@loopress/cli 0.30.0 → 0.31.0

package/dist/commands/acf/push.js

@@ -26,7 +26,8 @@ export default class Push extends PushCommand {
         this.log(`Pushing ACF configuration to ${url}`);
         this.log(`ACF path: ${path}`);
         const provider = getResourceStateProvider('acf');
-        const beforeState = await this.captureBeforePushState(provider, path);
+        // `--type` leaves the other types untouched: only the pushed ones count as overwritten.
+        const beforeState = await this.captureBeforePushState(provider, path, (id) => types.some((type) => id.startsWith(`${type}/`)));
         for (const type of types) {
             await this.pushType(type, path);
         }

package/dist/commands/composer/push.d.ts

@@ -17,5 +17,6 @@ export default class ComposerPush extends PushCommand {
     };
     run(): Promise<PushResult>;
     private reportLockDrift;
+    private wpackagistToRemove;
 }
 export {};

package/dist/commands/composer/push.js

@@ -2,6 +2,7 @@ import { Flags } from '@oclif/core';
 import { existsSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { confirmUninstall } from '../../lib/interactive.js';
 import { PushCommand } from '../../lib/push-command.js';
 import { isLocalEnvironment, isTimeoutError } from '../../lib/wp-client.js';
 import { requireToInstall, toIntent } from '../../utils/composer.js';
@@ -37,8 +38,15 @@ export default class ComposerPush extends PushCommand {
         this.log(`Pushing composer.json (${packageCount} ${packageCount === 1 ? 'package' : 'packages'}) to ${url}`);
         if (lock)
             this.log('  + composer.lock sent for drift comparison (the server resolves versions from composer.json)');
+        // The server renders composer.json from this intent alone, so a WordPress.org plugin or theme
+        // the site has and this file lacks gets uninstalled, active or not: say so before it happens.
+        const toRemove = await this.wpackagistToRemove(require);
+        if (toRemove.length > 0)
+            this.log(`Would uninstall from the site, absent from composer.json: ${toRemove.join(', ')}`);
         if (this.dryRun)
             return { hasLock, lockDrift: [], packageCount, status: 'dry-run' };
+        if (!(await confirmUninstall(toRemove, this.yes)))
+            this.error('Aborted.');
         this.log('Running Composer on the server, this can take a few minutes...');
         let response;
         try {
@@ -74,4 +82,9 @@ export default class ComposerPush extends PushCommand {
         }
         this.log('Run `lps composer pull` to update your local composer.json and composer.lock.');
     }
+    async wpackagistToRemove(require) {
+        const { composerJson } = await this.wp.get('loopress/v1/composer/json');
+        const current = JSON.parse(composerJson).require ?? {};
+        return Object.keys(current).filter((name) => name.startsWith('wpackagist-') && !Object.hasOwn(require, name));
+    }
 }

package/dist/commands/content/copy.d.ts

@@ -0,0 +1,28 @@
+import { LoopressCommand } from '../../lib/base.js';
+import { WpClient } from '../../lib/wp-client.js';
+type ContentCopyResult = {
+    from: string;
+    posts: number;
+    status: 'copied' | 'dry-run';
+    terms: number;
+};
+export default class Copy extends LoopressCommand {
+    static args: {
+        from: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static baseFlags: {
+        env: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    static description: string;
+    static enableJsonFlag: boolean;
+    static examples: string[];
+    static flags: {
+        yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<ContentCopyResult>;
+    protected sourceWp(from: string): WpClient;
+    private confirmReplace;
+    private copy;
+}
+export {};

