spinuptui 0.26.0 → 0.27.0

package/src/lib/wpCore.ts

@@ -0,0 +1,273 @@
+// WordPress core updates over SSH — `wp core check-update` / `wp core update`,
+// run as the site user in the site's real WordPress directory. The SpinupWP API
+// has no core-update endpoint (it only reports a `wp_core_update` flag), so this
+// is the same key-based SSH path the Plugins & themes view reads through.
+//
+// The WP dir is DETECTED, never assumed (see CLAUDE.md "WordPress layout rules"):
+// detectWpDirScript finds core on /public/, root-webroot, and Bedrock (web/wp)
+// layouts alike.
+//
+// Composer-managed core (Bedrock, Radicle) is allowed, deliberately: for a
+// security hotfix, getting the patched files onto the server NOW matters more
+// than keeping composer.lock in step. But it's a real divergence — the lock
+// still pins the old version, so the next `composer install` (a git deploy, a
+// clone) silently reverts the patch. The check reports the locked version so
+// the UI can say exactly that before anything runs.
+
+import type { Server, Site } from "../api/types.ts"
+import { SSH_OPTS, sshPort } from "./dbBackup.ts"
+import { detectWpDirScript } from "./serverClone.ts"
+import { wpCliResolveScript } from "./wpCli.ts"
+import { spawn } from "./spawn.ts"
+
+export interface WpCoreOffer {
+  version: string
+  updateType: string // "minor" | "major" (wp-cli's update_type)
+}
+
+export interface WpCoreStatus {
+  wpDir: string
+  current: string
+  offers: WpCoreOffer[] // newest first, as wp-cli lists them; [] = up to date
+  multisite: boolean
+  // Set when core is installed by Composer (roots/wordpress, johnpbloch/wordpress…):
+  // the version composer.lock pins, which a later `composer install` restores.
+  composer: { lockedVersion: string | null } | null
+}
+
+export type WpCoreCheckResult =
+  | { ok: true; target: string; status: WpCoreStatus }
+  | { ok: false; target: string; error: string }
+
+export type WpCoreUpdateResult =
+  | { ok: true; before: string; after: string; log: string }
+  | { ok: false; error: string; log: string }
+
+// Numeric, segment-wise version compare ("7.0" < "7.0.2" < "7.1"); non-numeric
+// tails are ignored, which is fine for WordPress release numbers.
+export function compareVersions(a: string, b: string): number {
+  const pa = a.split(".").map((n) => parseInt(n, 10) || 0)
+  const pb = b.split(".").map((n) => parseInt(n, 10) || 0)
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0)
+    if (d !== 0) return d
+  }
+  return 0
+}
+
+// The two targets a bulk update can aim for. "line" = the newest release in the
+// site's own major.minor line (7.0.2 → 7.0.x): WordPress backports security
+// fixes there, so it's the low-risk hotfix. "newest" = the newest release,
+// period (a major update for anyone on an older line). null = nothing to do.
+export type WpTargetMode = "line" | "newest"
+
+export function wpTarget(current: string, offers: WpCoreOffer[], mode: WpTargetMode): string | null {
+  const line = (v: string) => v.split(".").slice(0, 2).join(".")
+  const pool = mode === "line" ? offers.filter((o) => line(o.version) === line(current)) : offers
+  let best: string | null = null
+  for (const o of pool) if (compareVersions(o.version, current) > 0 && (!best || compareVersions(o.version, best) > 0)) best = o.version
+  return best
+}
+
+// Composer packages that install WordPress core itself.
+const CORE_PACKAGES = ["roots/wordpress", "roots/wordpress-no-content", "roots/wordpress-full", "johnpbloch/wordpress", "johnpbloch/wordpress-core"]
+
+interface Prepared {
+  target: string
+  args: string[]
+}
+
+function prepare(server: Server, site: Site, sshUser: string | null): Prepared | { error: string; target: string } {
+  const ip = server.ip_address
+  const user = site.site_user ?? sshUser
+  if (!ip) return { target: "(no IP)", error: "Server has no IP address." }
+  if (!user) return { target: ip, error: "Site has no site user — can't SSH in to run wp-cli." }
+  const target = `${user}@${ip}`
+  return { target, args: ["ssh", ...SSH_OPTS, ...sshPort(server.ssh_port ?? null), target] }
+}
+
+// Shared preamble: locate core (sets $W, bails with ===NOTWP when there's none),
+// then resolve $PHP/$WP pinned to the site's own PHP-CLI (see wpCli.ts).
