spinuptui 0.26.1 → 0.28.0

package/src/lib/providersCache.ts

@@ -13,7 +13,7 @@
 import { join } from "node:path"
 import { existsSync, readFileSync } from "node:fs"
 import { chmod, mkdir } from "node:fs/promises"
-import { configDir } from "../config.ts"
+import { profileDataDir } from "../config.ts"
 import type { VerifiedZone } from "./providers.ts"
 
 // v2: VerifiedZone gained `nameservers` + `account` (was accountId/accountName).
@@ -42,17 +42,20 @@ interface CacheFile {
   entries: Record<string, VerifiedConn> // key: connection id
 }
 
-export function providersCachePath(): string {
-  return join(configDir(), "providers-cache.json")
+export function providersCachePath(dir = profileDataDir()): string {
+  return join(dir, "providers-cache.json")
 }
 
 export class ProvidersCache {
+  // Pinned to the account active when the cache was created, so a write that
+  // lands after an account switch still goes to its own account\'s file.
+  private readonly dir = profileDataDir()
   private entries = new Map<string, VerifiedConn>()
   private writeChain: Promise<void> = Promise.resolve()
 
   load(): void {
     try {
-      const path = providersCachePath()
+      const path = providersCachePath(this.dir)
       if (!existsSync(path)) return
       const parsed = JSON.parse(readFileSync(path, "utf8")) as CacheFile
       if (parsed?.version !== CACHE_VERSION || !parsed.entries) return
@@ -91,10 +94,10 @@ export class ProvidersCache {
   }
 
   private async writeFile(): Promise<void> {
-    await mkdir(configDir(), { recursive: true })
+    await mkdir(this.dir, { recursive: true })
     const file: CacheFile = { version: CACHE_VERSION, entries: {} }
     for (const [k, entry] of this.entries) file.entries[k] = entry
-    const path = providersCachePath()
+    const path = providersCachePath(this.dir)
     await Bun.write(path, JSON.stringify(file, null, 2) + "\n")
     try {
       await chmod(path, 0o600)

package/src/lib/stackCache.ts

@@ -12,7 +12,7 @@
 import { join } from "node:path"
 import { existsSync, readFileSync } from "node:fs"
 import { chmod, mkdir } from "node:fs/promises"
-import { configDir } from "../config.ts"
+import { profileDataDir } from "../config.ts"
 import type { ProbeResult } from "./probe.ts"
 
 const CACHE_VERSION = 1
@@ -28,8 +28,8 @@ interface CacheFile {
   entries: Record<string, CachedProbe> // key: String(site.id)
 }
 
-export function stackCachePath(): string {
-  return join(configDir(), "stack-cache.json")
+export function stackCachePath(dir = profileDataDir()): string {
+  return join(dir, "stack-cache.json")
 }
 
 // A cached probe is considered stale when the site's relevant shape changes.
@@ -40,6 +40,9 @@ export function siteSignature(site: { is_wordpress: boolean; public_folder: stri
 }
 
 export class StackCache {
+  // Pinned to the account active when the cache was created, so a write that
+  // lands after an account switch still goes to its own account\'s file.
+  private readonly dir = profileDataDir()
   private entries = new Map<number, CachedProbe>()
   // Serializes disk writes so concurrent probes (batch mode) can't tear the
   // file or drop each other's updates. Each persist() runs after the previous.
@@ -49,7 +52,7 @@ export class StackCache {
   // simply yields an empty cache.
   load(): void {
     try {
-      const path = stackCachePath()
+      const path = stackCachePath(this.dir)
       if (!existsSync(path)) return
       const parsed = JSON.parse(readFileSync(path, "utf8")) as CacheFile
       if (parsed?.version !== CACHE_VERSION || !parsed.entries) return
@@ -99,10 +102,10 @@ export class StackCache {
   }
 
