spinuptui 0.28.0 → 1.1.0

package/CHANGELOG.md

@@ -5,12 +5,45 @@ All notable changes to this project are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-While the project is in `0.x`, the public surface (CLI subcommands/flags, config
-file location and format, and token-resolution behavior) may change between minor
-versions; such changes are called out here.
+From 1.0.0, the public surface (CLI subcommands/flags, config file location and
+format, and token-resolution behavior) changes incompatibly only in a major
+version; such changes are called out here.
 
 ## [Unreleased]
 
+## [1.1.0] - 2026-09-30
+
+### Added
+- **Clones match the source's SpinupWP settings.** Creating a site through SpinupWP's API only switches page caching on or off, so a clone used to come out with SpinupWP's defaults for everything else. The wizard now matches the source's page cache duration and exclusions, the security toggles (PHP in uploads, `xmlrpc.php`, multisite subdirectory rewrites), its path redirects, and the WP cron interval (read from the site's crontab, since the API doesn't report it). Only what differs is changed, so a retry changes nothing, and nothing the clone already has is removed. The verify pane (`v`) lists what it matched, and anything that didn't take, with `w` to open the new site in SpinupWP.
+- **Clones point out basic auth.** SpinupWP never reveals a site's basic-auth password, so a password-protected source can't be copied as-is. The verify pane says so and `w` opens the new site to set it.
+- **`spinuptui siblings <domain>` — who else is on this server.** Prints every site sharing a server with the one you name, as JSON, along with the server's own IP, SSH port, size and Ubuntu version. Each site says whether it's the server's vanity host, whether it's WordPress, what PHP it runs, whether page cache is on, and whether SpinupTUI set Uptime Kuma monitors up for it. This is for the case where a symptom belongs to the whole box rather than to one site: a vanity host's `?healthz` trips on whatever load the busiest co-tenant is making, and site isolation means the vanity site's own user can't see any of it — so the first question is always "who else lives here". `--probe` also SSHes into each site user and reports which ones this device's key is accepted for, which is the same question as "whose logs can I read". A site that comes back `permission_denied` is one key grant (`K` in the Browser view) away from being readable.
+
+### Changed
+- **Clones put the deploy script back themselves.** SpinupWP clears a deploy script set when a site is created, and until now you had to paste it back into the new site's Git settings. SpinupWP's API can now update a site's Git settings, so the clone wizard sets the source's script again once the site is done, and fixes push-to-deploy the same way if it came out different. The verify pane (`v`) says when it did. The `g` copy-and-open fallback only appears if the script still doesn't stick. A clone that finishes within about two minutes of creating the site waits out the rest first, since an earlier write would be cleared along with the original.
+
+### Fixed
+- **`spinuptui ssh` reports a hung connection as `connection_failed`.** When the connectivity probe ran past its 15-second limit, it came back as an unexplained `ssh_error` with the kill signal's exit code. It now says the connection didn't finish in time.
+
+### Notes
+- **Backups don't carry over to a clone yet.** SpinupWP stores backups per domain, so a clone backing up before DNS moves would write into the production site's folder. Switch backups on for the new site after cutover; having the wizard do it at the cutover step is planned.
+
+## [1.0.0] - 2026-09-24
+
+### Added
+- **Install with Homebrew.** `brew install mwender/tap/spinuptui` installs SpinupTUI along with Bun, and `brew upgrade spinuptui` updates it. The About panel (`?`) recognizes a Homebrew install and shows `brew upgrade spinuptui` as its update command instead of the Bun one.
+- **API headroom in the header.** The top bar now shows how many SpinupWP API requests are left in the current minute (`API 52/60`). It stays dim while there's plenty, turns amber once three-quarters of the minute's budget is spent, and red when SpinupTUI starts spacing out requests to avoid hitting the limit, so a slow moment has a visible reason. It refills on its own when the minute rolls over.
+- **Clone Radicle sites.** The clone wizard now clones git-deployed Radicle sites properly. Uploads come across from `content/uploads`, and after the database import the site's own deploy script runs on the new server, so the front-end is built (`npm ci`, `npm run build`, Acorn caches) the way a normal deploy would. Before creating anything, the wizard stops if the Radicle site has no deploy script, or if its script needs Node and the destination server doesn't have it. SpinupWP servers don't come with Node, so install it on the destination first.
+- **Clones keep your cron jobs.** Lines you added to a site's crontab (a feed import, a report, an Acorn or Laravel command) are copied to the clone under a `# Carried over from …` comment. Lines you commented out are copied as they are, SpinupWP's own WordPress cron entry is left to SpinupWP, and a retry never adds a line twice. The verify pane (`v`) says how many lines came across.
+
+### Changed
+- **Clones match the source's page cache and push-to-deploy** instead of using fixed defaults, and send the source's own deploy script.
+
+### Fixed
+- **Plugins & themes (`e`) no longer shows an empty list on sites with noisy plugins.** Some plugins print PHP notices into wp-cli's output, sometimes on the same line as the plugin list, and the view read that as "no plugins installed". The list is now found wherever it sits in the output, and if wp-cli returns no list at all the view says so, with the first line of what it printed, instead of showing zero plugins. The WordPress core update check uses the same parsing.
+
+### Notes
+- **SpinupWP clears a deploy script set through its API** a minute or two after the site is created, and there's no API call to set it afterwards. After a clone, the wizard checks the new site; if the script is gone, the roster marks the site and the verify pane offers `g`, which copies the source's script and opens the new site's Git settings so you can paste it back. The same check flags a push-to-deploy setting that didn't carry over.
+
 ## [0.28.0] - 2026-09-23
 
 ### Added
@@ -1436,7 +1469,9 @@ Initial tagged release.
 ### Notes
 - Read-only release: works with a SpinupWP **Read Only** API token.
 
