spinuptui 1.0.0 → 1.1.0

package/CHANGELOG.md

@@ -11,6 +11,22 @@ version; such changes are called out here.
 
 ## [Unreleased]
 
+## [1.1.0] - 2026-09-30
+
+### Added
+- **Clones match the source's SpinupWP settings.** Creating a site through SpinupWP's API only switches page caching on or off, so a clone used to come out with SpinupWP's defaults for everything else. The wizard now matches the source's page cache duration and exclusions, the security toggles (PHP in uploads, `xmlrpc.php`, multisite subdirectory rewrites), its path redirects, and the WP cron interval (read from the site's crontab, since the API doesn't report it). Only what differs is changed, so a retry changes nothing, and nothing the clone already has is removed. The verify pane (`v`) lists what it matched, and anything that didn't take, with `w` to open the new site in SpinupWP.
+- **Clones point out basic auth.** SpinupWP never reveals a site's basic-auth password, so a password-protected source can't be copied as-is. The verify pane says so and `w` opens the new site to set it.
+- **`spinuptui siblings <domain>` — who else is on this server.** Prints every site sharing a server with the one you name, as JSON, along with the server's own IP, SSH port, size and Ubuntu version. Each site says whether it's the server's vanity host, whether it's WordPress, what PHP it runs, whether page cache is on, and whether SpinupTUI set Uptime Kuma monitors up for it. This is for the case where a symptom belongs to the whole box rather than to one site: a vanity host's `?healthz` trips on whatever load the busiest co-tenant is making, and site isolation means the vanity site's own user can't see any of it — so the first question is always "who else lives here". `--probe` also SSHes into each site user and reports which ones this device's key is accepted for, which is the same question as "whose logs can I read". A site that comes back `permission_denied` is one key grant (`K` in the Browser view) away from being readable.
+
+### Changed
+- **Clones put the deploy script back themselves.** SpinupWP clears a deploy script set when a site is created, and until now you had to paste it back into the new site's Git settings. SpinupWP's API can now update a site's Git settings, so the clone wizard sets the source's script again once the site is done, and fixes push-to-deploy the same way if it came out different. The verify pane (`v`) says when it did. The `g` copy-and-open fallback only appears if the script still doesn't stick. A clone that finishes within about two minutes of creating the site waits out the rest first, since an earlier write would be cleared along with the original.
+
+### Fixed
+- **`spinuptui ssh` reports a hung connection as `connection_failed`.** When the connectivity probe ran past its 15-second limit, it came back as an unexplained `ssh_error` with the kill signal's exit code. It now says the connection didn't finish in time.
+
+### Notes
+- **Backups don't carry over to a clone yet.** SpinupWP stores backups per domain, so a clone backing up before DNS moves would write into the production site's folder. Switch backups on for the new site after cutover; having the wizard do it at the cutover step is planned.
+
 ## [1.0.0] - 2026-09-24
 
 ### Added
@@ -1453,7 +1469,8 @@ Initial tagged release.
 ### Notes
 - Read-only release: works with a SpinupWP **Read Only** API token.
 
-[Unreleased]: https://github.com/mwender/spinupwp-tui/compare/v1.0.0...HEAD
+[Unreleased]: https://github.com/mwender/spinupwp-tui/compare/v1.1.0...HEAD
+[1.1.0]: https://github.com/mwender/spinupwp-tui/compare/v1.0.0...v1.1.0
 [1.0.0]: https://github.com/mwender/spinupwp-tui/compare/v0.28.0...v1.0.0
 [0.28.0]: https://github.com/mwender/spinupwp-tui/compare/v0.27.0...v0.28.0
 [0.27.0]: https://github.com/mwender/spinupwp-tui/compare/v0.26.1...v0.27.0

package/README.md

@@ -82,12 +82,14 @@
   if it's read-only — anything that looks like a write/restart/destructive
   action is denied rather than run, so any agent using it inherits that
   guarantee without building its own guard; `spinuptui incidents <domain>` /
-  `--all` surfaces Uptime Kuma's down/up history as JSON; `spinuptui pull files
-  <domain> [path]` and `spinuptui pull db <domain> --yes` set up a local working
-  copy from production without opening the TUI at all — the same engines the
-  guided flow drives. Built so another agent/script can go from just a domain to
-  "what's wrong and how do I get in", or to a working local copy, with no manual
-  lookup. → [CLI subcommands](#cli-subcommands)
+  `--all` surfaces Uptime Kuma's down/up history as JSON; `spinuptui siblings
+  <domain>` lists every site sharing that site's server, so a page on a server's
+  vanity host leads straight to the co-tenants that could be causing it;
+  `spinuptui pull files <domain> [path]` and `spinuptui pull db <domain> --yes`
+  set up a local working copy from production without opening the TUI at all —
+  the same engines the guided flow drives. Built so another agent/script can go
+  from just a domain to "what's wrong and how do I get in", or to a working local
+  copy, with no manual lookup. → [CLI subcommands](#cli-subcommands)
 - **Completion toasts** — a non-focus-stealing toast when a background write
   (PHP upgrade, reboot, DNS resolve, …) finishes.
 - **Release notes** — an in-app "what's new" after every update, sourced
@@ -199,6 +201,24 @@ spinuptui ssh-exec <domain> [--server <name>] -- <command>  Resolve the
                      attempt (allowed, denied, or unresolved) is appended to
                      <config dir>/logs/ssh-exec-audit.jsonl. Quote <command>
                      as one shell argument if it needs pipes or redirects.
+spinuptui siblings <domain> [--server <name>] [--probe]  Print every site
+                     sharing a server with this one, as JSON, with the
+                     server's own details (IP, SSH port, size, Ubuntu
+                     version). Each entry carries its site user and SSH
+                     target, whether it's WordPress, its PHP version, whether
+                     page cache is on, whether it's the server's vanity host
+                     (isVanity), whether SpinupTUI registered Uptime Kuma
+                     monitors for it (monitored), and whether it's the domain
+                     you asked about (isQuery). The vanity host sorts first,
+                     then the queried site, then the rest alphabetically.
+                     --probe additionally SSHes into each site user and
+                     reports ssh:"ok" | "permission_denied" |
+                     "connection_failed" | "ssh_error", which answers "whose
+                     logs can I actually read on this box" in one call.
+                     Written for whole-server symptoms: a vanity host's
+                     ?healthz trips on the load of whichever co-tenant is
+                     busy, and site isolation means the vanity user can't see
+                     it.
 spinuptui incidents <domain> | --all [--hours N]  Print Uptime Kuma down/up
                      incidents as JSON, scoped to sites SpinupTUI manages
                      monitoring for (config.json's kumaMonitors) — --all

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spinuptui",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "SpinupTUI — a terminal dashboard for browsing, monitoring, and managing your SpinupWP servers and sites.",
   "type": "module",
   "bin": {

package/src/api/client.ts

@@ -15,6 +15,10 @@ import type {
   CreateSitePayload,
   AdditionalDomain,
   AddDomainPayload,
+  UpdateSiteGitPayload,
+  PageCachePayload,
+  NginxSettings,
+  PathRedirect,
 } from "./types.ts"
 
 // The restartable services SpinupWP exposes (POST /servers/{id}/services/{svc}/restart).
@@ -84,6 +88,16 @@ export interface SpinupWPClientLike {
   listSites(serverId?: number): Promise<Site[]>
   getSite(id: number): Promise<Site>
   createSite(payload: CreateSitePayload): Promise<{ event_id: number }>
+  updateSiteGit(siteId: number, payload: UpdateSiteGitPayload): Promise<{ event_id: number | null } | undefined>
+  enablePageCache(siteId: number, payload?: PageCachePayload): Promise<{ event_id: number }>
+  updatePageCache(siteId: number, payload: PageCachePayload): Promise<{ event_id: number }>
+  disablePageCache(siteId: number): Promise<{ event_id: number }>
+  updateNginx(siteId: number, payload: NginxSettings): Promise<{ event_ids: number[] }>
+  listPathRedirects(siteId: number): Promise<PathRedirect[]>
+  addPathRedirect(siteId: number, payload: Omit<PathRedirect, "created_at">): Promise<{ event_id: number }>
+  enableWpCron(siteId: number, interval: number): Promise<{ event_id: number }>
+  updateWpCron(siteId: number, interval: number): Promise<{ event_id: number }>
+  disableWpCron(siteId: number): Promise<{ event_id: number }>
   enableHttps(siteId: number): Promise<{ event_id: number }>
   disableHttps(siteId: number): Promise<{ event_id: number } | undefined>
   purgePageCache(siteId: number): Promise<{ event_id: number }>
@@ -351,6 +365,57 @@ export class SpinupWPClient implements SpinupWPClientLike {
     return this.mutate<{ event_id: number }>(`/sites/${siteId}/domains`, "POST", payload)
   }
 
