@loopress/cli 0.27.0 → 0.29.0

package/dist/lib/local-callback-server.js

@@ -2,15 +2,6 @@ import { Buffer } from 'node:buffer';
 import { randomBytes, timingSafeEqual } from 'node:crypto';
 import { createServer } from 'node:http';
 import { openBrowser } from './open-browser.js';
-async function readBody(req) {
-    const chunks = [];
-    for await (const chunk of req)
-        chunks.push(chunk);
-    return Buffer.concat(chunks).toString('utf8');
-}
-function parseFormData(body) {
-    return Object.fromEntries(new URLSearchParams(body));
-}
 /** Constant-time compare that also tolerates a length mismatch without throwing. */
 function safeEqual(a, b) {
     const bufferA = Buffer.from(a);
@@ -22,13 +13,14 @@ function safeEqual(a, b) {
  * local server; this factors out the server setup, timeout, and browser-opening boilerplate.
  *
  * The loopback server is unauthenticated, so any local process or web page open during the wait
- * could otherwise POST forged credentials to it (RFC 8252 section 8.9). Two guards close that:
+ * could otherwise send forged credentials to it (RFC 8252 section 8.9). Two guards close that:
  *
  * - a 32-byte `state` generated here, threaded into the authorize URL by `buildUrl`, and required
- *   back (constant-time compare) on any request that carries credentials;
- * - an `Origin` allowlist: a browser sends `Origin` on the relay's cross-site form POST, so a
- *   stray page's POST (carrying its own origin) is rejected. Top-level navigations send no
- *   `Origin` and are allowed, which is why `state` is the primary control.
+ *   back (constant-time compare) on any request with a query string, the only place credentials
+ *   are read from;
+ * - an `Origin` allowlist: the legitimate callbacks are top-level redirects, which send no
+ *   `Origin`, so a request from a page script (carrying its own origin) is rejected. That's
+ *   defense in depth, `state` is the primary control.
  *
  * The first request that looks like a callback (valid or not) shuts the server down, so a
  * failed guess gets no second try within the window.
@@ -38,23 +30,26 @@ export async function waitForLocalCallback(options) {
     const state = randomBytes(32).toString('hex');
     return new Promise((resolve, reject) => {
         function finish(res, page) {
-            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            // `Connection: close` (here and below): server.close() only refuses new connections, a
+            // kept-alive socket would otherwise still reach this handler after the shutdown.
+            res.writeHead(200, { Connection: 'close', 'Content-Type': 'text/html; charset=utf-8' });
             res.end(page);
             clearTimeout(timer);
             server.close();
         }
         function rejectRequest(res, message) {
-            res.writeHead(403, { 'Content-Type': 'text/plain' });
+            res.writeHead(403, { Connection: 'close', 'Content-Type': 'text/plain' });
             res.end(message);
             clearTimeout(timer);
             server.close();
             reject(new Error(message));
         }
-        async function handleIncoming(req, res) {
+        function handleIncoming(req, res) {
             try {
                 const url = new URL(req.url ?? '/', 'http://localhost');
-                const body = req.method === 'POST' ? parseFormData(await readBody(req)) : {};
-                const looksLikeCallback = url.searchParams.has('state') || Object.keys(body).length > 0;
+                // Any query string counts, not just one carrying `state`: credentials are read from the
+                // query, so a request with `password=` but no `state` must not slip past the check.
+                const looksLikeCallback = url.search !== '';
                 if (looksLikeCallback) {
                     const { origin } = req.headers;
                     if (origin !== undefined && !options.allowedOrigins.includes(origin)) {
@@ -79,7 +74,6 @@ export async function waitForLocalCallback(options) {
                         res.writeHead(400, { 'Content-Type': 'text/plain' });
                         res.end(message);
                     },
-                    body,
                 });
             }
             catch (error) {
@@ -89,7 +83,7 @@ export async function waitForLocalCallback(options) {
                 reject(error instanceof Error ? error : new Error(String(error)));
             }
         }
-        const server = createServer((req, res) => { void handleIncoming(req, res); });
+        const server = createServer(handleIncoming);
         server.on('error', (err) => {
             clearTimeout(timer);
             reject(err);
@@ -100,13 +94,17 @@ export async function waitForLocalCallback(options) {
         }, timeoutMs);
         server.listen(0, '127.0.0.1', () => {
             const { port } = server.address();
-            const targetUrl = options.buildUrl(`http://localhost:${port}`, state);
+            const targetUrl = options.buildUrl(`http://${options.callbackHost ?? 'localhost'}:${port}`, state);
             options.log(options.openingMessage);
             options.log(`\nIf it doesn't open automatically, visit:\n${targetUrl}\n`);
             openBrowser(targetUrl);
         });
     });
 }
+/**
+ * The page rewrites its own URL to `/` on load, so the callback query string (an Application
+ * Password, a console token) doesn't stay in the browser history or address bar.
+ */
 export function renderResultPage(options) {
     return `<!DOCTYPE html>
 <html lang="en">
@@ -144,6 +142,7 @@ export function renderResultPage(options) {
     <h1>${options.heading}</h1>
     <p>You can close this tab and return to your terminal.</p>
   </div>
+  <script>history.replaceState(null, '', '/')</script>
 </body>
 </html>`;
 }

