wordmove-ng 6.0.2 → 6.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6b938b4ef6d1ed30ecf48f1cbe1d48ba2f1a2ef223247189a3da3a0c1b840238
-  data.tar.gz: a3ffcdb129f255a82a7257f7d50a9d7c8b56195fd7e8a169ff04cceed8216281
+  metadata.gz: dd4eb4e95fb86d7ce9727f7483018c1a8b11dfb05ea5bdaace45bbde8a3b7122
+  data.tar.gz: 88ff0153cf9147f4876dade9e035a8207a3396e06350dea1e51ad4e0c946fcbf
 SHA512:
-  metadata.gz: 7d8d9baa3cecea48ac16a2853c927695eb1ad865bc0df9efc01f5ba6d034e96afab4322eeae3da3b9a605584a5fe44ed4ff58c3995daea9d4b9f08de616720ac
-  data.tar.gz: 211ca5b52895d6fef092985a0bec08cd7bad97845c6579187699856e1d79339d510da596a60247bc3aa4296b1bdb7e85859cebbeda51a853b36335bdb86723b0
+  metadata.gz: 21e75d8a0f362a0ad35610b544756d0324d7ac519a1a9bea065cb4549c971087ebd67928d78615522ecf9950f067ebea7f7aeddde085f692cacd4effe8f66a30
+  data.tar.gz: f99871ec8da25f7201894496dbe1d164b820e351f437f86f21c1623d68a95d9f61fcf3f0a7f498e22e15f03b69cdc6b9626f49624dee0b9ad8ec5c34552e5f98

data/.github/workflows/release.yml

@@ -2,12 +2,12 @@
 #
 # 1. release-please watches master. From Conventional Commits it opens (and keeps
 #    updating) a "release PR" that bumps lib/wordmove/version.rb and CHANGELOG.md.
-#    Merging that PR creates the vX.Y.Z tag and the GitHub release.
-# 2. The publish job then builds the gem and pushes it to rubygems.org with
-#    trusted publishing (OIDC, no API key) and attaches the .gem to the release.
-#
-# The publish job also runs when a v* tag is pushed by hand, which is how the
-# very first release (v6.0.0) is cut.
+#    Merging that PR creates the vX.Y.Z tag and the GitHub release, using the
+#    RELEASE_PLEASE_TOKEN PAT so that the tag push triggers this workflow again.
+# 2. That tag push runs the publish job, which builds the gem, pushes it to
+#    rubygems.org with trusted publishing (OIDC, no API key) and attaches the
+#    .gem to the release. A v* tag pushed by hand at the head of master goes
+#    through the same job.
 #
 # One-time setup (see README "Releasing"):
 #   - rubygems.org: pending trusted publisher for gem wordmove-ng, repository
@@ -36,9 +36,6 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    outputs:
-      release_created: ${{ steps.release.outputs.release_created }}
-      tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
       # A fine-grained PAT (secret RELEASE_PLEASE_TOKEN, contents + pull-requests
       # read/write) instead of the built-in token: PRs opened with the built-in
@@ -52,14 +49,10 @@ jobs:
           manifest-file: .release-please-manifest.json
 
   publish:
-    needs: [release-please]
-    # Runs after release-please created a release, or on a manually pushed tag.
-    # The `always()` is needed because release-please is skipped on tag pushes.
-    if: >-
-      always() && (
-        needs.release-please.outputs.release_created == 'true' ||
-        startsWith(github.ref, 'refs/tags/v')
-      )
+    # Only on tag pushes. release-please's tag (created with the PAT) triggers
+    # this workflow like any other push, so publishing from the master run as
+    # well would race it and fail with "Tag vX.Y.Z has already been created".
+    if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     environment: release
     permissions:
@@ -80,7 +73,7 @@ jobs:
 
       - name: Verify the tag points at the head of master
         env:
-          TAG: ${{ needs.release-please.outputs.tag_name || github.ref_name }}
+          TAG: ${{ github.ref_name }}
         run: |
           git fetch --tags --force
           tag_commit="$(git rev-parse "refs/tags/$TAG^{commit}")"
@@ -104,7 +97,7 @@ jobs:
       - name: Attach the gem to the GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
-          TAG: ${{ needs.release-please.outputs.tag_name || github.ref_name }}
+          TAG: ${{ github.ref_name }}
         # release-please creates the release itself; a hand-pushed tag has none yet.
         run: |
           if ! gh release view "$TAG" >/dev/null 2>&1; then

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "6.0.2"
+  ".": "6.1.0"
 }

data/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to wordmove-ng are documented here. The project follows
 are listed at https://github.com/welaika/wordmove/releases; the kokiddp fork's changes
 between 5.2.2 and this project are summarised under 6.0.0.
