primo-cli 0.1.17 → 0.1.19

package/dist/commands/deploy.js

@@ -224,11 +224,13 @@ async function check_provider_auth(provider) {
         return false;
     }
 }
-// Pinned to the upstream-published image. primocms's main.yml workflow
-// publishes branch tags for whitelisted prefixes (main, feature/**, rc/**),
-// with slashes slugified to dashes (feature/local-dev-cli → :feature-local-dev-cli).
-// Bump to a release tag (:v3.0.0) when primocms cuts a stable release.
-const PRIMO_SERVER_IMAGE = 'ghcr.io/primocms/primo:main';
+// Track the latest stable release. primocms's tag.yml workflow publishes a
+// :latest image (alongside semver tags) on every version tag — the comment
+// there calls out that "Railway/self-host deployers follow this tag to track
+// releases". Following :latest means deploys pick up new releases on their next
+// rebuild without a per-release bump here. (main.yml still publishes branch tags
+// like :main / :feature-* for testing; :latest is the released line.)
+const PRIMO_SERVER_IMAGE = 'ghcr.io/primocms/primo:latest';
 async function generate_dockerfile(inventory) {
     // One-line Dockerfile: pull the published primo image and run it
     // unchanged. Workspace data (server.yaml, sites/, library/) is uploaded

package/dist/commands/dev.js

@@ -29,6 +29,12 @@ let last_import_time = 0; // Timestamp of last import completion
 let last_local_change_time = 0; // Timestamp of most recent local watcher event
 const importing_site_keys = new Set();
 const pending_local_site_keys = new Set();
+// Sites whose last import returned null (duplicate _ids across files — nothing
+// was pushed). They stay quarantined until a later import succeeds: no CMS→file
+// polling into them (a quarantined site is out of sync with the CMS, so copying
+// remote-only paths in could clobber the local files the user must edit to fix
+// the conflict). Cleared on the next successful import.
+const blocked_site_keys = new Set();
 let is_importing_library = false;
 let has_pending_library_local_changes = false;
 let site_sync_baselines = new Map();
@@ -125,21 +131,73 @@ function compute_shrink_delta(prior, next) {
     const delta = next_lines - prior_lines;
     return delta < 0 ? delta : null;
 }
-// Write the most recent push outcome to a file the MCP build_preview tool
-// reads, so the agent learns when its file changes failed to land in the CMS.
-// Without this, build_preview compiles whatever stale DB state existed before
-// the failed push and reports ok:true, leaving the agent to chase phantom
-// rendering bugs instead of fixing the source error.
-async function write_sync_status(site_dir, status) {
+// Write the most recent push outcome to a file the MCP build_preview and
+// get_dev_status tools read, so the agent learns when its file changes failed
+// to land in the CMS and exactly which fields were dropped. Without this,
+// build_preview compiles whatever stale DB state existed before the failed
+// push and reports ok:true, leaving the agent to chase phantom rendering bugs
+// instead of fixing the source error.
+async function write_sync_status(site_dir, status, location = {}) {
     const status_dir = path.join(site_dir, '.primo');
     try {
         await fs.mkdir(status_dir, { recursive: true });
-        await fs.writeFile(path.join(status_dir, 'sync_status.json'), JSON.stringify(status, null, 2));
+        // last_import_at stamps every write so a reader can tell a fresh status
+        // from a stale one; port/url tell the agent where the server is.
+        const payload = {
+            ...status,
+            ...(location.port !== undefined ? { port: location.port } : {}),
+            ...(location.url !== undefined ? { url: location.url } : {}),
+            last_import_at: new Date().toISOString()
+        };
+        // Write atomically: a plain fs.writeFile truncates-then-writes, so the
+        // MCP get_dev_status reader can catch a half-written file and briefly
+        // report "not running" mid-write. Write to a temp file in the same dir
+        // (same filesystem → rename is atomic on POSIX) and rename over the
+        // target, so readers always see a complete old or new file.
+        const target = path.join(status_dir, 'sync_status.json');
+        const tmp = path.join(status_dir, `sync_status.${process.pid}.${randomInt(1e9)}.tmp`);
+        try {
+            await fs.writeFile(tmp, JSON.stringify(payload, null, 2));
+            await fs.rename(tmp, target);
+        }
+        catch (err) {
+            await fs.unlink(tmp).catch(() => { });
+            throw err;
+        }
     }
     catch {
         // Status reporting must not break the push.
     }
 }
+// Persist a successful import's outcome to sync_status.json — with the full
+// per-field warning details when content was dropped, so an agent can read
+// exactly what was lost without re-running dev. Shared by the boot loop and
+// the file watcher so both readers of the file see the same shape.
+async function write_import_sync_status(site_dir, import_timings, location) {
+    // The bootstrap+import fallback can return timings even when nothing
+    // imported (both attempts failed and were only logged). Never record a
+    // phantom success for that — write ok:false so the agent doesn't build a
+    // preview from unchanged CMS state.
