spinuptui 0.26.0 → 0.27.0

package/CHANGELOG.md

@@ -11,6 +11,25 @@ versions; such changes are called out here.
 
 ## [Unreleased]
 
+## [0.27.0] - 2026-09-23
+
+### Added
+- **Update WordPress core from `u`.** `u` is now **Update**, a menu with two choices: PHP version, the flow you already know, and WordPress core. The WordPress option checks the site over SSH with wp-cli and lists the available versions, with minor (security) releases picked first. After you confirm, it runs `wp core update` and then the database upgrade. The update keeps running if you close the overlay, and a toast reports when it's done. Bedrock and Radicle sites are included; for those, the confirm screen names the version `composer.lock` pins, and warns that the next `composer install` will put that version back until you run `composer update`.
+- **Stacks groups WordPress sites by core version.** Under Standard WP, Bedrock and Radicle, one indented row per WordPress version, newest first, shows how many sites run it (for example `└ WP 7.0.2  51`). The newest version in the fleet is highlighted green. Select a row to list its sites, which makes it easy to find the ones still waiting for a security release. `D` on a version row re-probes just those sites. Sites with no known version are grouped under `no version`, and the left pane now scrolls when the list is taller than the terminal.
+- **Update WordPress on a whole version group.** In Stacks, `u` on a version row (`└ WP 7.0.2`) checks every site in that group live over SSH, then shows a plan you can edit. The default target is the newest release in each site's own line (the security hotfix), and `m` switches to the newest release overall. `space` leaves a site out, and Bedrock and Radicle sites are marked `⚙` because of the `composer.lock` caveat. After you confirm, a canary site updates alone first, and if it fails nothing else is touched. The rest follow up to 4 at a time, one per server, stopping after 3 failures; `x` stops starting new sites. It keeps running if you close the overlay, and a single toast reports the result.
+- **Update progress shows on the site's row.** While a WordPress core update runs, the Stacks row replaces the version with a spinner and the target version (`⠹ → WP 7.1.2`). Servers and Search show a compact `WP` marker. If the update fails, the row keeps a `⬆!` marker until you open the result, and the toast that reports the failure is red instead of green.
+
+### Fixed
+- **The WordPress version on a site's row now follows the Update check.** Stacks and Servers show the version from the last `d` probe, so it went stale as soon as core changed. Opening **Update → WordPress core** reads the live version over SSH, and that value, along with the result of any update, now replaces the stored one.
+- **SpinupWP API errors now say why.** A rejected write used to show only "SpinupWP API error (HTTP 400)." The message now includes the reason from the API's response, such as which field it rejected.
+
+## [0.26.1] - 2026-09-18
+
+### Fixed
+- **`pull db` (and every other local command) now works when spinuptui is launched from inside a site's checkout.** Bun auto-loads the current directory's `.env`, and child processes inherited it, so a Bedrock site's own `DB_*` values reached `wp` as environment variables. Bedrock then read blank database credentials, and the pre-import backup failed with `Access denied for user '<you>'@'localhost' (using password: NO)`. Keys from that `.env` are now dropped at startup, except the ones spinuptui reads itself (its token and Uptime Kuma settings; provider credentials are covered below).
+- **`pull db`'s "Access denied" hint now points Bedrock and Radicle sites at their `.env`.** It used to blame `wp-config.php` for every site, but those stacks keep their database credentials in `.env`. The hint also mentions that a `DB_*` variable exported in the shell can override that file.
+- **A site's `.env` can no longer supply spinuptui's DNS provider credentials.** Launched from inside a site checkout, spinuptui read that site's `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` (which Bedrock sites commonly use for S3 media) as its own Route 53 credentials, silently overriding the ones in config. Provider keys (`AWS_*`, `CLOUDFLARE_API_TOKEN`, `GODADDY_API_*`) from a `.env` are now honored only in spinuptui's own project directory; keys exported in the shell work from anywhere, as before.
+
 ## [0.26.0] - 2026-08-26
 
 ### Added
@@ -1408,7 +1427,9 @@ Initial tagged release.
 ### Notes
 - Read-only release: works with a SpinupWP **Read Only** API token.
 
