@loopress/cli 0.18.0 → 0.20.0

package/dist/config/project-config.manager.js

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
-import slugify from 'slugify';
+import { toSlug } from '../utils/to-slug.js';
 import { readJsonFile, writeJsonFileAtomic } from './json-file.js';
 export class ProjectConfigManager {
     configDir;
@@ -9,7 +9,7 @@ export class ProjectConfigManager {
     }
     createProjectId(name) {
         const config = this.readConfig();
-        const base = slugify(name, { lower: true, strict: true }) || 'project';
+        const base = toSlug(name, 'project');
         let id = base;
         let suffix = 2;
         while (config.projects[id]) {

package/dist/lib/api-client.d.ts

@@ -6,7 +6,8 @@ export declare const API_URL: string;
 export declare class ApiClient {
     private readonly baseUrl;
     private readonly client;
-    constructor(token: string, baseUrl?: string);
+    private readonly timeoutMs;
+    constructor(token: string, baseUrl?: string, timeoutMs?: number);
     get<T = unknown>(path: string): Promise<T>;
     post<T = unknown>(path: string, json?: Record<string, unknown>): Promise<T>;
     put<T = unknown>(path: string, json?: Record<string, unknown>): Promise<T>;

package/dist/lib/api-client.js

@@ -1,4 +1,5 @@
 import got from 'got';
+import { REQUEST_TIMEOUT_MS } from './wp-client.js';
 export const API_URL = process.env.LPS_API_URL ?? 'https://api.loopress.dev';
 /**
  * HTTP client for the Loopress cloud API (projects, environments, credentials).
@@ -7,11 +8,14 @@ export const API_URL = process.env.LPS_API_URL ?? 'https://api.loopress.dev';
 export class ApiClient {
     baseUrl;
     client;
-    constructor(token, baseUrl = API_URL) {
+    timeoutMs;
+    constructor(token, baseUrl = API_URL, timeoutMs = REQUEST_TIMEOUT_MS) {
         this.baseUrl = baseUrl;
+        this.timeoutMs = timeoutMs;
         this.client = got.extend({
             headers: { Authorization: `Bearer ${token}` },
             prefixUrl: baseUrl,
+            timeout: { request: timeoutMs },
         });
     }
     async get(path) {
@@ -29,11 +33,11 @@ export class ApiClient {
             return (response.body ? JSON.parse(response.body) : undefined);
         }
         catch (error) {
-            throw new Error(formatApiError(error, `${this.baseUrl}/${path}`), { cause: error });
+            throw new Error(formatApiError(error, `${this.baseUrl}/${path}`, this.timeoutMs), { cause: error });
         }
     }
 }
-function formatApiError(error, url) {
+function formatApiError(error, url, timeoutMs) {
     const err = error;
     const status = err.response?.statusCode;
     if (status === 401) {
@@ -42,5 +46,8 @@ function formatApiError(error, url) {
     if (status === 403) {
         return `Request rejected (${status}) on ${url}: ${err.response?.body ?? err.message}`;
     }
+    if (err.name === 'TimeoutError') {
+        return `Request timed out after ${timeoutMs / 1000}s on ${url}. Check your network connection, or the Loopress API may be temporarily unreachable.`;
+    }
     return err.message ?? String(error);
 }

package/dist/lib/base.d.ts

@@ -3,20 +3,32 @@ import { EnvironmentConfig } from '../types/config.js';
 import { LoopressLocalConfig } from '../utils/loopress-config.js';
 import { WpClient } from './wp-client.js';
 export declare abstract class LoopressCommand extends Command {
+    static baseFlags: {
+        env: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
     static dryRunFlag: {
         'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
+    static yesFlag: {
+        yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
     protected dryRun: boolean;
     protected localConfig: LoopressLocalConfig;
+    protected projectId: string;
     protected siteConfig: EnvironmentConfig;
+    protected yes: boolean;
     private wpClient?;
     protected get rootDir(): string;
     protected get wp(): WpClient;
     init(): Promise<void>;
+    protected maybeAutoRotate(): Promise<void>;
+    protected removeOrphanedFiles(dir: string, orphans: string[], reason: string): Promise<void>;
     protected resolveAcfPath(override?: string): string;
     protected resolveApiPath(override?: string): string;
     protected resolveFormPath(override?: string): string;
+    protected resolvePagePath(override?: string): string;
     protected resolveSeoPath(override?: string): string;
     protected resolveSnippetsPath(override?: string): string;
+    private pickEnvironment;
     private resolveEnvironment;
 }