-[Unreleased]: https://github.com/mwender/spinupwp-tui/compare/v0.28.0...HEAD
+[Unreleased]: https://github.com/mwender/spinupwp-tui/compare/v1.1.0...HEAD
+[1.1.0]: https://github.com/mwender/spinupwp-tui/compare/v1.0.0...v1.1.0
+[1.0.0]: https://github.com/mwender/spinupwp-tui/compare/v0.28.0...v1.0.0
 [0.28.0]: https://github.com/mwender/spinupwp-tui/compare/v0.27.0...v0.28.0
 [0.27.0]: https://github.com/mwender/spinupwp-tui/compare/v0.26.1...v0.27.0
 [0.26.1]: https://github.com/mwender/spinupwp-tui/compare/v0.26.0...v0.26.1

package/README.md

@@ -82,12 +82,14 @@
   if it's read-only — anything that looks like a write/restart/destructive
   action is denied rather than run, so any agent using it inherits that
   guarantee without building its own guard; `spinuptui incidents <domain>` /
-  `--all` surfaces Uptime Kuma's down/up history as JSON; `spinuptui pull files
-  <domain> [path]` and `spinuptui pull db <domain> --yes` set up a local working
-  copy from production without opening the TUI at all — the same engines the
-  guided flow drives. Built so another agent/script can go from just a domain to
-  "what's wrong and how do I get in", or to a working local copy, with no manual
-  lookup. → [CLI subcommands](#cli-subcommands)
+  `--all` surfaces Uptime Kuma's down/up history as JSON; `spinuptui siblings
+  <domain>` lists every site sharing that site's server, so a page on a server's
+  vanity host leads straight to the co-tenants that could be causing it;
+  `spinuptui pull files <domain> [path]` and `spinuptui pull db <domain> --yes`
+  set up a local working copy from production without opening the TUI at all —
+  the same engines the guided flow drives. Built so another agent/script can go
+  from just a domain to "what's wrong and how do I get in", or to a working local
+  copy, with no manual lookup. → [CLI subcommands](#cli-subcommands)
 - **Completion toasts** — a non-focus-stealing toast when a background write
   (PHP upgrade, reboot, DNS resolve, …) finishes.
 - **Release notes** — an in-app "what's new" after every update, sourced
@@ -112,14 +114,20 @@
 
 ## Install & run
 
-The easy way — install the published package globally:
+The easy way — Homebrew (it installs Bun for you):
 
 ```sh
-bun install -g spinuptui
+brew install mwender/tap/spinuptui
 spinuptui login          # save your API token to the config file (once)
 spinuptui                # launch from any directory
 ```
 
+Or, if you already have Bun, install the published package globally:
+
+```sh
+bun install -g spinuptui
+```
+
 On first launch, if no token is configured you'll be guided through a short
 onboarding flow that validates your token and saves it locally.
 
@@ -155,6 +163,8 @@ bun run build:binary     # produces ./spinuptui — move it onto your PATH
 The app tells you when a newer release exists — a gold `✦ vX.Y.Z` appears next
 to the version in the header (and in the `?` About panel).
 
+- **Homebrew:** `brew upgrade spinuptui` (the About panel shows the same
+  command).
 - **Package install:** `bun add -g spinuptui@latest` (the About panel shows
   the same command). Don't use `bun update -g` — while spinuptui is pre-1.0,
   it records a caret range (e.g. `^0.22.2`) that excludes every later minor
@@ -191,6 +201,24 @@ spinuptui ssh-exec <domain> [--server <name>] -- <command>  Resolve the
                      attempt (allowed, denied, or unresolved) is appended to
                      <config dir>/logs/ssh-exec-audit.jsonl. Quote <command>
                      as one shell argument if it needs pipes or redirects.
+spinuptui siblings <domain> [--server <name>] [--probe]  Print every site
+                     sharing a server with this one, as JSON, with the
+                     server's own details (IP, SSH port, size, Ubuntu
+                     version). Each entry carries its site user and SSH
+                     target, whether it's WordPress, its PHP version, whether
+                     page cache is on, whether it's the server's vanity host
+                     (isVanity), whether SpinupTUI registered Uptime Kuma
+                     monitors for it (monitored), and whether it's the domain
+                     you asked about (isQuery). The vanity host sorts first,
+                     then the queried site, then the rest alphabetically.
+                     --probe additionally SSHes into each site user and
+                     reports ssh:"ok" | "permission_denied" |
+                     "connection_failed" | "ssh_error", which answers "whose
+                     logs can I actually read on this box" in one call.
+                     Written for whole-server symptoms: a vanity host's
+                     ?healthz trips on the load of whichever co-tenant is
+                     busy, and site isolation means the vanity user can't see
+                     it.
 spinuptui incidents <domain> | --all [--hours N]  Print Uptime Kuma down/up
                      incidents as JSON, scoped to sites SpinupTUI manages
                      monitoring for (config.json's kumaMonitors) — --all

