spinuptui 0.22.2 → 0.24.0

package/CHANGELOG.md

@@ -11,6 +11,60 @@ versions; such changes are called out here.
 
 ## [Unreleased]
 
+## [0.24.0] - 2026-07-15
+
+### Added
+- **`p` (Pull prod. DB) is now discoverable even when `localSync` is off.**
+  Previously the Site Control legend hid the entry entirely until `localSync`
+  was enabled in config — the only one of `p`'s three preconditions
+  (WordPress, linked copy, localSync) that hid the entry instead of flashing
+  a message on press. Now `p` always shows for WordPress sites; pressing it
+  with `localSync` off opens an in-app "Enable local sync?" confirm instead.
+  Confirming just saves the setting — you press `p` again afterward to
+  actually pull, so the destructive action itself stays behind two
+  deliberate presses, same as before.
+
+## [0.23.0] - 2026-07-15
+
+### Added
+- **Radicle sites are now detected and labeled as their own stack**, instead of
+  being misclassified as Bedrock. Radicle (Roots' Bedrock+Sage+Acorn+Trellis
+  starter) shares Bedrock's `roots/bedrock-autoloader` dependency, which was
+  tripping a naive `roots/bedrock` string match; detection now keys off
+  `roots/acorn` instead — the package that actually makes a site Radicle.
+  Radicle only surfaces via the on-demand SSH probe (`f` in the Servers/Search
+  tabs, `d`/`D` in Stacks) — its `/public/` webroot alone is indistinguishable
+  from a hardened Standard-WP `/public/` layout. DB backup/sync, plugin/theme
+  inventory, and local working-copy linking already worked on Radicle sites
+  (their path detection was already stack-agnostic); this release just adds
+  the missing name. Clone-wizard support for Radicle is a separate, not-yet-
+  built follow-up.
+
+### Fixed
+- A few README/docs mentions of `p` (plugins & themes) and `m` (monitoring)
+  that slipped through the previous release's key-unification work —
+  corrected to `e` and `M`, and scope notes broadened from "Search tab" to
+  "Servers / Search tabs" where applicable.
+
+## [0.22.3] - 2026-07-15
+
+### Fixed
+- **Site Control keys now behave the same in the Servers tab and Search.** The
+  shared Site Control legend was written against Search's bindings, but the
+  Servers tab silently diverged on several of them:
+  - `p` pulls the production DB in both views (Servers tab had it opening the
+    plugins/themes inventory instead, despite the legend saying "Pull prod.
+    DB"); plugins/themes moves to `e` in both.
+  - `d` runs a DB backup in both views (Servers tab had it running the Tier-2
+    stack-identify probe instead); that probe moves to `f`, added to Search
+    too (previously Servers-tab-only and not listed anywhere).
+  - `m` runs the production media-fallback action in both views (Servers tab
+    had no such binding at all; `m` aliased to Monitoring there instead).
+  - `a` (reboot/restart) now works with a site focused in the Servers tab, not
+    just the top-level server list — it was a silent no-op in that context.
+  - `K` (grant SSH key) is now wired up in Search — it was in the legend but
+    had no handler there at all.
+
 ## [0.22.2] - 2026-07-13
 
 ### Fixed
@@ -1185,7 +1239,10 @@ Initial tagged release.
 ### Notes
 - Read-only release: works with a SpinupWP **Read Only** API token.
 
-[Unreleased]: https://github.com/mwender/spinupwp-tui/compare/v0.22.2...HEAD
+[Unreleased]: https://github.com/mwender/spinupwp-tui/compare/v0.24.0...HEAD
+[0.24.0]: https://github.com/mwender/spinupwp-tui/compare/v0.23.0...v0.24.0
+[0.23.0]: https://github.com/mwender/spinupwp-tui/compare/v0.22.3...v0.23.0
+[0.22.3]: https://github.com/mwender/spinupwp-tui/compare/v0.22.2...v0.22.3
 [0.22.2]: https://github.com/mwender/spinupwp-tui/compare/v0.22.1...v0.22.2
 [0.22.1]: https://github.com/mwender/spinupwp-tui/compare/v0.22.0...v0.22.1
 [0.22.0]: https://github.com/mwender/spinupwp-tui/compare/v0.21.2...v0.22.0