+    if (!import_timings.ok) {
+        await write_sync_status(site_dir, {
+            ok: false,
+            error: 'Import failed — see the primo dev logs for details.',
+            failed_at: new Date().toISOString()
+        }, location);
+        return;
+    }
+    if (import_timings.warning_count > 0) {
+        await write_sync_status(site_dir, {
+            ok: true,
+            warnings: import_timings.warning_count,
+            warned_at: new Date().toISOString(),
+            warning_details: import_timings.warning_details
+        }, location);
+    }
+    else {
+        await write_sync_status(site_dir, { ok: true }, location);
+    }
+}
 async function prune_old_trash(workspace_dir) {
     const trash_dir = path.join(workspace_dir, '.primo', 'trash');
     try {
@@ -601,6 +659,9 @@ export async function dev_server(options) {
             process.exit(1);
         }
         const api_url = `http://127.0.0.1:${port}`;
+        // Stamped into every sync_status.json write so an agent reading the
+        // file also learns where the running server is.
+        const dev_location = { port, url: api_url };
         if (is_server_mode) {
             spinner.text = sync_policy.mode === 'cms' ? 'Pulling shared library...' : 'Loading shared library...';
             is_importing_library = true;
@@ -618,6 +679,8 @@ export async function dev_server(options) {
         }
         // Normalize and load all sites
         spinner.text = `Loading ${sites.length} site${sites.length > 1 ? 's' : ''}...`;
+        const blocked_sites = new Set();
+        let dropped_field_count = 0;
         for (const site of sites) {
             const use_bootstrap = !await site_exists(api_url, site.config.site_id);
             if (sync_policy.mode === 'cms' && !use_bootstrap) {
@@ -625,7 +688,31 @@ export async function dev_server(options) {
                 continue;
             }
             await normalize_site(site.dir);
+            const site_key = get_site_sync_key(site.dir, site.config);
             const import_timings = await with_site_import_lock(site.dir, site.config, () => import_site_files(site.dir, api_url, site.config, port, server_config, use_bootstrap, base_dir));
+            if (import_timings === null) {
+                // Duplicate _ids — nothing was pushed; the watcher retries
+                // once the user removes a conflicting file. Quarantine it so
+                // CMS→file polling doesn't sync into an out-of-sync site.
+                blocked_sites.add(site.dir);
+                blocked_site_keys.add(site_key);
+                continue;
+            }
+            // Write sync_status.json on boot too — otherwise an agent reading
+            // right after `primo dev` starts sees stale/absent state, and any
+            // dropped fields from the initial import stay invisible until the
+            // next file save. Writes ok:false when the import didn't land.
+            await write_import_sync_status(site.dir, import_timings, dev_location);
+            if (!import_timings.ok) {
+                // Bootstrap and its regular-import fallback both failed (only
+                // logged, not thrown). Keep the site quarantined and skip the
+                // baseline/success path so we don't record a phantom import.
+                blocked_sites.add(site.dir);
+                blocked_site_keys.add(site_key);
+                continue;
+            }
+            blocked_site_keys.delete(site_key);
+            dropped_field_count += import_timings.dropped_field_count;
             if (update_site_sync_state_after_import(site, import_timings, sync_policy)) {
                 await update_site_sync_baseline(site, api_url, server_config, base_dir);
             }
@@ -633,9 +720,20 @@ export async function dev_server(options) {
         // Verify all sites are accessible before proceeding
         spinner.text = 'Verifying sites...';
         for (const site of sites) {
+            if (blocked_sites.has(site.dir))
+                continue;
             await verify_site_ready(api_url, site.config.site_id);
         }
         spinner.succeed('Primo running');
+        // Restate any dropped-field warnings next to the banner. The per-field
+        // detail already printed above during import, but on a multi-site or
+        // long boot it scrolls out of view and the green banner reads as
+        // "all good" — so surface the aggregate here as the last thing on
+        // screen. See print_import_warnings for the full per-field output.
+        if (dropped_field_count > 0) {
+            console.log('');
+            console.log(chalk.yellow(`  ⚠ ${dropped_field_count} field${dropped_field_count === 1 ? '' : 's'} dropped — content not imported (see warnings above)`));
+        }
         console.log('');
         if (mcp_registration_path) {
             console.log(`  ${chalk.dim(`MCP server registered at ${mcp_registration_path} - agents in this directory can now use the Primo MCP server.`)}`);
@@ -815,7 +913,27 @@ export async function dev_server(options) {
                                 // Conflict detection must not block the local push.
                             }
                         }
-                        const import_timings = await with_site_import_lock(site.dir, site.config, () => import_site_files(site.dir, api_url, site.config, port, server_config, false, base_dir));
+                        // Steady-state pushes go through the additive import
+                        // endpoint (use_bootstrap=false). But a site whose initial
+                        // bootstrap+fallback both failed is quarantined and was
+                        // never created on the server — retrying import against a
+                        // nonexistent site would fail forever. For those, re-check
+                        // existence so the retry can bootstrap out of quarantine.
+                        // Healthy sites are never quarantined, so they skip the
+                        // extra request and keep the fast path.
+                        const retry_needs_bootstrap = blocked_site_keys.has(get_site_sync_key(site.dir, site.config))
+                            ? !await site_exists(api_url, site.config.site_id)
+                            : false;
+                        const import_timings = await with_site_import_lock(site.dir, site.config, () => import_site_files(site.dir, api_url, site.config, port, server_config, retry_needs_bootstrap, base_dir));
+                        if (import_timings === null) {
+                            // Duplicate _ids — import_site_files already printed the
+                            // error and wrote sync_status; nothing was pushed. Keep
+                            // the site quarantined from CMS→file polling.
+                            blocked_site_keys.add(get_site_sync_key(site.dir, site.config));
+                            return;
+                        }
+                        // Import succeeded — lift any prior quarantine.