package/bun.lock

@@ -0,0 +1,103 @@
+{
+  "lockfileVersion": 1,
+  "configVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "spinuptui",
+      "dependencies": {
+        "@opentui/core": "^0.4.1",
+        "@opentui/react": "^0.4.1",
+        "react": "^19.0.0",
+        "socket.io-client": "^4.8.3",
+      },
+      "devDependencies": {
+        "@types/bun": "^1.3.14",
+        "@types/react": "^19.0.0",
+        "typescript": "^5.6.0",
+      },
+    },
+  },
+  "packages": {
+    "@opentui/core": ["@opentui/core@0.4.5", "", { "dependencies": { "bun-ffi-structs": "0.2.4", "diff": "9.0.0", "marked": "17.0.1", "string-width": "7.2.0", "strip-ansi": "7.1.2" }, "optionalDependencies": { "@opentui/core-darwin-arm64": "0.4.5", "@opentui/core-darwin-x64": "0.4.5", "@opentui/core-linux-arm64": "0.4.5", "@opentui/core-linux-arm64-musl": "0.4.5", "@opentui/core-linux-x64": "0.4.5", "@opentui/core-linux-x64-musl": "0.4.5", "@opentui/core-win32-arm64": "0.4.5", "@opentui/core-win32-x64": "0.4.5" }, "peerDependencies": { "web-tree-sitter": "0.25.10" } }, "sha512-JsgRTPkA6e+Vxmumxai6SElOSlRQkbzNKHlCfemlArRiLhfC1IZ9RXJo2QH4xSu+uBOWAM90uss73/pPlkdEig=="],
+
+    "@opentui/core-darwin-arm64": ["@opentui/core-darwin-arm64@0.4.5", "", { "os": "darwin", "cpu": "arm64" }, "sha512-8KUG0oRidnR+oW1RSZJ72/PhZLl+qRRMk5U/mieF4c0SJ5V3tYACpBZAKzQfHNd1f7QzD8FHZct1lPpQgtmkWg=="],
+
+    "@opentui/core-darwin-x64": ["@opentui/core-darwin-x64@0.4.5", "", { "os": "darwin", "cpu": "x64" }, "sha512-R2bocsg55gwjOqCp/MWFgFYzRmsduKegB6nzgFAPCvAD/L5Jf30xpWJWFlSg3x8vxe1L9WJ84dfqa4M7mZZ3wA=="],
+
+    "@opentui/core-linux-arm64": ["@opentui/core-linux-arm64@0.4.5", "", { "os": "linux", "cpu": "arm64" }, "sha512-R4MZ25a4CzOAGVjW9aj1hUfzQGVfCJwrwBDbNs2SXaIvzcZqkxCVtU4FoQ5LsaD0j/BdNQVg2CIfFkFsm1fDuQ=="],
+
+    "@opentui/core-linux-arm64-musl": ["@opentui/core-linux-arm64-musl@0.4.5", "", { "os": "linux", "cpu": "arm64" }, "sha512-ieqdyKI6EIYPalYAETB2wsdP83hr5Ifi+dFnBFUmdEEFHsoKwBmn2S7bsTOYlX7Bg03F4/YPIg+IvRpeC+cUJw=="],
+
+    "@opentui/core-linux-x64": ["@opentui/core-linux-x64@0.4.5", "", { "os": "linux", "cpu": "x64" }, "sha512-SNyuQoxMKI1vuJhgxSSW96adWM6LqFl2SoS3GM4tGeneGOanVVG2Y06PvlytXvF4cKik97t0rqkVMRetmOs93w=="],
+
+    "@opentui/core-linux-x64-musl": ["@opentui/core-linux-x64-musl@0.4.5", "", { "os": "linux", "cpu": "x64" }, "sha512-mKVKcIcPiSVVZZsdPSBoWwoa2/TCeQAaMDeHF7PFw2kt5bTXZPP7xxWfRQLCNIcA1eaGl59UuwUWHDR2Ve548Q=="],
+
+    "@opentui/core-win32-arm64": ["@opentui/core-win32-arm64@0.4.5", "", { "os": "win32", "cpu": "arm64" }, "sha512-GHTTsqeR45q2Iek9Rb7ty+x/hAKn2jZ1ujlCgPR8LBKyF7h0E1dNFryoZ7ehMc3kJndP1sKn836IemKFqxuDdQ=="],
+
+    "@opentui/core-win32-x64": ["@opentui/core-win32-x64@0.4.5", "", { "os": "win32", "cpu": "x64" }, "sha512-Y8T/yXCDGagRGiQrtmuB6AhRcPucKFs/Dre3v8kJwNYqDccI4FzUPKclZ7djfmRZNjl7JUqPhZZP/PwDpQocMg=="],
+
+    "@opentui/react": ["@opentui/react@0.4.5", "", { "dependencies": { "@opentui/core": "0.4.5", "react-reconciler": "^0.33.0" }, "peerDependencies": { "react": ">=19.2.0", "react-devtools-core": "^7.0.1", "ws": "^8.18.0" } }, "sha512-n88Vx0cMmAu++/S14WscjvdcT46IDcxve02jMtcfHQ9j6cySRHfILfGEpOB7xxc8RpCwQceEyOjkKkfzPzm6Jg=="],
+
+    "@socket.io/component-emitter": ["@socket.io/component-emitter@3.1.2", "", {}, "sha512-9BCxFwvbGg/RsZK9tjXd8s4UcwR0MWeFQ1XEKIQVVvAGJyINdrqKMcTRyLoK8Rse1GjzLV9cwjWV1olXRWEXVA=="],
+
+    "@types/bun": ["@types/bun@1.3.14", "", { "dependencies": { "bun-types": "1.3.14" } }, "sha512-h1hFqFVcvAvD9j9K7ZW7vd82aSA+rTdznZa+5bwvCwqSB1jmmfLcbIWhOLx1/+boy/xmjgCs/OMUL8hRJSmnPw=="],
+
+    "@types/node": ["@types/node@26.1.2", "", { "dependencies": { "undici-types": "~8.3.0" } }, "sha512-Vu4a5UFA9rIIFJ7rB/Vaafh9lrCQszopTCx6KjFboXTGQbPNasehVR5TEiithSDGyd1DEiUByggTZsg8jukeIg=="],
+
+    "@types/react": ["@types/react@19.2.18", "", { "dependencies": { "csstype": "^3.2.2" } }, "sha512-AnzbBERsrLKtk2XSfTbYRLjQPdy116Sty4q+T+Bp3IC4l6jNBvreVPAHmpq9qhXQM7CXZPjLVmGMw9sy+hxQ3w=="],
+
+    "ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
+
+    "bun-ffi-structs": ["bun-ffi-structs@0.2.4", "", { "peerDependencies": { "typescript": "^5" } }, "sha512-AJzsqoVFs1KBbJbWHIYrVZLDC3NhTqqh25awRXqzoLzmBAKr5oqk6+CwuYHAekKx+VBCYVohBoKuRq40dV+TYg=="],
+
+    "bun-types": ["bun-types@1.3.14", "", { "dependencies": { "@types/node": "*" } }, "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ=="],
+
+    "csstype": ["csstype@3.2.3", "", {}, "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ=="],
+