package/README.md

@@ -34,23 +34,23 @@
   whatever's selected — Site Control or Server Control, grouped and always
   visible, no hidden key combos.
 - **Stack detection & fleet composition** — classifies every site as Standard WP,
-  Bedrock, or Non-WP, with a PHP-version breakdown and an on-demand SSH probe for
-  precise identification. → [docs/stack-detection.md](docs/stack-detection.md)
+  Bedrock, Radicle, or Non-WP, with a PHP-version breakdown and an on-demand SSH
+  probe for precise identification. → [docs/stack-detection.md](docs/stack-detection.md)
 - **Global search** — fuzzy search across every server and site by name, domain,
   or IP, with inline actions on the result.
 - **Events feed** — recent provisioning/operation activity with per-event detail.
 - **Live server health** (`h`) — real-time CPU/load/memory/disk over SSH.
   → [docs/server-health.md](docs/server-health.md)
-- **Installed plugins & themes** (`p`) — real `wp plugin`/`theme list` over SSH,
+- **Installed plugins & themes** (`e`) — real `wp plugin`/`theme list` over SSH,
   with per-item version and update status. → [docs/plugins-themes.md](docs/plugins-themes.md)
 - **Open in browser** (`o`) / **SSH into a site** (`s`) — one-key shortcuts.
 - **Link local working copies** (`L`) — link a site to its local checkout, with
   auto-discovery and git-drift indicators. → [docs/local-working-copies.md](docs/local-working-copies.md)
 - **DNS migration lens** (`n` / `N`) — see and edit a site's hosting records,
   repoint it to another server. → [docs/dns-access-editing.md](docs/dns-access-editing.md)
-- **Database backup & sync** (`d` / `p`, Search tab) — download or pull a
-  production DB into a linked local copy. → [docs/database-backup-sync.md](docs/database-backup-sync.md)
-- **Production media fallback** (`m`, Search tab) — serve missing-locally images
+- **Database backup & sync** (`d` / `p`, Servers / Search tabs) — download or
+  pull a production DB into a linked local copy. → [docs/database-backup-sync.md](docs/database-backup-sync.md)
+- **Production media fallback** (`m`, Servers / Search tabs) — serve missing-locally images
   from production after a DB pull. → [docs/production-media-fallback.md](docs/production-media-fallback.md)
 - **Upgrade a site's PHP version** (`u`) — pick a version, apply it, watch the
   event complete. → [docs/php-upgrade.md](docs/php-upgrade.md)
@@ -67,7 +67,7 @@
   [how it works](docs/clone-wizard-explained.md)
 - **Privileged writes over SSH** (`S` / `K`) — grant or revoke SSH keys directly,
   since the API can't. → [docs/privileged-ssh-writes.md](docs/privileged-ssh-writes.md)
-- **Site & server monitoring** (`m`) — a two-pane browser of a site's Uptime
+- **Site & server monitoring** (`M`) — a two-pane browser of a site's Uptime
   Kuma monitors (health, front-page fingerprint, an opt-in cache-bypass
   check, and, for vanity/server sites, load/Redis/PHP-fatal sentinels), each
   with a live status dot, an in-context explanation, and one action key to
@@ -220,6 +220,10 @@ These can be set in `config.json` or via an environment variable:
   and stack probes (see "Server health" below).
 - **`localSync`** / `SPINUPWP_LOCAL_SYNC` — opt-in for the **Pull production →
   local** DB sync (`p`); off by default because it overwrites your local database.
+  You don't need to set this by hand: pressing `p` on a WordPress site while
+  it's off opens an in-app "Enable local sync?" prompt that flips and saves it
+  for you — press `p` again afterward to actually pull. Setting it directly is
+  still supported for scripted/first-run setups.
   **Prefer `"localSync": true` in `config.json`** — it's read from a fixed path
   (`~/.config/spinupwp-tui/config.json`) so it applies wherever you launch `spinuptui`
   from. The environment variable works too, but note a `.env` is only loaded when
@@ -247,30 +251,31 @@ These can be set in `config.json` or via an environment variable:
 | `g` / `G` | Jump to top / bottom |
 | `o` | Open the selected site in your browser |
 | `s` | Open a terminal and SSH into the selected site |
-| `d` | Download a production DB backup into the linked copy (Search; WordPress + linked) |
-| `p` | Pull the production DB into the linked copy — overwrites local; opt-in via `localSync` (Search) |
-| `m` | Production media fallback: serve missing-locally images from production (Search; WordPress + linked) |
+| `d` | Download a production DB backup into the linked copy (Servers / Search; WordPress + linked) |
+| `p` | Pull the production DB into the linked copy — overwrites local; opt-in via `localSync` (Servers / Search) |
+| `m` | Production media fallback: serve missing-locally images from production (Servers / Search; WordPress + linked) |
 | `L` | Link / edit a site's local working copy |
 | `t` / `v` | Open the linked copy in a terminal / its local URL in your browser |
 | `n` | DNS migration view for a site — its records + TTLs (`⏎` edits a TTL; `p` repoints the record; `a` shows the whole server) |
 | `N` | DNS migration view for the whole server |
 | `h` | Live server health (CPU/mem/disk over SSH) |
-| `p` | List a site's installed plugins & themes over SSH — version + updates (Servers tab, sites pane) |
-| `d` | Detect a site's stack via SSH (Servers / Stacks tabs) |
-| `D` | Detect every site in the selected stack (Stacks tab) |
+| `e` | List a site's installed plugins & themes over SSH — version + updates (Servers / Search) |
+| `f` | Identify a site's stack via SSH (Servers / Search) — same action as Stacks' `d`/`D` below |
+| `d` | Identify a site's stack via SSH (Stacks tab only — `d` is DB backup in Servers/Search, above) |
+| `D` | Identify every site in the selected stack (Stacks tab) |
 | `S` | Auto-discover & batch-link local copies (Stacks tab) |
-| `f` | Report sites with no usable local copy (Stacks tab) |
+| `f` | Report sites with no usable local copy (Stacks tab only — `f` identifies a site's stack in Servers/Search, above) |
 | `u` | Upgrade a site's PHP version (Servers / Stacks / Search; needs a Read/Write token) |
 | `H` | Enable / disable HTTPS on a site (Servers / Stacks / Search; needs a Read/Write token) |
 | `P` | Purge a site's page cache + object cache (Servers / Stacks / Search; needs a Read/Write token) |
-| `m` / `M` | Site/server monitoring — a two-pane browser of this site's Uptime Kuma monitors (`M` is an alias, since lowercase `m` is taken in Search/Stacks). Inside: `↑`/`↓` selects a monitor, `a` registers/recalibrates/repairs it (Front page and Cache bypass open a check-window picker), `x` removes Front page or Cache bypass, `o` opens the selected monitor in Kuma, `d` runs the site doctor, `n` shows/edits alert wiring, and vanity sites add `R`/`r` for page refresh/secret rotation (Servers / Stacks / Search) |
-| `R` | Refresh a vanity page's HTML to the currently bundled version — no need to open `m` first. Shown under Vanity in the Servers tab's Control strip and Search's Actions list, for the one site per server whose domain is the server's own hostname |
+| `M` | Site/server monitoring — a two-pane browser of this site's Uptime Kuma monitors (capital, since lowercase `m` is media fallback in Servers/Search). Inside: `↑`/`↓` selects a monitor, `a` registers/recalibrates/repairs it (Front page and Cache bypass open a check-window picker), `x` removes Front page or Cache bypass, `o` opens the selected monitor in Kuma, `d` runs the site doctor, `n` shows/edits alert wiring, and vanity sites add `R`/`r` for page refresh/secret rotation (Servers / Stacks / Search) |
+| `R` | Refresh a vanity page's HTML to the currently bundled version — no need to open `M` first. Shown under Vanity in the Servers tab's Control strip and Search's Actions list, for the one site per server whose domain is the server's own hostname |
 | `a` | Server actions: reboot / restart a service (Servers / Search; needs a Read/Write token) |
 | `c` | Create a new server (Servers tab; needs a Read/Write token) |
 | `V` | Add a vanity site at the server's own hostname — DNS + site + HTTPS + SSH-key handoff (Servers tab; offered when no hostname site exists; needs a Read/Write token) |
 | `C` | Clone a server's sites to a new/existing destination (Servers tab; needs a Read/Write token + sudo) |
 | `S` | Connect sudo on a server for privileged writes — optionally remembered in the macOS Keychain (Servers tab) |
-| `K` | Grant / revoke an SSH key on a site, or every site on the server (needs sudo connected) |
+| `K` | Grant / revoke an SSH key on a site, or every site on the server (Servers / Search; needs sudo connected) |
 | `w` | Open the selected server/site in the SpinupWP web app |
 | `/` | Jump to global search |
 | `r` | Refresh data from the API |
@@ -291,14 +296,15 @@ processes — read-only, using your local SSH keys. Full details:
 
 ## Stack detection
 
-The **Stacks** tab (`3`) classifies every site as Standard WP, Bedrock, or Non-WP
-from API data alone, then lets you SSH-probe (`d` / `D`) for a precise ID (WHMCS,
-Laravel, Static HTML, WordPress version) that overrides a mislabeled guess. Full
-details: [docs/stack-detection.md](docs/stack-detection.md).
+The **Stacks** tab (`3`) classifies every site as Standard WP, Bedrock, Radicle,
+or Non-WP from API data alone (Radicle needs a probe to surface — see below),
+then lets you SSH-probe (`d` / `D`) for a precise ID (WHMCS, Laravel, Static
+HTML, WordPress version) that overrides a mislabeled guess. Full details:
+[docs/stack-detection.md](docs/stack-detection.md).
 
