@loopress/cli 0.28.0 → 0.30.0

package/dist/lib/declared-type-command.js

@@ -0,0 +1,192 @@
+import { confirm } from '@inquirer/prompts';
+import { Args } from '@oclif/core';
+import { writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { fileExtension, formatDeclaredFile, itemEndpoint, parseDeclaredFile, } from '../utils/declared-type-format.js';
+import { pluralize } from '../utils/pluralize.js';
+import { resolveResourceDir } from '../utils/resource-dirs.js';
+import { LoopressCommand } from './base.js';
+import { basenameKey, findOrphanedFiles } from './find-orphaned-files.js';
+import { isInteractive } from './interactive.js';
+import { loadFiles } from './load-files.js';
+import { PushCommand } from './push-command.js';
+import { getResourceStateProvider } from './resource-state.js';
+import { isApplicative404, isNotFoundError } from './wp-client.js';
+const SOURCE_LABELS = {
+    acf: 'ACF',
+    cptui: 'CPT UI',
+    loopress: 'Loopress',
+    other: 'theme or plugin',
+    wordpress: 'WordPress',
+};
+function pathArg(spec) {
+    return Args.string({ description: `Path to the ${spec.dir} directory (overrides project config)` });
+}
+export function declaredPushCommand(spec, description) {
+    class DeclaredPush extends PushCommand {
+        static args = { path: pathArg(spec) };
+        static description = description;
+        static enableJsonFlag = true;
+        static examples = [`$ lps ${spec.cliName} push`];
+        static flags = { ...PushCommand.dryRunFlag, ...PushCommand.yesFlag };
+        async run() {
+            const { args } = await this.parse(DeclaredPush);
+            const path = resolveResourceDir(spec.dirKind, this.localConfig, args.path);
+            this.log(`Pushing ${spec.plural} to ${this.siteConfig.url}`);
+            this.log(`Path: ${path}`);
+            const provider = getResourceStateProvider(spec.cliName);
+            const beforeState = await this.captureBeforePushState(provider, path);
+            const items = await loadFiles(path, {
+                extension: fileExtension(spec),
+                onSkip: (message) => {
+                    this.warn(message);
+                },
+                parse: (raw, filePath) => parseDeclaredFile(spec, filePath, raw),
+            });
+            this.log(`Found ${pluralize(items.length, spec.noun, spec.plural)} to push`);
+            const pushed = [];
+            await this.runPushTasks(items, (item) => item.slug, async (item, task) => {
+                await this.pushItem(item, task);
+                pushed.push(item.slug);
+            });
+            await this.writeAfterPushSnapshot(provider, path, beforeState);
+            if (this.failedCount > 0) {
+                this.error(`${pluralize(this.failedCount, spec.noun, spec.plural)} failed to push.`);
+            }
+            if (this.dryRun)
+                return { path, pushed, status: 'dry-run' };
+            await this.recordSuccess();
+            this.log(`All ${spec.plural} pushed.`);
+            return { path, pushed, status: 'success' };
+        }
+        async currentRevision(slug) {
+            try {
+                return (await this.wp.get(itemEndpoint(spec, slug))).revision;
+            }
+            catch (error) {
+                if (isNotFoundError(error))
+                    return undefined;
+                throw error;
+            }
+        }
+        async pushItem({ args, slug }, task) {
+            if (this.dryRun) {
+                if (task)
+                    task.output = `[dry-run] Would push: ${slug}`;
+                return;
+            }
+            try {
+                // Conditional write (#234), same as `menu push`: WordPress refuses it (412) if the item
+                // changed since this read. Slug, reserved names and code arguments are checked there.
+                const expectedRevision = await this.currentRevision(slug);
+                const body = { args, slug };
+                if (expectedRevision !== undefined)
+                    body.expectedRevision = expectedRevision;
+                await this.wp.post(spec.endpoint, body);
+                if (task)
+                    task.output = `Pushed: ${slug}`;
+            }
+            catch (error) {
+                this.reportTaskFailure(`Failed to push ${slug}: ${error.message}`, error, task);
+            }
+        }
+    }
+    return DeclaredPush;
+}
+export function declaredPullCommand(spec, description) {
+    class DeclaredPull extends LoopressCommand {
+        static args = { path: pathArg(spec) };
+        static description = description;
+        static enableJsonFlag = true;
+        static examples = [`$ lps ${spec.cliName} pull`];
+        static flags = { ...LoopressCommand.dryRunFlag, ...LoopressCommand.yesFlag };
+        async run() {
