spinuptui 0.28.0 → 1.1.0

package/src/lib/serverClone.ts

@@ -472,6 +472,13 @@ export interface BedrockPullSpec {
   destDbPassword: string
   excludeUploads: boolean
   publicFolder?: string // a signal, not a fact (CLAUDE.md) — re-verified below, independently, on both ends
+  // The source site's own git deploy script. Run on the dest after the DB import
+  // when the source is Radicle: its front-end (Vite build → public/build) and
+  // Acorn caches are gitignored, so composer install alone leaves the theme
+  // unbuilt, and the owner's deploy script is their own definition of "build this
+  // site". It runs last because Radicle deploy scripts call wp-cli (acorn
+  // optimize, cache purge, rewrite flush), which needs the imported database.
+  deployScript?: string
 }
 
 export async function runBedrockPull(
@@ -515,9 +522,12 @@ export async function runBedrockPull(
     //    source happened to detect — its structure comes from the git repo's own
     //    content, which can legitimately diverge from the source's on-disk state.
     onProgress("detect", "start")
-    const det = await run("detect", source, `${detectWpDirScript(root, spec.publicFolder)}; echo "WPCORE:$W"; echo "BEDROCKROOT:$B"`, 30_000)
+    const det = await run("detect", source, `${detectWpDirScript(root, spec.publicFolder)}; echo "WPCORE:$W"; echo "BEDROCKROOT:$B"; echo "RADICLEROOT:$RD"`, 30_000)
     const wpCore = (det.stdout.match(/^WPCORE:(.*)$/m)?.[1] ?? "").trim()
     const srcProjectRoot = (det.stdout.match(/^BEDROCKROOT:(.*)$/m)?.[1] ?? "").trim()
+    // Radicle requires roots/bedrock-autoloader, so it passes the Bedrock check
+    // above too — this is what tells the two apart.
+    const radicle = (det.stdout.match(/^RADICLEROOT:(.*)$/m)?.[1] ?? "").trim() !== ""
     if (!det.ok || !wpCore || !srcProjectRoot) {
       return fail("detect", `couldn't find a Bedrock project (composer.json + WordPress core) under ${root} on the source — is the public folder set correctly?`)
     }
@@ -577,20 +587,23 @@ export async function runBedrockPull(
     if (!composer.ok) return fail("build", (composer.stdout + composer.stderr).trim().split("\n").slice(-3).join(" ") || "composer install failed")
     onProgress("build", "ok")
 
