@loopress/cli 0.28.0 → 0.29.0

package/dist/commands/{template → theme/template}/list.d.ts

@@ -1,5 +1,5 @@
-import { LoopressCommand } from '../../lib/base.js';
-import { type ChildTheme } from '../../utils/template-format.js';
+import { LoopressCommand } from '../../../lib/base.js';
+import { type ChildTheme } from '../../../utils/template-format.js';
 type ListResult = Omit<ChildTheme, 'parts' | 'templates'> & {
     parts: string[];
     templates: string[];

package/dist/commands/{template → theme/template}/list.js

@@ -1,16 +1,16 @@
-import { LoopressCommand } from '../../lib/base.js';
-import { pluralize } from '../../utils/pluralize.js';
-import { CHILD_THEME_ENDPOINT } from '../../utils/template-format.js';
+import { LoopressCommand } from '../../../lib/base.js';
+import { pluralize } from '../../../utils/pluralize.js';
+import { CHILD_THEME_ENDPOINT } from '../../../utils/template-format.js';
 export default class List extends LoopressCommand {
     static description = 'Show the Loopress child theme of the active block theme: its templates, parts, and those edited in the Site Editor';
     static enableJsonFlag = true;
-    static examples = ['$ lps template list'];
+    static examples = ['$ lps theme template list'];
     async run() {
         const child = await this.wp.get(CHILD_THEME_ENDPOINT);
         // The markup is only needed by `template diff`, it would drown the JSON output here.
         const result = { ...child, parts: child.parts.map((part) => part.slug), templates: child.templates.map((template) => template.slug) };
         if (!child.exists) {
-            this.log(`No Loopress child theme yet (${child.stylesheet}), run lps template push.`);
+            this.log(`No Loopress child theme yet (${child.stylesheet}), run lps theme template push.`);
             return result;
         }
         this.log(`${child.stylesheet} (child of ${child.parent}, ${child.active ? 'active' : 'not active'})`);

package/dist/commands/{template → theme/template}/push.d.ts

@@ -1,4 +1,4 @@
-import { PushCommand } from '../../lib/push-command.js';
+import { PushCommand } from '../../../lib/push-command.js';
 type PushResult = {
     active?: boolean;
     customized?: string[];

package/dist/commands/{template → theme/template}/push.js

@@ -1,12 +1,13 @@
-import { PushCommand } from '../../lib/push-command.js';
-import { formatPageProblems } from '../../utils/page-format.js';
-import { pluralize } from '../../utils/pluralize.js';
-import { resolveResourceDir } from '../../utils/resource-dirs.js';
-import { CHILD_THEME_ENDPOINT, readLocalTemplates } from '../../utils/template-format.js';
+import { PushCommand } from '../../../lib/push-command.js';
+import { getResourceStateProvider } from '../../../lib/resource-state.js';
+import { formatPageProblems } from '../../../utils/page-format.js';
+import { pluralize } from '../../../utils/pluralize.js';
+import { resolveResourceDir } from '../../../utils/resource-dirs.js';
+import { CHILD_THEME_ENDPOINT, readLocalTemplates } from '../../../utils/template-format.js';
 export default class Push extends PushCommand {
     static description = 'Push block templates (templates/<slug>.html) and template parts (parts/<slug>.html) as the files of a child theme of the active block theme, <parent>-loopress. The child mirrors the project: files removed locally are removed from it. It is never activated for you.';
     static enableJsonFlag = true;
-    static examples = ['$ lps template push', '$ lps template push --dry-run'];
+    static examples = ['$ lps theme template push', '$ lps theme template push --dry-run'];
     static flags = {
         ...PushCommand.dryRunFlag,
         ...PushCommand.yesFlag,
@@ -24,6 +25,7 @@ export default class Push extends PushCommand {
         const names = { parts: parts.map((part) => part.slug), templates: templates.map((template) => template.slug) };
         this.log(`Found ${pluralize(templates.length, 'template')} and ${pluralize(parts.length, 'part')}`);
         if (this.dryRun) {
+            await this.previewRemote(getResourceStateProvider('template'), templatesPath);
             this.log('[dry-run] Would rewrite the child theme with them.');
             return { ...names, status: 'dry-run' };
         }

