@imwz/wp-pattern-sentinel 1.2.0 → 1.2.1

package/README.md

@@ -14,7 +14,7 @@ WordPress block validation is a JavaScript concern. The editor's `save()` functi
 
 Credentials are resolved in this order — the first match wins:
 
-1. **`--trellis` flag** — reads directly from Roots Trellis vault + `wordpress_sites.yml`
+1. **`--trellis` flag** — reads directly from Roots Trellis vault + `wordpress_sites.yml` (`--user` / `--pass` still override the username and password)
 2. **CLI flags** — `--url`, `--user`, `--pass`
 3. **Environment variables** — `WP_URL`, `WP_USER`, `WP_PASS`
 4. **`.env` file** — placed in the directory where you run sentinel
@@ -63,6 +63,15 @@ Sentinel auto-discovers the Trellis directory by walking up from the current wor
 
 **Bedrock support:** When `--trellis` is used, sentinel auto-detects Bedrock installs by reading `WP_SITEURL` from the site's `.env` file. Bedrock puts WordPress core in `/wp/`, so admin URLs become `/wp/wp-admin/` instead of `/wp-admin/`. No extra flags needed — this is handled automatically.
 
+**Different admin user:** Trellis provisions a WordPress user named `admin`, and that is the username Sentinel logs in with. If the local database was pulled from production, `admin` may not exist and login fails with "The username admin is not registered on this site". Pass the real admin with `--user`. Add `--pass` if that user's password differs from the vault's `admin_password`. URL and Bedrock detection still come from Trellis.
+
+```bash
+sentinel --trellis --site=example.com --user=jane path/to/patterns/
+
+# Password from your shell rather than the command line history; an empty value keeps the vault password
+sentinel --trellis --site=example.com --user=jane --pass="$WP_PASS" path/to/patterns/
+```
+
 ---
 
 ## Quickstart with `.env`
@@ -154,8 +163,8 @@ A block that renders `InnerBlocks` with a `template` and `templateLock: "all"` o
 | Flag | Default | Description |
 |------|---------|-------------|
 | `--url` | `http://localhost` | WordPress site URL |
-| `--user` | `admin` | Admin username |
-| `--pass` | `password` | Admin password |
+| `--user` | `admin` | Admin username. Overrides the Trellis username when used with `--trellis` |
+| `--pass` | `password` | Admin password. Overrides the vault password when used with `--trellis` |
 | `--wp-subdir` | — | WP core subdir when not using `--trellis` (e.g. `wp` for Bedrock). Sets admin URL to `{url}/{subdir}`. Auto-detected from `WP_SITEURL` when `--trellis` is used. |
 | `--headless` | `true` | Run browser headless |
 | `--concurrency` | `4` | Parallel workers |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@imwz/wp-pattern-sentinel",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Browser-based WordPress block pattern validator using Playwright",
   "type": "module",
   "engines": {

package/src/args.js

@@ -7,6 +7,7 @@ import { findTrellisDir, loadTrellisCredentials } from './trellis.js';
 /**
  * Credential resolution priority:
  *   1. --trellis flag  → reads Roots Trellis vault + wordpress_sites.yml
+ *                        (--user / --pass still override the vault values)
  *   2. CLI flags       → --url, --user, --pass
  *   3. Env vars        → WP_URL, WP_USER, WP_PASS
  *   4. .env file       → loaded from cwd automatically
@@ -64,6 +65,19 @@ function loadDotEnv() {
   }
 }
 
+/**
+ * Let --user / --pass override credentials read from Trellis. Trellis
+ * provisions the WordPress user "admin", but a site whose database was pulled
+ * from production only has that site's real admin, so explicit flags win. An
+ * empty flag (`--pass="$UNSET_VAR"` in an npm script) keeps the vault value.
+ */
+export function applyCredentialFlags({ user, pass }, values) {
+  return {
+    user: values.user || user,
+    pass: values.pass || pass,
+  };
+}
+
 export async function parseArgs(args) {
   loadDotEnv();
 
@@ -88,6 +102,8 @@ export async function parseArgs(args) {
       subsite: values.subsite ?? null,
     }));
 
+    ({ user, pass } = applyCredentialFlags({ user, pass }, values));
+
   } else {
     // --- Source 2: CLI flags ---
     url  = values.url;