+                        blocked_site_keys.delete(get_site_sync_key(site.dir, site.config));
                         let reload_ms = 0;
                         if (pending_reload) {
                             try {
@@ -841,16 +959,7 @@ export async function dev_server(options) {
                         }
                         console.log(chalk.dim(`  ${site.config.name}: normalize ${normalize_ms}ms, zip ${import_timings.zip_ms}ms, ${import_timings.mode} ${import_timings.request_ms}ms${reload_ms ? `, reload ${reload_ms}ms` : ''}`));
                         console.log(chalk.green(`  ✓ ${site.config.name} pushed`));
-                        if (import_timings.warning_count > 0) {
-                            await write_sync_status(site.dir, {
-                                ok: true,
-                                warnings: import_timings.warning_count,
-                                warned_at: new Date().toISOString()
-                            });
-                        }
-                        else {
-                            await write_sync_status(site.dir, { ok: true });
-                        }
+                        await write_import_sync_status(site.dir, import_timings, dev_location);
                     }
                     catch (err) {
                         const message = err instanceof Error ? err.message : String(err);
@@ -859,7 +968,7 @@ export async function dev_server(options) {
                             ok: false,
                             error: message,
                             failed_at: new Date().toISOString()
-                        });
+                        }, dev_location);
                     }
                     finally {
                         is_importing = false;
@@ -962,30 +1071,65 @@ export async function dev_server(options) {
                     return;
                 }
                 const new_sites = await discover_sites(base_dir);
+                let loaded_count = 0;
+                const quarantined = [];
                 for (const site of new_sites) {
                     if (known_sites.has(site.dir))
                         continue;
                     known_sites.add(site.dir);
                     sites.push(site);
                     const use_bootstrap = !await site_exists(api_url, site.config.site_id);
+                    let import_ok = true;
                     if (sync_policy.mode === 'cms' && !use_bootstrap) {
                         await sync_from_cms(site.dir, api_url, site.config, server_config, base_dir, sync_policy);
                     }
                     else {
                         await normalize_site(site.dir);
                         const import_timings = await with_site_import_lock(site.dir, site.config, () => import_site_files(site.dir, api_url, site.config, port, server_config, use_bootstrap, base_dir));
-                        if (update_site_sync_state_after_import(site, import_timings, sync_policy)) {
-                            await update_site_sync_baseline(site, api_url, server_config, base_dir);
+                        if (import_timings === null) {
+                            // Duplicate _ids on a freshly discovered site — quarantine
+                            // it from CMS→file polling until a later import succeeds.
+                            blocked_site_keys.add(get_site_sync_key(site.dir, site.config));
+                            quarantined.push(site.config.name);
+                            import_ok = false;
+                        }
+                        else {
+                            await write_import_sync_status(site.dir, import_timings, dev_location);
+                            if (!import_timings.ok) {
+                                // Bootstrap + fallback both failed (only logged). Quarantine
+                                // and skip the success path so we don't announce a site that
+                                // didn't actually load — and so `primo new` sees it in the
+                                // /reload body's `quarantined` list.
+                                blocked_site_keys.add(get_site_sync_key(site.dir, site.config));
+                                quarantined.push(site.config.name);
+                                import_ok = false;
+                            }
+                            else if (update_site_sync_state_after_import(site, import_timings, sync_policy)) {
+                                await update_site_sync_baseline(site, api_url, server_config, base_dir);
+                            }
                         }
                     }
                     setup_site_watchers(site);
+                    loaded_count++;
+                    if (!import_ok) {
+                        console.log(chalk.yellow(`  ⚠ ${site.config.name}: import failed — see logs; will retry on the next file change.`));
+                        continue;
+                    }
                     const host = local_dev_host(site.config.name || path.basename(site.dir), port);
                     console.log(chalk.green(`  ✓ New site loaded: ${site.config.name}`));
                     console.log(`    ${chalk.dim('Edit:')}    http://${host}/admin/site`);
                     console.log(`    ${chalk.dim('Preview:')} http://${host}/`);
                 }
-                res.writeHead(200);
-                res.end('ok');
+                // Report the outcome so `primo new` can tell whether the site it
+                // just scaffolded actually imported. A quarantined site (duplicate
+                // _ids) returns 200 with loaded:false so a 2xx no longer implies
+                // success — the caller checks the body, not just the status.