+function preamble(site: Site): string {
+  const root = `/sites/${site.domain}/files`
+  return [
+    detectWpDirScript(root, site.public_folder ?? undefined),
+    `if [ -z "$W" ]; then echo ===NOTWP; echo ===END; exit 0; fi`,
+    wpCliResolveScript(site.php_version),
+    // Every core command runs with plugins and themes unloaded: none of them need
+    // either, and a plugin's PHP notices land on STDOUT under the CLI SAPI —
+    // verified live on an Elementor Pro site under PHP 8.4, where a wall of
+    // "Implicitly marking parameter … as nullable is deprecated" swallowed the
+    // check-update JSON and the site read as up to date while two versions behind.
+    // It also keeps a fataling plugin from blocking the core update that fixes it.
+    `wpc() { "$PHP" "$WP" --path="$W" --skip-plugins --skip-themes "$@"; }`,
+  ].join("\n")
+}
+
+async function run(args: string[], remote: string, timeoutMs: number): Promise<{ code: number; stdout: string; stderr: string }> {
+  const proc = spawn([...args, remote], { stdout: "pipe", stderr: "pipe", stdin: "ignore" })
+  const timer = setTimeout(() => {
+    try {
+      proc.kill()
+    } catch {
+      /* already gone */
+    }
+  }, timeoutMs)
+  const code = await proc.exited
+  clearTimeout(timer)
+  const stdout = await new Response(proc.stdout as ReadableStream<Uint8Array>).text()
+  const stderr = await new Response(proc.stderr as ReadableStream<Uint8Array>).text()
+  return { code, stdout, stderr }
+}
+
+function splitSections(out: string): Record<string, string[]> {
+  const sections: Record<string, string[]> = {}
+  let current = ""
+  for (const rawLine of out.split("\n")) {
+    const line = rawLine.replace(/\r$/, "")
+    const m = line.match(/^===([A-Z]+)$/)
+    if (m) {
+      current = m[1]
+      sections[current] = []
+    } else if (current) {
+      sections[current].push(line)
+    }
+  }
+  return sections
+}
+
+function sshFailure(code: number, stderr: string): string {
+  return stderr.trim().split("\n").slice(-2).join(" ") || `ssh exited with code ${code}`
+}
+
+// Read the installed version, available updates, multisite-ness, and whether
+// Composer owns core. Strictly read-only.
+export async function checkWpCore(server: Server, site: Site, sshUser: string | null): Promise<WpCoreCheckResult> {
+  const p = prepare(server, site, sshUser)
+  if ("error" in p) return { ok: false, target: p.target, error: p.error }
+
+  // composer.lock sits at the project root: $W/../.. for Bedrock (web/wp),
+  // $W/.. for a public/ layout, or $W itself. The first lock that lists a core
+  // package wins; PHP parses it (jq isn't guaranteed on the box).
+  const pkgs = CORE_PACKAGES.map((n) => `'${n}'`).join(",")
+  const lockPhp = `$l=json_decode(file_get_contents($argv[1]),true);foreach(array_merge($l["packages"]??[],$l["packages-dev"]??[]) as $p){if(in_array($p["name"],[${pkgs}],true)){echo $p["version"];exit(0);}}exit(1);`
+  const remote = [
+    preamble(site),
+    `echo ===WPDIR; printf '%s\\n' "$W"`,
+    // Trailing `echo`s are load-bearing: wp's JSON/plain output has no trailing
+    // newline, so the next ===MARKER would glue onto it (see wpInventory.ts).
+    `echo ===VERSION; wpc core version 2>/dev/null || true; echo`,
+    `echo ===UPDATES; wpc core check-update --format=json 2>/dev/null || true; echo`,
+    `echo ===MULTISITE; wpc core is-installed --network >/dev/null 2>&1 && echo yes || echo no`,
+    `echo ===COMPOSER`,
+    `for d in "$W/../.." "$W/.." "$W"; do if [ -f "$d/composer.lock" ]; then v=$("$PHP" -r ${shq(lockPhp)} "$d/composer.lock" 2>/dev/null) && { echo "locked $v"; break; }; fi; if [ -f "$d/composer.json" ] && grep -qE '"(${CORE_PACKAGES.join("|")})"' "$d/composer.json"; then echo "managed"; break; fi; done`,
+    `echo ===END`,
+  ].join("\n")
+
+  let res: Awaited<ReturnType<typeof run>>
+  try {
+    res = await run(p.args, remote, 60_000)
+  } catch (err) {
+    return { ok: false, target: p.target, error: `Failed to launch ssh: ${(err as Error).message}` }
+  }
+  if (res.code !== 0 && !res.stdout.includes("===END")) return { ok: false, target: p.target, error: sshFailure(res.code, res.stderr) }
+
+  const s = splitSections(res.stdout)