package/dist/lib/php-files-command.js

@@ -274,6 +274,8 @@ export function resourceListCommand(spec) {
 }
 export function resourceRmCommand(spec) {
     class ResourceRm extends LoopressCommand {
+        // `remove` matches `lps app remove` and `lps option remove`, `rm` stays for existing scripts.
+        static aliases = [`${spec.cliName}:remove`];
         static args = {
             filename: Args.string({
                 description: `The ${spec.noun} to remove, its slug without the .php extension (e.g. "hello" or "invoice-pdf/[order_id]")`,
@@ -282,7 +284,7 @@ export function resourceRmCommand(spec) {
         };
         static description = spec.rmDescription;
         static enableJsonFlag = true;
-        static examples = [`$ lps ${spec.cliName} rm hello`, `$ lps ${spec.cliName} rm hello --yes`];
+        static examples = [`$ lps ${spec.cliName} rm hello`, `$ lps ${spec.cliName} remove hello --yes`];
         static flags = { ...LoopressCommand.dryRunFlag, ...LoopressCommand.yesFlag };
         async run() {
             const { args } = await this.parse(ResourceRm);

package/dist/lib/push-command.d.ts

@@ -2,12 +2,17 @@ import { LoopressCommand } from './base.js';
 import { type ResourceState } from './diff-state.js';
 import { type ResourceStateProvider } from './resource-state.js';
 export declare abstract class PushCommand extends LoopressCommand {
+    static baseFlags: {
+        'production-confirmed': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        env: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
     protected failedCount: number;
     private refusedByGuard;
     protected captureBeforePushState(provider: ResourceStateProvider, dir: string): Promise<ResourceState | undefined>;
     catch(err: Error): Promise<void>;
     protected guardProductionPush(): Promise<void>;
     init(): Promise<void>;
+    protected previewRemote(provider: ResourceStateProvider, dir: string): Promise<void>;
     protected recordDeployment(status: 'failure' | 'success'): Promise<void>;
     protected recordSuccess(): Promise<void>;
     protected reportTaskFailure(message: string, error: unknown, task?: {

