@loopress/cli 0.26.0 → 0.28.0

package/dist/commands/plugin/push.js

@@ -1,86 +1,104 @@
 import { Flags } from '@oclif/core';
 import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { confirmUninstall } from '../../lib/interactive.js';
 import { PushCommand } from '../../lib/push-command.js';
 import { isNotFoundError } from '../../lib/wp-client.js';
-import { isDowngrade, parseCollisions, SYNC_TIMEOUT_MS } from '../../utils/plugin-sync.js';
+import { pinActive, pinVersion, pinVersions, } from '../../types/plugin.js';
+import { toIntent, wpackagistRequire } from '../../utils/composer.js';
+import { isDowngrade, parseCollisions, SYNC_TIMEOUT_MS, } from '../../utils/plugin-sync.js';
 import { diffPlugins, lockedWpackagistSlugs, parseInstalledPlugins } from '../../utils/plugins.js';
-const IN_SYNC = { activated: [], installed: [], pinned: [], pruned: [], removed: [], status: 'in-sync' };
+import { isExactVersion } from '../../utils/version.js';
+const IN_SYNC = {
+    activated: [],
+    deactivated: [],
+    installed: [],
+    pinned: [],
+    pruned: [],
+    removed: [],
+    status: 'in-sync',
+};
 export default class Push extends PushCommand {
-    static description = 'Install plugins on WordPress to match loopress.json, pinned via Composer + WPackagist';
+    static description = 'Install plugins on WordPress to match loopress.json (or composer.json), via Composer + WPackagist';
     static enableJsonFlag = true;
     static examples = ['$ lps plugin push', '$ lps plugin push --dry-run', '$ lps plugin push --force --prune'];
     static flags = {
         ...PushCommand.dryRunFlag,
         ...PushCommand.yesFlag,
+        activate: Flags.boolean({
+            default: false,
+            description: 'composer.json projects only: activate every plugin it declares. Without it, plugins keep their current state and new ones stay inactive',
+        }),
         force: Flags.boolean({
             default: false,
             description: 'Allow downgrades and let Loopress take over plugins installed outside it (replaces their files)',
         }),
         prune: Flags.boolean({
             default: false,
-            description: 'Deactivate plugins that are active on the site but absent from loopress.json',
+            description: 'Deactivate plugins that are active on the site but absent from loopress.json (or composer.json)',
         }),
     };
     async run() {
         const { flags } = await this.parse(Push);
-        const { force, prune } = flags;
-        if (existsSync(join(process.cwd(), this.rootDir, 'composer.json'))) {
-            this.warn('This project has a composer.json, which is authoritative for plugins. Run `lps composer push` instead.');
-            return { ...IN_SYNC, status: 'composer-managed' };
-        }
-        const manifest = this.localConfig.plugins ?? {};
-        if (Object.keys(manifest).length === 0) {
-            this.error('No plugins found in loopress.json. Run `lps plugin pull` or `lps plugin add <slug>` first.');
-        }
+        const { activate, force, prune } = flags;
+        const source = await this.loadSource(activate);
+        const fromComposer = source.file === 'composer.json';
         this.log(`Pushing plugins to ${this.siteConfig.url}`);
+        if (fromComposer) {
+            this.log(`From composer.json, pushed whole (${source.packageCount} packages): themes and libraries it declares are synced too.`);
+        }
         const raw = await this.wp.get('wp/v2/plugins');
         const installed = parseInstalledPlugins(raw);
         const managed = lockedWpackagistSlugs(await this.fetchInstanceLock(), 'plugin');
-        const diff = diffPlugins(manifest, installed, managed);
-        this.guardForce(diff, force);
+        const diff = diffPlugins(source.manifest, installed, managed);
+        // composer.json records no active state: leave inactive plugins alone unless --activate.
+        const skippedActivations = fromComposer && !activate ? diff.toActivate : [];
+        if (fromComposer && !activate)
+            diff.toActivate = [];
+        this.guardForce(diff, force, source.file);
         const toPrune = prune ? diff.untrackedActive : [];
-        // A "latest" pin never shows as drift, but its newest upstream release may have moved
-        // since the last push, so a push must still run `composer update` to pick it up.
-        const hasLatestPin = Object.values(manifest).includes('latest');
