@loopress/cli 0.24.0 → 0.24.1

package/dist/commands/api/rm.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("../../lib/php-files-command.js").CommandClass<import("../../lib/php-files-command.js").RmFilesCommand>;
+export default _default;

package/dist/commands/api/rm.js

@@ -0,0 +1,2 @@
+import { API_FILES_RESOURCE, resourceRmCommand } from '../../lib/php-files-command.js';
+export default resourceRmCommand(API_FILES_RESOURCE);

package/dist/commands/composer/push.d.ts

@@ -1,6 +1,8 @@
 import { PushCommand } from '../../lib/push-command.js';
+import { type LockDriftEntry } from '../../utils/plugin-sync.js';
 type PushResult = {
     hasLock: boolean;
+    lockDrift: LockDriftEntry[];
     packageCount: number;
     status: 'dry-run' | 'success';
 };
@@ -14,5 +16,6 @@ export default class ComposerPush extends PushCommand {
         'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<PushResult>;
+    private reportLockDrift;
 }
 export {};

package/dist/commands/composer/push.js

@@ -4,7 +4,7 @@ import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { PushCommand } from '../../lib/push-command.js';
 import { isTimeoutError } from '../../lib/wp-client.js';
-import { parseCollisions, SYNC_TIMEOUT_MS } from '../../utils/plugin-sync.js';
+import { parseCollisions, SYNC_TIMEOUT_MS, } from '../../utils/plugin-sync.js';
 // Split a composer.json `require` map into the three intent namespaces the sync endpoint
 // understands. `composer/installers` is owned by the server scaffold, never sent.
 function toIntent(require) {
@@ -25,7 +25,7 @@ function toIntent(require) {
     return intent;
 }
 export default class ComposerPush extends PushCommand {
-    static description = 'Push composer.json (and composer.lock, if present) to WordPress and run Composer';
+    static description = 'Push composer.json to WordPress and run Composer to resolve and install dependencies';
     static enableJsonFlag = true;
     static examples = ['$ lps composer push', '$ lps composer push --dry-run'];
     static flags = {
@@ -47,14 +47,16 @@ export default class ComposerPush extends PushCommand {
         const packageCount = Object.keys(require).length;
         const intent = toIntent(require);
         const hasLock = existsSync(composerLockPath);
+        // The server resolves composer.json itself; it never installs from this lock (a crafted
+        // lock could point package downloads at arbitrary hosts). It is sent only so the server
+        // can report which pinned versions its own resolution moved. `lps composer pull` brings
+        // the resolved lock back.
         const lock = hasLock ? await readFile(composerLockPath, 'utf8') : null;
         this.log(`Pushing composer.json (${packageCount} ${packageCount === 1 ? 'package' : 'packages'}) to ${url}`);
         if (lock)
-            this.log('  + composer.lock included (reproducible install)');
-        else
-            this.warn('No composer.lock found. The server will resolve versions freely.');
+            this.log('  + composer.lock sent for drift comparison (the server resolves versions from composer.json)');
         if (this.dryRun)
-            return { hasLock, packageCount, status: 'dry-run' };
+            return { hasLock, lockDrift: [], packageCount, status: 'dry-run' };
         this.log('Running Composer on the server, this can take a few minutes...');
         let response;
         try {
@@ -72,7 +74,22 @@ export default class ComposerPush extends PushCommand {
         if (response.output.trim())
             this.log(response.output.trim());
         this.log('Composer run completed on the server.');
+        const lockDrift = response.lockDrift ?? [];
+        this.reportLockDrift(lockDrift);
         await this.recordSuccess();
-        return { hasLock, packageCount, status: 'success' };
+        return { hasLock, lockDrift, packageCount, status: 'success' };
+    }
+    // The server resolves composer.json from scratch and never installs from the uploaded lock,
+    // so a project that committed a lock can see versions move. Spell out exactly what changed
+    // and point at `lps composer pull` to bring the resolved lock back locally.
+    reportLockDrift(lockDrift) {
+        if (lockDrift.length === 0)
+            return;
+        this.log('');
+        this.log(`The server resolved ${lockDrift.length} ${lockDrift.length === 1 ? 'package' : 'packages'} to a different version than your local composer.lock:`);
+        for (const { from, name, to } of lockDrift) {
+            this.log(`  ${name}: ${from ?? '(absent)'} -> ${to ?? '(removed)'}`);
+        }
+        this.log('Run `lps composer pull` to update your local composer.json and composer.lock.');
     }
 }