-[Unreleased]: https://github.com/mwender/spinupwp-tui/compare/v0.26.0...HEAD
+[Unreleased]: https://github.com/mwender/spinupwp-tui/compare/v0.27.0...HEAD
+[0.27.0]: https://github.com/mwender/spinupwp-tui/compare/v0.26.1...v0.27.0
+[0.26.1]: https://github.com/mwender/spinupwp-tui/compare/v0.26.0...v0.26.1
 [0.26.0]: https://github.com/mwender/spinupwp-tui/compare/v0.25.0...v0.26.0
 [0.25.0]: https://github.com/mwender/spinupwp-tui/compare/v0.24.4...v0.25.0
 [0.24.4]: https://github.com/mwender/spinupwp-tui/compare/v0.24.3...v0.24.4

package/README.md

@@ -53,8 +53,8 @@
   pull a production DB into a linked local copy. → [docs/database-backup-sync.md](docs/database-backup-sync.md)
 - **Production media fallback** (`m`, Servers / Search tabs) — serve missing-locally images
   from production after a DB pull. → [docs/production-media-fallback.md](docs/production-media-fallback.md)
-- **Upgrade a site's PHP version** (`u`) — pick a version, apply it, watch the
-  event complete. → [docs/php-upgrade.md](docs/php-upgrade.md)
+- **Update a site** (`u`) — change its PHP version, or update WordPress core over
+  SSH (Standard WP, Bedrock and Radicle). → [docs/php-upgrade.md](docs/php-upgrade.md)
 - **Enable / disable HTTPS** (`H`) — toggle a site's certificate.
 - **Purge cache** (`P`) — clear page + object cache together.
 - **Server actions** (`a`) — reboot or restart a service, with the real reason a
@@ -320,7 +320,7 @@ These can be set in `config.json` or via an environment variable:
 | `D` | Identify every site in the selected stack (Stacks tab) |
 | `S` | Auto-discover & batch-link local copies (Stacks tab) |
 | `f` | Report sites with no usable local copy (Stacks tab only — `f` identifies a site's stack in Servers/Search, above) |
-| `u` | Upgrade a site's PHP version (Servers / Stacks / Search; needs a Read/Write token) |
+| `u` | Update a site: PHP version (needs a Read/Write token) or WordPress core (over SSH) (Servers / Stacks / Search) |
 | `H` | Enable / disable HTTPS on a site (Servers / Stacks / Search; needs a Read/Write token) |
 | `P` | Purge a site's page cache + object cache (Servers / Stacks / Search; needs a Read/Write token) |
 | `M` | Site/server monitoring — a two-pane browser of this site's Uptime Kuma monitors (capital, since lowercase `m` is media fallback in Servers/Search). Inside: `↑`/`↓` selects a monitor, `a` registers/recalibrates/repairs it (Front page and Cache bypass open a check-window picker), `x` removes Front page or Cache bypass, `o` opens the selected monitor in Kuma, `d` runs the site doctor, `n` shows/edits alert wiring, and vanity sites add `R`/`r` for page refresh/secret rotation (Servers / Stacks / Search) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spinuptui",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "SpinupTUI — a terminal dashboard for browsing, monitoring, and managing your SpinupWP servers and sites.",
   "type": "module",
   "bin": {
@@ -24,7 +24,8 @@
   "scripts": {
     "dev": "bun run src/index.tsx",
     "start": "bun run src/index.tsx",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --noEmit && bun run check:spawn",
+    "check:spawn": "! grep -rnaE \"Bun\\\\.spawn(Sync)?\\\\(|child_process\" src --exclude=spawn.ts || (echo \"Use spawn() from src/lib/spawn.ts instead (see that file)\" >&2; exit 1)",
     "link-global": "bun link",
     "unlink-global": "bun unlink",
     "build:binary": "bun build src/index.tsx --compile --outfile spinuptui"

