spinuptui 0.26.1 → 0.27.0

package/CHANGELOG.md

@@ -11,6 +11,18 @@ versions; such changes are called out here.
 
 ## [Unreleased]
 
+## [0.27.0] - 2026-09-23
+
+### Added
+- **Update WordPress core from `u`.** `u` is now **Update**, a menu with two choices: PHP version, the flow you already know, and WordPress core. The WordPress option checks the site over SSH with wp-cli and lists the available versions, with minor (security) releases picked first. After you confirm, it runs `wp core update` and then the database upgrade. The update keeps running if you close the overlay, and a toast reports when it's done. Bedrock and Radicle sites are included; for those, the confirm screen names the version `composer.lock` pins, and warns that the next `composer install` will put that version back until you run `composer update`.
+- **Stacks groups WordPress sites by core version.** Under Standard WP, Bedrock and Radicle, one indented row per WordPress version, newest first, shows how many sites run it (for example `└ WP 7.0.2  51`). The newest version in the fleet is highlighted green. Select a row to list its sites, which makes it easy to find the ones still waiting for a security release. `D` on a version row re-probes just those sites. Sites with no known version are grouped under `no version`, and the left pane now scrolls when the list is taller than the terminal.
+- **Update WordPress on a whole version group.** In Stacks, `u` on a version row (`└ WP 7.0.2`) checks every site in that group live over SSH, then shows a plan you can edit. The default target is the newest release in each site's own line (the security hotfix), and `m` switches to the newest release overall. `space` leaves a site out, and Bedrock and Radicle sites are marked `⚙` because of the `composer.lock` caveat. After you confirm, a canary site updates alone first, and if it fails nothing else is touched. The rest follow up to 4 at a time, one per server, stopping after 3 failures; `x` stops starting new sites. It keeps running if you close the overlay, and a single toast reports the result.
+- **Update progress shows on the site's row.** While a WordPress core update runs, the Stacks row replaces the version with a spinner and the target version (`⠹ → WP 7.1.2`). Servers and Search show a compact `WP` marker. If the update fails, the row keeps a `⬆!` marker until you open the result, and the toast that reports the failure is red instead of green.
+
+### Fixed
+- **The WordPress version on a site's row now follows the Update check.** Stacks and Servers show the version from the last `d` probe, so it went stale as soon as core changed. Opening **Update → WordPress core** reads the live version over SSH, and that value, along with the result of any update, now replaces the stored one.
+- **SpinupWP API errors now say why.** A rejected write used to show only "SpinupWP API error (HTTP 400)." The message now includes the reason from the API's response, such as which field it rejected.
+
 ## [0.26.1] - 2026-09-18
 
 ### Fixed
@@ -1415,7 +1427,8 @@ Initial tagged release.
 ### Notes
 - Read-only release: works with a SpinupWP **Read Only** API token.
 
-[Unreleased]: https://github.com/mwender/spinupwp-tui/compare/v0.26.1...HEAD
+[Unreleased]: https://github.com/mwender/spinupwp-tui/compare/v0.27.0...HEAD
+[0.27.0]: https://github.com/mwender/spinupwp-tui/compare/v0.26.1...v0.27.0
 [0.26.1]: https://github.com/mwender/spinupwp-tui/compare/v0.26.0...v0.26.1
 [0.26.0]: https://github.com/mwender/spinupwp-tui/compare/v0.25.0...v0.26.0
 [0.25.0]: https://github.com/mwender/spinupwp-tui/compare/v0.24.4...v0.25.0