+  // Update a site's Git settings (at least one field). Changing only the deploy
+  // script or push-to-deploy needs no server work, so SpinupWP answers with a null
+  // event_id — the new values are in place when this resolves. Needs a Read/Write
+  // token.
+  updateSiteGit(siteId: number, payload: UpdateSiteGitPayload): Promise<{ event_id: number | null } | undefined> {
+    return this.mutate<{ event_id: number | null } | undefined>(`/sites/${siteId}/git`, "PUT", payload)
+  }
+
+  // Page cache on an existing site (the API added enable/disable/settings in
+  // 2026-09; before that only purge existed). Async → event_id. Lists in the
+  // payload are newline-separated. Needs a Read/Write token.
+  enablePageCache(siteId: number, payload: PageCachePayload = {}): Promise<{ event_id: number }> {
+    return this.mutate<{ event_id: number }>(`/sites/${siteId}/page-cache`, "POST", payload)
+  }
+  updatePageCache(siteId: number, payload: PageCachePayload): Promise<{ event_id: number }> {
+    return this.mutate<{ event_id: number }>(`/sites/${siteId}/page-cache`, "PUT", payload)
+  }
+  disablePageCache(siteId: number): Promise<{ event_id: number }> {
+    return this.mutate<{ event_id: number }>(`/sites/${siteId}/page-cache`, "DELETE")
+  }
+
+  // Nginx toggles (PHP in uploads, xmlrpc.php, multisite subdirectory rewrites;
+  // public_folder too, unused here). One event PER CHANGED SETTING comes back as
+  // `event_ids` — empty when nothing changed. Needs a Read/Write token.
+  updateNginx(siteId: number, payload: NginxSettings): Promise<{ event_ids: number[] }> {
+    return this.mutate<{ event_ids: number[] }>(`/sites/${siteId}/nginx`, "PUT", payload)
+  }
+
+  // Path redirects (nginx-level, per site). Adding a from+to pair the site already
+  // has is rejected. Async → event_id. Needs a Read/Write token.
+  async listPathRedirects(siteId: number): Promise<PathRedirect[]> {
+    return this.listAll<PathRedirect>(`/sites/${siteId}/path-redirects`)
+  }
+  addPathRedirect(siteId: number, payload: Omit<PathRedirect, "created_at">): Promise<{ event_id: number }> {
+    return this.mutate<{ event_id: number }>(`/sites/${siteId}/path-redirects`, "POST", payload)
+  }
+
+  // Server-level WP cron (a system cron job replacing WordPress's page-load cron).
+  // interval is minutes, one of WP_CRON_INTERVALS. The Site object doesn't report
+  // it — read the site user's crontab instead (wpCronInterval in serverClone.ts).
+  // Async → event_id. Needs a Read/Write token.
+  enableWpCron(siteId: number, interval: number): Promise<{ event_id: number }> {
+    return this.mutate<{ event_id: number }>(`/sites/${siteId}/cron`, "POST", { interval })
+  }
+  updateWpCron(siteId: number, interval: number): Promise<{ event_id: number }> {
+    return this.mutate<{ event_id: number }>(`/sites/${siteId}/cron`, "PUT", { interval })
+  }
+  disableWpCron(siteId: number): Promise<{ event_id: number }> {
+    return this.mutate<{ event_id: number }>(`/sites/${siteId}/cron`, "DELETE")
+  }
+
   // Enable HTTPS on a site. `type: "webroot"` requests a Let's Encrypt cert (the
   // domain must already resolve to the server for LE to issue, so this runs after
   // the DNS A record has propagated). Async → returns an event_id to poll. Needs a

package/src/api/types.ts

@@ -66,6 +66,24 @@ export interface AdditionalDomain {
   created_at: string
 }
 
+// Page cache as the Site object reports it. The exclusion lists come back as ONE
+// pipe-joined regex ("/wp-admin/|/wp-json/|…") but are WRITTEN newline-separated —
+// see splitCacheList in lib/cloneSettings.ts. Unset lists read back null.
+export interface PageCacheSettings {
+  enabled: boolean
+  duration?: number | null
+  duration_unit?: string | null
+  path_exclusions?: string | null
+  cookie_exclusions?: string | null
+  ignored_query_params?: string | null
+}
+
+export interface NginxSettings {
+  uploads_directory_protected?: boolean
+  xmlrpc_protected?: boolean
+  subdirectory_rewrite_in_place?: boolean
+}
+
 export interface Site {
   id: number
   server_id: number
@@ -75,9 +93,9 @@ export interface Site {
   php_version: string | null
   public_folder: string | null
   is_wordpress: boolean
-  page_cache?: { enabled: boolean }
+  page_cache?: PageCacheSettings
   https?: { enabled: boolean }
-  nginx?: Record<string, unknown>
+  nginx?: NginxSettings
   database?: {
     id: number | null
     user_id: number | null
@@ -193,6 +211,37 @@ export interface CreateSitePayload {
   }
 }
 
+// PUT /sites/{id}/git — at least one field. Unlike POST /sites, deploy_script sits
+// alongside the git settings here, and the write key is push_to_deploy.
+export interface UpdateSiteGitPayload {
+  repo?: string
+  branch?: string
+  deploy_script?: string
+  push_to_deploy?: boolean
+}
+
+// POST/PUT /sites/{id}/page-cache. Lists are newline-separated on write. PUT keeps
+// any omitted field.
+export interface PageCachePayload {
+  duration?: number
+  duration_unit?: string
+  path_exclusions?: string
+  cookie_exclusions?: string
+  ignored_query_params?: string
+}
+
+// A site's path redirect (GET /sites/{id}/path-redirects). type: "permanent" = 301,
+// "redirect" = 302. Delete is keyed by from + to — there's no id.
+export interface PathRedirect {
+  from: string
+  to: string
+  type: "permanent" | "redirect"
+  created_at?: string
+}
+
+// The server-level WP cron intervals SpinupWP accepts, in minutes.
+export const WP_CRON_INTERVALS = [1, 2, 5, 10, 15, 30, 60] as const
+
 export interface Event {
   id: number
   initiated_by: string | null

package/src/dev/mockClient.ts

@@ -132,6 +132,62 @@ export function createMockClient(): SpinupWPClientLike {
       return { event_id }
     },
 