package/src/api/client.ts

@@ -31,6 +31,42 @@ export class ApiError extends Error {
   }
 }
 
+// Pull the human-readable reason out of a SpinupWP error body. The API answers
+// validation failures Laravel-style — {"message": "...", "errors": {field: [..]}}
+// — and a bare "HTTP 400" hides exactly the part the user needs (which field,
+// and why). Returns "" when the body has nothing usable, so callers can fall
+// back to the status-only message.
+export function apiErrorDetail(body: string | undefined): string {
+  const text = (body ?? "").trim()
+  if (!text) return ""
+  let json: unknown
+  try {
+    json = JSON.parse(text)
+  } catch {
+    // Not JSON (an HTML error page, say) — a short plain-text body is still worth
+    // showing; anything long is noise.
+    return text.length <= 200 && !text.startsWith("<") ? text : ""
+  }
+  if (!json || typeof json !== "object") return ""
+  const j = json as { message?: unknown; error?: unknown; errors?: unknown }
+  const parts: string[] = []
+  const message = typeof j.message === "string" ? j.message : typeof j.error === "string" ? j.error : ""
+  if (j.errors && typeof j.errors === "object") {
+    for (const v of Object.values(j.errors as Record<string, unknown>)) {
+      for (const m of Array.isArray(v) ? v : [v]) if (typeof m === "string" && !parts.includes(m)) parts.push(m)
+    }
+  }
+  // Laravel's top-level message usually just repeats the first field error
+  // ("The php version is invalid. (and 1 more error)") — prefer the field list.
+  if (parts.length) return parts.join(" ")
+  return message
+}
+
+function httpErrorMessage(status: number, body: string): string {
+  const detail = apiErrorDetail(body)
+  return detail ? `SpinupWP API error (HTTP ${status}): ${detail}` : `SpinupWP API error (HTTP ${status}).`
+}
+
 export interface ClientOptions {
   token: string
   baseUrl: string
@@ -152,7 +188,7 @@ export class SpinupWPClient implements SpinupWPClientLike {
     }
     if (!res.ok) {
       const body = await res.text().catch(() => "")
-      throw new ApiError(`SpinupWP API error (HTTP ${res.status}).`, res.status, body)
+      throw new ApiError(httpErrorMessage(res.status, body), res.status, body)
     }
 
     return (await res.json()) as T
@@ -189,7 +225,7 @@ export class SpinupWPClient implements SpinupWPClientLike {
     }
     if (!res.ok) {
       const errBody = await res.text().catch(() => "")
-      throw new ApiError(`SpinupWP API error (HTTP ${res.status}).`, res.status, errBody)
+      throw new ApiError(httpErrorMessage(res.status, errBody), res.status, errBody)
     }
 
     // Some write endpoints (e.g. PHP upgrade) return a bare body, others 204.

package/src/index.tsx

@@ -3,6 +3,9 @@
 // OpenTUI renderer and mounts either the first-run onboarding wizard (no token
 // yet) or the main app wrapped in the data store.
 
+// First, before any config read or spawn: keep a site checkout's .env from
+// leaking into child processes (see the module).
+import "./lib/cwdDotenv.ts"
 import { useState } from "react"
 import { createCliRenderer } from "@opentui/core"
 import { createRoot } from "@opentui/react"

package/src/lib/appUpdate.ts

@@ -11,6 +11,7 @@ import { join, sep } from "node:path"
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs"
 import { configDir } from "../config.ts"
 import { REPO_SLUG } from "../version.ts"
+import { spawn } from "./spawn.ts"
 
 const CACHE_VERSION = 1
 const TTL_MS = 6 * 60 * 60 * 1000 // 6 hours
@@ -161,7 +162,7 @@ function checkoutRoot(): string {
 }
 
 async function git(cwd: string, args: string[]): Promise<{ code: number; stdout: string; stderr: string }> {
-  const proc = Bun.spawn(["git", "-C", cwd, ...args], { stdout: "pipe", stderr: "pipe", stdin: "ignore" })
+  const proc = spawn(["git", "-C", cwd, ...args], { stdout: "pipe", stderr: "pipe", stdin: "ignore" })
   const [stdout, stderr, code] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text(), proc.exited])
   return { code, stdout: stdout.trim(), stderr: stderr.trim() }
 }