+            const { args } = await this.parse(DeclaredPull);
+            const path = resolveResourceDir(spec.dirKind, this.localConfig, args.path);
+            this.log(`Pulling ${spec.plural} from ${this.siteConfig.url}`);
+            this.log(`Path: ${path}`);
+            const remote = await this.wp.get(spec.endpoint);
+            const orphans = await findOrphanedFiles(path, new Set(remote.map(({ slug }) => slug)), { extensions: [fileExtension(spec)], key: basenameKey });
+            await this.pullDirectory(path, remote, orphans, {
+                dryRunMessage: `Would pull ${pluralize(remote.length, spec.noun, spec.plural)} to ${path}`,
+                orphanReason: `in ${path} no longer present on WordPress`,
+                pulledMessage: `Pulled ${pluralize(remote.length, spec.noun, spec.plural)} to ${path}`,
+                title: ({ slug }) => slug,
+                // Only the arguments: the slug is the file name, the revision is push bookkeeping.
+                async write(item, dir) {
+                    await writeFile(join(dir, `${item.slug}${fileExtension(spec)}`), formatDeclaredFile(spec, item.args));
+                },
+            });
+            return { path, status: this.dryRun ? 'dry-run' : 'success' };
+        }
+    }
+    return DeclaredPull;
+}
+// `countLabel` renders the item's count: "3 published" for a post type, "3 terms" for a taxonomy,
+// nothing when it returns an empty string.
+export function declaredListCommand(spec, description, countLabel) {
+    class DeclaredList extends LoopressCommand {
+        static description = description;
+        static enableJsonFlag = true;
+        static examples = [`$ lps ${spec.cliName} list`];
+        async run() {
+            const items = await this.wp.get(spec.registeredEndpoint);
+            for (const item of items) {
+                const attached = item.objectTypes && item.objectTypes.length > 0 ? `, on ${item.objectTypes.join(', ')}` : '';
+                const count = countLabel(item.count);
+                const counted = count ? ', ' + count : '';
+                this.log(`${item.slug} (${item.label}): ${SOURCE_LABELS[item.source]}${counted}${attached}`);
+                if (item.conflict) {
+                    this.warn(`${item.slug}: declared in ${spec.dir}/ but already registered by ${SOURCE_LABELS[item.source]}, the Loopress version is skipped`);
+                }
+            }
+            return items;
+        }
+    }
+    return DeclaredList;
+}
+// The only way a Loopress item leaves WordPress: push never deletes (see Push Deletion Rules in
+// the product docs). The local file is left alone, same as `hook rm`. `keptNote` says what
+// happens to what used it ("Its posts stay in the database, hidden until it's pushed again.").
+export function declaredRmCommand(spec, description, keptNote) {
+    class DeclaredRm extends LoopressCommand {
+        static aliases = [`${spec.cliName}:remove`];
+        static args = {
+            slug: Args.string({ description: `The ${spec.noun} slug, its ${spec.dir}/ file name without ${fileExtension(spec)}`, required: true }),
+        };
+        static description = description;
+        static enableJsonFlag = true;
+        static examples = [`$ lps ${spec.cliName} rm <slug>`, `$ lps ${spec.cliName} remove <slug> --yes`];
+        static flags = { ...LoopressCommand.dryRunFlag, ...LoopressCommand.yesFlag };
+        async run() {
+            const { args } = await this.parse(DeclaredRm);
+            const { slug } = args;
+            const { url } = this.siteConfig;
+            if (this.dryRun) {
+                this.log(`[dry-run] Would remove ${spec.noun} ${slug} from ${url}`);
+                return { removed: false, slug, status: 'dry-run' };
+            }
+            if (!this.yes) {
+                if (!isInteractive())
+                    this.error(`Removing ${spec.noun} ${slug} needs confirmation. Re-run with --yes.`);
+                const ok = await confirm({ default: false, message: `Remove ${spec.noun} ${slug} from ${url}? ${keptNote}` });
+                if (!ok) {
+                    this.log('Aborted.');
+                    return { removed: false, slug, status: 'aborted' };
+                }
+            }
+            try {
+                await this.wp.delete(itemEndpoint(spec, slug));
+            }
+            catch (error) {
+                const notFound = `${spec.noun[0].toUpperCase()}${spec.noun.slice(1)} not found`;
+                if (isApplicative404(error, notFound))
+                    this.error(`${spec.noun} ${slug} is not managed by Loopress on ${url}.`);
+                throw error;
+            }
+            this.log(`Removed ${spec.noun} ${slug} from ${url}. ${keptNote}`);
+            return { removed: true, slug, status: 'success' };
+        }
+    }
+    return DeclaredRm;
+}