package/dist/lib/base.js

@@ -1,15 +1,31 @@
+import { confirm } from '@inquirer/prompts';
 import { Command, Flags } from '@oclif/core';
+import { rm } from 'node:fs/promises';
 import { join } from 'node:path';
 import { configManager } from '../config/project-config.manager.js';
 import { readLocalConfig } from '../utils/loopress-config.js';
+import { isInteractive } from './interactive.js';
+import { isAppPasswordStale, rotateAppPassword } from './rotate-app-password.js';
 import { WpClient } from './wp-client.js';
 export class LoopressCommand extends Command {
+    // On every subclass without opt-in: targeting an environment explicitly beats depending on
+    // the machine-wide mutable state of `lps project switch`, which is shared across terminals.
+    static baseFlags = {
+        env: Flags.string({
+            description: 'Target environment by name, overriding the globally active one (lps project switch)',
+        }),
+    };
     static dryRunFlag = {
         'dry-run': Flags.boolean({ char: 'd', description: 'Show what would change without making changes' }),
     };
+    static yesFlag = {
+        yes: Flags.boolean({ char: 'y', description: 'Answer yes to confirmation prompts' }),
+    };
     dryRun = false;
     localConfig = {};
+    projectId;
     siteConfig;
+    yes = false;
     wpClient;
     get rootDir() {
         return this.localConfig.rootDir ?? '.';
@@ -28,12 +44,64 @@ export class LoopressCommand extends Command {
         await super.init();
         const { flags } = (await this.parse({
             args: this.ctor.args,
+            baseFlags: this.ctor.baseFlags,
             flags: this.ctor.flags,
             strict: this.ctor.strict,
         }));
         this.dryRun = Boolean(flags['dry-run']);
+        this.yes = Boolean(flags.yes);
         this.localConfig = await readLocalConfig();
-        this.siteConfig = this.resolveEnvironment();
+        const resolved = this.resolveEnvironment(flags.env);
+        this.siteConfig = resolved.env;
+        this.projectId = resolved.projectId;
+        await this.maybeAutoRotate();
+    }
+    // Silent, best-effort: a stale app password still works, so a failed rotation attempt
+    // (offline, site down) just tries again on the next command instead of blocking this one.
+    // `dryRun` is excluded since rotating writes a new credential, a real side effect a
+    // --dry-run run promises not to cause. `Rotate` overrides this to a no-op: its own `run()`
+    // already rotates unconditionally, so the background check would only redo the same work.
+    async maybeAutoRotate() {
+        if (this.dryRun)
+            return;
+        const { token } = this.siteConfig;
+        if (!token || !isAppPasswordStale(this.siteConfig.addedAt))
+            return;
+        try {
+            const rotated = await rotateAppPassword({ ...this.siteConfig, token });
+            this.siteConfig = rotated;
+            configManager.setEnvironment(this.projectId, rotated.name, rotated);
+        }
+        catch {
+            // swallowed: see comment above
+        }
+    }
+    // Orphan cleanup shared by every pull command (see Push Deletion Rules in the product docs):
+    // in a TTY the list is shown and confirmed first (Enter accepts), --yes skips the prompt, and
+    // outside a TTY the files are removed with a warning, the behavior scripts relied on before
+    // the confirmation existed.
+    async removeOrphanedFiles(dir, orphans, reason) {
+        if (orphans.length === 0)
+            return;
+        const description = `${orphans.length} local file${orphans.length === 1 ? '' : 's'} ${reason}: ${orphans.join(', ')}`;
+        if (!this.yes && isInteractive()) {
+            const proceed = await confirm({ default: true, message: `Remove ${description}?` });
+            if (!proceed) {
+                this.log(`Kept ${description}`);
+                return;
+            }
+        }
+        for (const file of orphans)
+            await rm(join(dir, file), { force: true });
+        // Non-interactive removals (no TTY, CI) keep the original warn so existing
+        // scripts that parse stderr or check exit status are not broken. Confirmed
+        // interactive removals are intentional, so log() is appropriate.
