spinuptui 0.27.0 → 1.0.0

package/src/index.tsx

@@ -6,13 +6,15 @@
 // First, before any config read or spawn: keep a site checkout's .env from
 // leaking into child processes (see the module).
 import "./lib/cwdDotenv.ts"
-import { useState } from "react"
+import { useCallback, useMemo, useState } from "react"
 import { createCliRenderer } from "@opentui/core"
 import { createRoot } from "@opentui/react"
 import pkg from "../package.json" with { type: "json" }
-import { hasToken, configPath, loadConfig } from "./config.ts"
+import { hasToken, configPath, loadConfig, pinActiveProfile, setActiveProfile, listProfiles } from "./config.ts"
 import { StoreProvider } from "./ui/store.tsx"
 import { App } from "./ui/App.tsx"
+import { AccountsContext, type AccountsApi } from "./ui/accounts.tsx"
+import { resetWpCoreJobs } from "./ui/wpCoreJobs.tsx"
 import { Onboarding } from "./ui/Onboarding.tsx"
 import { isDevMode } from "./dev/devMode.ts"
 import { SpinupWPClient } from "./api/client.ts"
@@ -94,7 +96,12 @@ Token resolution: SPINUPWP_ACCESS_TOKEN (env / .env) first, then the config
 file. Run \`spinuptui login\` once to save a token so \`spinuptui\` works from
 anywhere.
 
+Accounts: add and switch SpinupWP accounts in the app with A. Commands use the
+active one; SPINUPTUI_ACCOUNT=<id> picks another for a single run (ids are
+listed by \`spinuptui where\`).
+
 Config file: ${configPath()}
+Account: ${cfg.profileLabel} (${cfg.profileId})
 Token source: ${cfg.tokenSource}`)
   process.exit(0)
 }
@@ -107,7 +114,10 @@ if (args.includes("-v") || args.includes("--version") || command === "version")
 if (command === "where") {
   const cfg = loadConfig()
   console.log(`config: ${configPath()}`)
+  console.log(`account: ${cfg.profileLabel} (${cfg.profileId})`)
   console.log(`token source: ${cfg.tokenSource}`)
+  const others = listProfiles().filter((p) => !p.active)
+  if (others.length) console.log(`other accounts: ${others.map((p) => `${p.label} (${p.id})`).join(", ")}`)
   process.exit(0)
 }
 
@@ -240,13 +250,23 @@ const forceLogin = command === "login"
 
 function Root() {
   const [configured, setConfigured] = useState(isDevMode() ? true : forceLogin ? false : hasToken())
+  // The store is keyed by account: switching remounts it (see ui/accounts.tsx).
+  const [account, setAccount] = useState(() => pinActiveProfile())
+  const switchAccount = useCallback(async (id: string) => {
+    await setActiveProfile(id)
+    resetWpCoreJobs()
+    setAccount(id)
+  }, [])
+  const accounts = useMemo<AccountsApi>(() => ({ switchAccount }), [switchAccount])
   if (!configured) {
     return <Onboarding onComplete={() => setConfigured(true)} />
   }
   return (
-    <StoreProvider>
-      <App />
-    </StoreProvider>
+    <AccountsContext.Provider value={accounts}>
+      <StoreProvider key={account}>
+        <App />
+      </StoreProvider>
+    </AccountsContext.Provider>
   )
 }
 

package/src/lib/appUpdate.ts

@@ -129,15 +129,27 @@ export async function refreshUpdateInfo(current: string): Promise<UpdateInfo | n
 // ---- In-app updater (`u` in the Help/About overlay) ------------------------
 
 // How this copy of the app was installed, which decides the update path shown
-// in Help/About: a package-manager install (bun/npm global) lives under a
-// node_modules dir and updates via `bun update -g spinuptui`; anything else is
+// in Help/About: a Homebrew install lives in the Cellar (the formula unpacks the
+// package into its libexec) and updates via `brew upgrade`; a package-manager
+// install (bun/npm global) lives under a node_modules dir; anything else is
 // treated as a git checkout and updates via `git pull` (runSelfUpdate).
-export type InstallChannel = "git" | "package"
+export type InstallChannel = "git" | "package" | "brew"
 
 export function installChannel(): InstallChannel {
+  if (import.meta.dir.includes(`${sep}Cellar${sep}spinuptui${sep}`)) return "brew"
   return import.meta.dir.includes(`${sep}node_modules${sep}`) ? "package" : "git"
 }
 