package/dist/commands/content/copy.js

@@ -0,0 +1,97 @@
+import { confirm } from '@inquirer/prompts';
+import { Args, Flags } from '@oclif/core';
+import { configManager } from '../../config/project-config.manager.js';
+import { LoopressCommand } from '../../lib/base.js';
+import { isInteractive } from '../../lib/interactive.js';
+import { stdoutToStderr } from '../../lib/json-delegation.js';
+import { isLocalEnvironment, LOCAL_ENVIRONMENT_NAME, WpClient } from '../../lib/wp-client.js';
+import { pluralize } from '../../utils/pluralize.js';
+const BATCH_SIZE = 100;
+// Code goes up, content comes down: the content of <from> replaces the local site's, IDs
+// unchanged, never the reverse and never into the repo. Not a `pull`: nothing is written to
+// local files. The target is always "local", so there is no --env (this.wp is the local site),
+// <from> names the source like `lps promote`. Terms go first, so the post batches can attach
+// their term relationships. The plugin refuses the import on any site whose environment type is
+// not "local", whatever this command is pointed at.
+export default class Copy extends LoopressCommand {
+    static args = {
+        from: Args.string({ description: 'Environment to copy the content from', required: true }),
+    };
+    // Hidden, not removed: the type of LoopressCommand.baseFlags requires it. Any value other than
+    // "local" is refused in run().
+    static baseFlags = {
+        env: Flags.string({ hidden: true }),
+    };
+    static description = 'Replace the local site\'s content (posts, pages, public custom post types, terms) with the content of <from>, then push the project to the local site so tracked configuration wins. Media stay served by <from>, users, comments and orders are never copied.';
+    static enableJsonFlag = true;
+    static examples = ['$ lps content copy production', '$ lps content copy staging --dry-run'];
+    static flags = {
+        ...LoopressCommand.dryRunFlag,
+        ...LoopressCommand.yesFlag,
+    };
+    async run() {
+        const { args } = await this.parse(Copy);
+        const { from } = args;
+        if (!isLocalEnvironment(this.siteConfig.name)) {
+            this.error(`Content is only ever copied into the "${LOCAL_ENVIRONMENT_NAME}" environment. Run \`lps project config\` to add it if the project has none.`);
+        }
+        if (isLocalEnvironment(from)) {
+            this.error(`<from> must be another environment than "${LOCAL_ENVIRONMENT_NAME}", e.g. \`lps content copy production\`.`);
+        }
+        const source = this.sourceWp(from);
+        if (!this.dryRun)
+            await this.confirmReplace(from);
+        const info = await source.get('loopress/v1/content');
+        if (!this.dryRun) {
+            await this.wp.post('loopress/v1/content/reset', { home: info.home, uploadsUrl: info.uploadsUrl });
+        }
+        this.log(`\n→ Copying terms from ${from}...`);
+        const terms = await this.copy('terms', source);
+        this.log(`→ Copying posts from ${from}...`);
+        const posts = await this.copy('posts', source);
+        const summary = `${pluralize(posts, 'post')} and ${pluralize(terms, 'term')}`;
+        if (this.dryRun) {
+            this.log(`\n[dry-run] Would replace the local content with ${summary} from ${from}, then push the project to ${LOCAL_ENVIRONMENT_NAME}.`);
+            return { from, posts, status: 'dry-run', terms };
+        }
+        this.log(`\n→ Pushing the project to ${LOCAL_ENVIRONMENT_NAME}...`);
+        await stdoutToStderr(this.jsonEnabled(), async () => this.config.runCommand('push', ['--env', LOCAL_ENVIRONMENT_NAME, '--yes']));
+        this.log(`\nCopied ${summary} from ${from}.`);
+        return { from, posts, status: 'copied', terms };
+    }
+    // Overridable seam for tests, like `wpClient` on LoopressCommand.
+    sourceWp(from) {
+        const project = configManager.getProject(this.projectId);
+        const env = project?.environments[from];
+        if (!env) {
+            this.error(`Environment "${from}" not found. Available: ${Object.keys(project?.environments ?? {}).join(', ')}`);
+        }
+        if (!env.token)
+            this.error(`No credentials configured for ${env.url}. Run \`lps project config\` to add them.`);
+        return new WpClient(env.url, env.token, env.name);
+    }
+    async confirmReplace(from) {
+        if (this.yes)
+            return;
+        const message = `This deletes the posts, pages and terms of the "${LOCAL_ENVIRONMENT_NAME}" site and replaces them with ${from}'s.`;
+        if (!isInteractive())
+            this.error(`${message} Pass --yes to confirm.`);
+        const isProceed = await confirm({ default: true, message: `${message} Continue?` });
+        if (!isProceed)
+            this.error('Aborted.');
+    }
+    // Pages through the source, each page posted to the local site as is.
+    async copy(kind, source) {
+        let count = 0;
+        let after = 0;
+        while (after !== null) {
+            const page = await source.get(`loopress/v1/content/${kind}?after=${after}&limit=${BATCH_SIZE}`);
+            const { next, ...rows } = page;
+            count += rows[kind].length;
+            if (!this.dryRun)
+                await this.wp.post(`loopress/v1/content/${kind}`, rows);
+            after = next;
+        }
+        return count;
+    }
+}

package/dist/commands/doctor.d.ts

@@ -19,6 +19,7 @@ export default class Doctor extends LoopressCommand {
     private readonly checks;
     run(): Promise<DoctorResult>;
     private check;
+    private checkHookErrors;
     private checkLeftoverTempAdmins;
     private out;
     private reportPluginVersion;