+  if ("NOTWP" in s) return { ok: false, target: p.target, error: "No WordPress core found under the site's files — is this a WordPress site?" }
+  const current = lastVersionLine(s.VERSION)
+  if (!current) return { ok: false, target: p.target, error: "wp-cli couldn't read the WordPress version on this site." }
+
+  // Belt and braces with --skip-plugins: scan back for the line that parses as
+  // the JSON array, ignoring any other noise (a mu-plugin's notices still load).
+  // No match = "Success: WordPress is at the latest version." (plain text).
+  let offers: WpCoreOffer[] = []
+  for (const line of [...(s.UPDATES ?? [])].reverse()) {
+    if (!line.trim().startsWith("[")) continue
+    let parsed: unknown
+    try {
+      parsed = JSON.parse(line.trim())
+    } catch {
+      continue
+    }
+    if (!Array.isArray(parsed)) continue
+    offers = parsed
+      .filter((o) => o && typeof o.version === "string")
+      .map((o) => ({ version: o.version as string, updateType: typeof o.update_type === "string" ? o.update_type : "" }))
+    break
+  }
+
+  const comp = (s.COMPOSER ?? []).join("\n").trim()
+  const locked = comp.match(/^locked (.+)$/m)
+  const composer = locked ? { lockedVersion: locked[1].replace(/^v/, "") } : comp.includes("managed") ? { lockedVersion: null } : null
+
+  return {
+    ok: true,
+    target: p.target,
+    status: {
+      wpDir: (s.WPDIR?.[0] || "").trim(),
+      current,
+      offers,
+      multisite: (s.MULTISITE ?? []).join("").trim() === "yes",
+      composer,
+    },
+  }
+}
+
+// Update core to `version`, then run the database upgrade (network-wide on
+// multisite) and read the version back. If the update dies mid-way, WordPress
+// leaves a .maintenance file that keeps the site on "Briefly unavailable" for
+// up to 10 minutes — we remove it so a failure doesn't turn into downtime.
+export async function updateWpCore(
+  server: Server,
+  site: Site,
+  sshUser: string | null,
+  version: string,
+  multisite: boolean,
+): Promise<WpCoreUpdateResult> {
+  const p = prepare(server, site, sshUser)
+  if ("error" in p) return { ok: false, error: p.error, log: "" }
+  if (!/^[0-9][0-9A-Za-z.-]*$/.test(version)) return { ok: false, error: `Refusing odd version string "${version}".`, log: "" }
+
+  const remote = [
+    preamble(site),
+    `echo ===BEFORE; wpc core version 2>/dev/null; echo`,
+    `echo ===LOG`,
+    `wpc core update --version=${version} 2>&1; rc=$?`,
+    `if [ $rc -eq 0 ]; then wpc core update-db${multisite ? " --network" : ""} 2>&1 || rc=$?; fi`,
+    `[ -f "$W/.maintenance" ] && rm -f "$W/.maintenance" && echo "Removed a leftover .maintenance file."`,
+    `echo; echo ===RC; echo $rc`,
+    `echo ===AFTER; wpc core version 2>/dev/null; echo`,
+    `echo ===END`,
+  ].join("\n")
+
+  let res: Awaited<ReturnType<typeof run>>
+  try {
+    res = await run(p.args, remote, 300_000)
+  } catch (err) {
+    return { ok: false, error: `Failed to launch ssh: ${(err as Error).message}`, log: "" }
+  }
+  if (!res.stdout.includes("===END")) {
+    return { ok: false, error: res.code === 0 ? "The update didn't finish (timed out?)." : sshFailure(res.code, res.stderr), log: res.stdout.trim() }
+  }
+  const s = splitSections(res.stdout)
+  if ("NOTWP" in s) return { ok: false, error: "No WordPress core found under the site's files.", log: "" }
+  const log = (s.LOG ?? []).join("\n").trim()
+  const rc = Number((s.RC ?? []).join("").trim())
+  const before = lastVersionLine(s.BEFORE)
+  const after = lastVersionLine(s.AFTER)
+  if (rc !== 0) {
+    const lastErr = log.split("\n").filter((l) => /error|warning/i.test(l)).pop()
+    return { ok: false, error: lastErr ?? `wp core update exited with code ${rc}.`, log }
+  }
+  if (after !== version) return { ok: false, error: `wp-cli reported success, but the site now reports ${after || "no version"} (wanted ${version}).`, log }
+  return { ok: true, before, after, log }
+}
+
+// `wp core version` prints a bare version; pick that line out of any noise.
+function lastVersionLine(lines: string[] | undefined): string {
+  return [...(lines ?? [])].reverse().map((l) => l.trim()).find((l) => /^\d+\.\d+(\.\d+)?([-.][0-9A-Za-z.-]+)?$/.test(l)) ?? ""
+}
+
+function shq(s: string): string {
+  return `'${s.replace(/'/g, `'\\''`)}'`
+}