+// Homebrew owns its copy — `bun add -g` beside it would install a second one
+// that the `spinuptui` on PATH never runs.
+export const BREW_UPDATE_CMD = "brew upgrade spinuptui"
+
+// The manual update command for this install (null for a git checkout).
+export function updateCommand(): string | null {
+  const ch = installChannel()
+  return ch === "brew" ? BREW_UPDATE_CMD : ch === "package" ? PACKAGE_UPDATE_CMD : null
+}
+
 // The one-liner Help shows for a package install (also used by runSelfUpdate's
 // "not a checkout" message so every path names the same command).
 //
@@ -187,7 +199,7 @@ export async function runSelfUpdate(cwd: string = checkoutRoot()): Promise<SelfU
   try {
     const isRepo = await git(cwd, ["rev-parse", "--is-inside-work-tree"])
     if (isRepo.code !== 0 || isRepo.stdout !== "true") {
-      return { ok: false, message: `This install isn't a git checkout — update with \`${PACKAGE_UPDATE_CMD}\`.`, needsInstall: false }
+      return { ok: false, message: `This install isn't a git checkout — update with \`${updateCommand() ?? PACKAGE_UPDATE_CMD}\`.`, needsInstall: false }
     }
     const status = await git(cwd, ["status", "--porcelain"])
     if (status.stdout.length > 0) {

package/src/lib/dnsCache.ts

@@ -13,7 +13,7 @@
 import { join } from "node:path"
 import { existsSync, readFileSync } from "node:fs"
 import { chmod, mkdir } from "node:fs/promises"
-import { configDir } from "../config.ts"
+import { profileDataDir } from "../config.ts"
 import type { ZoneHost } from "./dns.ts"
 
 const CACHE_VERSION = 1
@@ -29,11 +29,14 @@ interface CacheFile {
   entries: Record<string, CachedDns> // key: normalized domain
 }
 
-export function dnsCachePath(): string {
-  return join(configDir(), "dns-cache.json")
+export function dnsCachePath(dir = profileDataDir()): string {
+  return join(dir, "dns-cache.json")
 }
 
 export class DnsCache {
+  // Pinned to the account active when the cache was created, so a write that
+  // lands after an account switch still goes to its own account\'s file.
+  private readonly dir = profileDataDir()
   private entries = new Map<string, CachedDns>()
   // Serializes writes so concurrent batch lookups can't tear the file.
   private writeChain: Promise<void> = Promise.resolve()
@@ -42,7 +45,7 @@ export class DnsCache {
   // an empty cache.
   load(): void {
     try {
-      const path = dnsCachePath()
+      const path = dnsCachePath(this.dir)
       if (!existsSync(path)) return
       const parsed = JSON.parse(readFileSync(path, "utf8")) as CacheFile
       if (parsed?.version !== CACHE_VERSION || !parsed.entries) return
@@ -80,10 +83,10 @@ export class DnsCache {
   }
 
   private async writeFile(): Promise<void> {
-    await mkdir(configDir(), { recursive: true })
+    await mkdir(this.dir, { recursive: true })
     const file: CacheFile = { version: CACHE_VERSION, entries: {} }
     for (const [k, entry] of this.entries) file.entries[k] = entry
-    const path = dnsCachePath()
+    const path = dnsCachePath(this.dir)
     await Bun.write(path, JSON.stringify(file, null, 2) + "\n")
     try {
       await chmod(path, 0o600)

package/src/lib/keychain.ts

@@ -8,6 +8,7 @@
 // the write — acceptable for an opt-in convenience on a personal box; documented here.
 
 import { spawn } from "./spawn.ts"
+import { activeProfileId, DEFAULT_PROFILE } from "../config.ts"
 
 const SERVICE = "spinup-sudo"
 
@@ -15,8 +16,12 @@ export function keychainAvailable(): boolean {
   return process.platform === "darwin"
 }
 
-function account(serverId: number): string {
-  return `server-${serverId}`
+// Server ids are per SpinupWP account — two accounts can both have server #42 —
+// so each account's entries are namespaced by its profile id. The default
+// profile keeps the original un-namespaced name, so entries saved before
+// accounts existed are still found.
+function account(serverId: number, profileId = activeProfileId()): string {
+  return profileId === DEFAULT_PROFILE ? `server-${serverId}` : `${profileId}:server-${serverId}`
 }
 
 async function security(args: string[]): Promise<{ ok: boolean; stdout: string; stderr: string }> {
@@ -53,8 +58,9 @@ export async function getSudoPassword(serverId: number): Promise<string | null>
   return r.ok ? r.stdout.replace(/\n+$/, "") : null
 }
 