package/dist/commands/form/push.d.ts

@@ -6,9 +6,11 @@ export default class Push extends PushCommand {
     static description: string;
     static examples: string[];
     static flags: {
+        'allow-notifications': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
+    private allowNotifications;
     run(): Promise<void>;
     private ensureCanonicalFilename;
     private loadFiles;

package/dist/commands/form/push.js

@@ -1,4 +1,4 @@
-import { Args } from '@oclif/core';
+import { Args, Flags } from '@oclif/core';
 import { readFile, rename } from 'node:fs/promises';
 import { dirname, extname, join } from 'node:path';
 import { PushCommand } from '../../lib/push-command.js';
@@ -12,15 +12,21 @@ export default class Push extends PushCommand {
         path: Args.string({ description: 'Path to forms directory (overrides project config)' }),
     };
     static description = 'Push forms to WordPress. Local files created or updated remotely are renamed on disk to the `<id>-<slug>.json` convention.';
-    static examples = ['$ lps form push'];
+    static examples = ['$ lps form push', '$ lps form push --allow-notifications'];
     static flags = {
         ...PushCommand.dryRunFlag,
         ...PushCommand.yesFlag,
+        'allow-notifications': Flags.boolean({
+            default: false,
+            description: "Also push each form's notification and confirmation settings (recipients, sender, messages). Off by default: the server keeps its own so a stray push can't redirect submissions.",
+        }),
     };
+    allowNotifications = false;
     async run() {
-        const { args } = await this.parse(Push);
+        const { args, flags } = await this.parse(Push);
         const { url } = this.siteConfig;
         const path = this.resolveFormPath(args.path);
+        this.allowNotifications = flags['allow-notifications'];
         this.log(`Pushing forms to ${url}`);
         this.log(`Forms path: ${path}`);
         const files = await this.loadFiles(path);
@@ -78,9 +84,10 @@ export default class Push extends PushCommand {
         }
         try {
             const id = getFormId(data);
+            const payload = this.allowNotifications ? { ...data, allowNotifications: true } : data;
             const { body, created } = await putOrCreate(this.wp, {
                 id,
-                payload: data,
+                payload,
                 postEndpoint: FORM_ENDPOINT,
                 putEndpoint: (formId) => `${FORM_ENDPOINT}/${formId}`,
             });

package/dist/commands/hook/rm.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("../../lib/php-files-command.js").CommandClass<import("../../lib/php-files-command.js").RmFilesCommand>;
+export default _default;

package/dist/commands/hook/rm.js

@@ -0,0 +1,2 @@
+import { HOOK_FILES_RESOURCE, resourceRmCommand } from '../../lib/php-files-command.js';
+export default resourceRmCommand(HOOK_FILES_RESOURCE);

package/dist/commands/login.js

@@ -13,8 +13,9 @@ export default class Login extends Command {
     }
     async waitForCallback() {
         return waitForLocalCallback({
-            buildUrl(callbackBaseUrl) {
-                const callbackUrl = encodeURIComponent(`${callbackBaseUrl}/callback`);
+            allowedOrigins: [CONSOLE_URL],
+            buildUrl(callbackBaseUrl, state) {
+                const callbackUrl = encodeURIComponent(`${callbackBaseUrl}/callback?state=${state}`);
                 return `${CONSOLE_URL}/cli-auth?callbackUrl=${callbackUrl}`;
             },
             handleRequest(url, { resolveWithPage, respondBadRequest }) {