 
+## [6.1.0](https://github.com/tekgnosis-net/wordmove-ng/compare/v6.0.3...v6.1.0) (2026-10-06)
+
+
+### Features
+
+* add the auto command that picks push or pull per component ([#9](https://github.com/tekgnosis-net/wordmove-ng/issues/9)) ([6733e70](https://github.com/tekgnosis-net/wordmove-ng/commit/6733e70c5e67b2628c6e8863fb1c6f85be714f13))
+
+## [6.0.3](https://github.com/tekgnosis-net/wordmove-ng/compare/v6.0.2...v6.0.3) (2026-09-30)
+
+
+### Documentation
+
+* expand the Ruby installation guide ([#7](https://github.com/tekgnosis-net/wordmove-ng/issues/7)) ([5972e2c](https://github.com/tekgnosis-net/wordmove-ng/commit/5972e2cf45f8ef6ebf1c2724b7637a8f4d319e11))
+
 ## [6.0.2](https://github.com/tekgnosis-net/wordmove-ng/compare/v6.0.1...v6.0.2) (2026-09-12)
 
 

data/CLAUDE.md

@@ -86,7 +86,13 @@ Key pieces:
 - **`Prerequisites`** (`lib/wordmove/prerequisites.rb`): one `sh` probe listing missing
   programs; `DB_SOURCE`/`DB_TARGET`/`REMOTE_ALL` requirement sets shared by deployer and
   doctor.
+- **`auto` command** (`lib/wordmove/auto_planner.rb` + `auto_command.rb`): per-component
+  direction from newest-mtime (directories) or latest post/comment (db) on both sides; core
+  never decided; plan-only unless `--apply`; exit 3 = pending moves. Specs stub `SshRunner`
+  and the planner's `local_shell`.
 - **Knobs**: `global.maintenance_mode` (env override `WORDMOVE_MAINTENANCE_MODE`),
+  `global.auto_window` / `global.auto_clock_skew_max` (`WORDMOVE_AUTO_WINDOW`,
+  `WORDMOVE_AUTO_CLOCK_SKEW_MAX`),
   `global.collation_fallbacks`, `global.charset_fallbacks`. Add new toggles as movefile keys
   with an env override and document them in README + CHANGELOG in the same commit.
 

data/README.md

@@ -35,7 +35,9 @@ in a few places where the old behaviour was unsafe. See [Upgrading from wordmove
 
 ## Installation
 
-Ruby 3.0 or newer is required.
+Ruby 3.0 or newer is required. If your system Ruby is older or missing, the docs walk
+through [installing Ruby](https://tekgnosis-net.github.io/wordmove-ng/installation/#ruby)
+with your package manager, rbenv, RVM, mise or Docker.
 
 ```bash
 gem install wordmove-ng
@@ -71,6 +73,10 @@ Component flags: `-w` core, `-u` uploads, `-t` themes, `-p` plugins, `-m` mu-plu
 `-l` languages, `-d` database, `--all` everything (`--all --no-uploads` to exclude one).
 `-s` simulates, `-e` picks the environment, `-c` points at another movefile.
 
+`wordmove-ng auto -e production --all` compares each component on both sides by timestamp and
+prints which direction it would move; add `--apply` to execute. See the
+[usage page](https://tekgnosis-net.github.io/wordmove-ng/usage/#auto) for the signals and caveats.
+
 ## Peer dependencies
 
 wordmove-ng is orchestration glue around standard tools.
@@ -320,12 +326,12 @@ stored anywhere.
 1. Every push to `master` updates a "release PR" that bumps `lib/wordmove/version.rb` and
    `CHANGELOG.md` according to the commits since the last release.
 2. Merging that PR creates the `vX.Y.Z` tag and the GitHub release.
-3. The `publish` job in `.github/workflows/release.yml` then runs the test suite on the
-   tagged commit, builds the gem, pushes it to rubygems.org and attaches the `.gem` file to
-   the GitHub release.
+3. The tag push triggers the `publish` job in `.github/workflows/release.yml`, which runs
+   the test suite on the tagged commit, builds the gem, pushes it to rubygems.org and
+   attaches the `.gem` file to the GitHub release.
 
-Pushing a `v*` tag by hand at the head of `master` triggers the same publish job; that is
-how 6.0.0 was cut. Merge the release PR only when there is something worth shipping:
+Pushing a `v*` tag by hand at the head of `master` goes through the same publish job; that
+is how 6.0.0 was cut. Merge the release PR only when there is something worth shipping:
 release-please keeps proposing a patch release for any Conventional Commit, including
 `ci:` and `docs:` ones.