package/src/lib/cliPull.ts

@@ -351,17 +351,22 @@ export async function runPullDb(
 
   if (result.stage === "error") {
     const error = result.error ?? "The sync failed."
-    // The overwhelmingly likely cause right after `pull files`: the copied
-    // wp-config.php still carries production's DB credentials, so local wp-cli
-    // authenticates as the production user against the local MySQL.
+    // Standard WP: the overwhelmingly likely cause right after `pull files` is the
+    // copied wp-config.php still carrying production's DB credentials, so local
+    // wp-cli authenticates as the production user against the local MySQL.
+    // Bedrock/Radicle keep credentials in .env instead (never pulled), and a
+    // DB_* variable exported in the shell can shadow that file.
     const deniedAs = /access denied for user '([^']+)'/i.exec(error)?.[1]
+    const envBased = plan.localKind === "bedrock" || plan.localKind === "radicle"
     return {
       ...fail(
         "sync_failed",
         error,
-        deniedAs
-          ? `Local MySQL refused the user "${deniedAs}". If this copy came from \`pull files\`, its wp-config.php still holds production's database credentials — point DB_NAME / DB_USER / DB_PASSWORD / DB_HOST at your local database and re-run.`
-          : undefined,
+        !deniedAs
+          ? undefined
+          : envBased
+            ? `Local MySQL refused the user "${deniedAs}". This is a ${plan.localKind} checkout, so its database credentials live in ${join(plan.localRoot, ".env")} — point DB_NAME / DB_USER / DB_PASSWORD / DB_HOST there at your local database and re-run. A DB_* variable exported in your shell can override that file, so check \`env | grep ^DB_\` too.`
+            : `Local MySQL refused the user "${deniedAs}". If this copy came from \`pull files\`, its wp-config.php still holds production's database credentials — point DB_NAME / DB_USER / DB_PASSWORD / DB_HOST at your local database and re-run.`,
       ),
       ...(result.failedStage ? { failedStage: result.failedStage } : {}),
     }

package/src/lib/cliSsh.ts

@@ -9,6 +9,7 @@ import type { Server, Site } from "../api/types.ts"
 import type { SpinupWPClientLike } from "../api/client.ts"
 import { ApiError } from "../api/client.ts"
 import { resolveSiteSshTarget, SSH_OPTS } from "./probe.ts"
+import { spawn } from "./spawn.ts"
 
 export type SshAccessReason =
   | "no_token"
@@ -181,7 +182,7 @@ export async function resolveSshAccess(
 
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, ...portOpt, target, "true"], {
+    proc = spawn(["ssh", ...SSH_OPTS, ...portOpt, target, "true"], {
       stdout: "pipe",
       stderr: "pipe",
       stdin: "ignore",