+                const body = JSON.stringify({
+                    loaded: loaded_count,
+                    quarantined
+                });
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(body);
             });
             reload_server.on('error', (err) => {
                 if (err.code === 'EADDRINUSE') {
@@ -1013,7 +1157,9 @@ export async function dev_server(options) {
                     for (const site of sites) {
                         try {
                             const site_key = get_site_sync_key(site.dir, site.config);
-                            if (importing_site_keys.has(site_key) || pending_local_site_keys.has(site_key)) {
+                            if (importing_site_keys.has(site_key) ||
+                                pending_local_site_keys.has(site_key) ||
+                                blocked_site_keys.has(site_key)) {
                                 continue;
                             }
                             await sync_from_cms(site.dir, api_url, site.config, server_config, base_dir, sync_policy);
@@ -1678,19 +1824,19 @@ function describe_duplicate(category, id, occurrences) {
     const files = [...new Set(occurrences.map((occurrence) => occurrence.file))].sort();
     switch (category) {
         case 'pages':
-            return `duplicate page _id "${id}" in ${files.join(' and ')}; skipping those pages`;
+            return `duplicate page _id "${id}" in ${files.join(' and ')}`;
         case 'page_sections':
-            return `duplicate section _id "${id}" in ${files.join(' and ')}; skipping those pages`;
+            return `duplicate section _id "${id}" in ${files.join(' and ')}`;
         case 'blocks':
-            return `duplicate block _id "${id}" in ${files.join(' and ')}; skipping those blocks`;
+            return `duplicate block _id "${id}" in ${files.join(' and ')}`;
         case 'page_types':
-            return `duplicate page type _id "${id}" in ${files.join(' and ')}; skipping those page types`;
+            return `duplicate page type _id "${id}" in ${files.join(' and ')}`;
         case 'site_fields':
-            return `duplicate site field _id "${id}" in ${files.join(' and ')}; skipping site/fields.yaml`;
+            return `duplicate site field _id "${id}" in ${files.join(' and ')}`;
         case 'block_fields':
-            return `duplicate block field _id "${id}" in ${files.join(' and ')}; skipping those blocks`;
+            return `duplicate block field _id "${id}" in ${files.join(' and ')}`;
         case 'page_type_fields':
-            return `duplicate page type field _id "${id}" in ${files.join(' and ')}; skipping those page types`;
+            return `duplicate page type field _id "${id}" in ${files.join(' and ')}`;
     }
 }
 async function prepare_site_for_local_dev(site_dir) {
@@ -1833,6 +1979,37 @@ async function prepare_site_for_local_dev(site_dir) {
         warnings
     };
 }
+// Warning kinds where page content was matched to no field and therefore
+// dropped from the render model. Counted separately from other import
+// warnings (unknown blocks, orphan uploads, duplicate ids) so the
+// end-of-boot summary can report "N fields dropped" accurately.
+const DROPPED_FIELD_KINDS = new Set(['orphaned_field', 'orphaned_page_field']);
+// Number of dropped-field warnings in an import response. Safe on any input
+// shape (returns 0 for non-arrays / missing warnings).
+function count_dropped_fields(warnings) {
+    if (!Array.isArray(warnings))
+        return 0;
+    return warnings.filter(w => DROPPED_FIELD_KINDS.has(w.kind)).length;
+}
+// Coerce a raw import-response `warnings` value into a clean ImportWarning[]
+// for persistence in sync_status.json. Defensive against partial/unknown
+// server shapes: drops non-object entries and fills missing string fields so
+// the agent-facing file always has a predictable schema. Returns [] for
+// non-arrays / missing warnings.
+function normalize_warning_details(warnings) {
+    if (!Array.isArray(warnings))
+        return [];
+    return warnings
+        .filter((w) => typeof w === 'object' && w !== null)
+        .map(w => ({
+        kind: typeof w.kind === 'string' ? w.kind : '',
+        file: typeof w.file === 'string' ? w.file : '',
+        path: typeof w.path === 'string' ? w.path : '',
+        field: typeof w.field === 'string' ? w.field : '',
+        block: typeof w.block === 'string' ? w.block : '',
+        message: typeof w.message === 'string' ? w.message : ''
+    }));
+}
 // Loudly surface non-fatal import problems (e.g. orphaned fields whose
 // content would otherwise be silently dropped). Printed in yellow with the
 // full details so agents and humans both see exactly what was lost and where.
@@ -1854,8 +2031,31 @@ async function import_site_files(site_dir, api_url, config, port, server_config,
     const site_id = config.site_id;
     const site_group = resolve_site_group(config, server_config);
     const preparation = await prepare_site_for_local_dev(site_dir);
-    for (const warning of preparation.warnings) {
-        console.log(chalk.yellow(`  ⚠ ${config.name}: ${warning}`));
+    if (preparation.warnings.length > 0) {
+        // Duplicate _ids (the only warning source in prepare_site_for_local_dev)
+        // would leave the server with stale/dangling state if we pushed anyway,
+        // so fail loudly instead of silently excluding the conflicting files.
+        for (const warning of preparation.warnings) {
+            console.log(chalk.red(`  ✖ ${config.name}: ${warning}`));
+        }
+        console.log(chalk.dim('    Remove one of the conflicting files and save to retry.'));
+        const message = preparation.warnings[0];
+        await write_sync_status(site_dir, {
+            ok: false,
+            error: message,
+            failed_at: new Date().toISOString()
+        }, { port, url: api_url });
+        try {
+            // Best-effort — older servers don't have this endpoint.
