@loopress/cli 0.27.0 → 0.28.0

package/dist/commands/app/pull.js

@@ -2,9 +2,9 @@ import { confirm } from '@inquirer/prompts';
 import { Args } from '@oclif/core';
 import { Buffer } from 'node:buffer';
 import { existsSync } from 'node:fs';
-import { mkdir, readdir, rm, writeFile } from 'node:fs/promises';
+import { mkdir, readdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
-import { APP_CONFIG_FILENAME } from '../../lib/app-manifest.js';
+import { APP_CONFIG_FILENAME, parseAppConfig } from '../../lib/app-manifest.js';
 import { LoopressCommand } from '../../lib/base.js';
 import { isInteractive } from '../../lib/interactive.js';
 import { pluralize } from '../../utils/pluralize.js';
@@ -60,14 +60,27 @@ export default class Pull extends LoopressCommand {
     }
     async pullApp(path, name) {
         const manifest = await this.wp.get(`loopress/v1/apps/${name}/manifest`);
-        const distDir = join(path, name, 'dist');
+        const appDir = join(path, name);
+        const configPath = join(appDir, APP_CONFIG_FILENAME);
+        // WordPress doesn't know where the app builds to (assetsDir) or whether its entry is explicit:
+        // keep what the local config says, only refresh what the server is the source of truth for.
+        const local = existsSync(configPath) ? parseAppConfig(await readFile(configPath, 'utf8'), appDir) : {};
+        const assetsDir = local.assetsDir ?? 'dist';
+        const distDir = join(appDir, assetsDir);
         for (const file of manifest.files) {
             const { content } = await this.wp.get(`loopress/v1/apps/${name}/asset?path=${encodeURIComponent(file.path)}`);
             const target = join(distDir, file.path);
             await mkdir(dirname(target), { recursive: true });
             await writeFile(target, Buffer.from(content, 'base64'));
         }
-        await writeFile(join(path, name, APP_CONFIG_FILENAME), JSON.stringify({ assetsDir: 'dist', mountSelector: manifest.mountSelector, name: manifest.name, routing: manifest.routing }, null, 2) + '\n');
+        await writeFile(configPath, JSON.stringify({
+            ...local,
+            assetsDir,
+            crossOrigin: manifest.crossOrigin ?? undefined, // dropped by JSON.stringify when unset
+            mountSelector: manifest.mountSelector,
+            name: manifest.name,
+            routing: manifest.routing,
+        }, null, 2) + '\n');
         this.log(`  ${name}: ${pluralize(manifest.files.length, 'file')} (build ${manifest.buildId})`);
         return { files: manifest.files.length, name };
     }

package/dist/commands/app/push.d.ts

@@ -18,11 +18,14 @@ export default class Push extends PushCommand {
     static flags: {
         yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        build: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
+    private build;
     run(): Promise<PushResult>;
     private appDirNames;
     private pushApp;
     private remoteFiles;
     private uploadAsset;
+    private warnIfCrossOriginIgnored;
 }
 export {};