+    async updateSiteGit(siteId, payload) {
+      const site = sites.find((s) => s.id === siteId)
+      if (site?.git) {
+        if (payload.repo != null) site.git.repo = payload.repo
+        if (payload.branch != null) site.git.branch = payload.branch
+        if (payload.deploy_script != null) site.git.deploy_script = payload.deploy_script
+        if (payload.push_to_deploy != null) site.git.push_enabled = payload.push_to_deploy
+      }
+      return { event_id: null }
+    },
+
+    async enablePageCache(siteId, payload = {}) {
+      const site = sites.find((s) => s.id === siteId)
+      if (site) site.page_cache = { ...site.page_cache, ...payload, enabled: true }
+      return { event_id: pushEvent("site.page_cache.enabled", site?.server_id ?? null, `Page cache enabled for ${site?.domain ?? siteId}`) }
+    },
+
+    async updatePageCache(siteId, payload) {
+      const site = sites.find((s) => s.id === siteId)
+      if (site) site.page_cache = { enabled: site.page_cache?.enabled ?? false, ...site.page_cache, ...payload }
+      return { event_id: pushEvent("site.page_cache.updated", site?.server_id ?? null, `Page cache updated for ${site?.domain ?? siteId}`) }
+    },
+
+    async disablePageCache(siteId) {
+      const site = sites.find((s) => s.id === siteId)
+      if (site) site.page_cache = { enabled: false }
+      return { event_id: pushEvent("site.page_cache.disabled", site?.server_id ?? null, `Page cache disabled for ${site?.domain ?? siteId}`) }
+    },
+
+    async updateNginx(siteId, payload) {
+      const site = sites.find((s) => s.id === siteId)
+      if (site) site.nginx = { ...site.nginx, ...payload }
+      return { event_ids: [pushEvent("site.nginx.updated", site?.server_id ?? null, `Nginx settings updated for ${site?.domain ?? siteId}`)] }
+    },
+
+    async listPathRedirects() {
+      return []
+    },
+
+    async addPathRedirect(siteId, payload) {
+      const site = sites.find((s) => s.id === siteId)
+      return { event_id: pushEvent("site.redirect.added", site?.server_id ?? null, `Redirect ${payload.from} added to ${site?.domain ?? siteId}`) }
+    },
+
+    async enableWpCron(siteId) {
+      return { event_id: pushEvent("site.cron.enabled", null, `WP cron enabled for site ${siteId}`) }
+    },
+
+    async updateWpCron(siteId) {
+      return { event_id: pushEvent("site.cron.updated", null, `WP cron updated for site ${siteId}`) }
+    },
+
+    async disableWpCron(siteId) {
+      return { event_id: pushEvent("site.cron.disabled", null, `WP cron disabled for site ${siteId}`) }
+    },
+
     async enableHttps(siteId) {
       const site = sites.find((s) => s.id === siteId)
       if (site) site.https = { enabled: true }

package/src/index.tsx

@@ -20,6 +20,7 @@ import { isDevMode } from "./dev/devMode.ts"
 import { SpinupWPClient } from "./api/client.ts"
 import { resolveSshAccess } from "./lib/cliSsh.ts"
 import { resolveIncidents } from "./lib/cliIncidents.ts"
+import { resolveSiblings } from "./lib/cliSiblings.ts"
 import { execSshCommand } from "./lib/sshExec.ts"
 import { runPullFiles, runPullDb } from "./lib/cliPull.ts"
 
@@ -72,6 +73,11 @@ Usage:
   spinuptui ssh-exec <domain> [--server <name>] -- <command>  Run a read-only
                        command over SSH (JSON); denies anything that looks
                        like a remote write
+  spinuptui siblings <domain> [--server <name>] [--probe]  List every site
+                       sharing a server with this one (JSON), flagging the
+                       server's vanity host and which sites Kuma watches.
+                       --probe also SSHes into each to report which ones this
+                       device's key can actually read.
   spinuptui incidents <domain> | --all [--hours N]  Print Uptime Kuma
                        down/up incidents for a site or the whole fleet (JSON)
   spinuptui pull files <domain> [path] [--url <local url>] [--server <name>]
@@ -163,6 +169,28 @@ if (command === "ssh-exec") {
   process.exit(result.ok ? 0 : 1)
 }
 
+if (command === "siblings") {
+  const parsed = parseFlags(args.slice(1))
+  const domain = parsed.positionals[0]
+  const server = parsed.flags.get("--server") ?? null
+  const probe = parsed.flags.has("--probe")
+  if (!domain || badFlagValue(parsed.flags, "--server")) {
+    console.error(
+      JSON.stringify({
+        ok: false,
+        reason: "usage",
+        message: "Usage: spinuptui siblings <domain> [--server <name>] [--probe]",
+      }),
+    )
+    process.exit(1)
+  }
+  const cfg = loadConfig()
+  const client = new SpinupWPClient(cfg)
+  const result = await resolveSiblings(domain, client, cfg, { server, probe })
+  console.log(JSON.stringify(result))
+  process.exit(result.ok ? 0 : 1)
+}
+
 if (command === "incidents") {
   const rest = args.slice(1)
   const hoursIdx = rest.indexOf("--hours")

package/src/lib/cliIncidents.ts

@@ -35,6 +35,13 @@ const KIND_FIELDS: Array<[keyof KumaMonitorRef, IncidentKind]> = [
   ["bypassId", "bypass"],
 ]
 
+// Does this ref name at least one monitor `resolveIncidents` would query? A ref
+// can outlive its monitors (removing one deletes its id, not the entry), so an
+// entry's mere presence isn't the answer.
+export function hasIncidentMonitors(ref: KumaMonitorRef | undefined): boolean {
+  return !!ref && KIND_FIELDS.some(([field]) => typeof ref[field] === "number")
+}
+
 interface Target {
   domain: string
   kind: IncidentKind