package/dist/commands/theme/version/pull.d.ts

@@ -0,0 +1,23 @@
+import { LoopressCommand } from '../../../lib/base.js';
+import { type ComposerPullResult } from '../../../utils/composer.js';
+type PullResult = {
+    added: string[];
+    merged: Record<string, string>;
+    skipped?: ComposerPullResult['skipped'];
+    status: 'dry-run' | 'success';
+    updated: Array<{
+        from: string;
+        slug: string;
+        to: string;
+    }>;
+};
+export default class Pull extends LoopressCommand {
+    static description: string;
+    static enableJsonFlag: boolean;
+    static examples: string[];
+    static flags: {
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<PullResult>;
+}
+export {};

package/dist/commands/theme/version/pull.js

@@ -0,0 +1,43 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { LoopressCommand } from '../../../lib/base.js';
+import { pullIntoComposerJson } from '../../../utils/composer.js';
+import { writeLocalConfig } from '../../../utils/loopress-config.js';
+import { mergePluginManifest } from '../../../utils/plugins.js';
+import { parseInstalledThemes } from '../../../utils/themes.js';
+export default class Pull extends LoopressCommand {
+    static description = 'Pull installed themes from WordPress into loopress.json, pinned to their live versions';
+    static enableJsonFlag = true;
+    static examples = ['$ lps theme version pull'];
+    static flags = {
+        ...LoopressCommand.dryRunFlag,
+    };
+    async run() {
+        const { url } = this.siteConfig;
+        this.log(`Pulling themes from ${url}`);
+        const raw = await this.wp.get('wp/v2/themes');
+        const installed = parseInstalledThemes(raw);
+        const incoming = Object.fromEntries(installed.map((t) => [t.slug, t.version]));
+        // A composer.json is authoritative over loopress.json: pin the live versions there instead.
+        const composerJsonPath = join(process.cwd(), this.rootDir, 'composer.json');
+        if (existsSync(composerJsonPath)) {
+            const result = await pullIntoComposerJson(composerJsonPath, 'theme', incoming, {
+                dryRun: this.dryRun,
+                log: this.log.bind(this),
+            });
+            return { ...result, status: this.dryRun ? 'dry-run' : 'success' };
+        }
+        const { added, merged, updated } = mergePluginManifest(this.localConfig.themes ?? {}, incoming);
+        if (this.dryRun) {
+            this.log(`[dry-run] Would write ${Object.keys(merged).length} themes to loopress.json`);
+            return { added, merged, status: 'dry-run', updated };
+        }
+        await writeLocalConfig({ ...this.localConfig, themes: merged });
+        this.log(`Wrote ${Object.keys(merged).length} themes to loopress.json`);
+        if (added.length > 0)
+            this.log(`  + Added: ${added.join(', ')}`);
+        for (const u of updated)
+            this.log(`  ~ Updated: ${u.slug} ${u.from} → ${u.to}`);
+        return { added, merged, status: 'success', updated };
+    }
+}

package/dist/commands/theme/version/push.d.ts

@@ -0,0 +1,22 @@
+import { PushCommand } from '../../../lib/push-command.js';
+type PushResult = {
+    installed: string[];
+    pinned: string[];
+    removed: string[];
+    status: 'composer-managed' | 'dry-run' | 'in-sync' | 'success';
+};
+export default class Push extends PushCommand {
+    static description: string;
+    static enableJsonFlag: boolean;
+    static examples: string[];
+    static flags: {
+        force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<PushResult>;
+    private fetchInstanceLock;
+    private guardForce;
+    private sync;
+}
+export {};