package/src/lib/cwdDotenv.ts

@@ -0,0 +1,106 @@
+// Keep the current directory's .env out of the processes we spawn.
+//
+// Bun auto-loads .env files from the directory it was launched in, and every
+// spawned child inherits process.env. Run spinuptui from inside a site's checkout
+// and that site's own .env — DB_NAME, DB_USER, DB_PASSWORD, WP_HOME — rides along
+// into `bash -lc "wp …"`. A Bedrock config then reads *nothing*: its phpdotenv
+// repository is immutable, so it skips keys that already exist in the
+// environment, while `Env::$options` with USE_ENV_ARRAY reads only $_ENV — which
+// PHP leaves empty for inherited variables when variables_order lacks "E" (the
+// Homebrew default). Every DB constant comes out blank, and `wp db export` fails
+// as "Access denied for user '<login name>'@'localhost' (using password: NO)".
+//
+// So: drop every key those files defined, except the ones this app reads itself —
+// its token and provider credentials may legitimately live in a project-local
+// .env (see config.ts). The provider keys have generic names a site's .env uses
+// too (Bedrock keeps S3 media credentials under AWS_*), so those are only trusted
+// from spinuptui's own project directory. Deleting from process.env only reaches children that are
+// handed process.env explicitly, which is what src/lib/spawn.ts is for. Must run
+// before anything reads config or spawns, which is why index.tsx imports this
+// module first.
+
+import { existsSync, readFileSync, realpathSync } from "node:fs"
+import { join } from "node:path"
+
+// Keys spinuptui reads from the environment on purpose. Only spinuptui uses the
+// SPINUP* names, so they're kept from any directory's .env.
+const OWN = /^SPINUP/
+
+// Provider credentials spinuptui also reads (config.ts). Kept only from the .env
+// in spinuptui's own project directory — anywhere else they're a site's keys.
+const PROVIDER = /^(CLOUDFLARE_API_TOKEN|AWS_(ACCESS_KEY_ID|SECRET_ACCESS_KEY|REGION)|GODADDY_API_(KEY|SECRET))$/
+
+// This file lives in <project>/src/lib.
+const PROJECT_DIR = join(import.meta.dir, "..", "..")
+
+function isProjectDir(dir: string): boolean {
+  try {
+    return realpathSync(dir) === realpathSync(PROJECT_DIR)
+  } catch {
+    return false
+  }
+}
+
+// Never removed, whatever a .env says: the spawned shells need these to work.
+const ESSENTIAL = new Set(["PATH", "HOME", "USER", "LOGNAME", "SHELL", "TMPDIR", "TERM", "LANG", "SSH_AUTH_SOCK", "XDG_CONFIG_HOME"])
+
+// The files Bun loads, in increasing precedence: .env, .env.<NODE_ENV> (default
+// development), then .env.local (skipped under test).
+function loadedFiles(cwd: string): string[] {
+  const mode = process.env.NODE_ENV || "development"
+  const names = [".env", `.env.${mode}`]
+  if (mode !== "test") names.push(".env.local")
+  return names.map((n) => join(cwd, n)).filter((p) => existsSync(p))
+}
+
+// Each key with the value the file gives it, or null where that value can't be
+// read with certainty (variable expansion, escapes, multi-line quotes). The value
+// only matters for telling a .env key from a shell one; see scrubCwdDotenv.
+export function dotenvEntries(text: string): Map<string, string | null> {
+  const out = new Map<string, string | null>()
+  for (const m of text.matchAll(/^[ \t]*(?:export[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*=(.*)$/gm)) {
+    out.set(m[1]!, dotenvValue(m[2]!.trim()))
+  }
+  return out
+}
+
+function dotenvValue(raw: string): string | null {
+  const q = raw[0]
+  if (q === "'" || q === "`" || q === '"') {
+    const end = raw.indexOf(q, 1)
+    if (end < 0) return null
+    const inner = raw.slice(1, end)
+    return q === '"' && /[$\\]/.test(inner) ? null : inner
+  }
+  const value = raw.replace(/\s+#.*$/, "").trim()
+  return value.includes("$") ? null : value
+}
+
+// Returns the keys removed, for tests and debugging.
+export function scrubCwdDotenv(cwd = process.cwd()): string[] {
+  // Later files win, as they do in Bun.
+  const entries = new Map<string, string | null>()
+  for (const file of loadedFiles(cwd)) {
+    let text: string
+    try {
+      text = readFileSync(file, "utf8")
+    } catch {
+      continue
+    }
+    for (const [key, value] of dotenvEntries(text)) entries.set(key, value)
+  }
+  const ownDir = isProjectDir(cwd)
+  const removed: string[] = []
+  for (const [key, value] of entries) {
+    if (OWN.test(key) || (ownDir && PROVIDER.test(key)) || ESSENTIAL.has(key) || !(key in process.env)) continue
+    // Bun never overrides a variable the shell already set, so a value that differs
+    // from the file's came from the shell — keep it. When the file's value can't be
+    // read with certainty, assume it's the file's and drop it.
+    if (value !== null && process.env[key] !== value) continue
+    delete process.env[key]
+    removed.push(key)
+  }
+  return removed
+}
+
+scrubCwdDotenv()

package/src/lib/dbBackup.ts

@@ -14,6 +14,7 @@ import { existsSync, mkdirSync, statSync } from "node:fs"
 import { join } from "node:path"
 import type { Server, Site } from "../api/types.ts"
 import { expandPath, type LocalLink } from "./local.ts"
+import { spawn } from "./spawn.ts"
 
 export const SSH_OPTS = ["-o", "BatchMode=yes", "-o", "ConnectTimeout=10", "-o", "StrictHostKeyChecking=accept-new"]
 
@@ -114,7 +115,7 @@ export async function runProcess(
 ): Promise<{ code: number; stderr: string; stdout: string }> {
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(cmd, { stdout: "pipe", stderr: "pipe", stdin: "ignore", cwd, env })
+    proc = spawn(cmd, { stdout: "pipe", stderr: "pipe", stdin: "ignore", cwd, env })
   } catch (err) {
     return { code: -1, stderr: `Failed to launch ${cmd[0]}: ${(err as Error).message}`, stdout: "" }
   }

package/src/lib/gitStatus.ts

@@ -7,6 +7,7 @@
 // needs a network fetch + possibly SSH auth, against the app's no-slow-ops rule).
 