-// Remove a server's stored sudo password (best-effort).
-export async function deleteSudoPassword(serverId: number): Promise<void> {
+// Remove a server's stored sudo password (best-effort) — the active account's,
+// or another account's when removing that account.
+export async function deleteSudoPassword(serverId: number, profileId?: string): Promise<void> {
   if (!keychainAvailable()) return
-  await security(["delete-generic-password", "-s", SERVICE, "-a", account(serverId)])
+  await security(["delete-generic-password", "-s", SERVICE, "-a", account(serverId, profileId)])
 }

package/src/lib/providersCache.ts

@@ -13,7 +13,7 @@
 import { join } from "node:path"
 import { existsSync, readFileSync } from "node:fs"
 import { chmod, mkdir } from "node:fs/promises"
-import { configDir } from "../config.ts"
+import { profileDataDir } from "../config.ts"
 import type { VerifiedZone } from "./providers.ts"
 
 // v2: VerifiedZone gained `nameservers` + `account` (was accountId/accountName).
@@ -42,17 +42,20 @@ interface CacheFile {
   entries: Record<string, VerifiedConn> // key: connection id
 }
 
-export function providersCachePath(): string {
-  return join(configDir(), "providers-cache.json")
+export function providersCachePath(dir = profileDataDir()): string {
+  return join(dir, "providers-cache.json")
 }
 
 export class ProvidersCache {
+  // Pinned to the account active when the cache was created, so a write that
+  // lands after an account switch still goes to its own account\'s file.
+  private readonly dir = profileDataDir()
   private entries = new Map<string, VerifiedConn>()
   private writeChain: Promise<void> = Promise.resolve()
 
   load(): void {
     try {
-      const path = providersCachePath()
+      const path = providersCachePath(this.dir)
       if (!existsSync(path)) return
       const parsed = JSON.parse(readFileSync(path, "utf8")) as CacheFile
       if (parsed?.version !== CACHE_VERSION || !parsed.entries) return
@@ -91,10 +94,10 @@ export class ProvidersCache {
   }
 
   private async writeFile(): Promise<void> {
-    await mkdir(configDir(), { recursive: true })
+    await mkdir(this.dir, { recursive: true })
     const file: CacheFile = { version: CACHE_VERSION, entries: {} }
     for (const [k, entry] of this.entries) file.entries[k] = entry
-    const path = providersCachePath()
+    const path = providersCachePath(this.dir)
     await Bun.write(path, JSON.stringify(file, null, 2) + "\n")
     try {
       await chmod(path, 0o600)

package/src/lib/serverClone.ts

@@ -472,6 +472,13 @@ export interface BedrockPullSpec {
   destDbPassword: string
   excludeUploads: boolean
   publicFolder?: string // a signal, not a fact (CLAUDE.md) — re-verified below, independently, on both ends
+  // The source site's own git deploy script. Run on the dest after the DB import
+  // when the source is Radicle: its front-end (Vite build → public/build) and
+  // Acorn caches are gitignored, so composer install alone leaves the theme
+  // unbuilt, and the owner's deploy script is their own definition of "build this
+  // site". It runs last because Radicle deploy scripts call wp-cli (acorn
+  // optimize, cache purge, rewrite flush), which needs the imported database.
+  deployScript?: string
 }
 
 export async function runBedrockPull(
@@ -515,9 +522,12 @@ export async function runBedrockPull(
     //    source happened to detect — its structure comes from the git repo's own
     //    content, which can legitimately diverge from the source's on-disk state.
     onProgress("detect", "start")
-    const det = await run("detect", source, `${detectWpDirScript(root, spec.publicFolder)}; echo "WPCORE:$W"; echo "BEDROCKROOT:$B"`, 30_000)
+    const det = await run("detect", source, `${detectWpDirScript(root, spec.publicFolder)}; echo "WPCORE:$W"; echo "BEDROCKROOT:$B"; echo "RADICLEROOT:$RD"`, 30_000)
     const wpCore = (det.stdout.match(/^WPCORE:(.*)$/m)?.[1] ?? "").trim()
     const srcProjectRoot = (det.stdout.match(/^BEDROCKROOT:(.*)$/m)?.[1] ?? "").trim()
+    // Radicle requires roots/bedrock-autoloader, so it passes the Bedrock check
+    // above too — this is what tells the two apart.
+    const radicle = (det.stdout.match(/^RADICLEROOT:(.*)$/m)?.[1] ?? "").trim() !== ""
     if (!det.ok || !wpCore || !srcProjectRoot) {
       return fail("detect", `couldn't find a Bedrock project (composer.json + WordPress core) under ${root} on the source — is the public folder set correctly?`)
     }
@@ -577,20 +587,23 @@ export async function runBedrockPull(
     if (!composer.ok) return fail("build", (composer.stdout + composer.stderr).trim().split("\n").slice(-3).join(" ") || "composer install failed")
     onProgress("build", "ok")
 