package/src/lib/wpInventory.ts

@@ -12,6 +12,7 @@ import type { Server, Site } from "../api/types.ts"
 import { SSH_OPTS, sshPort } from "./dbBackup.ts"
 import { detectWpDirScript } from "./serverClone.ts"
 import { wpCliResolveScript } from "./wpCli.ts"
+import { spawn } from "./spawn.ts"
 
 // One plugin or theme, mirroring `wp {plugin,theme} list` columns.
 export interface WpItem {
@@ -116,7 +117,7 @@ export async function fetchWpInventory(
 
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, ...sshPort(server.ssh_port ?? null), target, remote], {
+    proc = spawn(["ssh", ...SSH_OPTS, ...sshPort(server.ssh_port ?? null), target, remote], {
       stdout: "pipe",
       stderr: "pipe",
       stdin: "ignore",

package/src/ui/App.tsx

@@ -15,7 +15,8 @@ import { Stacks } from "./views/Stacks.tsx"
 import { Search } from "./views/Search.tsx"
 import { Events } from "./views/Events.tsx"
 import { Health } from "./views/Health.tsx"
-import { PhpUpgrade } from "./views/PhpUpgrade.tsx"
+import { SiteUpdate } from "./views/SiteUpdate.tsx"
+import { BulkWpUpdate } from "./views/BulkWpUpdate.tsx"
 import { HttpsToggle } from "./views/HttpsToggle.tsx"
 import { PurgeCache } from "./views/PurgeCache.tsx"
 import { ReleaseNotes } from "./views/ReleaseNotes.tsx"
@@ -63,6 +64,7 @@ export function App() {
     store.healthServer !== null ||
     store.wpInventorySite !== null ||
     store.phpUpgradeSite !== null ||
+    store.bulkWpGroup !== null ||
     store.httpsToggleSite !== null ||
     store.purgeCacheSite !== null ||
     store.grantKeySite !== null ||
@@ -129,6 +131,9 @@ export function App() {
     // The PHP-upgrade overlay owns the keyboard while open.
     if (store.phpUpgradeSite) return
 
+    // The bulk WordPress-update overlay owns the keyboard while open.
+    if (store.bulkWpGroup) return
+
     // The HTTPS-toggle overlay owns the keyboard while open.
     if (store.httpsToggleSite) return
 