package/dist/commands/doctor.js

@@ -1,5 +1,6 @@
 import { configManager } from '../config/project-config.manager.js';
 import { LoopressCommand } from '../lib/base.js';
+import { formatRuntimeError, HOOK_FILES_RESOURCE } from '../lib/php-files-command.js';
 import { findTempAdmins } from '../lib/temp-admin.js';
 import { isForbiddenError, isNotFoundError } from '../lib/wp-client.js';
 import { diagnoseWpSite } from '../lib/wp-site-diagnostic.js';
@@ -35,8 +36,10 @@ export default class Doctor extends LoopressCommand {
                 // application password without depending on any Loopress feature.
                 const isAuthenticated = await this.check('Credentials accepted (authenticated request)', async () => this.wp.get('wp/v2/users/me'));
                 // Skipped when the credentials were just rejected: it would only repeat that same 401.
-                if (isAuthenticated)
+                if (isAuthenticated) {
                     await this.checkLeftoverTempAdmins();
+                    await this.checkHookErrors();
+                }
                 pluginVersion = await this.reportPluginVersion();
             }
             else {
@@ -76,6 +79,30 @@ export default class Doctor extends LoopressCommand {
             return false;
         }
     }
+    // A hook that fails to load or throws while running doesn't break the site, it just quietly
+    // does nothing, and its only trace is an error_log nobody reads on managed hosting.
+    async checkHookErrors() {
+        let lookup;
+        try {
+            lookup = { files: await this.wp.get(HOOK_FILES_RESOURCE.endpoint) };
+        }
+        catch (error) {
+            if (isNotFoundError(error))
+                return; // Loopress Light has no hooks
+            lookup = { error };
+        }
+        await this.check('Hooks load and run without errors', async () => {
+            if ('error' in lookup)
+                throw lookup.error;
+            const files = Array.isArray(lookup.files) ? lookup.files : [];
+            const problems = files.flatMap((file) => [
+                ...(file.error ? [`hooks/${file.filename}.php: ${file.error}`] : []),
+                ...(file.runtimeError ? [`hooks/${file.filename}.php: ${formatRuntimeError(file.runtimeError)}`] : []),
+            ]);
+            if (problems.length > 0)
+                throw new Error(problems.join('\n  '));
+        });
+    }
     // Report only, never deletes: a doctor run shouldn't change the site. A leftover is a live
     // administrator with a password nobody holds, so it fails the run. Credentials without
     // `list_users` can't look, which is informational, not a failure: nothing was found wrong.

package/dist/commands/form/push.js

@@ -1,5 +1,5 @@
 import { Args, Flags } from '@oclif/core';
-import { readFile, rename } from 'node:fs/promises';
+import { readFile, rename, writeFile } from 'node:fs/promises';
 import { dirname, extname, join } from 'node:path';
 import { PushCommand } from '../../lib/push-command.js';
 import { putOrCreate } from '../../lib/put-or-create.js';
@@ -120,6 +120,9 @@ export default class Push extends PushCommand {
                 putEndpoint: formEndpoint,
             });
             const canonicalId = created ? getFormId(body) : id;
+            // The id is read from the file, not its name: without it the next push creates the form again.
+            if (created && canonicalId !== null)
+                await writeFile(filePath, JSON.stringify({ ...data, id: canonicalId }, null, 2) + '\n');
             if (canonicalId !== null)
                 await this.ensureCanonicalFilename(filePath, canonicalId, title);
             if (task)

package/dist/commands/option/push.js

@@ -23,8 +23,6 @@ export default class Push extends PushCommand {
         const { url } = this.siteConfig;
         this.log(`Pushing tracked options to ${url}`);
         this.log(`Options path: ${dir}`);
-        const provider = getResourceStateProvider('option');
-        const beforeState = await this.captureBeforePushState(provider, dir);
         const tracked = await loadFiles(dir, {
             extension: '.json',
             onSkip: (message) => {
@@ -33,6 +31,10 @@ export default class Push extends PushCommand {
             parse: parseLocalOption,
         });
         const { skipped, writable } = partitionByReadonly(tracked);
+        const provider = getResourceStateProvider('option');
+        // Readonly options are never written, so a site-side change to one is no reason to stop.
+        const writableNames = new Set(writable.map((option) => option.name));
+        const beforeState = await this.captureBeforePushState(provider, dir, (name) => writableNames.has(name));
         if (skipped.length > 0) {
             this.log(`Skipping ${pluralize(skipped.length, 'readonly option')}: ${skipped.map((option) => option.name).join(', ')}`);
         }