-    // 3. files — pull {web}/app/uploads (unless excluded), `web` being whatever the
-    //    detected public folder is actually named — which can differ in nesting
-    //    depth between source and dest (the repo's own content vs. how deep the
-    //    source's on-disk state happens to be). Archiving/extracting relative to
-    //    EACH side's own web dir (not `root`) with a fixed member name sidesteps
-    //    that — the two ends never need to agree on a shared relative path. Best-
-    //    effort: a site with no uploads dir yields an empty stream we simply skip.
+    // 3. files — pull the uploads dir under the public folder: Bedrock's
+    //    app/uploads or Radicle's content/uploads, whichever the source has.
+    //    `web` is whatever the detected public folder is actually named, and it
+    //    can differ in nesting depth between source and dest (the repo's own
+    //    content vs. how deep the source's on-disk state happens to be).
+    //    Archiving/extracting relative to EACH side's own web dir (not `root`)
+    //    keeps the member name (app/uploads or content/uploads) the same on both
+    //    ends, so they never need to agree on a shared relative path. Best-effort:
+    //    a site with no uploads dir yields an empty stream we simply skip.
     onProgress("files", "start")
     if (!spec.excludeUploads) {
       const stopUpPoll = pollTransferSize(dest, `${tmp}_up.tgz`, (b) => onTransfer?.("files", b))
+      const srcUploads = `cd ${shq(webDir)} && for d in app/uploads content/uploads; do if [ -d "$d" ]; then tar --warning=no-file-changed -czf - "$d"; rc=$?; [ $rc -le 1 ] && exit 0; exit $rc; fi; done; true`
       const up = await run(
         "files",
         dest,
-        `set -e; timeout -k 5 3600 ${remote(`[ -d ${shq(`${webDir}/app/uploads`)} ] && tar -C ${shq(webDir)} --warning=no-file-changed -czf - app/uploads || true`)} > ${tmp}_up.tgz; if [ -s ${tmp}_up.tgz ]; then tar -C ${shq(destWebDir)} -xzf ${tmp}_up.tgz && chown -R ${shq(du)}:${shq(du)} ${shq(`${destWebDir}/app/uploads`)}; fi; rm -f ${tmp}_up.tgz`,
+        `set -e; timeout -k 5 3600 ${remote(srcUploads)} > ${tmp}_up.tgz; if [ -s ${tmp}_up.tgz ]; then tar -C ${shq(destWebDir)} -xzf ${tmp}_up.tgz && for d in app/uploads content/uploads; do [ -d ${shq(destWebDir)}/$d ] && chown -R ${shq(du)}:${shq(du)} ${shq(destWebDir)}/$d; done; true; fi; rm -f ${tmp}_up.tgz`,
         3_660_000, // outer must exceed the in-script `timeout 3600` so the inner reports a clean 124
       )
       stopUpPoll()
@@ -641,6 +654,23 @@ export async function runBedrockPull(
     if (!imp.ok) return fail("db", imp.stderr.trim() || "db pull/import failed")
     onProgress("db", "ok")
 
