spinuptui 0.25.0 → 0.26.1

package/src/lib/dbBackup.ts

@@ -14,6 +14,7 @@ import { existsSync, mkdirSync, statSync } from "node:fs"
 import { join } from "node:path"
 import type { Server, Site } from "../api/types.ts"
 import { expandPath, type LocalLink } from "./local.ts"
+import { spawn } from "./spawn.ts"
 
 export const SSH_OPTS = ["-o", "BatchMode=yes", "-o", "ConnectTimeout=10", "-o", "StrictHostKeyChecking=accept-new"]
 
@@ -111,12 +112,12 @@ export async function runProcess(
   timeoutMs: number,
   cwd?: string,
   env?: Record<string, string>,
-): Promise<{ code: number; stderr: string }> {
+): Promise<{ code: number; stderr: string; stdout: string }> {
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(cmd, { stdout: "pipe", stderr: "pipe", stdin: "ignore", cwd, env })
+    proc = spawn(cmd, { stdout: "pipe", stderr: "pipe", stdin: "ignore", cwd, env })
   } catch (err) {
-    return { code: -1, stderr: `Failed to launch ${cmd[0]}: ${(err as Error).message}` }
+    return { code: -1, stderr: `Failed to launch ${cmd[0]}: ${(err as Error).message}`, stdout: "" }
   }
   const timer = setTimeout(() => {
     try {
@@ -127,8 +128,11 @@ export async function runProcess(
   }, timeoutMs)
   const code = await proc.exited
   clearTimeout(timer)
-  const stderr = await new Response(proc.stderr as ReadableStream<Uint8Array>).text()
-  return { code, stderr }
+  const [stdout, stderr] = await Promise.all([
+    new Response(proc.stdout as ReadableStream<Uint8Array>).text(),
+    new Response(proc.stderr as ReadableStream<Uint8Array>).text(),
+  ])
+  return { code, stderr, stdout }
 }
 
 // Pick a meaningful error line out of ssh/wp stderr, skipping the deprecation /

package/src/lib/dbSync.ts

@@ -12,7 +12,7 @@
 // SYNC_REMOTE_HOST / SYNC_LOCAL_HOST env contract as the sync-prod-to-local
 // script, so per-project tweaks (Elementor URL swaps, plugin toggles) carry over.
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "node:fs"
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, rmSync } from "node:fs"
 import { join, dirname } from "node:path"
 import type { Server, Site } from "../api/types.ts"
 import { expandPath, findProjectRoot, resolveLocalLink, type LocalKind, type LocalLink } from "./local.ts"
@@ -212,6 +212,20 @@ export async function runDbSync(plan: DbSyncPlan, domain: string, onProgress: (p
   const localSql = plan.localBackupPath.replace(/\.gz$/, "")
   const lb = await wp(`wp db export "${localSql}" >/dev/null && gzip -f "${localSql}"`, 300_000)
   if (lb.code !== 0) {
+    // `wp db export` creates its output file before it knows the dump will
+    // succeed, and the `&& gzip` never runs when it doesn't — leaving a bare
+    // .sql behind (empty on an instant failure, PARTIAL if the dump dies
+    // midway) named exactly like a real backup. Nothing was restorable from it
+    // anyway: this step aborts before the local database is touched. Remove it
+    // rather than leave a file that reads as a safety net, the same way the
+    // download branch below cleans up the remote dump it orphaned. A
+    // successful run leaves only the .gz, and the name carries a
+    // to-the-minute timestamp, so this can only ever be this run's artifact.
+    try {
+      rmSync(localSql, { force: true })
+    } catch {
+      /* best-effort — a leftover file must not mask the real failure below */
+    }
     // wp-cli's own "not a WordPress install" error is a common first-pull snag on a
     // fresh checkout — a Bedrock or Radicle project needs `composer install` to
     // build vendor/ + web/wp (or public/wp) before wp-cli (or wp-cli.yml) can find

package/src/lib/gitStatus.ts

@@ -7,6 +7,7 @@
 // needs a network fetch + possibly SSH auth, against the app's no-slow-ops rule).
 