package/dist/commands/theme/version/push.js

@@ -0,0 +1,123 @@
+import { Flags } from '@oclif/core';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { confirmUninstall } from '../../../lib/interactive.js';
+import { PushCommand } from '../../../lib/push-command.js';
+import { isNotFoundError } from '../../../lib/wp-client.js';
+import { isDowngrade, parseCollisions, SYNC_TIMEOUT_MS } from '../../../utils/plugin-sync.js';
+import { lockedWpackagistSlugs } from '../../../utils/plugins.js';
+import { diffThemes, parseInstalledThemes } from '../../../utils/themes.js';
+const IN_SYNC = { installed: [], pinned: [], removed: [], status: 'in-sync' };
+export default class Push extends PushCommand {
+    static description = 'Install themes on WordPress to match loopress.json (versions only, never switches the active theme)';
+    static enableJsonFlag = true;
+    static examples = ['$ lps theme version push', '$ lps theme version push --force'];
+    static flags = {
+        ...PushCommand.dryRunFlag,
+        ...PushCommand.yesFlag,
+        force: Flags.boolean({ default: false, description: 'Allow downgrades and take over themes installed outside Loopress' }),
+    };
+    async run() {
+        const { flags } = await this.parse(Push);
+        const { force } = flags;
+        if (existsSync(join(process.cwd(), this.rootDir, 'composer.json'))) {
+            this.warn('This project has a composer.json, which is authoritative. Run `lps composer push` instead.');
+            return { ...IN_SYNC, status: 'composer-managed' };
+        }
+        const manifest = this.localConfig.themes ?? {};
+        if (Object.keys(manifest).length === 0) {
+            this.error('No themes found in loopress.json. Run `lps theme version pull` first.');
+        }
+        this.log(`Pushing themes to ${this.siteConfig.url}`);
+        const raw = await this.wp.get('wp/v2/themes');
+        const installed = parseInstalledThemes(raw);
+        const managed = lockedWpackagistSlugs(await this.fetchInstanceLock(), 'theme');
+        const diff = diffThemes(manifest, installed, managed);
+        this.guardForce(diff, force);
+        // Uninstalling the theme WordPress is currently rendering leaves the site with no active
+        // theme, which is a hard fatal. --force does not override this: switch the active theme
+        // on the site first, then the removal is safe. A --force takeover of a collision hits the
+        // same fatal: the server moves the existing folder out of the way before reinstalling it,
+        // so the active theme is briefly missing either way, an active collision is just as
+        // dangerous as an active removal.
+        const activeRemoval = [...diff.toRemove, ...diff.collisions.map((c) => c.slug)].find((slug) => installed.find((t) => t.slug === slug)?.active);
+        if (activeRemoval) {
+            this.error(`Refusing to uninstall "${activeRemoval}": it is the site's active theme. ` +
+                'Switch the site to another theme, then re-run to remove it.');
+        }
+        // A "latest" pin never shows as drift, but its newest upstream release may have moved, so
+        // a push must still run `composer update` to pick it up.