package/dist/lib/dev-watch.d.ts

@@ -1,5 +1,5 @@
 import { type LoopressLocalConfig } from '../utils/loopress-config.js';
-export type ResourceType = 'api' | 'hooks' | 'pages' | 'parts' | 'plugins' | 'snippets' | 'templates';
+export type ResourceType = 'api' | 'blocks' | 'css' | 'hooks' | 'pages' | 'parts' | 'plugins' | 'snippets' | 'templates';
 export declare const RESOURCE_TYPES: ResourceType[];
 export type WatchTarget = {
     commandId: string;

package/dist/lib/dev-watch.js

@@ -1,6 +1,7 @@
 import { existsSync } from 'node:fs';
 import { join, sep } from 'node:path';
-export const RESOURCE_TYPES = ['snippets', 'templates', 'parts', 'pages', 'api', 'hooks', 'plugins'];
+import { resolveResourceDir } from '../utils/resource-dirs.js';
+export const RESOURCE_TYPES = ['snippets', 'templates', 'parts', 'css', 'blocks', 'pages', 'api', 'hooks', 'plugins'];
 // `only` narrows the default set, `skip` then removes from whatever that set is, same
 // precedence a combined `--only=a,b --skip=b` reads as: watch a, b, then drop b.
 export function resolveResourceTypes(only, skip = []) {
@@ -15,11 +16,14 @@ export function buildWatchTargets(types, localConfig, cwd) {
     const rootDir = join(cwd, localConfig.rootDir ?? '.');
     const candidates = {
         api: { commandId: 'api:push', path: join(rootDir, localConfig.apiDir ?? 'api'), type: 'api' },
+        // The theme CSS is bundled into the child theme with the templates, by the same push.
+        blocks: { commandId: 'theme:template:push', path: join(cwd, resolveResourceDir('blockCss', localConfig)), type: 'blocks' },
+        css: { commandId: 'theme:template:push', path: join(cwd, resolveResourceDir('css', localConfig)), type: 'css' },
         hooks: { commandId: 'hook:push', path: join(rootDir, localConfig.hooksDir ?? 'hooks'), type: 'hooks' },
         pages: { commandId: 'page:push', path: join(rootDir, localConfig.pageDir ?? 'pages'), type: 'pages' },
         plugins: { commandId: 'plugin:push', path: join(cwd, 'loopress.json'), type: 'plugins' },
-        parts: { commandId: 'template:push', path: join(rootDir, localConfig.partDir ?? 'parts'), type: 'parts' },
-        templates: { commandId: 'template:push', path: join(rootDir, localConfig.templateDir ?? 'templates'), type: 'templates' },
+        parts: { commandId: 'theme:template:push', path: join(cwd, resolveResourceDir('part', localConfig)), type: 'parts' },
+        templates: { commandId: 'theme:template:push', path: join(cwd, resolveResourceDir('template', localConfig)), type: 'templates' },
         snippets: { commandId: 'snippet:push', path: join(rootDir, localConfig.snippetsDir ?? 'snippets'), type: 'snippets' },
     };
     return types