package/dist/commands/seo/push.d.ts

@@ -6,9 +6,11 @@ export default class Push extends PushCommand {
     static description: string;
     static examples: string[];
     static flags: {
+        'allow-external-redirects': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
+    private allowExternalRedirects;
     run(): Promise<void>;
     private jsonFilesIn;
     private pushPostMeta;

package/dist/commands/seo/push.js

@@ -1,4 +1,4 @@
-import { Args } from '@oclif/core';
+import { Args, Flags } from '@oclif/core';
 import { readFile, rm, writeFile } from 'node:fs/promises';
 import { dirname, extname, join } from 'node:path';
 import { PushCommand } from '../../lib/push-command.js';
@@ -11,15 +11,21 @@ export default class Push extends PushCommand {
         path: Args.string({ description: 'Path to SEO directory (overrides project config)' }),
     };
     static description = 'Push SEO settings, post meta, and redirects to WordPress. Local redirect files created remotely are renamed on disk to the `<id>-<slug>` convention. Fails clearly per file if the active SEO plugin does not support redirects.';
-    static examples = ['$ lps seo push'];
+    static examples = ['$ lps seo push', '$ lps seo push --allow-external-redirects'];
     static flags = {
         ...PushCommand.dryRunFlag,
         ...PushCommand.yesFlag,
+        'allow-external-redirects': Flags.boolean({
+            default: false,
+            description: 'Allow pushing a redirect whose target points off this site. Off by default: the server rejects an off-site `urlTo` so a stray push can\'t 301 traffic away.',
+        }),
     };
+    allowExternalRedirects = false;
     async run() {
-        const { args } = await this.parse(Push);
+        const { args, flags } = await this.parse(Push);
         const { url } = this.siteConfig;
         const path = this.resolveSeoPath(args.path);
+        this.allowExternalRedirects = flags['allow-external-redirects'];
         this.log(`Pushing SEO configuration to ${url}`);
         this.log(`SEO path: ${path}`);
         await this.pushSettings(path);
@@ -74,7 +80,13 @@ export default class Push extends PushCommand {
         }
         try {
             const redirect = JSON.parse(await readFile(filePath, 'utf8'));
-            const payload = { headerCode: redirect.headerCode, sources: redirect.sources, status: redirect.status, urlTo: redirect.urlTo };
+            const payload = {
+                headerCode: redirect.headerCode,
+                sources: redirect.sources,
+                status: redirect.status,
+                urlTo: redirect.urlTo,
+                ...(this.allowExternalRedirects && { allowExternal: true }),
+            };
             // The id recorded locally may not exist on this site (e.g. a fresh install): putOrCreate
             // falls back to POST instead of failing, adopting whatever id the site assigns.
             const { body, created } = await putOrCreate(this.wp, {

package/dist/hooks/finally.js

@@ -1,4 +1,4 @@
-import { isTelemetryDisabled, redactArgv, resolveEnvironment, runtimeContext, SENTRY_DSN, } from '../lib/sentry.js';
+import { isTelemetryDisabled, redactArgv, resolveEnvironment, runtimeContext, scrubEvent, SENTRY_DSN, } from '../lib/sentry.js';
 // oclif has no `command_error` hook (checked @oclif/core@4.11.11's hooks.d.ts). `finally`
 // is the closest equivalent: it always runs at the end of the CLI lifecycle and carries
 // the error, if any, so it's where we report crashes before the process exits.
@@ -12,6 +12,9 @@ const hook = async function (options) {
     try {
         const Sentry = await import('@sentry/node');
         Sentry.init({
+            // Strip the site URL and the raw server response body out of every event. A WordPress
+            // request failure otherwise carries both in its message (F26).
+            beforeSend: scrubEvent,
             dsn: SENTRY_DSN,
             environment: resolveEnvironment(),
             release: this.config.version,