 

data/contrib/wordmove-sync.sh

@@ -20,7 +20,7 @@ set -euo pipefail
 # ---- settings (override with environment variables) --------------------------
 SITE_DIR="${SITE_DIR:-/path/to/wordpress}"        # directory holding movefile.yml
 ENVIRONMENT="${ENVIRONMENT:-production}"          # remote environment (-e)
-ACTION="${ACTION:-pull}"                          # pull or push
+ACTION="${ACTION:-pull}"                          # pull, push, or auto (plan only unless COMPONENTS adds --apply)
 COMPONENTS="${COMPONENTS:---all --no-db}"         # component flags
 LOG_DIR="${LOG_DIR:-$HOME/log/wordmove}"
 KEEP_LOGS="${KEEP_LOGS:-30}"                      # how many run logs to keep
@@ -28,8 +28,8 @@ RUBY_VERSION="${RUBY_VERSION:-}"                  # e.g. ruby-3.4.9 for rvm; emp
 # -----------------------------------------------------------------------------
 
 case "$ACTION" in
-  pull|push) ;;
-  *) echo "ACTION must be pull or push, got '$ACTION'" >&2; exit 2 ;;
+  pull|push|auto) ;;
+  *) echo "ACTION must be pull, push or auto, got '$ACTION'" >&2; exit 2 ;;
 esac
 
 # Ruby version managers are not loaded by cron.

data/docs/automation.md

@@ -140,6 +140,10 @@ tail -n 40 ~/log/wordmove/production-*.log
 
 Running `wordmove-ng doctor` under the same `env -i` prefix is the quickest check that the key and every tool resolve without an agent.
 
+## Drift reports with `auto`
+
+`wordmove-ng auto -e production --all` without `--apply` compares every component on both sides and exits `3` when something has drifted, `0` when everything is in sync. Scheduled from cron with `MAILTO` set, that is a nightly "which side changed" report with no risk of moving anything: `ACTION=auto COMPONENTS="--all"` works with the shipped script since the exit code propagates. Add `--apply` only once you trust the signals for your site; see the warning on the [usage page]({{ site.baseurl }}/usage/#auto).
+
 ## Database jobs
 
 For a scheduled database push enable `global.maintenance_mode` so the seconds between import and `wp search-replace` show visitors the maintenance page instead of the wrong URLs. Scheduled database pulls are the common case (a nightly copy of production for development) and need nothing special; each run leaves a `local-backup-<timestamp>.sql.gz` in `wp-content/`, so prune those occasionally.

data/docs/configuration.md

@@ -100,6 +100,8 @@ production:
 | `maintenance_mode` | `false` | Wrap the target's database import and adaptation in `wp maintenance-mode activate`/`deactivate`. `WORDMOVE_MAINTENANCE_MODE=1` in the environment forces it on for one run. |
 | `collation_fallbacks` | built-in table | Collations rewritten before import, e.g. `utf8mb3_uca1400_ai_ci: utf8mb4_unicode_ci`. Setting the key replaces the default table. |
 | `charset_fallbacks` | `utf8mb3: utf8mb4` | Charsets rewritten before import. |
+| `auto_window` | `300` | `wordmove-ng auto`: timestamp differences up to this many seconds count as in sync. Env override `WORDMOVE_AUTO_WINDOW`. |
+| `auto_clock_skew_max` | `60` | `wordmove-ng auto`: abort when local and remote clocks differ by more than this many seconds. Env override `WORDMOVE_AUTO_CLOCK_SKEW_MAX`. |
 | `sql_adapter` | ignored | Accepted with a warning for 5.x movefiles. |
 
 ## `local` and each remote

data/docs/contributing.md

@@ -38,9 +38,9 @@ Releases are automated by [release-please](https://github.com/googleapis/release
 
 1. Every push to `master` updates a "release PR" that bumps the version and the changelog from the commits since the last release. release-please proposes a patch release for any Conventional Commit, `ci:` and `docs:` included, so merge the PR only when there is something worth shipping.
 2. Merging it creates the `vX.Y.Z` tag and the GitHub release.
-3. The `publish` job in `.github/workflows/release.yml` re-runs the suite on the tagged commit, builds the gem, pushes it to rubygems.org and attaches the `.gem` file to the GitHub release.
+3. The tag push triggers the `publish` job in `.github/workflows/release.yml`, which re-runs the suite on the tagged commit, builds the gem, pushes it to rubygems.org and attaches the `.gem` file to the GitHub release.
 
-Pushing a `v*` tag by hand at the head of `master` triggers the same publish job.
+Pushing a `v*` tag by hand at the head of `master` goes through the same publish job.
 
 `master` is protected: changes land through pull requests whose `test` checks pass, and the rules apply to administrators too. release-please opens its PR with a fine-grained personal access token (secret `RELEASE_PLEASE_TOKEN`) because PRs opened with the built-in Actions token never trigger the checks.