 import { expandPath, findProjectRoot } from "./local.ts"
+import { spawn } from "./spawn.ts"
 
 export interface Drift {
   dirty: boolean // uncommitted working-tree changes
@@ -15,7 +16,7 @@ export interface Drift {
 
 async function git(cwd: string, args: string[]): Promise<{ ok: boolean; out: string }> {
   try {
-    const proc = Bun.spawn(["git", "-C", cwd, ...args], { stdout: "pipe", stderr: "ignore", stdin: "ignore" })
+    const proc = spawn(["git", "-C", cwd, ...args], { stdout: "pipe", stderr: "ignore", stdin: "ignore" })
     const out = await new Response(proc.stdout).text()
     const code = await proc.exited
     return { ok: code === 0, out: out.trim() }

package/src/lib/keychain.ts

@@ -7,6 +7,8 @@
 // as an argv value (-w), so it's briefly visible to `ps` on the local machine during
 // the write — acceptable for an opt-in convenience on a personal box; documented here.
 
+import { spawn } from "./spawn.ts"
+
 const SERVICE = "spinup-sudo"
 
 export function keychainAvailable(): boolean {
@@ -19,7 +21,7 @@ function account(serverId: number): string {
 
 async function security(args: string[]): Promise<{ ok: boolean; stdout: string; stderr: string }> {
   try {
-    const proc = Bun.spawn(["security", ...args], { stdin: "ignore", stdout: "pipe", stderr: "pipe" })
+    const proc = spawn(["security", ...args], { stdin: "ignore", stdout: "pipe", stderr: "pipe" })
     const [stdout, stderr, code] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text(), proc.exited])
     return { ok: code === 0, stdout, stderr }
   } catch (err) {

package/src/lib/open.ts

@@ -1,11 +1,13 @@
 // Open a URL in the user's default browser, cross-platform. Best-effort; never throws.
 
+import { spawn } from "./spawn.ts"
+
 export function openUrl(url: string): void {
   try {
     const platform = process.platform
     const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open"
     const args = platform === "win32" ? ["/c", "start", "", url] : [url]
-    Bun.spawn([cmd, ...args], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+    spawn([cmd, ...args], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
   } catch {
     // ignore — opening a browser is a convenience, not critical
   }
@@ -18,7 +20,7 @@ export function copyToClipboard(text: string): void {
   try {
     const platform = process.platform
     const cmd = platform === "darwin" ? ["pbcopy"] : platform === "win32" ? ["clip"] : ["xclip", "-selection", "clipboard"]
-    const proc = Bun.spawn(cmd, { stdin: "pipe", stdout: "ignore", stderr: "ignore" })
+    const proc = spawn(cmd, { stdin: "pipe", stdout: "ignore", stderr: "ignore" })
     proc.stdin.write(text)
     void proc.stdin.end()
   } catch {
@@ -71,11 +73,11 @@ export function openSshSession(user: string, host: string, port?: number | null,
         app === "iTerm"
           ? ["-e", `tell application "iTerm"\ncreate window with default profile command "${esc}"\nactivate\nend tell`]
           : ["-e", `tell application "Terminal" to do script "${esc}"`, "-e", `tell application "Terminal" to activate`]
-      Bun.spawn(["osascript", ...args], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+      spawn(["osascript", ...args], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
     } else if (platform === "win32") {
-      Bun.spawn(["cmd", "/c", "start", "cmd", "/k", cmd], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+      spawn(["cmd", "/c", "start", "cmd", "/k", cmd], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
     } else {
-      Bun.spawn(["x-terminal-emulator", "-e", cmd], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+      spawn(["x-terminal-emulator", "-e", cmd], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
     }
   } catch {
     // ignore — opening a shell is a convenience, not critical
@@ -90,12 +92,12 @@ export function openTerminalAt(dir: string, terminalApp?: string | null): void {
   try {
     const platform = process.platform
     if (platform === "darwin") {
-      Bun.spawn(["open", "-a", resolveTerminalApp(terminalApp), dir], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+      spawn(["open", "-a", resolveTerminalApp(terminalApp), dir], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
     } else if (platform === "win32") {
-      Bun.spawn(["cmd", "/c", "start", "cmd", "/k", `cd /d ${dir}`], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+      spawn(["cmd", "/c", "start", "cmd", "/k", `cd /d ${dir}`], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
     } else {
       // Try a few common terminal emulators; the first that exists wins.
-      Bun.spawn(["x-terminal-emulator", "--working-directory", dir], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
+      spawn(["x-terminal-emulator", "--working-directory", dir], { stdout: "ignore", stderr: "ignore", stdin: "ignore" })
     }
   } catch {
     // ignore — opening a terminal is a convenience, not critical