   private async writeFile(): Promise<void> {
-    await mkdir(configDir(), { recursive: true })
+    await mkdir(this.dir, { recursive: true })
     const file: CacheFile = { version: CACHE_VERSION, entries: {} }
     for (const [id, entry] of this.entries) file.entries[String(id)] = entry
-    const path = stackCachePath()
+    const path = stackCachePath(this.dir)
     await Bun.write(path, JSON.stringify(file, null, 2) + "\n")
     try {
       await chmod(path, 0o600)

package/src/lib/wpCli.ts

@@ -5,9 +5,9 @@
 // individual site's configured version, and can be missing extensions that
 // version's CLI SAPI never got configured with.
 //
-// Verified live 2026-07-09 on web4.wenmarkdigital.com: the system default had
+// Verified live 2026-07-09 on a production server: the system default had
 // drifted to 8.4, whose CLI lacked `mysqli` (its FPM pool likely never needed
-// it — no site there runs 8.4), while lp.anchoredconstructiontn.com's actual
+// it — no site there runs 8.4), while a site's actual
 // configured version (8.1) has a fully working php8.1-cli. Bare `wp` silently
 // ran under 8.4 and failed on anything touching $wpdb (post/user/plugin list,
 // option get) — while `wp core version`, and `wp db export/import/check/size`