package/dist/lib/diff-state.js

@@ -29,6 +29,7 @@ function renderTextChange(id, left, right, labels) {
 function objectFieldChanges(left, right) {
     return microdiff(left, right, { cyclesFix: false }).map((change) => {
         const path = change.path.join('.');
+        // microdiff types leaf values as `any`.
         if (change.type === 'CREATE')
             return { kind: 'added', path, to: change.value };
         if (change.type === 'REMOVE')

package/dist/lib/github-release.js

@@ -4,8 +4,8 @@ import { mkdtemp } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { pipeline } from 'node:stream/promises';
+import { withSpinner } from './spinner.js';
 const REPO = 'loopress/loopress';
-const RELEASE_TAG_PATTERN = /^wordpress-plugin@/;
 const ASSET_NAME = 'loopress-full.zip';
 /**
  * Downloads `loopress-full.zip` from the most recent `wordpress-plugin@*` release of
@@ -18,6 +18,9 @@ const ASSET_NAME = 'loopress-full.zip';
  * "the one zip asset".
  */
 export async function downloadLatestFullZip() {
+    return withSpinner('Downloading Loopress Full', download);
+}
+async function download() {
     const releases = await got(`https://api.github.com/repos/${REPO}/releases`, {
         headers: { accept: 'application/vnd.github+json', 'user-agent': 'loopress-cli' },
         searchParams: { 'per_page': 30 },

package/dist/lib/local-callback-server.d.ts

@@ -1,5 +1,4 @@
 export type CallbackHelpers<T> = {
-    body: Record<string, string>;
     rejectWithPage: (page: string, error: Error) => void;
     resolveWithPage: (page: string, value: T) => void;
     respondBadRequest: (message: string) => void;
@@ -9,13 +8,14 @@ export type CallbackHelpers<T> = {
  * local server; this factors out the server setup, timeout, and browser-opening boilerplate.
  *
  * The loopback server is unauthenticated, so any local process or web page open during the wait
- * could otherwise POST forged credentials to it (RFC 8252 section 8.9). Two guards close that:
+ * could otherwise send forged credentials to it (RFC 8252 section 8.9). Two guards close that:
  *
  * - a 32-byte `state` generated here, threaded into the authorize URL by `buildUrl`, and required
- *   back (constant-time compare) on any request that carries credentials;
- * - an `Origin` allowlist: a browser sends `Origin` on the relay's cross-site form POST, so a
- *   stray page's POST (carrying its own origin) is rejected. Top-level navigations send no
- *   `Origin` and are allowed, which is why `state` is the primary control.
+ *   back (constant-time compare) on any request with a query string, the only place credentials
+ *   are read from;
+ * - an `Origin` allowlist: the legitimate callbacks are top-level redirects, which send no
+ *   `Origin`, so a request from a page script (carrying its own origin) is rejected. That's
+ *   defense in depth, `state` is the primary control.
  *
  * The first request that looks like a callback (valid or not) shuts the server down, so a
  * failed guess gets no second try within the window.
@@ -23,12 +23,18 @@ export type CallbackHelpers<T> = {
 export declare function waitForLocalCallback<T>(options: {
     allowedOrigins: string[];
     buildUrl: (callbackBaseUrl: string, state: string) => string;
+    /** Host advertised in the callback URL; the server itself always listens on 127.0.0.1. */
+    callbackHost?: string;
     handleRequest: (url: URL, helpers: CallbackHelpers<T>) => void;
     log: (message: string) => void;
     openingMessage: string;
     timeoutMessage: string;
     timeoutMs?: number;
 }): Promise<T>;
+/**
+ * The page rewrites its own URL to `/` on load, so the callback query string (an Application
+ * Password, a console token) doesn't stay in the browser history or address bar.
+ */
 export declare function renderResultPage(options: {
     background: string;
     heading: string;

