spinuptui 0.26.0 → 0.26.1

package/CHANGELOG.md

@@ -11,6 +11,13 @@ versions; such changes are called out here.
 
 ## [Unreleased]
 
+## [0.26.1] - 2026-09-18
+
+### Fixed
+- **`pull db` (and every other local command) now works when spinuptui is launched from inside a site's checkout.** Bun auto-loads the current directory's `.env`, and child processes inherited it, so a Bedrock site's own `DB_*` values reached `wp` as environment variables. Bedrock then read blank database credentials, and the pre-import backup failed with `Access denied for user '<you>'@'localhost' (using password: NO)`. Keys from that `.env` are now dropped at startup, except the ones spinuptui reads itself (its token and Uptime Kuma settings; provider credentials are covered below).
+- **`pull db`'s "Access denied" hint now points Bedrock and Radicle sites at their `.env`.** It used to blame `wp-config.php` for every site, but those stacks keep their database credentials in `.env`. The hint also mentions that a `DB_*` variable exported in the shell can override that file.
+- **A site's `.env` can no longer supply spinuptui's DNS provider credentials.** Launched from inside a site checkout, spinuptui read that site's `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` (which Bedrock sites commonly use for S3 media) as its own Route 53 credentials, silently overriding the ones in config. Provider keys (`AWS_*`, `CLOUDFLARE_API_TOKEN`, `GODADDY_API_*`) from a `.env` are now honored only in spinuptui's own project directory; keys exported in the shell work from anywhere, as before.
+
 ## [0.26.0] - 2026-08-26
 
 ### Added
@@ -1408,7 +1415,8 @@ Initial tagged release.
 ### Notes
 - Read-only release: works with a SpinupWP **Read Only** API token.
 
-[Unreleased]: https://github.com/mwender/spinupwp-tui/compare/v0.26.0...HEAD
+[Unreleased]: https://github.com/mwender/spinupwp-tui/compare/v0.26.1...HEAD
+[0.26.1]: https://github.com/mwender/spinupwp-tui/compare/v0.26.0...v0.26.1
 [0.26.0]: https://github.com/mwender/spinupwp-tui/compare/v0.25.0...v0.26.0
 [0.25.0]: https://github.com/mwender/spinupwp-tui/compare/v0.24.4...v0.25.0
 [0.24.4]: https://github.com/mwender/spinupwp-tui/compare/v0.24.3...v0.24.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spinuptui",
-  "version": "0.26.0",
+  "version": "0.26.1",
   "description": "SpinupTUI — a terminal dashboard for browsing, monitoring, and managing your SpinupWP servers and sites.",
   "type": "module",
   "bin": {
@@ -24,7 +24,8 @@
   "scripts": {
     "dev": "bun run src/index.tsx",
     "start": "bun run src/index.tsx",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --noEmit && bun run check:spawn",
+    "check:spawn": "! grep -rnaE \"Bun\\\\.spawn(Sync)?\\\\(|child_process\" src --exclude=spawn.ts || (echo \"Use spawn() from src/lib/spawn.ts instead (see that file)\" >&2; exit 1)",
     "link-global": "bun link",
     "unlink-global": "bun unlink",
     "build:binary": "bun build src/index.tsx --compile --outfile spinuptui"

package/src/index.tsx

@@ -3,6 +3,9 @@
 // OpenTUI renderer and mounts either the first-run onboarding wizard (no token
 // yet) or the main app wrapped in the data store.
 
+// First, before any config read or spawn: keep a site checkout's .env from
+// leaking into child processes (see the module).
+import "./lib/cwdDotenv.ts"
 import { useState } from "react"
 import { createCliRenderer } from "@opentui/core"
 import { createRoot } from "@opentui/react"

package/src/lib/appUpdate.ts

@@ -11,6 +11,7 @@ import { join, sep } from "node:path"
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs"
 import { configDir } from "../config.ts"
 import { REPO_SLUG } from "../version.ts"
+import { spawn } from "./spawn.ts"
 
 const CACHE_VERSION = 1
 const TTL_MS = 6 * 60 * 60 * 1000 // 6 hours
@@ -161,7 +162,7 @@ function checkoutRoot(): string {
 }
 