package/src/lib/wpCore.ts

@@ -0,0 +1,273 @@
+// WordPress core updates over SSH — `wp core check-update` / `wp core update`,
+// run as the site user in the site's real WordPress directory. The SpinupWP API
+// has no core-update endpoint (it only reports a `wp_core_update` flag), so this
+// is the same key-based SSH path the Plugins & themes view reads through.
+//
+// The WP dir is DETECTED, never assumed (see CLAUDE.md "WordPress layout rules"):
+// detectWpDirScript finds core on /public/, root-webroot, and Bedrock (web/wp)
+// layouts alike.
+//
+// Composer-managed core (Bedrock, Radicle) is allowed, deliberately: for a
+// security hotfix, getting the patched files onto the server NOW matters more
+// than keeping composer.lock in step. But it's a real divergence — the lock
+// still pins the old version, so the next `composer install` (a git deploy, a
+// clone) silently reverts the patch. The check reports the locked version so
+// the UI can say exactly that before anything runs.
+
+import type { Server, Site } from "../api/types.ts"
+import { SSH_OPTS, sshPort } from "./dbBackup.ts"
+import { detectWpDirScript } from "./serverClone.ts"
+import { wpCliResolveScript } from "./wpCli.ts"
+import { spawn } from "./spawn.ts"
+
+export interface WpCoreOffer {
+  version: string
+  updateType: string // "minor" | "major" (wp-cli's update_type)
+}
+
+export interface WpCoreStatus {
+  wpDir: string
+  current: string
+  offers: WpCoreOffer[] // newest first, as wp-cli lists them; [] = up to date
+  multisite: boolean
+  // Set when core is installed by Composer (roots/wordpress, johnpbloch/wordpress…):
+  // the version composer.lock pins, which a later `composer install` restores.
+  composer: { lockedVersion: string | null } | null
+}
+
+export type WpCoreCheckResult =
+  | { ok: true; target: string; status: WpCoreStatus }
+  | { ok: false; target: string; error: string }
+
+export type WpCoreUpdateResult =
+  | { ok: true; before: string; after: string; log: string }
+  | { ok: false; error: string; log: string }
+
+// Numeric, segment-wise version compare ("7.0" < "7.0.2" < "7.1"); non-numeric
+// tails are ignored, which is fine for WordPress release numbers.
+export function compareVersions(a: string, b: string): number {
+  const pa = a.split(".").map((n) => parseInt(n, 10) || 0)
+  const pb = b.split(".").map((n) => parseInt(n, 10) || 0)
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0)
+    if (d !== 0) return d
+  }
+  return 0
+}
+
+// The two targets a bulk update can aim for. "line" = the newest release in the
+// site's own major.minor line (7.0.2 → 7.0.x): WordPress backports security
+// fixes there, so it's the low-risk hotfix. "newest" = the newest release,
+// period (a major update for anyone on an older line). null = nothing to do.
+export type WpTargetMode = "line" | "newest"
+
+export function wpTarget(current: string, offers: WpCoreOffer[], mode: WpTargetMode): string | null {
+  const line = (v: string) => v.split(".").slice(0, 2).join(".")
+  const pool = mode === "line" ? offers.filter((o) => line(o.version) === line(current)) : offers
+  let best: string | null = null
+  for (const o of pool) if (compareVersions(o.version, current) > 0 && (!best || compareVersions(o.version, best) > 0)) best = o.version
+  return best
+}
+
+// Composer packages that install WordPress core itself.
+const CORE_PACKAGES = ["roots/wordpress", "roots/wordpress-no-content", "roots/wordpress-full", "johnpbloch/wordpress", "johnpbloch/wordpress-core"]
+
+interface Prepared {
+  target: string
+  args: string[]
+}
+
+function prepare(server: Server, site: Site, sshUser: string | null): Prepared | { error: string; target: string } {
+  const ip = server.ip_address
+  const user = site.site_user ?? sshUser
+  if (!ip) return { target: "(no IP)", error: "Server has no IP address." }
+  if (!user) return { target: ip, error: "Site has no site user — can't SSH in to run wp-cli." }
+  const target = `${user}@${ip}`
+  return { target, args: ["ssh", ...SSH_OPTS, ...sshPort(server.ssh_port ?? null), target] }
+}
+
+// Shared preamble: locate core (sets $W, bails with ===NOTWP when there's none),
+// then resolve $PHP/$WP pinned to the site's own PHP-CLI (see wpCli.ts).