 

data/docs/installation.md

@@ -11,11 +11,124 @@ nav_order: 2
 
 ## Ruby
 
-wordmove-ng needs **Ruby 3.0 or newer**. Check with `ruby --version`. If your system Ruby is older or missing, use a version manager:
+wordmove-ng needs **Ruby 3.0 or newer** and is tested on 3.0 through 4.0. Check what you have:
 
-- [rbenv](https://github.com/rbenv/rbenv#installation)
-- [RVM](https://rvm.io/)
-- [mise](https://mise.jdx.dev/) (`mise use -g ruby@3.4`)
+```bash
+ruby --version
+```
+
+If that prints 3.0 or newer you can skip to [the gem](#the-gem). Otherwise pick one of the routes below. A version manager is the usual choice: it leaves the system Ruby alone (several distributions depend on it), installs gems into your home directory without `sudo`, and lets you upgrade Ruby later without touching anything else. Any current 3.x works; `3.4` is a good default and is what the project itself uses.
+
+### Option A: your distribution's Ruby
+{: .no_toc }
+
+The quickest route when the packaged version is recent enough. Debian 12, Ubuntu 22.04 and later, Fedora and Arch all ship Ruby 3.x.
+
+```bash
+# Debian / Ubuntu
+sudo apt update && sudo apt install -y ruby-full build-essential
+# Fedora
+sudo dnf install -y ruby ruby-devel @development-tools
+# Arch
+sudo pacman -S ruby base-devel
+```
+
+Then install the gem for your user only, so no `sudo` is needed and the system stays untouched:
+
+```bash
+gem install --user-install wordmove-ng
+```
+
+`--user-install` puts executables under `~/.local/share/gem/ruby/<version>/bin` (older Rubies: `~/.gem/ruby/<version>/bin`). Add that directory to your `PATH` in `~/.bashrc` or `~/.zshrc`; `gem env` prints the exact path under `USER INSTALLATION DIRECTORY`.
+
+### Option B: rbenv
+{: .no_toc }
+
+Lightweight, shell-agnostic, and packaged everywhere. `rbenv` selects a Ruby; the `ruby-build` plugin compiles one.
+
+```bash
+# macOS
+brew install rbenv ruby-build
+# Debian / Ubuntu (rbenv from apt is often old; the git checkout below is current)
+sudo apt install -y git build-essential autoconf libssl-dev libyaml-dev zlib1g-dev libffi-dev libgmp-dev rustc
+git clone https://github.com/rbenv/rbenv.git ~/.rbenv
+git clone https://github.com/rbenv/ruby-build.git ~/.rbenv/plugins/ruby-build
+~/.rbenv/bin/rbenv init      # prints the line to add to your shell profile; add it, then reopen the terminal
+```
+
+```bash
+rbenv install 3.4.11         # compiles Ruby, takes a few minutes
+rbenv global 3.4.11
+ruby --version
+gem install wordmove-ng
+rbenv rehash                 # makes the wordmove-ng executable visible
+```
+
+`rbenv install --list` shows the versions available; run `git -C ~/.rbenv/plugins/ruby-build pull` (or `brew upgrade ruby-build`) if a recent one is missing.
+
+### Option C: RVM
+{: .no_toc }
+
+Heavier than rbenv but familiar to many WordPress developers, and its gemsets isolate one project's gems from another's.
+
+```bash
+gpg --keyserver keyserver.ubuntu.com --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3 7D2BAF1CF37B13E2069D6956105BD0E739499BDB
+\curl -sSL https://get.rvm.io | bash -s stable
+source ~/.rvm/scripts/rvm    # or reopen the terminal
+```
+
+```bash
+rvm install 3.4.11
+rvm use 3.4.11 --default
+gem install wordmove-ng
+```
+
+RVM installs the build dependencies for you (it may ask for your `sudo` password once). To keep wordmove-ng in its own gemset: `rvm gemset create wordmove && rvm use 3.4.11@wordmove --default` before `gem install`. If you use the [cron script]({{ site.baseurl }}/automation/), set `RUBY_VERSION` to the same `ruby-3.4.11` or `ruby-3.4.11@wordmove` string.
+
+### Option D: mise
+{: .no_toc }
+
+One tool for Ruby, Node, PHP and more, with a single config file per project. Good if you already manage other runtimes with it.
+
+```bash
+curl https://mise.run | sh
+echo 'eval "$(~/.local/bin/mise activate bash)"' >> ~/.bashrc   # or: mise activate zsh >> ~/.zshrc
+exec $SHELL
+```
+
+```bash
+mise use --global ruby@3.4
+ruby --version
+gem install wordmove-ng
+```
+
+mise compiles Ruby through ruby-build as well, so on Linux install the same build packages listed under rbenv first; on macOS `brew install openssl@3 readline libyaml gmp autoconf`.