-        if (!hasLatestPin && isNoop(diff, toPrune)) {
+        // A "latest" pin (or a Composer constraint) never shows as drift, but its newest upstream
+        // release may have moved since the last push, so a push must still run `composer update`.
+        const hasFloatingPin = Object.values(source.manifest).some((pin) => !isExactVersion(pinVersion(pin)));
+        if (!hasFloatingPin && isNoop(diff, toPrune)) {
             this.log('Everything is already in sync.');
+            this.logStillInactive(skippedActivations);
             return { ...IN_SYNC };
         }
         if (isNoop(diff, toPrune))
-            this.log('Refreshing plugins pinned to "latest" to their newest releases.');
+            this.log('Refreshing plugins not pinned to an exact version to their newest releases.');
         logPlan(this, diff, toPrune, force);
         if (this.dryRun) {
             return this.result(diff, { includeCollisions: true, pruned: toPrune, removed: diff.toRemove, status: 'dry-run' });
         }
         if (!(await confirmUninstall(diff.toRemove, this.yes)))
             this.error('Aborted.');
-        const deactivated = await this.deactivateEndangered(installed, diff, force);
-        // Plugins that must end up active: the ones we deactivated for the file swap (minus any
-        // being uninstalled) plus the ones the manifest wants active but that are inactive today.
-        const toReactivate = [...deactivated.filter((p) => !diff.toRemove.includes(p.slug)), ...diff.toActivate];
+        // Plugins switched off for the file swap come back on, unless loopress.json wants them inactive.
+        const deactivated = (await this.deactivateEndangered(installed, diff, force)).filter((p) => !diff.toRemove.includes(p.slug) && (fromComposer || pinActive(source.manifest[p.slug])));
         let response;
         try {
-            response = await this.sync(manifest, force);
+            response = await this.sync(source.intent, force);
         }
         catch (error) {
             // The file swap never happened, so restore the plugins we defensively deactivated
             // instead of leaving the site with them switched off.
-            await this.activate(deactivated.filter((p) => !diff.toRemove.includes(p.slug)));
+            await this.activate(deactivated);
             throw error;
         }
-        toReactivate.push(...(await this.filesForNewlyInstalled(diff.toInstall)));
-        if (toPrune.length > 0) {
-            await this.deactivate(installed.filter((p) => toPrune.includes(p.slug)));
-        }
-        await this.activate(toReactivate);
+        const activateNew = (slug) => (fromComposer ? activate : pinActive(source.manifest[slug]));
+        const newlyInstalled = await this.filesForNewlyInstalled(diff.toInstall);
+        const toActivate = [...deactivated, ...diff.toActivate, ...newlyInstalled.filter((p) => activateNew(p.slug))];
+        const toDeactivate = [...diff.toDeactivate, ...installed.filter((p) => toPrune.includes(p.slug))];
+        await this.deactivate(toDeactivate);
+        await this.activate(toActivate);
         if (response.output.trim())
             this.log(response.output.trim());
         this.log('Plugins synced.');
+        this.logStillInactive([...skippedActivations, ...newlyInstalled.filter((p) => !activateNew(p.slug))], fromComposer);
         await this.recordSuccess();
         return this.result(diff, {
-            activated: toReactivate.map((p) => p.slug),
+            activated: toActivate.map((p) => p.slug),
             includeCollisions: force,
             pruned: toPrune,
             removed: response.removed ?? diff.toRemove,
@@ -140,26 +158,59 @@ export default class Push extends PushCommand {
             return file ? [{ file, slug }] : [];
         });
     }
-    guardForce(diff, force) {
+    guardForce(diff, force, file) {
         if (force)
             return;
         if (diff.collisions.length > 0) {
             const list = diff.collisions.map((c) => `${c.slug} (${c.installedVersion})`).join(', ');
             this.error(`${diff.collisions.length} plugin(s) are already installed outside Loopress: ${list}. ` +
                 'Re-run with --force to let Loopress manage them (this replaces their files with the WPackagist build, ' +
-                'local modifications are lost), or remove them from loopress.json.');