+function preamble(site: Site): string {
+  const root = `/sites/${site.domain}/files`
+  return [
+    detectWpDirScript(root, site.public_folder ?? undefined),
+    `if [ -z "$W" ]; then echo ===NOTWP; echo ===END; exit 0; fi`,
+    wpCliResolveScript(site.php_version),
+    // Every core command runs with plugins and themes unloaded: none of them need
+    // either, and a plugin's PHP notices land on STDOUT under the CLI SAPI —
+    // verified live on an Elementor Pro site under PHP 8.4, where a wall of
+    // "Implicitly marking parameter … as nullable is deprecated" swallowed the
+    // check-update JSON and the site read as up to date while two versions behind.
+    // It also keeps a fataling plugin from blocking the core update that fixes it.
+    `wpc() { "$PHP" "$WP" --path="$W" --skip-plugins --skip-themes "$@"; }`,
+  ].join("\n")
+}
+
+async function run(args: string[], remote: string, timeoutMs: number): Promise<{ code: number; stdout: string; stderr: string }> {
+  const proc = spawn([...args, remote], { stdout: "pipe", stderr: "pipe", stdin: "ignore" })
+  const timer = setTimeout(() => {
+    try {
+      proc.kill()
+    } catch {
+      /* already gone */
+    }
+  }, timeoutMs)
+  const code = await proc.exited
+  clearTimeout(timer)
+  const stdout = await new Response(proc.stdout as ReadableStream<Uint8Array>).text()
+  const stderr = await new Response(proc.stderr as ReadableStream<Uint8Array>).text()
+  return { code, stdout, stderr }
+}
+
+function splitSections(out: string): Record<string, string[]> {
+  const sections: Record<string, string[]> = {}
+  let current = ""
+  for (const rawLine of out.split("\n")) {
+    const line = rawLine.replace(/\r$/, "")
+    const m = line.match(/^===([A-Z]+)$/)
+    if (m) {
+      current = m[1]
+      sections[current] = []
+    } else if (current) {
+      sections[current].push(line)
+    }
+  }
+  return sections
+}
+
+function sshFailure(code: number, stderr: string): string {
+  return stderr.trim().split("\n").slice(-2).join(" ") || `ssh exited with code ${code}`
+}
+
+// Read the installed version, available updates, multisite-ness, and whether
+// Composer owns core. Strictly read-only.
+export async function checkWpCore(server: Server, site: Site, sshUser: string | null): Promise<WpCoreCheckResult> {
+  const p = prepare(server, site, sshUser)
+  if ("error" in p) return { ok: false, target: p.target, error: p.error }
+
+  // composer.lock sits at the project root: $W/../.. for Bedrock (web/wp),
+  // $W/.. for a public/ layout, or $W itself. The first lock that lists a core
+  // package wins; PHP parses it (jq isn't guaranteed on the box).
+  const pkgs = CORE_PACKAGES.map((n) => `'${n}'`).join(",")
+  const lockPhp = `$l=json_decode(file_get_contents($argv[1]),true);foreach(array_merge($l["packages"]??[],$l["packages-dev"]??[]) as $p){if(in_array($p["name"],[${pkgs}],true)){echo $p["version"];exit(0);}}exit(1);`
+  const remote = [
+    preamble(site),
+    `echo ===WPDIR; printf '%s\\n' "$W"`,
+    // Trailing `echo`s are load-bearing: wp's JSON/plain output has no trailing
+    // newline, so the next ===MARKER would glue onto it (see wpInventory.ts).
+    `echo ===VERSION; wpc core version 2>/dev/null || true; echo`,
+    `echo ===UPDATES; wpc core check-update --format=json 2>/dev/null || true; echo`,
+    `echo ===MULTISITE; wpc core is-installed --network >/dev/null 2>&1 && echo yes || echo no`,
+    `echo ===COMPOSER`,
+    `for d in "$W/../.." "$W/.." "$W"; do if [ -f "$d/composer.lock" ]; then v=$("$PHP" -r ${shq(lockPhp)} "$d/composer.lock" 2>/dev/null) && { echo "locked $v"; break; }; fi; if [ -f "$d/composer.json" ] && grep -qE '"(${CORE_PACKAGES.join("|")})"' "$d/composer.json"; then echo "managed"; break; fi; done`,
+    `echo ===END`,
+  ].join("\n")
+
+  let res: Awaited<ReturnType<typeof run>>
+  try {
+    res = await run(p.args, remote, 60_000)
+  } catch (err) {
+    return { ok: false, target: p.target, error: `Failed to launch ssh: ${(err as Error).message}` }
+  }
+  if (res.code !== 0 && !res.stdout.includes("===END")) return { ok: false, target: p.target, error: sshFailure(res.code, res.stderr) }
+
+  const s = splitSections(res.stdout)
