@loopress/cli 0.34.0 → 0.35.0

package/dist/commands/doctor.js

@@ -4,7 +4,7 @@ import {} from '../lib/capabilities.js';
 import { errorMessage } from '../lib/narrow.js';
 import { formatRuntimeError, HOOK_FILES_RESOURCE } from '../lib/php-files-command.js';
 import { findTempAdmins } from '../lib/temp-admin.js';
-import { isApplicationPasswordsDisabled, isForbiddenError, isNotFoundError } from '../lib/wp-client.js';
+import { isApplicationPasswordsDisabled, isFirewallBlock, isForbiddenError, isNotFoundError } from '../lib/wp-client.js';
 import { diagnoseWpSite } from '../lib/wp-site-diagnostic.js';
 import { pluralize } from '../utils/pluralize.js';
 export default class Doctor extends LoopressCommand {
@@ -156,7 +156,7 @@ export default class Doctor extends LoopressCommand {
         catch (error) {
             lookup = { error };
         }
-        if ('error' in lookup && isForbiddenError(lookup.error)) {
+        if ('error' in lookup && isForbiddenError(lookup.error) && !isFirewallBlock(lookup.error)) {
             this.out('- Leftover temporary admin accounts: not checked, these credentials cannot list users.');
             return;
         }

package/dist/commands/form/push.js

@@ -1,5 +1,5 @@
 import { Args, Flags } from '@oclif/core';
-import { readFile, rename, writeFile } from 'node:fs/promises';
+import { readFile, writeFile } from 'node:fs/promises';
 import { dirname, extname, join } from 'node:path';
 import { errorMessage, isRecord } from '../../lib/narrow.js';
 import { PushCommand } from '../../lib/push-command.js';
@@ -9,6 +9,7 @@ import { getResourceStateProvider } from '../../lib/resource-state.js';
 import { isNotFoundError } from '../../lib/wp-client.js';
 import { FORM_ENDPOINT, formEndpoint, getFormId, getFormTitle } from '../../utils/form-format.js';
 import { pluralize } from '../../utils/pluralize.js';
+import { renameWithRetry } from '../../utils/rename-retry.js';
 import { toSlug } from '../../utils/to-slug.js';
 export default class Push extends PushCommand {
     static args = {
@@ -66,7 +67,7 @@ export default class Push extends PushCommand {
     async ensureCanonicalFilename(filePath, id, title) {
         const canonicalPath = join(dirname(filePath), `${id}-${toSlug(title, 'untitled')}.json`);
         if (filePath !== canonicalPath)
-            await rename(filePath, canonicalPath);
+            await renameWithRetry(filePath, canonicalPath);
     }
     // One file is read in isolation: a corrupted or hand-broken JSON file must only skip that
     // form, not abort loading the rest of the directory, same principle as loadObjects() in

package/dist/commands/option/list.js

@@ -1,9 +1,14 @@
 import { Flags, ux } from '@oclif/core';
-import ttyTable from 'tty-table';
+import ttyTableModule, {} from 'tty-table';
 import { LoopressCommand } from '../../lib/base.js';
 import { withSpinner } from '../../lib/spinner.js';
 import { OPTIONS_ENDPOINT } from '../../utils/option-format.js';
 import { pluralize } from '../../utils/pluralize.js';
+// tty-table 7 ships CJS-flavored typings (`types` before `import` in its exports map), so under
+// Node16 resolution TS types the default import as the whole CJS namespace, while at runtime the
+// ESM build's default export is the factory itself (it exports no named `Table`).
+// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- see above
+const ttyTable = ttyTableModule;
 // Same green/yellow pairing drives both SOURCE? and PLUGIN, so a row's whole "where did this come
 // from" story reads as one color at a glance instead of requiring the "?" to be spotted in text.
 function confidenceColor(option) {

package/dist/commands/plugin/audit.d.ts

@@ -23,8 +23,8 @@ export default class Audit extends LoopressCommand {
     static flags: {};
     run(): Promise<AuditResult>;
     private auditOne;
-    private fetchHealth;
     private fetchVulnerabilities;
     private report;
+    private reportToConsole;
 }
 export {};