+
+### Docker
+{: .no_toc }
+
+If you would rather not install Ruby at all, run wordmove-ng from the official Ruby image. Mount your site and your SSH configuration, and make sure the peer tools are installed in the container:
+
+```bash
+docker run --rm -it \
+  -v "$PWD":/site -w /site \
+  -v "$HOME/.ssh":/root/.ssh:ro \
+  ruby:3.4 bash -c 'apt-get update -qq && apt-get install -y -qq rsync openssh-client mariadb-client >/dev/null \
+    && gem install -q wordmove-ng && wordmove-ng doctor'
+```
+
+For repeated use bake that into a small Dockerfile. Note that `local` in your movefile then means "inside the container": `wordpress_path` is `/site`, and the local database must be reachable from the container (`host: host.docker.internal` on Docker Desktop, or the compose service name).
+
+### Checking the result
+{: .no_toc }
+
+```bash
+ruby --version        # 3.0 or newer
+gem --version
+wordmove-ng --version
+```
+
+If `wordmove-ng` is not found right after installing, the executable directory is not in your `PATH` yet: open a new terminal, and for rbenv run `rbenv rehash`. `gem env` shows where executables were placed.
 
 ## The gem
 

data/docs/quick-start.md

@@ -72,6 +72,7 @@ A push of the database backs up the remote database to `wp-content/production-ba
 | `wordmove-ng push -e production --all --no-db` | mirror every folder, keep the production database |
 | `wordmove-ng push -e production --all --no-uploads` | everything but uploads |
 | `wordmove-ng pull -e production -d --no-adapt` | import the production database without rewriting URLs |
+| `wordmove-ng auto -e production --all` | show which components are newer on which side, change nothing |
 | `wordmove-ng list` | show every environment and its vhost |
 | `wordmove-ng help push` | all flags |
 

data/docs/usage.md

@@ -59,6 +59,47 @@ Options:
 
 `pull` copies from the remote given with `-e` to `local`; `push` copies from `local` to that remote. At least one component flag (or `--all`) is required.
 
+### `auto`
+{: .no_toc }
+
+Decides **per component** whether to push or pull, from timestamps on both sides, and prints a plan. Nothing changes unless you pass `--apply`.
+
+```bash
+wordmove-ng auto -e production -t -p -u -d          # print the plan
+wordmove-ng auto -e production --all --apply -s     # execute it as a dry run
+wordmove-ng auto -e production --all --apply        # execute it
+```
+
+```
+▬▬ Auto plan for "production" ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬
+  themes   PUSH   local 2026-10-06 09:12:40  remote 2026-10-01 18:03:11  local newer by 400769s
+  plugins  SKIP   local 2026-10-01 18:03:11  remote 2026-10-01 18:03:11  in sync (within 300s)
+  uploads  PULL   local 2026-09-28 11:20:02  remote 2026-10-06 08:55:30  remote newer by 682528s
+  db       PULL   local 2026-09-28 11:19:57  remote 2026-10-06 08:57:01  remote newer by 682624s
+    ℹ️  info | Plan only. Re-run with --apply to execute it (add -s for a dry run).
+```
+
+How each side is measured:
+
+| Component | Signal |
+| --- | --- |
+| uploads, themes, plugins, mu-plugins, languages | newest file modification time beneath the directory (`find … -printf '%T@'`) |
+| database | latest of `MAX(post_modified_gmt)` and `MAX(comment_date_gmt)`, via `wp db query` on each side |
+| core (`-w`) | never decided automatically; always `SKIP` |
+
+Guard rails:
+
+- Differences up to `global.auto_window` seconds (default 300) count as **in sync** and are skipped.
+- Local and remote clocks are compared first; a skew above `global.auto_clock_skew_max` seconds (default 60) aborts, a smaller one is reported as a warning.
+- A direction forbidden by the movefile shows as `BLOCKED` and is never executed.
+- If a probe fails on either side the row is `ERROR` and nothing is applied, even with `--apply`.
+- With `--apply`, pushes run first and pulls second, each wrapped in the usual `before`/`after` hooks, through exactly the same steps as `push` and `pull` (backups, prerequisites, `--simulate`).
+
+Exit codes: `0` when nothing needs to move or after a successful `--apply`, `3` when the plan has pending moves and `--apply` was not given, `1` on any error. Cron can therefore run `auto` without `--apply` as a nightly "drift report" and treat `3` as "something to look at".
+
+{: .warning }
+Timestamps are evidence, not truth. A `git checkout` or an rsync without `--times` touches every file and makes that side look newer; a plugin auto-update on production happening after your local theme work makes production "newer" and would delete your work on `--apply`. Read the plan before applying it. The database signal only covers posts and comments; option and settings changes are invisible to it.