 ## Installed plugins & themes
 
-`p` on a site (Servers tab) lists its real `wp plugin`/`theme list` over SSH —
+`e` on a site (Servers / Search tabs) lists its real `wp plugin`/`theme list` over SSH —
 status, version, and available updates — the detail the API only gives as bare
 counts. Read-only, works on Bedrock and misclassified sites too. Full details:
 [docs/plugins-themes.md](docs/plugins-themes.md).
@@ -358,10 +364,10 @@ Stacks tab can auto-discover copies (`S`) and report sites still missing one
 
 ## Database backup & sync
 
-On a linked WordPress site (Search tab), `d` downloads a gzipped production DB
-backup into `sql/`; `p` (opt-in via `localSync`) pulls production into your
-**local** database, backing it up first and rewriting URLs. Works with
-Standard WP and Bedrock. Full details:
+On a linked WordPress site (Servers or Search tab), `d` downloads a gzipped
+production DB backup into `sql/`; `p` (opt-in via `localSync`) pulls production
+into your **local** database, backing it up first and rewriting URLs. Works
+with Standard WP, Bedrock, and Radicle. Full details:
 [docs/database-backup-sync.md](docs/database-backup-sync.md).
 
 ## Production media fallback

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spinuptui",
-  "version": "0.22.2",
+  "version": "0.24.0",
   "description": "SpinupTUI — a terminal dashboard for browsing, monitoring, and managing your SpinupWP servers and sites.",
   "type": "module",
   "bin": {

package/src/lib/dbSync.ts

@@ -213,11 +213,13 @@ export async function runDbSync(plan: DbSyncPlan, domain: string, onProgress: (p
   const lb = await wp(`wp db export "${localSql}" >/dev/null && gzip -f "${localSql}"`, 300_000)
   if (lb.code !== 0) {
     // wp-cli's own "not a WordPress install" error is a common first-pull snag on a
-    // fresh checkout — a Bedrock project needs `composer install` to build vendor/ +
-    // web/wp before wp-cli (or wp-cli.yml) can find anything there at all. Appended
-    // after meaningfulError's own pick (not passed as its fallback), since that's
-    // only used when stderr has NO meaningful line — not the case here.
-    const hint = plan.localKind === "bedrock" && /does not seem to be a WordPress install/i.test(lb.stderr) ? " Run `composer install` in your local checkout first." : ""
+    // fresh checkout — a Bedrock or Radicle project needs `composer install` to
+    // build vendor/ + web/wp (or public/wp) before wp-cli (or wp-cli.yml) can find
+    // anything there at all. Appended after meaningfulError's own pick (not passed
+    // as its fallback), since that's only used when stderr has NO meaningful line
+    // — not the case here.
+    const needsComposer = plan.localKind === "bedrock" || plan.localKind === "radicle"
+    const hint = needsComposer && /does not seem to be a WordPress install/i.test(lb.stderr) ? " Run `composer install` in your local checkout first." : ""
     return fail(`Local DB backup failed — ${meaningfulError(lb.stderr, "couldn't export the local database.")}${hint}`, "local-backup")
   }
 

package/src/lib/local.ts

@@ -34,7 +34,7 @@ export function normalizeLink(raw: LocalLink & { valetUrl?: string }): LocalLink
 
 // Resolution of a link against the filesystem, computed on demand (cheap — one
 // focused site at a time). `kind` mirrors the stack buckets used elsewhere.
-export type LocalKind = "bedrock" | "wp" | "unknown"
+export type LocalKind = "bedrock" | "radicle" | "wp" | "unknown"
 export interface LocalState {
   exists: boolean
   kind: LocalKind
@@ -82,6 +82,11 @@ export function findProjectRoot(dir: string): string {
 }
 
 // Classify a local working copy by reading a few marker files (read-only):
+//   Radicle = composer.json requiring roots/acorn (checked first: Radicle's
+//     composer.json also requires roots/bedrock-autoloader, so a bare
+//     "roots/bedrock" substring match below would misclassify it as Bedrock —
+//     roots/acorn is the package that actually makes a site Radicle, since
+//     plain Bedrock never requires it)
 //   Bedrock = composer.json requiring roots/bedrock, or config/application.php
 //   WordPress = wp-config.php at the root (or a public/ webroot)
 // Anything that exists but matches neither is "unknown".
@@ -89,7 +94,9 @@ function classify(dir: string): LocalKind {
   const composer = join(dir, "composer.json")
   if (existsSync(composer)) {
     try {
-      if (readFileSync(composer, "utf8").includes("roots/bedrock")) return "bedrock"
+      const contents = readFileSync(composer, "utf8")
+      if (contents.includes("roots/acorn")) return "radicle"
+      if (contents.includes("roots/bedrock")) return "bedrock"
     } catch {
       // unreadable composer.json — fall through to other markers
     }
@@ -101,6 +108,7 @@ function classify(dir: string): LocalKind {
 
 const KIND_LABEL: Record<LocalKind, string> = {
   bedrock: "Bedrock",
+  radicle: "Radicle",
   wp: "WordPress",
   unknown: "unrecognized",
 }

package/src/lib/probe.ts

@@ -20,7 +20,7 @@ import type { Server, Site } from "../api/types.ts"
 import { detectWpDirScript } from "./serverClone.ts"
 import { theme } from "./theme.ts"
 
-export type ProbeKind = "wordpress" | "bedrock" | "whmcs" | "laravel" | "static" | "unknown"
+export type ProbeKind = "wordpress" | "bedrock" | "radicle" | "whmcs" | "laravel" | "static" | "unknown"
 
