tests/Unit/ApexThemeTest.php                       |  2 +-
 tests/Unit/BackgroundImportCommandTest.php         |  2 +-
 tests/Unit/ChartDataTest.php                       |  4 ++--
 tests/Unit/ImportPostProcessZeroRowsTest.php       |  2 +-
 tests/Unit/LayoutWrapperTest.php                   |  2 +-
 tests/Unit/OtherTablesClassificationTest.php       |  2 +-
 tests/Unit/ParseTableTest.php                      |  2 +-
 tests/Unit/PercentileMathTest.php                  |  2 +-
 tests/Unit/ReservedWordTest.php                    |  2 +-
 tests/Unit/SlowlogClearGlyphTest.php               |  4 ++--
 tests/Unit/SlowlogRemoveTest.php                   |  2 +-
 tests/Unit/StripDomainTest.php                     |  2 +-
 tests/Unit/TableAssociationTokenizerTest.php       |  2 +-
 tests/Unit/TableDictionaryTest.php                 |  4 ++--
 tests/Unit/TableModeDispatchTest.php               |  4 ++--
 tests/Unit/TimeoutExtractionTest.php               |  2 +-
 tests/Unit/UploadEnvironmentStatusTest.php         |  2 +-
 tests/bin/patch-coverage.php                       |  2 +-
 34 files changed, 43 insertions(+), 41 deletions(-)
 rename includes/{slowlog_functions.php => functions.php} (100%)

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 0033eb3..d2150fc 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -29,7 +29,7 @@ slowlog/                      # Repository root (install to plugins/slowlog/ in
 ├── images/                   # UI icons
 ├── includes/                 # Library/helper files, require_once'd from the entry points
 │   ├── database.php          # Schema management: table defs + create/upgrade/drop helpers
-│   └── slowlog_functions.php # Log parsing, import, and charting logic
+│   └── functions.php         # Log parsing, import, and charting logic
 ├── js/                       # Chart rendering client-side code
 ├── locales/                  # Internationalization files
 ├── tests/                    # Test suite
@@ -207,7 +207,7 @@ existing code or adding new code, not just in dedicated cleanup passes:
   label.
 - **File inclusion uses `require`/`require_once`.** Always use `require`/`require_once` (never
   `include`/`include_once`) so a missing dependency fails fast and loudly. Keep library/helper files
-  (e.g. `slowlog_functions.php`, `includes/database.php`) under `includes/` and reference them from
+  (e.g. `functions.php`, `includes/database.php`) under `includes/` and reference them from
   that path; entry points (`slowlog.php`, `import_log.php`, `setup.php`) stay in the plugin root.
 - **Plugin schema management.** Keep every schema function (table definitions, create, upgrade,
   drop) in `includes/database.php` (the thold model), included from `setup.php`'s install/upgrade
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f90b782..664cd95 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@
 * refactor: De-normalize the per-query method classification - `plugin_slowlog_details_methods` now stores the method name directly in a `method` varchar column instead of a `methodid` foreign key into `plugin_slowlog_methods`, and the classifier fragment dictionary moved into a PHP constant (`SLOWLOG_METHOD_FRAGMENTS`). The stats, By Method chart, details list, method filter dropdown, and chart-scope queries no longer join `plugin_slowlog_methods`, removing a join from every one of those read paths. The now-unused `plugin_slowlog_methods` dictionary table is left in place (a clean install drops it)
 * bug: Migrate an existing `plugin_slowlog_details_methods` table in place during upgrade - `api_plugin_db_table_create()` never retrofits a table that already exists, so on an existing install the de-normalization above would otherwise leave the old `methodid` column (and no `method` column), breaking every import/detail/stat/chart query with an unknown-column error. `slowlog_check_upgrade()` now runs an idempotent `slowlog_migrate_details_methods_to_method()` that adds the `method` column, backfills the names from the `plugin_slowlog_methods` dictionary, then swaps the primary key to `(logid, logentry, method)` and drops `methodid`. It runs on every page (self-gating on the `methodid` column) because this schema change ships without a version bump, so the version-drift upgrade branch would never fire for it
 * refactor: Move the slowlog_functions.php library file into includes/ and switch every file inclusion from include/include_once to require/require_once for fail-fast consistency (references updated across setup.php, slowlog.php, import_log.php, and the test suite)
+* refactor: Rename includes/slowlog_functions.php to includes/functions.php to match the Cacti plugin naming convention; every require/loadPluginSource reference and the Pest coverage source list were updated, and a manifest.json tombstone (includes/slowlog_functions.php) prunes the old filename from existing installs on upgrade
 * refactor: Move all schema management (table definitions, create, upgrade, and drop helpers) into includes/database.php (the thold model) with the Cacti copyright header; setup.php's install/uninstall/upgrade paths now require that file and delegate to it, keeping the api_plugin_db_table_create() create path and the db_update_table() upgrade refresh unchanged
 * dev: Enforce patch coverage of changed lines in CI and remove the inert COMPOSER_ROOT_VERSION env from the Pest step
 * bug: Fix the By Method/By Table chart scope filter rendering two overlapping widgets (a select2 multi-select and the jQuery multiselect) with an overlapping search box - `slowlog_charts_filter()` unconditionally applied `.multiselect()` to `#chart_scope` while Cacti core independently turned the same plain `<select>` into a select2. The control now carries the `select2-multi-count` class and prefers select2 when it is loaded (binding `select2:close` to re-apply the filter), only falling back to the jquery-multiselect widget when select2 is unavailable; its empty-selection state preserves the original `Select Method`/`Select Table` prompt rather than an inaccurate `All Selected`
diff --git a/import_log.php b/import_log.php
index 1d995b7..fe341f4 100644
--- a/import_log.php
+++ b/import_log.php
@@ -23,7 +23,7 @@
 */
 