+    "debug": ["debug@4.4.3", "", { "dependencies": { "ms": "^2.1.3" }, "peerDependencies": { "supports-color": "*" }, "optionalPeers": ["supports-color"] }, "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA=="],
+
+    "diff": ["diff@9.0.0", "", {}, "sha512-svtcdpS8CgJyqAjEQIXdb3OjhFVVYjzGAPO8WGCmRbrml64SPw/jJD4GoE98aR7r25A0XcgrK3F02yw9R/vhQw=="],
+
+    "emoji-regex": ["emoji-regex@10.6.0", "", {}, "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A=="],
+
+    "engine.io-client": ["engine.io-client@6.6.6", "", { "dependencies": { "@socket.io/component-emitter": "~3.1.0", "debug": "~4.4.1", "engine.io-parser": "~5.2.1", "ws": "~8.21.0", "xmlhttprequest-ssl": "~2.1.1" } }, "sha512-iY6QdftLQ9pyiPoX082bpf/u1UewnOaJrtJIF9T0++QB34lZrj0uP+Q/bj8AlUsAxqhnkTV2BS8SBZSxOmoV5Q=="],
+
+    "engine.io-parser": ["engine.io-parser@5.2.3", "", {}, "sha512-HqD3yTBfnBxIrbnM1DoD6Pcq8NECnh8d4As1Qgh0z5Gg3jRRIqijury0CL3ghu/edArpUYiYqQiDUQBIs4np3Q=="],
+
+    "get-east-asian-width": ["get-east-asian-width@1.6.0", "", {}, "sha512-QRbvDIbx6YklUe6RxeTeleMR0yv3cYH6PsPZHcnVn7xv7zO1BHN8r0XETu8n6Ye3Q+ahtSarc3WgtNWmehIBfA=="],
+
+    "marked": ["marked@17.0.1", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-boeBdiS0ghpWcSwoNm/jJBwdpFaMnZWRzjA6SkUMYb40SVaN1x7mmfGKp0jvexGcx+7y2La5zRZsYFZI6Qpypg=="],
+
+    "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
+
+    "react": ["react@19.2.8", "", {}, "sha512-PWaYA1L/q9u2u7xYQi+Y3L3Yfnie7XyLeaJICV1MGD6LprsBxcAqGjYyr0eY3p+QdsA+x/Irkt4Qif8D63+Sbw=="],
+
+    "react-devtools-core": ["react-devtools-core@7.0.1", "", { "dependencies": { "shell-quote": "^1.6.1", "ws": "^7" } }, "sha512-C3yNvRHaizlpiASzy7b9vbnBGLrhvdhl1CbdU6EnZgxPNbai60szdLtl+VL76UNOt5bOoVTOz5rNWZxgGt+Gsw=="],
+
+    "react-reconciler": ["react-reconciler@0.33.0", "", { "dependencies": { "scheduler": "^0.27.0" }, "peerDependencies": { "react": "^19.2.0" } }, "sha512-KetWRytFv1epdpJc3J4G75I4WrplZE5jOL7Yq0p34+OVOKF4Se7WrdIdVC45XsSSmUTlht2FM/fM1FZb1mfQeA=="],
+
+    "scheduler": ["scheduler@0.27.0", "", {}, "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q=="],
+
+    "shell-quote": ["shell-quote@1.10.0", "", {}, "sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA=="],
+
+    "socket.io-client": ["socket.io-client@4.8.3", "", { "dependencies": { "@socket.io/component-emitter": "~3.1.0", "debug": "~4.4.1", "engine.io-client": "~6.6.1", "socket.io-parser": "~4.2.4" } }, "sha512-uP0bpjWrjQmUt5DTHq9RuoCBdFJF10cdX9X+a368j/Ft0wmaVgxlrjvK3kjvgCODOMMOz9lcaRzxmso0bTWZ/g=="],
+
+    "socket.io-parser": ["socket.io-parser@4.2.7", "", { "dependencies": { "@socket.io/component-emitter": "~3.1.0", "debug": "~4.4.1" } }, "sha512-IH/iSeO9T6gz1KkFleGDWkG9N3dl4jXVYUtMhIqH10Md0ttMer8nUNWiP1DKuNrybD2xBrixLJdCC9J6ECoYkg=="],
+
+    "string-width": ["string-width@7.2.0", "", { "dependencies": { "emoji-regex": "^10.3.0", "get-east-asian-width": "^1.0.0", "strip-ansi": "^7.1.0" } }, "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ=="],
+
+    "strip-ansi": ["strip-ansi@7.1.2", "", { "dependencies": { "ansi-regex": "^6.0.1" } }, "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA=="],
+
+    "typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
+
+    "undici-types": ["undici-types@8.3.0", "", {}, "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ=="],
+
+    "web-tree-sitter": ["web-tree-sitter@0.25.10", "", { "peerDependencies": { "@types/emscripten": "^1.40.0" }, "optionalPeers": ["@types/emscripten"] }, "sha512-Y09sF44/13XvgVKgO2cNDw5rGk6s26MgoZPXLESvMXeefBf7i6/73eFurre0IsTW6E14Y0ArIzhUMmjoc7xyzA=="],
+
+    "ws": ["ws@8.21.2", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-54dMVAo4WIe6SKy3vBgN+9bJZqqQ8IMRevAkOLQALhi49qkkQDQfWdAZ8KQlXiEabw88ARXXdUrlvtbKQX+aKw=="],
+
+    "xmlhttprequest-ssl": ["xmlhttprequest-ssl@2.1.2", "", {}, "sha512-TEU+nJVUUnA4CYJFLvK5X9AOeH4KvDvhIfm0vV1GaQRtchnG0hgK5p8hw/xjv8cunWYCsiPCSDzObPyhEwq3KQ=="],
+
+    "react-devtools-core/ws": ["ws@7.5.13", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": "^5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-rsKI6xDBFVf4r/x8XyChGK04QR/XHroxs/jUcoWvtEZM8TPU/X/uIY9B1CsSzYws9ZJb/6bbBu7dPhFW00CAoA=="],
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spinuptui",
-  "version": "0.28.0",
+  "version": "1.1.0",
   "description": "SpinupTUI — a terminal dashboard for browsing, monitoring, and managing your SpinupWP servers and sites.",
   "type": "module",
   "bin": {
@@ -11,7 +11,8 @@
     "src",
     "README.md",
     "CHANGELOG.md",
-    "LICENSE"
+    "LICENSE",
+    "bun.lock"
   ],
   "repository": {
     "type": "git",