 import { expandPath, findProjectRoot } from "./local.ts"
+import { spawn } from "./spawn.ts"
 
 export interface Drift {
   dirty: boolean // uncommitted working-tree changes
@@ -15,7 +16,7 @@ export interface Drift {
 
 async function git(cwd: string, args: string[]): Promise<{ ok: boolean; out: string }> {
   try {
-    const proc = Bun.spawn(["git", "-C", cwd, ...args], { stdout: "pipe", stderr: "ignore", stdin: "ignore" })
+    const proc = spawn(["git", "-C", cwd, ...args], { stdout: "pipe", stderr: "ignore", stdin: "ignore" })
     const out = await new Response(proc.stdout).text()
     const code = await proc.exited
     return { ok: code === 0, out: out.trim() }

package/src/lib/keychain.ts

@@ -7,6 +7,8 @@
 // as an argv value (-w), so it's briefly visible to `ps` on the local machine during
 // the write — acceptable for an opt-in convenience on a personal box; documented here.
 
+import { spawn } from "./spawn.ts"
+
 const SERVICE = "spinup-sudo"
 
 export function keychainAvailable(): boolean {
@@ -19,7 +21,7 @@ function account(serverId: number): string {
 
 async function security(args: string[]): Promise<{ ok: boolean; stdout: string; stderr: string }> {
   try {
-    const proc = Bun.spawn(["security", ...args], { stdin: "ignore", stdout: "pipe", stderr: "pipe" })
+    const proc = spawn(["security", ...args], { stdin: "ignore", stdout: "pipe", stderr: "pipe" })
     const [stdout, stderr, code] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text(), proc.exited])
     return { ok: code === 0, stdout, stderr }
   } catch (err) {

package/src/lib/links.ts

@@ -0,0 +1,23 @@
+// Local working-copy links, read/written outside the React store.
+//
+// The TUI's store owns an authoritative in-memory Map and persists the whole
+// map on every change (see store.tsx's persistLinks), so it doesn't need these.
+// The CLI has no store: it reads the config once and writes a single link back,
+// merging rather than replacing so a concurrent TUI session's other links
+// survive. Both paths end up in the same config key (`localSites`).
+
+import { loadConfig, saveConfig } from "../config.ts"
+import { normalizeLink, type LocalLink } from "./local.ts"
+
+// The link recorded for a site id, if any.
+export function readLink(siteId: number): LocalLink | undefined {
+  const raw = loadConfig().localSites[String(siteId)]
+  return raw ? normalizeLink(raw) : undefined
+}
+
+// Merge one link into the stored set. Re-reads the config immediately before
+// writing so we don't clobber links made since this process started.
+export async function writeLink(siteId: number, link: LocalLink): Promise<void> {
+  const current = loadConfig().localSites
+  await saveConfig({ localSites: { ...current, [String(siteId)]: normalizeLink(link) } })
+}