+                `local modifications are lost), or remove them from ${file}.`);
         }
         const downgrades = diff.toPin.filter((p) => isDowngrade(p.from, p.to));
         if (downgrades.length > 0) {
             const list = downgrades.map((p) => `${p.slug} ${p.from} to ${p.to}`).join(', ');
             this.error(`Refusing to downgrade: ${list}. A downgrade only replaces plugin files, it does not undo database ` +
-                'migrations the newer version ran, which can break the site. Re-run with --force, or bump the version in loopress.json.');
+                `migrations the newer version ran, which can break the site. Re-run with --force, or bump the version in ${file}.`);
         }
     }
+    async loadSource(activate) {
+        const composerJsonPath = join(process.cwd(), this.rootDir, 'composer.json');
+        if (existsSync(composerJsonPath)) {
+            const composerJson = JSON.parse(await readFile(composerJsonPath, 'utf8'));
+            const manifest = wpackagistRequire(composerJson, 'plugin');
+            if (Object.keys(manifest).length === 0) {
+                this.error('No wpackagist-plugin/* package in composer.json. Run `lps plugin pull` first, or `lps composer push` to push it as is.');
+            }
+            const require = composerJson.require ?? {};
+            return { file: 'composer.json', intent: toIntent(require), manifest, packageCount: Object.keys(require).length };
+        }
+        if (activate) {
+            this.error('--activate only applies to projects with a composer.json: loopress.json already records whether each plugin is active.');
+        }
+        const manifest = this.localConfig.plugins ?? {};
+        if (Object.keys(manifest).length === 0) {
+            this.error('No plugins found in loopress.json. Run `lps plugin pull` or `lps plugin add <slug>` first.');
+        }
+        return {
+            file: 'loopress.json',
+            intent: { plugins: pinVersions(manifest) },
+            manifest,
+            packageCount: Object.keys(manifest).length,
+        };
+    }
+    // composer.json projects: plugins this push left inactive, and how to change that.
+    logStillInactive(plugins, fromComposer = true) {
+        if (!fromComposer || plugins.length === 0)
+            return;
+        this.log(`${plugins.length} plugin(s) from composer.json are inactive: ${plugins.map((p) => p.slug).join(', ')}.`);
+        this.log('Re-run with --activate to activate them, or activate them in wp-admin.');
+    }
     result(diff, opts) {
         const collisionSlugs = opts.includeCollisions ? diff.collisions.map((c) => c.slug) : [];
         return {
             activated: opts.activated ?? diff.toActivate.map((a) => a.slug),
+            deactivated: diff.toDeactivate.map((a) => a.slug),
             installed: [...diff.toInstall.map((a) => a.slug), ...collisionSlugs],
             pinned: diff.toPin.map((p) => p.slug),
             pruned: opts.pruned,
@@ -167,9 +218,9 @@ export default class Push extends PushCommand {
             status: opts.status,
         };
     }
-    async sync(manifest, force) {
+    async sync(intent, force) {
         try {
-            return await this.wp.post('loopress/v1/composer/sync', { force, intent: { plugins: manifest }, lock: null }, { timeoutMs: SYNC_TIMEOUT_MS });
+            return await this.wp.post('loopress/v1/composer/sync', { force, intent, lock: null }, { timeoutMs: SYNC_TIMEOUT_MS });
         }
         catch (error) {
             const collisions = parseCollisions(error);
@@ -184,6 +235,7 @@ function isNoop(diff, toPrune) {
     return (diff.toInstall.length === 0 &&
         diff.toPin.length === 0 &&
         diff.toActivate.length === 0 &&
+        diff.toDeactivate.length === 0 &&
         diff.toRemove.length === 0 &&
         diff.collisions.length === 0 &&
         toPrune.length === 0);
@@ -201,6 +253,7 @@ function logPlan(cmd, diff, prune, force) {
         section('To take over', diff.collisions.map((c) => `! ${c.slug} (installed outside Loopress)`));
     section('To re-pin', diff.toPin.map((p) => `~ ${p.slug} ${p.from} to ${p.to}`));
     section('To activate', diff.toActivate.map((a) => `↑ ${a.slug}`));
+    section('To deactivate', diff.toDeactivate.map((a) => `↓ ${a.slug}`));
     section('To uninstall', diff.toRemove.map((s) => `- ${s}`));
     section('To deactivate (--prune)', prune.map((s) => `⊘ ${s}`));
 }