+        if (this.yes || isInteractive()) {
+            this.log(`Removed ${description}`);
+        }
+        else {
+            this.warn(`Removed ${description}`);
+        }
     }
     resolveAcfPath(override) {
         if (override)
@@ -50,6 +118,11 @@ export class LoopressCommand extends Command {
             return override;
         return join(this.rootDir, this.localConfig.formDir ?? 'forms');
     }
+    resolvePagePath(override) {
+        if (override)
+            return override;
+        return join(this.rootDir, this.localConfig.pageDir ?? 'pages');
+    }
     resolveSeoPath(override) {
         if (override)
             return override;
@@ -60,29 +133,47 @@ export class LoopressCommand extends Command {
             return override;
         return join(this.rootDir, this.localConfig.snippetsDir ?? 'snippets');
     }
-    resolveEnvironment() {
+    pickEnvironment(project, envName) {
+        const env = project.environments[envName];
+        if (!env) {
+            this.error(`Environment "${envName}" not found in project "${project.name}". Available: ${Object.keys(project.environments).join(', ')}`);
+        }
+        return env;
+    }
+    resolveEnvironment(envName) {
         if (this.localConfig.projectId) {
-            const project = configManager.getProject(this.localConfig.projectId);
+            const { projectId } = this.localConfig;
+            const project = configManager.getProject(projectId);
             if (!project) {
-                this.error(`Project "${this.localConfig.projectId}" (from loopress.json) not found. Run \`lps project config\` to configure it.`);
+                this.error(`Project "${projectId}" (from loopress.json) not found. Run \`lps project config\` to configure it.`);
             }
             const envNames = Object.keys(project.environments);
             if (envNames.length === 0) {
                 this.error(`Project "${project.name}" has no environments configured. Run \`lps project config\` to add one.`);
             }
+            if (envName)
+                return { env: this.pickEnvironment(project, envName), projectId };
             if (envNames.length === 1) {
-                return project.environments[envNames[0]];
+                return { env: project.environments[envNames[0]], projectId };
             }
             const current = configManager.getCurrentProject();
-            const currentEnv = current?.id === this.localConfig.projectId ? configManager.getCurrentEnv() : null;
+            const currentEnv = current?.id === projectId ? configManager.getCurrentEnv() : null;
             if (!currentEnv) {
                 this.error(`Project "${project.name}" has multiple environments. Run \`lps project switch\` to pick one.`);
             }
-            return currentEnv;
+            return { env: currentEnv, projectId };
+        }
+        if (envName) {
+            const current = configManager.getCurrentProject();
+            if (!current) {
+                this.error('No project configured. Run `lps project config` first.');
+            }
+            return { env: this.pickEnvironment(current, envName), projectId: current.id };
         }
         const env = configManager.getCurrentEnv();
-        if (env)
-            return env;
+        const current = configManager.getCurrentProject();
+        if (env && current)
+            return { env, projectId: current.id };
         this.error('No environment configured. Run `lps project config` first.');
     }
 }

package/dist/lib/bootstrap-full-install.d.ts

@@ -0,0 +1,10 @@
+import { WpClient } from './wp-client.js';
+/**
+ * Installs and activates Loopress Full on a site that doesn't have it yet: downloads the
+ * latest release zip, creates a temporary admin (the only way to get `install_plugins` from
+ * just an app password), drives the wp-admin upload UI headlessly, then removes the temp
+ * account. Cleanup always runs, whether the install succeeded or not: the temp account never
+ * stays alive waiting on a human, the fallback for a failed install is manual instructions
+ * using the real user's own credentials, not the temp account.
+ */
+export declare function bootstrapLoopressFull(wp: WpClient, siteUrl: string, log: (message: string) => void): Promise<void>;