package/README.md

@@ -53,8 +53,8 @@
   pull a production DB into a linked local copy. → [docs/database-backup-sync.md](docs/database-backup-sync.md)
 - **Production media fallback** (`m`, Servers / Search tabs) — serve missing-locally images
   from production after a DB pull. → [docs/production-media-fallback.md](docs/production-media-fallback.md)
-- **Upgrade a site's PHP version** (`u`) — pick a version, apply it, watch the
-  event complete. → [docs/php-upgrade.md](docs/php-upgrade.md)
+- **Update a site** (`u`) — change its PHP version, or update WordPress core over
+  SSH (Standard WP, Bedrock and Radicle). → [docs/php-upgrade.md](docs/php-upgrade.md)
 - **Enable / disable HTTPS** (`H`) — toggle a site's certificate.
 - **Purge cache** (`P`) — clear page + object cache together.
 - **Server actions** (`a`) — reboot or restart a service, with the real reason a
@@ -320,7 +320,7 @@ These can be set in `config.json` or via an environment variable:
 | `D` | Identify every site in the selected stack (Stacks tab) |
 | `S` | Auto-discover & batch-link local copies (Stacks tab) |
 | `f` | Report sites with no usable local copy (Stacks tab only — `f` identifies a site's stack in Servers/Search, above) |
-| `u` | Upgrade a site's PHP version (Servers / Stacks / Search; needs a Read/Write token) |
+| `u` | Update a site: PHP version (needs a Read/Write token) or WordPress core (over SSH) (Servers / Stacks / Search) |
 | `H` | Enable / disable HTTPS on a site (Servers / Stacks / Search; needs a Read/Write token) |
 | `P` | Purge a site's page cache + object cache (Servers / Stacks / Search; needs a Read/Write token) |
 | `M` | Site/server monitoring — a two-pane browser of this site's Uptime Kuma monitors (capital, since lowercase `m` is media fallback in Servers/Search). Inside: `↑`/`↓` selects a monitor, `a` registers/recalibrates/repairs it (Front page and Cache bypass open a check-window picker), `x` removes Front page or Cache bypass, `o` opens the selected monitor in Kuma, `d` runs the site doctor, `n` shows/edits alert wiring, and vanity sites add `R`/`r` for page refresh/secret rotation (Servers / Stacks / Search) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spinuptui",
-  "version": "0.26.1",
+  "version": "0.27.0",
   "description": "SpinupTUI — a terminal dashboard for browsing, monitoring, and managing your SpinupWP servers and sites.",
   "type": "module",
   "bin": {

package/src/api/client.ts

@@ -31,6 +31,42 @@ export class ApiError extends Error {
   }
 }
 
+// Pull the human-readable reason out of a SpinupWP error body. The API answers
+// validation failures Laravel-style — {"message": "...", "errors": {field: [..]}}
+// — and a bare "HTTP 400" hides exactly the part the user needs (which field,
+// and why). Returns "" when the body has nothing usable, so callers can fall
+// back to the status-only message.
+export function apiErrorDetail(body: string | undefined): string {
+  const text = (body ?? "").trim()
+  if (!text) return ""
+  let json: unknown
+  try {
+    json = JSON.parse(text)
+  } catch {
+    // Not JSON (an HTML error page, say) — a short plain-text body is still worth
+    // showing; anything long is noise.
+    return text.length <= 200 && !text.startsWith("<") ? text : ""
+  }
+  if (!json || typeof json !== "object") return ""
+  const j = json as { message?: unknown; error?: unknown; errors?: unknown }
+  const parts: string[] = []
+  const message = typeof j.message === "string" ? j.message : typeof j.error === "string" ? j.error : ""
+  if (j.errors && typeof j.errors === "object") {
+    for (const v of Object.values(j.errors as Record<string, unknown>)) {
+      for (const m of Array.isArray(v) ? v : [v]) if (typeof m === "string" && !parts.includes(m)) parts.push(m)
+    }
+  }
+  // Laravel's top-level message usually just repeats the first field error
+  // ("The php version is invalid. (and 1 more error)") — prefer the field list.
+  if (parts.length) return parts.join(" ")
+  return message
+}
+
+function httpErrorMessage(status: number, body: string): string {
+  const detail = apiErrorDetail(body)
+  return detail ? `SpinupWP API error (HTTP ${status}): ${detail}` : `SpinupWP API error (HTTP ${status}).`
+}
+
 export interface ClientOptions {
   token: string
   baseUrl: string
@@ -152,7 +188,7 @@ export class SpinupWPClient implements SpinupWPClientLike {
     }
     if (!res.ok) {
       const body = await res.text().catch(() => "")
-      throw new ApiError(`SpinupWP API error (HTTP ${res.status}).`, res.status, body)
+      throw new ApiError(httpErrorMessage(res.status, body), res.status, body)
     }
 
     return (await res.json()) as T
@@ -189,7 +225,7 @@ export class SpinupWPClient implements SpinupWPClientLike {
     }
     if (!res.ok) {
       const errBody = await res.text().catch(() => "")
-      throw new ApiError(`SpinupWP API error (HTTP ${res.status}).`, res.status, errBody)
+      throw new ApiError(httpErrorMessage(res.status, errBody), res.status, errBody)
     }
 
     // Some write endpoints (e.g. PHP upgrade) return a bare body, others 204.