-    // 3. files — pull {web}/app/uploads (unless excluded), `web` being whatever the
-    //    detected public folder is actually named — which can differ in nesting
-    //    depth between source and dest (the repo's own content vs. how deep the
-    //    source's on-disk state happens to be). Archiving/extracting relative to
-    //    EACH side's own web dir (not `root`) with a fixed member name sidesteps
-    //    that — the two ends never need to agree on a shared relative path. Best-
-    //    effort: a site with no uploads dir yields an empty stream we simply skip.
+    // 3. files — pull the uploads dir under the public folder: Bedrock's
+    //    app/uploads or Radicle's content/uploads, whichever the source has.
+    //    `web` is whatever the detected public folder is actually named, and it
+    //    can differ in nesting depth between source and dest (the repo's own
+    //    content vs. how deep the source's on-disk state happens to be).
+    //    Archiving/extracting relative to EACH side's own web dir (not `root`)
+    //    keeps the member name (app/uploads or content/uploads) the same on both
+    //    ends, so they never need to agree on a shared relative path. Best-effort:
+    //    a site with no uploads dir yields an empty stream we simply skip.
     onProgress("files", "start")
     if (!spec.excludeUploads) {
       const stopUpPoll = pollTransferSize(dest, `${tmp}_up.tgz`, (b) => onTransfer?.("files", b))
+      const srcUploads = `cd ${shq(webDir)} && for d in app/uploads content/uploads; do if [ -d "$d" ]; then tar --warning=no-file-changed -czf - "$d"; rc=$?; [ $rc -le 1 ] && exit 0; exit $rc; fi; done; true`
       const up = await run(
         "files",
         dest,
-        `set -e; timeout -k 5 3600 ${remote(`[ -d ${shq(`${webDir}/app/uploads`)} ] && tar -C ${shq(webDir)} --warning=no-file-changed -czf - app/uploads || true`)} > ${tmp}_up.tgz; if [ -s ${tmp}_up.tgz ]; then tar -C ${shq(destWebDir)} -xzf ${tmp}_up.tgz && chown -R ${shq(du)}:${shq(du)} ${shq(`${destWebDir}/app/uploads`)}; fi; rm -f ${tmp}_up.tgz`,
+        `set -e; timeout -k 5 3600 ${remote(srcUploads)} > ${tmp}_up.tgz; if [ -s ${tmp}_up.tgz ]; then tar -C ${shq(destWebDir)} -xzf ${tmp}_up.tgz && for d in app/uploads content/uploads; do [ -d ${shq(destWebDir)}/$d ] && chown -R ${shq(du)}:${shq(du)} ${shq(destWebDir)}/$d; done; true; fi; rm -f ${tmp}_up.tgz`,
         3_660_000, // outer must exceed the in-script `timeout 3600` so the inner reports a clean 124
       )
       stopUpPoll()
@@ -641,6 +654,23 @@ export async function runBedrockPull(
     if (!imp.ok) return fail("db", imp.stderr.trim() || "db pull/import failed")
     onProgress("db", "ok")
 