package/dist/lib/push-command.js

@@ -1,3 +1,4 @@
+import { Flags } from '@oclif/core';
 import got from 'got';
 import { Listr } from 'listr2';
 import { resolve } from 'node:path';
@@ -7,19 +8,28 @@ import { LoopressCommand } from './base.js';
 import { guardProductionPush } from './guard-production-push.js';
 import { writeSnapshot } from './snapshot-store.js';
 export class PushCommand extends LoopressCommand {
+    // Passed by an aggregate command (`lps theme push`) that already confirmed production once,
+    // so its steps skip that prompt while still asking their own confirmations (uninstalls).
+    static baseFlags = {
+        ...LoopressCommand.baseFlags,
+        'production-confirmed': Flags.boolean({ hidden: true }),
+    };
     failedCount = 0;
     // Refusals of the production guard never reach the site, so they must not pollute the
     // deployment history with failure records.
     refusedByGuard = false;
     // Reads `provider`'s remote state right before a real push, for `writeAfterPushSnapshot` to
-    // pair with the actual post-push remote state once the push completes. A dry run changes
-    // nothing, so there is nothing to snapshot. Best-effort: a read failure (the site briefly
-    // unreachable) must never block the push itself, the same "never interrupt the push flow"
-    // stance recordDeployment takes; `undefined` tells `writeAfterPushSnapshot` there is no
-    // restore point to complete.
+    // pair with the actual post-push remote state once the push completes. Best-effort: a read
+    // failure (the site briefly unreachable) must never block the push itself, the same "never
+    // interrupt the push flow" stance recordDeployment takes; `undefined` tells
+    // `writeAfterPushSnapshot` there is no restore point to complete.
+    //
+    // On a dry run, the same read is the preview's check against the site (see previewRemote).
     async captureBeforePushState(provider, dir) {
-        if (this.dryRun)
+        if (this.dryRun) {
+            await this.previewRemote(provider, dir);
             return undefined;
+        }
         try {
             return await provider.remote(this.wp, (message) => {
                 this.warn(message);
@@ -34,7 +44,7 @@ export class PushCommand extends LoopressCommand {
         if (!this.dryRun && !this.refusedByGuard && this.siteConfig) {
             await this.recordDeployment('failure');
         }
-        return super.catch(err);
+        await super.catch(err);
     }
     async guardProductionPush() {
         await guardProductionPush({
@@ -44,13 +54,25 @@ export class PushCommand extends LoopressCommand {
                 this.refusedByGuard = true;
             },
             siteConfig: this.siteConfig,
-            yes: this.yes,
+            yes: this.yes || this.productionConfirmed,
         });
     }
     async init() {
         await super.init();
         await this.guardProductionPush();
     }
+    // A dry run used to stay local, so it announced "pushed" for a resource the site would refuse
+    // (ACF or Rank Math missing: a 400 or 409 on the real push). It now reads the site the same way
+    // `lps diff` does and fails the same way, so the preview, and the MCP server's preview and
+    // pre-apply check built on it, see what the real push will hit.
+    async previewRemote(provider, dir) {
+        try {
+            await provider.remote(this.wp, () => { }, dir);
+        }
+        catch (error) {
+            this.error(`The site would refuse this push: ${error.message}`);
+        }
+    }
     async recordDeployment(status) {
         const token = process.env.LOOPRESS_TOKEN ?? authManager.getAuth()?.token ?? null;
         if (!token)