package/dist/commands/page/push.js

@@ -29,13 +29,14 @@ export default class Push extends PushCommand {
             this.error(`No page "${args.slug}" in ${path} (expected ${args.slug}.html).`);
         }
         this.log(`Found ${pluralize(selected.length, 'page')} to push`);
-        if (this.dryRun)
-            await this.previewRemote(getResourceStateProvider('page'), path);
+        const provider = getResourceStateProvider('page');
+        const beforeState = await this.captureBeforePushState(provider, path, args.slug === undefined ? undefined : (id) => id === args.slug);
         const pushed = [];
         await this.runPushTasks(selected, (page) => page.slug, async (page, task) => {
             await this.pushPage(page, task);
             pushed.push(page.slug);
         });
+        await this.writeAfterPushSnapshot(provider, path, beforeState);
         if (this.failedCount > 0) {
             this.error(`${pluralize(this.failedCount, 'page')} failed to push.`);
         }

package/dist/commands/plugin/audit.js

@@ -28,7 +28,12 @@ export default class Audit extends LoopressCommand {
     }
     async auditOne(slug, pinned) {
         const [vulns, info] = await Promise.all([this.fetchVulnerabilities(slug), this.fetchHealth(slug)]);
-        const advisories = vulns.filter((v) => pinned === 'latest' || affects(pinned, v.fixedIn)).map((v) => ({ ...v, slug }));
+        // "latest" is the newest WordPress.org release, the one a push installs: audit that version.
+        // Unknown (WordPress.org unreachable), every advisory is reported, safer than none.
+        const version = pinned === 'latest' && typeof info?.version === 'string' ? info.version : pinned;
+        const advisories = vulns
+            .filter((v) => version === 'latest' || affects(version, v.range))
+            .map(({ range: _range, ...v }) => ({ ...v, slug }));
         const health = info ? describeHealth(slug, pinned, info) : [];
         return { advisories, health };
     }
@@ -72,8 +77,13 @@ export default class Audit extends LoopressCommand {
         const noun = advisories.length === 1 ? 'advisory' : 'advisories';
         this.log(`\n${advisories.length} vulnerability ${noun}, ${health.length} health note(s). ` +
             'Vulnerability data: wpvulnerability.net.');
-        if (advisories.length > 0)
-            this.exit(1);
+        // exit() throws before oclif prints the --json result, which a CI reading it needs most here.
+        if (advisories.length > 0) {
+            if (this.jsonEnabled())
+                process.exitCode = 1;
+            else
+                this.exit(1);
+        }
         return { advisories, health, status: 'issues' };
     }
 }
@@ -86,34 +96,41 @@ function normalizeAdvisory(raw) {
     const cvss = (raw.cvss ?? {});
     const source = Array.isArray(raw.source) ? raw.source : [];
     const cve = typeof raw.cve === 'string' ? raw.cve : source.find((s) => s.id?.startsWith('CVE-'))?.id;
+    const range = extractRange(raw);
     return {
         cve,
-        fixedIn: extractFixedIn(raw),
+        fixedIn: range.max?.op === 'lt' ? range.max.version : undefined,
+        range,
         score: cvss.score,
         severity: cvss.severity,
-        title: typeof raw.name === 'string' ? raw.name : 'Unnamed advisory',
+        title: typeof raw.name === 'string' ? decodeEntities(raw.name) : 'Unnamed advisory',
     };
 }
-// wpvulnerability's `impact.software[].versions[]` carries `to_version` / `to_compare`; the
-// first "< X" bound is the version the fix landed in. Best-effort: the shape varies, so a
-// missing bound just means we can't tell and the advisory is reported anyway.
-function extractFixedIn(raw) {
-    const impact = raw.impact;
-    for (const sw of impact?.software ?? []) {
-        for (const v of sw.versions ?? []) {
-            if (v.to_compare === '<' && typeof v.to_version === 'string')
-                return v.to_version;
-        }
-    }
-    return undefined;
+// wpvulnerability's `operator`: `max_version` with `max_operator` "lt" (fixed in that version),
+// "le" (affected up to it, no fix yet) or "eq" (that version only), and an optional lower bound `min_version` with
+// `min_operator` "gt" or "ge". No upper bound means every version from the lower one on.
+function extractRange(raw) {
+    const op = (raw.operator ?? {});
+    const bound = (version, operator) => typeof version === 'string' && version !== '' && typeof operator === 'string' ? { op: operator, version } : undefined;
+    return { max: bound(op.max_version, op.max_operator), min: bound(op.min_version, op.min_operator) };
+}
+// A bound we can't evaluate (odd version strings, unknown operator) counts as affected: a false
+// positive is safer than hiding an advisory.
+function affects(version, range) {
+    const within = (bound, ok) => {
+        if (!bound)
+            return true;
+        const order = compareVersions(version, bound.version);
+        return order === null || !Object.hasOwn(ok, bound.op) || ok[bound.op](order);
+    };
+    return (within(range.min, { ge: (o) => o >= 0, gt: (o) => o > 0 }) && within(range.max, { eq: (o) => o === 0, le: (o) => o <= 0, lt: (o) => o < 0 }));
 }
-// If we know the fix version, a pin below it is affected. If we can't compare (odd version
-// strings), report it anyway: a false positive is safer than hiding an advisory.
-function affects(pinned, fixedIn) {
-    if (!fixedIn)
-        return true;
-    const order = compareVersions(pinned, fixedIn);
-    return order === null || order < 0;
+// Advisory names come HTML-encoded ("WPForms &#8211; AI Form Builder").
+function decodeEntities(text) {
+    return text
+        .replaceAll(/&#(\d+);/g, (_, code) => String.fromCodePoint(Number(code)))
+        .replaceAll('&quot;', '"')
+        .replaceAll('&amp;', '&');
 }
 function describeHealth(slug, pinned, info) {
     const notes = [];