package/dist/commands/plugin/audit.js

@@ -1,11 +1,14 @@
 import got from 'got';
+import { authManager } from '../../config/auth.manager.js';
+import { API_URL } from '../../lib/api-client.js';
 import { LoopressCommand } from '../../lib/base.js';
 import { errorMessage, isRecord } from '../../lib/narrow.js';
 import { withSpinner } from '../../lib/spinner.js';
+import {} from '../../types/config.js';
 import { pinVersion } from '../../types/plugin.js';
 import { compareVersions } from '../../utils/version.js';
+import { fetchPluginInfo } from '../../utils/wporg.js';
 const WPVULN_BASE = 'https://www.wpvulnerability.net/plugin';
-const WPORG_INFO = 'https://api.wordpress.org/plugins/info/1.2/';
 export default class Audit extends LoopressCommand {
     static description = 'Check the plugins in loopress.json for known vulnerabilities (wpvulnerability.net) and health issues';
     static enableJsonFlag = true;
@@ -25,10 +28,20 @@ export default class Audit extends LoopressCommand {
             advisories.push(...found.advisories);
             health.push(...found.health);
         }
-        return this.report(advisories, health, slugs.length);
+        // Print first: report() may set the exit code, and the console request must not delay the output.
+        const result = this.report(advisories, health, slugs.length);
+        await this.reportToConsole(advisories, health, manifest);
+        // exit() throws before oclif prints the --json result, which a CI reading it needs most here.
+        if (advisories.length > 0) {
+            if (this.jsonEnabled())
+                process.exitCode = 1;
+            else
+                this.exit(1);
+        }
+        return result;
     }
     async auditOne(slug, pinned) {
-        const [vulns, info] = await Promise.all([this.fetchVulnerabilities(slug), this.fetchHealth(slug)]);
+        const [vulns, info] = await Promise.all([this.fetchVulnerabilities(slug), fetchPluginInfo(slug)]);
         // "latest" is the newest WordPress.org release, the one a push installs: audit that version.
         // Unknown (WordPress.org unreachable), every advisory is reported, safer than none.
         const version = pinned === 'latest' && typeof info?.version === 'string' ? info.version : pinned;
@@ -38,18 +51,6 @@ export default class Audit extends LoopressCommand {
         const health = info ? describeHealth(slug, pinned, info) : [];
         return { advisories, health };
     }
-    async fetchHealth(slug) {
-        try {
-            const body = await got(WPORG_INFO, {
-                searchParams: { action: 'plugin_information', 'request[slug]': slug },
-                timeout: { request: 10_000 },
-            }).json();
-            return typeof body === 'object' && !('error' in body) ? body : null;
-        }
-        catch {
-            return null;
-        }
-    }
     async fetchVulnerabilities(slug) {
         let body;
         try {
@@ -64,7 +65,8 @@ export default class Audit extends LoopressCommand {
                 'Audit aborted so a service outage is not reported as a clean result.', { cause: error });
         }
         // A 200 with the wrong shape (degraded service) must not read as "no advisories" either.
-        const list = body?.data?.vulnerability;
+        // wpvulnerability.net answers `"vulnerability": null` when it has no advisories: that is an empty list.
+        const list = body?.data?.vulnerability === null ? [] : body?.data?.vulnerability;
         if (!Array.isArray(list) || list.some((raw) => !isRecord(raw))) {
             throw new TypeError(`Unexpected answer from the vulnerability database (wpvulnerability.net) for "${slug}". ` +
                 'Audit aborted so a malformed response is not reported as a clean result.');
@@ -84,15 +86,35 @@ export default class Audit extends LoopressCommand {
         const noun = advisories.length === 1 ? 'advisory' : 'advisories';
         this.log(`\n${advisories.length} vulnerability ${noun}, ${health.length} health note(s). ` +
             'Vulnerability data: wpvulnerability.net.');
-        // exit() throws before oclif prints the --json result, which a CI reading it needs most here.
-        if (advisories.length > 0) {
-            if (this.jsonEnabled())
-                process.exitCode = 1;
-            else
-                this.exit(1);
-        }
         return { advisories, health, status: 'issues' };
     }
+    // Best-effort, like `recordDeployment`: when a token is present, sends the console the advisories
+    // and health notes (slug, version, CVE, severity, fixed version, title). Silent on any failure,
+    // and it never touches the output or the exit code.
+    async reportToConsole(advisories, health, manifest) {
+        try {
+            const token = process.env.LOOPRESS_TOKEN ?? authManager.getAuth()?.token ?? null;
+            const url = this.siteConfig?.url;
+            if (!token || !url)
+                return;
+            const sent = advisories.map(({ cve, fixedIn, severity, slug, title }) => ({
+                cve,
+                fixedIn,
+                severity,
+                slug,
+                title,
+                version: pinVersion(manifest[slug] ?? 'latest'),
+            }));
+            await got.post(`${API_URL}/plugin-audits`, {
+                headers: { Authorization: `Bearer ${token}` },
+                json: { advisories: sent, health, url },
+                timeout: { request: 3000 },
+            });
+        }
+        catch {
+            // non-blocking: reporting must never change the audit's outcome
+        }
+    }
 }
 function advisoryMeta(a) {
     const fixed = a.fixedIn ? `fixed in ${a.fixedIn}` : undefined;