+  if ("NOTWP" in s) return { ok: false, target: p.target, error: "No WordPress core found under the site's files — is this a WordPress site?" }
+  const current = lastVersionLine(s.VERSION)
+  if (!current) return { ok: false, target: p.target, error: "wp-cli couldn't read the WordPress version on this site." }
+
+  // Belt and braces with --skip-plugins: scan back for the line that parses as
+  // the JSON array, ignoring any other noise (a mu-plugin's notices still load).
+  // No match = "Success: WordPress is at the latest version." (plain text).
+  let offers: WpCoreOffer[] = []
+  for (const line of [...(s.UPDATES ?? [])].reverse()) {
+    if (!line.trim().startsWith("[")) continue
+    let parsed: unknown
+    try {
+      parsed = JSON.parse(line.trim())
+    } catch {
+      continue
+    }
+    if (!Array.isArray(parsed)) continue
+    offers = parsed
+      .filter((o) => o && typeof o.version === "string")
+      .map((o) => ({ version: o.version as string, updateType: typeof o.update_type === "string" ? o.update_type : "" }))
+    break
+  }
+
+  const comp = (s.COMPOSER ?? []).join("\n").trim()
+  const locked = comp.match(/^locked (.+)$/m)
+  const composer = locked ? { lockedVersion: locked[1].replace(/^v/, "") } : comp.includes("managed") ? { lockedVersion: null } : null
+
+  return {
+    ok: true,
+    target: p.target,
+    status: {
+      wpDir: (s.WPDIR?.[0] || "").trim(),
+      current,
+      offers,
+      multisite: (s.MULTISITE ?? []).join("").trim() === "yes",
+      composer,
+    },
+  }
+}
+
+// Update core to `version`, then run the database upgrade (network-wide on
+// multisite) and read the version back. If the update dies mid-way, WordPress
+// leaves a .maintenance file that keeps the site on "Briefly unavailable" for
+// up to 10 minutes — we remove it so a failure doesn't turn into downtime.
+export async function updateWpCore(
+  server: Server,
+  site: Site,
+  sshUser: string | null,
+  version: string,
+  multisite: boolean,
+): Promise<WpCoreUpdateResult> {
+  const p = prepare(server, site, sshUser)
+  if ("error" in p) return { ok: false, error: p.error, log: "" }
+  if (!/^[0-9][0-9A-Za-z.-]*$/.test(version)) return { ok: false, error: `Refusing odd version string "${version}".`, log: "" }
+
+  const remote = [
+    preamble(site),
+    `echo ===BEFORE; wpc core version 2>/dev/null; echo`,
+    `echo ===LOG`,
+    `wpc core update --version=${version} 2>&1; rc=$?`,
+    `if [ $rc -eq 0 ]; then wpc core update-db${multisite ? " --network" : ""} 2>&1 || rc=$?; fi`,
+    `[ -f "$W/.maintenance" ] && rm -f "$W/.maintenance" && echo "Removed a leftover .maintenance file."`,
+    `echo; echo ===RC; echo $rc`,
+    `echo ===AFTER; wpc core version 2>/dev/null; echo`,
+    `echo ===END`,
+  ].join("\n")
+
+  let res: Awaited<ReturnType<typeof run>>
+  try {
+    res = await run(p.args, remote, 300_000)
+  } catch (err) {
+    return { ok: false, error: `Failed to launch ssh: ${(err as Error).message}`, log: "" }
+  }
+  if (!res.stdout.includes("===END")) {
+    return { ok: false, error: res.code === 0 ? "The update didn't finish (timed out?)." : sshFailure(res.code, res.stderr), log: res.stdout.trim() }
+  }
+  const s = splitSections(res.stdout)
+  if ("NOTWP" in s) return { ok: false, error: "No WordPress core found under the site's files.", log: "" }
+  const log = (s.LOG ?? []).join("\n").trim()
+  const rc = Number((s.RC ?? []).join("").trim())
+  const before = lastVersionLine(s.BEFORE)
+  const after = lastVersionLine(s.AFTER)
+  if (rc !== 0) {
+    const lastErr = log.split("\n").filter((l) => /error|warning/i.test(l)).pop()
+    return { ok: false, error: lastErr ?? `wp core update exited with code ${rc}.`, log }
+  }
+  if (after !== version) return { ok: false, error: `wp-cli reported success, but the site now reports ${after || "no version"} (wanted ${version}).`, log }
+  return { ok: true, before, after, log }
+}
+
+// `wp core version` prints a bare version; pick that line out of any noise.
+function lastVersionLine(lines: string[] | undefined): string {
+  return [...(lines ?? [])].reverse().map((l) => l.trim()).find((l) => /^\d+\.\d+(\.\d+)?([-.][0-9A-Za-z.-]+)?$/.test(l)) ?? ""
+}
+
+function shq(s: string): string {
+  return `'${s.replace(/'/g, `'\\''`)}'`
+}