package/dist/commands/app/push.js

@@ -1,7 +1,8 @@
-import { Args } from '@oclif/core';
+import { Args, Flags } from '@oclif/core';
 import { existsSync } from 'node:fs';
 import { readdir, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { buildApp } from '../../lib/app-build.js';
 import { APP_CONFIG_FILENAME, diffFiles, loadAppManifest, } from '../../lib/app-manifest.js';
 import { PushCommand } from '../../lib/push-command.js';
 import { isNotFoundError } from '../../lib/wp-client.js';
@@ -10,15 +11,22 @@ export default class Push extends PushCommand {
     static args = {
         name: Args.string({ description: 'Push only this app (defaults to every app in the directory)' }),
     };
-    static description = 'Push built single-page app bundles to WordPress. Each app is an `apps/<name>/` directory holding a loopress.app.json and a built dist/ folder. Only files whose content changed are uploaded.';
+    static description = 'Build and push single-page app bundles to WordPress. Each app is an `apps/<name>/` directory holding a loopress.app.json and a dist/ folder. When the app has a package.json with a `build` script, it runs first (use --no-build to skip it). Only files whose content changed are uploaded.';
     static enableJsonFlag = true;
-    static examples = ['$ lps app push', '$ lps app push search'];
+    static examples = ['$ lps app push', '$ lps app push search', '$ lps app push --no-build'];
     static flags = {
+        build: Flags.boolean({
+            allowNo: true,
+            default: true,
+            description: "Run the app's package.json build script before pushing",
+        }),
         ...PushCommand.dryRunFlag,
         ...PushCommand.yesFlag,
     };
+    build = true;
     async run() {
-        const { args } = await this.parse(Push);
+        const { args, flags } = await this.parse(Push);
+        this.build = flags.build;
         const { url } = this.siteConfig;
         const path = this.resolveAppsPath();
         this.log(`Pushing apps to ${url}`);
@@ -71,6 +79,13 @@ export default class Push extends PushCommand {
         let manifest;
         let distDir;
         try {
+            // Built on dry runs too: the preview diffs dist/, so a stale one would make it lie.
+            if (this.build) {
+                await buildApp(appDir, (command) => {
+                    if (task)
+                        task.output = `${dirName}: building (${command})`;
+                });
+            }
             ;
             ({ distDir, manifest } = await loadAppManifest(appDir, dirName));
         }
@@ -93,12 +108,14 @@ export default class Push extends PushCommand {
                 task.output = `${manifest.name}: uploading ${file.path} (${index + 1}/${changed.length})`;
             await this.uploadAsset(manifest.name, distDir, file);
         }
+        let committed;
         try {
-            await this.wp.post(`loopress/v1/apps/${manifest.name}/commit`, manifest);
+            committed = await this.wp.post(`loopress/v1/apps/${manifest.name}/commit`, manifest);
         }
         catch (error) {
             this.reportTaskFailure(`${manifest.name}: commit failed: ${error.message}`, error, task);
         }
+        this.warnIfCrossOriginIgnored(manifest, committed);
         if (task) {
             task.output =
                 changed.length === 0
@@ -127,4 +144,11 @@ export default class Push extends PushCommand {
             this.reportTaskFailure(`${name}: failed to upload ${file.path}: ${error.message}`, error);
         }
     }
+    // An older plugin, or an app .htaccess the site owner manages, commits the build without the
+    // policy: say so rather than let the app look protected when it is not.
+    warnIfCrossOriginIgnored(manifest, committed) {
+        if (manifest.crossOrigin && committed?.crossOrigin !== manifest.crossOrigin) {
+            this.warn(`${manifest.name}: crossOrigin "${manifest.crossOrigin}" was not applied: either the Loopress plugin on this site is too old (update it, then push again) or wp-content/loopress/apps/${manifest.name}/.htaccess is managed by hand and was left untouched.`);
+        }
+    }
 }

package/dist/commands/composer/push.js

@@ -4,26 +4,8 @@ import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { PushCommand } from '../../lib/push-command.js';
 import { isTimeoutError } from '../../lib/wp-client.js';
+import { toIntent } from '../../utils/composer.js';
 import { parseCollisions, SYNC_TIMEOUT_MS, } from '../../utils/plugin-sync.js';
-// Split a composer.json `require` map into the three intent namespaces the sync endpoint
-// understands. `composer/installers` is owned by the server scaffold, never sent.
-function toIntent(require) {
-    const intent = { libraries: {}, plugins: {}, themes: {} };
-    for (const [name, constraint] of Object.entries(require)) {
-        if (name === 'composer/installers')
-            continue;
-        if (name.startsWith('wpackagist-plugin/')) {
-            intent.plugins[name.slice('wpackagist-plugin/'.length)] = constraint;
-        }
-        else if (name.startsWith('wpackagist-theme/')) {
-            intent.themes[name.slice('wpackagist-theme/'.length)] = constraint;
-        }
-        else {
-            intent.libraries[name] = constraint;
-        }
-    }
-    return intent;
-}
 export default class ComposerPush extends PushCommand {
     static description = 'Push composer.json to WordPress and run Composer to resolve and install dependencies';
     static enableJsonFlag = true;

