@loopress/cli 0.27.0 → 0.29.0

package/dist/commands/plugin/audit.js

@@ -1,5 +1,6 @@
 import got from 'got';
 import { LoopressCommand } from '../../lib/base.js';
+import { pinVersion } from '../../types/plugin.js';
 import { compareVersions } from '../../utils/version.js';
 const WPVULN_BASE = 'https://www.wpvulnerability.net/plugin';
 const WPORG_INFO = 'https://api.wordpress.org/plugins/info/1.2/';
@@ -18,7 +19,7 @@ export default class Audit extends LoopressCommand {
         const advisories = [];
         const health = [];
         for (const slug of slugs) {
-            const found = await this.auditOne(slug, manifest[slug]);
+            const found = await this.auditOne(slug, pinVersion(manifest[slug]));
             advisories.push(...found.advisories);
             health.push(...found.health);
         }
@@ -26,16 +27,14 @@ export default class Audit extends LoopressCommand {
     }
     async auditOne(slug, pinned) {
         const [vulns, info] = await Promise.all([this.fetchVulnerabilities(slug), this.fetchHealth(slug)]);
-        const advisories = vulns
-            .filter((v) => pinned === 'latest' || affects(pinned, v.fixedIn))
-            .map((v) => ({ ...v, slug }));
+        const advisories = vulns.filter((v) => pinned === 'latest' || affects(pinned, v.fixedIn)).map((v) => ({ ...v, slug }));
         const health = info ? describeHealth(slug, pinned, info) : [];
         return { advisories, health };
     }
     async fetchHealth(slug) {
         try {
             const body = await got(WPORG_INFO, {
-                searchParams: { 'action': 'plugin_information', 'request[slug]': slug },
+                searchParams: { action: 'plugin_information', 'request[slug]': slug },
                 timeout: { request: 10_000 },
             }).json();
             return typeof body === 'object' && !('error' in body) ? body : null;

package/dist/commands/plugin/pull.d.ts

@@ -1,15 +1,21 @@
 import { LoopressCommand } from '../../lib/base.js';
+import { type ComposerPullResult } from '../../utils/composer.js';
 import { type MergeResult } from '../../utils/plugins.js';
 type PullResult = MergeResult & {
-    status: 'composer-managed' | 'dry-run' | 'success';
+    skipped?: ComposerPullResult['skipped'];
+    status: 'dry-run' | 'success';
+    untracked: string[];
 };
 export default class Pull extends LoopressCommand {
     static description: string;
     static enableJsonFlag: boolean;
     static examples: string[];
     static flags: {
+        plugin: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<PullResult>;
+    private selectPlugins;
 }
 export {};