package/src/ui/App.tsx

@@ -15,7 +15,8 @@ import { Stacks } from "./views/Stacks.tsx"
 import { Search } from "./views/Search.tsx"
 import { Events } from "./views/Events.tsx"
 import { Health } from "./views/Health.tsx"
-import { PhpUpgrade } from "./views/PhpUpgrade.tsx"
+import { SiteUpdate } from "./views/SiteUpdate.tsx"
+import { BulkWpUpdate } from "./views/BulkWpUpdate.tsx"
 import { HttpsToggle } from "./views/HttpsToggle.tsx"
 import { PurgeCache } from "./views/PurgeCache.tsx"
 import { ReleaseNotes } from "./views/ReleaseNotes.tsx"
@@ -38,6 +39,7 @@ import { WpInventory } from "./views/WpInventory.tsx"
 import { ProviderConnect } from "./views/ProviderConnect.tsx"
 import { DnsRecords } from "./views/DnsRecords.tsx"
 import { KumaSite } from "./views/KumaSite.tsx"
+import { Accounts } from "./views/Accounts.tsx"
 
 const MIN_SPLASH_MS = 1200
 
@@ -48,6 +50,7 @@ export function App() {
   const [splashDone, setSplashDone] = useState(false)
   const [showHelp, setShowHelp] = useState(false)
   const [showExplain, setShowExplain] = useState(false)
+  const [showAccounts, setShowAccounts] = useState(false)
 
   // Enforce a minimum splash duration so the intro is visible even on fast loads.
   useEffect(() => {
@@ -59,10 +62,12 @@ export function App() {
   const overlayActive =
     showHelp ||
     showExplain ||
+    showAccounts ||
     store.releaseNotesInfo !== null ||
     store.healthServer !== null ||
     store.wpInventorySite !== null ||
     store.phpUpgradeSite !== null ||
+    store.bulkWpGroup !== null ||
     store.httpsToggleSite !== null ||
     store.purgeCacheSite !== null ||
     store.grantKeySite !== null ||
@@ -117,6 +122,9 @@ export function App() {
     // While a text field is focused, let it consume everything else.
     if (store.inputMode) return
 
+    // The Accounts overlay owns the keyboard while open.
+    if (showAccounts) return
+
     // The release-notes overlay owns the keyboard while open (any key dismisses).
     if (store.releaseNotesInfo) return
 
@@ -129,6 +137,9 @@ export function App() {
     // The PHP-upgrade overlay owns the keyboard while open.
     if (store.phpUpgradeSite) return
 
+    // The bulk WordPress-update overlay owns the keyboard while open.
+    if (store.bulkWpGroup) return
+
     // The HTTPS-toggle overlay owns the keyboard while open.
     if (store.httpsToggleSite) return
 
@@ -189,6 +200,9 @@ export function App() {
     // The site-monitoring (Uptime Kuma) overlay owns the keyboard while open.
     if (store.kumaSite) return
 
+    // A (Shift+a): the Accounts overlay — the header advertises it from every tab.
+    if (key.shift && key.name === "a") return setShowAccounts(true)
+
     switch (key.name) {
       case "q":
         return quit()
@@ -247,7 +261,8 @@ export function App() {
       {store.releaseNotesInfo && <ReleaseNotes />}
       {store.healthServer && <Health />}
       {store.wpInventorySite && <WpInventory />}
-      {store.phpUpgradeSite && <PhpUpgrade />}
+      {store.phpUpgradeSite && <SiteUpdate />}
+      {store.bulkWpGroup && <BulkWpUpdate />}
       {store.httpsToggleSite && <HttpsToggle />}
       {store.purgeCacheSite && <PurgeCache />}
       {store.grantKeySite && <GrantKey />}
@@ -268,6 +283,7 @@ export function App() {
       {store.connectZoneTarget && <ProviderConnect />}
       {store.dnsRecordsTarget && <DnsRecords />}
       {store.kumaSite && <KumaSite />}
+      {showAccounts && <Accounts onClose={() => setShowAccounts(false)} />}
       <ToastStack />
     </box>
   )