package/dist/lib/local-callback-server.js

@@ -2,15 +2,7 @@ import { Buffer } from 'node:buffer';
 import { randomBytes, timingSafeEqual } from 'node:crypto';
 import { createServer } from 'node:http';
 import { openBrowser } from './open-browser.js';
-async function readBody(req) {
-    const chunks = [];
-    for await (const chunk of req)
-        chunks.push(chunk);
-    return Buffer.concat(chunks).toString('utf8');
-}
-function parseFormData(body) {
-    return Object.fromEntries(new URLSearchParams(body));
-}
+import { withSpinner } from './spinner.js';
 /** Constant-time compare that also tolerates a length mismatch without throwing. */
 function safeEqual(a, b) {
     const bufferA = Buffer.from(a);
@@ -22,13 +14,14 @@ function safeEqual(a, b) {
  * local server; this factors out the server setup, timeout, and browser-opening boilerplate.
  *
  * The loopback server is unauthenticated, so any local process or web page open during the wait
- * could otherwise POST forged credentials to it (RFC 8252 section 8.9). Two guards close that:
+ * could otherwise send forged credentials to it (RFC 8252 section 8.9). Two guards close that:
  *
  * - a 32-byte `state` generated here, threaded into the authorize URL by `buildUrl`, and required
- *   back (constant-time compare) on any request that carries credentials;
- * - an `Origin` allowlist: a browser sends `Origin` on the relay's cross-site form POST, so a
- *   stray page's POST (carrying its own origin) is rejected. Top-level navigations send no
- *   `Origin` and are allowed, which is why `state` is the primary control.
+ *   back (constant-time compare) on any request with a query string, the only place credentials
+ *   are read from;
+ * - an `Origin` allowlist: the legitimate callbacks are top-level redirects, which send no
+ *   `Origin`, so a request from a page script (carrying its own origin) is rejected. That's
+ *   defense in depth, `state` is the primary control.
  *
  * The first request that looks like a callback (valid or not) shuts the server down, so a
  * failed guess gets no second try within the window.
@@ -36,25 +29,28 @@ function safeEqual(a, b) {
 export async function waitForLocalCallback(options) {
     const timeoutMs = options.timeoutMs ?? 5 * 60 * 1000;
     const state = randomBytes(32).toString('hex');
-    return new Promise((resolve, reject) => {
+    const callback = new Promise((resolve, reject) => {
         function finish(res, page) {
-            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            // `Connection: close` (here and below): server.close() only refuses new connections, a
+            // kept-alive socket would otherwise still reach this handler after the shutdown.
+            res.writeHead(200, { Connection: 'close', 'Content-Type': 'text/html; charset=utf-8' });
             res.end(page);
             clearTimeout(timer);
             server.close();
         }
         function rejectRequest(res, message) {
-            res.writeHead(403, { 'Content-Type': 'text/plain' });
+            res.writeHead(403, { Connection: 'close', 'Content-Type': 'text/plain' });
             res.end(message);
             clearTimeout(timer);
             server.close();
             reject(new Error(message));
         }
-        async function handleIncoming(req, res) {
+        function handleIncoming(req, res) {
             try {
                 const url = new URL(req.url ?? '/', 'http://localhost');
-                const body = req.method === 'POST' ? parseFormData(await readBody(req)) : {};
-                const looksLikeCallback = url.searchParams.has('state') || Object.keys(body).length > 0;
+                // Any query string counts, not just one carrying `state`: credentials are read from the
+                // query, so a request with `password=` but no `state` must not slip past the check.
+                const looksLikeCallback = url.search !== '';
                 if (looksLikeCallback) {
                     const { origin } = req.headers;
                     if (origin !== undefined && !options.allowedOrigins.includes(origin)) {
@@ -79,7 +75,6 @@ export async function waitForLocalCallback(options) {
                         res.writeHead(400, { 'Content-Type': 'text/plain' });
                         res.end(message);
                     },
-                    body,
                 });
             }
             catch (error) {
@@ -89,7 +84,7 @@ export async function waitForLocalCallback(options) {
                 reject(error instanceof Error ? error : new Error(String(error)));
             }
         }
-        const server = createServer((req, res) => { void handleIncoming(req, res); });
+        const server = createServer(handleIncoming);
         server.on('error', (err) => {
             clearTimeout(timer);
             reject(err);
@@ -100,13 +95,18 @@ export async function waitForLocalCallback(options) {
         }, timeoutMs);
         server.listen(0, '127.0.0.1', () => {
             const { port } = server.address();
-            const targetUrl = options.buildUrl(`http://localhost:${port}`, state);
+            const targetUrl = options.buildUrl(`http://${options.callbackHost ?? 'localhost'}:${port}`, state);
             options.log(options.openingMessage);
             options.log(`\nIf it doesn't open automatically, visit:\n${targetUrl}\n`);
             openBrowser(targetUrl);
         });
     });
+    return withSpinner('Waiting for the browser', async () => callback);
 }
+/**
+ * The page rewrites its own URL to `/` on load, so the callback query string (an Application
+ * Password, a console token) doesn't stay in the browser history or address bar.
+ */
 export function renderResultPage(options) {
     return `<!DOCTYPE html>
 <html lang="en">
@@ -144,6 +144,7 @@ export function renderResultPage(options) {
     <h1>${options.heading}</h1>
     <p>You can close this tab and return to your terminal.</p>
   </div>
+  <script>history.replaceState(null, '', '/')</script>
 </body>
 </html>`;
 }