+    // 5b. deploy — Radicle only: run the source's own deploy script (see
+    //     BedrockPullSpec.deployScript). Staged as a file owned by the site user
+    //     (base64 in, so no quoting of the owner's script is ever needed) and run
+    //     from the project root, exactly where SpinupWP's own deploys run it.
+    if (radicle && spec.deployScript?.trim()) {
+      onProgress("build", "start", "deploy script")
+      const b64 = Buffer.from(spec.deployScript.replace(/\r\n/g, "\n")).toString("base64")
+      const deploy = await run(
+        "build",
+        dest,
+        `set -e; echo ${shq(b64)} | base64 -d > ${tmp}_deploy.sh; chown ${shq(du)}:${shq(du)} ${tmp}_deploy.sh; chmod 600 ${tmp}_deploy.sh; cd ${shq(destProjectRoot)}; rc=0; sudo -u ${shq(du)} -H bash -lc ${shq(`cd ${shq(destProjectRoot)} && bash ${tmp}_deploy.sh`)} 2>&1 || rc=$?; rm -f ${tmp}_deploy.sh; exit $rc`,
+        1_200_000,
+      )
+      if (!deploy.ok) return fail("build", `the site's deploy script failed: ${(deploy.stdout + deploy.stderr).trim().split("\n").slice(-3).join(" ") || `exit ${deploy.code}`}`)
+      onProgress("build", "ok")
+    }
+
     // 6. verify — wp-cli on the dest (HTTP --resolve is the caller's).
     onProgress("verify", "start")
     const ver = await run("verify", dest, `cd ${shq(destProjectRoot)}; sudo -u ${shq(du)} -H wp core is-installed`, 30_000)
@@ -652,7 +682,7 @@ export async function runBedrockPull(
     // 7. revoke — drop the pull key (by marker) on source, clean dest temp + staged dump.
     onProgress("revoke", "start")
     await run("revoke", source, `AK=${shq(home)}/.ssh/authorized_keys; [ -f "$AK" ] && sed -i ${shq(`/${MARKER}/d`)} "$AK" && chown ${shq(su)}:${shq(su)} "$AK"; rm -f ${shq(home)}/.clone_db.sql.gz`, 30_000).catch(() => {})
-    await run("revoke", dest, `rm -f ${KEY} ${KEY}.pub ${tmp}_auth.json ${tmp}_up.tgz ${tmp}_env ${tmp}.sql.gz ${tmp}.sql`, 30_000).catch(() => {})
+    await run("revoke", dest, `rm -f ${KEY} ${KEY}.pub ${tmp}_auth.json ${tmp}_up.tgz ${tmp}_env ${tmp}.sql.gz ${tmp}.sql ${tmp}_deploy.sh`, 30_000).catch(() => {})
     onProgress("revoke", "ok")
   }
 }
@@ -667,11 +697,20 @@ export async function runBedrockPull(
 // just BEFORE a destination site (and its git clone) gets created for nothing.
 // Silent no-op for anything that isn't a detectable Bedrock install; that's
 // covered by the pull chain's own detection, not this pre-check's job.
-export async function preflightBedrockSource(source: SudoCtx, spec: { domain: string; publicFolder?: string }): Promise<{ ok: true } | { ok: false; error: string }> {
+//
+// For a Radicle source whose deploy script builds the front-end with npm/yarn/
+// pnpm, it also checks the destination has Node: a stock SpinupWP server doesn't,
+// and finding out after the create would leave a half-built site behind. We stop
+// and say so rather than install it — the server's packages aren't ours to manage.
+export async function preflightBedrockSource(
+  source: SudoCtx,
+  spec: { domain: string; publicFolder?: string; deployScript?: string },
+  dest?: SudoCtx,
+): Promise<{ ok: true } | { ok: false; error: string }> {
   const root = `/sites/${spec.domain}/files`
   const expectedWebDir = webrootFor(root, spec.publicFolder)
   const expectedProjectRoot = expectedWebDir === root ? root : expectedWebDir.slice(0, expectedWebDir.lastIndexOf("/"))
-  const r = await exec(source, `${detectWpDirScript(root, spec.publicFolder)}; echo "BEDROCKROOT:$B"`, 30_000)
+  const r = await exec(source, `${detectWpDirScript(root, spec.publicFolder)}; echo "BEDROCKROOT:$B"; echo "RADICLEROOT:$RD"`, 30_000)
   const detected = (r.stdout.match(/^BEDROCKROOT:(.*)$/m)?.[1] ?? "").trim()
   if (!r.ok || !detected) return { ok: true }
   if (detected !== expectedProjectRoot) {
@@ -680,9 +719,103 @@ export async function preflightBedrockSource(source: SudoCtx, spec: { domain: st
       error: `this site's actual files (Bedrock project at ${detected}) don't match its configured Public Folder (implies ${expectedProjectRoot}) — align them and retry`,
     }
   }
+  const radicle = (r.stdout.match(/^RADICLEROOT:(.*)$/m)?.[1] ?? "").trim() !== ""
+  // Radicle's front-end build lives only in the deploy script (see
+  // BedrockPullSpec.deployScript) — without one the clone would come up with no
+  // built assets and answer 500. SpinupWP can drop a script set through its API
+  // (one sent on create is gone a minute or two later), so this is reachable.
+  if (radicle && !spec.deployScript?.trim()) {
+    return {
+      ok: false,
+      error: "this Radicle site has no deploy script in SpinupWP, so there's nothing to build its front-end with — add one (Site → Git) and retry",
+    }
+  }
+  if (radicle && dest && /\b(npm|npx|yarn|pnpm|node)\b/.test(spec.deployScript ?? "")) {
+    const n = await exec(dest, `command -v node >/dev/null 2>&1 && echo HASNODE || echo NONODE`, 30_000)
+    if (n.stdout.includes("NONODE")) {
+      return {
+        ok: false,
+        error: `this Radicle site's deploy script builds its front-end with Node, and ${dest.server.name} doesn't have Node installed — install Node on it and retry`,
+      }
+    }
+  }
   return { ok: true }
 }
 