package/dist/commands/plugin/status.d.ts

@@ -4,6 +4,7 @@ type StatusResult = {
     inactive: string[];
     missing: string[];
     status: 'composer-managed' | 'drift' | 'in-sync';
+    unexpectedlyActive?: string[];
     untrackedActive: string[];
     wrongVersion: Array<{
         live: string;

package/dist/commands/plugin/status.js

@@ -12,7 +12,14 @@ export default class Status extends LoopressCommand {
         const { url } = this.siteConfig;
         if (existsSync(join(process.cwd(), this.rootDir, 'composer.json'))) {
             this.warn('This project has a composer.json, which is authoritative for plugins. Run `lps composer` commands instead.');
-            return { drift: false, inactive: [], missing: [], status: 'composer-managed', untrackedActive: [], wrongVersion: [] };
+            return {
+                drift: false,
+                inactive: [],
+                missing: [],
+                status: 'composer-managed',
+                untrackedActive: [],
+                wrongVersion: [],
+            };
         }
         const manifest = this.localConfig.plugins ?? {};
         const raw = await this.wp.get('wp/v2/plugins');
@@ -22,6 +29,7 @@ export default class Status extends LoopressCommand {
         const missing = diff.toInstall.map((a) => a.slug);
         const wrongVersion = diff.toPin.map((p) => ({ live: p.from, pinned: p.to, slug: p.slug }));
         const inactive = diff.toActivate.map((a) => a.slug);
+        const unexpectedlyActive = diff.toDeactivate.map((a) => a.slug);
         const { untrackedActive } = diff;
         // `collisions` are also drift (Loopress doesn't own them yet); surface them under missing's
         // banner so `plugin push --force` is the obvious next step.
@@ -29,6 +37,7 @@ export default class Status extends LoopressCommand {
         const drift = missing.length > 0 ||
             wrongVersion.length > 0 ||
             inactive.length > 0 ||
+            unexpectedlyActive.length > 0 ||
             diff.toRemove.length > 0 ||
             collisions.length > 0;
         if (!drift && untrackedActive.length === 0) {
@@ -43,13 +52,23 @@ export default class Status extends LoopressCommand {
             this.log(`Version drift: ${w.slug} is ${w.live}, loopress.json pins ${w.pinned}`);
         if (inactive.length > 0)
             this.log(`Pinned but inactive: ${inactive.join(', ')}`);
+        if (unexpectedlyActive.length > 0)
+            this.log(`Pinned inactive but active: ${unexpectedlyActive.join(', ')}`);
         if (diff.toRemove.length > 0)
             this.log(`Managed by Loopress but dropped from loopress.json: ${diff.toRemove.join(', ')}`);
         if (untrackedActive.length > 0)
             this.log(`Active but untracked: ${untrackedActive.join(', ')}`);
         if (drift)
             this.exit(1);
-        return { drift, inactive, missing, status: drift ? 'drift' : 'in-sync', untrackedActive, wrongVersion };
+        return {
+            drift,
+            inactive,
+            missing,
+            status: drift ? 'drift' : 'in-sync',
+            unexpectedlyActive,
+            untrackedActive,
+            wrongVersion,
+        };
     }
     async fetchInstanceLock() {
         try {