package/dist/commands/diff.js

@@ -7,7 +7,7 @@ const RESOURCES = [...RESOURCE_STATE_PROVIDERS.map((provider) => provider.resour
 export default class Diff extends DiffCommand {
     static description = [
         'Show what differs between your local tracked files and a WordPress environment, or between two environments.',
-        'Covers snippets, forms, ACF, API routes, Hooks, pages, SEO, Options, Menus, Theme styles, and Composer. Plugins and themes have their own `lps plugin status` / `lps theme status`.',
+        'Covers snippets, forms, ACF, API routes, Hooks, templates, template parts, pages, SEO, Options, Menus, Theme styles, and Composer. Plugins and themes have their own `lps plugin status` / `lps theme status`.',
         'Exit code: 0 in sync, 1 on drift, 2 when a resource could not be compared, so it doubles as a CI drift gate.',
     ].join(' ');
     static enableJsonFlag = true;

package/dist/commands/init.js

@@ -21,6 +21,8 @@ const FEATURES = [
     { dir: 'hooks', key: 'hooksDir', label: 'Hooks (actions, filters, cron)' },
     { dir: 'apps', key: 'appsDir', label: 'Single-page apps' },
     { dir: 'pages', key: 'pageDir', label: 'Static pages' },
+    { dir: 'templates', key: 'templateDir', label: 'Block templates' },
+    { dir: 'parts', key: 'partDir', label: 'Block template parts' },
 ];
 export default class Init extends Command {
     static description = 'Initialize a loopress.json config file in the current directory';

package/dist/commands/plugin/add.js

@@ -1,5 +1,6 @@
 import { Args, Flags } from '@oclif/core';
 import { LoopressCommand } from '../../lib/base.js';
+import { pinVersion } from '../../types/plugin.js';
 import { writeLocalConfig } from '../../utils/loopress-config.js';
 import { isExactVersion } from '../../utils/version.js';
 export default class Add extends LoopressCommand {
@@ -25,18 +26,20 @@ export default class Add extends LoopressCommand {
             this.error(`--version must be an exact version like 9.4.2, not a Composer constraint. Got "${version}".`);
         }
         const existing = this.localConfig.plugins ?? {};
-        if (existing[slug] === version) {
+        const current = existing[slug];
+        if (current !== undefined && pinVersion(current) === version) {
             this.log(`${slug} is already pinned to ${version} in loopress.json, nothing to do.`);
             return { slug, status: 'unchanged', version };
         }
-        const isUpdated = existing[slug] !== undefined;
+        const isUpdated = current !== undefined;
         if (this.dryRun) {
             this.log(`[dry-run] Would ${isUpdated ? 'update' : 'add'} ${slug} (${version}) in loopress.json`);
             return { slug, status: 'dry-run', version };
         }
         await writeLocalConfig({
             ...this.localConfig,
-            plugins: { ...existing, [slug]: version },
+            // Re-pinning a plugin recorded as inactive keeps it inactive.
+            plugins: { ...existing, [slug]: typeof current === 'object' ? { ...current, version } : version },
         });
         this.log(`${isUpdated ? 'Updated' : 'Added'} ${slug} (${version}). Run \`lps plugin push\` to apply.`);
         return { slug, status: isUpdated ? 'updated' : 'added', version };

package/dist/commands/plugin/audit.js

@@ -1,5 +1,6 @@
 import got from 'got';
 import { LoopressCommand } from '../../lib/base.js';
+import { pinVersion } from '../../types/plugin.js';
 import { compareVersions } from '../../utils/version.js';
 const WPVULN_BASE = 'https://www.wpvulnerability.net/plugin';
 const WPORG_INFO = 'https://api.wordpress.org/plugins/info/1.2/';
@@ -18,7 +19,7 @@ export default class Audit extends LoopressCommand {
         const advisories = [];
         const health = [];
         for (const slug of slugs) {
-            const found = await this.auditOne(slug, manifest[slug]);
+            const found = await this.auditOne(slug, pinVersion(manifest[slug]));
             advisories.push(...found.advisories);
             health.push(...found.health);
         }
@@ -26,16 +27,14 @@ export default class Audit extends LoopressCommand {
     }
     async auditOne(slug, pinned) {
         const [vulns, info] = await Promise.all([this.fetchVulnerabilities(slug), this.fetchHealth(slug)]);
-        const advisories = vulns
-            .filter((v) => pinned === 'latest' || affects(pinned, v.fixedIn))
-            .map((v) => ({ ...v, slug }));
+        const advisories = vulns.filter((v) => pinned === 'latest' || affects(pinned, v.fixedIn)).map((v) => ({ ...v, slug }));
         const health = info ? describeHealth(slug, pinned, info) : [];
         return { advisories, health };
     }
     async fetchHealth(slug) {
         try {
             const body = await got(WPORG_INFO, {
-                searchParams: { 'action': 'plugin_information', 'request[slug]': slug },
+                searchParams: { action: 'plugin_information', 'request[slug]': slug },
                 timeout: { request: 10_000 },
             }).json();
             return typeof body === 'object' && !('error' in body) ? body : null;