+// ---- Crontab carry-over --------------------------------------------------------
+//
+// SpinupWP writes each site user's crontab itself: a PATH line and an
+// `#Ansible: <domain>` block running WP cron. A new site gets its own copy at
+// create, so those are never copied. Anything else in the source user's crontab
+// was added by the site owner (a feed import, an Acorn/Laravel command, a report
+// job), and without this step a clone silently stops running it. Lines are copied
+// verbatim, commented-out ones included (a disabled job stays disabled), which is
+// safe because a clone keeps the domain and site user, so every path matches.
+// Idempotent: a line the dest already has is skipped, so a retry adds nothing.
+
+export interface CrontabSyncResult {
+  ok: boolean
+  added: string[] // the lines appended to the dest crontab (empty = nothing to carry)
+  error?: string
+}
+
+// The owner-added lines of a crontab: everything except SpinupWP's `#Ansible:`
+// marker + the job line after it, and blank lines. Environment lines (PATH=…,
+// MAILTO=…) are kept here; the caller drops the ones the dest already sets.
+// Exported for the test harness.
+export function ownerCrontabLines(crontab: string): string[] {
+  const out: string[] = []
+  const lines = crontab.split("\n").map((l) => l.replace(/\r$/, ""))
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]
+    if (/^#Ansible:/.test(line)) {
+      i++ // the managed job line that follows the marker
+      continue
+    }
+    if (line.trim() === "") continue
+    out.push(line)
+  }
+  return out
+}
+
+const envName = (line: string): string | null => line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=/)?.[1] ?? null
+
+export async function syncCrontab(
+  source: SudoCtx,
+  dest: SudoCtx,
+  spec: { domain: string; sourceSiteUser: string; destSiteUser: string },
+  onExec?: CloneExecLog,
+): Promise<CrontabSyncResult> {
+  const read = async (ctx: SudoCtx, user: string) => {
+    const t0 = Date.now()
+    const script = `crontab -l -u ${shq(user)} 2>/dev/null || true`
+    const r = await exec(ctx, script, 30_000)
+    onExec?.({ domain: spec.domain, stage: "config", host: ctx.server.name, ok: r.ok, code: r.code, ms: Date.now() - t0, script, stdout: r.stdout, stderr: r.stderr })
+    return r
+  }
+  const src = await read(source, spec.sourceSiteUser)
+  if (!src.ok) return { ok: false, added: [], error: src.stderr.trim() || "couldn't read the source crontab" }
+  const wanted = ownerCrontabLines(src.stdout)
+  if (wanted.length === 0) return { ok: true, added: [] }
+
+  const dst = await read(dest, spec.destSiteUser)
+  if (!dst.ok) return { ok: false, added: [], error: dst.stderr.trim() || "couldn't read the destination crontab" }
+  const have = new Set(dst.stdout.split("\n").map((l) => l.replace(/\r$/, "")))
+  const haveEnv = new Set([...have].map(envName).filter((n): n is string => n != null))
+  // An env line the dest already sets (SpinupWP's own PATH, typically) stays the dest's.
+  const added = wanted.filter((l) => !have.has(l) && !(envName(l) && haveEnv.has(envName(l)!)))
+  if (added.length === 0) return { ok: true, added: [] }
+
+  const block = ["", `# Carried over from ${source.server.name} by the SpinupTUI clone`, ...added].join("\n") + "\n"
+  const b64 = Buffer.from(block).toString("base64")
+  const script = `set -e; { crontab -l -u ${shq(spec.destSiteUser)} 2>/dev/null || true; echo ${shq(b64)} | base64 -d; } | crontab -u ${shq(spec.destSiteUser)} -`
+  const t0 = Date.now()
+  const w = await exec(dest, script, 30_000)
+  onExec?.({ domain: spec.domain, stage: "config", host: dest.server.name, ok: w.ok, code: w.code, ms: Date.now() - t0, script, stdout: w.stdout, stderr: w.stderr })
+  if (!w.ok) return { ok: false, added: [], error: w.stderr.trim() || "couldn't write the destination crontab" }
+  return { ok: true, added }
+}
+
 // ---- Files-only pull chain (non-WP sites: redirect shells, static/PHP sites) --
 //
 // The same hardened transport as the Standard-WP files stage (per-site key,