package/src/lib/probe.ts

@@ -167,6 +167,22 @@ function parseSections(out: string): Record<string, string> {
   return flat
 }
 
+// The same probe result with a newly learned WordPress core version, relabeled the
+// way classify() labels it. Returns null for kinds that don't carry a WP version
+// (a WHMCS/Laravel/static site's cached identity must never be rewritten).
+export function withWpVersion(r: ProbeResult, version: string): ProbeResult | null {
+  switch (r.kind) {
+    case "wordpress":
+      return { ...r, version, label: `WordPress ${version}` }
+    case "bedrock":
+      return { ...r, version, label: `Bedrock · WP ${version}` }
+    case "radicle":
+      return { ...r, version, label: `Radicle · WP ${version}` }
+    default:
+      return null
+  }
+}
+
 // Turn raw signals into a named stack. Order matters: name the distinctive apps
 // (WHMCS, Bedrock, Laravel) before falling back to a generic WordPress version.
 export function classify(sig: Record<string, string>): ProbeResult {

package/src/lib/wpCore.ts

@@ -0,0 +1,273 @@
+// WordPress core updates over SSH — `wp core check-update` / `wp core update`,
+// run as the site user in the site's real WordPress directory. The SpinupWP API
+// has no core-update endpoint (it only reports a `wp_core_update` flag), so this
+// is the same key-based SSH path the Plugins & themes view reads through.
+//
+// The WP dir is DETECTED, never assumed (see CLAUDE.md "WordPress layout rules"):
+// detectWpDirScript finds core on /public/, root-webroot, and Bedrock (web/wp)
+// layouts alike.
+//
+// Composer-managed core (Bedrock, Radicle) is allowed, deliberately: for a
+// security hotfix, getting the patched files onto the server NOW matters more
+// than keeping composer.lock in step. But it's a real divergence — the lock
+// still pins the old version, so the next `composer install` (a git deploy, a
+// clone) silently reverts the patch. The check reports the locked version so
+// the UI can say exactly that before anything runs.
+
+import type { Server, Site } from "../api/types.ts"
+import { SSH_OPTS, sshPort } from "./dbBackup.ts"
+import { detectWpDirScript } from "./serverClone.ts"
+import { wpCliResolveScript } from "./wpCli.ts"
+import { spawn } from "./spawn.ts"
+
+export interface WpCoreOffer {
+  version: string
+  updateType: string // "minor" | "major" (wp-cli's update_type)
+}
+
+export interface WpCoreStatus {
+  wpDir: string
+  current: string
+  offers: WpCoreOffer[] // newest first, as wp-cli lists them; [] = up to date
+  multisite: boolean
+  // Set when core is installed by Composer (roots/wordpress, johnpbloch/wordpress…):
+  // the version composer.lock pins, which a later `composer install` restores.
+  composer: { lockedVersion: string | null } | null
+}
+
+export type WpCoreCheckResult =
+  | { ok: true; target: string; status: WpCoreStatus }
+  | { ok: false; target: string; error: string }
+
+export type WpCoreUpdateResult =
+  | { ok: true; before: string; after: string; log: string }
+  | { ok: false; error: string; log: string }
+
+// Numeric, segment-wise version compare ("7.0" < "7.0.2" < "7.1"); non-numeric
+// tails are ignored, which is fine for WordPress release numbers.
+export function compareVersions(a: string, b: string): number {
+  const pa = a.split(".").map((n) => parseInt(n, 10) || 0)
+  const pb = b.split(".").map((n) => parseInt(n, 10) || 0)
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0)
+    if (d !== 0) return d
+  }
+  return 0
+}
+
+// The two targets a bulk update can aim for. "line" = the newest release in the
+// site's own major.minor line (7.0.2 → 7.0.x): WordPress backports security
+// fixes there, so it's the low-risk hotfix. "newest" = the newest release,
+// period (a major update for anyone on an older line). null = nothing to do.
+export type WpTargetMode = "line" | "newest"
+
+export function wpTarget(current: string, offers: WpCoreOffer[], mode: WpTargetMode): string | null {
+  const line = (v: string) => v.split(".").slice(0, 2).join(".")
+  const pool = mode === "line" ? offers.filter((o) => line(o.version) === line(current)) : offers
+  let best: string | null = null
+  for (const o of pool) if (compareVersions(o.version, current) > 0 && (!best || compareVersions(o.version, best) > 0)) best = o.version
+  return best
+}
+
+// Composer packages that install WordPress core itself.
+const CORE_PACKAGES = ["roots/wordpress", "roots/wordpress-no-content", "roots/wordpress-full", "johnpbloch/wordpress", "johnpbloch/wordpress-core"]
+
+interface Prepared {
+  target: string