+            await fetch(`${api_url}/api/primo/dev/status`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ status: 'error', message }),
+                signal: AbortSignal.timeout(2000)
+            });
+        }
+        catch { }
+        return null;
     }
     // Create ZIP of site files
     const zip_started = Date.now();
@@ -1881,12 +2081,16 @@ async function import_site_files(site_dir, api_url, config, port, server_config,
         }
         // Write created IDs back to files
         let warning_count = 0;
+        let dropped_field_count = 0;
+        let warning_details = [];
         try {
             const result = await import_response.json();
             if (result.created_ids) {
                 await write_created_ids(site_dir, result.created_ids, server_config, workspace_dir);
             }
             warning_count = print_import_warnings(config.name, result.warnings);
+            dropped_field_count = count_dropped_fields(result.warnings);
+            warning_details = normalize_warning_details(result.warnings);
         }
         catch {
             // ignore JSON parse errors
@@ -1895,7 +2099,10 @@ async function import_site_files(site_dir, api_url, config, port, server_config,
             zip_ms,
             request_ms,
             mode: 'import',
-            warning_count
+            ok: true,
+            warning_count,
+            dropped_field_count,
+            warning_details
         };
     }
     // Retry bootstrap up to 3 times (collections may not be ready immediately)
@@ -1918,6 +2125,8 @@ async function import_site_files(site_dir, api_url, config, port, server_config,
             }, 300000); // 300s timeout for imports
             const bootstrap_ms = Date.now() - bootstrap_started;
             let warning_count = 0;
+            let dropped_field_count = 0;
+            let warning_details = [];
             if (bootstrap_response.ok) {
                 try {
                     const result = await bootstrap_response.json();
@@ -1930,6 +2139,8 @@ async function import_site_files(site_dir, api_url, config, port, server_config,
                         await write_created_ids(site_dir, result.created_ids, server_config, workspace_dir);
                     }
                     warning_count = print_import_warnings(config.name, result.warnings);
+                    dropped_field_count = count_dropped_fields(result.warnings);
+                    warning_details = normalize_warning_details(result.warnings);
                 }
                 catch {
                     // ignore JSON parse errors
@@ -1938,7 +2149,10 @@ async function import_site_files(site_dir, api_url, config, port, server_config,
                     zip_ms,
                     request_ms: bootstrap_ms,
                     mode: 'bootstrap',
-                    warning_count
+                    ok: true,
+                    warning_count,
+                    dropped_field_count,
+                    warning_details
                 };
             }
             const error_text = await bootstrap_response.text();
@@ -1969,6 +2183,8 @@ async function import_site_files(site_dir, api_url, config, port, server_config,
                         await write_created_ids(site_dir, result.created_ids, server_config, workspace_dir);
                     }
                     warning_count = print_import_warnings(config.name, result.warnings);
+                    dropped_field_count = count_dropped_fields(result.warnings);
+                    warning_details = normalize_warning_details(result.warnings);
                 }
                 catch {
                     // ignore JSON parse errors
@@ -1978,7 +2194,14 @@ async function import_site_files(site_dir, api_url, config, port, server_config,
                 zip_ms,
                 request_ms: bootstrap_ms + import_ms,
                 mode: 'bootstrap+import',
-                warning_count
+                // Bootstrap failed and we fell back to a regular import; ok
+                // reflects whether that fallback actually landed. When both
+                // failed we still return timings (only logged above), so this
+                // guards against recording a phantom success.
+                ok: import_response.ok,
+                warning_count,
+                dropped_field_count,
+                warning_details
             };
         }
         catch (err) {

package/dist/commands/new.js

@@ -50,16 +50,20 @@ export async function new_site(options) {
                 name: 'name',
                 message: 'Site name:',
                 default: 'my-site',
-                validate: (input) => {
-                    if (!input.trim())
-                        return 'Name is required';
-                    if (!/^[a-z0-9.-]+$/i.test(input))
-                        return 'Use only letters, numbers, dots, and hyphens';
-                    return true;
-                }
+                validate: validate_site_name
             }]);
         site_name = name;
     }
+    else {
+        // A name passed as a CLI arg skips the prompt — validate it too, or a
+        // name like `.foo` slips through: it makes a hidden sites/.foo dir that
+        // discover_sites ignores, and an empty display_name downstream.
+        const error = validate_site_name(site_name);
+        if (error !== true) {
+            console.log(chalk.red(error));
+            process.exit(1);
+        }
+    }
     // Always create site in sites/<name>
     const site_dir = path.join(sites_dir, site_name);
     // Check if directory exists
@@ -250,20 +254,67 @@ sections:
             await fs.writeFile(workspace_agents_path, generate_agent_md());
         }
         spinner.succeed(`Site created: ${chalk.cyan(site_dir)}`);
-        // Check if server is already running
-        const port = 3000;
+        // Check if server is already running. Read the workspace's configured
+        // port (mirroring `primo dev`, which uses server_config.port) rather than
+        // assuming 3000 — otherwise on a custom-port workspace we'd probe the
+        // wrong port, miss the running server, and print links to a dead port.
+        const port = server_config.port ?? 3000;
         const server_running = await is_server_running(port);
         if (server_running) {
-            // Tell the server to reload and pick up the new site
+            // A `primo dev` is already running. Ask it to reload and pick up the
+            // new site. The dev server prints its own "New site loaded" + links,
+            // but in *its* terminal — so print the same links here too, otherwise
+            // this terminal looks like nothing happened.
+            // Host is derived from the display name (what becomes config.name),
+            // matching how dev_server builds the host — not the raw folder name.
+            const host = local_dev_host(display_name, port);
+            let outcome = 'unreachable';
             try {
-                await fetch(`http://127.0.0.1:${port + 1}/reload`, { method: 'POST' });
+                // Bound the request: the reload handler runs discovery + import
+                // synchronously before responding, so an unbounded fetch could
+                // hang here forever and never reach the warning below.