package/dist/lib/php-files-command.js

@@ -274,6 +274,8 @@ export function resourceListCommand(spec) {
 }
 export function resourceRmCommand(spec) {
     class ResourceRm extends LoopressCommand {
+        // `remove` matches `lps app remove` and `lps option remove`, `rm` stays for existing scripts.
+        static aliases = [`${spec.cliName}:remove`];
         static args = {
             filename: Args.string({
                 description: `The ${spec.noun} to remove, its slug without the .php extension (e.g. "hello" or "invoice-pdf/[order_id]")`,
@@ -282,7 +284,7 @@ export function resourceRmCommand(spec) {
         };
         static description = spec.rmDescription;
         static enableJsonFlag = true;
-        static examples = [`$ lps ${spec.cliName} rm hello`, `$ lps ${spec.cliName} rm hello --yes`];
+        static examples = [`$ lps ${spec.cliName} rm hello`, `$ lps ${spec.cliName} remove hello --yes`];
         static flags = { ...LoopressCommand.dryRunFlag, ...LoopressCommand.yesFlag };
         async run() {
             const { args } = await this.parse(ResourceRm);

package/dist/lib/push-command.d.ts

@@ -2,14 +2,20 @@ import { LoopressCommand } from './base.js';
 import { type ResourceState } from './diff-state.js';
 import { type ResourceStateProvider } from './resource-state.js';
 export declare abstract class PushCommand extends LoopressCommand {
+    static baseFlags: {
+        'production-confirmed': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        env: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
     protected failedCount: number;
     private refusedByGuard;
     protected captureBeforePushState(provider: ResourceStateProvider, dir: string): Promise<ResourceState | undefined>;
     catch(err: Error): Promise<void>;
     protected guardProductionPush(): Promise<void>;
     init(): Promise<void>;
+    protected previewRemote(provider: ResourceStateProvider, dir: string): Promise<void>;
     protected recordDeployment(status: 'failure' | 'success'): Promise<void>;
     protected recordSuccess(): Promise<void>;
+    protected reportPushToSite(): Promise<void>;
     protected reportTaskFailure(message: string, error: unknown, task?: {
         output: string;
     }): never;