package/dist/commands/plugin/pull.js

@@ -1,36 +1,68 @@
+import { checkbox } from '@inquirer/prompts';
+import { Flags } from '@oclif/core';
 import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { LoopressCommand } from '../../lib/base.js';
+import { isInteractive } from '../../lib/interactive.js';
+import { getComposerManagedSlugs, NOT_ON_WORDPRESS_ORG, pullIntoComposerJson, } from '../../utils/composer.js';
 import { writeLocalConfig } from '../../utils/loopress-config.js';
 import { mergePluginManifest, parseInstalledPlugins } from '../../utils/plugins.js';
 export default class Pull extends LoopressCommand {
-    static description = 'Pull installed plugins from WordPress into loopress.json, pinned to their live versions';
+    static description = 'Pull installed plugins from WordPress into loopress.json (or composer.json), pinned to their live versions. ' +
+        'Plugins already tracked are refreshed; new ones are offered as a list to tick, so plugins that only belong ' +
+        'on this environment (cache, security, backups) stay out of the project.';
     static enableJsonFlag = true;
-    static examples = ['$ lps plugin pull', '$ lps plugin pull --dry-run'];
+    static examples = ['$ lps plugin pull', '$ lps plugin pull --env production --plugin query-monitor'];
     static flags = {
         ...LoopressCommand.dryRunFlag,
+        ...LoopressCommand.yesFlag,
+        plugin: Flags.string({
+            description: 'Start tracking this installed plugin too, without asking (repeatable)',
+            multiple: true,
+        }),
     };
     async run() {
+        const { flags } = await this.parse(Pull);
         const { url } = this.siteConfig;
-        if (existsSync(join(process.cwd(), this.rootDir, 'composer.json'))) {
-            this.warn('This project has a composer.json, which is authoritative for plugins. Run `lps composer pull` instead.');
-            return { added: [], merged: this.localConfig.plugins ?? {}, status: 'composer-managed', updated: [] };
-        }
         this.log(`Pulling plugins from ${url}`);
         const raw = await this.wp.get('wp/v2/plugins');
-        const installed = parseInstalledPlugins(raw);
-        // Pin every plugin to the version actually running on the site. A later `plugin push`
-        // installs exactly this set via Composer + WPackagist; drift only surfaces when the pinned
-        // version and the live version disagree.
-        const incoming = Object.fromEntries(installed.map((p) => [p.slug, p.version]));
-        const { added, merged, updated } = mergePluginManifest(this.localConfig.plugins ?? {}, incoming);
+        const composerJsonPath = join(process.cwd(), this.rootDir, 'composer.json');
+        const composerJson = existsSync(composerJsonPath)
+            ? JSON.parse(await readFile(composerJsonPath, 'utf8'))
+            : undefined;
+        const declared = new Set(composerJson ? getComposerManagedSlugs(composerJson) : Object.keys(this.localConfig.plugins ?? {}));
+        const all = parseInstalledPlugins(raw);
+        const selected = await this.selectPlugins(all, declared, flags.plugin ?? [], flags.yes);
+        const installed = all.filter((p) => selected.has(p.slug));
+        const untracked = all.filter((p) => !selected.has(p.slug)).map((p) => p.slug);
+        if (untracked.length > 0) {
+            this.log(`  - Not tracked: ${untracked.join(', ')} (add one with \`lps plugin pull --plugin <slug>\`)`);
+        }
+        // Pin every plugin to the version actually running on the site, and record the inactive ones