package/src/lib/cliSiblings.ts

@@ -0,0 +1,181 @@
+// `spinuptui siblings <domain>` — every site sharing a server with this one,
+// for external tooling (e.g. an incident-diagnostics agent handed one domain).
+//
+// The motivating case: a server's vanity host pages on `?healthz`, but the
+// vanity site is an empty placeholder — the load is always a co-tenant, and
+// site isolation means the vanity user can't read the neighbour's logs. The
+// agent needs to know who else lives on the box, and which of them it can
+// actually SSH into, before it can find the request-level cause. Answering that
+// from the API takes two calls; discovering it by hand took weeks.
+
+import type { AppConfig } from "../config.ts"
+import type { Server, Site } from "../api/types.ts"
+import type { SpinupWPClientLike } from "../api/client.ts"
+import { ApiError } from "../api/client.ts"
+import {
+  resolveSiteByDomain,
+  probeSshTarget,
+  type SshAccessReason,
+  type SshAccessCandidate,
+  type SshProbeStatus,
+} from "./cliSsh.ts"
+import { hasIncidentMonitors } from "./cliIncidents.ts"
+import { resolveSiteSshTarget } from "./probe.ts"
+import { isVanityPair } from "./vanitySite.ts"
+
+// Why a co-tenant's logs may be out of reach. `ok` means this device's key is
+// accepted for that site user; `permission_denied` is the one worth acting on
+// (grant the key with K in the Browser view) and the usual reason a neighbour's
+// access log can't be read.
+export type SiblingSshStatus = SshProbeStatus
+
+export interface SiblingSite {
+  domain: string
+  siteUser: string | null
+  sshTarget: string
+  isWordPress: boolean
+  phpVersion: string | null
+  pageCache: boolean | null
+  // The site living at the server's own hostname — a placeholder whose monitors
+  // report on the whole box, so its pages are rarely about itself.
+  isVanity: boolean
+  // Has Uptime Kuma monitors registered through SpinupTUI, so `spinuptui
+  // incidents <domain>` will return something for it.
+  monitored: boolean
+  // The domain that was asked about, so a caller can tell itself apart from the
+  // neighbours without re-matching on additional domains.
+  isQuery: boolean
+  // Only present with --probe.
+  ssh?: SiblingSshStatus
+  sshMessage?: string
+}
+
+export interface SiblingsServer {
+  id: number
+  name: string
+  ip: string | null
+  // Needed alongside each site's sshTarget; null means the default, 22.
+  sshPort: number | null
+  provider: string | null
+  size: string | null
+  ubuntuVersion: string | null
+}
+
+export type SiblingsResult =
+  | {
+      ok: true
+      domain: string
+      primaryDomain: string
+      server: SiblingsServer
+      siteCount: number
+      sites: SiblingSite[]
+    }
+  | {
+      ok: false
+      domain: string
+      reason: SshAccessReason
+      message: string
+      remedy?: string
+      candidates?: SshAccessCandidate[]
+    }
+
+// Every probe hits the same sshd, so they're capped rather than all fired at
+// once: OpenSSH's default MaxStartups (10:30:100) starts dropping connections
+// that are still authenticating past 10, which would turn a big server's
+// result into random connection failures. A small burst of refused logins is
+// also gentler on any fail2ban-style guard watching that sshd.
+const PROBE_CONCURRENCY = 4
+
+async function mapLimit<T, R>(items: T[], limit: number, fn: (item: T) => Promise<R>): Promise<R[]> {
+  const out = new Array<R>(items.length)
+  let next = 0
+  const worker = async () => {
+    while (next < items.length) {
+      const i = next++
+      out[i] = await fn(items[i]!)
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker))
+  return out
+}
+
+function describe(site: Site, server: Server, cfg: AppConfig, queryId: number): SiblingSite {
+  return {
+    domain: site.domain,
+    siteUser: site.site_user,
+    sshTarget: resolveSiteSshTarget(site, server, cfg.sshUser),
+    isWordPress: site.is_wordpress,
+    phpVersion: site.php_version,
+    pageCache: site.page_cache ? site.page_cache.enabled : null,
+    isVanity: isVanityPair(site.domain, server.name),
+    monitored: hasIncidentMonitors(cfg.kumaMonitors[site.domain]),
+    isQuery: site.id === queryId,
+  }
+}
+
+export async function resolveSiblings(
+  domain: string,
+  client: SpinupWPClientLike,
+  cfg: AppConfig,
+  opts?: { server?: string | null; probe?: boolean },
+): Promise<SiblingsResult> {
+  const resolved = await resolveSiteByDomain(domain, client, cfg, { server: opts?.server ?? null })
+  if (!resolved.ok) return resolved.result
+
+  const { site, server } = resolved
+
+  let siteList: Site[]
+  try {
+    siteList = await client.listSites(server.id)
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 401) {
+      return {
+        ok: false,
+        domain,
+        reason: "token_rejected",
+        message: "Saved API token was rejected (401) — it may be expired or revoked.",
+        remedy: "Run `spinuptui login` to save a fresh token.",
+      }
+    }
+    const message = err instanceof ApiError ? err.message : `Unexpected error: ${(err as Error).message}`
+    return { ok: false, domain, reason: "api_error", message }
+  }
+
+  // The vanity host first, then the queried site, then alphabetically: a reader
+  // scanning the list sees what the box calls itself before its tenants.
+  const sorted = [...siteList].sort((a, b) => {
+    const rank = (s: Site) =>
+      isVanityPair(s.domain, server.name) ? 0 : s.id === site.id ? 1 : 2
+    return rank(a) - rank(b) || a.domain.localeCompare(b.domain)
+  })
+
+  const sites = sorted.map((s) => describe(s, server, cfg, site.id))
+  const port = server.ssh_port && server.ssh_port !== 22 ? server.ssh_port : null
+
+  // resolveSiteByDomain has already refused a server with no IP, so every
+  // sshTarget here is a real user@ip.
+  if (opts?.probe) {
+    const probes = await mapLimit(sites, PROBE_CONCURRENCY, (s) => probeSshTarget(s.sshTarget, port))
+    probes.forEach((p, i) => {
+      sites[i]!.ssh = p.status
+      if (p.message) sites[i]!.sshMessage = p.message
+    })
+  }
+
+  return {
+    ok: true,
+    domain,
+    primaryDomain: site.domain,
+    server: {
+      id: server.id,
+      name: server.name,
+      ip: server.ip_address,
+      sshPort: port,
+      provider: server.provider_name,
+      size: server.size,
+      ubuntuVersion: server.ubuntu_version,
+    },
+    siteCount: sites.length,
+    sites,
+  }
+}

package/src/lib/cliSsh.ts

@@ -169,15 +169,17 @@ export async function resolveSshTargetInfo(
   }
 }
 
-export async function resolveSshAccess(
-  domain: string,
-  client: SpinupWPClientLike,
-  cfg: AppConfig,
-  opts?: { server?: string | null },
-): Promise<SshAccessResult> {
-  const resolution = await resolveSshTargetInfo(domain, client, cfg, opts)
-  if (!resolution.ok) return resolution.result
-  const { primaryDomain, sshTarget: target, port, server: serverName } = resolution.info
+// One BatchMode `ssh … true` against an already-resolved target, classified.
+// Shared by `ssh` (one domain) and `siblings --probe` (every site on a server)
+// so both read a refused key, an unreachable box and anything else the same way.
+export type SshProbeStatus = "ok" | "permission_denied" | "connection_failed" | "ssh_error"
+
+const PROBE_TIMEOUT_MS = 15_000
+
+export async function probeSshTarget(
+  target: string,
+  port: number | null,
+): Promise<{ status: SshProbeStatus; message?: string }> {
   const portOpt = port ? ["-p", String(port)] : []
 
   let proc: ReturnType<typeof Bun.spawn>
@@ -188,46 +190,58 @@ export async function resolveSshAccess(
       stdin: "ignore",
     })
   } catch (err) {
-    return { ok: false, domain, reason: "ssh_error", message: `Failed to launch ssh: ${(err as Error).message}` }
+    return { status: "ssh_error", message: `Failed to launch ssh: ${(err as Error).message}` }
   }
 
+  let timedOut = false
   const timeout = setTimeout(() => {
+    timedOut = true
     try {
       proc.kill()
     } catch {
       /* already gone */
     }
-  }, 15000)
+  }, PROBE_TIMEOUT_MS)
 
   const exitCode = await proc.exited
   clearTimeout(timeout)
-  const stderr = await new Response(proc.stderr as ReadableStream<Uint8Array>).text()
+  if (exitCode === 0) return { status: "ok" }
 
-  if (exitCode === 0) {
-    return { ok: true, domain, primaryDomain, sshTarget: target, port, server: serverName }
+  // Killed by our own timer: ssh never got to say why, so say it here rather
+  // than reporting the kill signal's exit code as an unexplained ssh error.
+  if (timedOut) {
+    return { status: "connection_failed", message: `ssh did not finish within ${PROBE_TIMEOUT_MS / 1000}s.` }
   }
 
-  if (/permission denied/i.test(stderr)) {
-    return {
-      ok: false,
-      domain,
-      reason: "permission_denied",
-      message: stderr.trim().split("\n").slice(-2).join(" ") || "Permission denied.",
-      remedy: GRANT_KEY_REMEDY,
-    }
-  }
+  const stderr = await new Response(proc.stderr as ReadableStream<Uint8Array>).text()
+  const tail = stderr.trim().split("\n").slice(-2).join(" ")
+
+  if (/permission denied/i.test(stderr)) return { status: "permission_denied", message: tail || "Permission denied." }
   if (/(connection timed out|operation timed out|connection refused|could not resolve)/i.test(stderr)) {
-    return {
-      ok: false,
-      domain,
-      reason: "connection_failed",
-      message: stderr.trim().split("\n").slice(-2).join(" ") || `ssh exited with code ${exitCode}`,
-    }
+    return { status: "connection_failed", message: tail || `ssh exited with code ${exitCode}` }
+  }
+  return { status: "ssh_error", message: tail || `ssh exited with code ${exitCode}` }
+}
+
+export async function resolveSshAccess(
+  domain: string,
+  client: SpinupWPClientLike,
+  cfg: AppConfig,
+  opts?: { server?: string | null },
+): Promise<SshAccessResult> {
+  const resolution = await resolveSshTargetInfo(domain, client, cfg, opts)
+  if (!resolution.ok) return resolution.result
+  const { primaryDomain, sshTarget: target, port, server: serverName } = resolution.info
+
+  const probe = await probeSshTarget(target, port)
+  if (probe.status === "ok") {
+    return { ok: true, domain, primaryDomain, sshTarget: target, port, server: serverName }
   }
   return {
     ok: false,
     domain,
-    reason: "ssh_error",
-    message: stderr.trim().split("\n").slice(-2).join(" ") || `ssh exited with code ${exitCode}`,
+    reason: probe.status,
+    message: probe.message ?? "ssh failed.",
+    ...(probe.status === "permission_denied" ? { remedy: GRANT_KEY_REMEDY } : {}),
   }
 }