package/src/api/client.ts

@@ -15,6 +15,10 @@ import type {
   CreateSitePayload,
   AdditionalDomain,
   AddDomainPayload,
+  UpdateSiteGitPayload,
+  PageCachePayload,
+  NginxSettings,
+  PathRedirect,
 } from "./types.ts"
 
 // The restartable services SpinupWP exposes (POST /servers/{id}/services/{svc}/restart).
@@ -84,6 +88,16 @@ export interface SpinupWPClientLike {
   listSites(serverId?: number): Promise<Site[]>
   getSite(id: number): Promise<Site>
   createSite(payload: CreateSitePayload): Promise<{ event_id: number }>
+  updateSiteGit(siteId: number, payload: UpdateSiteGitPayload): Promise<{ event_id: number | null } | undefined>
+  enablePageCache(siteId: number, payload?: PageCachePayload): Promise<{ event_id: number }>
+  updatePageCache(siteId: number, payload: PageCachePayload): Promise<{ event_id: number }>
+  disablePageCache(siteId: number): Promise<{ event_id: number }>
+  updateNginx(siteId: number, payload: NginxSettings): Promise<{ event_ids: number[] }>
+  listPathRedirects(siteId: number): Promise<PathRedirect[]>
+  addPathRedirect(siteId: number, payload: Omit<PathRedirect, "created_at">): Promise<{ event_id: number }>
+  enableWpCron(siteId: number, interval: number): Promise<{ event_id: number }>
+  updateWpCron(siteId: number, interval: number): Promise<{ event_id: number }>
+  disableWpCron(siteId: number): Promise<{ event_id: number }>
   enableHttps(siteId: number): Promise<{ event_id: number }>
   disableHttps(siteId: number): Promise<{ event_id: number } | undefined>
   purgePageCache(siteId: number): Promise<{ event_id: number }>
@@ -110,15 +124,44 @@ const MAX_PAGES = 100 // hard safety cap when auto-paginating
 // event polling burned the window and made SUCCESSFUL operations look failed.
 let rlRemaining = Infinity
 let rlResetAt = 0
-const RL_LOW_WATER = 8 // start pacing when fewer than this many requests remain
+let rlLimit = 0 // X-RateLimit-Limit as last seen; 0 = no response yet
+export const RL_LOW_WATER = 8 // start pacing when fewer than this many requests remain
 const RL_MAX_RETRIES = 3
 const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms))
 