+        // as such so a later `plugin push` doesn't switch them on. A later `plugin push` installs
+        // exactly this set via Composer + WPackagist; drift only surfaces when the pinned version and
+        // the live version disagree.
+        const versions = Object.fromEntries(installed.map((p) => [p.slug, p.version]));
+        // A composer.json is authoritative over loopress.json: pin the live versions there instead.
+        if (composerJson) {
+            const result = await pullIntoComposerJson(composerJsonPath, 'plugin', versions, {
+                dryRun: this.dryRun,
+                log: this.log.bind(this),
+            });
+            // Ticked, but Composer can't install it (premium or custom): still not tracked by the project.
+            const notInstallable = result.skipped.filter((s) => s.reason === NOT_ON_WORDPRESS_ORG).map((s) => s.slug);
+            return { ...result, status: this.dryRun ? 'dry-run' : 'success', untracked: [...untracked, ...notInstallable] };
+        }
+        const pins = Object.fromEntries(installed.map((p) => [p.slug, p.active ? p.version : { active: false, version: p.version }]));
+        const { added, merged, updated } = mergePluginManifest(this.localConfig.plugins ?? {}, pins);
         if (this.dryRun) {
             this.log(`[dry-run] Would write ${Object.keys(merged).length} plugins to loopress.json`);
             if (added.length > 0)
                 this.log(`  + ${added.join(', ')}`);
             for (const u of updated)
                 this.log(`  ~ ${u.slug} (${u.from} → ${u.to})`);
-            return { added, merged, status: 'dry-run', updated };
+            return { added, merged, status: 'dry-run', untracked, updated };
         }
         await writeLocalConfig({ ...this.localConfig, plugins: merged });
         this.log(`Wrote ${Object.keys(merged).length} plugins to loopress.json`);
@@ -38,6 +70,28 @@ export default class Pull extends LoopressCommand {
             this.log(`  + Added: ${added.join(', ')}`);
         for (const u of updated)
             this.log(`  ~ Updated: ${u.slug} ${u.from} → ${u.to}`);
-        return { added, merged, status: 'success', updated };
+        return { added, merged, status: 'success', untracked, updated };
+    }
+    // Plugins already tracked are always refreshed, plus any --plugin. Every other installed plugin
+    // is offered unticked, so a second pull from production never brings Wordfence back on its
+    // own. With nobody to ask (--yes, --json, CI, the MCP server), only those two sets count:
+    // "track everything" would bring the same problem back silently.
+    async selectPlugins(installed, declared, requested, yes) {
+        const slugs = new Set(installed.map((p) => p.slug));
+        for (const slug of requested) {
+            if (!slugs.has(slug))
+                this.warn(`--plugin ${slug}: not installed on this environment, skipped.`);
+        }
+        const selected = new Set([...slugs].filter((slug) => declared.has(slug) || requested.includes(slug)));
+        const candidates = installed.filter((p) => !selected.has(p.slug));
+        if (yes || candidates.length === 0 || this.jsonEnabled() || !isInteractive())
+            return selected;
+        const picked = await checkbox({
+            choices: candidates.map((p) => ({ name: `${p.slug} ${p.version}${p.active ? '' : ' (inactive)'}`, value: p.slug })),
+            message: 'Which of these plugins should the project track? Leave the ones that only belong on this environment unticked.',
+        });
+        for (const slug of picked)
+            selected.add(slug);
+        return selected;
     }
 }