package/dist/commands/plugin/outdated.d.ts

@@ -0,0 +1,22 @@
+import { LoopressCommand } from '../../lib/base.js';
+import { type VersionJump } from '../../utils/version.js';
+export type OutdatedPlugin = {
+    current: string;
+    jump: null | VersionJump;
+    latest: null | string;
+    slug: string;
+    status: 'closed' | 'current' | 'error' | 'outdated' | 'unknown';
+};
+type OutdatedResult = {
+    outdated: number;
+    plugins: OutdatedPlugin[];
+};
+export default class Outdated extends LoopressCommand {
+    static description: string;
+    static enableJsonFlag: boolean;
+    static examples: string[];
+    static flags: {};
+    run(): Promise<OutdatedResult>;
+    private printTable;
+}
+export {};

package/dist/commands/plugin/outdated.js

@@ -0,0 +1,67 @@
+import { LoopressCommand } from '../../lib/base.js';
+import { withSpinner } from '../../lib/spinner.js';
+import { pinVersion } from '../../types/plugin.js';
+import { compareVersions, versionJump } from '../../utils/version.js';
+import { requestPluginInfo } from '../../utils/wporg.js';
+export default class Outdated extends LoopressCommand {
+    static description = 'Compare the plugins in loopress.json to the latest WordPress.org versions (exits 1 when one is behind or cannot be checked)';
+    static enableJsonFlag = true;
+    static examples = ['$ lps plugin outdated', '$ lps plugin outdated --json'];
+    static flags = {};
+    async run() {
+        const entries = Object.entries(this.localConfig.plugins ?? {});
+        if (entries.length === 0) {
+            this.log('No plugins in loopress.json.');
+            return { outdated: 0, plugins: [] };
+        }
+        const plugins = await withSpinner('Checking plugins', async () => Promise.all(entries.map(async ([slug, pin]) => checkPlugin(slug, pinVersion(pin)))));
+        const outdated = plugins.filter((p) => p.status === 'outdated').length;
+        this.printTable(plugins);
+        const failed = plugins.filter((p) => ['closed', 'error'].includes(p.status)).length;
+        if (outdated > 0)
+            this.log(`\n${outdated} plugin(s) behind WordPress.org.`);
+        if (failed > 0)
+            this.log(`\n${failed} plugin(s) closed on WordPress.org or could not be checked.`);
+        if (outdated === 0 && failed === 0)
+            this.log('\nAll plugins are up to date.');
+        // exit() throws before oclif prints the --json result, which a CI reading it needs most here.
+        if (outdated > 0 || failed > 0) {
+            if (this.jsonEnabled())
+                process.exitCode = 1;
+            else
+                this.exit(1);
+        }
+        return { outdated, plugins };
+    }
+    printTable(plugins) {
+        const rows = [
+            ['PLUGIN', 'CURRENT', 'LATEST', 'JUMP'],
+            ...plugins.map((p) => [p.slug, p.current, p.latest ?? '-', p.jump ?? (['closed', 'error', 'unknown'].includes(p.status) ? p.status : '-')]),
+        ];
+        const widths = [0, 1, 2, 3].map((i) => Math.max(...rows.map((r) => (r[i] ?? '').length)));
+        for (const row of rows)
+            this.log(row.map((cell, i) => cell.padEnd(widths[i] ?? 0)).join('  ').trimEnd());
+    }
+}
+async function checkPlugin(slug, current) {
+    let info;
+    try {
+        info = await requestPluginInfo(slug);
+    }
+    catch {
+        return { current, jump: null, latest: null, slug, status: 'error' };
+    }
+    if (info?.error === 'closed')
+        return { current, jump: null, latest: null, slug, status: 'closed' };
+    const latest = typeof info?.version === 'string' ? info.version : null;
+    // Not on WordPress.org (zip, premium), unknown. An unreachable API is an error.
+    if (!latest)
+        return { current, jump: null, latest: null, slug, status: 'unknown' };
+    // "latest" always installs the newest release: it is never behind.
+    const jump = versionJump(current, latest);
+    if (jump)
+        return { current, jump, latest, slug, status: 'outdated' };
+    // Equal or ahead is current; a pin that can't be ordered at all is unknown.
+    const comparable = current === 'latest' || compareVersions(current, latest) !== null;
+    return { current, jump: null, latest, slug, status: comparable ? 'current' : 'unknown' };
+}