 async function git(cwd: string, args: string[]): Promise<{ code: number; stdout: string; stderr: string }> {
-  const proc = Bun.spawn(["git", "-C", cwd, ...args], { stdout: "pipe", stderr: "pipe", stdin: "ignore" })
+  const proc = spawn(["git", "-C", cwd, ...args], { stdout: "pipe", stderr: "pipe", stdin: "ignore" })
   const [stdout, stderr, code] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text(), proc.exited])
   return { code, stdout: stdout.trim(), stderr: stderr.trim() }
 }

package/src/lib/cliPull.ts

@@ -351,17 +351,22 @@ export async function runPullDb(
 
   if (result.stage === "error") {
     const error = result.error ?? "The sync failed."
-    // The overwhelmingly likely cause right after `pull files`: the copied
-    // wp-config.php still carries production's DB credentials, so local wp-cli
-    // authenticates as the production user against the local MySQL.
+    // Standard WP: the overwhelmingly likely cause right after `pull files` is the
+    // copied wp-config.php still carrying production's DB credentials, so local
+    // wp-cli authenticates as the production user against the local MySQL.
+    // Bedrock/Radicle keep credentials in .env instead (never pulled), and a
+    // DB_* variable exported in the shell can shadow that file.
     const deniedAs = /access denied for user '([^']+)'/i.exec(error)?.[1]
+    const envBased = plan.localKind === "bedrock" || plan.localKind === "radicle"
     return {
       ...fail(
         "sync_failed",
         error,
-        deniedAs
-          ? `Local MySQL refused the user "${deniedAs}". If this copy came from \`pull files\`, its wp-config.php still holds production's database credentials — point DB_NAME / DB_USER / DB_PASSWORD / DB_HOST at your local database and re-run.`
-          : undefined,
+        !deniedAs
+          ? undefined
+          : envBased
+            ? `Local MySQL refused the user "${deniedAs}". This is a ${plan.localKind} checkout, so its database credentials live in ${join(plan.localRoot, ".env")} — point DB_NAME / DB_USER / DB_PASSWORD / DB_HOST there at your local database and re-run. A DB_* variable exported in your shell can override that file, so check \`env | grep ^DB_\` too.`
+            : `Local MySQL refused the user "${deniedAs}". If this copy came from \`pull files\`, its wp-config.php still holds production's database credentials — point DB_NAME / DB_USER / DB_PASSWORD / DB_HOST at your local database and re-run.`,
       ),
       ...(result.failedStage ? { failedStage: result.failedStage } : {}),
     }

package/src/lib/cliSsh.ts

@@ -9,6 +9,7 @@ import type { Server, Site } from "../api/types.ts"
 import type { SpinupWPClientLike } from "../api/client.ts"
 import { ApiError } from "../api/client.ts"
 import { resolveSiteSshTarget, SSH_OPTS } from "./probe.ts"
+import { spawn } from "./spawn.ts"
 
 export type SshAccessReason =
   | "no_token"
@@ -181,7 +182,7 @@ export async function resolveSshAccess(
 
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, ...portOpt, target, "true"], {
+    proc = spawn(["ssh", ...SSH_OPTS, ...portOpt, target, "true"], {
       stdout: "pipe",
       stderr: "pipe",
       stdin: "ignore",