+
 ## Flags
 
 | Flag | Meaning |
@@ -78,6 +119,7 @@ Options:
 | `--no-adapt` | import the database without running `wp search-replace` |
 | `-v`, `--verbose` | more output |
 | `--debug` | accepted for compatibility; had an effect only with the removed FTP deployer |
+| `--apply` | `auto` only: execute the plan instead of printing it |
 
 Component paths respect the `paths` section of each environment.
 

data/lib/wordmove/assets/wordmove_schema_global.yml

@@ -4,6 +4,10 @@ mapping:
     type: str
   maintenance_mode:
     type: bool
+  auto_window:
+    type: int
+  auto_clock_skew_max:
+    type: int
   collation_fallbacks:
     type: map
     mapping:

data/lib/wordmove/auto_command.rb

@@ -0,0 +1,43 @@
+module Wordmove
+  # Helpers behind `wordmove-ng auto`, kept out of the Thor class so the
+  # command definitions stay readable.
+  module AutoCommand
+    private
+
+    def selected_tasks(options)
+      tasks = []
+      handle_options(options) { |task| tasks << task }
+      tasks
+    end
+
+    def print_auto_plan(rows, warnings, environment)
+      logger.task "Auto plan for \"#{environment}\""
+      warnings.each { |w| logger.warn(w) }
+      width = rows.map { |r| r.task.length }.max
+      rows.each do |row|
+        logger.plain format(
+          "  %-#{width}s  %-7s  local %-20s  remote %-20s  %s",
+          row.task, row.direction.to_s.upcase, stamp(row.local_at), stamp(row.remote_at),
+          row.reason
+        )
+      end
+    end
+
+    def stamp(epoch)
+      epoch.nil? ? '-' : Time.at(epoch).strftime('%Y-%m-%d %H:%M:%S')
+    end
+
+    def apply_auto_plan(rows, options)
+      deployer = Wordmove::Deployer::Base.deployer_for(options.deep_symbolize_keys)
+      %i[push pull].each do |action|
+        tasks = rows.select { |r| r.direction == action }.map(&:task)
+        next if tasks.empty?
+
+        Wordmove::Hook.run(action, :before, options)
+        guardian = Wordmove::Guardian.new(options: options, action: action)
+        tasks.each { |task| deployer.send("#{action}_#{task}") if guardian.allows(task.to_sym) }
+        Wordmove::Hook.run(action, :after, options)
+      end
+    end
+  end
+end

data/lib/wordmove/auto_planner.rb

@@ -0,0 +1,194 @@
+require 'open3'
+require 'shellwords'
+require 'time'
+
+module Wordmove
+  # Decides, per component, whether local or the remote holds the newer
+  # content, so `wordmove-ng auto` can push some components and pull others.
+  #
+  # Directories are compared by the newest file modification time beneath
+  # them; the database by the latest post or comment change on each side.
+  # Differences inside `global.auto_window` seconds are treated as in sync.
+  # The WordPress core is never decided automatically: its files change on
+  # every checkout and on every update, and mirroring it the wrong way is the
+  # most destructive mistake possible.
+  class AutoPlanner
+    class ClockSkewError < StandardError; end
+
+    Row = Struct.new(:task, :local_at, :remote_at, :direction, :reason) do
+      def pending?
+        %i[push pull].include?(direction)
+      end
+    end
+
+    DEFAULT_WINDOW = 300
+    DEFAULT_CLOCK_SKEW_MAX = 60
+    DIRECTORY_TASKS = %w[uploads themes plugins mu_plugins languages].freeze
+    EPOCH = /\A\d+(\.\d+)?\z/
+    TIMESTAMP = /\A\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\z/
+
+    attr_reader :warnings, :environment
+
+    def initialize(cli_options)
+      @cli_options = cli_options
+      @movefile = Wordmove::Movefile.new(cli_options[:config])
+      @movefile.load_dotenv(cli_options)
+      @options = @movefile.fetch(false)
+      @environment = @movefile.environment(cli_options)
+      @runner = SshRunner.new(@options[environment][:ssh])
+      @warnings = []
+    end
+
+    def self.pending?(rows)
+      rows.any?(&:pending?)
+    end
+
+    # Returns one Row per task, in the given order.
+    def plan(tasks)
+      check_clock_skew!
+      tasks.map { |task| plan_task(task) }
+    end
+
+    def window
+      knob('WORDMOVE_AUTO_WINDOW', :auto_window, DEFAULT_WINDOW)
+    end
+
+    def clock_skew_max
+      knob('WORDMOVE_AUTO_CLOCK_SKEW_MAX', :auto_clock_skew_max, DEFAULT_CLOCK_SKEW_MAX)
+    end
+
+    private
+
+    def plan_task(task)
+      return Row.new(task, nil, nil, :skip, 'core is never decided automatically') if core?(task)
+
+      local_at, local_err = probe(:local, task)
+      remote_at, remote_err = probe(:remote, task)
+      error = probe_error(local_err, remote_err)
+      return Row.new(task, local_at, remote_at, :error, error) if error
+
+      direction, reason = decide(local_at, remote_at)
+      direction, reason = apply_forbid(task, direction, reason)
+      Row.new(task, local_at, remote_at, direction, reason)
+    end
+
+    def core?(task)
+      task == 'wordpress'
+    end
+
+    def probe_error(local_err, remote_err)
+      return "local probe failed: #{local_err}" if local_err
+      return "remote probe failed: #{remote_err}" if remote_err
+
+      nil
+    end
+
+    def decide(local_at, remote_at)
+      return [:skip, 'both sides empty'] if local_at.nil? && remote_at.nil?