+  args: string[]
+}
+
+function prepare(server: Server, site: Site, sshUser: string | null): Prepared | { error: string; target: string } {
+  const ip = server.ip_address
+  const user = site.site_user ?? sshUser
+  if (!ip) return { target: "(no IP)", error: "Server has no IP address." }
+  if (!user) return { target: ip, error: "Site has no site user — can't SSH in to run wp-cli." }
+  const target = `${user}@${ip}`
+  return { target, args: ["ssh", ...SSH_OPTS, ...sshPort(server.ssh_port ?? null), target] }
+}
+
+// Shared preamble: locate core (sets $W, bails with ===NOTWP when there's none),
+// then resolve $PHP/$WP pinned to the site's own PHP-CLI (see wpCli.ts).
+function preamble(site: Site): string {
+  const root = `/sites/${site.domain}/files`
+  return [
+    detectWpDirScript(root, site.public_folder ?? undefined),
+    `if [ -z "$W" ]; then echo ===NOTWP; echo ===END; exit 0; fi`,
+    wpCliResolveScript(site.php_version),
+    // Every core command runs with plugins and themes unloaded: none of them need
+    // either, and a plugin's PHP notices land on STDOUT under the CLI SAPI —
+    // verified live on an Elementor Pro site under PHP 8.4, where a wall of
+    // "Implicitly marking parameter … as nullable is deprecated" swallowed the
+    // check-update JSON and the site read as up to date while two versions behind.
+    // It also keeps a fataling plugin from blocking the core update that fixes it.
+    `wpc() { "$PHP" "$WP" --path="$W" --skip-plugins --skip-themes "$@"; }`,
+  ].join("\n")
+}
+
+async function run(args: string[], remote: string, timeoutMs: number): Promise<{ code: number; stdout: string; stderr: string }> {
+  const proc = spawn([...args, remote], { stdout: "pipe", stderr: "pipe", stdin: "ignore" })
+  const timer = setTimeout(() => {
+    try {
+      proc.kill()
+    } catch {
+      /* already gone */
+    }
+  }, timeoutMs)
+  const code = await proc.exited
+  clearTimeout(timer)
+  const stdout = await new Response(proc.stdout as ReadableStream<Uint8Array>).text()
+  const stderr = await new Response(proc.stderr as ReadableStream<Uint8Array>).text()
+  return { code, stdout, stderr }
+}
+
+function splitSections(out: string): Record<string, string[]> {
+  const sections: Record<string, string[]> = {}
+  let current = ""
+  for (const rawLine of out.split("\n")) {
+    const line = rawLine.replace(/\r$/, "")
+    const m = line.match(/^===([A-Z]+)$/)
+    if (m) {
+      current = m[1]
+      sections[current] = []
+    } else if (current) {
+      sections[current].push(line)
+    }
+  }
+  return sections
+}
+
+function sshFailure(code: number, stderr: string): string {
+  return stderr.trim().split("\n").slice(-2).join(" ") || `ssh exited with code ${code}`
+}
+
+// Read the installed version, available updates, multisite-ness, and whether
+// Composer owns core. Strictly read-only.
+export async function checkWpCore(server: Server, site: Site, sshUser: string | null): Promise<WpCoreCheckResult> {
+  const p = prepare(server, site, sshUser)
+  if ("error" in p) return { ok: false, target: p.target, error: p.error }
+
+  // composer.lock sits at the project root: $W/../.. for Bedrock (web/wp),
+  // $W/.. for a public/ layout, or $W itself. The first lock that lists a core
+  // package wins; PHP parses it (jq isn't guaranteed on the box).
+  const pkgs = CORE_PACKAGES.map((n) => `'${n}'`).join(",")
+  const lockPhp = `$l=json_decode(file_get_contents($argv[1]),true);foreach(array_merge($l["packages"]??[],$l["packages-dev"]??[]) as $p){if(in_array($p["name"],[${pkgs}],true)){echo $p["version"];exit(0);}}exit(1);`
+  const remote = [
+    preamble(site),
+    `echo ===WPDIR; printf '%s\\n' "$W"`,
+    // Trailing `echo`s are load-bearing: wp's JSON/plain output has no trailing
+    // newline, so the next ===MARKER would glue onto it (see wpInventory.ts).
+    `echo ===VERSION; wpc core version 2>/dev/null || true; echo`,
+    `echo ===UPDATES; wpc core check-update --format=json 2>/dev/null || true; echo`,
+    `echo ===MULTISITE; wpc core is-installed --network >/dev/null 2>&1 && echo yes || echo no`,
+    `echo ===COMPOSER`,
+    `for d in "$W/../.." "$W/.." "$W"; do if [ -f "$d/composer.lock" ]; then v=$("$PHP" -r ${shq(lockPhp)} "$d/composer.lock" 2>/dev/null) && { echo "locked $v"; break; }; fi; if [ -f "$d/composer.json" ] && grep -qE '"(${CORE_PACKAGES.join("|")})"' "$d/composer.json"; then echo "managed"; break; fi; done`,
+    `echo ===END`,
+  ].join("\n")
+
+  let res: Awaited<ReturnType<typeof run>>
+  try {
+    res = await run(p.args, remote, 60_000)
+  } catch (err) {