package/src/lib/cwdDotenv.ts

@@ -0,0 +1,106 @@
+// Keep the current directory's .env out of the processes we spawn.
+//
+// Bun auto-loads .env files from the directory it was launched in, and every
+// spawned child inherits process.env. Run spinuptui from inside a site's checkout
+// and that site's own .env — DB_NAME, DB_USER, DB_PASSWORD, WP_HOME — rides along
+// into `bash -lc "wp …"`. A Bedrock config then reads *nothing*: its phpdotenv
+// repository is immutable, so it skips keys that already exist in the
+// environment, while `Env::$options` with USE_ENV_ARRAY reads only $_ENV — which
+// PHP leaves empty for inherited variables when variables_order lacks "E" (the
+// Homebrew default). Every DB constant comes out blank, and `wp db export` fails
+// as "Access denied for user '<login name>'@'localhost' (using password: NO)".
+//
+// So: drop every key those files defined, except the ones this app reads itself —
+// its token and provider credentials may legitimately live in a project-local
+// .env (see config.ts). The provider keys have generic names a site's .env uses
+// too (Bedrock keeps S3 media credentials under AWS_*), so those are only trusted
+// from spinuptui's own project directory. Deleting from process.env only reaches children that are
+// handed process.env explicitly, which is what src/lib/spawn.ts is for. Must run
+// before anything reads config or spawns, which is why index.tsx imports this
+// module first.
+
+import { existsSync, readFileSync, realpathSync } from "node:fs"
+import { join } from "node:path"
+
+// Keys spinuptui reads from the environment on purpose. Only spinuptui uses the
+// SPINUP* names, so they're kept from any directory's .env.
+const OWN = /^SPINUP/
+
+// Provider credentials spinuptui also reads (config.ts). Kept only from the .env
+// in spinuptui's own project directory — anywhere else they're a site's keys.
+const PROVIDER = /^(CLOUDFLARE_API_TOKEN|AWS_(ACCESS_KEY_ID|SECRET_ACCESS_KEY|REGION)|GODADDY_API_(KEY|SECRET))$/
+
+// This file lives in <project>/src/lib.
+const PROJECT_DIR = join(import.meta.dir, "..", "..")
+
+function isProjectDir(dir: string): boolean {
+  try {
+    return realpathSync(dir) === realpathSync(PROJECT_DIR)
+  } catch {
+    return false
+  }
+}
+
+// Never removed, whatever a .env says: the spawned shells need these to work.
+const ESSENTIAL = new Set(["PATH", "HOME", "USER", "LOGNAME", "SHELL", "TMPDIR", "TERM", "LANG", "SSH_AUTH_SOCK", "XDG_CONFIG_HOME"])
+
+// The files Bun loads, in increasing precedence: .env, .env.<NODE_ENV> (default
+// development), then .env.local (skipped under test).
+function loadedFiles(cwd: string): string[] {
+  const mode = process.env.NODE_ENV || "development"
+  const names = [".env", `.env.${mode}`]
+  if (mode !== "test") names.push(".env.local")
+  return names.map((n) => join(cwd, n)).filter((p) => existsSync(p))
+}
+
+// Each key with the value the file gives it, or null where that value can't be
+// read with certainty (variable expansion, escapes, multi-line quotes). The value
+// only matters for telling a .env key from a shell one; see scrubCwdDotenv.
+export function dotenvEntries(text: string): Map<string, string | null> {
+  const out = new Map<string, string | null>()
+  for (const m of text.matchAll(/^[ \t]*(?:export[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*=(.*)$/gm)) {
+    out.set(m[1]!, dotenvValue(m[2]!.trim()))
+  }
+  return out
+}
+
+function dotenvValue(raw: string): string | null {
+  const q = raw[0]
+  if (q === "'" || q === "`" || q === '"') {
+    const end = raw.indexOf(q, 1)
+    if (end < 0) return null
+    const inner = raw.slice(1, end)
+    return q === '"' && /[$\\]/.test(inner) ? null : inner
+  }
+  const value = raw.replace(/\s+#.*$/, "").trim()
+  return value.includes("$") ? null : value
+}
+
+// Returns the keys removed, for tests and debugging.
+export function scrubCwdDotenv(cwd = process.cwd()): string[] {
+  // Later files win, as they do in Bun.
+  const entries = new Map<string, string | null>()
+  for (const file of loadedFiles(cwd)) {
+    let text: string
+    try {
+      text = readFileSync(file, "utf8")
+    } catch {
+      continue
+    }
+    for (const [key, value] of dotenvEntries(text)) entries.set(key, value)
+  }
+  const ownDir = isProjectDir(cwd)
+  const removed: string[] = []
+  for (const [key, value] of entries) {
+    if (OWN.test(key) || (ownDir && PROVIDER.test(key)) || ESSENTIAL.has(key) || !(key in process.env)) continue
+    // Bun never overrides a variable the shell already set, so a value that differs
+    // from the file's came from the shell — keep it. When the file's value can't be
+    // read with certainty, assume it's the file's and drop it.
+    if (value !== null && process.env[key] !== value) continue
+    delete process.env[key]
+    removed.push(key)
+  }
+  return removed
+}
+
+scrubCwdDotenv()

package/src/lib/dbBackup.ts

@@ -14,6 +14,7 @@ import { existsSync, mkdirSync, statSync } from "node:fs"
 import { join } from "node:path"
 import type { Server, Site } from "../api/types.ts"
 import { expandPath, type LocalLink } from "./local.ts"
+import { spawn } from "./spawn.ts"
 
 export const SSH_OPTS = ["-o", "BatchMode=yes", "-o", "ConnectTimeout=10", "-o", "StrictHostKeyChecking=accept-new"]
 