+    // 5b. deploy — Radicle only: run the source's own deploy script (see
+    //     BedrockPullSpec.deployScript). Staged as a file owned by the site user
+    //     (base64 in, so no quoting of the owner's script is ever needed) and run
+    //     from the project root, exactly where SpinupWP's own deploys run it.
+    if (radicle && spec.deployScript?.trim()) {
+      onProgress("build", "start", "deploy script")
+      const b64 = Buffer.from(spec.deployScript.replace(/\r\n/g, "\n")).toString("base64")
+      const deploy = await run(
+        "build",
+        dest,
+        `set -e; echo ${shq(b64)} | base64 -d > ${tmp}_deploy.sh; chown ${shq(du)}:${shq(du)} ${tmp}_deploy.sh; chmod 600 ${tmp}_deploy.sh; cd ${shq(destProjectRoot)}; rc=0; sudo -u ${shq(du)} -H bash -lc ${shq(`cd ${shq(destProjectRoot)} && bash ${tmp}_deploy.sh`)} 2>&1 || rc=$?; rm -f ${tmp}_deploy.sh; exit $rc`,
+        1_200_000,
+      )
+      if (!deploy.ok) return fail("build", `the site's deploy script failed: ${(deploy.stdout + deploy.stderr).trim().split("\n").slice(-3).join(" ") || `exit ${deploy.code}`}`)
+      onProgress("build", "ok")
+    }
+
     // 6. verify — wp-cli on the dest (HTTP --resolve is the caller's).
     onProgress("verify", "start")
     const ver = await run("verify", dest, `cd ${shq(destProjectRoot)}; sudo -u ${shq(du)} -H wp core is-installed`, 30_000)
@@ -652,7 +682,7 @@ export async function runBedrockPull(
     // 7. revoke — drop the pull key (by marker) on source, clean dest temp + staged dump.
     onProgress("revoke", "start")
     await run("revoke", source, `AK=${shq(home)}/.ssh/authorized_keys; [ -f "$AK" ] && sed -i ${shq(`/${MARKER}/d`)} "$AK" && chown ${shq(su)}:${shq(su)} "$AK"; rm -f ${shq(home)}/.clone_db.sql.gz`, 30_000).catch(() => {})
-    await run("revoke", dest, `rm -f ${KEY} ${KEY}.pub ${tmp}_auth.json ${tmp}_up.tgz ${tmp}_env ${tmp}.sql.gz ${tmp}.sql`, 30_000).catch(() => {})
+    await run("revoke", dest, `rm -f ${KEY} ${KEY}.pub ${tmp}_auth.json ${tmp}_up.tgz ${tmp}_env ${tmp}.sql.gz ${tmp}.sql ${tmp}_deploy.sh`, 30_000).catch(() => {})
     onProgress("revoke", "ok")
   }
 }
@@ -667,11 +697,20 @@ export async function runBedrockPull(
 // just BEFORE a destination site (and its git clone) gets created for nothing.
 // Silent no-op for anything that isn't a detectable Bedrock install; that's
 // covered by the pull chain's own detection, not this pre-check's job.
-export async function preflightBedrockSource(source: SudoCtx, spec: { domain: string; publicFolder?: string }): Promise<{ ok: true } | { ok: false; error: string }> {
+//
+// For a Radicle source whose deploy script builds the front-end with npm/yarn/
+// pnpm, it also checks the destination has Node: a stock SpinupWP server doesn't,
+// and finding out after the create would leave a half-built site behind. We stop
+// and say so rather than install it — the server's packages aren't ours to manage.
+export async function preflightBedrockSource(
+  source: SudoCtx,
+  spec: { domain: string; publicFolder?: string; deployScript?: string },
+  dest?: SudoCtx,
+): Promise<{ ok: true } | { ok: false; error: string }> {
   const root = `/sites/${spec.domain}/files`
   const expectedWebDir = webrootFor(root, spec.publicFolder)
   const expectedProjectRoot = expectedWebDir === root ? root : expectedWebDir.slice(0, expectedWebDir.lastIndexOf("/"))
-  const r = await exec(source, `${detectWpDirScript(root, spec.publicFolder)}; echo "BEDROCKROOT:$B"`, 30_000)
+  const r = await exec(source, `${detectWpDirScript(root, spec.publicFolder)}; echo "BEDROCKROOT:$B"; echo "RADICLEROOT:$RD"`, 30_000)
   const detected = (r.stdout.match(/^BEDROCKROOT:(.*)$/m)?.[1] ?? "").trim()
   if (!r.ok || !detected) return { ok: true }
   if (detected !== expectedProjectRoot) {
@@ -680,9 +719,131 @@ export async function preflightBedrockSource(source: SudoCtx, spec: { domain: st
       error: `this site's actual files (Bedrock project at ${detected}) don't match its configured Public Folder (implies ${expectedProjectRoot}) — align them and retry`,
     }
   }
+  const radicle = (r.stdout.match(/^RADICLEROOT:(.*)$/m)?.[1] ?? "").trim() !== ""
+  // Radicle's front-end build lives only in the deploy script (see
+  // BedrockPullSpec.deployScript) — without one the clone would come up with no
+  // built assets and answer 500. SpinupWP can drop a script set through its API
+  // (one sent on create is gone a minute or two later), so this is reachable.
+  if (radicle && !spec.deployScript?.trim()) {
+    return {
+      ok: false,
+      error: "this Radicle site has no deploy script in SpinupWP, so there's nothing to build its front-end with — add one (Site → Git) and retry",
+    }
+  }
+  if (radicle && dest && /\b(npm|npx|yarn|pnpm|node)\b/.test(spec.deployScript ?? "")) {
+    const n = await exec(dest, `command -v node >/dev/null 2>&1 && echo HASNODE || echo NONODE`, 30_000)
+    if (n.stdout.includes("NONODE")) {
+      return {
+        ok: false,
+        error: `this Radicle site's deploy script builds its front-end with Node, and ${dest.server.name} doesn't have Node installed — install Node on it and retry`,
+      }
+    }
+  }
   return { ok: true }
 }
 