package/src/lib/localSetup.ts

@@ -0,0 +1,164 @@
+// Set up a brand-new local working copy for a remote SpinupWP site — the
+// missing first step before dbSync (`p`) and mediaFallback (`m`) can run.
+//
+// Gets the CODE down (git clone for git-deployed sites, an rsync pull over SSH
+// for everything else — excluding uploads/ and the server-specific caching
+// drop-ins, object-cache.php/advanced-cache.php: they're wired to production's
+// Redis/disk cache, and object-cache.php doesn't just no-op without it, it
+// fatals) and runs `composer install` locally when the checkout turns out to
+// be Bedrock/Radicle. Deliberately stops there: it never touches the local
+// database or webserver config, and never links the site itself — the caller
+// does that (reusing `linkSite`) once this succeeds, then hands off to the
+// existing dbSync (`p`) and mediaFallback (`m`) flows unchanged.
+//
+// For a public/-style webroot, wp-config.php lives ONE level above it (see
+// CLAUDE.md's WordPress layout rules) — so the rsync path always pulls the
+// site's whole files root, not just the detected webroot, so wp-config.php
+// (and anything else living beside it) comes down too. `public_folder` is a
+// SETTING, not a fact (SpinupWP never enforces it), so the real webroot is
+// detected on the source via `detectWpDirScript` rather than trusted.
+
+import { existsSync, mkdirSync, readdirSync } from "node:fs"
+import { dirname } from "node:path"
+import type { Server, Site } from "../api/types.ts"
+import { expandPath, resolveLocalLink } from "./local.ts"
+import { SSH_OPTS, sshPort, runProcess, meaningfulError } from "./dbBackup.ts"
+import { detectWpDirScript } from "./serverClone.ts"
+
+export interface LocalSetupPlan {
+  domain: string
+  isGit: boolean
+  repoUrl: string | null // git clone source, when isGit
+  user: string // SSH user — only needed for the non-git rsync path
+  host: string
+  port: number | null
+  filesRoot: string // remote /sites/{domain}/files — rsync source root
+  publicFolder: string | null // as configured; the real webroot is still detected, not trusted
+  destPath: string // expanded local destination (must not exist, or be empty)
+  destUrl: string
+}
+
+export type LocalSetupPlanResult = { ok: true; plan: LocalSetupPlan } | { ok: false; error: string }
+
+export function planLocalSetup(
+  site: Site,
+  server: Server | undefined,
+  sshUser: string | null,
+  destPath: string,
+  destUrl: string,
+): LocalSetupPlanResult {
+  const path = destPath.trim()
+  if (!path) return { ok: false, error: "Enter a local path." }
+  const dir = expandPath(path)
+  if (existsSync(dir) && readdirSync(dir).length > 0) return { ok: false, error: "That path already exists and isn't empty." }
+
+  const isGit = !!site.git?.repo
+  const host = server?.ip_address
+  const user = site.site_user ?? sshUser
+  // Non-git sites are pulled over SSH, so they need a reachable server + user.
+  // Git sites clone straight from the repo and never touch the server.
+  if (!isGit && (!host || !user)) return { ok: false, error: "Missing site user or server IP — can't reach the site." }
+
+  return {
+    ok: true,
+    plan: {
+      domain: site.domain,
+      isGit,
+      repoUrl: site.git?.repo ?? null,
+      user: user ?? "",
+      host: host ?? "",
+      port: server?.ssh_port ?? null,
+      filesRoot: `/sites/${site.domain}/files`,
+      publicFolder: site.public_folder,
+      destPath: dir,
+      destUrl: destUrl.trim(),
+    },
+  }
+}
+
+export type LocalSetupStage = "fetch" | "build" | "done" | "error"
+
+export interface LocalSetupProgress {
+  stage: LocalSetupStage
+  domain: string
+  destPath?: string
+  error?: string
+  failedStage?: LocalSetupStage
+  ranComposer?: boolean
+}
+
+export function isLocalSetupInFlight(p: LocalSetupProgress | undefined): boolean {
+  return p != null && p.stage !== "done" && p.stage !== "error"
+}
+
+// rsync the source's whole files root down, excluding uploads wherever they