 // `onSelection` brightens the colors that are too low-contrast on the focused
 // (bright-green) selection background — green-on-green and the faint greys.
@@ -30,6 +30,8 @@ export function probeKindColor(kind: ProbeKind, onSelection = false): string {
       return theme.accent
     case "bedrock":
       return onSelection ? theme.text : theme.good
+    case "radicle":
+      return onSelection ? theme.text : theme.purple
     case "whmcs":
       return theme.purple
     case "laravel":
@@ -89,8 +91,10 @@ function buildRemoteScript(domain: string, publicFolder: string | null): string
     // script (WHMCS/index/WP-version checks) intentionally keeps using as-is.
     detectWpDirScript(root, publicFolder ?? undefined),
     `BEDROCKROOT="$B"`,
+    `RADICLEROOT="$RD"`,
     'F="$HOME/files"',
     `W="$HOME/files${pf}"`,
+    'echo ===RADICLE; [ -n "$RADICLEROOT" ] && echo yes || echo no',
     'echo ===BEDROCK; [ -n "$BEDROCKROOT" ] && echo yes || echo no',
     'echo ===APPLICATION; test -f "$F/config/application.php" && echo yes || echo no',
     'echo ===ARTISAN; test -f "$F/artisan" && echo yes || echo no',
@@ -170,6 +174,16 @@ export function classify(sig: Record<string, string>): ProbeResult {
   if (sig.WHMCSCONF === "yes" && sig.WHMCSVENDOR === "yes") {
     return { kind: "whmcs", app: "WHMCS", version: null, label: "WHMCS" }
   }
+  // Checked before BEDROCK: Radicle's composer.json also requires
+  // roots/bedrock-autoloader, so it would otherwise match the Bedrock signal too.
+  if (sig.RADICLE === "yes") {
+    return {
+      kind: "radicle",
+      app: "Radicle",
+      version: wpVersion,
+      label: wpVersion ? `Radicle · WP ${wpVersion}` : "Radicle",
+    }
+  }
   if (sig.BEDROCK === "yes" || sig.APPLICATION === "yes") {
     return {
       kind: "bedrock",

package/src/lib/serverClone.ts

@@ -216,8 +216,12 @@ export function detectWpDirScript(root: string, publicFolder?: string): string {
     `[ -z "$W" ] && [ -f ${shq(candidate)}/wp/wp-settings.php ] && W=${shq(candidate)}/wp`,
     `[ -z "$W" ] && [ -f "$D/wp-settings.php" ] && W="$D"`,
     `[ -z "$W" ] && { F=$(find "$D" -maxdepth 3 -name wp-settings.php -not -path "*/wp-content/*" -print -quit 2>/dev/null); [ -n "$F" ] && W=$(dirname "$F"); }`,
-    `B=""`,
-    `[ -n "$W" ] && [ "$(basename "$W")" = "wp" ] && { P=$(dirname "$(dirname "$W")"); [ -f "$P/composer.json" ] && grep -q "roots/bedrock" "$P/composer.json" 2>/dev/null && B="$P"; }`,
+    `B=""; RD=""`,
+    // Radicle's composer.json also requires roots/bedrock-autoloader, so a bare
+    // "roots/bedrock" substring match (below) can't tell the two apart — check
+    // for roots/acorn first, the package that actually makes a site Radicle
+    // (plain Bedrock never requires it). $P is set by the same lookup either way.
+    `[ -n "$W" ] && [ "$(basename "$W")" = "wp" ] && { P=$(dirname "$(dirname "$W")"); [ -f "$P/composer.json" ] && { grep -q "roots/acorn" "$P/composer.json" 2>/dev/null && RD="$P"; grep -q "roots/bedrock" "$P/composer.json" 2>/dev/null && B="$P"; }; }`,
   ].join("; ")
 }
 

package/src/lib/stack.ts

@@ -23,10 +23,10 @@ import type { ProbeKind } from "./probe.ts"
 import { publicFolderRel } from "./serverClone.ts"
 import { theme } from "./theme.ts"
 
-export type Stack = "Standard WP" | "Bedrock" | "Non-WP"
+export type Stack = "Standard WP" | "Bedrock" | "Radicle" | "Non-WP"
 
 // All buckets in display order (kept stable so the Stacks view doesn't reflow).
-export const STACKS: Stack[] = ["Standard WP", "Bedrock", "Non-WP"]
+export const STACKS: Stack[] = ["Standard WP", "Bedrock", "Radicle", "Non-WP"]
 
 export function classifyStack(site: Site): Stack {
   if (!site.is_wordpress) return "Non-WP"
@@ -46,6 +46,11 @@ export function effectiveStack(site: Site, probeKind?: ProbeKind | null): Stack
       return "Standard WP"
     case "bedrock":
       return "Bedrock"
+    case "radicle":
+      // Radicle's public/ webroot is indistinguishable from a hardened
+      // Standard-WP public/ layout at Tier-1 (public_folder alone), so this
+      // bucket only exists once Tier-2 (SSH probe) confirms roots/acorn.
+      return "Radicle"
     case "whmcs":
     case "laravel":
     case "static":
@@ -75,6 +80,10 @@ export function cloneStackFor(site: Site, probeKind?: ProbeKind | null): "wp" |
     if (probeKind === "whmcs" || probeKind === "laravel" || probeKind === "static") return "files"
     return "bedrock"
   }
+  // A "radicle" probe never falls into "wp" here since effectiveStack maps it
+  // to "Radicle", not "Standard WP" — deliberate: the Standard-WP pull chain
+  // assumes a flat webroot and would corrupt a Radicle clone. Real Radicle
+  // clone-wizard support is a separate, not-yet-built phase (issue #38).
   return effectiveStack(site, probeKind) === "Standard WP" ? "wp" : "files"
 }
 
@@ -86,6 +95,8 @@ export function stackColor(stack: Stack, onSelection = false): string {
       return theme.accent // blue
     case "Bedrock":
       return onSelection ? theme.text : theme.good // green
+    case "Radicle":
+      return onSelection ? theme.text : theme.purple
     case "Non-WP":
       return onSelection ? theme.text : theme.textDim // gray
   }
@@ -98,6 +109,8 @@ export function stackTag(stack: Stack): string {
       return "wp"
     case "Bedrock":
       return "bedrock"
+    case "Radicle":
+      return "radicle"
     case "Non-WP":
       return "app"
   }

package/src/ui/App.tsx

@@ -23,6 +23,7 @@ import { GrantKey } from "./views/GrantKey.tsx"
 import { SudoConnect } from "./views/SudoConnect.tsx"
 import { DbBackup } from "./views/DbBackup.tsx"
 import { DbSync } from "./views/DbSync.tsx"
+import { EnableLocalSync } from "./views/EnableLocalSync.tsx"
 import { MediaFallback } from "./views/MediaFallback.tsx"
 import { ServerActions } from "./views/ServerActions.tsx"
 import { NewServer } from "./views/NewServer.tsx"
@@ -67,6 +68,7 @@ export function App() {
     store.sudoConnectServer !== null ||
     store.dbBackupSite !== null ||
     store.dbSyncSite !== null ||
+    store.enableLocalSyncSite !== null ||
     store.mediaFallbackSite !== null ||
     store.serverActionsServer !== null ||
     store.newServerOpen ||
@@ -143,6 +145,9 @@ export function App() {
     // The DB-sync overlay owns the keyboard while open.
     if (store.dbSyncSite) return
 