package/dist/lib/bootstrap-full-install.js

@@ -0,0 +1,66 @@
+import { launchLocalBrowser } from './browser-launch.js';
+import { downloadLatestFullZip } from './github-release.js';
+import { createTempAdmin, deleteTempAdmin } from './temp-admin.js';
+/**
+ * Installs and activates Loopress Full on a site that doesn't have it yet: downloads the
+ * latest release zip, creates a temporary admin (the only way to get `install_plugins` from
+ * just an app password), drives the wp-admin upload UI headlessly, then removes the temp
+ * account. Cleanup always runs, whether the install succeeded or not: the temp account never
+ * stays alive waiting on a human, the fallback for a failed install is manual instructions
+ * using the real user's own credentials, not the temp account.
+ */
+export async function bootstrapLoopressFull(wp, siteUrl, log) {
+    log('Downloading the latest Loopress Full release...');
+    const zipPath = await downloadLatestFullZip();
+    log('Creating a temporary admin account to install it...');
+    const admin = await createTempAdmin(wp);
+    let installError;
+    try {
+        log('Installing and activating Loopress Full...');
+        await runBrowserInstall(admin, siteUrl, zipPath);
+    }
+    catch (error) {
+        installError = error;
+    }
+    if (!installError) {
+        log('Loopress Full installed and activated.');
+    }
+    log('Removing the temporary admin account...');
+    let cleanupError;
+    try {
+        await deleteTempAdmin(wp, admin);
+    }
+    catch (error) {
+        cleanupError = error;
+    }
+    const manualFallback = `Install it manually: upload ${zipPath} at ${siteUrl}/wp-admin/plugin-install.php?tab=upload`;
+    if (installError && cleanupError) {
+        throw new Error(`Could not install Loopress Full automatically, and the temporary admin account could not be removed (${cleanupError.message}). ${manualFallback}`, { cause: installError });
+    }
+    if (cleanupError)
+        throw cleanupError;
+    if (installError) {
+        throw new Error(`Could not install Loopress Full automatically. ${manualFallback}`, { cause: installError });
+    }
+}
+async function runBrowserInstall(admin, siteUrl, zipPath) {
+    const browser = await launchLocalBrowser();
+    try {
+        const page = await browser.newPage();
+        await page.goto(`${siteUrl}/wp-login.php`, { waitUntil: 'domcontentloaded' });
+        await page.fill('#user_login', admin.username);
+        await page.fill('#user_pass', admin.password);
+        await Promise.all([page.waitForLoadState('domcontentloaded'), page.click('#wp-submit')]);
+        await page.goto(`${siteUrl}/wp-admin/plugin-install.php?tab=upload`, { waitUntil: 'domcontentloaded' });
+        await page.setInputFiles('#pluginzip', zipPath);
+        await Promise.all([page.waitForLoadState('domcontentloaded'), page.click('input[name="install-plugin-submit"]')]);
+        // The activate link only appears after a successful install; its absence (a moved
+        // selector, DISALLOW_FILE_MODS, an unexpected wp-admin state) means the install didn't
+        // go through, not that activation is a separate optional step.
+        const activateLink = await page.waitForSelector('a[href*="action=activate"]', { timeout: 15_000 });
+        await Promise.all([page.waitForLoadState('domcontentloaded'), activateLink.click()]);
+    }
+    finally {
+        await browser.close();
+    }
+}

package/dist/lib/browser-launch.d.ts

@@ -0,0 +1,8 @@
+import { type Browser } from 'playwright-core';
+/**
+ * Launches a locally installed Chrome/Edge/Chromium via `playwright-core`, which ships no
+ * bundled browser (unlike `playwright`, ~300MB of Chromium): it drives whatever's already on
+ * the machine, tried in this order. Always headless: this flow has no click for a human to
+ * make, so there's nothing a visible window would let anyone do differently.
+ */
+export declare function launchLocalBrowser(): Promise<Browser>;