package/src/lib/cloneSettings.ts

@@ -0,0 +1,180 @@
+// Carry a site's SpinupWP settings onto its clone: page cache (on/off, duration,
+// exclusions), the nginx security toggles, path redirects, and the server-level WP
+// cron interval. The create payload can only say "page cache on", so without this
+// a clone comes out with SpinupWP's defaults for everything else. Each setting is
+// compared first and only a difference is written, so a retry re-runs it safely.
+//
+// Not carried here: basic auth (the password can't be read from the API — the
+// result flags it instead) and backups (stored per DOMAIN in the bucket, so a clone
+// backing up before DNS cutover would write over production's files; they're
+// applied at cutover).
+
+import type { SpinupWPClientLike } from "../api/client.ts"
+import { WP_CRON_INTERVALS, type NginxSettings, type PageCachePayload, type PageCacheSettings, type PathRedirect, type Site } from "../api/types.ts"
+import { pollEvent } from "./cloneDomains.ts"
+
+export interface SettingsCarryResult {
+  carried: string[] // short labels for what was written ("page cache", "3 redirects", …)
+  failed: { what: string; error: string }[]
+  basicAuthMissing: boolean // the source is password-protected, the clone isn't
+}
+
+type Log = (entry: Record<string, unknown>) => void
+
+// Page-cache exclusion lists read back as one pipe-joined regex but are written one
+// entry per line. Split on top-level pipes only, so an alternation inside a group
+// or class — "(a|b)", "[|]" — stays one entry. Exported for the test harness.
+export function splitCacheList(joined: string): string[] {
+  const out: string[] = []
+  let depth = 0
+  let cur = ""
+  for (let i = 0; i < joined.length; i++) {
+    const ch = joined[i]!
+    if (ch === "\\") {
+      cur += ch + (joined[i + 1] ?? "")
+      i++
+      continue
+    }
+    if (ch === "(" || ch === "[" || ch === "{") depth++
+    else if ((ch === ")" || ch === "]" || ch === "}") && depth > 0) depth--
+    if (ch === "|" && depth === 0) {
+      out.push(cur)
+      cur = ""
+      continue
+    }
+    cur += ch
+  }
+  out.push(cur)
+  return out.filter((e) => e !== "")
+}
+
+const CACHE_LISTS = ["path_exclusions", "cookie_exclusions", "ignored_query_params"] as const
+
+// What to send so the dest's page cache matches the source's: only the fields that
+// differ, and never a list the source leaves unset (null reads as "SpinupWP's
+// default", which the dest already has).
+function pageCacheDiff(src: PageCacheSettings, dst: PageCacheSettings | undefined): PageCachePayload {
+  const out: PageCachePayload = {}
+  if (src.duration != null && src.duration_unit != null && (src.duration !== dst?.duration || src.duration_unit !== dst?.duration_unit)) {
+    out.duration = src.duration
+    out.duration_unit = src.duration_unit
+  }
+  for (const k of CACHE_LISTS) {
+    const v = src[k]
+    if (v != null && v !== dst?.[k]) out[k] = splitCacheList(v).join("\n")
+  }
+  return out
+}
+
+// Wait for each event and turn the outcome into an error string (undefined = done).
+async function settle(client: SpinupWPClientLike, eventIds: number[]): Promise<string | undefined> {
+  for (const id of eventIds) {
+    const r = await pollEvent(client, id)
+    if (r.outcome === "failed") return `event ${id} failed on SpinupWP`
+    if (r.outcome === "timeout") return `gave up waiting for event ${id}${r.lastStatus ? ` (still "${r.lastStatus}")` : ""} — retry the site to re-check`
+  }
+  return undefined
+}
+
+const redirectKey = (r: Pick<PathRedirect, "from" | "to">) => `${r.from}\u0000${r.to}`
+
+export async function carrySiteSettings(
+  client: SpinupWPClientLike,
+  sourceSiteId: number,
+  destSiteId: number,
+  wpCron: { source?: number | null; dest?: number | null },
+  log?: Log,
+): Promise<SettingsCarryResult> {
+  const result: SettingsCarryResult = { carried: [], failed: [], basicAuthMissing: false }
+  let src: Site
+  let dst: Site
+  try {
+    ;[src, dst] = await Promise.all([client.getSite(sourceSiteId), client.getSite(destSiteId)])
+  } catch (err) {
+    result.failed.push({ what: "settings", error: `couldn't read the sites: ${(err as Error).message}` })
+    return result
+  }
+
+  // Each step records its own outcome; one failing never stops the rest.
+  const step = async (what: string, run: () => Promise<number[] | null>) => {
+    try {
+      const events = await run()
+      if (events == null) return // nothing to change
+      const error = await settle(client, events)
+      if (error) {
+        result.failed.push({ what, error })
+        log?.({ event: "settings-carry", what, ok: false, error })
+      } else {
+        result.carried.push(what)
+        log?.({ event: "settings-carry", what, ok: true })
+      }
+    } catch (err) {
+      const error = (err as Error).message
+      result.failed.push({ what, error })
+      log?.({ event: "settings-carry", what, ok: false, error })
+    }
+  }
+
+  // Page cache
+  const sc = src.page_cache
+  if (sc) {
+    await step("page cache", async () => {
+      if (!sc.enabled) return dst.page_cache?.enabled ? [(await client.disablePageCache(destSiteId)).event_id] : null
+      const diff = pageCacheDiff(sc, dst.page_cache)
+      if (!dst.page_cache?.enabled) return [(await client.enablePageCache(destSiteId, diff)).event_id]
+      return Object.keys(diff).length > 0 ? [(await client.updatePageCache(destSiteId, diff)).event_id] : null
+    })
+  }
+
+  // Nginx security toggles (public_folder is set at create and handled by the pull)
+  const sn = src.nginx ?? {}
+  const nginx: NginxSettings = {}
+  for (const k of ["uploads_directory_protected", "xmlrpc_protected", "subdirectory_rewrite_in_place"] as const) {
+    if (sn[k] != null && sn[k] !== dst.nginx?.[k]) nginx[k] = sn[k]
+  }
+  if (Object.keys(nginx).length > 0) {
+    await step("security settings", async () => (await client.updateNginx(destSiteId, nginx)).event_ids)
+  }
+
+  // Path redirects: add the source's that the dest lacks. The dest's own extras
+  // are left alone (a clone shouldn't delete anything).
+  let srcRedirects: PathRedirect[] = []
+  try {
+    srcRedirects = await client.listPathRedirects(sourceSiteId)
+  } catch (err) {
+    result.failed.push({ what: "redirects", error: `couldn't list the source's redirects: ${(err as Error).message}` })
+  }
+  if (srcRedirects.length > 0) {
+    let have = new Set<string>()
+    try {
+      have = new Set((await client.listPathRedirects(destSiteId)).map(redirectKey))
+    } catch {
+      /* add them all; a duplicate is rejected per redirect and reported */
+    }
+    const missing = srcRedirects.filter((r) => !have.has(redirectKey(r)))
+    if (missing.length > 0) {
+      await step(`${missing.length} redirect${missing.length === 1 ? "" : "s"}`, async () => {
+        const events: number[] = []
+        for (const r of missing) events.push((await client.addPathRedirect(destSiteId, { from: r.from, to: r.to, type: r.type })).event_id)
+        return events
+      })
+    }
+  }
+
+  // WP cron: both ends' intervals come from their crontabs (undefined = unread,
+  // null = no managed job recognized). Only an interval is ever carried: a source
+  // with no recognizable job might have WP cron off, or a line shape we don't
+  // parse, and switching the clone's off on a guess is worse than leaving it.
+  const want = wpCron.source
+  const have = wpCron.dest
+  if (want != null && have !== undefined && want !== have) {
+    if (!(WP_CRON_INTERVALS as readonly number[]).includes(want)) {
+      result.failed.push({ what: "WP cron", error: `the source runs WP cron every ${want} min, which SpinupWP's API doesn't offer` })
+    } else {
+      await step(`WP cron every ${want} min`, async () => [(have == null ? await client.enableWpCron(destSiteId, want) : await client.updateWpCron(destSiteId, want)).event_id])
+    }
+  }
+
+  result.basicAuthMissing = !!src.basic_auth?.enabled && !dst.basic_auth?.enabled
+  return result
+}

package/src/lib/serverClone.ts

@@ -757,6 +757,10 @@ export interface CrontabSyncResult {
   ok: boolean
   added: string[] // the lines appended to the dest crontab (empty = nothing to carry)
   error?: string
+  // SpinupWP's server-level WP cron on each end, in minutes (see wpCronInterval):
+  // null = no managed WP cron job, undefined = that crontab wasn't read.
+  sourceWpCron?: number | null
+  destWpCron?: number | null
 }
 