+    return { ok: false, target: p.target, error: `Failed to launch ssh: ${(err as Error).message}` }
+  }
+  if (res.code !== 0 && !res.stdout.includes("===END")) return { ok: false, target: p.target, error: sshFailure(res.code, res.stderr) }
+
+  const s = splitSections(res.stdout)
+  if ("NOTWP" in s) return { ok: false, target: p.target, error: "No WordPress core found under the site's files — is this a WordPress site?" }
+  const current = lastVersionLine(s.VERSION)
+  if (!current) return { ok: false, target: p.target, error: "wp-cli couldn't read the WordPress version on this site." }
+
+  // Belt and braces with --skip-plugins: scan back for the line that parses as
+  // the JSON array, ignoring any other noise (a mu-plugin's notices still load).
+  // No match = "Success: WordPress is at the latest version." (plain text).
+  let offers: WpCoreOffer[] = []
+  for (const line of [...(s.UPDATES ?? [])].reverse()) {
+    if (!line.trim().startsWith("[")) continue
+    let parsed: unknown
+    try {
+      parsed = JSON.parse(line.trim())
+    } catch {
+      continue
+    }
+    if (!Array.isArray(parsed)) continue
+    offers = parsed
+      .filter((o) => o && typeof o.version === "string")
+      .map((o) => ({ version: o.version as string, updateType: typeof o.update_type === "string" ? o.update_type : "" }))
+    break
+  }
+
+  const comp = (s.COMPOSER ?? []).join("\n").trim()
+  const locked = comp.match(/^locked (.+)$/m)
+  const composer = locked ? { lockedVersion: locked[1].replace(/^v/, "") } : comp.includes("managed") ? { lockedVersion: null } : null
+
+  return {
+    ok: true,
+    target: p.target,
+    status: {
+      wpDir: (s.WPDIR?.[0] || "").trim(),
+      current,
+      offers,
+      multisite: (s.MULTISITE ?? []).join("").trim() === "yes",
+      composer,
+    },
+  }
+}
+
+// Update core to `version`, then run the database upgrade (network-wide on
+// multisite) and read the version back. If the update dies mid-way, WordPress
+// leaves a .maintenance file that keeps the site on "Briefly unavailable" for
+// up to 10 minutes — we remove it so a failure doesn't turn into downtime.
+export async function updateWpCore(
+  server: Server,
+  site: Site,
+  sshUser: string | null,
+  version: string,
+  multisite: boolean,
+): Promise<WpCoreUpdateResult> {
+  const p = prepare(server, site, sshUser)
+  if ("error" in p) return { ok: false, error: p.error, log: "" }
+  if (!/^[0-9][0-9A-Za-z.-]*$/.test(version)) return { ok: false, error: `Refusing odd version string "${version}".`, log: "" }
+
+  const remote = [
+    preamble(site),
+    `echo ===BEFORE; wpc core version 2>/dev/null; echo`,
+    `echo ===LOG`,
+    `wpc core update --version=${version} 2>&1; rc=$?`,
+    `if [ $rc -eq 0 ]; then wpc core update-db${multisite ? " --network" : ""} 2>&1 || rc=$?; fi`,
+    `[ -f "$W/.maintenance" ] && rm -f "$W/.maintenance" && echo "Removed a leftover .maintenance file."`,
+    `echo; echo ===RC; echo $rc`,
+    `echo ===AFTER; wpc core version 2>/dev/null; echo`,
+    `echo ===END`,
+  ].join("\n")
+
+  let res: Awaited<ReturnType<typeof run>>
+  try {
+    res = await run(p.args, remote, 300_000)
+  } catch (err) {
+    return { ok: false, error: `Failed to launch ssh: ${(err as Error).message}`, log: "" }
+  }
+  if (!res.stdout.includes("===END")) {
+    return { ok: false, error: res.code === 0 ? "The update didn't finish (timed out?)." : sshFailure(res.code, res.stderr), log: res.stdout.trim() }
+  }
+  const s = splitSections(res.stdout)
+  if ("NOTWP" in s) return { ok: false, error: "No WordPress core found under the site's files.", log: "" }
+  const log = (s.LOG ?? []).join("\n").trim()
+  const rc = Number((s.RC ?? []).join("").trim())
+  const before = lastVersionLine(s.BEFORE)
+  const after = lastVersionLine(s.AFTER)
+  if (rc !== 0) {
+    const lastErr = log.split("\n").filter((l) => /error|warning/i.test(l)).pop()
+    return { ok: false, error: lastErr ?? `wp core update exited with code ${rc}.`, log }
+  }
+  if (after !== version) return { ok: false, error: `wp-cli reported success, but the site now reports ${after || "no version"} (wanted ${version}).`, log }
+  return { ok: true, before, after, log }
+}
+
+// `wp core version` prints a bare version; pick that line out of any noise.
+function lastVersionLine(lines: string[] | undefined): string {
+  return [...(lines ?? [])].reverse().map((l) => l.trim()).find((l) => /^\d+\.\d+(\.\d+)?([-.][0-9A-Za-z.-]+)?$/.test(l)) ?? ""
+}
+
+function shq(s: string): string {
+  return `'${s.replace(/'/g, `'\\''`)}'`
+}