package/dist/lib/resource-state.js

@@ -4,9 +4,10 @@ import { ACF_OBJECT_TYPES, acfEndpoint, getAcfKey } from '../utils/acf-format.js
 import { FORM_ENDPOINT, getFormId } from '../utils/form-format.js';
 import { getMenuSlug, MENU_ENDPOINT, MENU_LOCATIONS_ENDPOINT } from '../utils/menu-format.js';
 import { optionEndpoint, parseLocalOption } from '../utils/option-format.js';
-import { formatPageProblems, PAGES_ENDPOINT, readLocalPages } from '../utils/page-format.js';
+import { formatPageProblems, PAGES_ENDPOINT, readLocalHtmlFiles, readLocalPages } from '../utils/page-format.js';
 import { DEFAULT_POST_TYPES, SEO_REDIRECTS_ENDPOINT, SEO_SETTINGS_ENDPOINT, seoPostMetaEndpoint, } from '../utils/seo-format.js';
 import { normalizeSnippet, SNIPPETS_ENDPOINT, stripPhpOpeningTag } from '../utils/snippet-format.js';
+import { CHILD_THEME_ENDPOINT, parsePartFile, parseTemplateFile, TEMPLATE_SLUG_RULE } from '../utils/template-format.js';
 import { canonicalGlobalStyles, getActiveThemeGlobalStyles, globalStylesEndpoint, THEME_STYLES_FILE_SUFFIX, } from '../utils/theme-styles-format.js';
 import { loadFiles } from './load-files.js';
 import { loadSnippets } from './load-snippets.js';
@@ -217,6 +218,45 @@ const pageProvider = {
     resource: 'page',
     title: 'Pages',
 };
+// ---- Templates and parts ---------------------------------------------------------------
+// Both live in the Loopress child theme (ChildThemeController), one GET answers for both. A
+// template or part edited in the Site Editor gets `siteEditor: 'customized'` on the remote side
+// only, so it always shows as drift: its database copy is what the site renders, not the file.
+async function childThemeState(wp, kind) {
+    const child = await wp.get(CHILD_THEME_ENDPOINT);
+    const files = child[kind];
+    const state = new Map(files.map(({ slug, ...rest }) => [slug, rest]));
+    for (const entry of child.customized) {
+        const [dir, slug] = entry.split('/', 2);
+        if (dir === kind)
+            state.set(slug, { ...state.get(slug), siteEditor: 'customized' });
+    }
+    return state;
+}
+const templateProvider = {
+    dirKind: 'template',
+    async local(dir) {
+        const { files, problems } = await readLocalHtmlFiles(dir, parseTemplateFile, TEMPLATE_SLUG_RULE);
+        if (problems.length > 0)
+            throw new Error(formatPageProblems(problems));
+        return new Map(files.map(({ slug, ...rest }) => [slug, rest]));
+    },
+    remote: async (wp) => childThemeState(wp, 'templates'),
+    resource: 'template',
+    title: 'Templates',
+};
+const partProvider = {
+    dirKind: 'part',
+    async local(dir) {
+        const { files, problems } = await readLocalHtmlFiles(dir, parsePartFile, TEMPLATE_SLUG_RULE);
+        if (problems.length > 0)
+            throw new Error(formatPageProblems(problems));
+        return new Map(files.map(({ slug, ...rest }) => [slug, rest]));
+    },
+    remote: async (wp) => childThemeState(wp, 'parts'),
+    resource: 'part',
+    title: 'Template parts',
+};
 // ---- SEO --------------------------------------------------------------------------------
 function canonicalRedirect(redirect) {
     return omit(redirect, REDIRECT_VOLATILE_KEYS);
@@ -368,12 +408,13 @@ const optionsProvider = {
         const tracked = await loadFiles(dir, {
             extension: '.json',
             onSkip: onWarn,
-            parse: (raw) => parseLocalOption(raw).name,
+            parse: parseLocalOption,
         });
         const state = new Map();
-        for (const name of tracked) {
+        for (const { name, refs } of tracked) {
             try {
-                const option = await wp.get(optionEndpoint(name));
+                // With the file's refs, so post references compare as paths on both sides.
+                const option = await wp.get(optionEndpoint(name, refs));
                 state.set(name, { autoload: option.autoload, value: option.value });
             }
             catch (error) {
@@ -426,6 +467,8 @@ export const RESOURCE_STATE_PROVIDERS = [
     acfProvider,
     apiProvider,
     hookProvider,
+    templateProvider,
+    partProvider,
     pageProvider,
     seoProvider,
     menuProvider,

package/dist/lib/rollback-command.d.ts

@@ -16,6 +16,7 @@ export type RollbackResult = {
     status: 'dry-run' | 'listed' | 'no-op' | 'success';
 };
 export declare function resourceRollbackCommand(resource: string, options: {
+    command?: string;
     description: string;
     pathNoun: string;
 }): typeof LoopressCommand;