package/dist/lib/push-command.js

@@ -1,3 +1,4 @@
+import { Flags } from '@oclif/core';
 import got from 'got';
 import { Listr } from 'listr2';
 import { resolve } from 'node:path';
@@ -6,20 +7,30 @@ import { API_URL } from './api-client.js';
 import { LoopressCommand } from './base.js';
 import { guardProductionPush } from './guard-production-push.js';
 import { writeSnapshot } from './snapshot-store.js';
+import { withoutSpinner, withSpinner } from './spinner.js';
 export class PushCommand extends LoopressCommand {
+    // Passed by an aggregate command (`lps theme push`) that already confirmed production once,
+    // so its steps skip that prompt while still asking their own confirmations (uninstalls).
+    static baseFlags = {
+        ...LoopressCommand.baseFlags,
+        'production-confirmed': Flags.boolean({ hidden: true }),
+    };
     failedCount = 0;
     // Refusals of the production guard never reach the site, so they must not pollute the
     // deployment history with failure records.
     refusedByGuard = false;
     // Reads `provider`'s remote state right before a real push, for `writeAfterPushSnapshot` to
-    // pair with the actual post-push remote state once the push completes. A dry run changes
-    // nothing, so there is nothing to snapshot. Best-effort: a read failure (the site briefly
-    // unreachable) must never block the push itself, the same "never interrupt the push flow"
-    // stance recordDeployment takes; `undefined` tells `writeAfterPushSnapshot` there is no
-    // restore point to complete.
+    // pair with the actual post-push remote state once the push completes. Best-effort: a read
+    // failure (the site briefly unreachable) must never block the push itself, the same "never
+    // interrupt the push flow" stance recordDeployment takes; `undefined` tells
+    // `writeAfterPushSnapshot` there is no restore point to complete.
+    //
+    // On a dry run, the same read is the preview's check against the site (see previewRemote).
     async captureBeforePushState(provider, dir) {
-        if (this.dryRun)
+        if (this.dryRun) {
+            await this.previewRemote(provider, dir);
             return undefined;
+        }
         try {
             return await provider.remote(this.wp, (message) => {
                 this.warn(message);
@@ -34,7 +45,7 @@ export class PushCommand extends LoopressCommand {
         if (!this.dryRun && !this.refusedByGuard && this.siteConfig) {
             await this.recordDeployment('failure');
         }
-        return super.catch(err);
+        await super.catch(err);
     }
     async guardProductionPush() {
         await guardProductionPush({
@@ -44,31 +55,61 @@ export class PushCommand extends LoopressCommand {
                 this.refusedByGuard = true;
             },
             siteConfig: this.siteConfig,
-            yes: this.yes,
+            yes: this.yes || this.productionConfirmed,
         });
     }
     async init() {
         await super.init();
         await this.guardProductionPush();
     }
+    // A dry run used to stay local, so it announced "pushed" for a resource the site would refuse
+    // (ACF or Rank Math missing: a 400 or 409 on the real push). It now reads the site the same way
+    // `lps diff` does and fails the same way, so the preview, and the MCP server's preview and
+    // pre-apply check built on it, see what the real push will hit.
+    async previewRemote(provider, dir) {
+        try {
+            await provider.remote(this.wp, () => { }, dir);
+        }
+        catch (error) {
+            this.error(`The site would refuse this push: ${error.message}`);
+        }
+    }
     async recordDeployment(status) {
         const token = process.env.LOOPRESS_TOKEN ?? authManager.getAuth()?.token ?? null;
         if (!token)
             return;
         try {
-            await got.post(`${API_URL}/deployments`, {
+            await withSpinner('Recording the deployment', async () => got.post(`${API_URL}/deployments`, {
                 headers: { Authorization: `Bearer ${token}` },
                 json: { status, url: this.siteConfig.url },
                 timeout: { request: 3000 },
-            });
+            }));