+// land (relative to the detected webroot, not assumed at the files root).
+async function fetchByRsync(plan: LocalSetupPlan): Promise<{ code: number; stderr: string }> {
+  const target = `${plan.user}@${plan.host}`
+  const probeScript = `${detectWpDirScript(plan.filesRoot, plan.publicFolder ?? undefined)}; echo "D:$D"; echo "W:$W"`
+  const probe = await runProcess(["ssh", ...SSH_OPTS, ...sshPort(plan.port), target, probeScript], 30_000)
+  if (probe.code !== 0) return { code: probe.code, stderr: probe.stderr }
+  const d = probe.stdout.match(/^D:(.*)$/m)?.[1]?.trim()
+  const w = probe.stdout.match(/^W:(.*)$/m)?.[1]?.trim()
+  if (!d) return { code: 1, stderr: "couldn't determine the site's files root on the server." }
+  if (!w) return { code: 1, stderr: "couldn't find a WordPress install under this site on the server." }
+
+  // Paths relative to the files root we're about to rsync, e.g.
+  // "public/wp-content/uploads" when the webroot sits below the files root, or
+  // bare "wp-content/uploads" when it doesn't.
+  const webrootRel = w === d ? "" : w.slice(d.length).replace(/^\/+/, "")
+  const contentRel = (name: string) => (webrootRel ? `${webrootRel}/wp-content/${name}` : `wp-content/${name}`)
+  // object-cache.php (and advanced-cache.php, same family) are server drop-ins
+  // wired to production's Redis/disk cache — they don't just no-op without it,
+  // they fatal (confirmed: SpinupWP's object-cache drop-in 500s on a cache MISS
+  // when Redis is unreachable). Local dev doesn't want production caching
+  // anyway, so these are excluded outright rather than copied and hoping.
+  const excludes = ["uploads", "object-cache.php", "advanced-cache.php"].map((name) => `--exclude=${contentRel(name)}`)
+
+  const sshCmd = ["ssh", ...SSH_OPTS, ...sshPort(plan.port)].join(" ")
+  return runProcess(["rsync", "-az", "-e", sshCmd, ...excludes, `${target}:${d}/`, `${plan.destPath}/`], 600_000)
+}
+
+export async function runLocalSetup(plan: LocalSetupPlan, onProgress: (p: LocalSetupProgress) => void): Promise<LocalSetupProgress> {
+  const domain = plan.domain
+  const fail = (error: string, failedStage: LocalSetupStage = "fetch"): LocalSetupProgress => {
+    const p: LocalSetupProgress = { stage: "error", domain, error, failedStage }
+    onProgress(p)
+    return p
+  }
+  const stageFail = (label: string, stderr: string, fallback: string, failedStage: LocalSetupStage) =>
+    fail(`${label} — ${meaningfulError(stderr, fallback)}`, failedStage)
+
+  onProgress({ stage: "fetch", domain })
+  try {
+    mkdirSync(dirname(plan.destPath), { recursive: true })
+  } catch {
+    // best-effort — the actual clone/rsync surfaces a real error if this truly can't be created
+  }
+
+  if (plan.isGit) {
+    if (!plan.repoUrl) return fail("This site has no git repo configured in SpinupWP.", "fetch")
+    const cl = await runProcess(["git", "clone", plan.repoUrl, plan.destPath], 300_000)
+    if (cl.code !== 0) return stageFail("git clone failed", cl.stderr, `exit ${cl.code}.`, "fetch")
+  } else {
+    mkdirSync(plan.destPath, { recursive: true })
+    const rs = await fetchByRsync(plan)
+    if (rs.code !== 0) return stageFail("File pull failed", rs.stderr, `exit ${rs.code}.`, "fetch")
+  }
+
+  // Bedrock/Radicle needs `composer install` to build vendor/ + web/wp before
+  // anything (wp-cli included) can find a WordPress install in the checkout.
+  // Standard WP ships its core in the tree already, so this is a no-op there.
+  const kind = resolveLocalLink({ domain, path: plan.destPath, localUrl: plan.destUrl }).kind
+  let ranComposer = false
+  if (kind === "bedrock" || kind === "radicle") {
+    onProgress({ stage: "build", domain })
+    const ci = await runProcess(["bash", "-lc", "composer install"], 300_000, plan.destPath)
+    if (ci.code !== 0) return stageFail("composer install failed", ci.stderr, "composer error.", "build")
+    ranComposer = true
+  }
+
+  const done: LocalSetupProgress = { stage: "done", domain, destPath: plan.destPath, ranComposer }
+  onProgress(done)
+  return done
+}