package/src/ui/Explain.tsx

@@ -44,7 +44,7 @@ const GUIDES: Record<Route, Guide> = {
       ["h", "Server health over SSH (CPU / memory / disk)"],
       ["a", "Server actions: reboot or restart a service"],
       ["d", "Identify the app running on a site (SSH)"],
-      ["u", "Change a site's PHP version"],
+      ["u", "Update a site: PHP version or WordPress core"],
       ["o / w", "Open the site · open it in the SpinupWP web app"],
       ["s", "Open a terminal and SSH into the site"],
       ["t / v / L", "Local copy: open a terminal · open the local URL · link or edit"],
@@ -54,7 +54,7 @@ const GUIDES: Record<Route, Guide> = {
     title: "Stacks",
     summary: "Your fleet grouped by app type (Standard WP / Bedrock / Non-WP), with a fleet-wide PHP version breakdown.",
     panes: [
-      ["Groups", "App-type buckets; Non-WP expands into WHMCS / Laravel / …"],
+      ["Groups", "App-type buckets; WordPress stacks expand by core version (newest highlighted), Non-WP into WHMCS / Laravel / …"],
       ["Sites", "The sites in the selected group"],
       ["PHP versions", "How many sites run each PHP version (EOL flagged)"],
     ],
@@ -63,7 +63,8 @@ const GUIDES: Record<Route, Guide> = {
       ["D", "Identify every app in the selected group"],
       ["S", "Find local copies on your disk and link them"],
       ["f", "Report sites with no local copy (filter by stack with ←/→)"],
-      ["u", "Change a site's PHP version"],
+      ["u", "Update a site: PHP version or WordPress core"],
+      ["u (on a WP x.y.z row)", "Update WordPress on every site in that version group — canary first"],
       ["t / v / L", "Local copy: terminal · local URL · link or edit"],
       ["o / w", "Open the site · open it in SpinupWP"],
       ["s", "Open a terminal and SSH into the site"],
@@ -79,7 +80,7 @@ const GUIDES: Record<Route, Guide> = {
     actions: [
       ["type", "Filter results"],
       ["Tab / →", "Hand focus from the box to the result's actions"],
-      ["o / w / u", "Open · open in SpinupWP · change PHP"],
+      ["o / w / u", "Open · open in SpinupWP · update PHP or WordPress"],
       ["s", "SSH into the site (opens a terminal)"],
       ["t / v / L", "Local copy: terminal · local URL · link or edit"],
       ["d / p / m", "DB backup · pull prod→local · production media fallback"],

package/src/ui/Header.tsx

@@ -20,14 +20,14 @@ const TABS: { route: Route; key: string; label: string }[] = [
 // actions a user would reach for. Shown directly under the nav strip.
 const SUBTITLES: Record<Route, string> = {
   dashboard: "Your account at a glance — fleet health, what needs attention, recent activity",
-  servers: "Browse servers and their sites  ·  h server health  ·  u change PHP  ·  L link a local copy",
+  servers: "Browse servers and their sites  ·  h server health  ·  u update PHP/WP  ·  L link a local copy",
   stacks: "Your fleet grouped by app type  ·  d identify an app (SSH)  ·  S find local copies on your disk",
   search: "Jump to any server or site by name  ·  Tab hands focus to the result's actions",
   events: "Recent deploys, reboots, and operations across your account",
 }
 