package/dist/lib/local-callback-server.d.ts

@@ -7,9 +7,22 @@ export type CallbackHelpers<T> = {
 /**
  * Sends the user to a URL in their browser and catches the resulting redirect on a short-lived
  * local server; this factors out the server setup, timeout, and browser-opening boilerplate.
+ *
+ * The loopback server is unauthenticated, so any local process or web page open during the wait
+ * could otherwise POST forged credentials to it (RFC 8252 section 8.9). Two guards close that:
+ *
+ * - a 32-byte `state` generated here, threaded into the authorize URL by `buildUrl`, and required
+ *   back (constant-time compare) on any request that carries credentials;
+ * - an `Origin` allowlist: a browser sends `Origin` on the relay's cross-site form POST, so a
+ *   stray page's POST (carrying its own origin) is rejected. Top-level navigations send no
+ *   `Origin` and are allowed, which is why `state` is the primary control.
+ *
+ * The first request that looks like a callback (valid or not) shuts the server down, so a
+ * failed guess gets no second try within the window.
  */
 export declare function waitForLocalCallback<T>(options: {
-    buildUrl: (callbackBaseUrl: string) => string;
+    allowedOrigins: string[];
+    buildUrl: (callbackBaseUrl: string, state: string) => string;
     handleRequest: (url: URL, helpers: CallbackHelpers<T>) => void;
     log: (message: string) => void;
     openingMessage: string;

package/dist/lib/local-callback-server.js

@@ -1,4 +1,5 @@
 import { Buffer } from 'node:buffer';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
 import { createServer } from 'node:http';
 import { openBrowser } from './open-browser.js';
 async function readBody(req) {
@@ -10,12 +11,31 @@ async function readBody(req) {
 function parseFormData(body) {
     return Object.fromEntries(new URLSearchParams(body));
 }
+/** Constant-time compare that also tolerates a length mismatch without throwing. */
+function safeEqual(a, b) {
+    const bufferA = Buffer.from(a);
+    const bufferB = Buffer.from(b);
+    return bufferA.length === bufferB.length && timingSafeEqual(bufferA, bufferB);
+}
 /**
  * Sends the user to a URL in their browser and catches the resulting redirect on a short-lived
  * local server; this factors out the server setup, timeout, and browser-opening boilerplate.
+ *
+ * The loopback server is unauthenticated, so any local process or web page open during the wait
+ * could otherwise POST forged credentials to it (RFC 8252 section 8.9). Two guards close that:
+ *
+ * - a 32-byte `state` generated here, threaded into the authorize URL by `buildUrl`, and required
+ *   back (constant-time compare) on any request that carries credentials;
+ * - an `Origin` allowlist: a browser sends `Origin` on the relay's cross-site form POST, so a
+ *   stray page's POST (carrying its own origin) is rejected. Top-level navigations send no
+ *   `Origin` and are allowed, which is why `state` is the primary control.
+ *
+ * The first request that looks like a callback (valid or not) shuts the server down, so a
+ * failed guess gets no second try within the window.
  */
 export async function waitForLocalCallback(options) {
     const timeoutMs = options.timeoutMs ?? 5 * 60 * 1000;
+    const state = randomBytes(32).toString('hex');
     return new Promise((resolve, reject) => {
         function finish(res, page) {
             res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
@@ -23,10 +43,29 @@ export async function waitForLocalCallback(options) {
             clearTimeout(timer);
             server.close();
         }
+        function rejectRequest(res, message) {
+            res.writeHead(403, { 'Content-Type': 'text/plain' });
+            res.end(message);
+            clearTimeout(timer);
+            server.close();
+            reject(new Error(message));
+        }
         async function handleIncoming(req, res) {
             try {
                 const url = new URL(req.url ?? '/', 'http://localhost');
                 const body = req.method === 'POST' ? parseFormData(await readBody(req)) : {};
+                const looksLikeCallback = url.searchParams.has('state') || Object.keys(body).length > 0;
+                if (looksLikeCallback) {
+                    const { origin } = req.headers;
+                    if (origin !== undefined && !options.allowedOrigins.includes(origin)) {
+                        rejectRequest(res, 'Rejected a cross-origin request to the login callback server.');
+                        return;
+                    }
+                    if (!safeEqual(url.searchParams.get('state') ?? '', state)) {
+                        rejectRequest(res, 'Rejected a login callback with a missing or invalid state value.');
+                        return;
+                    }
+                }
                 options.handleRequest(url, {
                     rejectWithPage(page, error) {
                         finish(res, page);
@@ -61,7 +100,7 @@ export async function waitForLocalCallback(options) {
         }, timeoutMs);
         server.listen(0, '127.0.0.1', () => {
             const { port } = server.address();
-            const targetUrl = options.buildUrl(`http://localhost:${port}`);
+            const targetUrl = options.buildUrl(`http://localhost:${port}`, state);
             options.log(options.openingMessage);
             options.log(`\nIf it doesn't open automatically, visit:\n${targetUrl}\n`);
             openBrowser(targetUrl);