package/src/lib/probe.ts

@@ -19,6 +19,7 @@
 import type { Server, Site } from "../api/types.ts"
 import { detectWpDirScript } from "./serverClone.ts"
 import { theme } from "./theme.ts"
+import { spawn } from "./spawn.ts"
 
 export type ProbeKind = "wordpress" | "bedrock" | "radicle" | "whmcs" | "laravel" | "static" | "unknown"
 
@@ -117,7 +118,7 @@ export async function probeSite(
 
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, target, buildRemoteScript(site.domain, site.public_folder)], {
+    proc = spawn(["ssh", ...SSH_OPTS, target, buildRemoteScript(site.domain, site.public_folder)], {
       stdout: "pipe",
       stderr: "pipe",
       stdin: "ignore",
@@ -166,6 +167,22 @@ function parseSections(out: string): Record<string, string> {
   return flat
 }
 
+// The same probe result with a newly learned WordPress core version, relabeled the
+// way classify() labels it. Returns null for kinds that don't carry a WP version
+// (a WHMCS/Laravel/static site's cached identity must never be rewritten).
+export function withWpVersion(r: ProbeResult, version: string): ProbeResult | null {
+  switch (r.kind) {
+    case "wordpress":
+      return { ...r, version, label: `WordPress ${version}` }
+    case "bedrock":
+      return { ...r, version, label: `Bedrock · WP ${version}` }
+    case "radicle":
+      return { ...r, version, label: `Radicle · WP ${version}` }
+    default:
+      return null
+  }
+}
+
 // Turn raw signals into a named stack. Order matters: name the distinctive apps
 // (WHMCS, Bedrock, Laravel) before falling back to a generic WordPress version.
 export function classify(sig: Record<string, string>): ProbeResult {

package/src/lib/serverClone.ts

@@ -12,6 +12,7 @@
 
 import type { Server } from "../api/types.ts"
 import { wpCliResolveScript } from "./wpCli.ts"
+import { spawn } from "./spawn.ts"
 
 const SSH_OPTS = ["-o", "BatchMode=yes", "-o", "ConnectTimeout=10", "-o", "StrictHostKeyChecking=accept-new"]
 
@@ -42,7 +43,7 @@ export async function sudoExec(
   const ctrl = new AbortController()
   const timer = setTimeout(() => ctrl.abort(), timeoutMs)
   try {
-    const proc = Bun.spawn(["ssh", ...SSH_OPTS, ...portOpt, target, "sudo -S -p '' bash -s"], {
+    const proc = spawn(["ssh", ...SSH_OPTS, ...portOpt, target, "sudo -S -p '' bash -s"], {
       stdin: "pipe",
       stdout: "pipe",
       stderr: "pipe",
@@ -853,7 +854,7 @@ async function wpFacts(ctx: SudoCtx, root: string, user: string, phpVersion?: st
 // `curl --resolve` checks). 2xx/3xx counts as serving.
 async function curlStatus(domain: string, ip: string): Promise<string> {
   try {
-    const proc = Bun.spawn(
+    const proc = spawn(
       ["curl", "-sS", "-o", "/dev/null", "-m", "20", "-w", "%{http_code}", "-L", "--resolve", `${domain}:80:${ip}`, "--resolve", `${domain}:443:${ip}`, `http://${domain}/`],
       { stdout: "pipe", stderr: "pipe" },
     )