@@ -247,7 +252,8 @@ export function App() {
       {store.releaseNotesInfo && <ReleaseNotes />}
       {store.healthServer && <Health />}
       {store.wpInventorySite && <WpInventory />}
-      {store.phpUpgradeSite && <PhpUpgrade />}
+      {store.phpUpgradeSite && <SiteUpdate />}
+      {store.bulkWpGroup && <BulkWpUpdate />}
       {store.httpsToggleSite && <HttpsToggle />}
       {store.purgeCacheSite && <PurgeCache />}
       {store.grantKeySite && <GrantKey />}

package/src/ui/Explain.tsx

@@ -44,7 +44,7 @@ const GUIDES: Record<Route, Guide> = {
       ["h", "Server health over SSH (CPU / memory / disk)"],
       ["a", "Server actions: reboot or restart a service"],
       ["d", "Identify the app running on a site (SSH)"],
-      ["u", "Change a site's PHP version"],
+      ["u", "Update a site: PHP version or WordPress core"],
       ["o / w", "Open the site · open it in the SpinupWP web app"],
       ["s", "Open a terminal and SSH into the site"],
       ["t / v / L", "Local copy: open a terminal · open the local URL · link or edit"],
@@ -54,7 +54,7 @@ const GUIDES: Record<Route, Guide> = {
     title: "Stacks",
     summary: "Your fleet grouped by app type (Standard WP / Bedrock / Non-WP), with a fleet-wide PHP version breakdown.",
     panes: [
-      ["Groups", "App-type buckets; Non-WP expands into WHMCS / Laravel / …"],
+      ["Groups", "App-type buckets; WordPress stacks expand by core version (newest highlighted), Non-WP into WHMCS / Laravel / …"],
       ["Sites", "The sites in the selected group"],
       ["PHP versions", "How many sites run each PHP version (EOL flagged)"],
     ],
@@ -63,7 +63,8 @@ const GUIDES: Record<Route, Guide> = {
       ["D", "Identify every app in the selected group"],
       ["S", "Find local copies on your disk and link them"],
       ["f", "Report sites with no local copy (filter by stack with ←/→)"],
-      ["u", "Change a site's PHP version"],
+      ["u", "Update a site: PHP version or WordPress core"],
+      ["u (on a WP x.y.z row)", "Update WordPress on every site in that version group — canary first"],
       ["t / v / L", "Local copy: terminal · local URL · link or edit"],
       ["o / w", "Open the site · open it in SpinupWP"],
       ["s", "Open a terminal and SSH into the site"],
@@ -79,7 +80,7 @@ const GUIDES: Record<Route, Guide> = {
     actions: [
       ["type", "Filter results"],
       ["Tab / →", "Hand focus from the box to the result's actions"],
-      ["o / w / u", "Open · open in SpinupWP · change PHP"],
+      ["o / w / u", "Open · open in SpinupWP · update PHP or WordPress"],
       ["s", "SSH into the site (opens a terminal)"],
       ["t / v / L", "Local copy: terminal · local URL · link or edit"],
       ["d / p / m", "DB backup · pull prod→local · production media fallback"],

package/src/ui/Header.tsx

@@ -20,7 +20,7 @@ const TABS: { route: Route; key: string; label: string }[] = [
 // actions a user would reach for. Shown directly under the nav strip.
 const SUBTITLES: Record<Route, string> = {
   dashboard: "Your account at a glance — fleet health, what needs attention, recent activity",
-  servers: "Browse servers and their sites  ·  h server health  ·  u change PHP  ·  L link a local copy",
+  servers: "Browse servers and their sites  ·  h server health  ·  u update PHP/WP  ·  L link a local copy",
   stacks: "Your fleet grouped by app type  ·  d identify an app (SSH)  ·  S find local copies on your disk",
   search: "Jump to any server or site by name  ·  Tab hands focus to the result's actions",
   events: "Recent deploys, reboots, and operations across your account",

package/src/ui/Help.tsx

@@ -40,7 +40,7 @@ const NAV: Section = {
     ["c", "Create a new server"],
     ["C", "Clone this server to a new one"],
     ["S", "Connect sudo on the server"],
-    ["u", "Change PHP version"],
+    ["u", "Update PHP version or WordPress core"],
     ["H", "Enable/disable HTTPS"],
     ["P", "Purge page + object cache"],
     ["K", "Grant SpinupTUI's SSH key (sudo)"],