@@ -114,7 +115,7 @@ export async function runProcess(
 ): Promise<{ code: number; stderr: string; stdout: string }> {
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(cmd, { stdout: "pipe", stderr: "pipe", stdin: "ignore", cwd, env })
+    proc = spawn(cmd, { stdout: "pipe", stderr: "pipe", stdin: "ignore", cwd, env })
   } catch (err) {
     return { code: -1, stderr: `Failed to launch ${cmd[0]}: ${(err as Error).message}`, stdout: "" }
   }

package/src/lib/gitStatus.ts

@@ -7,6 +7,7 @@
 // needs a network fetch + possibly SSH auth, against the app's no-slow-ops rule).
 
 import { expandPath, findProjectRoot } from "./local.ts"
+import { spawn } from "./spawn.ts"
 
 export interface Drift {
   dirty: boolean // uncommitted working-tree changes
@@ -15,7 +16,7 @@ export interface Drift {
 
 async function git(cwd: string, args: string[]): Promise<{ ok: boolean; out: string }> {
   try {
-    const proc = Bun.spawn(["git", "-C", cwd, ...args], { stdout: "pipe", stderr: "ignore", stdin: "ignore" })
+    const proc = spawn(["git", "-C", cwd, ...args], { stdout: "pipe", stderr: "ignore", stdin: "ignore" })
     const out = await new Response(proc.stdout).text()
     const code = await proc.exited
     return { ok: code === 0, out: out.trim() }

package/src/lib/keychain.ts

@@ -7,6 +7,8 @@
 // as an argv value (-w), so it's briefly visible to `ps` on the local machine during
 // the write — acceptable for an opt-in convenience on a personal box; documented here.
 
+import { spawn } from "./spawn.ts"
+
 const SERVICE = "spinup-sudo"
 
 export function keychainAvailable(): boolean {
@@ -19,7 +21,7 @@ function account(serverId: number): string {
 
 async function security(args: string[]): Promise<{ ok: boolean; stdout: string; stderr: string }> {
   try {
-    const proc = Bun.spawn(["security", ...args], { stdin: "ignore", stdout: "pipe", stderr: "pipe" })
+    const proc = spawn(["security", ...args], { stdin: "ignore", stdout: "pipe", stderr: "pipe" })
     const [stdout, stderr, code] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text(), proc.exited])
     return { ok: code === 0, stdout, stderr }
   } catch (err) {

package/src/lib/open.ts

@@ -1,11 +1,13 @@
 // Open a URL in the user's default browser, cross-platform. Best-effort; never throws.
 
+import { spawn } from "./spawn.ts"
+
 export function openUrl(url: string): void {
   try {
     const platform = process.platform
     const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open"
     const args = platform === "win32" ? ["/c", "start", "", url] : [url]
-    Bun.spawn([cmd, ...args], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+    spawn([cmd, ...args], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
   } catch {
     // ignore — opening a browser is a convenience, not critical
   }
@@ -18,7 +20,7 @@ export function copyToClipboard(text: string): void {
   try {
     const platform = process.platform
     const cmd = platform === "darwin" ? ["pbcopy"] : platform === "win32" ? ["clip"] : ["xclip", "-selection", "clipboard"]
-    const proc = Bun.spawn(cmd, { stdin: "pipe", stdout: "ignore", stderr: "ignore" })
+    const proc = spawn(cmd, { stdin: "pipe", stdout: "ignore", stderr: "ignore" })
     proc.stdin.write(text)
     void proc.stdin.end()
   } catch {
@@ -71,11 +73,11 @@ export function openSshSession(user: string, host: string, port?: number | null,
         app === "iTerm"
           ? ["-e", `tell application "iTerm"\ncreate window with default profile command "${esc}"\nactivate\nend tell`]
           : ["-e", `tell application "Terminal" to do script "${esc}"`, "-e", `tell application "Terminal" to activate`]
-      Bun.spawn(["osascript", ...args], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+      spawn(["osascript", ...args], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
     } else if (platform === "win32") {
-      Bun.spawn(["cmd", "/c", "start", "cmd", "/k", cmd], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+      spawn(["cmd", "/c", "start", "cmd", "/k", cmd], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
     } else {
-      Bun.spawn(["x-terminal-emulator", "-e", cmd], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+      spawn(["x-terminal-emulator", "-e", cmd], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
     }
   } catch {
     // ignore — opening a shell is a convenience, not critical
@@ -90,12 +92,12 @@ export function openTerminalAt(dir: string, terminalApp?: string | null): void {
   try {
     const platform = process.platform
     if (platform === "darwin") {
-      Bun.spawn(["open", "-a", resolveTerminalApp(terminalApp), dir], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+      spawn(["open", "-a", resolveTerminalApp(terminalApp), dir], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
     } else if (platform === "win32") {
-      Bun.spawn(["cmd", "/c", "start", "cmd", "/k", `cd /d ${dir}`], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+      spawn(["cmd", "/c", "start", "cmd", "/k", `cd /d ${dir}`], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
     } else {
       // Try a few common terminal emulators; the first that exists wins.
-      Bun.spawn(["x-terminal-emulator", "--working-directory", dir], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+      spawn(["x-terminal-emulator", "--working-directory", dir], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
     }
   } catch {
     // ignore — opening a terminal is a convenience, not critical