+                const controller = new AbortController();
+                const timeout = setTimeout(() => controller.abort(), 30000);
+                let res;
+                try {
+                    res = await fetch(`http://127.0.0.1:${port + 1}/reload`, {
+                        method: 'POST',
+                        signal: controller.signal
+                    });
+                }
+                finally {
+                    clearTimeout(timeout);
+                }
+                if (res.ok) {
+                    // A 2xx no longer implies the site imported — the handler
+                    // returns { quarantined: [...] } for sites it couldn't load
+                    // (duplicate _ids). Parse the body to tell the difference.
+                    const result = await res.json().catch(() => null);
+                    outcome = result?.quarantined?.includes(display_name)
+                        ? 'quarantined'
+                        : 'reloaded';
+                }
             }
             catch {
-                // Reload server might not be running (older version)
+                // Reload server not running (older `primo dev`, hot reload disabled
+                // because the port was in use) or the request timed out. Site files
+                // are on disk; restarting `primo dev` will pick them up.
             }
             console.log('');
-            console.log(chalk.dim(`  http://${site_name}.localhost:${port}/`));
+            console.log(`  ${chalk.cyan(display_name)}`);
+            console.log(`    ${chalk.dim('Edit:')}    http://${host}/admin/site`);
+            console.log(`    ${chalk.dim('Preview:')} http://${host}/`);
             console.log('');
+            if (outcome === 'quarantined') {
+                console.log(chalk.yellow('  Site created, but the dev server couldn\'t import it (duplicate IDs).'));
+                console.log(chalk.dim('  Check the `primo dev` logs and fix the conflict.'));
+                console.log('');
+            }
+            else if (outcome === 'unreachable') {
+                console.log(chalk.yellow('  Couldn\'t reach the running dev server to reload it.'));
+                console.log(chalk.dim('  Restart `primo dev` to pick up the new site.'));
+                console.log('');
+            }
         }
         else if (!options.skipDev) {
             // No server running, start one
@@ -282,6 +333,26 @@ sections:
         process.exit(1);
     }
 }
+// Shared name validation for both the interactive prompt and the CLI arg.
+// Returns `true` when valid, or an error string (inquirer's contract).
+// Leading dots/hyphens are rejected: a leading dot makes a hidden sites/.<name>
+// directory that discover_sites skips, and strips display_name to empty.
+function validate_site_name(input) {
+    if (!input.trim())
+        return 'Name is required';
+    if (!/^[a-z0-9.-]+$/i.test(input))
+        return 'Use only letters, numbers, dots, and hyphens';
+    if (/^[.-]/.test(input))
+        return 'Name can\'t start with a dot or hyphen';
+    return true;
+}
+// Mirror of dev.ts's local_dev_host: slug the display name into a
+// `<slug>.localhost:<port>` host so the links printed here match the ones
+// `primo dev` prints for the same site.
+function local_dev_host(name, port) {
+    const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '') || 'site';
+    return `${slug}.localhost:${port}`;
+}
 function generate_id() {
     const chars = 'abcdefghijklmnopqrstuvwxyz0123456789';
     let id = '';

package/dist/commands/pull.js

@@ -8,6 +8,10 @@ import { get_auth_token } from '../utils/auth.js';
 import { authenticate_interactively } from './login.js';
 import { write_site_config } from '../utils/site-config.js';
 import { read_server_config, write_server_config, normalize_server_url } from '../utils/server-config.js';
+// Directories owned by the server export. Local files under these that no
+// longer exist in the export are stale (e.g. a page that gained children
+// moved from pages/foo.yaml to pages/foo/index.yaml) and get trashed.
+const MANAGED_DIRS = ['pages', 'blocks', 'page-types', 'site'];
 async function detect_server() {
     const ports = [3000, 8080, 5173];
     for (const port of ports) {
@@ -209,8 +213,27 @@ async function pull_one_site(server, headers, site, site_dir, spinner) {
     const temp_zip = path.join(site_dir, '.primo-export.zip');
     await fs.writeFile(temp_zip, Buffer.from(zip_data));
     spinner.text = `Extracting ${site.name}...`;
-    await extract(temp_zip, { dir: site_dir });
-    await fs.unlink(temp_zip);
+    const temp_dir = path.join(site_dir, '.primo', `pull-temp-${Date.now()}`);
+    let trashed = [];
+    try {
+        await fs.mkdir(temp_dir, { recursive: true });
+        await extract(temp_zip, { dir: temp_dir });
+        await fs.unlink(temp_zip);
+        trashed = await reconcile_managed_dirs(site_dir, temp_dir);
+        await fs.cp(temp_dir, site_dir, { recursive: true });
+    }
+    finally {
+        await fs.rm(temp_dir, { recursive: true, force: true });
+        // Also drop the archive: on a successful pull it was already unlinked
+        // above, but if extract() threw it's still sitting in site_dir.
+        await fs.rm(temp_zip, { force: true });
+    }
+    if (trashed.length > 0) {
+        console.log(chalk.dim('  Removed stale files (moved to .primo/trash):'));
+        for (const trashed_path of trashed) {
+            console.log(chalk.dim(`    ${trashed_path}`));
+        }
+    }
     await write_site_config(site_dir, {
         name: site.name || 'Imported Site',
         site_id: site.id,
@@ -220,6 +243,92 @@ async function pull_one_site(server, headers, site, site_dir, spinner) {
     await copy_schemas(site_dir);
     await add_schema_references(site_dir);
 }
+// Move local files under MANAGED_DIRS that have no counterpart in the fresh
+// export into .primo/trash/pull-<ts>/, then remove newly-empty directories
+// (best-effort). Returns the trashed paths relative to the site dir.