package/src/ui/ToastStack.tsx

@@ -20,11 +20,11 @@ export function ToastStack() {
         <box
           key={t.id}
           border
-          borderColor={theme.good}
+          borderColor={t.kind === "error" ? theme.bad : theme.good}
           backgroundColor={theme.bgPanel}
           style={{ flexDirection: "row", gap: 1, maxWidth: TOAST_WIDTH, paddingLeft: 1, paddingRight: 1 }}
         >
-          <text content="✓" fg={theme.good} />
+          <text content={t.kind === "error" ? "✕" : "✓"} fg={t.kind === "error" ? theme.bad : theme.good} />
           <text content={t.message} fg={theme.text} />
         </box>
       ))}

package/src/ui/components.tsx

@@ -459,7 +459,7 @@ export function siteGroups(isWordpress: boolean, isVanity: boolean): ActionGroup
     ["L", "Link / edit"],
   ]
   if (isWordpress) local.push(["m", "Media fallback"])
-  remote.push(["u", "PHP ver."])
+  remote.push(["u", "Update PHP / WP"])
   remote.push(["H", "Toggle HTTPS"])
   remote.push(["P", "Purge cache"])
   remote.push(["M", "Monitoring"])

package/src/ui/store.tsx

@@ -20,7 +20,7 @@ import { resolveLocalLink, expandPath, normalizeLink, type LocalLink } from "../
 import { cloneStackFor, type Stack } from "../lib/stack.ts"
 import { openTerminalAt, openUrl, openSshSession } from "../lib/open.ts"
 import { gitDrift, type Drift } from "../lib/gitStatus.ts"
-import { probeSite } from "../lib/probe.ts"
+import { probeSite, withWpVersion } from "../lib/probe.ts"
 import { resolveZone, normalizeDomain, candidateHostnames, type ZoneHost } from "../lib/dns.ts"
 import { queryAuthoritative } from "../lib/dnsQuery.ts"
 import { DnsCache, type CachedDns } from "../lib/dnsCache.ts"
@@ -484,6 +484,11 @@ interface StoreValue extends DataState {
   // The site whose PHP-upgrade overlay is open, or null. Set by site views.
   phpUpgradeSite: Site | null
   setPhpUpgradeSite: (s: Site | null) => void
+  // The Stacks version group whose bulk WordPress-update overlay is open, or null.
+  // The sites are a snapshot taken when it opened (the group itself reshuffles as
+  // updates land and versions change).
+  bulkWpGroup: { title: string; sites: Site[] } | null
+  setBulkWpGroup: (g: { title: string; sites: Site[] } | null) => void
   // In-flight (and just-failed) PHP upgrades, keyed by site id. Tracked in the
   // store — not the overlay — so progress survives closing the modal; site rows
   // and detail panels read this to show a spinner/marker.
@@ -757,6 +762,9 @@ interface StoreValue extends DataState {
   probeErrors: Map<number, string> // last error per site id
   // Probe a single site over SSH (fire-and-forget); write-through to the cache.
   runProbe: (site: Site) => void
+  // Fold a WP core version read elsewhere (the `u` → WordPress check/update) into
+  // the cached probe, so rows showing "WordPress x.y.z" don't lag behind it.
+  noteWpVersion: (site: Site, version: string) => void
   // Probe many sites with a bounded concurrency pool (skips in-flight sites).
   runProbeMany: (sites: Site[]) => void
   // Whether a cached probe for this site is stale (site shape changed since).
@@ -949,6 +957,7 @@ export function StoreProvider({ children }: { children: ReactNode }) {
   const [healthServer, setHealthServer] = useState<Server | null>(null)
   const [wpInventorySite, setWpInventorySite] = useState<Site | null>(null)
   const [phpUpgradeSite, setPhpUpgradeSite] = useState<Site | null>(null)
+  const [bulkWpGroup, setBulkWpGroup] = useState<{ title: string; sites: Site[] } | null>(null)
   const [phpUpgrades, setPhpUpgrades] = useState<Map<number, PhpUpgradeProgress>>(new Map())
   const [httpsToggleSite, setHttpsToggleSite] = useState<Site | null>(null)
   const [httpsToggles, setHttpsToggles] = useState<Map<number, HttpsToggleProgress>>(new Map())
@@ -1147,6 +1156,17 @@ export function StoreProvider({ children }: { children: ReactNode }) {
 