package/dist/commands/plugin/push.d.ts

@@ -1,17 +1,19 @@
 import { PushCommand } from '../../lib/push-command.js';
 type PushResult = {
     activated: string[];
+    deactivated: string[];
     installed: string[];
     pinned: string[];
     pruned: string[];
     removed: string[];
-    status: 'composer-managed' | 'dry-run' | 'in-sync' | 'success';
+    status: 'dry-run' | 'in-sync' | 'success';
 };
 export default class Push extends PushCommand {
     static description: string;
     static enableJsonFlag: boolean;
     static examples: string[];
     static flags: {
+        activate: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         prune: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
@@ -24,6 +26,8 @@ export default class Push extends PushCommand {
     private fetchInstanceLock;
     private filesForNewlyInstalled;
     private guardForce;
+    private loadSource;
+    private logStillInactive;
     private result;
     private sync;
 }

package/dist/commands/plugin/push.js

@@ -1,86 +1,104 @@
 import { Flags } from '@oclif/core';
 import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { confirmUninstall } from '../../lib/interactive.js';
 import { PushCommand } from '../../lib/push-command.js';
-import { isNotFoundError } from '../../lib/wp-client.js';
-import { isDowngrade, parseCollisions, SYNC_TIMEOUT_MS } from '../../utils/plugin-sync.js';
+import { isLocalEnvironment, isNotFoundError } from '../../lib/wp-client.js';
+import { pinActive, pinVersion, pinVersions, } from '../../types/plugin.js';
+import { requireToInstall, toIntent, wpackagistRequire } from '../../utils/composer.js';
+import { isDowngrade, parseCollisions, SYNC_TIMEOUT_MS, } from '../../utils/plugin-sync.js';
 import { diffPlugins, lockedWpackagistSlugs, parseInstalledPlugins } from '../../utils/plugins.js';
-const IN_SYNC = { activated: [], installed: [], pinned: [], pruned: [], removed: [], status: 'in-sync' };
+import { isExactVersion } from '../../utils/version.js';
+const IN_SYNC = {
+    activated: [],
+    deactivated: [],
+    installed: [],
+    pinned: [],
+    pruned: [],
+    removed: [],
+    status: 'in-sync',
+};
 export default class Push extends PushCommand {
-    static description = 'Install plugins on WordPress to match loopress.json, pinned via Composer + WPackagist';
+    static description = 'Install plugins on WordPress to match loopress.json (or composer.json), via Composer + WPackagist';
     static enableJsonFlag = true;
     static examples = ['$ lps plugin push', '$ lps plugin push --dry-run', '$ lps plugin push --force --prune'];
     static flags = {
         ...PushCommand.dryRunFlag,
         ...PushCommand.yesFlag,
+        activate: Flags.boolean({
+            default: false,
+            description: 'composer.json projects only: activate every plugin it declares. Without it, plugins keep their current state and new ones stay inactive',
+        }),
         force: Flags.boolean({
             default: false,
             description: 'Allow downgrades and let Loopress take over plugins installed outside it (replaces their files)',
         }),
         prune: Flags.boolean({
             default: false,
-            description: 'Deactivate plugins that are active on the site but absent from loopress.json',
+            description: 'Deactivate plugins that are active on the site but absent from loopress.json (or composer.json)',
         }),
     };
     async run() {
         const { flags } = await this.parse(Push);
-        const { force, prune } = flags;
-        if (existsSync(join(process.cwd(), this.rootDir, 'composer.json'))) {
-            this.warn('This project has a composer.json, which is authoritative for plugins. Run `lps composer push` instead.');
-            return { ...IN_SYNC, status: 'composer-managed' };
-        }
-        const manifest = this.localConfig.plugins ?? {};
-        if (Object.keys(manifest).length === 0) {
-            this.error('No plugins found in loopress.json. Run `lps plugin pull` or `lps plugin add <slug>` first.');
-        }
+        const { activate, force, prune } = flags;
+        const source = await this.loadSource(activate);
+        const fromComposer = source.file === 'composer.json';
         this.log(`Pushing plugins to ${this.siteConfig.url}`);
+        if (fromComposer) {
+            this.log(`From composer.json, pushed whole (${source.packageCount} packages): themes and libraries it declares are synced too.`);
+        }
         const raw = await this.wp.get('wp/v2/plugins');
         const installed = parseInstalledPlugins(raw);
         const managed = lockedWpackagistSlugs(await this.fetchInstanceLock(), 'plugin');
-        const diff = diffPlugins(manifest, installed, managed);
-        this.guardForce(diff, force);