package/src/lib/spawn.ts

@@ -0,0 +1,17 @@
+// The one way this app starts a child process.
+//
+// Bun.spawn with no `env` option hands the child Bun's *startup* environment,
+// ignoring anything deleted from process.env since — and so do Bun.spawnSync and
+// node:child_process (all confirmed on Bun 1.3.14). That defeats the startup scrub
+// of the launch directory's .env (see cwdDotenv.ts): a site checkout's DB_* values
+// would still reach `wp`. Passing `env: process.env` does honor the deletions, so
+// this wrapper defaults it. A caller's explicit `env` still wins.
+//
+// `bun run typecheck` fails on any direct Bun.spawn/spawnSync or child_process use
+// outside this file, so new call sites can't quietly bypass it.
+
+export const spawn = ((cmd: unknown, opts?: { env?: unknown }) => {
+  if (Array.isArray(cmd)) return Bun.spawn(cmd, { ...opts, env: opts?.env ?? process.env } as never)
+  const o = cmd as { env?: unknown }
+  return Bun.spawn({ ...o, env: o.env ?? process.env } as never)
+}) as typeof Bun.spawn

package/src/lib/ssh.ts

@@ -15,6 +15,7 @@ import { existsSync, readFileSync, readdirSync } from "node:fs"
 import { mkdir, chmod } from "node:fs/promises"
 import { keysDir } from "../config.ts"
 import type { Server, Site } from "../api/types.ts"
+import { spawn } from "./spawn.ts"
 
 export interface CpuCore {
   idx: number
@@ -122,7 +123,7 @@ export async function fetchRebootInfo(
 
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, target, REBOOT_SCRIPT], { stdout: "pipe", stderr: "pipe", stdin: "ignore" })
+    proc = spawn(["ssh", ...SSH_OPTS, target, REBOOT_SCRIPT], { stdout: "pipe", stderr: "pipe", stdin: "ignore" })
   } catch (err) {
     return { ok: false, target, error: `Failed to launch ssh: ${(err as Error).message}` }
   }
@@ -161,7 +162,7 @@ export async function fetchServerHealth(
 
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, target, REMOTE_SCRIPT], {
+    proc = spawn(["ssh", ...SSH_OPTS, target, REMOTE_SCRIPT], {
       stdout: "pipe",
       stderr: "pipe",
       stdin: "ignore",
@@ -258,7 +259,7 @@ export async function ensureSpinupKey(): Promise<{ path: string; pub: string; co
     return { path, pub: readFileSync(pub, "utf8").trim(), comment }
   }
   await mkdir(keysDir(), { recursive: true })
-  const proc = Bun.spawn(
+  const proc = spawn(
     ["ssh-keygen", "-t", "ed25519", "-N", "", "-C", comment, "-f", path],
     { stdout: "pipe", stderr: "pipe", stdin: "ignore" },
   )
@@ -360,7 +361,7 @@ async function runSshStdin(
   const portOpt = port && port !== 22 ? ["-p", String(port)] : []
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, ...portOpt, target, remoteCmd], {
+    proc = spawn(["ssh", ...SSH_OPTS, ...portOpt, target, remoteCmd], {
       stdout: "pipe",
       stderr: "pipe",
       stdin: stdinPayload == null ? "ignore" : "pipe",
@@ -576,7 +577,7 @@ export async function listPersonalKeys(): Promise<GrantableKey[]> {
 
   // ssh-agent (keys the user has loaded). Best-effort; ignore if no agent.
   try {
-    const proc = Bun.spawn(["ssh-add", "-L"], { stdout: "pipe", stderr: "ignore", stdin: "ignore" })
+    const proc = spawn(["ssh-add", "-L"], { stdout: "pipe", stderr: "ignore", stdin: "ignore" })
     const code = await proc.exited
     if (code === 0) {
       const out = await new Response(proc.stdout as ReadableStream<Uint8Array>).text()

package/src/lib/sshExec.ts

@@ -12,6 +12,7 @@ import { resolveSshTargetInfo, type SshAccessReason, type SshAccessCandidate } f
 import { SSH_OPTS } from "./probe.ts"
 import { classifySshCommand } from "./sshExecPolicy.ts"
 import { logSshExecAttempt } from "./sshExecLog.ts"
+import { spawn } from "./spawn.ts"
 
 export type SshExecReason = SshAccessReason | "command_denied"
 
@@ -63,7 +64,7 @@ export async function execSshCommand(
   const start = Date.now()
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, ...portOpt, sshTarget, command], {
+    proc = spawn(["ssh", ...SSH_OPTS, ...portOpt, sshTarget, command], {
       stdout: "pipe",
       stderr: "pipe",
       stdin: "ignore",