package/dist/commands/plugin/pull.d.ts

@@ -1,7 +1,9 @@
 import { LoopressCommand } from '../../lib/base.js';
+import { type ComposerPullResult } from '../../utils/composer.js';
 import { type MergeResult } from '../../utils/plugins.js';
 type PullResult = MergeResult & {
-    status: 'composer-managed' | 'dry-run' | 'success';
+    skipped?: ComposerPullResult['skipped'];
+    status: 'dry-run' | 'success';
 };
 export default class Pull extends LoopressCommand {
     static description: string;

package/dist/commands/plugin/pull.js

@@ -1,6 +1,7 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { LoopressCommand } from '../../lib/base.js';
+import { pullIntoComposerJson } from '../../utils/composer.js';
 import { writeLocalConfig } from '../../utils/loopress-config.js';
 import { mergePluginManifest, parseInstalledPlugins } from '../../utils/plugins.js';
 export default class Pull extends LoopressCommand {
@@ -12,18 +13,25 @@ export default class Pull extends LoopressCommand {
     };
     async run() {
         const { url } = this.siteConfig;
-        if (existsSync(join(process.cwd(), this.rootDir, 'composer.json'))) {
-            this.warn('This project has a composer.json, which is authoritative for plugins. Run `lps composer pull` instead.');
-            return { added: [], merged: this.localConfig.plugins ?? {}, status: 'composer-managed', updated: [] };
-        }
         this.log(`Pulling plugins from ${url}`);
         const raw = await this.wp.get('wp/v2/plugins');
         const installed = parseInstalledPlugins(raw);
-        // Pin every plugin to the version actually running on the site. A later `plugin push`
-        // installs exactly this set via Composer + WPackagist; drift only surfaces when the pinned
-        // version and the live version disagree.
-        const incoming = Object.fromEntries(installed.map((p) => [p.slug, p.version]));
-        const { added, merged, updated } = mergePluginManifest(this.localConfig.plugins ?? {}, incoming);
+        // Pin every plugin to the version actually running on the site, and record the inactive ones
+        // as such so a later `plugin push` doesn't switch them on. A later `plugin push` installs
+        // exactly this set via Composer + WPackagist; drift only surfaces when the pinned version and
+        // the live version disagree.
+        const versions = Object.fromEntries(installed.map((p) => [p.slug, p.version]));
+        const pins = Object.fromEntries(installed.map((p) => [p.slug, p.active ? p.version : { active: false, version: p.version }]));
+        // A composer.json is authoritative over loopress.json: pin the live versions there instead.
+        const composerJsonPath = join(process.cwd(), this.rootDir, 'composer.json');
+        if (existsSync(composerJsonPath)) {
+            const result = await pullIntoComposerJson(composerJsonPath, 'plugin', versions, {
+                dryRun: this.dryRun,
+                log: this.log.bind(this),
+            });
+            return { ...result, status: this.dryRun ? 'dry-run' : 'success' };
+        }
+        const { added, merged, updated } = mergePluginManifest(this.localConfig.plugins ?? {}, pins);
         if (this.dryRun) {
             this.log(`[dry-run] Would write ${Object.keys(merged).length} plugins to loopress.json`);
             if (added.length > 0)