+        const diff = diffPlugins(source.manifest, installed, managed);
+        // composer.json records no active state: leave inactive plugins alone unless --activate.
+        const skippedActivations = fromComposer && !activate ? diff.toActivate : [];
+        if (fromComposer && !activate)
+            diff.toActivate = [];
+        this.guardForce(diff, force, source.file);
         const toPrune = prune ? diff.untrackedActive : [];
-        // A "latest" pin never shows as drift, but its newest upstream release may have moved
-        // since the last push, so a push must still run `composer update` to pick it up.
-        const hasLatestPin = Object.values(manifest).includes('latest');
-        if (!hasLatestPin && isNoop(diff, toPrune)) {
+        // A "latest" pin (or a Composer constraint) never shows as drift, but its newest upstream
+        // release may have moved since the last push, so a push must still run `composer update`.
+        const hasFloatingPin = Object.values(source.manifest).some((pin) => !isExactVersion(pinVersion(pin)));
+        if (!hasFloatingPin && isNoop(diff, toPrune)) {
             this.log('Everything is already in sync.');
+            this.logStillInactive(skippedActivations);
             return { ...IN_SYNC };
         }
         if (isNoop(diff, toPrune))
-            this.log('Refreshing plugins pinned to "latest" to their newest releases.');
+            this.log('Refreshing plugins not pinned to an exact version to their newest releases.');
         logPlan(this, diff, toPrune, force);
         if (this.dryRun) {
             return this.result(diff, { includeCollisions: true, pruned: toPrune, removed: diff.toRemove, status: 'dry-run' });
         }
         if (!(await confirmUninstall(diff.toRemove, this.yes)))
             this.error('Aborted.');
-        const deactivated = await this.deactivateEndangered(installed, diff, force);
-        // Plugins that must end up active: the ones we deactivated for the file swap (minus any
-        // being uninstalled) plus the ones the manifest wants active but that are inactive today.
-        const toReactivate = [...deactivated.filter((p) => !diff.toRemove.includes(p.slug)), ...diff.toActivate];
+        // Plugins switched off for the file swap come back on, unless loopress.json wants them inactive.
+        const deactivated = (await this.deactivateEndangered(installed, diff, force)).filter((p) => !diff.toRemove.includes(p.slug) && (fromComposer || pinActive(source.manifest[p.slug])));
         let response;
         try {
-            response = await this.sync(manifest, force);
+            response = await this.sync(source.intent, force);
         }
         catch (error) {
             // The file swap never happened, so restore the plugins we defensively deactivated
             // instead of leaving the site with them switched off.
-            await this.activate(deactivated.filter((p) => !diff.toRemove.includes(p.slug)));
+            await this.activate(deactivated);
             throw error;
         }
-        toReactivate.push(...(await this.filesForNewlyInstalled(diff.toInstall)));
-        if (toPrune.length > 0) {
-            await this.deactivate(installed.filter((p) => toPrune.includes(p.slug)));
-        }
-        await this.activate(toReactivate);
+        const activateNew = (slug) => (fromComposer ? activate : pinActive(source.manifest[slug]));
+        const newlyInstalled = await this.filesForNewlyInstalled(diff.toInstall);
+        const toActivate = [...deactivated, ...diff.toActivate, ...newlyInstalled.filter((p) => activateNew(p.slug))];
+        const toDeactivate = [...diff.toDeactivate, ...installed.filter((p) => toPrune.includes(p.slug))];
+        await this.deactivate(toDeactivate);
+        await this.activate(toActivate);
         if (response.output.trim())
             this.log(response.output.trim());
         this.log('Plugins synced.');
+        this.logStillInactive([...skippedActivations, ...newlyInstalled.filter((p) => !activateNew(p.slug))], fromComposer);
         await this.recordSuccess();
         return this.result(diff, {
-            activated: toReactivate.map((p) => p.slug),
+            activated: toActivate.map((p) => p.slug),
             includeCollisions: force,
             pruned: toPrune,
             removed: response.removed ?? diff.toRemove,
@@ -140,26 +158,60 @@ export default class Push extends PushCommand {
             return file ? [{ file, slug }] : [];
         });
     }
-    guardForce(diff, force) {
+    guardForce(diff, force, file) {
         if (force)
             return;
         if (diff.collisions.length > 0) {
             const list = diff.collisions.map((c) => `${c.slug} (${c.installedVersion})`).join(', ');