package/dist/lib/rollback-command.js

@@ -33,7 +33,9 @@ function indentPatch(patch) {
 // anything, this runs the equivalent of `lps <resource> diff` between the environment's current
 // state and the state the original push expected to leave behind, and requires explicit
 // confirmation (the same interactive/`--yes` shape as guardProductionPush) when they differ.
+// `command` is the CLI topic when it isn't the resource key (e.g. `theme style` for theme-styles).
 export function resourceRollbackCommand(resource, options) {
+    const command = options.command ?? resource;
     class ResourceRollback extends LoopressCommand {
         static args = {
             path: Args.string({ description: `Path to ${options.pathNoun} (overrides project config)` }),
@@ -41,10 +43,10 @@ export function resourceRollbackCommand(resource, options) {
         static description = options.description;
         static enableJsonFlag = true;
         static examples = [
-            `$ lps ${resource} rollback`,
-            `$ lps ${resource} rollback --list`,
-            `$ lps ${resource} rollback --to 1732000000000`,
-            `$ lps ${resource} rollback --dry-run`,
+            `$ lps ${command} rollback`,
+            `$ lps ${command} rollback --list`,
+            `$ lps ${command} rollback --to 1732000000000`,
+            `$ lps ${command} rollback --dry-run`,
         ];
         static flags = {
             ...LoopressCommand.dryRunFlag,
@@ -105,7 +107,7 @@ export function resourceRollbackCommand(resource, options) {
             // an item present now but absent from the snapshot stays present after "restoring" it.
             if (restoreDiff.removed.length > 0) {
                 this.warn(`${pluralize(restoreDiff.removed.length, 'item')} present now but not in this snapshot will NOT be removed ` +
-                    `(${restoreDiff.removed.join(', ')}): restoring only creates and updates, the same as \`lps ${resource} push\`. Remove ${restoreDiff.removed.length === 1 ? 'it' : 'them'} by hand if that's part of undoing the original push.`);
+                    `(${restoreDiff.removed.join(', ')}): restoring only creates and updates, the same as \`lps ${command} push\`. Remove ${restoreDiff.removed.length === 1 ? 'it' : 'them'} by hand if that's part of undoing the original push.`);
             }
             if (this.dryRun) {
                 return { drift: driftSummary, id: snapshot.id, restored: summarize(restoreDiff), status: 'dry-run' };
@@ -125,7 +127,7 @@ export function resourceRollbackCommand(resource, options) {
                 // production guard and the drift confirmation above already covered what the delegated
                 // push's own guard would ask again, same reasoning as the top-level `lps push`
                 // delegating to each resource's push command in commands/push.ts.
-                await this.config.runCommand(`${resource}:push`, [tmpDir, '--env', this.siteConfig.name, '--yes']);
+                await this.config.runCommand(`${command.replaceAll(' ', ':')}:push`, [tmpDir, '--env', this.siteConfig.name, '--yes']);
             }
             finally {
                 // A cleanup failure here must never hide a real error from the push above: warn about

package/dist/lib/rotate-app-password.js

@@ -8,14 +8,14 @@ export function isAppPasswordStale(addedAt) {
 // the old one. Reversing this order risks locking the user out if the new one is somehow bad.
 export async function rotateAppPassword(env) {
     const [user] = env.token.split(':', 1);
-    const oldClient = new WpClient(env.url, env.token);
+    const oldClient = new WpClient(env.url, env.token, env.name);
     const old = await oldClient.get(`${APPLICATION_PASSWORDS_PATH}/introspect`);
     const created = await oldClient.post(APPLICATION_PASSWORDS_PATH, { name: 'Loopress' });
     if (!created.password) {
         throw new Error(`WordPress did not return a password when creating the new application password on ${env.url}.`);
     }
     const newToken = `${user}:${created.password}`;
-    const newClient = new WpClient(env.url, newToken);
+    const newClient = new WpClient(env.url, newToken, env.name);
     try {
         await newClient.get(`${APPLICATION_PASSWORDS_PATH}/introspect`);
     }

package/dist/lib/snapshot-store.js

@@ -7,7 +7,7 @@ export const SNAPSHOT_RETENTION = 10;
 // representation; snapshots round-trip through a plain object instead. Keys are sorted so two
 // snapshots of the same state serialize identically (stable diffs, deterministic tests).
 export function stateToRecord(state) {
-    return Object.fromEntries([...state].sort(([a], [b]) => a.localeCompare(b)));
+    return Object.fromEntries([...state].toSorted(([a], [b]) => a.localeCompare(b)));
 }
 export function recordToState(record) {
     return new Map(Object.entries(record));
@@ -113,7 +113,7 @@ export async function listSnapshots(rootDir, resource, environment) {
             // rather than failing the whole listing; it stays on disk for a human to inspect.
         }
     }
-    return summaries.sort((a, b) => Number(b.id) - Number(a.id));
+    return summaries.toSorted((a, b) => Number(b.id) - Number(a.id));
 }
 // `id` undefined reads the most recent snapshot for this environment (the common
 // `lps <resource> rollback` case). Throws a message ready to show the user directly: no