 export function Header() {
-  const { route, servers, sites, loading, lastUpdated, updateInfo, newServerJob, vanityJob, cloneJob, cloneServer, kumaStatus } = useStore()
+  const { route, servers, sites, loading, lastUpdated, updateInfo, newServerJob, vanityJob, cloneJob, cloneServer, kumaStatus, profileLabel } = useStore()
   // Name the domain(s) when there are few enough to fit the header row; fall
   // back to a bare count once there are too many to list safely. Deliberately
   // still just the plain up/down signal (kumaStatus.up) — not expanding what
@@ -119,6 +119,10 @@ export function Header() {
       <box style={{ flexDirection: "row", height: 1, paddingLeft: 1, paddingRight: 1, alignItems: "center" }}>
         <text content="💡 " fg={theme.accent} style={{ flexShrink: 0 }} />
         <text content={SUBTITLES[route]} fg={theme.textDim} wrapMode="none" style={{ flexGrow: 1, flexShrink: 1 }} />
+        {/* Always visible, so it's never a guess which client's fleet this is. */}
+        <text content="  Account: " fg={theme.textFaint} style={{ flexShrink: 0 }} />
+        <text content={truncate(profileLabel, 32)} fg={theme.text} wrapMode="none" style={{ flexShrink: 0 }} />
+        <text content="  A switch" fg={theme.textFaint} style={{ flexShrink: 0 }} />
       </box>
     </box>
   )

package/src/ui/Help.tsx

@@ -18,6 +18,7 @@ const GLOBAL: Section = {
     ["1 … 5", "Switch tabs"],
     ["r", "Refresh from the API"],
     ["/", "Global search"],
+    ["A", "Switch SpinupWP accounts"],
     ["i", "Explain the current screen"],
     ["?", "This help"],
     ["q · Ctrl+C", "Quit · force quit"],
@@ -40,7 +41,7 @@ const NAV: Section = {
     ["c", "Create a new server"],
     ["C", "Clone this server to a new one"],
     ["S", "Connect sudo on the server"],
-    ["u", "Change PHP version"],
+    ["u", "Update PHP version or WordPress core"],
     ["H", "Enable/disable HTTPS"],
     ["P", "Purge page + object cache"],
     ["K", "Grant SpinupTUI's SSH key (sudo)"],

package/src/ui/ToastStack.tsx

@@ -20,11 +20,11 @@ export function ToastStack() {
         <box
           key={t.id}
           border
-          borderColor={theme.good}
+          borderColor={t.kind === "error" ? theme.bad : theme.good}
           backgroundColor={theme.bgPanel}
           style={{ flexDirection: "row", gap: 1, maxWidth: TOAST_WIDTH, paddingLeft: 1, paddingRight: 1 }}
         >
-          <text content="✓" fg={theme.good} />
+          <text content={t.kind === "error" ? "✕" : "✓"} fg={t.kind === "error" ? theme.bad : theme.good} />
           <text content={t.message} fg={theme.text} />
         </box>
       ))}

package/src/ui/accounts.tsx

@@ -0,0 +1,21 @@
+// Account switching lives ABOVE the store: switching remounts <StoreProvider>
+// keyed by the account, which is what guarantees a clean slate — every effect,
+// poller and interval of the outgoing account is torn down by React, and every
+// id-keyed cache (servers, sites, probes, jobs…) starts empty for the new one.
+// See config.ts "Accounts" for how the profiles are stored.
+
+import { createContext, useContext } from "react"
+
+export interface AccountsApi {
+  // Make `id` the active account and remount the app on it. The caller checks
+  // the store's switchBlocker() first — nothing here waits for running work.
+  switchAccount: (id: string) => Promise<void>
+}
+
+export const AccountsContext = createContext<AccountsApi | null>(null)
+
+export function useAccounts(): AccountsApi {
+  const ctx = useContext(AccountsContext)
+  if (!ctx) throw new Error("useAccounts must be used within <AccountsContext.Provider>")
+  return ctx
+}

package/src/ui/components.tsx

@@ -459,7 +459,7 @@ export function siteGroups(isWordpress: boolean, isVanity: boolean): ActionGroup
     ["L", "Link / edit"],
   ]
   if (isWordpress) local.push(["m", "Media fallback"])
-  remote.push(["u", "PHP ver."])
+  remote.push(["u", "Update PHP / WP"])
   remote.push(["H", "Toggle HTTPS"])
   remote.push(["P", "Purge cache"])
   remote.push(["M", "Monitoring"])