package/src/lib/probe.ts

@@ -19,6 +19,7 @@
 import type { Server, Site } from "../api/types.ts"
 import { detectWpDirScript } from "./serverClone.ts"
 import { theme } from "./theme.ts"
+import { spawn } from "./spawn.ts"
 
 export type ProbeKind = "wordpress" | "bedrock" | "radicle" | "whmcs" | "laravel" | "static" | "unknown"
 
@@ -117,7 +118,7 @@ export async function probeSite(
 
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, target, buildRemoteScript(site.domain, site.public_folder)], {
+    proc = spawn(["ssh", ...SSH_OPTS, target, buildRemoteScript(site.domain, site.public_folder)], {
       stdout: "pipe",
       stderr: "pipe",
       stdin: "ignore",

package/src/lib/serverClone.ts

@@ -12,6 +12,7 @@
 
 import type { Server } from "../api/types.ts"
 import { wpCliResolveScript } from "./wpCli.ts"
+import { spawn } from "./spawn.ts"
 
 const SSH_OPTS = ["-o", "BatchMode=yes", "-o", "ConnectTimeout=10", "-o", "StrictHostKeyChecking=accept-new"]
 
@@ -42,7 +43,7 @@ export async function sudoExec(
   const ctrl = new AbortController()
   const timer = setTimeout(() => ctrl.abort(), timeoutMs)
   try {
-    const proc = Bun.spawn(["ssh", ...SSH_OPTS, ...portOpt, target, "sudo -S -p '' bash -s"], {
+    const proc = spawn(["ssh", ...SSH_OPTS, ...portOpt, target, "sudo -S -p '' bash -s"], {
       stdin: "pipe",
       stdout: "pipe",
       stderr: "pipe",
@@ -853,7 +854,7 @@ async function wpFacts(ctx: SudoCtx, root: string, user: string, phpVersion?: st
 // `curl --resolve` checks). 2xx/3xx counts as serving.
 async function curlStatus(domain: string, ip: string): Promise<string> {
   try {
-    const proc = Bun.spawn(
+    const proc = spawn(
       ["curl", "-sS", "-o", "/dev/null", "-m", "20", "-w", "%{http_code}", "-L", "--resolve", `${domain}:80:${ip}`, "--resolve", `${domain}:443:${ip}`, `http://${domain}/`],
       { stdout: "pipe", stderr: "pipe" },
     )

package/src/lib/spawn.ts

@@ -0,0 +1,17 @@
+// The one way this app starts a child process.
+//
+// Bun.spawn with no `env` option hands the child Bun's *startup* environment,
+// ignoring anything deleted from process.env since — and so do Bun.spawnSync and
+// node:child_process (all confirmed on Bun 1.3.14). That defeats the startup scrub
+// of the launch directory's .env (see cwdDotenv.ts): a site checkout's DB_* values
+// would still reach `wp`. Passing `env: process.env` does honor the deletions, so
+// this wrapper defaults it. A caller's explicit `env` still wins.
+//
+// `bun run typecheck` fails on any direct Bun.spawn/spawnSync or child_process use
+// outside this file, so new call sites can't quietly bypass it.
+
+export const spawn = ((cmd: unknown, opts?: { env?: unknown }) => {
+  if (Array.isArray(cmd)) return Bun.spawn(cmd, { ...opts, env: opts?.env ?? process.env } as never)
+  const o = cmd as { env?: unknown }
+  return Bun.spawn({ ...o, env: o.env ?? process.env } as never)
+}) as typeof Bun.spawn

package/src/lib/ssh.ts

@@ -15,6 +15,7 @@ import { existsSync, readFileSync, readdirSync } from "node:fs"
 import { mkdir, chmod } from "node:fs/promises"
 import { keysDir } from "../config.ts"
 import type { Server, Site } from "../api/types.ts"
+import { spawn } from "./spawn.ts"
 
 export interface CpuCore {
   idx: number
@@ -122,7 +123,7 @@ export async function fetchRebootInfo(
 