package/dist/lib/validate-local.js

@@ -4,6 +4,7 @@ import { configManager } from '../config/project-config.manager.js';
 import { parseLocalOption } from '../utils/option-format.js';
 import { readLocalPages } from '../utils/page-format.js';
 import { parseType } from '../utils/snippet-format.js';
+import { readLocalTemplates } from '../utils/template-format.js';
 import { loadSnippets } from './load-snippets.js';
 import { readdirTolerant } from './readdir-tolerant.js';
 // Directories holding one JSON document per resource. Snippets (code file plus JSON sidecar)
@@ -17,8 +18,10 @@ const DEFAULT_DIR = {
     menuDir: 'menus',
     optionsDir: 'options',
     pageDir: 'pages',
+    partDir: 'parts',
     seoDir: 'seo',
     snippetsDir: 'snippets',
+    templateDir: 'templates',
     themeStylesDir: 'theme',
 };
 // Inspects the local tracked files under `cwd` without contacting WordPress: JSON files parse
@@ -49,6 +52,9 @@ export async function validateLocal(cwd) {
     const pages = await readLocalPages(resolve('pageDir'));
     checked += pages.pages.length + pages.problems.length;
     problems.push(...pages.problems);
+    const templates = await readLocalTemplates(resolve('templateDir'), resolve('partDir'));
+    checked += templates.templates.length + templates.parts.length + templates.problems.length;
+    problems.push(...templates.problems);
     return { checked, problems, valid: problems.length === 0 };
 }
 // Recursive: both api/ and hooks/ files can live in a nested path-segment directory

package/dist/lib/wp-authorize-flow.d.ts

@@ -3,24 +3,17 @@ export type AuthorizeResult = {
     userLogin: string;
 };
 /**
- * Relays the authorization through the Loopress API so that WordPress's
- * `success_url` / `reject_url` can be valid HTTPS URLs.  The API receives the
- * redirect from WordPress and forwards the credentials back to a local callback
- * server via a form POST (keeping them out of the browser's address bar).
+ * Asks WordPress for an Application Password through its own authorize-application.php page,
+ * with the CLI's loopback server as `success_url` / `reject_url`:
  *
- * Flow:
- *   1. Start a local HTTP server on `127.0.0.1`.
- *   2. Open the browser to `https://api.loopress.dev/auth/wp-authorize` with the local
- *      callback URL and the target WordPress site as query params.
- *   3. That page redirects the user to WordPress's authorize-application.php,
- *      passing the API's callback endpoint as `success_url` (HTTPS).
- *   4. After the user approves, WordPress redirects to the API callback.
- *   5. The API callback returns an HTML page that POSTs a form with the
- *      Application Password to the local callback server.
- *   6. The local server extracts the credentials and resolves the promise.
+ *   1. Start a local HTTP server on 127.0.0.1.
+ *   2. Open the browser on `<site>/wp-admin/authorize-application.php`.
+ *   3. After the user approves, WordPress redirects to the loopback URL with `user_login` and
+ *      `password` appended to its query string (`state` is kept, WordPress only adds params).
  *
- * The `state` value is threaded through `callbackUrl` (the relay copies it verbatim into the
- * form's POST target), so it comes back as a query param on the credential POST and
- * `waitForLocalCallback` can match it before this handler runs.
+ * The callback host must be the literal `127.0.0.1`, not `localhost`: WordPress 7.0+ only exempts
+ * `127.0.0.1` and `[::1]` from its HTTPS requirement on these URLs. Older versions are screened
+ * out beforehand by `diagnoseWpSite`. The credentials land in the browser history as part of the
+ * callback URL, so the result page rewrites that history entry (see `renderResultPage`).
  */
 export declare function authorizeWithBrowser(siteUrl: string, log: (message: string) => void): Promise<AuthorizeResult>;