package/src/lib/open.ts

@@ -1,11 +1,13 @@
 // Open a URL in the user's default browser, cross-platform. Best-effort; never throws.
 
+import { spawn } from "./spawn.ts"
+
 export function openUrl(url: string): void {
   try {
     const platform = process.platform
     const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open"
     const args = platform === "win32" ? ["/c", "start", "", url] : [url]
-    Bun.spawn([cmd, ...args], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+    spawn([cmd, ...args], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
   } catch {
     // ignore — opening a browser is a convenience, not critical
   }
@@ -18,7 +20,7 @@ export function copyToClipboard(text: string): void {
   try {
     const platform = process.platform
     const cmd = platform === "darwin" ? ["pbcopy"] : platform === "win32" ? ["clip"] : ["xclip", "-selection", "clipboard"]
-    const proc = Bun.spawn(cmd, { stdin: "pipe", stdout: "ignore", stderr: "ignore" })
+    const proc = spawn(cmd, { stdin: "pipe", stdout: "ignore", stderr: "ignore" })
     proc.stdin.write(text)
     void proc.stdin.end()
   } catch {
@@ -71,11 +73,11 @@ export function openSshSession(user: string, host: string, port?: number | null,
         app === "iTerm"
           ? ["-e", `tell application "iTerm"\ncreate window with default profile command "${esc}"\nactivate\nend tell`]
           : ["-e", `tell application "Terminal" to do script "${esc}"`, "-e", `tell application "Terminal" to activate`]
-      Bun.spawn(["osascript", ...args], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+      spawn(["osascript", ...args], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
     } else if (platform === "win32") {
-      Bun.spawn(["cmd", "/c", "start", "cmd", "/k", cmd], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+      spawn(["cmd", "/c", "start", "cmd", "/k", cmd], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
     } else {
-      Bun.spawn(["x-terminal-emulator", "-e", cmd], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+      spawn(["x-terminal-emulator", "-e", cmd], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
     }
   } catch {
     // ignore — opening a shell is a convenience, not critical
@@ -90,12 +92,12 @@ export function openTerminalAt(dir: string, terminalApp?: string | null): void {
   try {
     const platform = process.platform
     if (platform === "darwin") {
-      Bun.spawn(["open", "-a", resolveTerminalApp(terminalApp), dir], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+      spawn(["open", "-a", resolveTerminalApp(terminalApp), dir], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
     } else if (platform === "win32") {
-      Bun.spawn(["cmd", "/c", "start", "cmd", "/k", `cd /d ${dir}`], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+      spawn(["cmd", "/c", "start", "cmd", "/k", `cd /d ${dir}`], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
     } else {
       // Try a few common terminal emulators; the first that exists wins.
-      Bun.spawn(["x-terminal-emulator", "--working-directory", dir], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+      spawn(["x-terminal-emulator", "--working-directory", dir], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
     }
   } catch {
     // ignore — opening a terminal is a convenience, not critical

package/src/lib/probe.ts

@@ -19,6 +19,7 @@
 import type { Server, Site } from "../api/types.ts"
 import { detectWpDirScript } from "./serverClone.ts"
 import { theme } from "./theme.ts"
+import { spawn } from "./spawn.ts"
 
 export type ProbeKind = "wordpress" | "bedrock" | "radicle" | "whmcs" | "laravel" | "static" | "unknown"
 
@@ -117,7 +118,7 @@ export async function probeSite(
 
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, target, buildRemoteScript(site.domain, site.public_folder)], {
+    proc = spawn(["ssh", ...SSH_OPTS, target, buildRemoteScript(site.domain, site.public_folder)], {
       stdout: "pipe",
       stderr: "pipe",
       stdin: "ignore",

package/src/lib/serverClone.ts

@@ -12,6 +12,7 @@
 
 import type { Server } from "../api/types.ts"
 import { wpCliResolveScript } from "./wpCli.ts"
+import { spawn } from "./spawn.ts"
 
 const SSH_OPTS = ["-o", "BatchMode=yes", "-o", "ConnectTimeout=10", "-o", "StrictHostKeyChecking=accept-new"]
 
@@ -42,7 +43,7 @@ export async function sudoExec(
   const ctrl = new AbortController()
   const timer = setTimeout(() => ctrl.abort(), timeoutMs)
   try {
-    const proc = Bun.spawn(["ssh", ...SSH_OPTS, ...portOpt, target, "sudo -S -p '' bash -s"], {
+    const proc = spawn(["ssh", ...SSH_OPTS, ...portOpt, target, "sudo -S -p '' bash -s"], {
       stdin: "pipe",
       stdout: "pipe",
       stderr: "pipe",
@@ -853,7 +854,7 @@ async function wpFacts(ctx: SudoCtx, root: string, user: string, phpVersion?: st
 // `curl --resolve` checks). 2xx/3xx counts as serving.
 async function curlStatus(domain: string, ip: string): Promise<string> {
   try {
-    const proc = Bun.spawn(
+    const proc = spawn(
       ["curl", "-sS", "-o", "/dev/null", "-m", "20", "-w", "%{http_code}", "-L", "--resolve", `${domain}:80:${ip}`, "--resolve", `${domain}:443:${ip}`, `http://${domain}/`],
       { stdout: "pipe", stderr: "pipe" },
     )