package/dist/commands/plugin/push.d.ts

@@ -24,10 +24,11 @@ export default class Push extends PushCommand {
     private deactivate;
     private deactivateEndangered;
     private fetchInstanceLock;
-    private filesForNewlyInstalled;
     private guardForce;
+    private installedBySync;
     private loadSource;
     private logStillInactive;
+    private removeStaleCopies;
     private result;
     private sync;
 }

package/dist/commands/plugin/push.js

@@ -6,10 +6,10 @@ import { confirmUninstall } from '../../lib/interactive.js';
 import { causeOf, isRecord } from '../../lib/narrow.js';
 import { PushCommand } from '../../lib/push-command.js';
 import { isLocalEnvironment, isNotFoundError, parseBody, responseOf } from '../../lib/wp-client.js';
-import { pinActive, pinVersion, pinVersions, } from '../../types/plugin.js';
+import { pinActive, pinProblem, pinVersion, pinVersions, } from '../../types/plugin.js';
 import { parseComposerJson, requireToInstall, toIntent, wpackagistRequire } from '../../utils/composer.js';
 import { isDowngrade, parseCollisions, SYNC_TIMEOUT_MS, } from '../../utils/plugin-sync.js';
-import { diffPlugins, lockedWpackagistSlugs, parseInstalledPlugins } from '../../utils/plugins.js';
+import { diffPlugins, lockedWpackagistSlugs, parseInstalledPlugins, preferredCopy, } from '../../utils/plugins.js';
 import { isExactVersion } from '../../utils/version.js';
 const IN_SYNC = {
     activated: [],
@@ -65,6 +65,9 @@ export default class Push extends PushCommand {
         if (!hasFloatingPin && isNoop(diff, toPrune)) {
             this.log('Everything is already in sync.');
             this.logStillInactive(skippedActivations);
+            // The inventory still matters to the console when nothing had to change.
+            if (!this.dryRun)
+                await this.recordDeployment('success');
             return { ...IN_SYNC };
         }
         if (isNoop(diff, toPrune))
@@ -75,8 +78,9 @@ export default class Push extends PushCommand {
         }
         if (!(await confirmUninstall(diff.toRemove, this.yes)))
             this.error('Aborted.');
+        const switchedOff = await this.deactivateEndangered(installed, diff, force);
         // Plugins switched off for the file swap come back on, unless loopress.json wants them inactive.
-        const deactivated = (await this.deactivateEndangered(installed, diff, force)).filter((p) => !diff.toRemove.includes(p.slug) && (fromComposer || pinActive(source.manifest[p.slug])));
+        const deactivated = switchedOff.filter((p) => !diff.toRemove.includes(p.slug) && (fromComposer || pinActive(source.manifest[p.slug])));
         let response;
         try {
             response = await this.sync(source.intent, force);
@@ -87,9 +91,14 @@ export default class Push extends PushCommand {
             await this.activate(deactivated);
             throw error;
         }
-        const activateNew = (slug) => (fromComposer ? activate : pinActive(source.manifest[slug]));
-        const newlyInstalled = await this.filesForNewlyInstalled(diff.toInstall);
-        const toActivate = [...deactivated, ...diff.toActivate, ...newlyInstalled.filter((p) => activateNew(p.slug))];
+        const wasActive = new Set(switchedOff.map((p) => p.slug));
+        const activateNew = (slug) => fromComposer ? activate || wasActive.has(slug) : pinActive(source.manifest[slug]);
+        const { newlyInstalled, takenOver } = await this.installedBySync(installed, diff, force);
+        const toActivate = [
+            ...deactivated.filter((p) => takenOver.every((t) => t.slug !== p.slug)),
+            ...diff.toActivate,
+            ...[...newlyInstalled, ...takenOver].filter((p) => activateNew(p.slug)),
+        ];
         const toDeactivate = [...diff.toDeactivate, ...installed.filter((p) => toPrune.includes(p.slug))];
         await this.deactivate(toDeactivate);
         await this.activate(toActivate);
@@ -169,19 +178,6 @@ export default class Push extends PushCommand {
             throw error;
         }
     }
-    // toInstall entries carry no `file`: the plugin didn't exist on the site at diff time, so its
-    // WordPress core plugin id (folder/main-file.php) is only knowable after sync() has actually
-    // installed it. Refetch to get it, then activate like everything else.
-    async filesForNewlyInstalled(toInstall) {
-        if (toInstall.length === 0)
-            return [];
-        const installedAfterSync = parseInstalledPlugins(await this.wp.get('wp/v2/plugins'));
-        const fileBySlug = new Map(installedAfterSync.map((p) => [p.slug, p.file]));
-        return toInstall.flatMap(({ slug }) => {
-            const file = fileBySlug.get(slug);
-            return file ? [{ file, slug }] : [];
-        });
-    }
     guardForce(diff, force, file) {
         if (force)
             return;
@@ -198,6 +194,21 @@ export default class Push extends PushCommand {