package/src/ui/App.tsx

@@ -15,7 +15,8 @@ import { Stacks } from "./views/Stacks.tsx"
 import { Search } from "./views/Search.tsx"
 import { Events } from "./views/Events.tsx"
 import { Health } from "./views/Health.tsx"
-import { PhpUpgrade } from "./views/PhpUpgrade.tsx"
+import { SiteUpdate } from "./views/SiteUpdate.tsx"
+import { BulkWpUpdate } from "./views/BulkWpUpdate.tsx"
 import { HttpsToggle } from "./views/HttpsToggle.tsx"
 import { PurgeCache } from "./views/PurgeCache.tsx"
 import { ReleaseNotes } from "./views/ReleaseNotes.tsx"
@@ -63,6 +64,7 @@ export function App() {
     store.healthServer !== null ||
     store.wpInventorySite !== null ||
     store.phpUpgradeSite !== null ||
+    store.bulkWpGroup !== null ||
     store.httpsToggleSite !== null ||
     store.purgeCacheSite !== null ||
     store.grantKeySite !== null ||
@@ -129,6 +131,9 @@ export function App() {
     // The PHP-upgrade overlay owns the keyboard while open.
     if (store.phpUpgradeSite) return
 
+    // The bulk WordPress-update overlay owns the keyboard while open.
+    if (store.bulkWpGroup) return
+
     // The HTTPS-toggle overlay owns the keyboard while open.
     if (store.httpsToggleSite) return
 
@@ -247,7 +252,8 @@ export function App() {
       {store.releaseNotesInfo && <ReleaseNotes />}
       {store.healthServer && <Health />}
       {store.wpInventorySite && <WpInventory />}
-      {store.phpUpgradeSite && <PhpUpgrade />}
+      {store.phpUpgradeSite && <SiteUpdate />}
+      {store.bulkWpGroup && <BulkWpUpdate />}
       {store.httpsToggleSite && <HttpsToggle />}
       {store.purgeCacheSite && <PurgeCache />}
       {store.grantKeySite && <GrantKey />}