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, target, REBOOT_SCRIPT], { stdout: "pipe", stderr: "pipe", stdin: "ignore" })
+    proc = spawn(["ssh", ...SSH_OPTS, target, REBOOT_SCRIPT], { stdout: "pipe", stderr: "pipe", stdin: "ignore" })
   } catch (err) {
     return { ok: false, target, error: `Failed to launch ssh: ${(err as Error).message}` }
   }
@@ -161,7 +162,7 @@ export async function fetchServerHealth(
 
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, target, REMOTE_SCRIPT], {
+    proc = spawn(["ssh", ...SSH_OPTS, target, REMOTE_SCRIPT], {
       stdout: "pipe",
       stderr: "pipe",
       stdin: "ignore",
@@ -258,7 +259,7 @@ export async function ensureSpinupKey(): Promise<{ path: string; pub: string; co
     return { path, pub: readFileSync(pub, "utf8").trim(), comment }
   }
   await mkdir(keysDir(), { recursive: true })
-  const proc = Bun.spawn(
+  const proc = spawn(
     ["ssh-keygen", "-t", "ed25519", "-N", "", "-C", comment, "-f", path],
     { stdout: "pipe", stderr: "pipe", stdin: "ignore" },
   )
@@ -360,7 +361,7 @@ async function runSshStdin(
   const portOpt = port && port !== 22 ? ["-p", String(port)] : []
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, ...portOpt, target, remoteCmd], {
+    proc = spawn(["ssh", ...SSH_OPTS, ...portOpt, target, remoteCmd], {
       stdout: "pipe",
       stderr: "pipe",
       stdin: stdinPayload == null ? "ignore" : "pipe",
@@ -576,7 +577,7 @@ export async function listPersonalKeys(): Promise<GrantableKey[]> {
 
   // ssh-agent (keys the user has loaded). Best-effort; ignore if no agent.
   try {
-    const proc = Bun.spawn(["ssh-add", "-L"], { stdout: "pipe", stderr: "ignore", stdin: "ignore" })
+    const proc = spawn(["ssh-add", "-L"], { stdout: "pipe", stderr: "ignore", stdin: "ignore" })
     const code = await proc.exited
     if (code === 0) {
       const out = await new Response(proc.stdout as ReadableStream<Uint8Array>).text()

package/src/lib/sshExec.ts

@@ -12,6 +12,7 @@ import { resolveSshTargetInfo, type SshAccessReason, type SshAccessCandidate } f
 import { SSH_OPTS } from "./probe.ts"
 import { classifySshCommand } from "./sshExecPolicy.ts"
 import { logSshExecAttempt } from "./sshExecLog.ts"
+import { spawn } from "./spawn.ts"
 
 export type SshExecReason = SshAccessReason | "command_denied"
 
@@ -63,7 +64,7 @@ export async function execSshCommand(
   const start = Date.now()
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, ...portOpt, sshTarget, command], {
+    proc = spawn(["ssh", ...SSH_OPTS, ...portOpt, sshTarget, command], {
       stdout: "pipe",
       stderr: "pipe",
       stdin: "ignore",

package/src/lib/wpInventory.ts

@@ -12,6 +12,7 @@ import type { Server, Site } from "../api/types.ts"
 import { SSH_OPTS, sshPort } from "./dbBackup.ts"
 import { detectWpDirScript } from "./serverClone.ts"
 import { wpCliResolveScript } from "./wpCli.ts"
+import { spawn } from "./spawn.ts"
 
 // One plugin or theme, mirroring `wp {plugin,theme} list` columns.
 export interface WpItem {
@@ -116,7 +117,7 @@ export async function fetchWpInventory(
 
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, ...sshPort(server.ssh_port ?? null), target, remote], {
+    proc = spawn(["ssh", ...SSH_OPTS, ...sshPort(server.ssh_port ?? null), target, remote], {
       stdout: "pipe",
       stderr: "pipe",
       stdin: "ignore",