 function rlUpdate(headers: Headers): void {
-  const rem = Number(headers.get("x-ratelimit-remaining"))
-  if (Number.isFinite(rem)) rlRemaining = rem
+  // Number(null) is 0, so a missing header must not read as "0 left".
+  const remHeader = headers.get("x-ratelimit-remaining")
+  const rem = Number(remHeader)
+  if (remHeader !== null && Number.isFinite(rem)) rlRemaining = rem
+  const limit = Number(headers.get("x-ratelimit-limit"))
+  if (Number.isFinite(limit) && limit > 0) rlLimit = limit
   // No reset header outside 429s — assume the standard 1-minute window rolls over.
   if (rlResetAt < Date.now()) rlResetAt = Date.now() + 60_000
+  rlNotify()
+}
+
+// Read side for the header's headroom indicator: what's left of this minute's
+// budget, so a user sees the wall coming before a 429 (or before pacing makes
+// the app feel slow). null until the first response has told us the limit.
+export interface RateLimitSnapshot {
+  remaining: number
+  limit: number
+  resetAt: number
+}
+const rlListeners = new Set<() => void>()
+function rlNotify(): void {
+  for (const l of rlListeners) l()
+}
+export function rateLimitSnapshot(): RateLimitSnapshot | null {
+  if (!rlLimit || !Number.isFinite(rlRemaining)) return null
+  // Past the window's end the last count is stale: a fresh window is full.
+  const remaining = rlResetAt < Date.now() ? rlLimit : rlRemaining
+  return { remaining, limit: rlLimit, resetAt: rlResetAt }
+}
+export function onRateLimitChange(listener: () => void): () => void {
+  rlListeners.add(listener)
+  return () => rlListeners.delete(listener)
 }
 
 async function rlGate(): Promise<void> {
@@ -154,6 +197,7 @@ export class SpinupWPClient implements SpinupWPClientLike {
         const waitMs = (Number.isFinite(ra) && ra > 0 ? ra : 20) * 1000
         rlRemaining = 0
         rlResetAt = Date.now() + waitMs
+        rlNotify()
         await sleep(waitMs + Math.random() * 500)
         continue
       }
@@ -321,6 +365,57 @@ export class SpinupWPClient implements SpinupWPClientLike {
     return this.mutate<{ event_id: number }>(`/sites/${siteId}/domains`, "POST", payload)
   }
 
+  // Update a site's Git settings (at least one field). Changing only the deploy
+  // script or push-to-deploy needs no server work, so SpinupWP answers with a null
+  // event_id — the new values are in place when this resolves. Needs a Read/Write
+  // token.
+  updateSiteGit(siteId: number, payload: UpdateSiteGitPayload): Promise<{ event_id: number | null } | undefined> {
+    return this.mutate<{ event_id: number | null } | undefined>(`/sites/${siteId}/git`, "PUT", payload)
+  }
+
+  // Page cache on an existing site (the API added enable/disable/settings in
+  // 2026-09; before that only purge existed). Async → event_id. Lists in the
+  // payload are newline-separated. Needs a Read/Write token.
+  enablePageCache(siteId: number, payload: PageCachePayload = {}): Promise<{ event_id: number }> {
+    return this.mutate<{ event_id: number }>(`/sites/${siteId}/page-cache`, "POST", payload)
+  }
+  updatePageCache(siteId: number, payload: PageCachePayload): Promise<{ event_id: number }> {
+    return this.mutate<{ event_id: number }>(`/sites/${siteId}/page-cache`, "PUT", payload)
+  }
+  disablePageCache(siteId: number): Promise<{ event_id: number }> {
+    return this.mutate<{ event_id: number }>(`/sites/${siteId}/page-cache`, "DELETE")
+  }
+
+  // Nginx toggles (PHP in uploads, xmlrpc.php, multisite subdirectory rewrites;
+  // public_folder too, unused here). One event PER CHANGED SETTING comes back as
+  // `event_ids` — empty when nothing changed. Needs a Read/Write token.
+  updateNginx(siteId: number, payload: NginxSettings): Promise<{ event_ids: number[] }> {
+    return this.mutate<{ event_ids: number[] }>(`/sites/${siteId}/nginx`, "PUT", payload)
+  }
+
+  // Path redirects (nginx-level, per site). Adding a from+to pair the site already
+  // has is rejected. Async → event_id. Needs a Read/Write token.
+  async listPathRedirects(siteId: number): Promise<PathRedirect[]> {
+    return this.listAll<PathRedirect>(`/sites/${siteId}/path-redirects`)
+  }
+  addPathRedirect(siteId: number, payload: Omit<PathRedirect, "created_at">): Promise<{ event_id: number }> {
+    return this.mutate<{ event_id: number }>(`/sites/${siteId}/path-redirects`, "POST", payload)
+  }
+
+  // Server-level WP cron (a system cron job replacing WordPress's page-load cron).
+  // interval is minutes, one of WP_CRON_INTERVALS. The Site object doesn't report
+  // it — read the site user's crontab instead (wpCronInterval in serverClone.ts).
+  // Async → event_id. Needs a Read/Write token.
+  enableWpCron(siteId: number, interval: number): Promise<{ event_id: number }> {
+    return this.mutate<{ event_id: number }>(`/sites/${siteId}/cron`, "POST", { interval })
+  }
+  updateWpCron(siteId: number, interval: number): Promise<{ event_id: number }> {
+    return this.mutate<{ event_id: number }>(`/sites/${siteId}/cron`, "PUT", { interval })
+  }
+  disableWpCron(siteId: number): Promise<{ event_id: number }> {
+    return this.mutate<{ event_id: number }>(`/sites/${siteId}/cron`, "DELETE")
+  }
+
   // Enable HTTPS on a site. `type: "webroot"` requests a Let's Encrypt cert (the
   // domain must already resolve to the server for LE to issue, so this runs after
   // the DNS A record has propagated). Async → returns an event_id to poll. Needs a