package/dist/lib/php-files-command.d.ts

@@ -22,12 +22,16 @@ export type PhpFilesResource = {
     pathNoun: string;
     pullDescription: string;
     pushDescription: string;
+    rmDescription: string;
 };
-type PhpFile = {
-    content: string;
+type RemotePhpFile = {
+    content?: string;
+    error?: string;
     filename: string;
+    public?: boolean;
 };
 type PushResult = {
+    pruned: string[];
     pushed: string[];
     status: 'dry-run' | 'success';
 };
@@ -36,6 +40,11 @@ type PullResult = {
     pulled: string[];
     status: 'dry-run' | 'success';
 };
+type RmResult = {
+    filename: string;
+    removed: boolean;
+    status: 'aborted' | 'dry-run' | 'success';
+};
 export type CommandClass<TInstance> = new (argv: string[], config: Config) => TInstance;
 export type PushFilesCommand = Omit<PushCommand, 'run'> & {
     run(): Promise<PushResult>;
@@ -44,11 +53,15 @@ export type PullFilesCommand = Omit<LoopressCommand, 'run'> & {
     run(): Promise<PullResult>;
 };
 export type ListFilesCommand = Omit<LoopressCommand, 'run'> & {
-    run(): Promise<PhpFile[]>;
+    run(): Promise<RemotePhpFile[]>;
+};
+export type RmFilesCommand = Omit<LoopressCommand, 'run'> & {
+    run(): Promise<RmResult>;
 };
 export declare function resourcePushCommand(spec: PhpFilesResource): CommandClass<PushFilesCommand>;
 export declare function resourcePullCommand(spec: PhpFilesResource): CommandClass<PullFilesCommand>;
 export declare function resourceListCommand(spec: PhpFilesResource): CommandClass<ListFilesCommand>;
+export declare function resourceRmCommand(spec: PhpFilesResource): CommandClass<RmFilesCommand>;
 export declare const API_FILES_RESOURCE: PhpFilesResource;
 export declare const HOOK_FILES_RESOURCE: PhpFilesResource;
 export {};