+        const hasLatestPin = Object.values(manifest).includes('latest');
+        if (!hasLatestPin && isNoop(diff)) {
+            this.log('Everything is already in sync.');
+            return { ...IN_SYNC };
+        }
+        if (isNoop(diff))
+            this.log('Refreshing themes pinned to "latest" to their newest releases.');
+        for (const a of diff.toInstall)
+            this.log(`  + ${a.slug} ${a.version}`);
+        for (const p of diff.toPin)
+            this.log(`  ~ ${p.slug} ${p.from} to ${p.to}`);
+        for (const s of diff.toRemove)
+            this.log(`  - ${s}`);
+        for (const c of diff.collisions)
+            this.log(`  ! ${c.slug} (take over)`);
+        if (this.dryRun)
+            return result(diff, 'dry-run', diff.toRemove, true);
+        if (!(await confirmUninstall(diff.toRemove, this.yes)))
+            this.error('Aborted.');
+        const response = await this.sync(manifest, force);
+        if (response.output.trim())
+            this.log(response.output.trim());
+        this.log('Themes synced.');
+        await this.recordSuccess();
+        return result(diff, 'success', response.removed ?? diff.toRemove, force);
+    }
+    async fetchInstanceLock() {
+        try {
+            const { composerLock } = await this.wp.get('loopress/v1/composer/lock');
+            return composerLock;
+        }
+        catch (error) {
+            if (isNotFoundError(error))
+                return null;
+            throw error;
+        }
+    }
+    guardForce(diff, force) {
+        if (force)
+            return;
+        if (diff.collisions.length > 0) {
+            const list = diff.collisions.map((c) => `${c.slug} (${c.installedVersion})`).join(', ');
+            this.error(`${list} installed outside Loopress. Re-run with --force to take them over, or remove them from loopress.json.`);
+        }
+        const downgrades = diff.toPin.filter((p) => isDowngrade(p.from, p.to));
+        if (downgrades.length > 0) {
+            const list = downgrades.map((p) => `${p.slug} ${p.from} to ${p.to}`).join(', ');
+            this.error(`Refusing to downgrade: ${list}. Re-run with --force.`);
+        }
+    }
+    async sync(manifest, force) {
+        try {
+            return await this.wp.post('loopress/v1/composer/sync', { force, intent: { themes: manifest }, lock: null }, { timeoutMs: SYNC_TIMEOUT_MS });
+        }
+        catch (error) {
+            if (parseCollisions(error)) {
+                this.error('The site rejected the push: themes installed outside Loopress. Re-run with --force.');
+            }
+            throw error;
+        }
+    }
+}
+function isNoop(diff) {
+    return (diff.toInstall.length === 0 && diff.toPin.length === 0 && diff.toRemove.length === 0 && diff.collisions.length === 0);
+}
+function result(diff, status, removed, includeCollisions) {
+    const collisionSlugs = includeCollisions ? diff.collisions.map((c) => c.slug) : [];
+    return {
+        installed: [...diff.toInstall.map((a) => a.slug), ...collisionSlugs],
+        pinned: diff.toPin.map((p) => p.slug),
+        removed,
+        status,
+    };
+}