package/dist/commands/project/config.js

@@ -5,7 +5,7 @@ import { bootstrapLoopressFull } from '../../lib/bootstrap-full-install.js';
 import { isInteractive } from '../../lib/interactive.js';
 import { isLoopressFullActive } from '../../lib/plugin-detection.js';
 import { authorizeWithBrowser } from '../../lib/wp-authorize-flow.js';
-import { WpClient } from '../../lib/wp-client.js';
+import { isLocalEnvironment, WpClient } from '../../lib/wp-client.js';
 import { diagnoseWpSite } from '../../lib/wp-site-diagnostic.js';
 const NEW_PROJECT = '__new__';
 const AUTH_BROWSER = 'browser';
@@ -48,16 +48,20 @@ export default class Config extends Command {
         const rawUrl = await input({
             message: 'WordPress URL',
             validate(value) {
+                let parsed;
                 try {
-                    const parsed = new URL(value);
-                    if (!['http:', 'https:'].includes(parsed.protocol)) {
-                        return 'URL must start with http:// or https://';
-                    }
-                    return true;
+                    parsed = new URL(value);
                 }
                 catch {
                     return 'Invalid URL';
                 }
+                if (!['http:', 'https:'].includes(parsed.protocol)) {
+                    return 'URL must start with http:// or https://';
+                }
+                if (parsed.protocol === 'http:' && !isLocalEnvironment(envName)) {
+                    return `Plain HTTP would send the Application Password in cleartext. Use HTTPS. Plain HTTP is allowed only for the "local" environment (this one is "${envName}").`;
+                }
+                return true;
             },
         });
         let url = rawUrl;
@@ -88,10 +92,10 @@ export default class Config extends Command {
         this.log('→ Run `lps project switch` to change the active project or environment');
     }
     async maybeBootstrapLoopressFull(env) {
-        const { token, url } = env;
+        const { name, token, url } = env;
         if (!token)
             return; // env was just built with one a few lines up; guard only narrows the type
-        const wp = new WpClient(url, token);
+        const wp = new WpClient(url, token, name);
         // A detection failure (network hiccup, plugins REST disabled) is treated as "assume it's
         // there" rather than surprising the user with an account-creating prompt they didn't ask
         // for; `lps project config` can simply be re-run if it genuinely isn't installed.

package/dist/commands/promote.d.ts

@@ -17,8 +17,10 @@ export default class Promote extends Command {
         'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<PromoteResult>;
+    private assertDirsInsideProject;
     private confirmPromotion;
     private delegateArgv;
+    private enterScratchCopy;
     private requireEnvironment;
     private resolveProject;
 }