package/dist/commands/promote.d.ts

@@ -13,6 +13,7 @@ export default class Promote extends Command {
     static enableJsonFlag: boolean;
     static examples: string[];
     static flags: {
+        overwrite: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };

package/dist/commands/promote.js

@@ -8,6 +8,7 @@ import { configManager } from '../config/project-config.manager.js';
 import { LoopressCommand } from '../lib/base.js';
 import { isInteractive } from '../lib/interactive.js';
 import { stdoutToStderr } from '../lib/json-delegation.js';
+import { PushCommand } from '../lib/push-command.js';
 import { readLocalConfig } from '../utils/loopress-config.js';
 import { resolveResourceDir, RESOURCE_DIR_DEFAULTS } from '../utils/resource-dirs.js';
 export default class Promote extends Command {
@@ -21,10 +22,11 @@ export default class Promote extends Command {
     static flags = {
         ...LoopressCommand.dryRunFlag,
         ...LoopressCommand.yesFlag,
+        overwrite: PushCommand.baseFlags.overwrite,
     };
     async run() {
         const { args, flags } = await this.parse(Promote);
-        const { yes } = flags;
+        const { overwrite, yes } = flags;
         const dryRun = flags['dry-run'];
         const { environments, projectName } = await this.resolveProject();
         const from = this.requireEnvironment(environments, projectName, args.from);
@@ -52,10 +54,12 @@ export default class Promote extends Command {
             }
             catch (error) {
                 // A partial pull must never be pushed onward: stop before touching <to>.
-                this.error(`Pull from ${from.name} failed, ${to.name} left untouched: ${error.message}`);
+                // "untouched" is only true of <to>: a real (non dry-run) pull has already rewritten the files.
+                const filesNote = dryRun ? '' : ` Your local files may already hold part of ${from.name}, review them before pushing.`;
+                this.error(`Pull from ${from.name} failed, nothing was pushed to ${to.name}.${filesNote} ${error.message}`);
             }
             this.log(`\n=== Pushing to ${to.name} (${to.url}) ===`);
-            await stdoutToStderr(this.jsonEnabled(), async () => this.config.runCommand('push', this.delegateArgv(to.name, dryRun)));
+            await stdoutToStderr(this.jsonEnabled(), async () => this.config.runCommand('push', [...this.delegateArgv(to.name, dryRun), ...(overwrite ? ['--overwrite'] : [])]));
         }
         finally {
             if (scratch) {

package/dist/commands/pull.d.ts

@@ -2,7 +2,7 @@ import { LoopressCommand } from '../lib/base.js';
 type PullTargetResult = {
     error?: string;
     label: string;
-    status: 'failed' | 'pulled';
+    status: 'failed' | 'pulled' | 'skipped';
 };
 type PullResult = {
     results: PullTargetResult[];
@@ -18,5 +18,6 @@ export default class Pull extends LoopressCommand {
     private failedCount;
     run(): Promise<PullResult>;
     private buildArgv;
+    private usesResource;
 }
 export {};