+    // The "enable local sync?" confirm overlay owns the keyboard while open.
+    if (store.enableLocalSyncSite) return
+
     // The media-fallback overlay owns the keyboard while open.
     if (store.mediaFallbackSite) return
 
@@ -244,6 +249,7 @@ export function App() {
       {store.sudoConnectServer && <SudoConnect />}
       {store.dbBackupSite && <DbBackup />}
       {store.dbSyncSite && <DbSync />}
+      {store.enableLocalSyncSite && <EnableLocalSync />}
       {store.mediaFallbackSite && <MediaFallback />}
       {store.serverActionsServer && <ServerActions />}
       {store.newServerOpen && <NewServer />}

package/src/ui/Details.tsx

@@ -6,7 +6,7 @@ import { formatBytes, diskUsedPct, bar, formatDate, timeAgo, truncate } from "..
 import { Field, StatusBadge, ControlPanel, siteGroups, type ActionGroup } from "./components.tsx"
 import { effectiveStack, stackColor } from "../lib/stack.ts"
 import { probeKindColor } from "../lib/probe.ts"
-import { resolveLocalLink, type LocalLink } from "../lib/local.ts"
+import { resolveLocalLink, type LocalLink, type LocalKind } from "../lib/local.ts"
 import { normalizeDomain } from "../lib/dns.ts"
 import { isVanityPair } from "../lib/vanitySite.ts"
 import type { Drift } from "../lib/gitStatus.ts"
@@ -276,11 +276,11 @@ export function SiteDetail({ site, serverName }: { site: Site; serverName: strin
 // Site Control groups — see ServerControl above. Recomputes stack/vanity
 // itself since it's not a child of SiteDetail; both derivations are cheap.
 export function SiteControl({ site, serverName, layout }: { site: Site; serverName: string; layout?: "list" | "flow" }) {
-  const { probes, localSync } = useStore()
+  const { probes } = useStore()
   const stack = effectiveStack(site, probes.get(site.id)?.result.kind)
   const isWordPress = stack !== "Non-WP"
   const isVanity = isVanityPair(site.domain, serverName)
-  return <ControlPanel heading="Site Control" groups={siteGroups(isWordPress, localSync, isVanity)} layout={layout} />
+  return <ControlPanel heading="Site Control" groups={siteGroups(isWordPress, isVanity)} layout={layout} />
 }
 
 // DNS zone-host lines for a site's domains, populated on demand (key `n`). Each
@@ -320,8 +320,17 @@ function SiteDnsSection({ site }: { site: Site }) {
 }
 
 // Color for a resolved local stack label.
-function localLabelColor(kind: "bedrock" | "wp" | "unknown"): string {
-  return kind === "bedrock" ? theme.good : kind === "wp" ? theme.accent : theme.warn
+function localLabelColor(kind: LocalKind): string {
+  switch (kind) {
+    case "bedrock":
+      return theme.good
+    case "radicle":
+      return theme.purple
+    case "wp":
+      return theme.accent
+    case "unknown":
+      return theme.warn
+  }
 }
 
 // Compact, self-explaining git-drift label for a linked copy's line, e.g.

package/src/ui/components.tsx

@@ -427,21 +427,31 @@ export function ControlPanel({ heading, groups, layout = "list" }: { heading: st
 // since the group label is always visible right next to them (as its own column
 // in layout="flow", or its own line in layout="list").
 //
-// The DB backup/sync use wp-cli, so they only apply to WordPress sites — omitted
-// for non-WP sites (their `d`/`p` keypresses are also guarded in the handler). DNS
-// (`n`) and the rest apply to any site. `isVanity` (the site's domain equals its
+// The DB backup/sync and plugins/themes inventory all use wp-cli, so they only
+// apply to WordPress sites — omitted for non-WP sites (their `d`/`p`/`e`
+// keypresses are also guarded in the handler). DNS (`n`) and the rest apply to
+// any site. `isVanity` (the site's domain equals its
 // own server's name, per `isVanityPair`) adds the one-off page-refresh action —
 // vanity pages seeded before this app existed need a way to pick up the current
 // bundled HTML.
-export function siteGroups(isWordpress: boolean, localSync: boolean, isVanity: boolean): ActionGroup[] {
+//
+// `p` (Pull prod. DB) is always shown for WordPress sites, even when the
+// localSync config flag is off — pressing it then opens a confirm overlay to
+// enable the flag, rather than hiding the entry entirely. That matches how
+// the OTHER two gates on this same action already behave (is_wordpress and
+// "not linked" both flash on press instead of hiding the entry); localSync
+// used to be the odd one out.
+export function siteGroups(isWordpress: boolean, isVanity: boolean): ActionGroup[] {
   const remote: [string, string][] = [
     ["s", "SSH"],
     ["K", "Grant SSH key"],
     ["n", "DNS"],
+    ["f", "Identify app"],
   ]
   if (isWordpress) {
     remote.push(["d", "↓ DB backup"])
-    if (localSync) remote.push(["p", "Pull prod. DB"])
+    remote.push(["p", "Pull prod. DB"])
+    remote.push(["e", "Plugins & themes"])
   }
   const local: [string, string][] = [
     ["t", "Terminal"],

package/src/ui/store.tsx

@@ -728,6 +728,12 @@ interface StoreValue extends DataState {
   sshUser: string | null
   // Opt-in for the destructive production→local DB sync (`p`); default off.
   localSync: boolean
+  // The site `p` was pressed on while localSync was off — drives the "enable
+  // local sync?" confirm overlay. null when the overlay is closed.
+  enableLocalSyncSite: Site | null
+  setEnableLocalSyncSite: (s: Site | null) => void
+  // Persists localSync=true to config.json and flips the reactive flag above.
+  enableLocalSync: () => void
   // SpinupWP account slug (from env/config) for building web deep links.
   accountSlug: string | null
   sitesForServer: (serverId: number) => Site[]
@@ -997,6 +1003,8 @@ export function StoreProvider({ children }: { children: ReactNode }) {
   const [dbBackups, setDbBackups] = useState<Map<number, DbBackupProgress>>(new Map())
   const [dbSyncSite, setDbSyncSite] = useState<Site | null>(null)
   const [dbSyncs, setDbSyncs] = useState<Map<number, DbSyncProgress>>(new Map())
+  const [localSync, setLocalSyncState] = useState<boolean>(() => cfgRef.current.localSync)
+  const [enableLocalSyncSite, setEnableLocalSyncSite] = useState<Site | null>(null)
   const [mediaFallbackSite, setMediaFallbackSite] = useState<Site | null>(null)
   const [localRoots, setLocalRoots] = useState<string[]>(() => [...cfgRef.current.localRoots])
   const [discoverOpen, setDiscoverOpen] = useState(false)
@@ -1728,6 +1736,12 @@ export function StoreProvider({ children }: { children: ReactNode }) {
     })
   }, [])
 