+async function reconcile_managed_dirs(site_dir, temp_dir) {
+    const trashed = [];
+    const stamp = Date.now();
+    for (const dir of MANAGED_DIRS) {
+        const local_root = path.join(site_dir, dir);
+        const temp_root = path.join(temp_dir, dir);
+        for (const relative of await list_files_recursive(local_root)) {
+            // Keep the local file only if the export still has a *file* at the
+            // same path. If the counterpart is now a directory (a file→dir
+            // transition, e.g. pages/foo.yaml became pages/foo/…), the local
+            // file is stale and must be trashed — otherwise the later fs.cp
+            // can't lay a directory over the surviving file and the pull fails.
+            try {
+                const counterpart = await fs.stat(path.join(temp_root, relative));
+                if (counterpart.isFile())
+                    continue;
+            }
+            catch {
+                // Missing from the export — stale.
+            }
+            const local_path = path.join(local_root, relative);
+            // Scope the trash path by the managed dir. Two managed dirs can hold
+            // the same relative name (pages/config.yaml, blocks/config.yaml);
+            // without the dir segment they'd collide at trash/pull-<ts>/config.yaml
+            // and the second move would clobber the first while both are reported.
+            const trash_path = path.join(site_dir, '.primo', 'trash', `pull-${stamp}`, dir, relative);
+            await fs.mkdir(path.dirname(trash_path), { recursive: true });
+            try {
+                await fs.rename(local_path, trash_path);
+            }
+            catch {
+                // Cross-device move — fall back to copy + delete.
+                await fs.copyFile(local_path, trash_path);
+                await fs.unlink(local_path);
+            }
+            trashed.push(`${dir}/${relative}`);
+        }
+        await remove_empty_dirs(local_root);
+    }
+    return trashed;
+}
+async function list_files_recursive(root, prefix = '') {
+    let entries;
+    try {
+        entries = await fs.readdir(root, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const files = [];
+    for (const entry of entries) {
+        if (entry.name.startsWith('.'))
+            continue;
+        const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+        if (entry.isDirectory()) {
+            files.push(...await list_files_recursive(path.join(root, entry.name), relative));
+        }
+        else if (entry.isFile()) {
+            files.push(relative);
+        }
+    }
+    return files;
+}
+// Remove empty directories bottom-up. rmdir on a non-empty dir fails, which
+// we ignore — only newly-emptied dirs go away.
+async function remove_empty_dirs(root) {
+    let entries;
+    try {
+        entries = await fs.readdir(root, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (entry.isDirectory()) {
+            await remove_empty_dirs(path.join(root, entry.name));
+        }
+    }
+    try {
+        await fs.rmdir(root);
+    }
+    catch { }
+}
 async function pull_library_into(server, headers, root_dir, spinner) {
     spinner.start('Pulling library...');
     const response = await fetch(`${server}/api/primo/export-library`, { headers });

package/dist/commands/push.js

@@ -333,14 +333,12 @@ async function try_bootstrap_site(server, token, zip_buffer, config, site_id, gr
         form.append('group', config.group);
     if (group_name)
         form.append('group_name', group_name);
-    // Register the site against the deploy URL's host so the first visit to
-    // that domain finds a matching site instead of dropping into CreateSite.
-    try {
-        form.append('host', new URL(server).host);
-    }
-    catch {
-        // Malformed server URL — let the server fall back to its own default.
-    }
+    // Host is intentionally not sent. A pushed site is created unassigned —
+    // the server seeds `host` with a placeholder (the site's own id) so the
+    // site is editable in the dashboard but not publicly served until an
+    // operator assigns a real domain. The lone exception is bootstrap of the
+    // very first site on a fresh instance, where the server falls back to the
+    // deploy URL's host so that instance's front door resolves immediately.
     form.append('file', new Blob([zip_buffer]), 'site.zip');
     const headers = {};
     if (token)

package/dist/utils/binary.js

@@ -9,7 +9,64 @@ import ora from 'ora';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const PRIMO_HOME = path.join(os.homedir(), '.primo');
 const BIN_DIR = path.join(PRIMO_HOME, 'bin');
-const VERSION = '3.2.3'; // matches primo releases
+const REPO = 'primocms/primo';
+// Resolve the latest primo release tag at runtime rather than pinning a version
+// here — a pinned constant silently goes stale (it sat on 3.2.3 through two
+// releases). Cached for the process so repeated calls in one CLI run don't
+// re-hit the API. Bounded by a 10s timeout so an already-installed binary can
+// still be reused promptly when GitHub is slow or unreachable.
+let latest_version_cache;
+async function get_latest_version() {
+    if (latest_version_cache !== undefined)
+        return latest_version_cache;
+    try {
+        const res = await fetch(`https://api.github.com/repos/${REPO}/releases/latest`, {
+            headers: { Accept: 'application/vnd.github+json' },
+            // Node 18+ ships AbortSignal.timeout; keeps the version check from
+            // hanging CLI startup when GitHub stalls.
+            signal: AbortSignal.timeout(10_000)
+        });
+        // Rate limits come back as 403 or 429. Detect them the way GitHub's docs
+        // prescribe, since no single signal covers every case:
+        //   - primary limit: 403 with x-ratelimit-remaining: 0
+        //   - secondary limit: 403/429 with a Retry-After header, or a body
+        //     message mentioning a secondary rate limit (remaining may be > 0)
+        //   - 429 is always a rate limit
+        // Treat all of these as "can't tell", never a definitive version —
+        // otherwise a throttled run would mask an outdated binary as current. A
+        // plain 403 with quota remaining (e.g. a genuine permission error) is a
+        // real "unavailable" verdict, not a throttle.