+// ---- Crontab carry-over --------------------------------------------------------
+//
+// SpinupWP writes each site user's crontab itself: a PATH line and an
+// `#Ansible: <domain>` block running WP cron. A new site gets its own copy at
+// create, so those are never copied. Anything else in the source user's crontab
+// was added by the site owner (a feed import, an Acorn/Laravel command, a report
+// job), and without this step a clone silently stops running it. Lines are copied
+// verbatim, commented-out ones included (a disabled job stays disabled), which is
+// safe because a clone keeps the domain and site user, so every path matches.
+// Idempotent: a line the dest already has is skipped, so a retry adds nothing.
+
+export interface CrontabSyncResult {
+  ok: boolean
+  added: string[] // the lines appended to the dest crontab (empty = nothing to carry)
+  error?: string
+  // SpinupWP's server-level WP cron on each end, in minutes (see wpCronInterval):
+  // null = no managed WP cron job, undefined = that crontab wasn't read.
+  sourceWpCron?: number | null
+  destWpCron?: number | null
+}
+
+// The owner-added lines of a crontab: everything except SpinupWP's `#Ansible:`
+// marker + the job line after it, and blank lines. Environment lines (PATH=…,
+// MAILTO=…) are kept here; the caller drops the ones the dest already sets.
+// Exported for the test harness.
+export function ownerCrontabLines(crontab: string): string[] {
+  const out: string[] = []
+  const lines = crontab.split("\n").map((l) => l.replace(/\r$/, ""))
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]
+    if (/^#Ansible:/.test(line)) {
+      i++ // the managed job line that follows the marker
+      continue
+    }
+    if (line.trim() === "") continue
+    out.push(line)
+  }
+  return out
+}
+
+// The interval, in minutes, of SpinupWP's managed WP cron job — the line after the
+// `#Ansible:` marker. The API doesn't report it, so the crontab is the only place
+// to read it. SpinupWP staggers the start minute per site, so every-5 is written
+// "4,9,14,…,59 * * * *": the gap between the first two minutes is the interval, a
+// single minute is hourly, "*" every minute. null = no managed WP cron job (or one
+// in a shape we don't recognize). Exported for the test harness.
+export function wpCronInterval(crontab: string): number | null {
+  const lines = crontab.split("\n").map((l) => l.replace(/\r$/, ""))
+  const at = lines.findIndex((l) => /^#Ansible:/.test(l))
+  const job = at >= 0 ? lines[at + 1] : undefined
+  if (!job || !/wp cron event run/.test(job)) return null
+  const [minute, hour] = job.trim().split(/\s+/)
+  if (hour !== "*" || !minute) return null
+  if (minute === "*") return 1
+  const step = minute.match(/^\*\/(\d+)$/)
+  if (step) return Number(step[1])
+  const mins = minute.split(",").map(Number)
+  if (mins.some((m) => !Number.isInteger(m))) return null
+  return mins.length === 1 ? 60 : mins[1]! - mins[0]!
+}
+
+const envName = (line: string): string | null => line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=/)?.[1] ?? null
+
+export async function syncCrontab(
+  source: SudoCtx,
+  dest: SudoCtx,
+  spec: { domain: string; sourceSiteUser: string; destSiteUser: string },
+  onExec?: CloneExecLog,
+): Promise<CrontabSyncResult> {
+  const read = async (ctx: SudoCtx, user: string) => {
+    const t0 = Date.now()
+    const script = `crontab -l -u ${shq(user)} 2>/dev/null || true`
+    const r = await exec(ctx, script, 30_000)
+    onExec?.({ domain: spec.domain, stage: "config", host: ctx.server.name, ok: r.ok, code: r.code, ms: Date.now() - t0, script, stdout: r.stdout, stderr: r.stderr })
+    return r
+  }
+  const src = await read(source, spec.sourceSiteUser)
+  if (!src.ok) return { ok: false, added: [], error: src.stderr.trim() || "couldn't read the source crontab" }
+  const wanted = ownerCrontabLines(src.stdout)
+  const sourceWpCron = wpCronInterval(src.stdout)
+
+  // Read even when there's nothing to append: the caller compares WP cron intervals.
+  const dst = await read(dest, spec.destSiteUser)
+  if (!dst.ok) return { ok: false, added: [], error: dst.stderr.trim() || "couldn't read the destination crontab", sourceWpCron }
+  const destWpCron = wpCronInterval(dst.stdout)
+  if (wanted.length === 0) return { ok: true, added: [], sourceWpCron, destWpCron }
+  const have = new Set(dst.stdout.split("\n").map((l) => l.replace(/\r$/, "")))
+  const haveEnv = new Set([...have].map(envName).filter((n): n is string => n != null))
+  // An env line the dest already sets (SpinupWP's own PATH, typically) stays the dest's.
+  const added = wanted.filter((l) => !have.has(l) && !(envName(l) && haveEnv.has(envName(l)!)))
+  if (added.length === 0) return { ok: true, added: [], sourceWpCron, destWpCron }
+
+  const block = ["", `# Carried over from ${source.server.name} by the SpinupTUI clone`, ...added].join("\n") + "\n"
+  const b64 = Buffer.from(block).toString("base64")
+  const script = `set -e; { crontab -l -u ${shq(spec.destSiteUser)} 2>/dev/null || true; echo ${shq(b64)} | base64 -d; } | crontab -u ${shq(spec.destSiteUser)} -`
+  const t0 = Date.now()
+  const w = await exec(dest, script, 30_000)
+  onExec?.({ domain: spec.domain, stage: "config", host: dest.server.name, ok: w.ok, code: w.code, ms: Date.now() - t0, script, stdout: w.stdout, stderr: w.stderr })
+  if (!w.ok) return { ok: false, added: [], error: w.stderr.trim() || "couldn't write the destination crontab", sourceWpCron, destWpCron }
+  return { ok: true, added, sourceWpCron, destWpCron }
+}
+
 // ---- Files-only pull chain (non-WP sites: redirect shells, static/PHP sites) --
 //
 // The same hardened transport as the Standard-WP files stage (per-site key,