                 `migrations the newer version ran, which can break the site. Re-run with --force, or bump the version in ${file}.`);
         }
     }
+    // New and taken-over plugins only get their final WordPress id (folder/main-file) once
+    // sync() has installed them: read it from the site. A taken-over plugin is activated from
+    // the folder Composer installed, with no stale copy left beside it.
+    async installedBySync(installed, diff, force) {
+        const collisions = force ? diff.collisions.map((c) => c.slug) : [];
+        if (diff.toInstall.length === 0 && collisions.length === 0)
+            return { newlyInstalled: [], takenOver: [] };
+        const afterSync = parseInstalledPlugins(await this.wp.get('wp/v2/plugins'));
+        const takenOver = filesFor(collisions, afterSync);
+        const kept = await this.removeStaleCopies(installed, afterSync, takenOver);
+        return {
+            newlyInstalled: filesFor(diff.toInstall.map((p) => p.slug), afterSync),
+            takenOver: takenOver.filter((p) => !kept.includes(p.slug)),
+        };
+    }
     async loadSource(activate) {
         const composerJsonPath = join(process.cwd(), this.rootDir, 'composer.json');
         if (existsSync(composerJsonPath)) {
@@ -217,6 +228,10 @@ export default class Push extends PushCommand {
         if (Object.keys(manifest).length === 0) {
             this.error('No plugins found in loopress.json. Run `lps plugin pull` or `lps plugin add <slug>` first.');
         }
+        // A mistyped key (`activate`) would otherwise push the plugin with the default state.
+        const problems = Object.entries(manifest).flatMap(([slug, pin]) => pinProblem(slug, pin) ?? []);
+        if (problems.length > 0)
+            this.error(`Invalid loopress.json: ${problems.join('; ')}. Fix it, then push again.`);
         return {
             file: 'loopress.json',
             intent: { plugins: pinVersions(manifest) },
@@ -231,6 +246,34 @@ export default class Push extends PushCommand {
         this.log(`${plugins.length} plugin(s) from composer.json are inactive: ${plugins.map((p) => p.slug).join(', ')}.`);
         this.log('Re-run with --activate to activate them, or activate them in wp-admin.');
     }
+    // A takeover installs `wp-content/plugins/<slug>/`, but the plugin it replaces may live
+    // elsewhere: core's Hello Dolly is `hello.php`, which the site lists under the slug
+    // `hello-dolly`. Composer leaves that file in place, and both copies declare the same
+    // functions, so activating them together would fatal: delete the stale copy, as --force says.
+    // Returns the slugs whose stale copy could not be deleted: the caller must not activate
+    // their replacement beside it. Copies the sync already removed are skipped, and a failed
+    // deletion does not stop the others or the activations.
+    async removeStaleCopies(installed, afterSync, managedCopies) {
+        const replaced = installed.flatMap((old) => {
+            const copy = managedCopies.find((c) => c.slug === old.slug && c.file !== old.file);
+            return copy && afterSync.some((a) => a.file === old.file) ? [{ copy, old }] : [];
+        });
+        const kept = [];
+        for (const { copy, old } of replaced) {
+            this.log(`  ✕ removing ${old.file} (replaced by ${copy.file})`);
+            try {
+                // Deactivated before the sync if it was active (deactivateEndangered): WordPress
+                // refuses to delete an active plugin.
+                await this.wp.delete(`wp/v2/plugins/${old.file}`);
+            }
+            catch (error) {
+                kept.push(old.slug);
+                this.warn(`Could not delete ${old.file}: ${error instanceof Error ? error.message : String(error)}. ` +
+                    `${copy.file} stays inactive until it is deleted: remove ${old.file} in wp-admin, then activate ${copy.slug}.`);
+            }
+        }
+        return kept;
+    }
     result(diff, opts) {
         const collisionSlugs = opts.includeCollisions ? diff.collisions.map((c) => c.slug) : [];
         return {
@@ -267,6 +310,14 @@ function missingDependencies(error) {
     const data = [body.data, ...(Array.isArray(body.additional_data) ? body.additional_data : [])];
     return data.flatMap((d) => (isRecord(d) && isRecord(d.not_installed) ? Object.keys(d.not_installed) : []));
 }
+// The WordPress plugin id of each slug, read after sync() has installed it: a plugin the diff
+// saw as missing (or as an unmanaged copy) has no id, or the wrong one, before that.
+function filesFor(slugs, installed) {
+    return slugs.flatMap((slug) => {
+        const match = preferredCopy(installed.filter((p) => p.slug === slug), slug);
+        return match ? [{ file: match.file, slug }] : [];
+    });
+}
 function isNoop(diff, toPrune) {
     return (diff.toInstall.length === 0 &&
         diff.toPin.length === 0 &&