+        if (res.status === 403 || res.status === 429) {
+            const remaining = res.headers.get('x-ratelimit-remaining');
+            const retry_after = res.headers.get('retry-after');
+            let rate_limited = res.status === 429 || remaining === '0' || retry_after !== null;
+            if (!rate_limited) {
+                // Last resort: peek at the body for the secondary-limit message.
+                const body = await res.text().catch(() => '');
+                rate_limited = /secondary rate limit|rate limit/i.test(body);
+            }
+            latest_version_cache = rate_limited
+                ? { status: 'throttled', reason: `GitHub rate limit (${res.status})` }
+                : { status: 'unavailable' };
+            return latest_version_cache;
+        }
+        if (!res.ok)
+            throw new Error(`GitHub API ${res.status}`);
+        const data = (await res.json());
+        const version = parse_semver(data.tag_name ?? null);
+        latest_version_cache = version ? { status: 'resolved', version } : { status: 'unavailable' };
+    }
+    catch (err) {
+        // Timeout / DNS / connection reset — indistinguishable from being
+        // offline. Treat as throttled (can't confirm) so we don't force a
+        // needless re-download of a working binary.
+        latest_version_cache = {
+            status: 'throttled',
+            reason: err instanceof Error ? err.message : 'network error'
+        };
+    }
+    return latest_version_cache;
+}
 // Path to locally built binary (for development)
 // The binary is at primo/primo (inside the primo repo directory)
 const LOCAL_BINARY = path.resolve(__dirname, '..', '..', '..', 'primo', 'primo');
@@ -46,9 +103,12 @@ function get_platform() {
     return { os: osName, arch: archName, ext };
 }
 function get_download_url(platform) {
-    const base = 'https://github.com/primocms/primo/releases/download';
+    // /releases/latest/download/<asset> 302-redirects to the newest release's
+    // asset, so we never name a version here — the binary always tracks the
+    // latest published release. fetch() follows the redirect automatically.
+    const base = `https://github.com/${REPO}/releases/latest/download`;
     const filename = `primo_${platform.os}_${platform.arch}${platform.ext}`;
-    return `${base}/v${VERSION}/${filename}`;
+    return `${base}/${filename}`;
 }
 // Extract a bare semver (e.g. "3.2.1") from a binary's --version output.
 // The server prints a build banner first, then "<name> version vX.Y.Z", so we
@@ -113,8 +173,8 @@ export async function ensure_binary() {
         return LOCAL_BINARY;
     }
     catch { }
-    // A managed binary already on disk is reused only when it matches the pinned
-    // version. A stale binary (older release, or a pre-rename "palacms" build
+    // A managed binary already on disk is reused only when it matches the latest
+    // release. A stale binary (older release, or a pre-rename "palacms" build
     // reporting a different version) is re-downloaded so fixes actually reach
     // users who already have a binary installed.
     let updating_from = null;
@@ -127,8 +187,17 @@ export async function ensure_binary() {
     // Need to download - get the target path
     const platform = get_platform();
     const binary_path = path.join(BIN_DIR, `primo${platform.ext}`);
+    // Resolve the target version for display only (the download URL follows the
+    // /latest redirect regardless). Falls back to "latest" when we couldn't
+    // confirm the tag; surface a throttle notice so a rate-limited check isn't
+    // silent.
+    const lookup = await get_latest_version();
+    const target_version = lookup.status === 'resolved' ? lookup.version : 'latest';
+    if (lookup.status === 'throttled') {
+        console.log(chalk.dim(`  (couldn't confirm latest version: ${lookup.reason}; downloading current release)`));
+    }
     const spinner = ora(updating_from
-        ? `Updating primo ${updating_from} → ${VERSION}...`
+        ? `Updating primo ${updating_from} → ${target_version}...`
         : 'Setting up Primo...').start();
     try {
         // Create directories
@@ -148,7 +217,7 @@ export async function ensure_binary() {
         // Make executable, then atomically replace any existing binary.
         await fs.chmod(tmp_path, 0o755);
         await fs.rename(tmp_path, binary_path);
-        spinner.succeed(updating_from ? `Primo updated to ${VERSION}` : 'Primo setup complete');
+        spinner.succeed(updating_from ? `Primo updated to ${target_version}` : 'Primo setup complete');
         return binary_path;
     }
     catch (error) {
@@ -184,5 +253,15 @@ export async function get_binary_version() {
 // developer-chosen and must not be clobbered by a download.
 async function is_binary_current() {
     const installed = await get_binary_version();
-    return installed === VERSION;
+    if (!installed)
+        return false;
+    const latest = await get_latest_version();
+    // resolved  → compare versions.
+    // throttled → can't confirm (rate-limited / offline); keep the installed
+    //             binary rather than thrashing a re-download, and it'll refresh
+    //             on the next unthrottled run.
+    // unavailable → no usable release to compare against; keep what's on disk.
+    if (latest.status !== 'resolved')
+        return true;
+    return installed === latest.version;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primo-cli",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "Local development CLI for Primo",
   "type": "module",
   "bin": {