package/src/api/types.ts

@@ -66,6 +66,24 @@ export interface AdditionalDomain {
   created_at: string
 }
 
+// Page cache as the Site object reports it. The exclusion lists come back as ONE
+// pipe-joined regex ("/wp-admin/|/wp-json/|…") but are WRITTEN newline-separated —
+// see splitCacheList in lib/cloneSettings.ts. Unset lists read back null.
+export interface PageCacheSettings {
+  enabled: boolean
+  duration?: number | null
+  duration_unit?: string | null
+  path_exclusions?: string | null
+  cookie_exclusions?: string | null
+  ignored_query_params?: string | null
+}
+
+export interface NginxSettings {
+  uploads_directory_protected?: boolean
+  xmlrpc_protected?: boolean
+  subdirectory_rewrite_in_place?: boolean
+}
+
 export interface Site {
   id: number
   server_id: number
@@ -75,9 +93,9 @@ export interface Site {
   php_version: string | null
   public_folder: string | null
   is_wordpress: boolean
-  page_cache?: { enabled: boolean }
+  page_cache?: PageCacheSettings
   https?: { enabled: boolean }
-  nginx?: Record<string, unknown>
+  nginx?: NginxSettings
   database?: {
     id: number | null
     user_id: number | null
@@ -193,6 +211,37 @@ export interface CreateSitePayload {
   }
 }
 
+// PUT /sites/{id}/git — at least one field. Unlike POST /sites, deploy_script sits
+// alongside the git settings here, and the write key is push_to_deploy.
+export interface UpdateSiteGitPayload {
+  repo?: string
+  branch?: string
+  deploy_script?: string
+  push_to_deploy?: boolean
+}
+
+// POST/PUT /sites/{id}/page-cache. Lists are newline-separated on write. PUT keeps
+// any omitted field.
+export interface PageCachePayload {
+  duration?: number
+  duration_unit?: string
+  path_exclusions?: string
+  cookie_exclusions?: string
+  ignored_query_params?: string
+}
+
+// A site's path redirect (GET /sites/{id}/path-redirects). type: "permanent" = 301,
+// "redirect" = 302. Delete is keyed by from + to — there's no id.
+export interface PathRedirect {
+  from: string
+  to: string
+  type: "permanent" | "redirect"
+  created_at?: string
+}
+
+// The server-level WP cron intervals SpinupWP accepts, in minutes.
+export const WP_CRON_INTERVALS = [1, 2, 5, 10, 15, 30, 60] as const
+
 export interface Event {
   id: number
   initiated_by: string | null

package/src/dev/mockClient.ts

@@ -132,6 +132,62 @@ export function createMockClient(): SpinupWPClientLike {
       return { event_id }
     },
 
+    async updateSiteGit(siteId, payload) {
+      const site = sites.find((s) => s.id === siteId)
+      if (site?.git) {
+        if (payload.repo != null) site.git.repo = payload.repo
+        if (payload.branch != null) site.git.branch = payload.branch
+        if (payload.deploy_script != null) site.git.deploy_script = payload.deploy_script
+        if (payload.push_to_deploy != null) site.git.push_enabled = payload.push_to_deploy
+      }
+      return { event_id: null }
+    },
+
+    async enablePageCache(siteId, payload = {}) {
+      const site = sites.find((s) => s.id === siteId)
+      if (site) site.page_cache = { ...site.page_cache, ...payload, enabled: true }
+      return { event_id: pushEvent("site.page_cache.enabled", site?.server_id ?? null, `Page cache enabled for ${site?.domain ?? siteId}`) }
+    },
+
+    async updatePageCache(siteId, payload) {
+      const site = sites.find((s) => s.id === siteId)
+      if (site) site.page_cache = { enabled: site.page_cache?.enabled ?? false, ...site.page_cache, ...payload }
+      return { event_id: pushEvent("site.page_cache.updated", site?.server_id ?? null, `Page cache updated for ${site?.domain ?? siteId}`) }
+    },
+
+    async disablePageCache(siteId) {
+      const site = sites.find((s) => s.id === siteId)
+      if (site) site.page_cache = { enabled: false }
+      return { event_id: pushEvent("site.page_cache.disabled", site?.server_id ?? null, `Page cache disabled for ${site?.domain ?? siteId}`) }
+    },
+
+    async updateNginx(siteId, payload) {
+      const site = sites.find((s) => s.id === siteId)
+      if (site) site.nginx = { ...site.nginx, ...payload }
+      return { event_ids: [pushEvent("site.nginx.updated", site?.server_id ?? null, `Nginx settings updated for ${site?.domain ?? siteId}`)] }
+    },
+
+    async listPathRedirects() {
+      return []
+    },
+
+    async addPathRedirect(siteId, payload) {
+      const site = sites.find((s) => s.id === siteId)
+      return { event_id: pushEvent("site.redirect.added", site?.server_id ?? null, `Redirect ${payload.from} added to ${site?.domain ?? siteId}`) }
+    },
+
+    async enableWpCron(siteId) {
+      return { event_id: pushEvent("site.cron.enabled", null, `WP cron enabled for site ${siteId}`) }
+    },
+
+    async updateWpCron(siteId) {
+      return { event_id: pushEvent("site.cron.updated", null, `WP cron updated for site ${siteId}`) }
+    },
+
+    async disableWpCron(siteId) {
+      return { event_id: pushEvent("site.cron.disabled", null, `WP cron disabled for site ${siteId}`) }
+    },
+
     async enableHttps(siteId) {
       const site = sites.find((s) => s.id === siteId)
       if (site) site.https = { enabled: true }