package/src/lib/spinupweb.ts

@@ -31,3 +31,10 @@ export function serverProvidersSettingsUrl(accountSlug: string | null): string {
 export function siteSftpUrl(id: number, accountSlug: string | null): string {
   return accountSlug ? `${WEB_BASE}/${accountSlug}/sites/${id}#sftp` : WEB_BASE
 }
+
+// A site's Git settings (repo, branch, deploy script). The clone wizard links here
+// when a dest site's deploy script needs re-entering: SpinupWP drops a script
+// set through the API (see the create payload in store.tsx).
+export function siteGitUrl(id: number, accountSlug: string | null): string {
+  return accountSlug ? `${WEB_BASE}/${accountSlug}/sites/${id}#git` : WEB_BASE
+}

package/src/lib/stack.ts

@@ -80,10 +80,13 @@ export function cloneStackFor(site: Site, probeKind?: ProbeKind | null): "wp" |
     if (probeKind === "whmcs" || probeKind === "laravel" || probeKind === "static") return "files"
     return "bedrock"
   }
-  // A "radicle" probe never falls into "wp" here since effectiveStack maps it
-  // to "Radicle", not "Standard WP" — deliberate: the Standard-WP pull chain
-  // assumes a flat webroot and would corrupt a Radicle clone. Real Radicle
-  // clone-wizard support is a separate, not-yet-built phase (issue #38).
+  // A git-deployed Radicle site took the branch above: the Bedrock pull handles
+  // it (it detects Radicle itself, pulls content/uploads, and runs the site's
+  // deploy script to build the front-end). A "radicle" probe with no git repo
+  // never falls into "wp" here since effectiveStack maps it to "Radicle", not
+  // "Standard WP" — deliberate: the Standard-WP pull chain assumes a flat webroot
+  // and would corrupt a Radicle clone, and without the repo there's nothing to
+  // rebuild it from.
   return effectiveStack(site, probeKind) === "Standard WP" ? "wp" : "files"
 }
 