package/dist/lib/wp-authorize-flow.js

@@ -1,44 +1,40 @@
 import { renderResultPage, waitForLocalCallback } from './local-callback-server.js';
 /**
- * Relays the authorization through the Loopress API so that WordPress's
- * `success_url` / `reject_url` can be valid HTTPS URLs.  The API receives the
- * redirect from WordPress and forwards the credentials back to a local callback
- * server via a form POST (keeping them out of the browser's address bar).
+ * Asks WordPress for an Application Password through its own authorize-application.php page,
+ * with the CLI's loopback server as `success_url` / `reject_url`:
  *
- * Flow:
- *   1. Start a local HTTP server on `127.0.0.1`.
- *   2. Open the browser to `https://api.loopress.dev/auth/wp-authorize` with the local
- *      callback URL and the target WordPress site as query params.
- *   3. That page redirects the user to WordPress's authorize-application.php,
- *      passing the API's callback endpoint as `success_url` (HTTPS).
- *   4. After the user approves, WordPress redirects to the API callback.
- *   5. The API callback returns an HTML page that POSTs a form with the
- *      Application Password to the local callback server.
- *   6. The local server extracts the credentials and resolves the promise.
+ *   1. Start a local HTTP server on 127.0.0.1.
+ *   2. Open the browser on `<site>/wp-admin/authorize-application.php`.
+ *   3. After the user approves, WordPress redirects to the loopback URL with `user_login` and
+ *      `password` appended to its query string (`state` is kept, WordPress only adds params).
  *
- * The `state` value is threaded through `callbackUrl` (the relay copies it verbatim into the
- * form's POST target), so it comes back as a query param on the credential POST and
- * `waitForLocalCallback` can match it before this handler runs.
+ * The callback host must be the literal `127.0.0.1`, not `localhost`: WordPress 7.0+ only exempts
+ * `127.0.0.1` and `[::1]` from its HTTPS requirement on these URLs. Older versions are screened
+ * out beforehand by `diagnoseWpSite`. The credentials land in the browser history as part of the
+ * callback URL, so the result page rewrites that history entry (see `renderResultPage`).
  */
 export async function authorizeWithBrowser(siteUrl, log) {
     return waitForLocalCallback({
-        allowedOrigins: ['https://api.loopress.dev'],
+        // WordPress reaches the callback through a top-level GET redirect, which carries no Origin,
+        // so any request that does carry one isn't WordPress.
+        allowedOrigins: [],
         buildUrl(callbackBaseUrl, state) {
-            const relayUrl = 'https://api.loopress.dev/auth/wp-authorize';
+            const callbackUrl = `${callbackBaseUrl}/?state=${state}`;
             const params = new URLSearchParams({
-                callbackUrl: `${callbackBaseUrl}?state=${state}`,
-                wpUrl: siteUrl,
+                app_name: 'Loopress',
+                reject_url: `${callbackUrl}&cancelled=1`,
+                success_url: callbackUrl,
             });
-            return `${relayUrl}?${params}`;
+            return `${siteUrl}/wp-admin/authorize-application.php?${params}`;
         },
-        handleRequest(url, { resolveWithPage, rejectWithPage, respondBadRequest, body }) {
-            if (url.searchParams.has('cancelled') || body.cancelled) {
+        callbackHost: '127.0.0.1',
+        handleRequest(url, { resolveWithPage, rejectWithPage, respondBadRequest }) {
+            if (url.searchParams.has('cancelled')) {
                 rejectWithPage(REJECTED_PAGE, new Error('Authorization rejected in WordPress.'));
                 return;
             }
-            // Credentials come from the relay's form POST only. Reading them from the query string
-            // would let them land in shell history, proxy logs and the browser address bar (F24).
-            const { password, user_login: userLogin } = body;
+            const password = url.searchParams.get('password');
+            const userLogin = url.searchParams.get('user_login');
             if (!password || !userLogin) {
                 respondBadRequest('Missing password or user_login');
                 return;
@@ -46,7 +42,7 @@ export async function authorizeWithBrowser(siteUrl, log) {
             resolveWithPage(SUCCESS_PAGE, { password, userLogin });
         },
         log,
-        openingMessage: 'Opening WordPress in your browser to authorize Loopress...',
+        openingMessage: 'Opening WordPress in your browser to authorize Loopress...\nIf WordPress says the URL must be served over a secure connection (WordPress older than 7.0), press Ctrl-C and run `lps project config` again, choosing manual entry.',
         timeoutMessage: 'Authorization timed out after 5 minutes.',
     });
 }