             this.error(`${diff.collisions.length} plugin(s) are already installed outside Loopress: ${list}. ` +
                 'Re-run with --force to let Loopress manage them (this replaces their files with the WPackagist build, ' +
-                'local modifications are lost), or remove them from loopress.json.');
+                `local modifications are lost), or remove them from ${file}.`);
         }
         const downgrades = diff.toPin.filter((p) => isDowngrade(p.from, p.to));
         if (downgrades.length > 0) {
             const list = downgrades.map((p) => `${p.slug} ${p.from} to ${p.to}`).join(', ');
             this.error(`Refusing to downgrade: ${list}. A downgrade only replaces plugin files, it does not undo database ` +
-                'migrations the newer version ran, which can break the site. Re-run with --force, or bump the version in loopress.json.');
+                `migrations the newer version ran, which can break the site. Re-run with --force, or bump the version in ${file}.`);
         }
     }
+    async loadSource(activate) {
+        const composerJsonPath = join(process.cwd(), this.rootDir, 'composer.json');
+        if (existsSync(composerJsonPath)) {
+            const composerJson = JSON.parse(await readFile(composerJsonPath, 'utf8'));
+            const includeDev = isLocalEnvironment(this.siteConfig.name);
+            const manifest = wpackagistRequire(composerJson, 'plugin', includeDev);
+            if (Object.keys(manifest).length === 0) {
+                this.error('No wpackagist-plugin/* package in composer.json. Run `lps plugin pull` first, or `lps composer push` to push it as is.');
+            }
+            const require = requireToInstall(composerJson, includeDev);
+            return { file: 'composer.json', intent: toIntent(require), manifest, packageCount: Object.keys(require).length };
+        }
+        if (activate) {
+            this.error('--activate only applies to projects with a composer.json: loopress.json already records whether each plugin is active.');
+        }
+        const manifest = this.localConfig.plugins ?? {};
+        if (Object.keys(manifest).length === 0) {
+            this.error('No plugins found in loopress.json. Run `lps plugin pull` or `lps plugin add <slug>` first.');
+        }
+        return {
+            file: 'loopress.json',
+            intent: { plugins: pinVersions(manifest) },
+            manifest,
+            packageCount: Object.keys(manifest).length,
+        };
+    }
+    // composer.json projects: plugins this push left inactive, and how to change that.
+    logStillInactive(plugins, fromComposer = true) {
+        if (!fromComposer || plugins.length === 0)
+            return;
+        this.log(`${plugins.length} plugin(s) from composer.json are inactive: ${plugins.map((p) => p.slug).join(', ')}.`);
+        this.log('Re-run with --activate to activate them, or activate them in wp-admin.');
+    }
     result(diff, opts) {
         const collisionSlugs = opts.includeCollisions ? diff.collisions.map((c) => c.slug) : [];
         return {
             activated: opts.activated ?? diff.toActivate.map((a) => a.slug),
+            deactivated: diff.toDeactivate.map((a) => a.slug),
             installed: [...diff.toInstall.map((a) => a.slug), ...collisionSlugs],
             pinned: diff.toPin.map((p) => p.slug),
             pruned: opts.pruned,
@@ -167,9 +219,9 @@ export default class Push extends PushCommand {
             status: opts.status,
         };
     }
-    async sync(manifest, force) {
+    async sync(intent, force) {
         try {
-            return await this.wp.post('loopress/v1/composer/sync', { force, intent: { plugins: manifest }, lock: null }, { timeoutMs: SYNC_TIMEOUT_MS });
+            return await this.wp.post('loopress/v1/composer/sync', { force, intent, lock: null }, { timeoutMs: SYNC_TIMEOUT_MS });
         }
         catch (error) {
             const collisions = parseCollisions(error);
@@ -184,6 +236,7 @@ function isNoop(diff, toPrune) {
     return (diff.toInstall.length === 0 &&
         diff.toPin.length === 0 &&
         diff.toActivate.length === 0 &&
+        diff.toDeactivate.length === 0 &&
         diff.toRemove.length === 0 &&
         diff.collisions.length === 0 &&
         toPrune.length === 0);
@@ -201,6 +254,7 @@ function logPlan(cmd, diff, prune, force) {
         section('To take over', diff.collisions.map((c) => `! ${c.slug} (installed outside Loopress)`));
     section('To re-pin', diff.toPin.map((p) => `~ ${p.slug} ${p.from} to ${p.to}`));
     section('To activate', diff.toActivate.map((a) => `↑ ${a.slug}`));
+    section('To deactivate', diff.toDeactivate.map((a) => `↓ ${a.slug}`));
     section('To uninstall', diff.toRemove.map((s) => `- ${s}`));
     section('To deactivate (--prune)', prune.map((s) => `⊘ ${s}`));
 }