package/src/lib/spawn.ts

@@ -0,0 +1,17 @@
+// The one way this app starts a child process.
+//
+// Bun.spawn with no `env` option hands the child Bun's *startup* environment,
+// ignoring anything deleted from process.env since — and so do Bun.spawnSync and
+// node:child_process (all confirmed on Bun 1.3.14). That defeats the startup scrub
+// of the launch directory's .env (see cwdDotenv.ts): a site checkout's DB_* values
+// would still reach `wp`. Passing `env: process.env` does honor the deletions, so
+// this wrapper defaults it. A caller's explicit `env` still wins.
+//
+// `bun run typecheck` fails on any direct Bun.spawn/spawnSync or child_process use
+// outside this file, so new call sites can't quietly bypass it.
+
+export const spawn = ((cmd: unknown, opts?: { env?: unknown }) => {
+  if (Array.isArray(cmd)) return Bun.spawn(cmd, { ...opts, env: opts?.env ?? process.env } as never)
+  const o = cmd as { env?: unknown }
+  return Bun.spawn({ ...o, env: o.env ?? process.env } as never)
+}) as typeof Bun.spawn

package/src/lib/ssh.ts

@@ -15,6 +15,7 @@ import { existsSync, readFileSync, readdirSync } from "node:fs"
 import { mkdir, chmod } from "node:fs/promises"
 import { keysDir } from "../config.ts"
 import type { Server, Site } from "../api/types.ts"
+import { spawn } from "./spawn.ts"
 
 export interface CpuCore {
   idx: number
@@ -122,7 +123,7 @@ export async function fetchRebootInfo(
 
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, target, REBOOT_SCRIPT], { stdout: "pipe", stderr: "pipe", stdin: "ignore" })
+    proc = spawn(["ssh", ...SSH_OPTS, target, REBOOT_SCRIPT], { stdout: "pipe", stderr: "pipe", stdin: "ignore" })
   } catch (err) {
     return { ok: false, target, error: `Failed to launch ssh: ${(err as Error).message}` }
   }
@@ -161,7 +162,7 @@ export async function fetchServerHealth(
 
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, target, REMOTE_SCRIPT], {
+    proc = spawn(["ssh", ...SSH_OPTS, target, REMOTE_SCRIPT], {
       stdout: "pipe",
       stderr: "pipe",
       stdin: "ignore",
@@ -258,7 +259,7 @@ export async function ensureSpinupKey(): Promise<{ path: string; pub: string; co
     return { path, pub: readFileSync(pub, "utf8").trim(), comment }
   }
   await mkdir(keysDir(), { recursive: true })
-  const proc = Bun.spawn(
+  const proc = spawn(
     ["ssh-keygen", "-t", "ed25519", "-N", "", "-C", comment, "-f", path],
     { stdout: "pipe", stderr: "pipe", stdin: "ignore" },
   )
@@ -360,7 +361,7 @@ async function runSshStdin(
   const portOpt = port && port !== 22 ? ["-p", String(port)] : []
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, ...portOpt, target, remoteCmd], {
+    proc = spawn(["ssh", ...SSH_OPTS, ...portOpt, target, remoteCmd], {
       stdout: "pipe",
       stderr: "pipe",
       stdin: stdinPayload == null ? "ignore" : "pipe",
@@ -576,7 +577,7 @@ export async function listPersonalKeys(): Promise<GrantableKey[]> {
 