+      return [:push, 'remote empty'] if remote_at.nil?
+      return [:pull, 'local empty'] if local_at.nil?
+
+      delta = (remote_at - local_at).to_i
+      return [:skip, "in sync (within #{window}s)"] if delta.abs <= window
+
+      delta.positive? ? [:pull, "remote newer by #{delta}s"] : [:push, "local newer by #{-delta}s"]
+    end
+
+    def apply_forbid(task, direction, reason)
+      return [direction, reason] unless %i[push pull].include?(direction)
+
+      forbidden = @options.dig(environment, :forbid, direction, task.to_sym) == true
+      return [direction, reason] unless forbidden
+
+      [:blocked, "#{reason}; #{direction} forbidden by movefile"]
+    end
+
+    # Returns [epoch_or_nil, error_or_nil]. Probe output comes from a remote
+    # host and is treated as untrusted: anything that is not a plain number or
+    # timestamp is reported as an error rather than interpreted.
+    def probe(side, task)
+      command = task == 'db' ? db_command(side) : dir_command(side, task)
+      stdout, stderr, code = execute(side, command)
+      return [nil, stderr.to_s.strip.empty? ? "exit #{code}" : stderr.strip] unless code.zero?
+
+      [task == 'db' ? parse_db(stdout) : parse_epoch(stdout), nil]
+    rescue ArgumentError => e
+      [nil, "unparseable output: #{e.message}"]
+    end
+
+    def dir_command(side, task)
+      path = WordpressDirectory.new(task.to_sym, side_options(side)).path
+      # Newest regular file mtime under the directory; empty output if none.
+      "find #{Shellwords.escape(path)} -type f -printf '%T@\\n' 2>/dev/null | sort -n | tail -1"
+    end
+
+    # Latest post and comment change, one per line. The table prefix is read
+    # with `wp db prefix` so custom prefixes work; wp handles the credentials.
+    def db_command(side)
+      path = Shellwords.escape(side_options(side)[:wordpress_path])
+      prefix = "$(wp db prefix --path=#{path} --allow-root)"
+      sql = "SELECT MAX(post_modified_gmt) FROM #{prefix}posts " \
+            "UNION ALL SELECT MAX(comment_date_gmt) FROM #{prefix}comments"
+      "wp db query \"#{sql}\" --skip-column-names --path=#{path} --allow-root"
+    end
+
+    def parse_epoch(stdout)
+      value = stdout.to_s.strip
+      return nil if value.empty?
+
+      expect_format!(value, EPOCH, 'an epoch')
+      value.to_f
+    end
+
+    def expect_format!(value, pattern, what)
+      return if value.match?(pattern)
+
+      raise ArgumentError, "expected #{what}, got #{value.inspect[0, 40]}"
+    end
+
+    def parse_db(stdout)
+      stamps = stdout.to_s.lines.map(&:strip).reject { |l| l.empty? || l == 'NULL' }
+      return nil if stamps.empty?
+
+      stamps.map do |stamp|
+        expect_format!(stamp, TIMESTAMP, 'a timestamp')
+        Time.parse("#{stamp} UTC").to_i
+      end.max
+    end
+
+    def check_clock_skew!
+      local_out, local_err, local_code = local_shell('date +%s')
+      rout, rerr, rcode = @runner.run('date +%s')
+      raise ClockSkewError, "could not read the local clock: #{local_err}" unless local_code.zero?
+      raise ClockSkewError, "could not read the remote clock: #{rerr}" unless rcode.zero?
+
+      skew = (rout.to_i - local_out.to_i).abs
+      if skew > clock_skew_max
+        raise ClockSkewError,
+              "clock skew of #{skew}s between local and \"#{environment}\" exceeds the " \
+              "maximum of #{clock_skew_max}s; fix the clocks (ntp) before trusting timestamps"
+      end
+      @warnings << "clock skew of #{skew}s between local and \"#{environment}\"" if skew.positive?