package/dist/lib/browser-launch.js

@@ -0,0 +1,20 @@
+import { chromium } from 'playwright-core';
+const CHANNELS = ['chrome', 'msedge', 'chromium'];
+/**
+ * Launches a locally installed Chrome/Edge/Chromium via `playwright-core`, which ships no
+ * bundled browser (unlike `playwright`, ~300MB of Chromium): it drives whatever's already on
+ * the machine, tried in this order. Always headless: this flow has no click for a human to
+ * make, so there's nothing a visible window would let anyone do differently.
+ */
+export async function launchLocalBrowser() {
+    let lastError;
+    for (const channel of CHANNELS) {
+        try {
+            return await chromium.launch({ channel, headless: true });
+        }
+        catch (error) {
+            lastError = error;
+        }
+    }
+    throw new Error('No local Chrome, Edge, or Chromium install found. Install one of these browsers to install Loopress Full automatically, or install it manually from wp-admin.', { cause: lastError });
+}

package/dist/lib/find-orphaned-files.d.ts

@@ -0,0 +1,7 @@
+export interface OrphanMatcher {
+    extensions: string[];
+    key(base: string): null | string;
+}
+export declare function findOrphanedFiles(dir: string, keep: Set<string>, matcher: OrphanMatcher): Promise<string[]>;
+export declare function numericPrefixKey(base: string): null | string;
+export declare function basenameKey(base: string): string;

package/dist/lib/find-orphaned-files.js

@@ -0,0 +1,29 @@
+import { readdir } from 'node:fs/promises';
+import { extname } from 'node:path';
+export async function findOrphanedFiles(dir, keep, matcher) {
+    let files;
+    try {
+        files = await readdir(dir);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+    return files.filter((file) => {
+        const ext = extname(file);
+        if (!matcher.extensions.includes(ext))
+            return false;
+        const key = matcher.key(file.slice(0, -ext.length));
+        return key !== null && !keep.has(key);
+    });
+}
+// The `<id>-<slug>.*` filename convention: the numeric prefix is the identity.
+export function numericPrefixKey(base) {
+    const match = /^(\d+)-/.exec(base);
+    return match?.[1] ?? null;
+}
+// The `<key>.<ext>` filename convention: the whole basename is the identity.
+export function basenameKey(base) {
+    return base;
+}

package/dist/lib/github-release.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Downloads `loopress-full.zip` from the most recent `wordpress-plugin@*` release of
+ * `loopress/loopress`, returning the local path to the downloaded file.
+ *
+ * `releases/latest` isn't used on purpose: this repo's releases interleave
+ * `wordpress-plugin@X.Y.Z` and `@loopress/cli@X.Y.Z` tags, so "latest" can be a CLI release
+ * with no plugin assets at all. Every `wordpress-plugin@*` release always ships both
+ * `loopress-full.zip` and `loopress-light.zip`, so the asset is matched by exact name, not by
+ * "the one zip asset".
+ */
+export declare function downloadLatestFullZip(): Promise<string>;