 // The owner-added lines of a crontab: everything except SpinupWP's `#Ansible:`
@@ -778,6 +782,27 @@ export function ownerCrontabLines(crontab: string): string[] {
   return out
 }
 
+// The interval, in minutes, of SpinupWP's managed WP cron job — the line after the
+// `#Ansible:` marker. The API doesn't report it, so the crontab is the only place
+// to read it. SpinupWP staggers the start minute per site, so every-5 is written
+// "4,9,14,…,59 * * * *": the gap between the first two minutes is the interval, a
+// single minute is hourly, "*" every minute. null = no managed WP cron job (or one
+// in a shape we don't recognize). Exported for the test harness.
+export function wpCronInterval(crontab: string): number | null {
+  const lines = crontab.split("\n").map((l) => l.replace(/\r$/, ""))
+  const at = lines.findIndex((l) => /^#Ansible:/.test(l))
+  const job = at >= 0 ? lines[at + 1] : undefined
+  if (!job || !/wp cron event run/.test(job)) return null
+  const [minute, hour] = job.trim().split(/\s+/)
+  if (hour !== "*" || !minute) return null
+  if (minute === "*") return 1
+  const step = minute.match(/^\*\/(\d+)$/)
+  if (step) return Number(step[1])
+  const mins = minute.split(",").map(Number)
+  if (mins.some((m) => !Number.isInteger(m))) return null
+  return mins.length === 1 ? 60 : mins[1]! - mins[0]!
+}
+
 const envName = (line: string): string | null => line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=/)?.[1] ?? null
 
 export async function syncCrontab(
@@ -796,15 +821,18 @@ export async function syncCrontab(
   const src = await read(source, spec.sourceSiteUser)
   if (!src.ok) return { ok: false, added: [], error: src.stderr.trim() || "couldn't read the source crontab" }
   const wanted = ownerCrontabLines(src.stdout)
-  if (wanted.length === 0) return { ok: true, added: [] }
+  const sourceWpCron = wpCronInterval(src.stdout)
 
+  // Read even when there's nothing to append: the caller compares WP cron intervals.
   const dst = await read(dest, spec.destSiteUser)
-  if (!dst.ok) return { ok: false, added: [], error: dst.stderr.trim() || "couldn't read the destination crontab" }
+  if (!dst.ok) return { ok: false, added: [], error: dst.stderr.trim() || "couldn't read the destination crontab", sourceWpCron }
+  const destWpCron = wpCronInterval(dst.stdout)
+  if (wanted.length === 0) return { ok: true, added: [], sourceWpCron, destWpCron }
   const have = new Set(dst.stdout.split("\n").map((l) => l.replace(/\r$/, "")))
   const haveEnv = new Set([...have].map(envName).filter((n): n is string => n != null))
   // An env line the dest already sets (SpinupWP's own PATH, typically) stays the dest's.
   const added = wanted.filter((l) => !have.has(l) && !(envName(l) && haveEnv.has(envName(l)!)))
-  if (added.length === 0) return { ok: true, added: [] }
+  if (added.length === 0) return { ok: true, added: [], sourceWpCron, destWpCron }
 
   const block = ["", `# Carried over from ${source.server.name} by the SpinupTUI clone`, ...added].join("\n") + "\n"
   const b64 = Buffer.from(block).toString("base64")
@@ -812,8 +840,8 @@ export async function syncCrontab(
   const t0 = Date.now()
   const w = await exec(dest, script, 30_000)
   onExec?.({ domain: spec.domain, stage: "config", host: dest.server.name, ok: w.ok, code: w.code, ms: Date.now() - t0, script, stdout: w.stdout, stderr: w.stderr })
-  if (!w.ok) return { ok: false, added: [], error: w.stderr.trim() || "couldn't write the destination crontab" }
-  return { ok: true, added }
+  if (!w.ok) return { ok: false, added: [], error: w.stderr.trim() || "couldn't write the destination crontab", sourceWpCron, destWpCron }
+  return { ok: true, added, sourceWpCron, destWpCron }
 }
 
 // ---- Files-only pull chain (non-WP sites: redirect shells, static/PHP sites) --

package/src/ui/store.tsx

@@ -10,7 +10,7 @@ import { toast } from "./toast.ts"
 import { SpinupWPClient, ApiError, type ServerService, type SpinupWPClientLike } from "../api/client.ts"
 import { isDevMode } from "../dev/devMode.ts"
 import { createMockClient } from "../dev/mockClient.ts"
-import type { Server, Site, Event, ProviderMetadata, CreateServerPayload, CreateSitePayload, AdditionalDomain } from "../api/types.ts"
+import type { Server, Site, Event, ProviderMetadata, CreateServerPayload, CreateSitePayload, AdditionalDomain, UpdateSiteGitPayload } from "../api/types.ts"
 import { loadConfig, saveConfig, type StoredConfig, type ServerProviderRef, type KumaMonitorRef, type UptimeKumaConn } from "../config.ts"
 import { saveJob, removeJob } from "../lib/jobs.ts"
 import { APP_VERSION } from "../version.ts"
@@ -47,6 +47,7 @@ import type { StoredProviders } from "../config.ts"
 import { fetchRebootInfo, grantSiteSshKey, revokeSiteSshKey, verifySudo, ensureSpinupKey, listPersonalKeys, keyBody, type RebootInfo } from "../lib/ssh.ts"
 import { estimateSourceSiteSizes, runStandardWpPull, runBedrockPull, runFilesOnlyPull, verifyClone, verifyFilesClone, preflightBedrockSource, syncCrontab, type SudoCtx, type CloneStage, type CloneExecRecord, type VerifyResult as CloneVerifyResult } from "../lib/serverClone.ts"
 import { CloneLogger } from "../lib/cloneLog.ts"
+import { carrySiteSettings, type SettingsCarryResult } from "../lib/cloneSettings.ts"
 import { syncAdditionalDomains } from "../lib/cloneDomains.ts"
 import { parseRepo, deployKeysSettingsUrl, ghAvailable, ghDeployKeyPresent, ghAddDeployKey, generateDeployKeypair, type RepoHost } from "../lib/gitDeployKey.ts"
 import { keychainAvailable, setSudoPassword, getSudoPassword, deleteSudoPassword } from "../lib/keychain.ts"
@@ -298,10 +299,14 @@ export interface CloneSiteState {
   cutover?: CloneCutoverState // slice 6: DNS repoint state for this site's domain
   cronAdded?: string[] // owner crontab lines carried to the dest (empty = none to carry)
   cronError?: string // crontab carry-over failed (the clone itself still succeeded)
-  // The source had a deploy script but the dest reads back none — SpinupWP drops a
-  // script set on create, and there's no API to set it after. The verify pane
-  // offers it for copy with a link to the dest's Git settings.
+  settingsCarried?: string[] // SpinupWP settings written to match the source (see carrySiteSettings)
+  settingsFailed?: { what: string; error: string }[] // …and the ones that didn't take
+  basicAuthMissing?: boolean // the source is password-protected; the clone can't be (password unreadable)
+  // The source had a deploy script but the dest still reads back none after we set
+  // it again (SpinupWP drops a script set on create). The verify pane offers it for
+  // copy with a link to the dest's Git settings.
   deployScriptLost?: boolean
+  deployScriptRestored?: boolean // SpinupWP dropped the script and we set it again
   pushMismatch?: boolean // the dest's push-to-deploy reads back different from the source's
 }
 // Slice 6: per-site DNS cutover. Each A record among the site's domains (primary +
@@ -397,6 +402,52 @@ const INTERRUPTED_LOCAL_SETUP_MSG = "Interrupted by a restart — the local copy
 const SERVER_DONE = new Set(["deployed", "completed", "provisioned", "finished", "success"])
 const SERVER_FAIL = new Set(["failed", "errored", "error"])
 