package/src/lib/wpCli.ts

@@ -28,3 +28,55 @@ export function wpCliResolveScript(phpVersion?: string | null): string {
   const phpBin = phpVersion ? `php${phpVersion}` : "php"
   return [`WP=$(command -v wp 2>/dev/null || echo /usr/local/bin/wp)`, `PHP=$(command -v ${phpBin} 2>/dev/null || command -v php)`].join("\n")
 }
+
+// Pull wp-cli's `--format=json` array out of a section of remote stdout that may
+// also carry noise: under the CLI SAPI a plugin's PHP notices/deprecations print
+// to STDOUT (2>/dev/null doesn't catch them), and with no newline of their own
+// they can sit on the same line as the JSON — before it, or after it when they
+// fire at shutdown (seen live: an Elementor Pro deprecation glued to the end of
+// `plugin list` output). So: from every `[`, bracket-match to its closing `]`
+// (skipping brackets inside JSON strings), and keep the longest slice that parses
+// as an array of objects — which is what every wp-cli list is, and what notice
+// text like "on line [3]" or "[array (" never is.
+// Returns null when nothing parses, so callers can tell "wp-cli printed no list"
+// (an error worth surfacing) from a genuinely empty `[]`.
+export function extractJsonArray(lines: string[] | undefined): unknown[] | null {
+  const text = (lines ?? []).join("\n")
+  let best: unknown[] | null = null
+  let bestLen = -1
+  for (let start = text.indexOf("["); start !== -1; start = text.indexOf("[", start + 1)) {
+    const end = matchingBracket(text, start)
+    if (end === -1 || end - start <= bestLen) continue
+    try {
+      const parsed = JSON.parse(text.slice(start, end + 1))
+      if (Array.isArray(parsed) && parsed.every((o) => o !== null && typeof o === "object")) {
+        best = parsed
+        bestLen = end - start
+      }
+    } catch {
+      /* not JSON from here — try the next `[` */
+    }
+  }
+  return best
+}
+
+// Index of the `]` closing the `[` at `start`, or -1. Tracks JSON string state so
+// a bracket inside a value (a plugin name, a URL) doesn't end the match early.
+function matchingBracket(text: string, start: number): number {
+  let depth = 0
+  let inString = false
+  for (let i = start; i < text.length; i++) {
+    const ch = text[i]
+    if (inString) {
+      if (ch === "\\") i++
+      else if (ch === '"') inString = false
+    } else if (ch === '"') inString = true
+    else if (ch === "[" || ch === "{") depth++
+    else if (ch === "]" || ch === "}") {
+      depth--
+      if (depth === 0) return ch === "]" ? i : -1
+      if (depth < 0) return -1
+    }
+  }
+  return -1
+}

package/src/lib/wpCore.ts

@@ -17,7 +17,7 @@
 import type { Server, Site } from "../api/types.ts"
 import { SSH_OPTS, sshPort } from "./dbBackup.ts"
 import { detectWpDirScript } from "./serverClone.ts"
-import { wpCliResolveScript } from "./wpCli.ts"
+import { extractJsonArray, wpCliResolveScript } from "./wpCli.ts"
 import { spawn } from "./spawn.ts"
 
 export interface WpCoreOffer {
@@ -177,24 +177,13 @@ export async function checkWpCore(server: Server, site: Site, sshUser: string |
   const current = lastVersionLine(s.VERSION)
   if (!current) return { ok: false, target: p.target, error: "wp-cli couldn't read the WordPress version on this site." }
 