 require(__DIR__ . '/../../include/cli_check.php');
-require(__DIR__ . '/includes/slowlog_functions.php');
+require(__DIR__ . '/includes/functions.php');
 
 // process calling arguments
 $parms = $_SERVER['argv'];
diff --git a/includes/slowlog_functions.php b/includes/functions.php
similarity index 100%
rename from includes/slowlog_functions.php
rename to includes/functions.php
diff --git a/manifest.json b/manifest.json
index 462bd23..f68de3f 100644
--- a/manifest.json
+++ b/manifest.json
@@ -1,5 +1,6 @@
 {
     "tombstones": [
+        "includes/slowlog_functions.php",
         "keywords.txt",
         "themes/"
     ],
diff --git a/phpunit.xml b/phpunit.xml
index 9087b7a..2f1c58c 100644
--- a/phpunit.xml
+++ b/phpunit.xml
@@ -29,7 +29,7 @@
         <include>
             <file>setup.php</file>
             <file>includes/database.php</file>
-            <file>includes/slowlog_functions.php</file>
+            <file>includes/functions.php</file>
         </include>
     </source>
 </phpunit>
diff --git a/slowlog.php b/slowlog.php
index fb48074..615fc9a 100644
--- a/slowlog.php
+++ b/slowlog.php
@@ -27,7 +27,7 @@
 require_once('./lib/utility.php');
 require_once('./lib/poller.php');
 require_once('./lib/timespan_settings.php');
-require_once('./plugins/slowlog/includes/slowlog_functions.php');
+require_once('./plugins/slowlog/includes/functions.php');
 