package/dist/commands/plugin/update.d.ts

@@ -0,0 +1,36 @@
+import { LoopressCommand } from '../../lib/base.js';
+import { type VersionJump } from '../../utils/version.js';
+export type PluginChange = {
+    from: string;
+    jump: VersionJump;
+    slug: string;
+    to: string;
+};
+export type SkippedPlugin = {
+    reason: 'current' | 'error' | 'latest' | 'unknown';
+    slug: string;
+    version: string;
+};
+type UpdateResult = {
+    changes: PluginChange[];
+    skipped: SkippedPlugin[];
+};
+type Cap = 'minor' | 'patch' | undefined;
+export default class Update extends LoopressCommand {
+    static args: {
+        slug: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static description: string;
+    static enableJsonFlag: boolean;
+    static examples: string[];
+    static flags: {
+        minor: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        patch: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    static strict: boolean;
+    run(): Promise<UpdateResult>;
+    private write;
+}
+export declare function pickUpdate(current: string, latest: string, versions: unknown, cap: Cap): null | string;
+export {};

package/dist/commands/plugin/update.js

@@ -0,0 +1,121 @@
+import { Args, Flags } from '@oclif/core';
+import { LoopressCommand } from '../../lib/base.js';
+import { withSpinner } from '../../lib/spinner.js';
+import { pinVersion } from '../../types/plugin.js';
+import { writeLocalConfig } from '../../utils/loopress-config.js';
+import { compareVersions, isExactVersion, versionJump } from '../../utils/version.js';
+import { requestPluginInfo } from '../../utils/wporg.js';
+export default class Update extends LoopressCommand {
+    static args = {
+        slug: Args.string({ description: 'Plugin slug(s) in loopress.json to update (default: all of them)' }),
+    };
+    static description = 'Rewrite plugin versions in loopress.json to the latest WordPress.org releases (loopress.json only, run `lps plugin push` to apply)';
+    static enableJsonFlag = true;
+    static examples = [
+        '$ lps plugin update',
+        '$ lps plugin update woocommerce akismet',
+        '$ lps plugin update --minor',
+        '$ lps plugin update --patch --json',
+    ];
+    static flags = {
+        ...LoopressCommand.dryRunFlag,
+        minor: Flags.boolean({ description: 'Stay on the current major version (minor and patch releases only)', exclusive: ['patch'] }),
+        patch: Flags.boolean({ description: 'Stay on the current minor version (patch releases only)', exclusive: ['minor'] }),
+    };
+    static strict = false;
+    async run() {
+        const { argv, flags } = await this.parse(Update);
+        const pins = this.localConfig.plugins ?? {};
+        const requested = [...new Set(argv.map(String))];
+        const missing = requested.filter((slug) => !Object.hasOwn(pins, slug));
+        if (missing.length > 0)
+            this.error(`Not in loopress.json: ${missing.join(', ')}. Add it with \`lps plugin add\`.`);
+        const targets = Object.entries(pins).filter(([slug]) => requested.length === 0 || requested.includes(slug));
+        if (targets.length === 0) {
+            this.log('No plugins in loopress.json.');
+            return { changes: [], skipped: [] };
+        }
+        const results = await withSpinner('Checking plugins', async () => Promise.all(targets.map(async ([slug, pin]) => resolveUpdate(slug, pinVersion(pin), capOf(flags)))));
+        const changes = results.filter((r) => 'to' in r);
+        const skipped = results.filter((r) => 'reason' in r);
+        for (const c of changes)
+            this.log(`${this.dryRun ? '[dry-run] ' : ''}${c.slug}  ${c.from} -> ${c.to}  (${c.jump})`);
+        const unchecked = skipped.some((s) => s.reason === 'unknown' || s.reason === 'error');