+  const enableLocalSync = useCallback(() => {
+    cfgRef.current.localSync = true
+    void saveConfig({ localSync: true })
+    setLocalSyncState(true)
+  }, [])
+
   const openLocalTerminal = useCallback(
     (siteId: number) => {
       const link = localLinks.get(siteId)
@@ -4326,7 +4340,10 @@ export function StoreProvider({ children }: { children: ReactNode }) {
     rebootInfoErrors,
     loadRebootInfo,
     sshUser: cfgRef.current.sshUser,
-    localSync: cfgRef.current.localSync,
+    localSync,
+    enableLocalSyncSite,
+    setEnableLocalSyncSite,
+    enableLocalSync,
     accountSlug: cfgRef.current.accountSlug,
     sitesForServer,
     serverById,

package/src/ui/views/Browser.tsx

@@ -23,7 +23,7 @@ type Focus = "servers" | "sites"
 
 export function Browser({ rows }: { rows: number }) {
   const store = useStore()
-  const { servers, sitesForServer, route, inputMode, overlayOpen, setHealthServer, setWpInventorySite, runProbe, probes, accountSlug, setPhpUpgradeSite, phpUpgrades, setHttpsToggleSite, setPurgeCacheSite, setGrantKeySite, setSudoConnectServer, isSudoConnected, setServerActionsServer, serverOps, setLocalLinkSite, openLocalTerminal, openLocalUrl, sshSite, setDnsInventoryServer, setNewServerSource, setNewServerOpen, setVanityServer, vanityJob, beginClone, isServerOsEol, setKumaSite, kumaConfigured, startKumaSetup, startVanityReseed } = store
+  const { servers, sitesForServer, route, inputMode, overlayOpen, setHealthServer, setWpInventorySite, runProbe, probes, accountSlug, setPhpUpgradeSite, phpUpgrades, setHttpsToggleSite, setPurgeCacheSite, setGrantKeySite, setSudoConnectServer, isSudoConnected, setServerActionsServer, serverOps, setLocalLinkSite, openLocalTerminal, openLocalUrl, sshSite, setDnsInventoryServer, setNewServerSource, setNewServerOpen, setVanityServer, vanityJob, beginClone, isServerOsEol, setKumaSite, kumaConfigured, startKumaSetup, startVanityReseed, setDbSyncSite, localSync, localLinks, setDbBackupSite, setMediaFallbackSite, setEnableLocalSyncSite } = store
 
   const [serverIndex, setServerIndex] = useState(0)
   const [siteIndex, setSiteIndex] = useState(0)
@@ -89,8 +89,25 @@ export function Browser({ rows }: { rows: number }) {
           setTimeout(() => setFlash(null), 1500)
         }
         return
-      case "d":
-        // Detect the selected site's stack via SSH (Tier 2); shows in Details.
+      case "d": {
+        // DB backup uses wp-cli on the remote and downloads into the linked copy,
+        // so it needs a WordPress site and a local link. Same gate as Search's d.
+        const s = focus === "sites" ? sites[siteIndex] : undefined
+        if (!s) return
+        if (!s.is_wordpress) {
+          setFlash("Database backup needs WordPress (wp-cli) — this isn't a WP site")
+        } else if (!localLinks.has(s.id)) {
+          setFlash("Not linked — press L to link a local copy")
+        } else {
+          setDbBackupSite(s)
+          return
+        }
+        setTimeout(() => setFlash(null), 1500)
+        return
+      }
+      case "f":
+        // Identify the selected site's stack via SSH (Tier 2); shows in Details.
+        // Same action as Search's f and Stacks' d/D.
         if (focus === "sites" && sites[siteIndex]) {
           const s = sites[siteIndex]
           runProbe(s)
@@ -110,13 +127,27 @@ export function Browser({ rows }: { rows: number }) {
         // Purge page cache + object cache on the selected site.
         if (focus === "sites" && sites[siteIndex]) setPurgeCacheSite(sites[siteIndex])
         return
-      case "m":
       case "M":
         // Uptime Kuma monitoring for the selected site (connect on first use).
-        // M is an alias: it's the binding Search/Stacks use (their lowercase m
-        // is taken), so the capital works everywhere.
+        // Capital because lowercase m is media fallback here, matching Search.
         if (focus === "sites" && sites[siteIndex]) setKumaSite(sites[siteIndex])
         return
+      case "m": {
+        // Production media fallback: drops a mu-plugin into the linked local copy,
+        // so it needs a WordPress site and a local link (same gate as d).
+        const s = focus === "sites" ? sites[siteIndex] : undefined
+        if (!s) return
+        if (!s.is_wordpress) {
+          setFlash("Media fallback needs WordPress — this isn't a WP site")
+        } else if (!localLinks.has(s.id)) {
+          setFlash("Not linked — press L to link a local copy")
+        } else {
+          setMediaFallbackSite(s)
+          return
+        }
+        setTimeout(() => setFlash(null), 1500)
+        return
+      }
       case "R": {
         // Refresh a vanity page's HTML — only the one site per server whose
         // domain equals the server's own name. Same binding/behavior as the
@@ -168,7 +199,30 @@ export function Browser({ rows }: { rows: number }) {
         // DNS inventory scoped to the selected site (its domains + records).
         if (focus === "sites" && sites[siteIndex] && server) setDnsInventoryServer(server, sites[siteIndex].id)
         return
-      case "p":
+      case "p": {
+        // Pull production → local (opt-in, overwrites the local DB): needs a
+        // WordPress site, localSync enabled, and a linked local copy. Same
+        // gate as Search's `p` (Search.tsx) so the Site Control legend's
+        // "Pull prod. DB" label is accurate here too. A localSync-off site
+        // opens a confirm overlay to enable it (rather than a dead-end flash)
+        // since it's now always shown in the legend, not hidden until enabled.
+        const s = focus === "sites" ? sites[siteIndex] : undefined
+        if (!s) return
+        if (!localSync) {
+          setEnableLocalSyncSite(s)
+          return
+        } else if (!s.is_wordpress) {
+          setFlash("Sync needs WordPress (wp-cli) — this isn't a WP site")
+        } else if (!localLinks.has(s.id)) {
+          setFlash("Not linked — press L to link a local copy")
+        } else {
+          setDbSyncSite(s)
+          return
+        }
+        setTimeout(() => setFlash(null), 1500)
+        return
+      }
+      case "e":
         // Plugins & themes (wp-cli over SSH) for the selected site.
         if (focus === "sites" && sites[siteIndex]) setWpInventorySite(sites[siteIndex])
         return
@@ -182,10 +236,11 @@ export function Browser({ rows }: { rows: number }) {
         if (server) setSudoConnectServer(server)
         return
       case "a":
-        // Server actions (reboot / restart) are server-scoped, so only offered
-        // when the Servers pane is focused — when you've drilled into a site,
-        // the context is the site (server actions are dropped there).
-        if (focus === "servers" && server) setServerActionsServer(server)
+        // Server actions (reboot / restart) — on the server, or a site's server
+        // (mirrors Search's a, which derives the server from whichever result
+        // kind is selected). `server` is already scoped to whichever server the
+        // focused pane's rows belong to, so this works unchanged from either pane.
+        if (server) setServerActionsServer(server)
         return
       case "c":
         // Create a new server. Seed from the highlighted server when there is one;