package/dist/commands/plugin/push.d.ts

@@ -1,17 +1,19 @@
 import { PushCommand } from '../../lib/push-command.js';
 type PushResult = {
     activated: string[];
+    deactivated: string[];
     installed: string[];
     pinned: string[];
     pruned: string[];
     removed: string[];
-    status: 'composer-managed' | 'dry-run' | 'in-sync' | 'success';
+    status: 'dry-run' | 'in-sync' | 'success';
 };
 export default class Push extends PushCommand {
     static description: string;
     static enableJsonFlag: boolean;
     static examples: string[];
     static flags: {
+        activate: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         prune: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
@@ -24,6 +26,8 @@ export default class Push extends PushCommand {
     private fetchInstanceLock;
     private filesForNewlyInstalled;
     private guardForce;
+    private loadSource;
+    private logStillInactive;
     private result;
     private sync;
 }

package/dist/commands/plugin/push.js

@@ -1,86 +1,104 @@
 import { Flags } from '@oclif/core';
 import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { confirmUninstall } from '../../lib/interactive.js';
 import { PushCommand } from '../../lib/push-command.js';
 import { isNotFoundError } from '../../lib/wp-client.js';
-import { isDowngrade, parseCollisions, SYNC_TIMEOUT_MS } from '../../utils/plugin-sync.js';
+import { pinActive, pinVersion, pinVersions, } from '../../types/plugin.js';
+import { toIntent, wpackagistRequire } from '../../utils/composer.js';
+import { isDowngrade, parseCollisions, SYNC_TIMEOUT_MS, } from '../../utils/plugin-sync.js';
 import { diffPlugins, lockedWpackagistSlugs, parseInstalledPlugins } from '../../utils/plugins.js';
-const IN_SYNC = { activated: [], installed: [], pinned: [], pruned: [], removed: [], status: 'in-sync' };
+import { isExactVersion } from '../../utils/version.js';
+const IN_SYNC = {
+    activated: [],
+    deactivated: [],
+    installed: [],
+    pinned: [],
+    pruned: [],
+    removed: [],
+    status: 'in-sync',
+};
 export default class Push extends PushCommand {
-    static description = 'Install plugins on WordPress to match loopress.json, pinned via Composer + WPackagist';
+    static description = 'Install plugins on WordPress to match loopress.json (or composer.json), via Composer + WPackagist';
     static enableJsonFlag = true;
     static examples = ['$ lps plugin push', '$ lps plugin push --dry-run', '$ lps plugin push --force --prune'];
     static flags = {
         ...PushCommand.dryRunFlag,
         ...PushCommand.yesFlag,
+        activate: Flags.boolean({
+            default: false,
+            description: 'composer.json projects only: activate every plugin it declares. Without it, plugins keep their current state and new ones stay inactive',
+        }),
         force: Flags.boolean({
             default: false,
             description: 'Allow downgrades and let Loopress take over plugins installed outside it (replaces their files)',
         }),
         prune: Flags.boolean({
             default: false,
-            description: 'Deactivate plugins that are active on the site but absent from loopress.json',
+            description: 'Deactivate plugins that are active on the site but absent from loopress.json (or composer.json)',
         }),
     };
     async run() {
         const { flags } = await this.parse(Push);
-        const { force, prune } = flags;
-        if (existsSync(join(process.cwd(), this.rootDir, 'composer.json'))) {
-            this.warn('This project has a composer.json, which is authoritative for plugins. Run `lps composer push` instead.');
-            return { ...IN_SYNC, status: 'composer-managed' };
-        }
-        const manifest = this.localConfig.plugins ?? {};
-        if (Object.keys(manifest).length === 0) {
-            this.error('No plugins found in loopress.json. Run `lps plugin pull` or `lps plugin add <slug>` first.');
-        }
+        const { activate, force, prune } = flags;
+        const source = await this.loadSource(activate);
+        const fromComposer = source.file === 'composer.json';
         this.log(`Pushing plugins to ${this.siteConfig.url}`);
+        if (fromComposer) {
+            this.log(`From composer.json, pushed whole (${source.packageCount} packages): themes and libraries it declares are synced too.`);
+        }
         const raw = await this.wp.get('wp/v2/plugins');
         const installed = parseInstalledPlugins(raw);
         const managed = lockedWpackagistSlugs(await this.fetchInstanceLock(), 'plugin');
-        const diff = diffPlugins(manifest, installed, managed);
-        this.guardForce(diff, force);
+        const diff = diffPlugins(source.manifest, installed, managed);