package/dist/hooks/finally.d.ts

@@ -1,3 +1,4 @@
-import type { Hook } from '@oclif/core';
+import { type Hook } from '@oclif/core';
 declare const hook: Hook.Finally;
+export declare function dropHttpCause(error: Error): void;
 export default hook;

package/dist/hooks/finally.js

@@ -1,3 +1,5 @@
+import { settings } from '@oclif/core';
+import { RequestError } from 'got';
 import { isTelemetryDisabled, redactArgv, resolveEnvironment, runtimeContext, scrubEvent, SENTRY_DSN, } from '../lib/sentry.js';
 // oclif has no `command_error` hook (checked @oclif/core@4.11.11's hooks.d.ts). `finally`
 // is the closest equivalent: it always runs at the end of the CLI lifecycle and carries
@@ -7,8 +9,15 @@ import { isTelemetryDisabled, redactArgv, resolveEnvironment, runtimeContext, sc
 // It's a heavy module (@opentelemetry deps, import-in-the-middle instrumentation), so loading
 // it eagerly on every command would tax the common case where commands succeed.
 const hook = async function (options) {
-    if (!options.error || isTelemetryDisabled())
+    if (!options.error)
         return;
+    if (!isTelemetryDisabled())
+        await report(this, options);
+    // After the report, so Sentry still gets the whole chain. LPS_DEBUG=1 keeps it on screen too.
+    if (!settings.debug)
+        dropHttpCause(options.error);
+};
+async function report(context, options) {
     try {
         const Sentry = await import('@sentry/node');
         Sentry.init({
@@ -17,7 +26,7 @@ const hook = async function (options) {
             beforeSend: scrubEvent,
             dsn: SENTRY_DSN,
             environment: resolveEnvironment(),
-            release: this.config.version,
+            release: context.config.version,
             // Node defaults `server_name` to os.hostname(), which is often the user's real name
             // (e.g. "jane-doe-macbook-pro"). sendDefaultPii covers IP addresses and similar, off by
             // default but set explicitly since this reports from users' own machines.
@@ -32,7 +41,21 @@ const hook = async function (options) {
         await Sentry.flush(2000);
     }
     catch (error) {
-        this.debug('Failed to report error to Sentry: %O', error);
+        context.debug('Failed to report error to Sentry: %O', error);
     }
-};
+}
+// WpClient and ApiClient already fold what matters of a got error (status, the server's own
+// reason) into their own message, and keep got's error as `cause` for the helpers that read
+// its response. oclif prints every cause after the message, so without this a clear "Request
+// failed (409) on ...: The active theme is not a block theme" ends with "Caused by: HTTPError:
+// Request failed with status code 409 ... Code: ERR_NON_2XX_3XX_RESPONSE", which is what the
+// user remembers. Other causes (a failed plugin install under its fallback advice) stay.
+export function dropHttpCause(error) {
+    for (let current = error; current instanceof Error; current = current.cause) {
+        if (current.cause instanceof RequestError) {
+            delete current.cause;
+            return;
+        }
+    }
+}
 export default hook;

package/dist/lib/app-manifest.js

@@ -22,7 +22,7 @@ export function isAllowedAsset(relPath) {
 // server would reject, so the push fails locally with a clear message instead of a 400
 // halfway through the upload.
 export async function buildFileList(distDir) {
-    const relPaths = (await walkFiles(distDir)).sort((a, b) => a.localeCompare(b));
+    const relPaths = (await walkFiles(distDir)).toSorted((a, b) => a.localeCompare(b));
     const files = [];
     for (const path of relPaths) {
         if (!isAllowedAsset(path)) {
@@ -37,7 +37,7 @@ export async function buildFileList(distDir) {
 // Used as the enqueue `?ver` (cache busting) and as the build identity in `app list`.
 export function computeBuildId(files) {
     const digest = createHash('sha256');
-    for (const file of [...files].sort((a, b) => a.path.localeCompare(b.path))) {
+    for (const file of files.toSorted((a, b) => a.path.localeCompare(b.path))) {
         digest.update(`${file.path}:${file.sha256}\n`);
     }
     return digest.digest('hex').slice(0, 12);

package/dist/lib/base.d.ts

@@ -14,6 +14,7 @@ export declare abstract class LoopressCommand extends Command {
     };
     protected dryRun: boolean;
     protected localConfig: LoopressLocalConfig;
+    protected productionConfirmed: boolean;
     protected projectId: string;
     protected siteConfig: EnvironmentConfig;
     protected yes: boolean;

package/dist/lib/base.js

@@ -26,6 +26,8 @@ export class LoopressCommand extends Command {
     };
     dryRun = false;
     localConfig = {};
+    // Set by PushCommand's hidden --production-confirmed, see there.
+    productionConfirmed = false;
     projectId;
     siteConfig;
     yes = false;
@@ -54,6 +56,7 @@ export class LoopressCommand extends Command {
         }));
         this.dryRun = Boolean(flags['dry-run']);
         this.yes = Boolean(flags.yes);
+        this.productionConfirmed = Boolean(flags['production-confirmed']);
         this.localConfig = await readLocalConfig();
         const resolved = this.resolveEnvironment(flags.env);
         this.siteConfig = resolved.env;