-  // Belt and braces with --skip-plugins: scan back for the line that parses as
-  // the JSON array, ignoring any other noise (a mu-plugin's notices still load).
+  // Belt and braces with --skip-plugins: a mu-plugin's notices still load, so
+  // pull the JSON array out of any surrounding noise.
   // No match = "Success: WordPress is at the latest version." (plain text).
-  let offers: WpCoreOffer[] = []
-  for (const line of [...(s.UPDATES ?? [])].reverse()) {
-    if (!line.trim().startsWith("[")) continue
-    let parsed: unknown
-    try {
-      parsed = JSON.parse(line.trim())
-    } catch {
-      continue
-    }
-    if (!Array.isArray(parsed)) continue
-    offers = parsed
-      .filter((o) => o && typeof o.version === "string")
-      .map((o) => ({ version: o.version as string, updateType: typeof o.update_type === "string" ? o.update_type : "" }))
-    break
-  }
+  const parsed = extractJsonArray(s.UPDATES) ?? []
+  const offers: WpCoreOffer[] = parsed
+    .filter((o): o is { version: string; update_type?: unknown } => !!o && typeof (o as { version?: unknown }).version === "string")
+    .map((o) => ({ version: o.version, updateType: typeof o.update_type === "string" ? o.update_type : "" }))
 
   const comp = (s.COMPOSER ?? []).join("\n").trim()
   const locked = comp.match(/^locked (.+)$/m)

package/src/lib/wpInventory.ts

@@ -11,7 +11,7 @@
 import type { Server, Site } from "../api/types.ts"
 import { SSH_OPTS, sshPort } from "./dbBackup.ts"
 import { detectWpDirScript } from "./serverClone.ts"
-import { wpCliResolveScript } from "./wpCli.ts"
+import { extractJsonArray, wpCliResolveScript } from "./wpCli.ts"
 import { spawn } from "./spawn.ts"
 
 // One plugin or theme, mirroring `wp {plugin,theme} list` columns.
@@ -68,17 +68,11 @@ function splitSections(out: string): Record<string, string[]> {
   return sections
 }
 
-// wp --format=json emits a single-line JSON array; tolerate blank/garbage by
-// returning [] rather than throwing (a fresh site can legitimately have 0 themes).
-function parseJsonArray(lines: string[] | undefined): RawItem[] {
-  const text = (lines ?? []).join("").trim()
-  if (!text) return []
-  try {
-    const parsed = JSON.parse(text)
-    return Array.isArray(parsed) ? parsed : []
-  } catch {
-    return []
-  }
+// First non-blank line of a section — the likeliest culprit when wp-cli's JSON is
+// missing (a PHP fatal or notice printed in its place).
+function firstNoise(lines: string[] | undefined): string {
+  const line = (lines ?? []).map((l) => l.trim()).find(Boolean) ?? ""
+  return line.length > 160 ? `${line.slice(0, 159)}…` : line
 }
 
 export async function fetchWpInventory(
@@ -147,8 +141,18 @@ export async function fetchWpInventory(
     return { ok: false, target, error: `No WordPress core found under ${root} — is this a WordPress site?` }
   }
   const wpDir = (s.WPDIR?.[0] || root).trim()
-  const plugins = normalize(parseJsonArray(s.PLUGINS))
-  const themes = normalize(parseJsonArray(s.THEMES))
+  // A plugin's PHP notices can print to stdout alongside the JSON (see
+  // extractJsonArray). No JSON at all means wp-cli failed; say so instead of
+  // showing an empty list that reads as "no plugins installed".
+  const rawPlugins = extractJsonArray(s.PLUGINS)
+  const rawThemes = extractJsonArray(s.THEMES)
+  if (!rawPlugins || !rawThemes) {
+    const which = !rawPlugins ? "plugin" : "theme"
+    const noise = firstNoise(!rawPlugins ? s.PLUGINS : s.THEMES)
+    return { ok: false, target, error: `wp-cli didn't return the ${which} list${noise ? `: ${noise}` : "."}` }
+  }
+  const plugins = normalize(rawPlugins as RawItem[])
+  const themes = normalize(rawThemes as RawItem[])
   return { ok: true, target, wpDir, inventory: { plugins, themes } }
 }
 