package/dist/commands/promote.js

@@ -1,15 +1,21 @@
 import { confirm } from '@inquirer/prompts';
 import { Args, Command } from '@oclif/core';
+// eslint-disable-next-line n/no-unsupported-features/node-builtins -- stable since 22.3, works unflagged on 22.0+
+import { cp, mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { basename, isAbsolute, join, relative, resolve } from 'node:path';
 import { configManager } from '../config/project-config.manager.js';
 import { LoopressCommand } from '../lib/base.js';
 import { isInteractive } from '../lib/interactive.js';
+import { stdoutToStderr } from '../lib/json-delegation.js';
 import { readLocalConfig } from '../utils/loopress-config.js';
+import { resolveResourceDir, RESOURCE_DIR_DEFAULTS } from '../utils/resource-dirs.js';
 export default class Promote extends Command {
     static args = {
         from: Args.string({ description: 'Environment to copy the configuration from', required: true }),
         to: Args.string({ description: 'Environment to copy the configuration to', required: true }),
     };
-    static description = 'Copy every tracked resource from one environment to another by pulling from <from> then pushing to <to>. Local tracked files are overwritten with <from> in the process.';
+    static description = 'Copy every tracked resource from one environment to another by pulling from <from> then pushing to <to>. Local tracked files are overwritten with <from> in the process. With --dry-run, <from> is pulled into a throwaway copy of the project instead, and the push is only previewed.';
     static enableJsonFlag = true;
     static examples = ['$ lps promote staging production', '$ lps promote production staging --dry-run'];
     static flags = {
@@ -28,19 +34,55 @@ export default class Promote extends Command {
         }
         if (!dryRun)
             await this.confirmPromotion(from.name, to.name, to.url, yes);
-        this.log(`\n=== Pulling from ${from.name} (${from.url}) ===`);
+        // A dry-run pull writes nothing, so a dry-run push right after would preview the current
+        // local files instead of <from>. Instead, really pull into a throwaway copy of the project
+        // and dry-run the push from there: the preview is what a real promotion would push, and the
+        // user's own files stay untouched.
+        const originalCwd = process.cwd();
+        const scratch = dryRun ? await this.enterScratchCopy(originalCwd) : undefined;
+        // The delegated pull is real, so without this its auto-rotation could revoke a stale app
+        // password during what the user asked to be a preview (see LoopressCommand.maybeAutoRotate).
+        const previousNoRotate = process.env.LOOPRESS_NO_AUTO_ROTATE;
+        if (scratch)
+            process.env.LOOPRESS_NO_AUTO_ROTATE = '1';
         try {
-            await this.config.runCommand('pull', this.delegateArgv(from.name, dryRun));
+            this.log(`\n=== Pulling from ${from.name} (${from.url}) ===`);
+            try {
+                await stdoutToStderr(this.jsonEnabled(), async () => this.config.runCommand('pull', this.delegateArgv(from.name, false)));
+            }
+            catch (error) {
+                // A partial pull must never be pushed onward: stop before touching <to>.
+                this.error(`Pull from ${from.name} failed, ${to.name} left untouched: ${error.message}`);
+            }
+            this.log(`\n=== Pushing to ${to.name} (${to.url}) ===`);
+            await stdoutToStderr(this.jsonEnabled(), async () => this.config.runCommand('push', this.delegateArgv(to.name, dryRun)));
         }
-        catch (error) {
-            // A partial pull must never be pushed onward: stop before touching <to>.
-            this.error(`Pull from ${from.name} failed, ${to.name} left untouched: ${error.message}`);
+        finally {
+            if (scratch) {
+                if (previousNoRotate === undefined)
+                    delete process.env.LOOPRESS_NO_AUTO_ROTATE;
+                else
+                    process.env.LOOPRESS_NO_AUTO_ROTATE = previousNoRotate;
+                process.chdir(originalCwd);
+                await rm(scratch, { force: true, recursive: true });
+            }
         }
-        this.log(`\n=== Pushing to ${to.name} (${to.url}) ===`);
-        await this.config.runCommand('push', this.delegateArgv(to.name, dryRun));
         this.log(dryRun ? `\n[dry-run] ${from.name} would be promoted to ${to.name}.` : `\n${from.name} promoted to ${to.name}.`);
         return { from: from.name, status: dryRun ? 'dry-run' : 'promoted', to: to.name };
     }
+    // The scratch pull writes wherever loopress.json points. An absolute or `../` rootDir or
+    // resource dir would land outside the copy, in the user's real files, during a dry run.
+    async assertDirsInsideProject(projectDir) {
+        const localConfig = await readLocalConfig();
+        const dirs = [localConfig.rootDir ?? '.', ...Object.keys(RESOURCE_DIR_DEFAULTS).map((kind) => resolveResourceDir(kind, localConfig))];
+        const outside = dirs.find((dir) => {
+            const rel = relative(projectDir, resolve(projectDir, dir));
+            return rel.startsWith('..') || isAbsolute(rel);
+        });
+        if (outside !== undefined) {
+            this.error(`--dry-run can't preview safely: "${outside}" in loopress.json is outside the project. Run \`lps diff --env <from> --against <to>\` instead.`);
+        }
+    }
     // Deliberately not `guardProductionPush`: promote overwrites local tracked files for every
     // target, not just production, so it needs its own confirmation regardless of the name. That
     // prompt also calls out production when relevant, making a second production-only guard
@@ -69,6 +111,26 @@ export default class Promote extends Command {
             argv.push('--dry-run');
         return argv;
     }
+    // Copies the whole project (not just what `pull` rewrites): push also reads files pull never
+    // touches, and a real promotion pushes those as they are locally. node_modules and .git are
+    // never read by push. Returns the scratch root, cwd is left inside the copy.
+    async enterScratchCopy(projectDir) {
+        await this.assertDirsInsideProject(projectDir);
+        const scratch = await mkdtemp(join(tmpdir(), 'lps-promote-'));
+        try {
+            const copy = join(scratch, basename(projectDir));
+            await cp(projectDir, copy, {
+                filter: (source) => !['.git', 'node_modules'].includes(basename(source)),
+                recursive: true,
+            });
+            process.chdir(copy);
+        }
+        catch (error) {
+            await rm(scratch, { force: true, recursive: true });
+            throw error;
+        }
+        return scratch;
+    }
     requireEnvironment(environments, projectName, name) {
         const env = environments[name];
         if (!env) {