package/src/ui/views/EnableLocalSync.tsx

@@ -0,0 +1,88 @@
+// "Enable local sync?" confirm overlay — opened when `p` (Pull prod. DB) is
+// pressed on a site while the localSync config flag is off. localSync is a
+// deliberate opt-in (pulling production overwrites the local database), so
+// confirming here only flips the flag and saves it — it does NOT chain into
+// the pull itself. The user presses `p` again afterward to actually run it,
+// which still has its own confirm-before-firing step. Keeps the destructive
+// action behind two deliberate presses, same safety margin as before, while
+// making the feature discoverable instead of a silent config-file-only switch.
+
+import { useState } from "react"
+import { useKeyboard } from "@opentui/react"
+import { theme } from "../../lib/theme.ts"
+import { truncate } from "../../lib/format.ts"
+import { Panel, Centered } from "../components.tsx"
+import { StatusBar } from "../StatusBar.tsx"
+import { useStore } from "../store.tsx"
+
+type Phase = "confirm" | "done"
+
+export function EnableLocalSync() {
+  const { enableLocalSyncSite: site, setEnableLocalSyncSite, enableLocalSync } = useStore()
+  const [phase, setPhase] = useState<Phase>("confirm")
+
+  const close = () => setEnableLocalSyncSite(null)
+
+  useKeyboard((key) => {
+    const name = key.name ?? ""
+    if (phase === "confirm") {
+      if (name === "y") {
+        enableLocalSync()
+        setPhase("done")
+        return
+      }
+      if (name === "escape" || name === "q") return close()
+      return
+    }
+    // "done" — any key closes.
+    return close()
+  })
+
+  if (!site) return null
+
+  return (
+    <box style={{ position: "absolute", top: 0, left: 0, width: "100%", height: "100%", flexDirection: "column", backgroundColor: theme.bg, zIndex: 210 }}>
+      <box style={{ flexDirection: "row", height: 1, backgroundColor: theme.bgAlt, paddingLeft: 1, paddingRight: 1, alignItems: "center" }}>
+        <text content="↓ Local sync  " fg={theme.brand} style={{ flexShrink: 0 }} />
+        <text content={truncate(site.domain, 40)} fg={theme.text} wrapMode="none" style={{ flexShrink: 1 }} />
+      </box>
+
+      <Centered>{renderBody()}</Centered>
+
+      <StatusBar hints={phase === "confirm" ? [{ key: "y", label: "enable" }, { key: "esc", label: "cancel" }] : [{ key: "any", label: "close" }]} showGlobal={false} />
+    </box>
+  )
+
+  function renderBody() {
+    if (phase === "confirm") {
+      return (
+        <Panel title=" Enable local sync? " active>
+          <box style={{ flexDirection: "column", width: 62, paddingTop: 1, paddingBottom: 1 }}>
+            <text content="Local sync is off — it's opt-in because pulling production" fg={theme.text} wrapMode="none" />
+            <text content="overwrites your LOCAL database." fg={theme.text} wrapMode="none" />
+            <box style={{ height: 1 }} />
+            <text content="Enabling it just flips the setting — it won't pull anything" fg={theme.textDim} wrapMode="none" />
+            <text content="yet. Press p again afterward to actually pull production." fg={theme.textDim} wrapMode="none" />
+            <box style={{ height: 1 }} />
+            <text content="Press y to enable · Esc to cancel" fg={theme.textFaint} wrapMode="none" />
+          </box>
+        </Panel>
+      )
+    }
+
+    return (
+      <Panel title=" Done " active>
+        <box style={{ flexDirection: "column", width: 56, paddingTop: 1, paddingBottom: 1 }}>
+          <box style={{ flexDirection: "row" }}>
+            <text content="✓ " fg={theme.good} />
+            <text content="Local sync enabled" fg={theme.text} wrapMode="none" />
+          </box>
+          <box style={{ height: 1 }} />
+          <text content="Press p again to pull production into your local copy." fg={theme.textDim} wrapMode="none" />
+          <box style={{ height: 1 }} />
+          <text content="Press any key to close" fg={theme.textFaint} />
+        </box>
+      </Panel>
+    )
+  }
+}

package/src/ui/views/Forgotten.tsx

@@ -30,7 +30,7 @@ interface Entry {
 }
 
 // Stack filter options the report can cycle through (← / →). null = all stacks.
-const STACK_FILTERS: (Stack | null)[] = [null, "Standard WP", "Bedrock", "Non-WP"]
+const STACK_FILTERS: (Stack | null)[] = [null, "Standard WP", "Bedrock", "Radicle", "Non-WP"]
 
 export function Forgotten() {
   const { sites, localLinks, probes, setForgottenOpen, setLocalLinkSite, forgottenStack, setLinkReturnToForgotten } = useStore()

package/src/ui/views/KumaSite.tsx

@@ -40,7 +40,7 @@ import { useStore, type KumaAlertProvider } from "../store.tsx"
 import { isVanityPair } from "../../lib/vanitySite.ts"
 import { openUrl } from "../../lib/open.ts"
 import { runSiteDoctor, type DoctorReport } from "../../lib/siteDoctor.ts"
-import { classifyStack } from "../../lib/stack.ts"
+import { effectiveStack } from "../../lib/stack.ts"
 
 const BASE_FIELDS = ["url", "username", "password"] as const
 // Fixed input width: the panel body is 66 wide, the label gutter is 12 ("❯ " +
@@ -152,7 +152,7 @@ type AlertsState =
 type AlertSummary = null | { kind: "loading" } | { kind: "error"; error: string } | { kind: "ready"; providers: KumaAlertProvider[] }
 
 export function KumaSite() {
-  const { kumaSite: site, setKumaSite, kumaConfigured, kumaUrl, connectKuma, kumaMonitorFor, kumaOps, startKumaSetup, startVanityReseed, startKumaRotate, startFingerprintSetup, startBypassMonitorSetup, removeSiteMonitor, fetchKumaAlerts, toggleKumaAlert, clearKumaOp, kumaStatus, servers, setInputMode } = useStore()
+  const { kumaSite: site, setKumaSite, kumaConfigured, kumaUrl, connectKuma, kumaMonitorFor, kumaOps, startKumaSetup, startVanityReseed, startKumaRotate, startFingerprintSetup, startBypassMonitorSetup, removeSiteMonitor, fetchKumaAlerts, toggleKumaAlert, clearKumaOp, kumaStatus, servers, setInputMode, probes } = useStore()
 