 ini_set('max_execution_time', '0');
 ini_set('memory_limit', '-1');
diff --git a/tests/Integration/ComputeStatsTest.php b/tests/Integration/ComputeStatsTest.php
index fb37344..415b5f9 100644
--- a/tests/Integration/ComputeStatsTest.php
+++ b/tests/Integration/ComputeStatsTest.php
@@ -56,7 +56,7 @@ function slowlog_test_stats_insert_tuples(): array {
 }
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 
 	slowlog_test_mock_db('db_fetch_assoc_prepared', 'plugin_slowlog_details_methods', array(
 		array('id' => 1, 'scope_key' => 'SELECTS', 'query_time' => 10, 'rows_sent' => 1, 'rows_examined' => 100, 'rows_affected' => 0, 'bytes_sent' => 500),
diff --git a/tests/Integration/ImportLogfileParsingTest.php b/tests/Integration/ImportLogfileParsingTest.php
index 45bea73..74de84a 100644
--- a/tests/Integration/ImportLogfileParsingTest.php
+++ b/tests/Integration/ImportLogfileParsingTest.php
@@ -43,7 +43,7 @@ function slowlog_test_details_insert_sql(array $calls): string {
 }
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 
 	// Avoids the log-with-zero-rows $start warning path; not what this test covers.
 	slowlog_test_mock_db('db_fetch_cell_prepared', 'COUNT(*)', 2);
diff --git a/tests/Integration/ImportLogfileReadErrorTest.php b/tests/Integration/ImportLogfileReadErrorTest.php
index ea1ccd7..7373edf 100644
--- a/tests/Integration/ImportLogfileReadErrorTest.php
+++ b/tests/Integration/ImportLogfileReadErrorTest.php
@@ -64,7 +64,7 @@ public function stream_close() {
 }
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 
 	if (in_array('slowlogfail', stream_get_wrappers(), true)) {
 		stream_wrapper_unregister('slowlogfail');
diff --git a/tests/Integration/ImportPostProcessMethodsTest.php b/tests/Integration/ImportPostProcessMethodsTest.php
index 6d5431f..19244e4 100644
--- a/tests/Integration/ImportPostProcessMethodsTest.php
+++ b/tests/Integration/ImportPostProcessMethodsTest.php
@@ -78,7 +78,7 @@ function slowlog_test_stats_insert_tuples(): array {
 }
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 
 	slowlog_test_mock_db('db_fetch_cell_prepared', 'COUNT(*)', 3);
 });
diff --git a/tests/Integration/ReprocessTest.php b/tests/Integration/ReprocessTest.php
index 21cc5b2..28e9636 100644
--- a/tests/Integration/ReprocessTest.php
+++ b/tests/Integration/ReprocessTest.php
@@ -38,7 +38,7 @@ function slowlog_test_calls_matching(array $calls, string $needle): array {
 }
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 
 	// No plugin_slowlog_details rows fixture needed - this just verifies the cleanup/dispatch.
 	slowlog_test_mock_db('db_fetch_cell_prepared', 'COUNT(*)', 0);
diff --git a/tests/Security/OutputEscapingTest.php b/tests/Security/OutputEscapingTest.php
index 521dc5f..abc37a8 100644
--- a/tests/Security/OutputEscapingTest.php
+++ b/tests/Security/OutputEscapingTest.php
@@ -23,7 +23,7 @@
 	it('does not interpolate raw variables into HTML attributes', function () {
 		$uiFiles = array(
 			'slowlog.php',
-			'includes/slowlog_functions.php',
+			'includes/functions.php',
 		);
 
 		foreach ($uiFiles as $relativeFile) {
@@ -78,7 +78,7 @@
 	it('uses html_escape or __esc for user-controlled output', function () {
 		$uiFiles = array(
 			'slowlog.php',
-			'includes/slowlog_functions.php',
+			'includes/functions.php',
 		);
 
 		$totalEscapeCalls = 0;
diff --git a/tests/Security/PreparedStatementUsageTest.php b/tests/Security/PreparedStatementUsageTest.php
index 0a1fbe6..1950542 100644
--- a/tests/Security/PreparedStatementUsageTest.php
+++ b/tests/Security/PreparedStatementUsageTest.php
@@ -22,9 +22,9 @@
 describe('prepared statement usage in slowlog', function () {
 	$setup    = file_get_contents(realpath(__DIR__ . '/../../setup.php'));
 	$slowlog  = file_get_contents(realpath(__DIR__ . '/../../slowlog.php'));
-	$helpers  = file_get_contents(realpath(__DIR__ . '/../../includes/slowlog_functions.php'));
+	$helpers  = file_get_contents(realpath(__DIR__ . '/../../includes/functions.php'));
 
-	it('reads setup.php, slowlog.php, and slowlog_functions.php', function () use ($setup, $slowlog, $helpers) {
+	it('reads setup.php, slowlog.php, and functions.php', function () use ($setup, $slowlog, $helpers) {
 		expect($setup)->not->toBeFalse();
 		expect($slowlog)->not->toBeFalse();
 		expect($helpers)->not->toBeFalse();
@@ -50,15 +50,15 @@
 		expect(preg_match_all('/\bdb_fetch_assoc_prepared\s*\(/', $slowlog))->toBeGreaterThanOrEqual(5);
 	});
 