+// SpinupWP clears a deploy script sent with POST /sites a minute or two after the
+// create (seen at ~90s, 2026-09-24). A PUT made before that would be wiped along
+// with it, so the restore below waits until this long after the create.
+const DEPLOY_SCRIPT_WIPE_MS = 150_000
+
+// Put a cloned git site's deploy script and push-to-deploy back to the source's
+// values if the dest reads back different, then re-read so only what's still
+// wrong is reported. Best-effort: a failed write or read never fails the clone.
+async function restoreDestGit(
+  client: SpinupWPClientLike,
+  destSiteId: number,
+  site: Pick<CloneSiteState, "domain" | "deployScript" | "pushEnabled">,
+  createdAt: number | undefined,
+  logger: CloneLogger | null | undefined,
+  onWait: () => void,
+): Promise<{ deployScriptLost: boolean; deployScriptRestored: boolean; pushMismatch: boolean } | undefined> {
+  const wantScript = site.deployScript?.trim()
+  const diff = (dest: Site) => ({
+    script: !!wantScript && !dest.git?.deploy_script?.trim(),
+    push: site.pushEnabled != null && dest.git?.push_enabled !== site.pushEnabled,
+  })
+  try {
+    const wait = createdAt != null ? DEPLOY_SCRIPT_WIPE_MS - (Date.now() - createdAt) : 0
+    if (wait > 0) {
+      onWait()
+      await new Promise((r) => setTimeout(r, wait))
+    }
+    const before = diff(await client.getSite(destSiteId))
+    if (!before.script && !before.push) return { deployScriptLost: false, deployScriptRestored: false, pushMismatch: false }
+    const payload: UpdateSiteGitPayload = {
+      ...(before.script ? { deploy_script: wantScript } : {}),
+      ...(before.push ? { push_to_deploy: site.pushEnabled } : {}),
+    }
+    try {
+      await client.updateSiteGit(destSiteId, payload)
+      logger?.log({ event: "git-restore", domain: site.domain, fields: Object.keys(payload) })
+    } catch (err) {
+      logger?.log({ event: "git-restore", domain: site.domain, fields: Object.keys(payload), error: (err as Error).message })
+    }
+    const after = diff(await client.getSite(destSiteId))
+    return { deployScriptLost: after.script, deployScriptRestored: before.script && !after.script, pushMismatch: after.push }
+  } catch {
+    return undefined // unknown — say nothing rather than guess
+  }
+}
+
 export function isNewServerInFlight(j: NewServerJob | null | undefined): boolean {
   return j != null && j.status !== "done" && j.status !== "failed"
 }
@@ -3831,6 +3882,7 @@ export function StoreProvider({ children }: { children: ReactNode }) {
         // DB password can't be recovered to re-stamp wp-config, so a leftover from a
         // prior run must be removed first (create will surface a clear conflict).
         let destSiteId = site.destSiteId
+        let createdAt: number | undefined // when THIS run created the dest (see the git restore below)
         if (destSiteId == null) {
           let ev
           try {
@@ -3846,10 +3898,10 @@ export function StoreProvider({ children }: { children: ReactNode }) {
                     database: { name: dbName, username: dbName, password: dbPw, table_prefix: site.tablePrefix || "wp_" },
                     // deploy_script is TOP-LEVEL; we send the source's own (canonical
                     // only as the fallback). CAVEAT, verified 2026-09-24: SpinupWP stores
-                    // it, echoes it back, then clears it a minute or two later — so the
-                    // dest's script has to be re-entered in the dashboard. Nothing here
-                    // depends on it: the pull runs composer (and a Radicle source's own
-                    // script) over SSH.
+                    // it, echoes it back, then clears it a minute or two later — so it's
+                    // set again with PUT /git once the site is done (see below). Nothing
+                    // here depends on it: the pull runs composer (and a Radicle source's
+                    // own script) over SSH.
                     deploy_script: site.deployScript?.trim() || "composer install -o --no-dev",
                     git: {
                       repo: site.gitRepo!,
@@ -3881,10 +3933,10 @@ export function StoreProvider({ children }: { children: ReactNode }) {
                       database: { name: dbName, username: dbName, password: dbPw, table_prefix: site.tablePrefix || "wp_" },
                     }
             // Match the source's page cache — a deploy script that purges it
-            // (`wp spinupwp cache purge-site`) fails on a site where it's off, and
-            // it can't be switched on through the API after the create.
+            // (`wp spinupwp cache purge-site`) fails on a site where it's off.
             if (site.pageCache != null) payload.page_cache = { enabled: site.pageCache }
             ev = await client.createSite(payload)
+            createdAt = Date.now()
             logger?.log({ event: "create-requested", domain: site.domain, eventId: ev?.event_id })
           } catch (err) {
             return fail("create", err instanceof ApiError ? err.message : (err as Error).message)
@@ -3962,25 +4014,24 @@ export function StoreProvider({ children }: { children: ReactNode }) {
         // reported on the site, never fails a clone whose files and DB are in place.
         set((s) => ({ ...s, detail: "crontab" }))
         const cron = await syncCrontab(source, dest, { domain: site.domain, sourceSiteUser: site.siteUser, destSiteUser: site.siteUser }, onExec)
-        logger?.log({ event: "crontab", domain: site.domain, ok: cron.ok, added: cron.added, error: cron.error })
-        // Did the dest keep the deploy script we sent on create? (It usually
-        // doesn't — see the create payload.) Re-read rather than assume, so this
-        // goes quiet on its own if SpinupWP fixes it.
-        // Same re-read for push-to-deploy (which does stick, as of 2026-09-24 —
-        // checked anyway, since the create is the only chance to set it).
-        let deployScriptLost = false
-        let pushMismatch = false
-        if (site.gitRepo && destSiteId != null) {
-          try {
-            const destSite = await client.getSite(destSiteId)
-            deployScriptLost = !!site.deployScript?.trim() && !destSite.git?.deploy_script?.trim()
-            pushMismatch = site.pushEnabled != null && destSite.git?.push_enabled !== site.pushEnabled
-          } catch {
-            /* unknown — say nothing rather than guess */
-          }
+        logger?.log({ event: "crontab", domain: site.domain, ok: cron.ok, added: cron.added, error: cron.error, sourceWpCron: cron.sourceWpCron, destWpCron: cron.destWpCron })
+        // SpinupWP settings the create can't carry: page cache details, the nginx
+        // security toggles, redirects, WP cron interval. Best-effort like the crontab.
+        let settings: SettingsCarryResult | undefined
+        if (destSiteId != null) {
+          set((s) => ({ ...s, step: "config", detail: "settings" }))
+          settings = await carrySiteSettings(client, site.sourceSiteId, destSiteId, { source: cron.sourceWpCron, dest: cron.destWpCron }, logger ? (e) => logger.log({ domain: site.domain, ...e }) : undefined)
         }
-        logger?.log({ event: "site-done", domain: site.domain, sourceWebrootRel, destWebrootRel, deployScriptLost, pushMismatch })
-        set((s) => ({ ...s, step: "done", detail: undefined, error: undefined, failedStep: undefined, sourceWebrootRel, destWebrootRel, cronAdded: cron.added, cronError: cron.ok ? undefined : cron.error, deployScriptLost, pushMismatch }))
+        // Did the dest keep the deploy script we sent on create? It usually doesn't
+        // (see the create payload), so re-read and, if it's gone, set it again with
+        // PUT /git — push-to-deploy too, should it read back different. Only what's
+        // still wrong after that is flagged for the user.
+        const git = site.gitRepo && destSiteId != null ? await restoreDestGit(client, destSiteId, site, createdAt, logger, () => set((s) => ({ ...s, step: "config", detail: "restoring deploy script", stageStartedAt: Date.now() }))) : undefined
+        const deployScriptLost = git?.deployScriptLost ?? false
+        const pushMismatch = git?.pushMismatch ?? false
+        const deployScriptRestored = git?.deployScriptRestored ?? false
+        logger?.log({ event: "site-done", domain: site.domain, sourceWebrootRel, destWebrootRel, deployScriptLost, deployScriptRestored, pushMismatch, settingsCarried: settings?.carried, settingsFailed: settings?.failed, basicAuthMissing: settings?.basicAuthMissing })
+        set((s) => ({ ...s, step: "done", detail: undefined, error: undefined, failedStep: undefined, sourceWebrootRel, destWebrootRel, cronAdded: cron.added, cronError: cron.ok ? undefined : cron.error, deployScriptLost, deployScriptRestored, pushMismatch, settingsCarried: settings?.carried, settingsFailed: settings?.failed, basicAuthMissing: settings?.basicAuthMissing }))
       } catch (err) {
         fail(site.step, (err as Error).message)
       }