package/dist/commands/plugin/status.d.ts

@@ -4,6 +4,7 @@ type StatusResult = {
     inactive: string[];
     missing: string[];
     status: 'composer-managed' | 'drift' | 'in-sync';
+    unexpectedlyActive?: string[];
     untrackedActive: string[];
     wrongVersion: Array<{
         live: string;

package/dist/commands/plugin/status.js

@@ -12,7 +12,14 @@ export default class Status extends LoopressCommand {
         const { url } = this.siteConfig;
         if (existsSync(join(process.cwd(), this.rootDir, 'composer.json'))) {
             this.warn('This project has a composer.json, which is authoritative for plugins. Run `lps composer` commands instead.');
-            return { drift: false, inactive: [], missing: [], status: 'composer-managed', untrackedActive: [], wrongVersion: [] };
+            return {
+                drift: false,
+                inactive: [],
+                missing: [],
+                status: 'composer-managed',
+                untrackedActive: [],
+                wrongVersion: [],
+            };
         }
         const manifest = this.localConfig.plugins ?? {};
         const raw = await this.wp.get('wp/v2/plugins');
@@ -22,6 +29,7 @@ export default class Status extends LoopressCommand {
         const missing = diff.toInstall.map((a) => a.slug);
         const wrongVersion = diff.toPin.map((p) => ({ live: p.from, pinned: p.to, slug: p.slug }));
         const inactive = diff.toActivate.map((a) => a.slug);
+        const unexpectedlyActive = diff.toDeactivate.map((a) => a.slug);
         const { untrackedActive } = diff;
         // `collisions` are also drift (Loopress doesn't own them yet); surface them under missing's
         // banner so `plugin push --force` is the obvious next step.
@@ -29,6 +37,7 @@ export default class Status extends LoopressCommand {
         const drift = missing.length > 0 ||
             wrongVersion.length > 0 ||
             inactive.length > 0 ||
+            unexpectedlyActive.length > 0 ||
             diff.toRemove.length > 0 ||
             collisions.length > 0;
         if (!drift && untrackedActive.length === 0) {
@@ -43,13 +52,23 @@ export default class Status extends LoopressCommand {
             this.log(`Version drift: ${w.slug} is ${w.live}, loopress.json pins ${w.pinned}`);
         if (inactive.length > 0)
             this.log(`Pinned but inactive: ${inactive.join(', ')}`);
+        if (unexpectedlyActive.length > 0)
+            this.log(`Pinned inactive but active: ${unexpectedlyActive.join(', ')}`);
         if (diff.toRemove.length > 0)
             this.log(`Managed by Loopress but dropped from loopress.json: ${diff.toRemove.join(', ')}`);
         if (untrackedActive.length > 0)
             this.log(`Active but untracked: ${untrackedActive.join(', ')}`);
         if (drift)
             this.exit(1);
-        return { drift, inactive, missing, status: drift ? 'drift' : 'in-sync', untrackedActive, wrongVersion };
+        return {
+            drift,
+            inactive,
+            missing,
+            status: drift ? 'drift' : 'in-sync',
+            unexpectedlyActive,
+            untrackedActive,
+            wrongVersion,
+        };
     }
     async fetchInstanceLock() {
         try {

package/dist/commands/project/config.js

@@ -5,7 +5,7 @@ import { bootstrapLoopressFull } from '../../lib/bootstrap-full-install.js';
 import { isInteractive } from '../../lib/interactive.js';
 import { isLoopressFullActive } from '../../lib/plugin-detection.js';
 import { authorizeWithBrowser } from '../../lib/wp-authorize-flow.js';
-import { WpClient } from '../../lib/wp-client.js';
+import { isLocalEnvironment, WpClient } from '../../lib/wp-client.js';
 import { diagnoseWpSite } from '../../lib/wp-site-diagnostic.js';
 const NEW_PROJECT = '__new__';
 const AUTH_BROWSER = 'browser';
@@ -48,16 +48,20 @@ export default class Config extends Command {
         const rawUrl = await input({
             message: 'WordPress URL',
             validate(value) {
+                let parsed;
                 try {
-                    const parsed = new URL(value);
-                    if (!['http:', 'https:'].includes(parsed.protocol)) {
-                        return 'URL must start with http:// or https://';
-                    }
-                    return true;
+                    parsed = new URL(value);
                 }
                 catch {
                     return 'Invalid URL';
                 }
+                if (!['http:', 'https:'].includes(parsed.protocol)) {
+                    return 'URL must start with http:// or https://';
+                }
+                if (parsed.protocol === 'http:' && !isLocalEnvironment(envName)) {
+                    return `Plain HTTP would send the Application Password in cleartext. Use HTTPS. Plain HTTP is allowed only for the "local" environment (this one is "${envName}").`;
+                }
+                return true;
             },
         });
         let url = rawUrl;
@@ -88,10 +92,10 @@ export default class Config extends Command {
         this.log('→ Run `lps project switch` to change the active project or environment');
     }
     async maybeBootstrapLoopressFull(env) {
-        const { token, url } = env;
+        const { name, token, url } = env;
         if (!token)
             return; // env was just built with one a few lines up; guard only narrows the type
-        const wp = new WpClient(url, token);
+        const wp = new WpClient(url, token, name);
         // A detection failure (network hiccup, plugins REST disabled) is treated as "assume it's
         // there" rather than surprising the user with an account-creating prompt they didn't ask
         // for; `lps project config` can simply be re-run if it genuinely isn't installed.

package/dist/commands/promote.d.ts

@@ -17,8 +17,10 @@ export default class Promote extends Command {
         'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<PromoteResult>;
+    private assertDirsInsideProject;
     private confirmPromotion;
     private delegateArgv;
+    private enterScratchCopy;
     private requireEnvironment;
     private resolveProject;
 }