package/dist/lib/php-files-command.js

@@ -1,4 +1,5 @@
-import { Args } from '@oclif/core';
+import { confirm } from '@inquirer/prompts';
+import { Args, Flags } from '@oclif/core';
 import { mkdir, writeFile } from 'node:fs/promises';
 import { dirname, join, relative, sep } from 'node:path';
 import { authManager } from '../config/auth.manager.js';
@@ -7,8 +8,10 @@ import { resolveResourceDir, RESOURCE_DIR_DEFAULTS } from '../utils/resource-dir
 import { ApiClient } from './api-client.js';
 import { LoopressCommand } from './base.js';
 import { basenameKey, findOrphanedFiles } from './find-orphaned-files.js';
+import { isInteractive } from './interactive.js';
 import { loadFiles as loadDirectoryFiles } from './load-files.js';
 import { PushCommand } from './push-command.js';
+import { isApplicative404 } from './wp-client.js';
 // Mirrors wordpress-plugin FileWriter::DECLARE_PATTERN / withGuard(): the server rejects both
 // an absent declare(strict_types=1); and one that appears more than once (it needs a single
 // unambiguous insertion point for the ABSPATH guard). Matching "exactly once" here, not just
@@ -35,10 +38,21 @@ export function resourcePushCommand(spec) {
         static args = pathArg(spec.pathNoun);
         static description = spec.pushDescription;
         static enableJsonFlag = true;
-        static examples = [`$ lps ${spec.cliName} push`, `$ lps ${spec.cliName} push --path ./${RESOURCE_DIR_DEFAULTS[spec.dirKind]}`];
-        static flags = { ...PushCommand.dryRunFlag, ...PushCommand.yesFlag };
+        static examples = [
+            `$ lps ${spec.cliName} push`,
+            `$ lps ${spec.cliName} push --path ./${RESOURCE_DIR_DEFAULTS[spec.dirKind]}`,
+            `$ lps ${spec.cliName} push --prune`,
+        ];
+        static flags = {
+            ...PushCommand.dryRunFlag,
+            ...PushCommand.yesFlag,
+            prune: Flags.boolean({
+                default: false,
+                description: `Delete server-side ${spec.noun}s not present locally after pushing`,
+            }),
+        };
         async run() {
-            const { args } = await this.parse(ResourcePush);
+            const { args, flags } = await this.parse(ResourcePush);
             const { url } = this.siteConfig;
             const path = resolveResourceDir(spec.dirKind, this.localConfig, args.path);
             this.log(`Pushing ${spec.label} to ${url}`);
@@ -46,23 +60,66 @@ export function resourcePushCommand(spec) {
             const files = await this.loadFiles(path);
             this.log(`Found ${pluralize(files.length, spec.noun)} to push`);
             const pushed = [];
+            const publicRoutes = [];
             await this.runPushTasks(files, (file) => file.filename, async (file, task) => {
-                await this.pushFile(file, task);
+                const result = await this.pushFile(file, task);
                 pushed.push(file.filename);
+                if (result?.public)
+                    publicRoutes.push(file.filename);
             });
             if (this.failedCount > 0) {
                 this.error(`${pluralize(this.failedCount, spec.noun)} failed to push.`);
             }
+            for (const route of publicRoutes) {
+                this.warn(`${route}: PUBLIC route, no authentication required. Anyone on the internet can call it. See https://loopress.dev/api/routes/#authentication-and-permissions`);
+            }
+            const pruned = flags.prune ? await this.prune(new Set(files.map((file) => file.filename))) : [];
             if (this.dryRun)
-                return { pushed, status: 'dry-run' };
+                return { pruned, pushed, status: 'dry-run' };
             await this.recordSuccess();
             await spec.afterPush?.({ filenames: pushed, siteConfig: this.siteConfig });
             this.log(`All ${spec.label} pushed.`);
-            return { pushed, status: 'success' };
+            return { pruned, pushed, status: 'success' };
         }
         async loadFiles(path) {
             return loadPhpFiles(this, path);
         }
+        // Mirror of `pull`'s local orphan cleanup, aimed at the server: any file on WordPress with
+        // no local counterpart is deleted. Opt-in (`--prune`) because it removes code from a live
+        // site. In a non-TTY without `--yes` it refuses rather than prunes: a stray local path in
+        // CI must not silently wipe production routes, and unlike `pull`'s local deletions these
+        // are not recoverable from the repo.
+        async prune(localFilenames) {
+            const remote = await this.wp.get(spec.endpoint);