package/src/ui/Explain.tsx

@@ -44,7 +44,7 @@ const GUIDES: Record<Route, Guide> = {
       ["h", "Server health over SSH (CPU / memory / disk)"],
       ["a", "Server actions: reboot or restart a service"],
       ["d", "Identify the app running on a site (SSH)"],
-      ["u", "Change a site's PHP version"],
+      ["u", "Update a site: PHP version or WordPress core"],
       ["o / w", "Open the site · open it in the SpinupWP web app"],
       ["s", "Open a terminal and SSH into the site"],
       ["t / v / L", "Local copy: open a terminal · open the local URL · link or edit"],
@@ -54,7 +54,7 @@ const GUIDES: Record<Route, Guide> = {
     title: "Stacks",
     summary: "Your fleet grouped by app type (Standard WP / Bedrock / Non-WP), with a fleet-wide PHP version breakdown.",
     panes: [
-      ["Groups", "App-type buckets; Non-WP expands into WHMCS / Laravel / …"],
+      ["Groups", "App-type buckets; WordPress stacks expand by core version (newest highlighted), Non-WP into WHMCS / Laravel / …"],
       ["Sites", "The sites in the selected group"],
       ["PHP versions", "How many sites run each PHP version (EOL flagged)"],
     ],
@@ -63,7 +63,8 @@ const GUIDES: Record<Route, Guide> = {
       ["D", "Identify every app in the selected group"],
       ["S", "Find local copies on your disk and link them"],
       ["f", "Report sites with no local copy (filter by stack with ←/→)"],
-      ["u", "Change a site's PHP version"],
+      ["u", "Update a site: PHP version or WordPress core"],
+      ["u (on a WP x.y.z row)", "Update WordPress on every site in that version group — canary first"],
       ["t / v / L", "Local copy: terminal · local URL · link or edit"],
       ["o / w", "Open the site · open it in SpinupWP"],
       ["s", "Open a terminal and SSH into the site"],
@@ -79,7 +80,7 @@ const GUIDES: Record<Route, Guide> = {
     actions: [
       ["type", "Filter results"],
       ["Tab / →", "Hand focus from the box to the result's actions"],
-      ["o / w / u", "Open · open in SpinupWP · change PHP"],
+      ["o / w / u", "Open · open in SpinupWP · update PHP or WordPress"],
       ["s", "SSH into the site (opens a terminal)"],
       ["t / v / L", "Local copy: terminal · local URL · link or edit"],
       ["d / p / m", "DB backup · pull prod→local · production media fallback"],

package/src/ui/Header.tsx

@@ -20,7 +20,7 @@ const TABS: { route: Route; key: string; label: string }[] = [
 // actions a user would reach for. Shown directly under the nav strip.
 const SUBTITLES: Record<Route, string> = {
   dashboard: "Your account at a glance — fleet health, what needs attention, recent activity",
-  servers: "Browse servers and their sites  ·  h server health  ·  u change PHP  ·  L link a local copy",
+  servers: "Browse servers and their sites  ·  h server health  ·  u update PHP/WP  ·  L link a local copy",
   stacks: "Your fleet grouped by app type  ·  d identify an app (SSH)  ·  S find local copies on your disk",
   search: "Jump to any server or site by name  ·  Tab hands focus to the result's actions",
   events: "Recent deploys, reboots, and operations across your account",

package/src/ui/Help.tsx

@@ -40,7 +40,7 @@ const NAV: Section = {
     ["c", "Create a new server"],
     ["C", "Clone this server to a new one"],
     ["S", "Connect sudo on the server"],
-    ["u", "Change PHP version"],
+    ["u", "Update PHP version or WordPress core"],
     ["H", "Enable/disable HTTPS"],
     ["P", "Purge page + object cache"],
     ["K", "Grant SpinupTUI's SSH key (sudo)"],

package/src/ui/ToastStack.tsx

@@ -20,11 +20,11 @@ export function ToastStack() {
         <box
           key={t.id}
           border
-          borderColor={theme.good}
+          borderColor={t.kind === "error" ? theme.bad : theme.good}
           backgroundColor={theme.bgPanel}
           style={{ flexDirection: "row", gap: 1, maxWidth: TOAST_WIDTH, paddingLeft: 1, paddingRight: 1 }}
         >
-          <text content="✓" fg={theme.good} />
+          <text content={t.kind === "error" ? "✕" : "✓"} fg={t.kind === "error" ? theme.bad : theme.good} />
           <text content={t.message} fg={theme.text} />
         </box>
       ))}

package/src/ui/components.tsx

@@ -459,7 +459,7 @@ export function siteGroups(isWordpress: boolean, isVanity: boolean): ActionGroup
     ["L", "Link / edit"],
   ]
   if (isWordpress) local.push(["m", "Media fallback"])
-  remote.push(["u", "PHP ver."])
+  remote.push(["u", "Update PHP / WP"])
   remote.push(["H", "Toggle HTTPS"])
   remote.push(["P", "Purge cache"])
   remote.push(["M", "Monitoring"])