package/dist/lib/dev-watch.js

@@ -18,8 +18,8 @@ export function buildWatchTargets(types, localConfig, cwd) {
         hooks: { commandId: 'hook:push', path: join(rootDir, localConfig.hooksDir ?? 'hooks'), type: 'hooks' },
         pages: { commandId: 'page:push', path: join(rootDir, localConfig.pageDir ?? 'pages'), type: 'pages' },
         plugins: { commandId: 'plugin:push', path: join(cwd, 'loopress.json'), type: 'plugins' },
-        parts: { commandId: 'template:push', path: join(rootDir, localConfig.partDir ?? 'parts'), type: 'parts' },
-        templates: { commandId: 'template:push', path: join(rootDir, localConfig.templateDir ?? 'templates'), type: 'templates' },
+        parts: { commandId: 'theme:template:push', path: join(rootDir, localConfig.partDir ?? 'parts'), type: 'parts' },
+        templates: { commandId: 'theme:template:push', path: join(rootDir, localConfig.templateDir ?? 'templates'), type: 'templates' },
         snippets: { commandId: 'snippet:push', path: join(rootDir, localConfig.snippetsDir ?? 'snippets'), type: 'snippets' },
     };
     return types

package/dist/lib/diff-state.js

@@ -29,6 +29,7 @@ function renderTextChange(id, left, right, labels) {
 function objectFieldChanges(left, right) {
     return microdiff(left, right, { cyclesFix: false }).map((change) => {
         const path = change.path.join('.');
+        // microdiff types leaf values as `any`.
         if (change.type === 'CREATE')
             return { kind: 'added', path, to: change.value };
         if (change.type === 'REMOVE')

package/dist/lib/github-release.js

@@ -5,7 +5,6 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { pipeline } from 'node:stream/promises';
 const REPO = 'loopress/loopress';
-const RELEASE_TAG_PATTERN = /^wordpress-plugin@/;
 const ASSET_NAME = 'loopress-full.zip';
 /**
  * Downloads `loopress-full.zip` from the most recent `wordpress-plugin@*` release of

package/dist/lib/local-callback-server.d.ts

@@ -1,5 +1,4 @@
 export type CallbackHelpers<T> = {
-    body: Record<string, string>;
     rejectWithPage: (page: string, error: Error) => void;
     resolveWithPage: (page: string, value: T) => void;
     respondBadRequest: (message: string) => void;
@@ -9,13 +8,14 @@ export type CallbackHelpers<T> = {
  * local server; this factors out the server setup, timeout, and browser-opening boilerplate.
  *
  * The loopback server is unauthenticated, so any local process or web page open during the wait
- * could otherwise POST forged credentials to it (RFC 8252 section 8.9). Two guards close that:
+ * could otherwise send forged credentials to it (RFC 8252 section 8.9). Two guards close that:
  *
  * - a 32-byte `state` generated here, threaded into the authorize URL by `buildUrl`, and required
- *   back (constant-time compare) on any request that carries credentials;
- * - an `Origin` allowlist: a browser sends `Origin` on the relay's cross-site form POST, so a
- *   stray page's POST (carrying its own origin) is rejected. Top-level navigations send no
- *   `Origin` and are allowed, which is why `state` is the primary control.
+ *   back (constant-time compare) on any request with a query string, the only place credentials
+ *   are read from;
+ * - an `Origin` allowlist: the legitimate callbacks are top-level redirects, which send no
+ *   `Origin`, so a request from a page script (carrying its own origin) is rejected. That's
+ *   defense in depth, `state` is the primary control.
  *
  * The first request that looks like a callback (valid or not) shuts the server down, so a
  * failed guess gets no second try within the window.
@@ -23,12 +23,18 @@ export type CallbackHelpers<T> = {
 export declare function waitForLocalCallback<T>(options: {
     allowedOrigins: string[];
     buildUrl: (callbackBaseUrl: string, state: string) => string;
+    /** Host advertised in the callback URL; the server itself always listens on 127.0.0.1. */
+    callbackHost?: string;
     handleRequest: (url: URL, helpers: CallbackHelpers<T>) => void;
     log: (message: string) => void;
     openingMessage: string;
     timeoutMessage: string;
     timeoutMs?: number;
 }): Promise<T>;
+/**
+ * The page rewrites its own URL to `/` on load, so the callback query string (an Application
+ * Password, a console token) doesn't stay in the browser history or address bar.
+ */
 export declare function renderResultPage(options: {
     background: string;
     heading: string;