package/src/ui/views/CloneWizard.tsx

@@ -16,7 +16,7 @@ import { Panel, Spinner } from "../components.tsx"
 import { StatusBar } from "../StatusBar.tsx"
 import { openUrl, copyToClipboard } from "../../lib/open.ts"
 import { consoleForHost } from "../../lib/providers.ts"
-import { serverWebUrl, siteGitUrl } from "../../lib/spinupweb.ts"
+import { serverWebUrl, siteGitUrl, siteWebUrl } from "../../lib/spinupweb.ts"
 import { useStore, cloneNeedsGitAccess, type CloneStep, type CloneSiteStep, type CloneSiteState, type RepoKeyState } from "../store.tsx"
 import type { VerifyCheck } from "../../lib/serverClone.ts"
 
@@ -36,6 +36,12 @@ const STEP_GITACCESS = { step: "gitaccess" as CloneStep, label: "Git access" }
 const STEP_CLONE = { step: "clone" as CloneStep, label: "Clone sites" }
 const STEP_CUTOVER = { step: "cutover" as CloneStep, label: "DNS cutover" }
 // The Git-access step only appears when a Bedrock site is selected (deploy-key onboarding).
+// A clone setting the user has to finish in SpinupWP: basic auth (its password
+// can't be read), or a setting whose carry-over failed.
+function needsSettingsHand(s: CloneSiteState): boolean {
+  return !!s.basicAuthMissing || !!s.settingsFailed?.length
+}
+
 function stepsFor(needsGit: boolean): { step: CloneStep; label: string }[] {
   return needsGit
     ? [STEP_PLAN, STEP_SERVER, STEP_TRUST, STEP_GITACCESS, STEP_CLONE, STEP_CUTOVER]
@@ -312,6 +318,9 @@ export function CloneWizard() {
           if (drilled.deployScriptLost && drilled.deployScript) copyToClipboard(drilled.deployScript)
           return openUrl(siteGitUrl(drilled.destSiteId, accountSlug))
         }
+        // w — a setting needs doing by hand (basic auth, or one that didn't carry):
+        // open the new site in SpinupWP.
+        if (name === "w" && drilled && needsSettingsHand(drilled) && drilled.destSiteId != null) return openUrl(siteWebUrl(drilled.destSiteId, accountSlug))
         return
       }
       const n = sel.length
@@ -733,7 +742,7 @@ export function CloneWizard() {
           {selected.map((s, i) => {
             const active = !["queued", "done", "error"].includes(s.step)
             const cur = i === idx
-            const vmark = (s.verify ? (s.verify.ok ? " ✓verified" : " ✕mismatch") : s.verifying ? " verifying…" : "") + (s.deployScriptLost || s.pushMismatch || s.cronError ? " · ⚠ see verify" : "")
+            const vmark = (s.verify ? (s.verify.ok ? " ✓verified" : " ✕mismatch") : s.verifying ? " verifying…" : "") + (s.deployScriptLost || s.pushMismatch || s.cronError || needsSettingsHand(s) ? " · ⚠ see verify" : "")
             return (
               <box key={s.sourceSiteId} style={{ flexDirection: "row", height: 1, backgroundColor: cur ? theme.bgAlt : undefined }}>
                 {active ? <Spinner color={theme.brand} /> : <text content={s.step === "done" ? "✓" : s.step === "error" ? "✕" : "○"} fg={s.step === "done" ? theme.good : s.step === "error" ? theme.bad : theme.textFaint} style={{ flexShrink: 0 }} />}
@@ -801,7 +810,7 @@ export function CloneWizard() {
               <box style={{ flexGrow: 1 }} />
               <text content={v.ok ? "✓ Clone matches the source." : "✕ Differences found — review the ✕ rows above."} fg={v.ok ? theme.good : theme.bad} wrapMode="none" />
               {cloneNotes(site)}
-              <text content={`v re-run${site.deployScriptLost ? " · g copy deploy script + open Git settings" : site.pushMismatch ? " · g open Git settings" : ""} · ← back to roster`} fg={theme.textFaint} wrapMode="none" />
+              <text content={`v re-run${site.deployScriptLost ? " · g copy deploy script + open Git settings" : site.pushMismatch ? " · g open Git settings" : ""}${needsSettingsHand(site) ? " · w open in SpinupWP" : ""} · ← back to roster`} fg={theme.textFaint} wrapMode="none" />
             </>
           ) : (
             <text content="Press v to compare this clone against its source." fg={theme.textDim} wrapMode="none" />
@@ -821,11 +830,21 @@ export function CloneWizard() {
     return (
       <>
         {cron ? <text content={cron.text} fg={cron.fg} wrapMode="none" /> : null}
+        {site.settingsCarried?.length ? <text content={`✓ Settings matched to the source: ${site.settingsCarried.join(" · ")}`} fg={theme.good} wrapMode="none" /> : null}
+        {site.settingsFailed?.map((f) => (
+          <text key={f.what} content={`✕ Couldn't match ${f.what}: ${f.error} — press w to set it in SpinupWP`} fg={theme.bad} wrapMode="none" />
+        ))}
+        {site.basicAuthMissing ? (
+          <text content="⚠ The source is password-protected (basic auth) and the clone isn't — SpinupWP won't reveal the password; press w to set it" fg={theme.warn} wrapMode="none" />
+        ) : null}
         {site.pushMismatch ? (
           <text content={`⚠ Push-to-deploy is ${site.pushEnabled ? "off" : "on"} here but ${site.pushEnabled ? "on" : "off"} on the source — switch it in the new site's Git settings (g)`} fg={theme.warn} wrapMode="none" />
         ) : null}
+        {site.deployScriptRestored ? (
+          <text content="✓ Deploy script: SpinupWP dropped the one set on create, so it was set again from the source" fg={theme.good} wrapMode="none" />
+        ) : null}
         {site.deployScriptLost ? (
-          <text content="⚠ SpinupWP didn't keep this site's deploy script — press g to copy the source's and paste it into the new site's Git settings" fg={theme.warn} wrapMode="none" />
+          <text content="⚠ SpinupWP didn't keep this site's deploy script, even when set again — press g to copy the source's and paste it into the new site's Git settings" fg={theme.warn} wrapMode="none" />
         ) : null}
       </>
     )
@@ -884,7 +903,7 @@ export function CloneWizard() {
       if (verifyOpen != null) {
         const drilled = job!.sites.find((s) => s.sourceSiteId === verifyOpen)
         if (drilled?.step === "error") return [{ key: "r", label: "retry site" }, { key: "←", label: "back" }, { key: "esc", label: "close" }]
-        return [{ key: "v", label: "re-run" }, ...(drilled?.deployScriptLost || drilled?.pushMismatch ? [{ key: "g", label: "Git settings" }] : []), { key: "←", label: "back" }, { key: "esc", label: "close" }]
+        return [{ key: "v", label: "re-run" }, ...(drilled?.deployScriptLost || drilled?.pushMismatch ? [{ key: "g", label: "Git settings" }] : []), ...(drilled && needsSettingsHand(drilled) ? [{ key: "w", label: "SpinupWP" }] : []), { key: "←", label: "back" }, { key: "esc", label: "close" }]
       }
       const done = selected.filter((s) => s.step === "done").length
       const errored = selected.filter((s) => s.step === "error").length