package/dist/lib/wp-client.d.ts

@@ -1,4 +1,7 @@
 export declare const REQUEST_TIMEOUT_MS = 30000;
+export declare const LOCAL_ENVIRONMENT_NAME = "local";
+export declare function isLocalEnvironment(environmentName: string | undefined): boolean;
+export declare function assertSecureSiteUrl(siteUrl: string, environmentName: string | undefined): void;
 /**
  * HTTP client for a WordPress site's REST API.
  * Paths are relative to `<site>/wp-json/`, e.g. `loopress/v1/snippets` or `wp/v2/plugins`.
@@ -6,7 +9,7 @@ export declare const REQUEST_TIMEOUT_MS = 30000;
 export declare class WpClient {
     private readonly siteUrl;
     private readonly client;
-    constructor(siteUrl: string, token: string);
+    constructor(siteUrl: string, token: string, environmentName?: string);
     delete<T = unknown>(path: string, options?: RequestOptions): Promise<T>;
     get<T>(path: string, options?: RequestOptions): Promise<T>;
     getAll<T>(path: string, options?: RequestOptions & {

package/dist/lib/wp-client.js

@@ -1,6 +1,29 @@
 import got from 'got';
 import { Buffer } from 'node:buffer';
 export const REQUEST_TIMEOUT_MS = 30_000;
+// The one environment allowed to talk plain HTTP: Loopress's local dev environment, identified
+// by its config name (the same "local" environment `lps dev` targets), never by the URL's host.
+// Locality is a property of the configured environment, not of a hostname, so a real remote site
+// can never opt into cleartext just by resolving to a `.local`/loopback-looking name.
+export const LOCAL_ENVIRONMENT_NAME = 'local';
+export function isLocalEnvironment(environmentName) {
+    return environmentName === LOCAL_ENVIRONMENT_NAME;
+}
+// Throws when a URL would send credentials in cleartext: http:// for any environment other than
+// the local one. The trust boundary is here, at the client, so a hand-edited config.json or
+// loopress.json cannot bypass the check the interactive prompt also applies.
+export function assertSecureSiteUrl(siteUrl, environmentName) {
+    let parsed;
+    try {
+        parsed = new URL(siteUrl);
+    }
+    catch {
+        throw new Error(`Invalid site URL: ${siteUrl}`);
+    }
+    if (parsed.protocol === 'http:' && !isLocalEnvironment(environmentName)) {
+        throw new Error(`Refusing to send credentials over plain HTTP for the "${environmentName ?? 'unknown'}" environment: the Application Password would travel in cleartext. Use HTTPS. Plain HTTP is allowed only for the "${LOCAL_ENVIRONMENT_NAME}" environment.`);
+    }
+}
 /**
  * HTTP client for a WordPress site's REST API.
  * Paths are relative to `<site>/wp-json/`, e.g. `loopress/v1/snippets` or `wp/v2/plugins`.
@@ -8,8 +31,9 @@ export const REQUEST_TIMEOUT_MS = 30_000;
 export class WpClient {
     siteUrl;
     client;
-    constructor(siteUrl, token) {
+    constructor(siteUrl, token, environmentName) {
         this.siteUrl = siteUrl;
+        assertSecureSiteUrl(siteUrl, environmentName);
         this.client = got.extend({
             headers: { Authorization: `Basic ${Buffer.from(token).toString('base64')}` },
             prefixUrl: `${siteUrl}/wp-json`,