-	it('removed raw table insert interpolation in slowlog_functions.php', function () use ($helpers) {
+	it('removed raw table insert interpolation in functions.php', function () use ($helpers) {
 		expect($helpers)->not->toContain("VALUES (\$logid, '\$t')");
 	});
 
-	it('removed raw details table interpolation in slowlog_functions.php', function () use ($helpers) {
+	it('removed raw details table interpolation in functions.php', function () use ($helpers) {
 		expect($helpers)->not->toContain('WHERE logid=$logid');
 	});
 
-	it('parameterizes methodid insert values in slowlog_functions.php', function () use ($helpers) {
+	it('parameterizes methodid insert values in functions.php', function () use ($helpers) {
 		expect($helpers)->not->toContain("SELECT '\$logid' AS logid, logentry");
 	});
 
diff --git a/tests/Security/RawBulkInsertEscapingTest.php b/tests/Security/RawBulkInsertEscapingTest.php
index 2c694f4..e0770a1 100644
--- a/tests/Security/RawBulkInsertEscapingTest.php
+++ b/tests/Security/RawBulkInsertEscapingTest.php
@@ -31,7 +31,7 @@
 uses(TestCase::class);
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 
 	slowlog_test_mock_db('db_fetch_cell_prepared', 'COUNT(*)', 1);
 
diff --git a/tests/Security/RedirectSafetyTest.php b/tests/Security/RedirectSafetyTest.php
index 6988992..e10b167 100644
--- a/tests/Security/RedirectSafetyTest.php
+++ b/tests/Security/RedirectSafetyTest.php
@@ -24,7 +24,7 @@
 		$files = array(
 			'setup.php',
 			'slowlog.php',
-			'includes/slowlog_functions.php',
+			'includes/functions.php',
 		);
 
 		foreach ($files as $relativeFile) {
diff --git a/tests/Unit/ApexThemeTest.php b/tests/Unit/ApexThemeTest.php
index c8f5659..84a5148 100644
--- a/tests/Unit/ApexThemeTest.php
+++ b/tests/Unit/ApexThemeTest.php
@@ -26,7 +26,7 @@
 uses(TestCase::class);
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 
 	$this->orig_base = $GLOBALS['config']['base_path'];
 	$this->sandbox   = sys_get_temp_dir() . '/slowlog_theme_' . bin2hex(random_bytes(4));
diff --git a/tests/Unit/BackgroundImportCommandTest.php b/tests/Unit/BackgroundImportCommandTest.php
index 63a5c67..990f2f3 100644
--- a/tests/Unit/BackgroundImportCommandTest.php
+++ b/tests/Unit/BackgroundImportCommandTest.php
@@ -30,7 +30,7 @@
 uses(TestCase::class);
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 
 	$this->logfile = tempnam(sys_get_temp_dir(), 'slowlog_test_');
 
diff --git a/tests/Unit/ChartDataTest.php b/tests/Unit/ChartDataTest.php
index 89287f6..2ffcd3f 100644
--- a/tests/Unit/ChartDataTest.php
+++ b/tests/Unit/ChartDataTest.php
@@ -16,7 +16,7 @@
 
 /*
  * slowlog_chart_measures()/slowlog_get_chart_object()/slowlog_get_stats_chart_object() back
- * the By Method/By Table chart pages. They live in slowlog_functions.php (not slowlog.php)
+ * the By Method/By Table chart pages. They live in functions.php (not slowlog.php)
  * specifically so they're safe to require_once in isolation for testing - slowlog.php itself
  * has top-level dispatch code (chdir(), include('./include/auth.php'), a switch on
  * get_request_var('action')) that only runs inside a real Cacti request.
@@ -25,7 +25,7 @@
 uses(TestCase::class);
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 
 	slowlog_test_mock_db('db_fetch_cell_prepared', 'SELECT description', 'My Log');
 });
diff --git a/tests/Unit/ImportPostProcessZeroRowsTest.php b/tests/Unit/ImportPostProcessZeroRowsTest.php
index 8910aa6..4821fd0 100644
--- a/tests/Unit/ImportPostProcessZeroRowsTest.php
+++ b/tests/Unit/ImportPostProcessZeroRowsTest.php
@@ -31,7 +31,7 @@
 uses(TestCase::class);
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 
 	slowlog_test_mock_db('db_fetch_cell_prepared', 'COUNT(*)', 0);
 });
diff --git a/tests/Unit/LayoutWrapperTest.php b/tests/Unit/LayoutWrapperTest.php
index 37d054e..d0d66d2 100644
--- a/tests/Unit/LayoutWrapperTest.php
+++ b/tests/Unit/LayoutWrapperTest.php
@@ -40,7 +40,7 @@ function slowlog_test_renderer() {
 }
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 	$GLOBALS['slowlog_events'] = array();
 });
 