+        // composer.json records no active state: leave inactive plugins alone unless --activate.
+        const skippedActivations = fromComposer && !activate ? diff.toActivate : [];
+        if (fromComposer && !activate)
+            diff.toActivate = [];
+        this.guardForce(diff, force, source.file);
         const toPrune = prune ? diff.untrackedActive : [];
-        // A "latest" pin never shows as drift, but its newest upstream release may have moved
-        // since the last push, so a push must still run `composer update` to pick it up.
-        const hasLatestPin = Object.values(manifest).includes('latest');
-        if (!hasLatestPin && isNoop(diff, toPrune)) {
+        // A "latest" pin (or a Composer constraint) never shows as drift, but its newest upstream
+        // release may have moved since the last push, so a push must still run `composer update`.
+        const hasFloatingPin = Object.values(source.manifest).some((pin) => !isExactVersion(pinVersion(pin)));
+        if (!hasFloatingPin && isNoop(diff, toPrune)) {
             this.log('Everything is already in sync.');
+            this.logStillInactive(skippedActivations);
             return { ...IN_SYNC };
         }
         if (isNoop(diff, toPrune))
-            this.log('Refreshing plugins pinned to "latest" to their newest releases.');
+            this.log('Refreshing plugins not pinned to an exact version to their newest releases.');
         logPlan(this, diff, toPrune, force);
         if (this.dryRun) {
             return this.result(diff, { includeCollisions: true, pruned: toPrune, removed: diff.toRemove, status: 'dry-run' });
         }
         if (!(await confirmUninstall(diff.toRemove, this.yes)))
             this.error('Aborted.');
-        const deactivated = await this.deactivateEndangered(installed, diff, force);
-        // Plugins that must end up active: the ones we deactivated for the file swap (minus any
-        // being uninstalled) plus the ones the manifest wants active but that are inactive today.
-        const toReactivate = [...deactivated.filter((p) => !diff.toRemove.includes(p.slug)), ...diff.toActivate];
+        // Plugins switched off for the file swap come back on, unless loopress.json wants them inactive.
+        const deactivated = (await this.deactivateEndangered(installed, diff, force)).filter((p) => !diff.toRemove.includes(p.slug) && (fromComposer || pinActive(source.manifest[p.slug])));
         let response;
         try {
-            response = await this.sync(manifest, force);
+            response = await this.sync(source.intent, force);
         }
         catch (error) {
             // The file swap never happened, so restore the plugins we defensively deactivated
             // instead of leaving the site with them switched off.
-            await this.activate(deactivated.filter((p) => !diff.toRemove.includes(p.slug)));
+            await this.activate(deactivated);
             throw error;
         }
-        toReactivate.push(...(await this.filesForNewlyInstalled(diff.toInstall)));
-        if (toPrune.length > 0) {
-            await this.deactivate(installed.filter((p) => toPrune.includes(p.slug)));
-        }
-        await this.activate(toReactivate);
+        const activateNew = (slug) => (fromComposer ? activate : pinActive(source.manifest[slug]));
+        const newlyInstalled = await this.filesForNewlyInstalled(diff.toInstall);
+        const toActivate = [...deactivated, ...diff.toActivate, ...newlyInstalled.filter((p) => activateNew(p.slug))];
+        const toDeactivate = [...diff.toDeactivate, ...installed.filter((p) => toPrune.includes(p.slug))];
+        await this.deactivate(toDeactivate);
+        await this.activate(toActivate);
         if (response.output.trim())
             this.log(response.output.trim());
         this.log('Plugins synced.');
+        this.logStillInactive([...skippedActivations, ...newlyInstalled.filter((p) => !activateNew(p.slug))], fromComposer);
         await this.recordSuccess();
         return this.result(diff, {
-            activated: toReactivate.map((p) => p.slug),
+            activated: toActivate.map((p) => p.slug),
             includeCollisions: force,
             pruned: toPrune,
             removed: response.removed ?? diff.toRemove,
@@ -140,26 +158,59 @@ export default class Push extends PushCommand {
             return file ? [{ file, slug }] : [];
         });
     }
-    guardForce(diff, force) {
+    guardForce(diff, force, file) {
         if (force)
             return;
         if (diff.collisions.length > 0) {
             const list = diff.collisions.map((c) => `${c.slug} (${c.installedVersion})`).join(', ');