package/dist/lib/local-callback-server.js

@@ -2,15 +2,6 @@ import { Buffer } from 'node:buffer';
 import { randomBytes, timingSafeEqual } from 'node:crypto';
 import { createServer } from 'node:http';
 import { openBrowser } from './open-browser.js';
-async function readBody(req) {
-    const chunks = [];
-    for await (const chunk of req)
-        chunks.push(chunk);
-    return Buffer.concat(chunks).toString('utf8');
-}
-function parseFormData(body) {
-    return Object.fromEntries(new URLSearchParams(body));
-}
 /** Constant-time compare that also tolerates a length mismatch without throwing. */
 function safeEqual(a, b) {
     const bufferA = Buffer.from(a);
@@ -22,13 +13,14 @@ function safeEqual(a, b) {
  * local server; this factors out the server setup, timeout, and browser-opening boilerplate.
  *
  * The loopback server is unauthenticated, so any local process or web page open during the wait
- * could otherwise POST forged credentials to it (RFC 8252 section 8.9). Two guards close that:
+ * could otherwise send forged credentials to it (RFC 8252 section 8.9). Two guards close that:
  *
  * - a 32-byte `state` generated here, threaded into the authorize URL by `buildUrl`, and required
- *   back (constant-time compare) on any request that carries credentials;
- * - an `Origin` allowlist: a browser sends `Origin` on the relay's cross-site form POST, so a
- *   stray page's POST (carrying its own origin) is rejected. Top-level navigations send no
- *   `Origin` and are allowed, which is why `state` is the primary control.
+ *   back (constant-time compare) on any request with a query string, the only place credentials
+ *   are read from;
+ * - an `Origin` allowlist: the legitimate callbacks are top-level redirects, which send no
+ *   `Origin`, so a request from a page script (carrying its own origin) is rejected. That's
+ *   defense in depth, `state` is the primary control.
  *
  * The first request that looks like a callback (valid or not) shuts the server down, so a
  * failed guess gets no second try within the window.
@@ -38,23 +30,26 @@ export async function waitForLocalCallback(options) {
     const state = randomBytes(32).toString('hex');
     return new Promise((resolve, reject) => {
         function finish(res, page) {
-            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            // `Connection: close` (here and below): server.close() only refuses new connections, a
+            // kept-alive socket would otherwise still reach this handler after the shutdown.
+            res.writeHead(200, { Connection: 'close', 'Content-Type': 'text/html; charset=utf-8' });
             res.end(page);
             clearTimeout(timer);
             server.close();
         }
         function rejectRequest(res, message) {
-            res.writeHead(403, { 'Content-Type': 'text/plain' });
+            res.writeHead(403, { Connection: 'close', 'Content-Type': 'text/plain' });
             res.end(message);
             clearTimeout(timer);
             server.close();
             reject(new Error(message));
         }
-        async function handleIncoming(req, res) {
+        function handleIncoming(req, res) {
             try {
                 const url = new URL(req.url ?? '/', 'http://localhost');
-                const body = req.method === 'POST' ? parseFormData(await readBody(req)) : {};
-                const looksLikeCallback = url.searchParams.has('state') || Object.keys(body).length > 0;
+                // Any query string counts, not just one carrying `state`: credentials are read from the
+                // query, so a request with `password=` but no `state` must not slip past the check.
+                const looksLikeCallback = url.search !== '';
                 if (looksLikeCallback) {
                     const { origin } = req.headers;
                     if (origin !== undefined && !options.allowedOrigins.includes(origin)) {
@@ -79,7 +74,6 @@ export async function waitForLocalCallback(options) {
                         res.writeHead(400, { 'Content-Type': 'text/plain' });
                         res.end(message);
                     },
-                    body,
                 });
             }
             catch (error) {
@@ -89,7 +83,7 @@ export async function waitForLocalCallback(options) {
                 reject(error instanceof Error ? error : new Error(String(error)));
             }
         }
-        const server = createServer((req, res) => { void handleIncoming(req, res); });
+        const server = createServer(handleIncoming);
         server.on('error', (err) => {
             clearTimeout(timer);
             reject(err);
@@ -100,13 +94,17 @@ export async function waitForLocalCallback(options) {
         }, timeoutMs);
         server.listen(0, '127.0.0.1', () => {
             const { port } = server.address();
-            const targetUrl = options.buildUrl(`http://localhost:${port}`, state);
+            const targetUrl = options.buildUrl(`http://${options.callbackHost ?? 'localhost'}:${port}`, state);
             options.log(options.openingMessage);
             options.log(`\nIf it doesn't open automatically, visit:\n${targetUrl}\n`);
             openBrowser(targetUrl);
         });
     });
 }
+/**
+ * The page rewrites its own URL to `/` on load, so the callback query string (an Application
+ * Password, a console token) doesn't stay in the browser history or address bar.
+ */
 export function renderResultPage(options) {
     return `<!DOCTYPE html>
 <html lang="en">
@@ -144,6 +142,7 @@ export function renderResultPage(options) {
     <h1>${options.heading}</h1>
     <p>You can close this tab and return to your terminal.</p>
   </div>
+  <script>history.replaceState(null, '', '/')</script>
 </body>
 </html>`;
 }