diff --git a/tests/Unit/OtherTablesClassificationTest.php b/tests/Unit/OtherTablesClassificationTest.php
index 7e4a521..37b88a6 100644
--- a/tests/Unit/OtherTablesClassificationTest.php
+++ b/tests/Unit/OtherTablesClassificationTest.php
@@ -49,7 +49,7 @@ function slowlog_test_method_tuples(): array {
 }
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 });
 
 it('tags a logentry that touches a non-Cacti table', function () {
diff --git a/tests/Unit/ParseTableTest.php b/tests/Unit/ParseTableTest.php
index 0e57f30..e6b372f 100644
--- a/tests/Unit/ParseTableTest.php
+++ b/tests/Unit/ParseTableTest.php
@@ -22,7 +22,7 @@
 uses(TestCase::class);
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 });
 
 it('normalizes a bare table name', function () {
diff --git a/tests/Unit/PercentileMathTest.php b/tests/Unit/PercentileMathTest.php
index 10b2a14..41cec1f 100644
--- a/tests/Unit/PercentileMathTest.php
+++ b/tests/Unit/PercentileMathTest.php
@@ -24,7 +24,7 @@
 uses(TestCase::class);
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 });
 
 it('computes the median of an even-length array as the average of the two middle values', function () {
diff --git a/tests/Unit/ReservedWordTest.php b/tests/Unit/ReservedWordTest.php
index c99a72b..68daf2b 100644
--- a/tests/Unit/ReservedWordTest.php
+++ b/tests/Unit/ReservedWordTest.php
@@ -28,7 +28,7 @@
 uses(TestCase::class);
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 
 	$GLOBALS['reserved_words'] = array(
 		'SELECT' => 'SELECT',
diff --git a/tests/Unit/SlowlogClearGlyphTest.php b/tests/Unit/SlowlogClearGlyphTest.php
index 223c6e2..fc6a5b0 100644
--- a/tests/Unit/SlowlogClearGlyphTest.php
+++ b/tests/Unit/SlowlogClearGlyphTest.php
@@ -7,7 +7,7 @@
 
 /*
  * Unit coverage for slowlog_details_filter_clear_glyph() in
- * includes/slowlog_functions.php. The clear-filter glyph uses a CSP-safe
+ * includes/functions.php. The clear-filter glyph uses a CSP-safe
  * slowlogClearFilter class and data-url attribute (bound via a delegated
  * handler) instead of an inline onclick.
  */
@@ -15,7 +15,7 @@
 uses(TestCase::class);
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 });
 
 it('renders the clear-filter glyph with CSP-safe markup and no inline handler', function () {
diff --git a/tests/Unit/SlowlogRemoveTest.php b/tests/Unit/SlowlogRemoveTest.php
index db7b207..e4ac475 100644
--- a/tests/Unit/SlowlogRemoveTest.php
+++ b/tests/Unit/SlowlogRemoveTest.php
@@ -23,7 +23,7 @@
 uses(TestCase::class);
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 });
 
 it('deletes from every per-logid table, including the stats cache', function () {
diff --git a/tests/Unit/StripDomainTest.php b/tests/Unit/StripDomainTest.php
index 8fcdb56..2e46546 100644
--- a/tests/Unit/StripDomainTest.php
+++ b/tests/Unit/StripDomainTest.php
@@ -22,7 +22,7 @@
 uses(TestCase::class);
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 });
 
 it('keeps a bare hostname unchanged', function () {
diff --git a/tests/Unit/TableAssociationTokenizerTest.php b/tests/Unit/TableAssociationTokenizerTest.php
index d7ebd98..868e3c9 100644
--- a/tests/Unit/TableAssociationTokenizerTest.php
+++ b/tests/Unit/TableAssociationTokenizerTest.php
@@ -65,7 +65,7 @@ function slowlog_test_run_tokenizer(string $query): array {
 }
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 });
 