package/dist/commands/pull.js

@@ -1,7 +1,8 @@
 import { LoopressCommand } from '../lib/base.js';
+import { stdoutToStderr } from '../lib/json-delegation.js';
 import { pluralize } from '../utils/pluralize.js';
-// composer before plugins: `plugin:pull` reads the local composer.json to skip
-// Composer-managed plugins, so it needs the freshly pulled one. The rest write to independent
+// composer before plugins: when a composer.json exists, `plugin:pull` merges the live plugins
+// into it, so it must run on the freshly pulled one or `composer:pull` would overwrite its work. The rest write to independent
 // directories and their order does not matter, it mirrors `lps push` for familiarity.
 const PULL_TARGETS = [
     { commandId: 'composer:pull', label: 'composer' },
@@ -29,7 +30,7 @@ export default class Pull extends LoopressCommand {
         for (const target of PULL_TARGETS) {
             this.log(`\n→ Pulling ${target.label}...`);
             try {
-                await this.config.runCommand(target.commandId, this.buildArgv(target));
+                await stdoutToStderr(this.jsonEnabled(), async () => this.config.runCommand(target.commandId, this.buildArgv(target)));
                 this.log(`✓ ${target.label} pulled`);
                 results.push({ label: target.label, status: 'pulled' });
             }
@@ -41,7 +42,10 @@ export default class Pull extends LoopressCommand {
             }
         }
         if (this.failedCount > 0) {
-            this.error(`${pluralize(this.failedCount, 'resource')} failed to pull.`);
+            // Each failure's own reason, not just the count: under --json the per-resource lines above
+            // never reach stdout, and this message is all an MCP caller or a script gets to see.
+            const failures = results.filter((result) => result.status === 'failed').map((result) => `${result.label}: ${result.error}`);
+            this.error(`${pluralize(this.failedCount, 'resource')} failed to pull. ${failures.join('; ')}`);
         }
         this.log('\nAll resources pulled.');
         return { results };

package/dist/commands/push.d.ts

@@ -18,6 +18,7 @@ export default class Push extends LoopressCommand {
     private failedCount;
     run(): Promise<PushResult>;
     private buildArgv;
+    private composerDeclaresPlugins;
     private guardProductionPush;
 }
 export {};