+        if (!unchecked && changes.length === 0)
+            this.log('Every plugin is already at the newest version allowed.');
+        else if (changes.length > 0 && !this.dryRun)
+            await this.write(changes);
+        const failed = skipped.filter((s) => s.reason === 'error').map((s) => s.slug);
+        if (failed.length > 0) {
+            this.warn(`Could not check ${failed.join(', ')} (WordPress.org unreachable).`);
+            // Same as `plugin outdated`: exit() would throw before oclif prints the --json result.
+            if (this.jsonEnabled())
+                process.exitCode = 1;
+            else
+                this.exit(1);
+        }
+        return { changes, skipped };
+    }
+    async write(changes) {
+        const plugins = { ...this.localConfig.plugins };
+        for (const { slug, to } of changes) {
+            const pin = plugins[slug];
+            // An object pin keeps its other keys (an inactive plugin stays inactive).
+            plugins[slug] = typeof pin === 'object' ? { ...pin, version: to } : to;
+        }
+        await writeLocalConfig({ ...this.localConfig, plugins });
+        this.log(`\nUpdated ${changes.length} plugin(s) in loopress.json. Run \`lps plugin push\` to apply.`);
+    }
+}
+function capOf(flags) {
+    if (flags.patch)
+        return 'patch';
+    return flags.minor ? 'minor' : undefined;
+}
+async function resolveUpdate(slug, current, cap) {
+    if (current === 'latest')
+        return { reason: 'latest', slug, version: current };
+    // A wildcard or range constraint (9.4.x) is not an exact pin: rewriting it would widen it.
+    if (!isExactVersion(current))
+        return { reason: 'unknown', slug, version: current };
+    let info;
+    try {
+        info = await requestPluginInfo(slug, { versions: cap !== undefined });
+    }
+    catch {
+        return { reason: 'error', slug, version: current };
+    }
+    const latest = typeof info?.version === 'string' ? info.version : null;
+    if (!latest || compareVersions(current, latest) === null)
+        return { reason: 'unknown', slug, version: current };
+    // A cap needs the release list: without it an eligible release could be missed silently.
+    const listed = info?.versions;
+    if (cap !== undefined && (typeof listed !== 'object' || listed === null || Object.keys(listed).length === 0)) {
+        return { reason: 'unknown', slug, version: current };
+    }
+    const to = pickUpdate(current, latest, info?.versions, cap);
+    const jump = to ? versionJump(current, to) : null;
+    return to && jump ? { from: current, jump, slug, to } : { reason: 'current', slug, version: current };
+}
+// The version `current` should move to: `latest` without a cap, otherwise the newest stable
+// release from WordPress.org's version list that keeps the major (--minor) or the major and
+// minor (--patch). Null when nothing newer qualifies.
+export function pickUpdate(current, latest, versions, cap) {
+    if (cap === undefined)
+        return versionJump(current, latest) ? latest : null;
+    const listed = typeof versions === 'object' && versions !== null ? Object.keys(versions) : [];
+    let best = null;
+    for (const candidate of [...listed, latest]) {
+        // Skips "trunk", prereleases and anything beyond the advertised latest release.
+        if (!/^\d+(?:\.\d+){0,3}$/.test(candidate) || !isExactVersion(candidate))
+            continue;
+        if ((compareVersions(candidate, latest) ?? 1) > 0)
+            continue;
+        const jump = versionJump(current, candidate);
+        if (!jump || jump === 'major' || (cap === 'patch' && jump === 'minor'))
+            continue;
+        if (best === null || (compareVersions(candidate, best) ?? 0) > 0)
+            best = candidate;
+    }
+    return best;
+}