package/dist/lib/github-release.js

@@ -0,0 +1,37 @@
+import got from 'got';
+import { createWriteStream } from 'node:fs';
+import { mkdtemp } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { pipeline } from 'node:stream/promises';
+const REPO = 'loopress/loopress';
+const RELEASE_TAG_PATTERN = /^wordpress-plugin@/;
+const ASSET_NAME = 'loopress-full.zip';
+/**
+ * Downloads `loopress-full.zip` from the most recent `wordpress-plugin@*` release of
+ * `loopress/loopress`, returning the local path to the downloaded file.
+ *
+ * `releases/latest` isn't used on purpose: this repo's releases interleave
+ * `wordpress-plugin@X.Y.Z` and `@loopress/cli@X.Y.Z` tags, so "latest" can be a CLI release
+ * with no plugin assets at all. Every `wordpress-plugin@*` release always ships both
+ * `loopress-full.zip` and `loopress-light.zip`, so the asset is matched by exact name, not by
+ * "the one zip asset".
+ */
+export async function downloadLatestFullZip() {
+    const releases = await got(`https://api.github.com/repos/${REPO}/releases`, {
+        headers: { accept: 'application/vnd.github+json', 'user-agent': 'loopress-cli' },
+        searchParams: { 'per_page': 30 },
+    }).json();
+    const pluginRelease = releases.find((release) => RELEASE_TAG_PATTERN.test(release.tag_name));
+    if (!pluginRelease) {
+        throw new Error(`No "wordpress-plugin@*" release found in ${REPO}.`);
+    }
+    const asset = pluginRelease.assets.find((candidate) => candidate.name === ASSET_NAME);
+    if (!asset) {
+        throw new Error(`Release "${pluginRelease.tag_name}" has no "${ASSET_NAME}" asset.`);
+    }
+    const dir = await mkdtemp(join(tmpdir(), 'lps-loopress-full-'));
+    const zipPath = join(dir, ASSET_NAME);
+    await pipeline(got.stream(asset.browser_download_url), createWriteStream(zipPath));
+    return zipPath;
+}

package/dist/lib/interactive.d.ts

@@ -0,0 +1 @@
+export declare function isInteractive(): boolean;

package/dist/lib/interactive.js

@@ -0,0 +1,7 @@
+// Whether prompts can be shown at all: a real terminal on both ends, and not a CI runner.
+// CI=1 with a pseudo-TTY still counts as non-interactive, which is what CI users expect.
+// Every command that prompts routes its decision through this so the CLI never hangs on a
+// question nobody can answer.
+export function isInteractive() {
+    return Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY) && !process.env.CI;
+}

package/dist/lib/load-files.d.ts

@@ -0,0 +1,5 @@
+export declare function loadFiles<T>(dir: string, options: {
+    extension: string;
+    onSkip(message: string): void;
+    parse(raw: string, filePath: string): T;
+}): Promise<T[]>;

package/dist/lib/load-files.js

@@ -0,0 +1,31 @@
+import { readdir, readFile } from 'node:fs/promises';
+import { extname, join } from 'node:path';
+// Loads every `<extension>` file of a flat directory through `parse`. One file is read in
+// isolation: a corrupted or hand-broken file (unreadable, bad JSON, failed validation) must
+// only skip that file, never abort loading the rest of the directory, so `parse` throwing is
+// reported through `onSkip` and the loop moves on. ENOENT on the directory itself means
+// "nothing to load", not an error.
+export async function loadFiles(dir, options) {
+    let entries;
+    try {
+        entries = await readdir(dir);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+    const items = [];
+    for (const entry of entries) {
+        if (extname(entry) !== options.extension)
+            continue;
+        const filePath = join(dir, entry);
+        try {
+            items.push(options.parse(await readFile(filePath, 'utf8'), filePath));
+        }
+        catch (error) {
+            options.onSkip(`Skipping "${filePath}": ${error.message}`);
+        }
+    }
+    return items;
+}

package/dist/lib/plugin-detection.d.ts

@@ -0,0 +1,8 @@
+import { WpClient } from './wp-client.js';
+/**
+ * Checks `wp/v2/plugins` directly rather than through `parseInstalledPlugins`
+ * (`src/utils/plugins.ts`), which deliberately filters Loopress's own plugin slugs out of its
+ * result so `plugin push` never tries to manage itself. This is the one place that needs to
+ * see Loopress Full itself.
+ */
+export declare function isLoopressFullActive(wp: WpClient): Promise<boolean>;

package/dist/lib/plugin-detection.js

@@ -0,0 +1,11 @@
+const FULL_PLUGIN_PREFIX = 'loopress-full/';
+/**
+ * Checks `wp/v2/plugins` directly rather than through `parseInstalledPlugins`
+ * (`src/utils/plugins.ts`), which deliberately filters Loopress's own plugin slugs out of its
+ * result so `plugin push` never tries to manage itself. This is the one place that needs to
+ * see Loopress Full itself.
+ */
+export async function isLoopressFullActive(wp) {
+    const plugins = await wp.get('wp/v2/plugins');
+    return plugins.some((plugin) => plugin.plugin.startsWith(FULL_PLUGIN_PREFIX) && plugin.status === 'active');
+}