package/dist/commands/pull.js

@@ -1,6 +1,12 @@
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
 import { LoopressCommand } from '../lib/base.js';
 import { stdoutToStderr } from '../lib/json-delegation.js';
 import { pluralize } from '../utils/pluralize.js';
+import { resolveResourceDir } from '../utils/resource-dirs.js';
+// How the plugin reports its integration missing: "ACF is not active", "No supported form
+// plugin is active", "No supported snippet plugin is active".
+const PLUGIN_MISSING = /\bis not active\b|\bNo supported .+ plugin is active\b/;
 // composer before plugins: when a composer.json exists, `plugin:pull` merges the live plugins
 // into it, so it must run on the freshly pulled one or `composer:pull` would overwrite its work. The rest write to independent
 // directories and their order does not matter, it mirrors `lps push` for familiarity.
@@ -11,14 +17,14 @@ const PULL_TARGETS = [
     { commandId: 'taxonomy:pull', label: 'taxonomies', supportsYes: true },
     { commandId: 'meta:pull', label: 'post meta', supportsYes: true },
     { commandId: 'role:pull', label: 'roles', supportsYes: true },
-    { commandId: 'acf:pull', label: 'ACF', supportsYes: true },
+    { commandId: 'acf:pull', label: 'ACF', needsPlugin: 'acf', supportsYes: true },
     { commandId: 'api:pull', label: 'API routes', supportsYes: true },
     { commandId: 'hook:pull', label: 'hooks', supportsYes: true },
-    { commandId: 'form:pull', label: 'forms', supportsYes: true },
+    { commandId: 'form:pull', label: 'forms', needsPlugin: 'form', supportsYes: true },
     { commandId: 'pattern:pull', label: 'patterns', supportsYes: true },
     { commandId: 'menu:pull', label: 'menus', supportsYes: true },
     { commandId: 'option:pull', label: 'options', supportsYes: true },
-    { commandId: 'snippet:pull', label: 'snippets', supportsYes: true },
+    { commandId: 'snippet:pull', label: 'snippets', needsPlugin: 'snippets', supportsYes: true },
 ];
 export default class Pull extends LoopressCommand {
     static description = 'Pull all content, plugins, composer dependencies, post types, taxonomies, post meta, roles, ACF, API routes, hooks, forms, patterns, menus, options, and snippets, from WordPress';
@@ -40,8 +46,19 @@ export default class Pull extends LoopressCommand {
                 results.push({ label: target.label, status: 'pulled' });
             }
             catch (error) {
-                this.failedCount++;
                 const { message } = error;
+                // A site without ACF (or a form or snippet plugin) is the common case, not a failure,
+                // as long as the project doesn't use that resource: a vanilla site must pull, and a
+                // promote must not stop on it. A project that does use it still fails.
+                if (target.needsPlugin && PLUGIN_MISSING.test(message) && !this.usesResource(target.needsPlugin)) {
+                    // oclif's catch already set exitCode to 1 for the sub-command; a real failure still
+                    // exits non-zero through the this.error() below.
+                    process.exitCode = undefined;
+                    this.log(`→ ${target.label}: not configured, skipped`);
+                    results.push({ label: target.label, status: 'skipped' });
+                    continue;
+                }
+                this.failedCount++;
                 this.log(`✗ ${target.label} failed: ${message}`);
                 results.push({ error: message, label: target.label, status: 'failed' });
             }
@@ -65,4 +82,7 @@ export default class Pull extends LoopressCommand {
             argv.push('--yes');
         return argv;
     }
+    usesResource(kind) {
+        return existsSync(resolve(resolveResourceDir(kind, this.localConfig)));
+    }
 }

package/dist/commands/push.d.ts

@@ -2,7 +2,7 @@ import { LoopressCommand } from '../lib/base.js';
 type PushTargetResult = {
     error?: string;
     label: string;
-    status: 'failed' | 'pushed';
+    status: 'failed' | 'pushed' | 'skipped';
 };
 type PushResult = {
     results: PushTargetResult[];
@@ -12,13 +12,15 @@ export default class Push extends LoopressCommand {
     static enableJsonFlag: boolean;
     static examples: string[];
     static flags: {
+        overwrite: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
-    private failedCount;
     run(): Promise<PushResult>;
     private buildArgv;
     private composerDeclaresPlugins;
+    private composerJsonPath;
     private guardProductionPush;
+    private skippedTargets;
 }
 export {};