   // Probe one site and reconcile state + cache. Concurrency-safe (all state
   // updates are functional), so the batch runner can pool several at once.
+  const noteWpVersion = useCallback((site: Site, version: string) => {
+    const cache = cacheRef.current!
+    const entry = cache.get(site.id)
+    // Only refresh an existing WP-family probe: with no probe we don't know the
+    // stack (Standard vs Bedrock vs Radicle), and that's the probe's job.
+    if (!entry || entry.result.version === version) return
+    const next = withWpVersion(entry.result, version)
+    if (!next) return
+    void cache.set(site.id, next, siteSignature(site)).then(() => setProbes(cache.snapshot()))
+  }, [])
+
   const probeOne = useCallback(
     async (site: Site) => {
       const cache = cacheRef.current!
@@ -4249,6 +4269,8 @@ export function StoreProvider({ children }: { children: ReactNode }) {
     setWpInventorySite,
     phpUpgradeSite,
     setPhpUpgradeSite,
+    bulkWpGroup,
+    setBulkWpGroup,
     phpUpgrades,
     startPhpUpgrade,
     clearPhpUpgrade,
@@ -4421,6 +4443,7 @@ export function StoreProvider({ children }: { children: ReactNode }) {
     probingIds,
     probeErrors,
     runProbe,
+    noteWpVersion,
     runProbeMany,
     isProbeStale,
     dnsZones,

package/src/ui/toast.ts

@@ -3,7 +3,7 @@
 // Replaces the @opentui-ui/toast package, which is stuck on a peer-dependency
 // range from opentui's 0.1.x days and breaks against the @opentui/core 0.4.x
 // line we're on (see CHANGELOG v0.24.2/v0.24.3). Every call site in this app
-// only ever fires a single-line success message, so a small first-party
+// only ever fires a single-line success or error message, so a small first-party
 // implementation is simpler — and immune to upstream drift — than depending
 // on a package built for a much larger feature set we don't use.
 //
@@ -15,6 +15,7 @@
 export interface ToastItem {
   id: number
   message: string
+  kind: "success" | "error"
 }
 
 const TOAST_DURATION_MS = 4000
@@ -36,14 +37,19 @@ export function getToasts(): ToastItem[] {
   return toasts
 }
 
-export const toast = {
-  success(message: string) {
-    const id = nextId++
-    toasts = [...toasts, { id, message }]
+function push(message: string, kind: ToastItem["kind"]) {
+  const id = nextId++
+  toasts = [...toasts, { id, message, kind }]
+  notify()
+  setTimeout(() => {
+    toasts = toasts.filter((t) => t.id !== id)
     notify()
-    setTimeout(() => {
-      toasts = toasts.filter((t) => t.id !== id)
-      notify()
-    }, TOAST_DURATION_MS)
-  },
+  }, TOAST_DURATION_MS)
+}
+
+export const toast = {
+  success: (message: string) => push(message, "success"),
+  // For a background job that failed after its overlay was closed — points the
+  // user back at where the details are.
+  error: (message: string) => push(message, "error"),
 }

package/src/ui/views/Browser.tsx

@@ -11,6 +11,7 @@ import { theme, statusColor, statusDot } from "../../lib/theme.ts"
 import { effectiveStack, stackColor, stackTag } from "../../lib/stack.ts"
 import { truncate } from "../../lib/format.ts"
 import { Panel, PhpVersionCell, Spinner } from "../components.tsx"
+import { WpCoreRowMark } from "../wpCoreJobs.tsx"
 import { List, moveSelection } from "../List.tsx"
 import { ServerDetail, SiteDetail, ControlStrip, CONTROL_STRIP_HEIGHT } from "../Details.tsx"
 import { StatusBar } from "../StatusBar.tsx"
@@ -387,6 +388,7 @@ export function Browser({ rows }: { rows: number }) {
                       linked/key/HTTPS/cache/backup/updates badges moved to the Details
                       pane (already shown there for the selected site) to give the
                       domain name room on narrower terminals. */}
+                  <WpCoreRowMark siteId={s.id} selected={selected} compact />
                   <text content={stackTag(stack).padEnd(7) + " "} fg={stackColor(stack, selected)} wrapMode="none" style={{ flexShrink: 0 }} />
                   <PhpVersionCell version={s.php_version} upgrade={phpUpgrades.get(s.id)} selected={selected} />
                 </>