+            const orphans = remote.map((file) => file.filename).filter((name) => !localFilenames.has(name));
+            if (orphans.length === 0)
+                return [];
+            const summary = `${pluralize(orphans.length, spec.noun)} on ${this.siteConfig.url} not present locally: ${orphans.join(', ')}`;
+            if (this.dryRun) {
+                this.log(`[dry-run] Would prune ${summary}`);
+                return orphans;
+            }
+            if (!this.yes) {
+                if (!isInteractive()) {
+                    const count = pluralize(orphans.length, `server-side ${spec.noun}`);
+                    this.error(`--prune would delete ${count} but stdin is not a TTY. Re-run with --yes to confirm, or without --prune.`);
+                }
+                const ok = await confirm({ default: false, message: `Prune ${summary}?` });
+                if (!ok) {
+                    this.log('Kept the server-side files, nothing pruned.');
+                    return [];
+                }
+            }
+            // Sequential, like runPushTasks: keeps the "Pruned: …" lines ordered and the WordPress
+            // writes serial.
+            const deleted = [];
+            for (const filename of orphans) {
+                await this.wp.delete(`${spec.endpoint}?filename=${encodeURIComponent(filename)}`);
+                this.log(`Pruned: ${filename}`);
+                deleted.push(filename);
+            }
+            return deleted;
+        }
         async pushFile(file, task) {
             if (!spec.filenamePattern.test(file.filename)) {
                 const message = `Invalid filename "${file.filename}": ${spec.invalidFilenameHint}`;
@@ -77,7 +134,7 @@ export function resourcePushCommand(spec) {
             if (this.dryRun) {
                 if (task)
                     task.output = `[dry-run] Would push: ${file.filename}`;
-                return;
+                return undefined;
             }
             try {
                 const result = await this.wp.put(spec.endpoint, {
@@ -90,6 +147,7 @@ export function resourcePushCommand(spec) {
                             ? `Pushed: ${file.filename} (syntax check skipped, unavailable on this host)`
                             : `Pushed: ${file.filename}`;
                 }
+                return result;
             }
             catch (error) {
                 this.reportTaskFailure(`Failed to push ${file.filename}: ${error.message}`, error, task);
@@ -112,19 +170,28 @@ export function resourcePullCommand(spec) {
             this.log(`Pulling ${spec.label} from ${url}`);
             this.log(`${spec.pathLabel} path: ${path}`);
             const files = await this.wp.get(spec.endpoint);
+            // A file the server would not read back (over the size limit, see LP-SEC-02) arrives
+            // with no content: report it and leave any local copy untouched rather than overwriting
+            // it with nothing.
+            const unreadable = files.filter((file) => typeof file.content !== 'string');
+            for (const file of unreadable) {
+                this.warn(`Skipped ${file.filename}: ${file.error ?? 'the server did not return its content'}`);
+            }
+            const readable = files.filter((file) => typeof file.content === 'string');
             // A `<filename>.php` no longer present remotely was deleted on WordPress (push stays
-            // additive-only, but pull already cleans up locally, same as `snippet pull`).
+            // additive-only, but pull already cleans up locally, same as `snippet pull`). The
+            // unreadable ones still exist remotely, so keep them out of the orphan set.
             const orphans = await findOrphanedFiles(path, new Set(files.map((file) => file.filename)), {
                 extensions: ['.php'],
                 key: basenameKey,
                 recursive: true,
             });
-            const pulled = files.map((file) => file.filename);
-            await this.pullDirectory(path, files, orphans, {
+            const pulled = readable.map((file) => file.filename);
+            await this.pullDirectory(path, readable, orphans, {
                 alwaysCreateDir: true,
-                dryRunMessage: `Would pull ${pluralize(files.length, spec.noun)} to ${path}`,
+                dryRunMessage: `Would pull ${pluralize(readable.length, spec.noun)} to ${path}`,
                 orphanReason: spec.orphanReason,
-                pulledMessage: `Pulled ${pluralize(files.length, spec.noun)} to ${path}`,
+                pulledMessage: `Pulled ${pluralize(readable.length, spec.noun)} to ${path}`,