package/src/lib/spinupweb.ts

@@ -31,3 +31,10 @@ export function serverProvidersSettingsUrl(accountSlug: string | null): string {
 export function siteSftpUrl(id: number, accountSlug: string | null): string {
   return accountSlug ? `${WEB_BASE}/${accountSlug}/sites/${id}#sftp` : WEB_BASE
 }
+
+// A site's Git settings (repo, branch, deploy script). The clone wizard links here
+// when a dest site's deploy script needs re-entering: SpinupWP drops a script
+// set through the API (see the create payload in store.tsx).
+export function siteGitUrl(id: number, accountSlug: string | null): string {
+  return accountSlug ? `${WEB_BASE}/${accountSlug}/sites/${id}#git` : WEB_BASE
+}

package/src/lib/stack.ts

@@ -80,10 +80,13 @@ export function cloneStackFor(site: Site, probeKind?: ProbeKind | null): "wp" |
     if (probeKind === "whmcs" || probeKind === "laravel" || probeKind === "static") return "files"
     return "bedrock"
   }
-  // A "radicle" probe never falls into "wp" here since effectiveStack maps it
-  // to "Radicle", not "Standard WP" — deliberate: the Standard-WP pull chain
-  // assumes a flat webroot and would corrupt a Radicle clone. Real Radicle
-  // clone-wizard support is a separate, not-yet-built phase (issue #38).
+  // A git-deployed Radicle site took the branch above: the Bedrock pull handles
+  // it (it detects Radicle itself, pulls content/uploads, and runs the site's
+  // deploy script to build the front-end). A "radicle" probe with no git repo
+  // never falls into "wp" here since effectiveStack maps it to "Radicle", not
+  // "Standard WP" — deliberate: the Standard-WP pull chain assumes a flat webroot
+  // and would corrupt a Radicle clone, and without the repo there's nothing to
+  // rebuild it from.
   return effectiveStack(site, probeKind) === "Standard WP" ? "wp" : "files"
 }
 

package/src/lib/stackCache.ts

@@ -12,7 +12,7 @@
 import { join } from "node:path"
 import { existsSync, readFileSync } from "node:fs"
 import { chmod, mkdir } from "node:fs/promises"
-import { configDir } from "../config.ts"
+import { profileDataDir } from "../config.ts"
 import type { ProbeResult } from "./probe.ts"
 
 const CACHE_VERSION = 1
@@ -28,8 +28,8 @@ interface CacheFile {
   entries: Record<string, CachedProbe> // key: String(site.id)
 }
 
-export function stackCachePath(): string {
-  return join(configDir(), "stack-cache.json")
+export function stackCachePath(dir = profileDataDir()): string {
+  return join(dir, "stack-cache.json")
 }
 