         }
         catch {
             // non-blocking: recording must never interrupt the push flow
         }
     }
     async recordSuccess() {
-        if (!this.dryRun)
-            await this.recordDeployment('success');
+        if (this.dryRun)
+            return;
+        await this.recordDeployment('success');
+        await this.reportPushToSite();
+    }
+    // Tells the plugin this push finished, for its Overview tab and the "managed by Loopress"
+    // warnings in wp-admin: one record per command (`this.id`, e.g. `acf:push`), since a single push
+    // sends one request per item. Best-effort like recordDeployment: a plugin older than the push
+    // log answers 404, one that doesn't know this command 400, neither may fail a push that landed.
+    async reportPushToSite() {
+        if (!this.id)
+            return;
+        try {
+            // Bounded: the site fingerprints the pushed resource before answering, which a large
+            // site can make slow, and a finished push must not wait on its own bookkeeping.
+            await this.wp.post('loopress/v1/pushes', { resource: this.id }, { timeoutMs: 5000 });
+        }
+        catch {
+            // non-blocking, see above
+        }
     }
     // Reports one failed Listr task: status lines go through `task.output` when running inside a
     // Listr renderer (this.warn would race with the repaint), and fall back to `this.warn` when
@@ -89,17 +130,19 @@ export class PushCommand extends LoopressCommand {
     // just the first. `label` feeds the "Push <label>" task title; `task` does the actual work
     // and reports its own failure through `reportTaskFailure`.
     async runPushTasks(items, label, task) {
-        await new Listr(items.map((item) => ({
-            task: async (_ctx, taskCtx) => task(item, taskCtx),
-            title: `Push ${label(item)}`,
-        })), { concurrent: false, exitOnError: false, renderer: this.jsonEnabled() ? 'silent' : 'default' }).run();
+        await withoutSpinner(async () => {
+            await new Listr(items.map((item) => ({
+                task: async (_ctx, taskCtx) => task(item, taskCtx),
+                title: `Push ${label(item)}`,
+            })), { concurrent: false, exitOnError: false, renderer: this.jsonEnabled() ? 'silent' : 'default' }).run();
+        });
     }
     // Pairs `beforeState` (from captureBeforePushState, read before this push touched anything)
     // with a fresh remote read taken right after the push, and writes both as one rollback
     // snapshot. Reading the after-state from WordPress itself, rather than assuming it matches
     // the local files that were pushed, is what keeps this correct for every resource's own
-    // partial-push semantics: a readonly option skipped by `option push`, a snippet or SEO
-    // redirect that gets a server-assigned id on create, a theme-styles push that only touches the
+    // partial-push semantics: a readonly option skipped by `option push`, a snippet or form
+    // that gets a server-assigned id on create, a theme-styles push that only touches the
     // active stylesheet, an API/hook push that leaves server-side files alone unless `--prune`.
     // `lps <resource> rollback`'s drift check compares the environment's state at rollback time
     // against exactly this after-state, so it has to be what actually landed, not what was sent.

package/dist/lib/put-or-create.js

@@ -1,8 +1,7 @@
 import { isNotFoundError } from './wp-client.js';
-// Update-or-create dance shared by every id-based resource (form, seo redirect,
-// snippet, unlike ACF which is key-based and only ever POSTs): PUT to the known id, and only
-// fall back to POST when the site doesn't recognize that id (404), e.g. a fresh install or a
-// database reset.
+// Update-or-create dance shared by every id-based resource (form, snippet, unlike ACF which
+// is key-based and only ever POSTs): PUT to the known id, and only fall back to POST when the
+// site doesn't recognize that id (404), e.g. a fresh install or a database reset.
 export async function putOrCreate(wp, options) {
     const { id, payload, postEndpoint, postPayload = payload, putEndpoint } = options;
     if (id !== null) {