             this.error(`${diff.collisions.length} plugin(s) are already installed outside Loopress: ${list}. ` +
                 'Re-run with --force to let Loopress manage them (this replaces their files with the WPackagist build, ' +
-                'local modifications are lost), or remove them from loopress.json.');
+                `local modifications are lost), or remove them from ${file}.`);
         }
         const downgrades = diff.toPin.filter((p) => isDowngrade(p.from, p.to));
         if (downgrades.length > 0) {
             const list = downgrades.map((p) => `${p.slug} ${p.from} to ${p.to}`).join(', ');
             this.error(`Refusing to downgrade: ${list}. A downgrade only replaces plugin files, it does not undo database ` +
-                'migrations the newer version ran, which can break the site. Re-run with --force, or bump the version in loopress.json.');
+                `migrations the newer version ran, which can break the site. Re-run with --force, or bump the version in ${file}.`);
         }
     }
+    async loadSource(activate) {
+        const composerJsonPath = join(process.cwd(), this.rootDir, 'composer.json');
+        if (existsSync(composerJsonPath)) {
+            const composerJson = JSON.parse(await readFile(composerJsonPath, 'utf8'));
+            const manifest = wpackagistRequire(composerJson, 'plugin');
+            if (Object.keys(manifest).length === 0) {
+                this.error('No wpackagist-plugin/* package in composer.json. Run `lps plugin pull` first, or `lps composer push` to push it as is.');
+            }
+            const require = composerJson.require ?? {};
+            return { file: 'composer.json', intent: toIntent(require), manifest, packageCount: Object.keys(require).length };
+        }
+        if (activate) {
+            this.error('--activate only applies to projects with a composer.json: loopress.json already records whether each plugin is active.');
+        }
+        const manifest = this.localConfig.plugins ?? {};
+        if (Object.keys(manifest).length === 0) {
+            this.error('No plugins found in loopress.json. Run `lps plugin pull` or `lps plugin add <slug>` first.');
+        }
+        return {
+            file: 'loopress.json',
+            intent: { plugins: pinVersions(manifest) },
+            manifest,
+            packageCount: Object.keys(manifest).length,
+        };
+    }
+    // composer.json projects: plugins this push left inactive, and how to change that.
+    logStillInactive(plugins, fromComposer = true) {
+        if (!fromComposer || plugins.length === 0)
+            return;
+        this.log(`${plugins.length} plugin(s) from composer.json are inactive: ${plugins.map((p) => p.slug).join(', ')}.`);
+        this.log('Re-run with --activate to activate them, or activate them in wp-admin.');
+    }
     result(diff, opts) {
         const collisionSlugs = opts.includeCollisions ? diff.collisions.map((c) => c.slug) : [];
         return {
             activated: opts.activated ?? diff.toActivate.map((a) => a.slug),
+            deactivated: diff.toDeactivate.map((a) => a.slug),
             installed: [...diff.toInstall.map((a) => a.slug), ...collisionSlugs],
             pinned: diff.toPin.map((p) => p.slug),
             pruned: opts.pruned,
@@ -167,9 +218,9 @@ export default class Push extends PushCommand {
             status: opts.status,
         };
     }
-    async sync(manifest, force) {
+    async sync(intent, force) {
         try {
-            return await this.wp.post('loopress/v1/composer/sync', { force, intent: { plugins: manifest }, lock: null }, { timeoutMs: SYNC_TIMEOUT_MS });
+            return await this.wp.post('loopress/v1/composer/sync', { force, intent, lock: null }, { timeoutMs: SYNC_TIMEOUT_MS });
         }
         catch (error) {
             const collisions = parseCollisions(error);
@@ -184,6 +235,7 @@ function isNoop(diff, toPrune) {
     return (diff.toInstall.length === 0 &&
         diff.toPin.length === 0 &&
         diff.toActivate.length === 0 &&
+        diff.toDeactivate.length === 0 &&
         diff.toRemove.length === 0 &&
         diff.collisions.length === 0 &&
         toPrune.length === 0);
@@ -201,6 +253,7 @@ function logPlan(cmd, diff, prune, force) {
         section('To take over', diff.collisions.map((c) => `! ${c.slug} (installed outside Loopress)`));
     section('To re-pin', diff.toPin.map((p) => `~ ${p.slug} ${p.from} to ${p.to}`));
     section('To activate', diff.toActivate.map((a) => `↑ ${a.slug}`));
+    section('To deactivate', diff.toDeactivate.map((a) => `↓ ${a.slug}`));
     section('To uninstall', diff.toRemove.map((s) => `- ${s}`));
     section('To deactivate (--prune)', prune.map((s) => `⊘ ${s}`));
 }