 // A cached probe is considered stale when the site's relevant shape changes.
@@ -40,6 +40,9 @@ export function siteSignature(site: { is_wordpress: boolean; public_folder: stri
 }
 
 export class StackCache {
+  // Pinned to the account active when the cache was created, so a write that
+  // lands after an account switch still goes to its own account\'s file.
+  private readonly dir = profileDataDir()
   private entries = new Map<number, CachedProbe>()
   // Serializes disk writes so concurrent probes (batch mode) can't tear the
   // file or drop each other's updates. Each persist() runs after the previous.
@@ -49,7 +52,7 @@ export class StackCache {
   // simply yields an empty cache.
   load(): void {
     try {
-      const path = stackCachePath()
+      const path = stackCachePath(this.dir)
       if (!existsSync(path)) return
       const parsed = JSON.parse(readFileSync(path, "utf8")) as CacheFile
       if (parsed?.version !== CACHE_VERSION || !parsed.entries) return
@@ -99,10 +102,10 @@ export class StackCache {
   }
 
   private async writeFile(): Promise<void> {
-    await mkdir(configDir(), { recursive: true })
+    await mkdir(this.dir, { recursive: true })
     const file: CacheFile = { version: CACHE_VERSION, entries: {} }
     for (const [id, entry] of this.entries) file.entries[String(id)] = entry
-    const path = stackCachePath()
+    const path = stackCachePath(this.dir)
     await Bun.write(path, JSON.stringify(file, null, 2) + "\n")
     try {
       await chmod(path, 0o600)

package/src/lib/wpCli.ts

@@ -5,9 +5,9 @@
 // individual site's configured version, and can be missing extensions that
 // version's CLI SAPI never got configured with.
 //
-// Verified live 2026-07-09 on web4.wenmarkdigital.com: the system default had
+// Verified live 2026-07-09 on a production server: the system default had
 // drifted to 8.4, whose CLI lacked `mysqli` (its FPM pool likely never needed
-// it — no site there runs 8.4), while lp.anchoredconstructiontn.com's actual
+// it — no site there runs 8.4), while a site's actual
 // configured version (8.1) has a fully working php8.1-cli. Bare `wp` silently
 // ran under 8.4 and failed on anything touching $wpdb (post/user/plugin list,
 // option get) — while `wp core version`, and `wp db export/import/check/size`
@@ -28,3 +28,55 @@ export function wpCliResolveScript(phpVersion?: string | null): string {
   const phpBin = phpVersion ? `php${phpVersion}` : "php"
   return [`WP=$(command -v wp 2>/dev/null || echo /usr/local/bin/wp)`, `PHP=$(command -v ${phpBin} 2>/dev/null || command -v php)`].join("\n")
 }
+
+// Pull wp-cli's `--format=json` array out of a section of remote stdout that may
+// also carry noise: under the CLI SAPI a plugin's PHP notices/deprecations print
+// to STDOUT (2>/dev/null doesn't catch them), and with no newline of their own
+// they can sit on the same line as the JSON — before it, or after it when they
+// fire at shutdown (seen live: an Elementor Pro deprecation glued to the end of
+// `plugin list` output). So: from every `[`, bracket-match to its closing `]`
+// (skipping brackets inside JSON strings), and keep the longest slice that parses
+// as an array of objects — which is what every wp-cli list is, and what notice
+// text like "on line [3]" or "[array (" never is.
+// Returns null when nothing parses, so callers can tell "wp-cli printed no list"
+// (an error worth surfacing) from a genuinely empty `[]`.
+export function extractJsonArray(lines: string[] | undefined): unknown[] | null {
+  const text = (lines ?? []).join("\n")
+  let best: unknown[] | null = null
+  let bestLen = -1
+  for (let start = text.indexOf("["); start !== -1; start = text.indexOf("[", start + 1)) {
+    const end = matchingBracket(text, start)
+    if (end === -1 || end - start <= bestLen) continue
+    try {
+      const parsed = JSON.parse(text.slice(start, end + 1))
+      if (Array.isArray(parsed) && parsed.every((o) => o !== null && typeof o === "object")) {
+        best = parsed
+        bestLen = end - start
+      }
+    } catch {
+      /* not JSON from here — try the next `[` */
+    }
+  }
+  return best
+}
+
+// Index of the `]` closing the `[` at `start`, or -1. Tracks JSON string state so
+// a bracket inside a value (a plugin name, a URL) doesn't end the match early.
+function matchingBracket(text: string, start: number): number {
+  let depth = 0
+  let inString = false
+  for (let i = start; i < text.length; i++) {
+    const ch = text[i]
+    if (inString) {
+      if (ch === "\\") i++
+      else if (ch === '"') inString = false
+    } else if (ch === '"') inString = true
+    else if (ch === "[" || ch === "{") depth++
+    else if (ch === "]" || ch === "}") {
+      depth--
+      if (depth === 0) return ch === "]" ? i : -1
+      if (depth < 0) return -1
+    }
+  }
+  return -1
+}