+    end
+
+    def execute(side, command)
+      side == :local ? local_shell(command) : @runner.run(command)
+    end
+
+    def local_shell(command)
+      stdout, stderr, status = Open3.capture3('sh', '-c', command)
+      [stdout, stderr, status.exitstatus]
+    end
+
+    def side_options(side)
+      side == :local ? @options[:local] : @options[environment]
+    end
+
+    def knob(env_name, key, default)
+      raw = ENV.fetch(env_name, nil)
+      raw = @options.dig(:global, key) if raw.nil? || raw.to_s.strip.empty?
+      value = raw.nil? ? default : raw.to_i
+      value.clamp(0, 86_400 * 30)
+    end
+  end
+end

data/lib/wordmove/cli.rb

@@ -1,5 +1,7 @@
 module Wordmove
   class CLI < Thor
+    include AutoCommand
+
     map %w[--version -v] => :__print_version
 
     desc "--version, -v", "Print the version"
@@ -104,6 +106,58 @@ module Wordmove
       Wordmove::Hook.run(:pull, :after, options)
     end
 
+    desc "auto", "Decides per component whether to push or pull, from timestamps on both sides"
+    long_desc <<-LONGDESC
+      Compares each selected component on local and on the remote (newest file
+      modification time for directories, latest post or comment change for the
+      database) and proposes a direction per component. The WordPress core is
+      never decided automatically.
+
+      Without --apply only the plan is printed and nothing changes; the exit
+      code is 3 when at least one component would move, 0 when everything is in
+      sync. With --apply the plan is executed through the regular push and pull
+      steps, honouring --simulate, forbid rules and hooks.
+    LONGDESC
+    shared_options.each do |option, args|
+      method_option option, args
+    end
+    method_option :apply, type: :boolean, default: false,
+                          desc: "Execute the plan instead of only printing it"
+    # rubocop:disable-next Metrics/MethodLength
+    def auto
+      ensure_wordpress_options_presence!(options)
+      begin
+        planner = Wordmove::AutoPlanner.new(options.deep_symbolize_keys)
+        rows = planner.plan(selected_tasks(options))
+      rescue MovefileNotFound, Wordmove::AutoPlanner::ClockSkewError,
+             UndefinedEnvironment, UnmetPeerDependencyError => e
+        logger.error(e.message)
+        exit 1
+      rescue Psych::SyntaxError => e
+        logger.error("Your movefile is not parsable due to a syntax error: #{e.message}")
+        exit 1
+      end
+
+      print_auto_plan(rows, planner.warnings, planner.environment)
+
+      if rows.any? { |r| r.direction == :error }
+        logger.error "Some components could not be compared; nothing was changed."
+        exit 1
+      end
+
+      unless Wordmove::AutoPlanner.pending?(rows)
+        logger.success "Nothing to do."
+        return
+      end
+
+      unless options[:apply]
+        logger.info "Plan only. Re-run with --apply to execute it (add -s for a dry run)."
+        exit 3
+      end
+
+      apply_auto_plan(rows, options)
+    end
+
     desc "push", "Pushes WP data from local machine to remote host"
     shared_options.each do |option, args|
       method_option option, args

data/lib/wordmove/generators/movefile.yml

@@ -2,6 +2,11 @@ global:
   # Put the target site in `wp maintenance-mode` while its database is replaced.
   # Can also be forced with the WORDMOVE_MAINTENANCE_MODE=1 environment variable.
   maintenance_mode: false
+  # `wordmove-ng auto`: timestamp differences up to this many seconds count as "in sync",
+  # and a larger clock skew between local and the remote aborts the comparison.
+  # Env overrides: WORDMOVE_AUTO_WINDOW, WORDMOVE_AUTO_CLOCK_SKEW_MAX.
+  # auto_window: 300
+  # auto_clock_skew_max: 60
 
 local:
   vhost: <%= vhost %>

data/lib/wordmove/version.rb

@@ -1,3 +1,3 @@
 module Wordmove
-  VERSION = "6.0.2".freeze
+  VERSION = "6.1.0".freeze
 end

data/lib/wordmove.rb

@@ -22,6 +22,8 @@ require 'yaml'
 
 require 'wordmove/ssh_runner'
 require 'wordmove/prerequisites'
+require 'wordmove/auto_planner'
+require 'wordmove/auto_command'
 require 'photocopier'
 
 require 'wordmove/cli'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: wordmove-ng
 version: !ruby/object:Gem::Version
-  version: 6.0.2
+  version: 6.1.0
 platform: ruby
 authors:
 - Kumar
@@ -275,6 +275,8 @@ files:
 - lib/wordmove/assets/wordmove_schema_global.yml
 - lib/wordmove/assets/wordmove_schema_local.yml
 - lib/wordmove/assets/wordmove_schema_remote.yml
+- lib/wordmove/auto_command.rb
+- lib/wordmove/auto_planner.rb
 - lib/wordmove/cli.rb
 - lib/wordmove/deployer/base.rb
 - lib/wordmove/deployer/ssh.rb