package/dist/commands/push.js

@@ -1,5 +1,10 @@
+import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
 import { LoopressCommand } from '../lib/base.js';
 import { guardProductionPush } from '../lib/guard-production-push.js';
+import { stdoutToStderr } from '../lib/json-delegation.js';
+import { wpackagistRequire } from '../utils/composer.js';
 import { pluralize } from '../utils/pluralize.js';
 // Dependency-ish order: code first (plugins, composer), then the ACF definitions content
 // relies on, then content itself.
@@ -10,6 +15,8 @@ const PUSH_TARGETS = [
     { commandId: 'api:push', label: 'API routes' },
     { commandId: 'hook:push', label: 'hooks' },
     { commandId: 'form:push', label: 'forms' },
+    // Before pages: WordPress refuses a page whose `template` it doesn't know yet.
+    { commandId: 'template:push', label: 'templates and parts' },
     { commandId: 'page:push', label: 'pages' },
     { commandId: 'seo:push', label: 'SEO' },
     { commandId: 'menu:push', label: 'menus' },
@@ -17,7 +24,7 @@ const PUSH_TARGETS = [
     { commandId: 'snippet:push', label: 'snippets' },
 ];
 export default class Push extends LoopressCommand {
-    static description = 'Push all local content, plugins, composer dependencies, ACF, API routes, hooks, forms, pages, SEO, menus, options, and snippets, to WordPress';
+    static description = 'Push all local content, plugins, composer dependencies, ACF, API routes, hooks, forms, templates, pages, SEO, menus, options, and snippets, to WordPress';
     static enableJsonFlag = true;
     static examples = ['$ lps push', '$ lps push --env staging', '$ lps push --dry-run'];
     static flags = {
@@ -29,10 +36,16 @@ export default class Push extends LoopressCommand {
         await this.guardProductionPush();
         const argv = this.buildArgv();
         const results = [];
+        const composerPushedByPlugins = await this.composerDeclaresPlugins();
         for (const target of PUSH_TARGETS) {
+            if (composerPushedByPlugins && target.commandId === 'composer:push') {
+                this.log('\n→ composer: already pushed whole by plugins');
+                results.push({ label: target.label, status: 'pushed' });
+                continue;
+            }
             this.log(`\n→ Pushing ${target.label}...`);
             try {
-                await this.config.runCommand(target.commandId, argv);
+                await stdoutToStderr(this.jsonEnabled(), async () => this.config.runCommand(target.commandId, argv));
                 this.log(`✓ ${target.label} pushed`);
                 results.push({ label: target.label, status: 'pushed' });
             }
@@ -44,7 +57,12 @@ export default class Push extends LoopressCommand {
             }
         }
         if (this.failedCount > 0) {
-            this.error(`${pluralize(this.failedCount, 'resource')} failed to push.`);
+            // Each failure's own reason, not just the count: under --json the per-resource lines above
+            // never reach stdout, and this message is all an MCP caller or a script gets to see.
+            const failures = results
+                .filter((result) => result.status === 'failed')
+                .map((result) => `${result.label}: ${result.error}`);
+            this.error(`${pluralize(this.failedCount, 'resource')} failed to push. ${failures.join('; ')}`);
         }
         this.log('\nAll resources pushed.');
         return { results };
@@ -58,9 +76,29 @@ export default class Push extends LoopressCommand {
             argv.push('--dry-run');
         return argv;
     }
+    // A composer.json that declares plugins is pushed whole by `plugin:push` (with its activation
+    // safety), so `composer:push` would only run Composer on the server a second time.
+    async composerDeclaresPlugins() {
+        const path = join(process.cwd(), this.rootDir, 'composer.json');
+        if (!existsSync(path))
+            return false;
+        try {
+            const composerJson = JSON.parse(await readFile(path, 'utf8'));
+            return Object.keys(wpackagistRequire(composerJson, 'plugin')).length > 0;
+        }
+        catch {
+            // Unreadable: let both commands run and report the parse error themselves.
+            return false;
+        }
+    }
     // Guards once here (shared with PushCommand, lib/push-command.ts) rather than once per
     // delegated command.
     async guardProductionPush() {
-        await guardProductionPush({ dryRun: this.dryRun, error: (message) => this.error(message), siteConfig: this.siteConfig, yes: this.yes });
+        await guardProductionPush({
+            dryRun: this.dryRun,
+            error: (message) => this.error(message),
+            siteConfig: this.siteConfig,
+            yes: this.yes,
+        });
     }
 }

package/dist/commands/template/diff.d.ts

@@ -0,0 +1,10 @@
+import { DiffCommand, type DiffJson } from '../../lib/diff-command.js';
+export default class Diff extends DiffCommand {
+    static description: string;
+    static enableJsonFlag: boolean;
+    static examples: string[];
+    static flags: {
+        against: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<DiffJson>;
+}

package/dist/commands/template/diff.js

@@ -0,0 +1,13 @@
+import { DiffCommand } from '../../lib/diff-command.js';
+import { getResourceStateProvider } from '../../lib/resource-state.js';
+export default class Diff extends DiffCommand {
+    static description = 'Show what differs in block templates and parts between your local files and a WordPress environment, or between two environments. Templates and parts edited in the Site Editor show up too.';
+    static enableJsonFlag = true;
+    static examples = ['$ lps template diff', '$ lps template diff --env staging', '$ lps template diff --env staging --against production'];
+    static flags = { ...DiffCommand.againstFlag };
+    async run() {
+        const { flags } = await this.parse(Diff);
+        const sides = this.resolveSides(flags.against);
+        return this.report(['template', 'part'].map((resource) => this.providerTarget(getResourceStateProvider(resource), sides)), sides);
+    }
+}

package/dist/commands/template/list.d.ts

@@ -0,0 +1,13 @@
+import { LoopressCommand } from '../../lib/base.js';
+import { type ChildTheme } from '../../utils/template-format.js';
+type ListResult = Omit<ChildTheme, 'parts' | 'templates'> & {
+    parts: string[];
+    templates: string[];
+};
+export default class List extends LoopressCommand {
+    static description: string;
+    static enableJsonFlag: boolean;
+    static examples: string[];
+    run(): Promise<ListResult>;
+}
+export {};