package/dist/commands/plugin/status.d.ts

@@ -4,6 +4,7 @@ type StatusResult = {
     inactive: string[];
     missing: string[];
     status: 'composer-managed' | 'drift' | 'in-sync';
+    unexpectedlyActive?: string[];
     untrackedActive: string[];
     wrongVersion: Array<{
         live: string;

package/dist/commands/plugin/status.js

@@ -12,7 +12,14 @@ export default class Status extends LoopressCommand {
         const { url } = this.siteConfig;
         if (existsSync(join(process.cwd(), this.rootDir, 'composer.json'))) {
             this.warn('This project has a composer.json, which is authoritative for plugins. Run `lps composer` commands instead.');
-            return { drift: false, inactive: [], missing: [], status: 'composer-managed', untrackedActive: [], wrongVersion: [] };
+            return {
+                drift: false,
+                inactive: [],
+                missing: [],
+                status: 'composer-managed',
+                untrackedActive: [],
+                wrongVersion: [],
+            };
         }
         const manifest = this.localConfig.plugins ?? {};
         const raw = await this.wp.get('wp/v2/plugins');
@@ -22,6 +29,7 @@ export default class Status extends LoopressCommand {
         const missing = diff.toInstall.map((a) => a.slug);
         const wrongVersion = diff.toPin.map((p) => ({ live: p.from, pinned: p.to, slug: p.slug }));
         const inactive = diff.toActivate.map((a) => a.slug);
+        const unexpectedlyActive = diff.toDeactivate.map((a) => a.slug);
         const { untrackedActive } = diff;
         // `collisions` are also drift (Loopress doesn't own them yet); surface them under missing's
         // banner so `plugin push --force` is the obvious next step.
@@ -29,6 +37,7 @@ export default class Status extends LoopressCommand {
         const drift = missing.length > 0 ||
             wrongVersion.length > 0 ||
             inactive.length > 0 ||
+            unexpectedlyActive.length > 0 ||
             diff.toRemove.length > 0 ||
             collisions.length > 0;
         if (!drift && untrackedActive.length === 0) {
@@ -43,13 +52,23 @@ export default class Status extends LoopressCommand {
             this.log(`Version drift: ${w.slug} is ${w.live}, loopress.json pins ${w.pinned}`);
         if (inactive.length > 0)
             this.log(`Pinned but inactive: ${inactive.join(', ')}`);
+        if (unexpectedlyActive.length > 0)
+            this.log(`Pinned inactive but active: ${unexpectedlyActive.join(', ')}`);
         if (diff.toRemove.length > 0)
             this.log(`Managed by Loopress but dropped from loopress.json: ${diff.toRemove.join(', ')}`);
         if (untrackedActive.length > 0)
             this.log(`Active but untracked: ${untrackedActive.join(', ')}`);
         if (drift)
             this.exit(1);
-        return { drift, inactive, missing, status: drift ? 'drift' : 'in-sync', untrackedActive, wrongVersion };
+        return {
+            drift,
+            inactive,
+            missing,
+            status: drift ? 'drift' : 'in-sync',
+            unexpectedlyActive,
+            untrackedActive,
+            wrongVersion,
+        };
     }
     async fetchInstanceLock() {
         try {