package/dist/lib/php-files-command.js

@@ -274,6 +274,8 @@ export function resourceListCommand(spec) {
 }
 export function resourceRmCommand(spec) {
     class ResourceRm extends LoopressCommand {
+        // `remove` matches `lps app remove` and `lps option remove`, `rm` stays for existing scripts.
+        static aliases = [`${spec.cliName}:remove`];
         static args = {
             filename: Args.string({
                 description: `The ${spec.noun} to remove, its slug without the .php extension (e.g. "hello" or "invoice-pdf/[order_id]")`,
@@ -282,7 +284,7 @@ export function resourceRmCommand(spec) {
         };
         static description = spec.rmDescription;
         static enableJsonFlag = true;
-        static examples = [`$ lps ${spec.cliName} rm hello`, `$ lps ${spec.cliName} rm hello --yes`];
+        static examples = [`$ lps ${spec.cliName} rm hello`, `$ lps ${spec.cliName} remove hello --yes`];
         static flags = { ...LoopressCommand.dryRunFlag, ...LoopressCommand.yesFlag };
         async run() {
             const { args } = await this.parse(ResourceRm);

package/dist/lib/push-command.d.ts

@@ -2,12 +2,17 @@ import { LoopressCommand } from './base.js';
 import { type ResourceState } from './diff-state.js';
 import { type ResourceStateProvider } from './resource-state.js';
 export declare abstract class PushCommand extends LoopressCommand {
+    static baseFlags: {
+        'production-confirmed': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        env: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
     protected failedCount: number;
     private refusedByGuard;
     protected captureBeforePushState(provider: ResourceStateProvider, dir: string): Promise<ResourceState | undefined>;
     catch(err: Error): Promise<void>;
     protected guardProductionPush(): Promise<void>;
     init(): Promise<void>;
+    protected previewRemote(provider: ResourceStateProvider, dir: string): Promise<void>;
     protected recordDeployment(status: 'failure' | 'success'): Promise<void>;
     protected recordSuccess(): Promise<void>;
     protected reportTaskFailure(message: string, error: unknown, task?: {