                 title: (file) => file.filename,
                 async write(file, writeDir) {
                     const filePath = join(writeDir, `${file.filename}.php`);
@@ -156,13 +223,66 @@ export function resourceListCommand(spec) {
             this.log(`Found ${pluralize(files.length, spec.noun)}:`);
             this.log('');
             for (const file of files) {
-                this.log(`  ${file.filename}`);
+                const badges = [file.public ? '[PUBLIC]' : '', file.error ? `(${file.error})` : ''].filter(Boolean).join('  ');
+                this.log(badges ? `  ${file.filename}  ${badges}` : `  ${file.filename}`);
+            }
+            if (files.some((file) => file.public)) {
+                this.log('');
+                this.warn('[PUBLIC] routes run for anyone, with no authentication. Review them.');
             }
             return files;
         }
     }
     return ResourceList;
 }
+export function resourceRmCommand(spec) {
+    class ResourceRm extends LoopressCommand {
+        static args = {
+            filename: Args.string({
+                description: `The ${spec.noun} to remove, its slug without the .php extension (e.g. "hello" or "invoice-pdf/[order_id]")`,
+                required: true,
+            }),
+        };
+        static description = spec.rmDescription;
+        static enableJsonFlag = true;
+        static examples = [`$ lps ${spec.cliName} rm hello`, `$ lps ${spec.cliName} rm hello --yes`];
+        static flags = { ...LoopressCommand.dryRunFlag, ...LoopressCommand.yesFlag };
+        async run() {
+            const { args } = await this.parse(ResourceRm);
+            const { filename } = args;
+            const { url } = this.siteConfig;
+            if (!spec.filenamePattern.test(filename)) {
+                this.error(`Invalid filename "${filename}": ${spec.invalidFilenameHint}`);
+            }
+            if (this.dryRun) {
+                this.log(`[dry-run] Would remove ${filename} from ${url}`);
+                return { filename, removed: false, status: 'dry-run' };
+            }
+            if (!this.yes) {
+                if (!isInteractive()) {
+                    this.error(`Removing ${filename} needs confirmation. Re-run with --yes.`);
+                }
+                const ok = await confirm({ default: false, message: `Remove ${filename} from ${url}?` });
+                if (!ok) {
+                    this.log('Aborted.');
+                    return { filename, removed: false, status: 'aborted' };
+                }
+            }
+            try {
+                await this.wp.delete(`${spec.endpoint}?filename=${encodeURIComponent(filename)}`);
+            }
+            catch (error) {
+                if (isApplicative404(error, 'File not found')) {
+                    this.error(`${filename} is not on ${url}.`);
+                }
+                throw error;
+            }
+            this.log(`Removed ${filename} from ${url}`);
+            return { filename, removed: true, status: 'success' };
+        }
+    }
+    return ResourceRm;
+}
 export const API_FILES_RESOURCE = {
     // Best-effort report of the current route list to the Loopress cloud, purely for console
     // visibility (US-18): the routes are already live on WordPress by this point, so this can
@@ -195,6 +315,7 @@ export const API_FILES_RESOURCE = {
     pathNoun: 'api directory',
     pullDescription: 'Pull custom API route files from WordPress',
     pushDescription: 'Push custom API route files to WordPress',
+    rmDescription: 'Remove a custom API route file from WordPress',
 };
 export const HOOK_FILES_RESOURCE = {
     cliName: 'hook',
@@ -213,4 +334,5 @@ export const HOOK_FILES_RESOURCE = {
     pathNoun: 'hooks directory',
     pullDescription: 'Pull hook files (actions, filters, cron) from WordPress',
     pushDescription: 'Push hook files (actions, filters, cron) to WordPress',
+    rmDescription: 'Remove a hook file (action, filter, cron) from WordPress',
 };

package/dist/lib/sentry.d.ts

@@ -1,3 +1,4 @@
+import type { ErrorEvent } from '@sentry/node';
 export declare const SENTRY_DSN = "https://a08dd56bfffc2a45d5b8f665e4cb8b7d@o4511586904309760.ingest.de.sentry.io/4511673275973712";
 export declare function isTelemetryDisabled(): boolean;
 export declare function resolveEnvironment(): string;
@@ -6,3 +7,5 @@ export declare function runtimeContext(): {
     os: string;
 };
 export declare function redactArgv(argv: string[]): string[];
+export declare function scrubErrorMessage(value: string): string;
+export declare function scrubEvent(event: ErrorEvent): ErrorEvent;