 it('finds the table in a simple SELECT ... FROM', function () {
diff --git a/tests/Unit/TableDictionaryTest.php b/tests/Unit/TableDictionaryTest.php
index 9adfd1d..0560ead 100644
--- a/tests/Unit/TableDictionaryTest.php
+++ b/tests/Unit/TableDictionaryTest.php
@@ -36,7 +36,7 @@ function slowlog_test_dictionary_calls(): array {
 }
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 
 	slowlog_test_mock_db('db_fetch_assoc_prepared', 'FROM plugin_slowlog_details_tables', array(
 		array('table_name' => 'host'),
@@ -79,7 +79,7 @@ function slowlog_test_dictionary_calls(): array {
 });
 
 it('is invoked as part of the normal post-processing pipeline', function () {
-	$source = file_get_contents(realpath(__DIR__ . '/../../includes/slowlog_functions.php'));
+	$source = file_get_contents(realpath(__DIR__ . '/../../includes/functions.php'));
 
 	expect($source)->toContain('slowlog_sync_table_dictionary($logid, $known_tables);');
 });
diff --git a/tests/Unit/TableModeDispatchTest.php b/tests/Unit/TableModeDispatchTest.php
index 80cac5a..c5509b8 100644
--- a/tests/Unit/TableModeDispatchTest.php
+++ b/tests/Unit/TableModeDispatchTest.php
@@ -54,7 +54,7 @@ function slowlog_test_other_tables_call_count(): int {
 }
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 
 	slowlog_test_mock_db('db_fetch_cell_prepared', 'COUNT(*)', 1);
 	slowlog_test_mock_db('db_fetch_cell_prepared', "WHERE method = 'OTHER TABLES'", 22);
@@ -147,7 +147,7 @@ function slowlog_test_other_tables_call_count(): int {
 });
 
 it('forwards the reference/list table names to the background worker', function () {
-	$source = file_get_contents(realpath(__DIR__ . '/../../includes/slowlog_functions.php'));
+	$source = file_get_contents(realpath(__DIR__ . '/../../includes/functions.php'));
 
 	expect($source)->toContain("\$cmd .= trim(\$table_names) !== '' ? ' --table-names=' . cacti_escapeshellarg(trim(\$table_names)) : '';");
 });
diff --git a/tests/Unit/TimeoutExtractionTest.php b/tests/Unit/TimeoutExtractionTest.php
index 6148bbe..6ddf7d9 100644
--- a/tests/Unit/TimeoutExtractionTest.php
+++ b/tests/Unit/TimeoutExtractionTest.php
@@ -28,7 +28,7 @@
 uses(TestCase::class);
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 });
 
 it('converts a MAX_EXECUTION_TIME hint from milliseconds to seconds', function () {
diff --git a/tests/Unit/UploadEnvironmentStatusTest.php b/tests/Unit/UploadEnvironmentStatusTest.php
index eee170d..29c0d2f 100644
--- a/tests/Unit/UploadEnvironmentStatusTest.php
+++ b/tests/Unit/UploadEnvironmentStatusTest.php
@@ -31,7 +31,7 @@ function slowlog_test_warnings_matching(array $warnings, string $needle): array
 }
 
 beforeEach(function () {
-	TestCase::loadPluginSource('includes/slowlog_functions.php');
+	TestCase::loadPluginSource('includes/functions.php');
 });
 
 afterEach(function () {
diff --git a/tests/bin/patch-coverage.php b/tests/bin/patch-coverage.php
index 2b77384..7d2220b 100644
--- a/tests/bin/patch-coverage.php
+++ b/tests/bin/patch-coverage.php
@@ -163,7 +163,7 @@ function changed_lines($base_ref) {
 	// Web UI / CLI entry points: slowlog.php chdir + require include/auth.php and
 	// import_log.php require include/cli_check.php, then dispatch on request/CLI
 	// args, so neither can be loaded into the isolated unit process. Their logic
-	// lives in the measured includes/slowlog_functions.php.
+	// lives in the measured includes/functions.php.
 	'slowlog.php',
 	'import_log.php',
 ];