package/src/index.tsx

@@ -20,6 +20,7 @@ import { isDevMode } from "./dev/devMode.ts"
 import { SpinupWPClient } from "./api/client.ts"
 import { resolveSshAccess } from "./lib/cliSsh.ts"
 import { resolveIncidents } from "./lib/cliIncidents.ts"
+import { resolveSiblings } from "./lib/cliSiblings.ts"
 import { execSshCommand } from "./lib/sshExec.ts"
 import { runPullFiles, runPullDb } from "./lib/cliPull.ts"
 
@@ -72,6 +73,11 @@ Usage:
   spinuptui ssh-exec <domain> [--server <name>] -- <command>  Run a read-only
                        command over SSH (JSON); denies anything that looks
                        like a remote write
+  spinuptui siblings <domain> [--server <name>] [--probe]  List every site
+                       sharing a server with this one (JSON), flagging the
+                       server's vanity host and which sites Kuma watches.
+                       --probe also SSHes into each to report which ones this
+                       device's key can actually read.
   spinuptui incidents <domain> | --all [--hours N]  Print Uptime Kuma
                        down/up incidents for a site or the whole fleet (JSON)
   spinuptui pull files <domain> [path] [--url <local url>] [--server <name>]
@@ -163,6 +169,28 @@ if (command === "ssh-exec") {
   process.exit(result.ok ? 0 : 1)
 }
 
+if (command === "siblings") {
+  const parsed = parseFlags(args.slice(1))
+  const domain = parsed.positionals[0]
+  const server = parsed.flags.get("--server") ?? null
+  const probe = parsed.flags.has("--probe")
+  if (!domain || badFlagValue(parsed.flags, "--server")) {
+    console.error(
+      JSON.stringify({
+        ok: false,
+        reason: "usage",
+        message: "Usage: spinuptui siblings <domain> [--server <name>] [--probe]",
+      }),
+    )
+    process.exit(1)
+  }
+  const cfg = loadConfig()
+  const client = new SpinupWPClient(cfg)
+  const result = await resolveSiblings(domain, client, cfg, { server, probe })
+  console.log(JSON.stringify(result))
+  process.exit(result.ok ? 0 : 1)
+}
+
 if (command === "incidents") {
   const rest = args.slice(1)
   const hoursIdx = rest.indexOf("--hours")

package/src/lib/appUpdate.ts

@@ -129,15 +129,27 @@ export async function refreshUpdateInfo(current: string): Promise<UpdateInfo | n
 // ---- In-app updater (`u` in the Help/About overlay) ------------------------
 
 // How this copy of the app was installed, which decides the update path shown
-// in Help/About: a package-manager install (bun/npm global) lives under a
-// node_modules dir and updates via `bun update -g spinuptui`; anything else is
+// in Help/About: a Homebrew install lives in the Cellar (the formula unpacks the
+// package into its libexec) and updates via `brew upgrade`; a package-manager
+// install (bun/npm global) lives under a node_modules dir; anything else is
 // treated as a git checkout and updates via `git pull` (runSelfUpdate).
-export type InstallChannel = "git" | "package"
+export type InstallChannel = "git" | "package" | "brew"
 
 export function installChannel(): InstallChannel {
+  if (import.meta.dir.includes(`${sep}Cellar${sep}spinuptui${sep}`)) return "brew"
   return import.meta.dir.includes(`${sep}node_modules${sep}`) ? "package" : "git"
 }
 
+// Homebrew owns its copy — `bun add -g` beside it would install a second one
+// that the `spinuptui` on PATH never runs.
+export const BREW_UPDATE_CMD = "brew upgrade spinuptui"
+
+// The manual update command for this install (null for a git checkout).
+export function updateCommand(): string | null {
+  const ch = installChannel()
+  return ch === "brew" ? BREW_UPDATE_CMD : ch === "package" ? PACKAGE_UPDATE_CMD : null
+}
+
 // The one-liner Help shows for a package install (also used by runSelfUpdate's
 // "not a checkout" message so every path names the same command).
 //
@@ -187,7 +199,7 @@ export async function runSelfUpdate(cwd: string = checkoutRoot()): Promise<SelfU
   try {
     const isRepo = await git(cwd, ["rev-parse", "--is-inside-work-tree"])
     if (isRepo.code !== 0 || isRepo.stdout !== "true") {
-      return { ok: false, message: `This install isn't a git checkout — update with \`${PACKAGE_UPDATE_CMD}\`.`, needsInstall: false }
+      return { ok: false, message: `This install isn't a git checkout — update with \`${updateCommand() ?? PACKAGE_UPDATE_CMD}\`.`, needsInstall: false }
     }
     const status = await git(cwd, ["status", "--porcelain"])
     if (status.stdout.length > 0) {