package/dist/commands/push.js

@@ -6,7 +6,7 @@ import { integrationFix, missingIntegration, missingModule } from '../lib/capabi
 import { guardProductionPush } from '../lib/guard-production-push.js';
 import { stdoutToStderr } from '../lib/json-delegation.js';
 import { errorMessage } from '../lib/narrow.js';
-import { PushCommand } from '../lib/push-command.js';
+import { postDeployment, PushCommand, startDeploymentCollector, stopDeploymentCollector } from '../lib/push-command.js';
 import { parseSelectionFlag, selectionFlags, selectResources } from '../lib/resource-selection.js';
 import { isLocalEnvironment } from '../lib/wp-client.js';
 import { pinActive } from '../types/plugin.js';
@@ -75,6 +75,15 @@ export default class Push extends LoopressCommand {
         const argv = this.buildArgv();
         const results = [];
         const skips = await this.skippedTargets(selected, skipFlag.includes('composer'));
+        // The steps run in process and would each post their own record: collect, and post once.
+        const collected = startDeploymentCollector();
+        const record = async (status) => {
+            stopDeploymentCollector();
+            if (this.dryRun)
+                return;
+            const steps = results.map((result, index) => ({ command: PUSH_TARGETS[index]?.commandId ?? '', status: result.status }));
+            await postDeployment({ command: 'push', status, steps, url: this.siteConfig.url, ...(collected.plugins && { plugins: collected.plugins }) });
+        };
         for (const target of PUSH_TARGETS) {
             const skip = skips.get(target.commandId);
             if (skip) {
@@ -99,9 +108,11 @@ export default class Push extends LoopressCommand {
                     .map((next) => next.label);
                 const skippedNote = skipped.length > 0 ? ` Not attempted: ${skipped.join(', ')}.` : '';
                 this.warnUnsupported();
+                await record('failure');
                 this.error(`${target.label} failed to push: ${message}.${skippedNote}`);
             }
         }
+        await record('success');
         this.log(this.doneMessage(selected.size < PUSH_IDS.length));
         this.warnUnsupported();
         return { results };