package/src/ui/store.tsx

@@ -20,7 +20,7 @@ import { resolveLocalLink, expandPath, normalizeLink, type LocalLink } from "../
 import { cloneStackFor, type Stack } from "../lib/stack.ts"
 import { openTerminalAt, openUrl, openSshSession } from "../lib/open.ts"
 import { gitDrift, type Drift } from "../lib/gitStatus.ts"
-import { probeSite } from "../lib/probe.ts"
+import { probeSite, withWpVersion } from "../lib/probe.ts"
 import { resolveZone, normalizeDomain, candidateHostnames, type ZoneHost } from "../lib/dns.ts"
 import { queryAuthoritative } from "../lib/dnsQuery.ts"
 import { DnsCache, type CachedDns } from "../lib/dnsCache.ts"
@@ -484,6 +484,11 @@ interface StoreValue extends DataState {
   // The site whose PHP-upgrade overlay is open, or null. Set by site views.
   phpUpgradeSite: Site | null
   setPhpUpgradeSite: (s: Site | null) => void
+  // The Stacks version group whose bulk WordPress-update overlay is open, or null.
+  // The sites are a snapshot taken when it opened (the group itself reshuffles as
+  // updates land and versions change).
+  bulkWpGroup: { title: string; sites: Site[] } | null
+  setBulkWpGroup: (g: { title: string; sites: Site[] } | null) => void
   // In-flight (and just-failed) PHP upgrades, keyed by site id. Tracked in the
   // store — not the overlay — so progress survives closing the modal; site rows
   // and detail panels read this to show a spinner/marker.
@@ -757,6 +762,9 @@ interface StoreValue extends DataState {
   probeErrors: Map<number, string> // last error per site id
   // Probe a single site over SSH (fire-and-forget); write-through to the cache.
   runProbe: (site: Site) => void
+  // Fold a WP core version read elsewhere (the `u` → WordPress check/update) into
+  // the cached probe, so rows showing "WordPress x.y.z" don't lag behind it.
+  noteWpVersion: (site: Site, version: string) => void
   // Probe many sites with a bounded concurrency pool (skips in-flight sites).
   runProbeMany: (sites: Site[]) => void
   // Whether a cached probe for this site is stale (site shape changed since).
@@ -949,6 +957,7 @@ export function StoreProvider({ children }: { children: ReactNode }) {
   const [healthServer, setHealthServer] = useState<Server | null>(null)
   const [wpInventorySite, setWpInventorySite] = useState<Site | null>(null)
   const [phpUpgradeSite, setPhpUpgradeSite] = useState<Site | null>(null)
+  const [bulkWpGroup, setBulkWpGroup] = useState<{ title: string; sites: Site[] } | null>(null)
   const [phpUpgrades, setPhpUpgrades] = useState<Map<number, PhpUpgradeProgress>>(new Map())
   const [httpsToggleSite, setHttpsToggleSite] = useState<Site | null>(null)
   const [httpsToggles, setHttpsToggles] = useState<Map<number, HttpsToggleProgress>>(new Map())
@@ -1147,6 +1156,17 @@ export function StoreProvider({ children }: { children: ReactNode }) {
 
   // Probe one site and reconcile state + cache. Concurrency-safe (all state
   // updates are functional), so the batch runner can pool several at once.
+  const noteWpVersion = useCallback((site: Site, version: string) => {
+    const cache = cacheRef.current!
+    const entry = cache.get(site.id)
+    // Only refresh an existing WP-family probe: with no probe we don't know the
+    // stack (Standard vs Bedrock vs Radicle), and that's the probe's job.
+    if (!entry || entry.result.version === version) return
+    const next = withWpVersion(entry.result, version)
+    if (!next) return
+    void cache.set(site.id, next, siteSignature(site)).then(() => setProbes(cache.snapshot()))
+  }, [])
+
   const probeOne = useCallback(
     async (site: Site) => {
       const cache = cacheRef.current!
@@ -4249,6 +4269,8 @@ export function StoreProvider({ children }: { children: ReactNode }) {
     setWpInventorySite,
     phpUpgradeSite,
     setPhpUpgradeSite,
+    bulkWpGroup,
+    setBulkWpGroup,
     phpUpgrades,
     startPhpUpgrade,
     clearPhpUpgrade,
@@ -4421,6 +4443,7 @@ export function StoreProvider({ children }: { children: ReactNode }) {
     probingIds,
     probeErrors,
     runProbe,
+    noteWpVersion,
     runProbeMany,
     isProbeStale,
     dnsZones,