package/src/ui/Header.tsx

@@ -6,6 +6,8 @@ import { timeAgo, truncate } from "../lib/format.ts"
 import { Spinner } from "./components.tsx"
 import { APP_NAME, APP_VERSION } from "../version.ts"
 import { isDevMode } from "../dev/devMode.ts"
+import { RL_LOW_WATER, onRateLimitChange, rateLimitSnapshot, type RateLimitSnapshot } from "../api/client.ts"
+import { useEffect, useState } from "react"
 
 const TABS: { route: Route; key: string; label: string }[] = [
   { route: "dashboard", key: "1", label: "Dashboard" },
@@ -26,6 +28,29 @@ const SUBTITLES: Record<Route, string> = {
   events: "Recent deploys, reboots, and operations across your account",
 }
 
+// SpinupWP allows 60 API requests a minute. Show what's left of this minute so
+// the wall is visible before it's hit: dim while there's plenty, amber past
+// three-quarters spent, red once the client has started pacing requests (the
+// point where the app slows down on purpose). Hidden until a response has
+// reported the limit (and in Dev Mode, which never calls the API).
+function ApiHeadroom() {
+  const [rl, setRl] = useState<RateLimitSnapshot | null>(rateLimitSnapshot)
+  useEffect(() => {
+    const refresh = () => setRl(rateLimitSnapshot())
+    const off = onRateLimitChange(refresh)
+    // The window rolls over with no request to announce it; re-read so a spent
+    // budget doesn't sit on screen after it has refilled.
+    const tick = setInterval(refresh, 5_000)
+    return () => {
+      off()
+      clearInterval(tick)
+    }
+  }, [])
+  if (!rl) return null
+  const color = rl.remaining <= RL_LOW_WATER ? theme.bad : rl.remaining <= rl.limit / 4 ? theme.warn : theme.textFaint
+  return <text content={`API ${rl.remaining}/${rl.limit}  `} fg={color} style={{ flexShrink: 0 }} wrapMode="none" />
+}
+
 export function Header() {
   const { route, servers, sites, loading, lastUpdated, updateInfo, newServerJob, vanityJob, cloneJob, cloneServer, kumaStatus, profileLabel } = useStore()
   // Name the domain(s) when there are few enough to fit the header row; fall
@@ -114,6 +139,7 @@ export function Header() {
         )}
         {loading && <Spinner interval={100} />}
         <text content={`  ${servers.length} servers · ${sites.length} sites  `} fg={theme.textDim} style={{ flexShrink: 0 }} />
+        <ApiHeadroom />
         <text content={lastUpdated ? `updated ${timeAgo(lastUpdated.toISOString())}` : "loading…"} fg={theme.textFaint} style={{ flexShrink: 0 }} />
       </box>
       <box style={{ flexDirection: "row", height: 1, paddingLeft: 1, paddingRight: 1, alignItems: "center" }}>

package/src/ui/Help.tsx

@@ -8,7 +8,7 @@ import { theme } from "../lib/theme.ts"
 import { APP_NAME, APP_VERSION, REPO_URL } from "../version.ts"
 import { Sparkle, Spinner } from "./components.tsx"
 import { useStore } from "./store.tsx"
-import { runSelfUpdate, installChannel, PACKAGE_UPDATE_CMD, type UpdateInfo, type SelfUpdateResult } from "../lib/appUpdate.ts"
+import { runSelfUpdate, installChannel, updateCommand, type UpdateInfo, type SelfUpdateResult } from "../lib/appUpdate.ts"
 
 type Section = { title: string; keys: [string, string][] }
 
@@ -191,10 +191,10 @@ function AboutColumn({
       {selfUpdate !== "idle" && selfUpdate !== "running" ? (
         <text content={selfUpdate.message} fg={selfUpdate.ok ? theme.good : theme.bad} />
       ) : null}
-      {installChannel() === "package" ? (
+      {installChannel() !== "git" ? (
         <>
           {line("Manual:")}
-          {line(PACKAGE_UPDATE_CMD, theme.text)}
+          {line(updateCommand() ?? "", theme.text)}
         </>
       ) : (
         <>