   const [draft, setDraft] = useState({ url: "", username: "", password: "" })
   const [fieldIdx, setFieldIdx] = useState(0)
@@ -371,8 +371,14 @@ export function KumaSite() {
       pageCacheEnabled: site.page_cache?.enabled ?? null,
       sshTarget: site.site_user && server ? `${site.site_user}@${server.name}` : null,
       isWordPress: !!site.is_wordpress,
-      // Bedrock relocates the login under /wp/ — aim the door probe there.
-      loginPath: classifyStack(site) === "Bedrock" ? "/wp/wp-login.php" : "/wp-login.php",
+      // Bedrock and Radicle both nest core under a wp/ folder, relocating the
+      // login there — aim the door probe at it. Uses effectiveStack (Tier-2
+      // probe when available) since Radicle's public/ webroot alone is
+      // indistinguishable at Tier-1 from a hardened Standard-WP public/ layout.
+      loginPath: (() => {
+        const stack = effectiveStack(site, probes.get(site.id)?.result.kind)
+        return stack === "Bedrock" || stack === "Radicle" ? "/wp/wp-login.php" : "/wp-login.php"
+      })(),
     }).then((report) => setDoctor((prev) => (prev ? { kind: "ready", report } : prev)))
   }
 

package/src/ui/views/Search.tsx

@@ -35,7 +35,7 @@ function score(haystack: string, q: string): number | null {
 
 export function Search({ rows }: { rows: number }) {
   const store = useStore()
-  const { servers, sites, serverById, setInputMode, setRoute, route, overlayOpen, setHealthServer, setPhpUpgradeSite, setHttpsToggleSite, setPurgeCacheSite, setServerActionsServer, accountSlug, localLinks, setLocalLinkSite, openLocalTerminal, openLocalUrl, sshSite, setDnsInventoryServer, setDbBackupSite, dbBackups, setDbSyncSite, dbSyncs, localSync, setMediaFallbackSite, beginClone, setSudoConnectServer, setKumaSite, kumaConfigured, startKumaSetup, startVanityReseed } = store
+  const { servers, sites, serverById, setInputMode, setRoute, route, overlayOpen, setHealthServer, setPhpUpgradeSite, setHttpsToggleSite, setPurgeCacheSite, setServerActionsServer, accountSlug, localLinks, setLocalLinkSite, openLocalTerminal, openLocalUrl, sshSite, setDnsInventoryServer, setDbBackupSite, dbBackups, setDbSyncSite, dbSyncs, localSync, setMediaFallbackSite, beginClone, setSudoConnectServer, setKumaSite, kumaConfigured, startKumaSetup, startVanityReseed, setWpInventorySite, setGrantKeySite, runProbe, setEnableLocalSyncSite } = store
   const [query, setQuery] = useState("")
   const [selected, setSelected] = useState(0)
   // "query" = typing/filtering (input focused); "actions" = input blurred so the
@@ -160,6 +160,11 @@ export function Search({ rows }: { rows: number }) {
       case "L":
         if (current?.kind === "site") setLocalLinkSite(current.site)
         return
+      case "K":
+        // Grant Spinup's machine key to the selected site over SSH — matches
+        // Browser's K binding, which was already in the shared legend here.
+        if (current?.kind === "site") setGrantKeySite(current.site)
+        return
       case "s":
         if (current?.kind === "site") flashMsg(sshSite(current.site.id))
         return
@@ -174,14 +179,20 @@ export function Search({ rows }: { rows: number }) {
         return
       case "p":
         // Pull production → local: opt-in (it overwrites the local DB), and needs
-        // a WordPress site + a local link.
+        // a WordPress site + a local link. A localSync-off site opens a confirm
+        // overlay to enable it (rather than a dead-end flash) since it's now
+        // always shown in the legend, not hidden until enabled.
         if (current?.kind === "site") {
-          if (!localSync) flashMsg('Local sync is off — set "localSync": true in config to enable')
+          if (!localSync) setEnableLocalSyncSite(current.site)
           else if (!current.site.is_wordpress) flashMsg("Sync needs WordPress (wp-cli) — this isn't a WP site")
           else if (!localLinks.has(current.site.id)) flashMsg("Not linked — press L to link a local copy")
           else setDbSyncSite(current.site)
         }
         return
+      case "e":
+        // Plugins & themes (wp-cli over SSH) for the selected site.
+        if (current?.kind === "site") setWpInventorySite(current.site)
+        return
       case "m":
         // Production media fallback: drops a mu-plugin into the linked local copy,
         // so it needs a WordPress site and a local link (same gate as backup).
@@ -212,6 +223,14 @@ export function Search({ rows }: { rows: number }) {
           if (srv) setDnsInventoryServer(srv, current.site.id)
         }
         return
+      case "f":
+        // Identify the selected site's stack via SSH (Tier 2) — same action as
+        // Browser's f and Stacks' d/D.
+        if (current?.kind === "site") {
+          runProbe(current.site)
+          flashMsg(`Identifying the app on ${current.site.domain}…`)
+        }
+        return
       case "h": {
         const srv =
           current?.kind === "server"
@@ -362,7 +381,6 @@ export function Search({ rows }: { rows: number }) {
             <ActionsCard
               result={current}
               serverName={current.kind === "site" ? (serverById(current.site.server_id)?.name ?? "—") : current.server.name}
-              localSync={localSync}
             />
           ) : current.kind === "server" ? (
             <ServerDetail server={current.server} siteCount={store.sitesForServer(current.server.id).length} />
@@ -377,12 +395,12 @@ export function Search({ rows }: { rows: number }) {
   )
 }
 
-function ActionsCard({ result, serverName, localSync }: { result: Result; serverName: string; localSync: boolean }) {
+function ActionsCard({ result, serverName }: { result: Result; serverName: string }) {
   const isSite = result.kind === "site"
   const name = isSite ? result.site.domain : result.server.name
   const status = isSite ? result.site.status : result.server.connection_status
   // Server results reuse the SAME Server Control suite as the Browser detail pane.
-  const groups = isSite ? siteGroups(result.site.is_wordpress, localSync, isVanityPair(result.site.domain, serverName)) : SERVER_CONTROL
+  const groups = isSite ? siteGroups(result.site.is_wordpress, isVanityPair(result.site.domain, serverName)) : SERVER_CONTROL
   return (
     <box style={{ flexDirection: "column" }}>
       <box style={{ flexDirection: "row" }}>