   // ssh-agent (keys the user has loaded). Best-effort; ignore if no agent.
   try {
-    const proc = Bun.spawn(["ssh-add", "-L"], { stdout: "pipe", stderr: "ignore", stdin: "ignore" })
+    const proc = spawn(["ssh-add", "-L"], { stdout: "pipe", stderr: "ignore", stdin: "ignore" })
     const code = await proc.exited
     if (code === 0) {
       const out = await new Response(proc.stdout as ReadableStream<Uint8Array>).text()

package/src/lib/sshExec.ts

@@ -12,6 +12,7 @@ import { resolveSshTargetInfo, type SshAccessReason, type SshAccessCandidate } f
 import { SSH_OPTS } from "./probe.ts"
 import { classifySshCommand } from "./sshExecPolicy.ts"
 import { logSshExecAttempt } from "./sshExecLog.ts"
+import { spawn } from "./spawn.ts"
 
 export type SshExecReason = SshAccessReason | "command_denied"
 
@@ -44,8 +45,9 @@ export async function execSshCommand(
   command: string,
   client: SpinupWPClientLike,
   cfg: AppConfig,
+  opts?: { server?: string | null },
 ): Promise<SshExecResult> {
-  const resolution = await resolveSshTargetInfo(domain, client, cfg)
+  const resolution = await resolveSshTargetInfo(domain, client, cfg, opts)
   if (!resolution.ok) {
     logSshExecAttempt({ domain, command, decision: "error", reason: resolution.result.reason, message: resolution.result.message })
     return { ...resolution.result, command }
@@ -62,7 +64,7 @@ export async function execSshCommand(
   const start = Date.now()
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, ...portOpt, sshTarget, command], {
+    proc = spawn(["ssh", ...SSH_OPTS, ...portOpt, sshTarget, command], {
       stdout: "pipe",
       stderr: "pipe",
       stdin: "ignore",

package/src/lib/wpInventory.ts

@@ -12,6 +12,7 @@ import type { Server, Site } from "../api/types.ts"
 import { SSH_OPTS, sshPort } from "./dbBackup.ts"
 import { detectWpDirScript } from "./serverClone.ts"
 import { wpCliResolveScript } from "./wpCli.ts"
+import { spawn } from "./spawn.ts"
 
 // One plugin or theme, mirroring `wp {plugin,theme} list` columns.
 export interface WpItem {
@@ -116,7 +117,7 @@ export async function fetchWpInventory(
 
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, ...sshPort(server.ssh_port ?? null), target, remote], {
+    proc = spawn(["ssh", ...SSH_OPTS, ...sshPort(server.ssh_port ?? null), target, remote], {
       stdout: "pipe",
       stderr: "pipe",
       stdin: "ignore",

package/src/ui/App.tsx

@@ -30,6 +30,7 @@ import { NewServer } from "./views/NewServer.tsx"
 import { VanityNewSite } from "./views/VanityNewSite.tsx"
 import { CloneWizard } from "./views/CloneWizard.tsx"
 import { LocalLinkOverlay } from "./views/LocalLink.tsx"
+import { LocalSetupOverlay } from "./views/LocalSetup.tsx"
 import { Discover } from "./views/Discover.tsx"
 import { Forgotten } from "./views/Forgotten.tsx"
 import { DnsInventory } from "./views/DnsInventory.tsx"
@@ -75,6 +76,7 @@ export function App() {
     store.vanityServer !== null ||
     store.cloneServer !== null ||
     store.localLinkSite !== null ||
+    store.localSetupSite !== null ||
     store.discoverOpen ||
     store.forgottenOpen ||
     store.dnsInventoryServer !== null ||
@@ -166,6 +168,9 @@ export function App() {
     // The local-link overlay owns the keyboard while open.
     if (store.localLinkSite) return
 
+    // The new-local-copy (clone/rsync) overlay owns the keyboard while open.
+    if (store.localSetupSite) return
+
     // The discovery overlay owns the keyboard while open.
     if (store.discoverOpen) return
 
@@ -256,6 +261,7 @@ export function App() {
       {store.vanityServer && <VanityNewSite />}
       {store.cloneServer && <CloneWizard />}
       {store.localLinkSite && <LocalLinkOverlay />}
+      {store.localSetupSite && <LocalSetupOverlay />}
       {store.discoverOpen && <Discover />}
       {store.forgottenOpen && <Forgotten />}
       {store.dnsInventoryServer && <DnsInventory />}