package/dist/lib/push-command.d.ts

@@ -1,6 +1,13 @@
 import { LoopressCommand } from './base.js';
 export declare abstract class PushCommand extends LoopressCommand {
+    protected failedCount: number;
+    private refusedByGuard;
     catch(err: Error): Promise<void>;
+    protected guardProductionPush(): Promise<void>;
+    init(): Promise<void>;
     protected recordDeployment(status: 'failure' | 'success'): Promise<void>;
     protected recordSuccess(): Promise<void>;
+    protected reportTaskFailure(message: string, error: unknown, task?: {
+        output: string;
+    }): never;
 }

package/dist/lib/push-command.js

@@ -1,14 +1,39 @@
+import { confirm } from '@inquirer/prompts';
 import got from 'got';
 import { authManager } from '../config/auth.manager.js';
+import { API_URL } from './api-client.js';
 import { LoopressCommand } from './base.js';
-const API_URL = process.env.LPS_API_URL ?? 'https://api.loopress.dev';
+import { isInteractive } from './interactive.js';
 export class PushCommand extends LoopressCommand {
+    failedCount = 0;
+    // Refusals of the production guard never reach the site, so they must not pollute the
+    // deployment history with failure records.
+    refusedByGuard = false;
     async catch(err) {
-        if (!this.dryRun && this.siteConfig) {
+        if (!this.dryRun && !this.refusedByGuard && this.siteConfig) {
             await this.recordDeployment('failure');
         }
         return super.catch(err);
     }
+    // Pushing to an environment named "production" needs explicit intent: a TTY confirmation
+    // (Enter accepts), or --yes in scripts and CI. Dry runs are exempt, they change nothing.
+    async guardProductionPush() {
+        if (this.siteConfig.name.toLowerCase() !== 'production' || this.dryRun || this.yes)
+            return;
+        if (!isInteractive()) {
+            this.refusedByGuard = true;
+            this.error('Target environment is "production". Pass --yes to confirm the push in a non-interactive run.');
+        }
+        const proceed = await confirm({ default: true, message: `Push to production (${this.siteConfig.url})?` });
+        if (!proceed) {
+            this.refusedByGuard = true;
+            this.error('Aborted.');
+        }
+    }
+    async init() {
+        await super.init();
+        await this.guardProductionPush();
+    }
     async recordDeployment(status) {
         const token = process.env.LOOPRESS_TOKEN ?? authManager.getAuth()?.token ?? null;
         if (!token)
@@ -28,4 +53,17 @@ export class PushCommand extends LoopressCommand {
         if (!this.dryRun)
             await this.recordDeployment('success');
     }
+    // Reports one failed Listr task: status lines go through `task.output` when running inside a
+    // Listr renderer (this.warn would race with the repaint), and fall back to `this.warn` when
+    // called without a task (e.g. directly in tests). Rethrowing is what lets Listr mark the task
+    // failed (red cross) instead of completed; `exitOnError: false` on the list still lets sibling
+    // tasks run, and the accumulated `failedCount` drives the command's final "N failed" error.
+    reportTaskFailure(message, error, task) {
+        if (task)
+            task.output = message;
+        else
+            this.warn(`  ${message}`);
+        this.failedCount++;
+        throw error;
+    }
 }

package/dist/lib/rotate-app-password.d.ts

@@ -0,0 +1,6 @@
+import { EnvironmentConfig } from '../types/config.js';
+export declare const APP_PASSWORD_MAX_AGE_MS: number;
+export declare function isAppPasswordStale(addedAt: string): boolean;
+export declare function rotateAppPassword(env: EnvironmentConfig & {
+    token: string;
+}): Promise<EnvironmentConfig>;